feat: establish unified administration and model context baseline

backend/test/list-models.test.ts

@@ -56,7 +56,7 @@ test("catalog listing translates upstream Pi IDs back to canonical model keys",
     session: { reasoning: true, contextWindow: 32768, maxTokens: 8192 },
   };
   const modelCatalog: RuntimeModelCatalog = {
-    defaultSession: model.id, defaultMetadataGeneration: null, embedding: null,
+    defaultInteraction: model.id, embedding: null,
     sessionModels: () => [model], metadataModels: () => [], hasSession: (id) => id === model.id,
   };
   try {
@@ -75,6 +75,38 @@ test("catalog listing translates upstream Pi IDs back to canonical model keys",
   }
 });
 
+test("catalog listing supplies the shared DeepSeek key without requiring Pi auth", async () => {
+  const script = scriptWith([{ provider: "deepseek", id: "deepseek-v4-pro", name: "DeepSeek V4 Pro" }]);
+  const secret = join(path.dirname(script), "thothii.secrets");
+  writeFileSync(secret, "DEEPSEEK_API_KEY=shared-key\nOPENAI_API_KEY=unrelated-key\n", { mode: 0o600 });
+  const model: RuntimeModel = {
+    id: "deepseek/deepseek-v4-pro", provider: "deepseek", model: "deepseek-v4-pro",
+    label: "DeepSeek V4 Pro", upstreamModel: "deepseek-v4-pro",
+    authentication: { mode: "secret_env", apiKeyEnv: "DEEPSEEK_API_KEY" },
+    sessionAdapter: { mode: "pi_builtin" }, session: { reasoning: false },
+  };
+  const modelCatalog: RuntimeModelCatalog = {
+    defaultInteraction: model.id, embedding: null,
+    sessionModels: () => [model], metadataModels: () => [], hasSession: (id) => id === model.id,
+  };
+  try {
+    const lister = createPiModelLister(loadConfig({ THT_SECRETS_FILE: secret }), {
+      ...noManagedModels, modelCatalog, loadEnabledModels: enabled(model.id),
+      spawnFn: (_command, _args, options) => {
+        expect(options.env.DEEPSEEK_API_KEY).toBe("shared-key");
+        expect(options.env).not.toHaveProperty("OPENAI_API_KEY");
+        expect(options.env).not.toHaveProperty("THT_SECRETS_FILE");
+        return spawn("node", [FAKE, script], { env: options.env }) as any;
+      },
+    });
+    await expect(lister()).resolves.toEqual([{
+      provider: model.provider, id: model.model, name: model.label, reasoning: false,
+    }]);
+  } finally {
+    rmSync(path.dirname(script), { recursive: true, force: true });
+  }
+});
+
 test("createPiModelLister caches within ttl (spawns once for two calls)", async () => {
   const script = scriptWith([{ provider: "zai", id: "glm-5.2", name: "GLM 5.2", reasoning: true }]);
   try {

backend/test/metadata-generation-models.test.ts

@@ -20,9 +20,8 @@ function runtimeCatalog(overrides: Record<string, unknown> = {}, secrets = "OPEN
   const catalogFile = join(root, "catalog.json");
   const secretsFile = join(root, "thothii.secrets");
   const catalog = {
-    schemaVersion: 1,
-    defaultSession: "zai/glm-5.3",
-    defaultMetadataGeneration: "zai/glm-5.3",
+    schemaVersion: 2,
+    defaultInteraction: "zai/glm-5.3",
     embedding: { id: "ollama/qwen3-embedding:0.6b", dimensions: 1024 },
     models: [
       {
@@ -55,8 +54,8 @@ test("loads session default and safe metadata choices from the normalized runtim
   const runtime = loadRuntimeModelCatalog(catalogFile);
   const metadata = loadMetadataGenerationModels({ catalogFile, secretsFile });
 
-  expect(runtime.defaultSession).toBe("zai/glm-5.3");
-  expect(runtime.hasSession("deepseek/deepseek-v4-pro")).toBe(true);
+  expect(runtime.defaultInteraction).toBe("zai/glm-5.3");
+  expect(runtime.hasSession("deepseek/deepseek-v4-pro")).toBe(false);
   expect(metadata.catalog()).toEqual({
     models: [{ id: "zai/glm-5.3", label: "GLM 5.3" }],
     default: "zai/glm-5.3",
@@ -69,14 +68,36 @@ test("loads session default and safe metadata choices from the normalized runtim
   expect(() => metadata.resolve("zai/missing")).toThrow(MetadataGenerationModelUnavailableError);
 });
 
