feat: expose safe pi management api

tools/thothctl/internal/pi/commands_test.go

@@ -123,8 +123,8 @@ func (f *configureRunner) Run(_ context.Context, args []string, stdin io.Reader)
 			endpoint = "https://drift.example.invalid"
 		}
 		return compose.Result{Stdout: `{"services":{"core":{"image":"thothii-core:local","environment":{"THT_LLM_URL":"` + endpoint + `"}}}}`}, nil
-	case strings.Contains(call, "/models"):
-		return compose.Result{Stdout: `{"models":[{"provider":"old","id":"old-model"},{"provider":"new","id":"new-model"}]}`}, nil
+	case strings.Contains(call, "/pi-management/options"):
+		return compose.Result{Stdout: `{"providers":["old","new"],"models":[{"provider":"old","id":"old-model"},{"provider":"new","id":"new-model"}],"reasoning":["low","medium","high"]}`}, nil
 	case strings.Contains(call, "settings-cli.js --snapshot"):
 		raw := f.settingsRaw
 		payload := map[string]any{"exists": f.settingsExist, "rawBase64": base64.StdEncoding.EncodeToString(raw)}
@@ -218,11 +218,14 @@ func TestConfigureCompensationRestoresAbsentAndExactEmptyPriorFiles(t *testing.T
 	}
 }
 
-func TestConfigureValidatesBackendModelOptionsWritesRealCoreSettingsAndUsesUpstreamIdentity(t *testing.T) {
+// Catches thothctl reading the legacy public model route instead of the admin-only closed Pi
+// Management choices before it writes shared installation defaults.
+func TestConfigureLoadsDedicatedClosedOptionsWritesRealCoreSettingsAndUsesUpstreamIdentity(t *testing.T) {
 	fake := newFakeRunner()
 	if err := Configure(context.Background(), fake, Defaults{Provider: "provider", Model: "model", Thinking: "medium"}); err != nil {
 		t.Fatal(err)
 	}
+	assertCalled(t, fake.calls, "/pi-management/options")
 	assertCalled(t, fake.calls, "node /app/backend/dist/settings/settings-cli.js --provider provider --model model --thinking medium")
 	assertCalled(t, fake.calls, "x-thoth-principal-subject: thothctl-maintenance")
 	if got := strings.Join(fake.calls, "\n"); strings.Contains(got, "pi-defaults.json") || strings.Contains(got, "secret") {
@@ -233,28 +236,47 @@ func TestConfigureValidatesBackendModelOptionsWritesRealCoreSettingsAndUsesUpstr
 	}
 }
 
-func TestTestUsesOnlySanitizedPiAndCoreProbes(t *testing.T) {
+// Catches a smoke check that composes health/models/settings itself and drifts from the dedicated
+// backend contract, rather than retaining only the independent in-container version signal.
+func TestTestUsesDedicatedSmokeEndpointAndIndependentImageVersionProbe(t *testing.T) {
 	fake := newFakeRunner()
 	if err := Test(context.Background(), fake); err != nil {
 		t.Fatalf("Test() error = %v", err)
 	}
-	for _, command := range []string{"pi --version", "/health", "/models", "/settings"} {
+	for _, command := range []string{"pi --version", "/pi-management/test", "x-thoth-principal-subject: thothctl-maintenance"} {
 		assertCalled(t, fake.calls, command)
 	}
+	for _, legacy := range []string{"/health", "/models", "/settings"} {
+		if strings.Contains(strings.Join(fake.calls, "\n"), legacy) {
+			t.Fatalf("Pi smoke invoked legacy endpoint %q: %s", legacy, strings.Join(fake.calls, "\n"))
+		}
+	}
 	if got := strings.Join(fake.calls, "\n"); strings.Contains(got, "secret") {
 		t.Fatalf("probe commands expose secret: %s", got)
 	}
 }
 
-func TestTestRequiresConfiguredProviderAndModelToMatchOneAvailableEntry(t *testing.T) {
+// Catches an ignored negative ready result from the backend smoke endpoint, which would report a
+// successfully verified candidate image while its configured Pi runtime is unusable.
+func TestTestRequiresDedicatedSmokeEndpointToReportReady(t *testing.T) {
 	fake := newFakeRunner()
-	fake.modelsWire = `{"models":[{"id":"different-model","provider":"provider"}]}`
-	if err := Test(context.Background(), fake); err == nil || !strings.Contains(err.Error(), "configured provider/model") {
-		t.Fatalf("Test() error = %v, want exact settings/model mismatch", err)
+	fake.piManagementTestWire = `{"ready":false,"message":"provider unavailable"}`
+	if err := Test(context.Background(), fake); err == nil || !strings.Contains(err.Error(), "Pi smoke response is not ready") {
+		t.Fatalf("Test() error = %v, want negative dedicated smoke result", err)
 	}
-	fake.modelsWire = `{"models":[{"id":"model","provider":"provider"}]}`
+	fake.piManagementTestWire = `{"ready":true}`
 	if err := Test(context.Background(), fake); err != nil {
 		t.Fatalf("Test() exact match error = %v", err)
 	}
 	assertCalled(t, fake.calls, "pi --version")
 }
+
+// Catches thothctl accepting a reasoning level that the backend did not publish as a closed
+// installation option, which would bypass the Pi Management validation surface.
+func TestConfigureRejectsReasoningOutsideDedicatedClosedOptions(t *testing.T) {
+	fake := newFakeRunner()
+	fake.piManagementOptionsWire = `{"providers":["provider"],"models":[{"provider":"provider","id":"model"}],"reasoning":["low"]}`
+	if err := Configure(context.Background(), fake, Defaults{Provider: "provider", Model: "model", Thinking: "high"}); err == nil || !strings.Contains(err.Error(), "Pi options") {
+		t.Fatalf("Configure() error = %v, want closed reasoning rejection", err)
+	}
+}