fix: use Pi user auth and handle startup failures

backend/src/app.ts

@@ -95,7 +95,8 @@ export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstanc
   app.get("/health/dwh", async () => tht.dbPing());
   app.get("/me", async (req) => getPrincipal(req));
   sessionRoutes(app, {
-    mgr, tht: tht as ThtRunner, hub, getSettings, readiness, dwhPrecheck: config.dwhPrecheck,
+    mgr, tht: tht as ThtRunner, hub, getSettings, readiness, listModels,
+    dwhPrecheck: config.dwhPrecheck,
   });
   sqlRoutes(app, { tht: tht as ThtRunner, getSettings });
   metaRoutes(app, { harnessDir: config.harnessDir, listModels });

backend/src/routes/sessions.ts

@@ -6,6 +6,7 @@ import type { Settings } from "../settings/settings-store.js";
 import { getPrincipal } from "../auth/auth.js";
 import type { PrincipalContext } from "../auth/principal.js";
 import type { ReadinessManager } from "../runtime/readiness-manager.js";
+import type { ListModelsFn } from "./meta.js";
 
 const BOOTSTRAP_FAILURE_MESSAGE =
   "Session startup failed. Check configuration and connectivity, then Resume the session.";
@@ -15,6 +16,8 @@ const RESUME_FAILURE_MESSAGE =
   "Session could not be resumed. Check configuration and connectivity, then try again.";
 const DWH_UNREACHABLE_MESSAGE =
   "Cannot start a session: the database is unreachable. Check the VPN connection and try again.";
+const MODEL_UNAVAILABLE_MESSAGE =
+  "Selected model is unavailable. Check Pi authentication and model settings, then try again.";
 
 export function sessionRoutes(
   app: FastifyInstance,
@@ -22,6 +25,7 @@ export function sessionRoutes(
     mgr: PiProcessManager; tht: ThtRunner; hub: SseHub;
     getSettings: (principal: PrincipalContext) => Promise<Settings>;
     readiness: ReadinessManager;
+    listModels: ListModelsFn;
     /** Local-only guard: probe DWH reachability before creating a session (run-stack.sh). */
     dwhPrecheck?: boolean;
   },
@@ -189,6 +193,26 @@ export function sessionRoutes(
         return reply.code(503).send({ error: DWH_UNREACHABLE_MESSAGE, code: "dwh_unreachable" });
       }
     }
+    if (s.provider && s.model) {
+      let available: Awaited<ReturnType<ListModelsFn>>;
+      try {
+        available = await d.listModels();
+      } catch {
+        return reply.code(503).send({
+          error: MODEL_UNAVAILABLE_MESSAGE,
+          code: "model_unavailable",
+        });
+      }
+      const selectedAvailable = available.some(
+        (candidate) => candidate.provider === s.provider && candidate.id === s.model,
+      );
+      if (!selectedAvailable) {
+        return reply.code(503).send({
+          error: MODEL_UNAVAILABLE_MESSAGE,
+          code: "model_unavailable",
+        });
+      }
+    }
     // Settings (global) supply workspace/provider/model/thinking. The new-question
     // form sends only the question text. `workspace` selects the tht `-c <config>`.
     let id: string;
@@ -206,8 +230,21 @@ export function sessionRoutes(
       principal,
       question: b.question,
     };
-    const rt = d.mgr.createFor(id, options);
-    bindRuntime(id, rt, runner, s.workspace);
+    let rt: ReturnType<PiProcessManager["createFor"]> | undefined;
+    try {
+      rt = d.mgr.createFor(id, options);
+      bindRuntime(id, rt, runner, s.workspace);
+    } catch (error) {
+      if (rt) d.mgr.teardownIfCurrent(id, rt);
+      console.error(
+        `[pi:${id}] runtime construction failed:`,
+        error instanceof Error ? error.message : "unknown error",
+      );
+      await runner.failSession(id, s.workspace).catch((persistenceError: unknown) => {
+        console.error(`[session:${id}] failSession persistence failed:`, persistenceError);
+      });
+      return reply.code(503).send({ error: BOOTSTRAP_FAILURE_MESSAGE });
+    }
     info(id, "Session created");
     bootstrap(
       id, rt, runner, s.workspace, d.mgr.configure(rt, options),