+test("DeepSeek uses one identity and bundle credential for native Pi and LiteLLM", () => {
+  const models = ["deepseek-v4-pro", "deepseek-v4-flash"].map((model) => ({
+    id: `deepseek/${model}`, provider: "deepseek", model, label: model, upstreamModel: model,
+    authentication: { mode: "secret_env", apiKeyEnv: "DEEPSEEK_API_KEY" },
+    sessionAdapter: { mode: "pi_builtin" }, metadataAdapter: { litellmProvider: "deepseek" },
+    session: { reasoning: false }, metadataGeneration: { disableThinking: false },
+  }));
+  const files = runtimeCatalog({ defaultInteraction: models[0].id, models }, "DEEPSEEK_API_KEY=shared-key\n");
+  const runtime = loadRuntimeModelCatalog(files.catalogFile);
+  const metadata = loadMetadataGenerationModels(files);
+  expect(runtime.sessionModels().map((model) => model.id)).toEqual(metadata.catalog().models.map((model) => model.id));
+  expect(metadata.catalog().default).toBe(runtime.defaultInteraction);
+  for (const model of models) {
+    expect(metadata.resolve(model.id)).toMatchObject({
+      id: model.id, provider: "deepseek", model: model.model,
+      apiKeyEnv: "DEEPSEEK_API_KEY", apiKey: "shared-key",
+    });
+  }
+  expect(() => metadata.resolve("deepseek-metadata/deepseek-v4-pro"))
+    .toThrow(MetadataGenerationModelUnavailableError);
+});
+
 test("returns empty catalogs when no runtime projection is configured", () => {
-  expect(loadRuntimeModelCatalog().defaultSession).toBeNull();
+  expect(loadRuntimeModelCatalog().defaultInteraction).toBeNull();
   expect(loadMetadataGenerationModels({}).catalog()).toEqual({ models: [], default: null });
 });
 
 test("rejects a drifted default and an unprotected projection", () => {
-  const drifted = runtimeCatalog({ defaultSession: "zai/missing" });
-  expect(() => loadRuntimeModelCatalog(drifted.catalogFile)).toThrow("session default is invalid");
+  const drifted = runtimeCatalog({ defaultInteraction: "zai/missing" });
+  expect(() => loadRuntimeModelCatalog(drifted.catalogFile)).toThrow("interaction default is invalid");
 
   const unprotected = runtimeCatalog();
   chmodSync(unprotected.catalogFile, 0o666);
@@ -85,7 +106,7 @@ test("rejects a drifted default and an unprotected projection", () => {
 
 test("rejects authentication semantics that cannot come from the installation catalog", () => {
   const invalid = runtimeCatalog({
-    defaultMetadataGeneration: undefined,
+    defaultInteraction: undefined,
     models: [{
       id: "zai/glm-5.3",
       provider: "zai",
@@ -112,3 +133,13 @@ test("splits canonical session identities without provider aliases", () => {
   expect(splitCanonicalModelId("zai/glm-5.3")).toEqual({ provider: "zai", model: "glm-5.3" });
   expect(() => splitCanonicalModelId("glm-5.3")).toThrow("model identity is invalid");
 });
+
+test("rejects a default supported by only one configured use", () => {
+  const { catalogFile } = runtimeCatalog({ defaultInteraction: "deepseek/deepseek-v4-pro" });
+  expect(() => loadRuntimeModelCatalog(catalogFile)).toThrow("interaction default is invalid");
+});
+
+test("requires regenerated runtime schema v2 rather than interpreting two legacy defaults", () => {
+  const { catalogFile } = runtimeCatalog({ schemaVersion: 1, defaultSession: "zai/glm-5.3" });
+  expect(() => loadRuntimeModelCatalog(catalogFile)).toThrow("runtime model catalog is invalid");
+});

backend/test/pi-management.test.ts

@@ -1,4 +1,4 @@
-import { mkdtempSync } from "node:fs";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { expect, test, vi } from "vitest";
@@ -7,7 +7,34 @@ import {
   createPiManagement,
   type PiExecFile,
 } from "../src/pi/management.js";
-import type { RuntimeModelCatalog } from "../src/models/runtime-model-catalog.js";
+import type { RuntimeModel, RuntimeModelCatalog } from "../src/models/runtime-model-catalog.js";
+
+test.each([false, true])("catalog credential status ignores legacy Pi auth, missing bundle key: %s", async (missingKey) => {
+  const root = mkdtempSync(join(tmpdir(), "tht-catalog-status-"));
+  writeFileSync(join(root, "auth.json"), JSON.stringify({ deepseek: { type: "api_key", key: "stale-key" } }), { mode: 0o600 });
+  const secret = join(root, "thothii.secrets");
+  writeFileSync(secret, missingKey ? "THT_MODEL_API_KEY=legacy-key\n" : "DEEPSEEK_API_KEY=shared-key\n", { mode: 0o600 });
+  vi.stubEnv("PI_CODING_AGENT_DIR", root);
+  const model: RuntimeModel = {
+    id: "deepseek/deepseek-v4-pro", provider: "deepseek", model: "deepseek-v4-pro",
+    label: "DeepSeek", upstreamModel: "deepseek-v4-pro",
+    authentication: { mode: "secret_env", apiKeyEnv: "DEEPSEEK_API_KEY" },
+    sessionAdapter: { mode: "pi_builtin" }, session: { reasoning: false },
+  };
+  try {
+    const service = createPiManagement(loadConfig({ THT_SECRETS_FILE: secret }), {
+      modelCatalog: {
+        defaultInteraction: model.id, embedding: null,
+        sessionModels: () => [model], metadataModels: () => [], hasSession: (id) => id === model.id,
+      },
+      execute: successfulExec([]), readSettings: () => ({ thinking: "medium" }),
+    });
+    expect((await service.status()).credentials).toBe(missingKey ? "missing" : "present");
+  } finally {
+    vi.unstubAllEnvs();
+    rmSync(root, { recursive: true, force: true });
+  }
+});
 
