fix: harden thothctl pi lifecycle

tools/thothctl/cmd/thothctl/main.go

@@ -30,9 +30,11 @@ Commands:
   pi status           Show the Pi version embedded in core.
   pi doctor           Check Pi preconditions without changing the installation.
   pi test             Run the temporary Pi/core smoke checks.
+  pi check            Alias for pi test.
+  pi configure        Store non-secret Pi defaults (credentials stay in PI_AUTH_FILE).
   pi update           Rebuild or pull a pinned Pi image (requires --yes).
   pi rollback --yes   Restore the image recorded by the latest Pi update.
-  pi logs [--follow]  Show sanitized core logs.
+  pi logs             Show the latest sanitized core logs.
 `
 
 func main() {
@@ -156,13 +158,22 @@ func piCommand(ctx context.Context, installation config.Installation, runner com
 		fmt.Fprintln(stdout, "Pi/core smoke checks passed.")
 		return 0
 	case "logs":
-		logArgs, err := logsArgs(args[1:])
-		if err != nil {
-			return commandUsageError(stderr, "pi logs accepts only --follow")
+		if len(args) != 1 {
+			return commandUsageError(stderr, "pi logs does not support --follow; use bounded snapshots")
 		}
-		logArgs = append(logArgs, "core")
+		logArgs := []string{"logs", "--tail", "200", "core"}
 		result, err := controlled.Run(ctx, append([]string{"compose"}, logArgs...), nil)
 		return writeResult(result, err, secretValues, stdout, stderr)
+	case "configure":
+		defaults, err := parsePiConfigureArgs(args[1:])
+		if err != nil {
+			return commandUsageError(stderr, err.Error())
+		}
+		if err := pi.Configure(ctx, controlled, filepath.Join(installation.ProjectDirectory, ".thothctl", "pi-defaults.json"), defaults); err != nil {
+			return piFailure(stderr, err, secretValues)
+		}
+		fmt.Fprintln(stdout, "Pi defaults saved. Put credentials only in the configured PI_AUTH_FILE (mode 0600).")
+		return 0
 	case "update":
 		request, err := parsePiUpdateArgs(args[1:], filepath.Join(installation.ProjectDirectory, ".thothctl", "update-state.json"))
 		if err != nil {
@@ -193,6 +204,33 @@ func piCommand(ctx context.Context, installation config.Installation, runner com
 	}
 }
 
+func parsePiConfigureArgs(args []string) (pi.Defaults, error) {
+	var value pi.Defaults
+	for len(args) > 0 {
+		if len(args) < 2 {
+			return pi.Defaults{}, errors.New("configure options require values")
+		}
+		key, v := args[0], args[1]
+		args = args[2:]
+		switch key {
+		case "--provider":
+			value.Provider = v
+		case "--model":
+			value.Model = v
+		case "--thinking":
+			value.Thinking = v
+		case "--llm-url":
+			value.LLMURL = v
+		default:
+			return pi.Defaults{}, fmt.Errorf("unknown pi configure option %q", key)
+		}
+	}
+	if value.Provider == "" || value.Model == "" || value.Thinking == "" || value.LLMURL == "" {
+		return pi.Defaults{}, errors.New("pi configure requires --provider --model --thinking --llm-url")
+	}
+	return value, nil
+}
+
 func parsePiUpdateArgs(args []string, statePath string) (pi.Request, error) {
 	request := pi.Request{StatePath: statePath, Source: pi.BuildSource}
 	for len(args) > 0 {