 function configFor(settingsFile = join(mkdtempSync(join(tmpdir(), "tht-pi-management-")), "settings.json")) {
   return loadConfig({
@@ -19,8 +46,7 @@ function configFor(settingsFile = join(mkdtempSync(join(tmpdir(), "tht-pi-manage
 }
 
 const modelCatalog: RuntimeModelCatalog = {
-  defaultSession: "zai/glm-5.2",
-  defaultMetadataGeneration: null,
+  defaultInteraction: "zai/glm-5.2",
   embedding: { id: "ollama/qwen3-embedding:0.6b", dimensions: 1024 },
   sessionModels: () => [],
   metadataModels: () => [],

backend/test/pi-process-manager.test.ts

@@ -642,27 +642,33 @@ test("session Pi spawn reads the single secret bundle and scrubs its path", asyn
   }
 });
 
-test("session Pi spawn resolves the selected catalog credential from the secret bundle", () => {
+test.each([false, true])("session Pi uses the catalog bundle despite stale Pi auth: %s", (missingKey) => {
   const root = mkdtempSync(path.join(tmpdir(), "thothii-catalog-credential-"));
   const agentDir = path.join(root, "agent");
   mkdirSync(agentDir, { mode: 0o700 });
-  writeFileSync(path.join(agentDir, "auth.json"), "{}\n", { mode: 0o600 });
+  const originalAuth = JSON.stringify({
+    deepseek: { type: "api_key", key: "stale-key" },
+    anthropic: { type: "api_key", key: "unrelated-key" },
+  });
+  writeFileSync(path.join(agentDir, "auth.json"), originalAuth, { mode: 0o600 });
   writeFileSync(path.join(agentDir, "models.json"), '{"providers":{}}\n', { mode: 0o600 });
   const secret = path.join(root, "thothii.secrets");
-  writeFileSync(secret, "ZAI_API_KEY=catalog-secret\nTHT_MODEL_API_KEY=legacy-secret\n", { mode: 0o600 });
+  writeFileSync(secret, missingKey ? "THT_MODEL_API_KEY=legacy-secret\n"
+    : "DEEPSEEK_API_KEY=catalog-secret\nTHT_MODEL_API_KEY=legacy-secret\n", { mode: 0o600 });
+  const legacyKey = path.join(root, "legacy-key");
+  writeFileSync(legacyKey, "legacy-file-key", { mode: 0o600 });
   const model: RuntimeModel = {
-    id: "openai/test-model",
-    provider: "openai",
-    model: "test-model",
-    label: "Test model",
-    upstreamModel: "test-model",
-    authentication: { mode: "secret_env", apiKeyEnv: "ZAI_API_KEY" },
+    id: "deepseek/deepseek-v4-pro",
+    provider: "deepseek",
+    model: "deepseek-v4-pro",
+    label: "DeepSeek V4 Pro",
+    upstreamModel: "deepseek-v4-pro",
+    authentication: { mode: "secret_env", apiKeyEnv: "DEEPSEEK_API_KEY" },
     sessionAdapter: { mode: "pi_builtin" },
     session: { reasoning: false },
   };
   const modelCatalog: RuntimeModelCatalog = {
-    defaultSession: model.id,
-    defaultMetadataGeneration: null,
+    defaultInteraction: model.id,
     embedding: null,
     sessionModels: () => [model],
     metadataModels: () => [],
@@ -672,17 +678,26 @@ test("session Pi spawn resolves the selected catalog credential from the secret
   const child = recordingChild();
   child.stderr.resume = () => {};
   vi.stubEnv("PI_CODING_AGENT_DIR", agentDir);
-  const mgr = new PiProcessManager(loadConfig({ THT_SECRETS_FILE: secret }), {
+  const mgr = new PiProcessManager(loadConfig({ THT_SECRETS_FILE: secret, THT_MODEL_API_KEY_FILE: legacyKey }), {
     modelCatalog,
-    authProviders: () => new Set(),
+    authProviders: () => new Set(["deepseek"]),
     spawnFn: (...args: any[]) => { calls.push(args); return child as any; },
   });
   try {
-    mgr.createFor("catalog-credential", { provider: "openai", model: "test-model" });
-    expect(calls[0][2].env.ZAI_API_KEY).toBe("catalog-secret");
+    const create = () => mgr.createFor("catalog-credential", { provider: model.provider, model: model.model });
+    if (missingKey) {
+      expect(create).toThrow("model provider credential is unavailable");
+      expect(calls).toHaveLength(0);
+      return;
+    }
+    create();
+    expect(calls[0][2].env.DEEPSEEK_API_KEY).toBe("catalog-secret");
     expect(calls[0][2].env).not.toHaveProperty("OPENAI_API_KEY");
     expect(calls[0][2].env).not.toHaveProperty("THT_MODEL_API_KEY");
+    expect(JSON.parse(readFileSync(path.join(calls[0][2].env.PI_CODING_AGENT_DIR, "auth.json"), "utf8")))
+      .toEqual({ anthropic: { type: "api_key", key: "unrelated-key" } });
   } finally {
+    expect(readFileSync(path.join(agentDir, "auth.json"), "utf8")).toBe(originalAuth);
     mgr.teardown("catalog-credential");
     vi.unstubAllEnvs();
     rmSync(root, { recursive: true, force: true });
@@ -750,7 +765,7 @@ test("set_model translates a canonical catalog key to its upstream Pi model ID",
     session: { reasoning: false, contextWindow: 32768, maxTokens: 8192 },
   };
   const modelCatalog: RuntimeModelCatalog = {
-    defaultSession: model.id, defaultMetadataGeneration: null, embedding: null,
+    defaultInteraction: model.id, embedding: null,
     sessionModels: () => [model], metadataModels: () => [], hasSession: (id) => id === model.id,
   };
   const mgr = new PiProcessManager(loadConfig({ PI_BIN: "/usr/local/bin/pi" }), {

backend/test/pi-provider-smoke.test.ts

@@ -61,20 +61,22 @@ test("provider smoke resolves the selected catalog credential from the secret bu
     session: { reasoning: false },
   };
   const modelCatalog: RuntimeModelCatalog = {
-    defaultSession: model.id,
-    defaultMetadataGeneration: null,
+    defaultInteraction: model.id,
     embedding: null,
     sessionModels: () => [model],
     metadataModels: () => [],
     hasSession: (id) => id === model.id,
   };
   let spawnEnv: NodeJS.ProcessEnv | undefined;
+  const readAuthStore = vi.fn(() => JSON.stringify({ openai: { type: "api_key", key: "stale-key" } }));
   const smoke = createPiProviderSmoke(loadConfig({ THT_SECRETS_FILE: secret }), {
     modelCatalog,
-    authProviders: () => new Set(),
+    authProviders: () => new Set(["openai"]),
+    readAuthStore,
     readModelsStore: () => undefined,
     spawnFn: (_command, _args, options) => {
       spawnEnv = options.env;
+      expect(existsSync(join(options.env.PI_CODING_AGENT_DIR!, "auth.json"))).toBe(false);
       return successfulProviderChild();
     },
   });
@@ -85,6 +87,7 @@ test("provider smoke resolves the selected catalog credential from the secret bu
     expect(spawnEnv?.ZAI_API_KEY).toBe("catalog-secret");
     expect(spawnEnv).not.toHaveProperty("OPENAI_API_KEY");
     expect(spawnEnv).not.toHaveProperty("THT_MODEL_API_KEY");
+    expect(readAuthStore).not.toHaveBeenCalled();
   } finally {
     rmSync(root, { recursive: true, force: true });
   }
@@ -306,7 +309,7 @@ test("provider smoke makes one configured request from an isolated no-capability
     sessionAdapter: { mode: "pi_builtin" }, session: { reasoning: true },
   };
   const smokeCatalog: RuntimeModelCatalog = {
-    defaultSession: smokeModel.id, defaultMetadataGeneration: null, embedding: null,
+    defaultInteraction: smokeModel.id, embedding: null,
     sessionModels: () => [smokeModel], metadataModels: () => [],
     hasSession: (id) => id === smokeModel.id,
   };

backend/test/routes-sessions.test.ts

@@ -27,10 +27,9 @@ function operationalWorkspace(id = "default") {
   } as const;
 }
 
-function sessionCatalog(defaultSession = "zai/glm-5.2", available = [defaultSession]) {
+function sessionCatalog(defaultInteraction = "zai/glm-5.2", available = [defaultInteraction]) {
   return {
-    defaultSession,
-    defaultMetadataGeneration: null,
+    defaultInteraction,
     embedding: { id: "ollama/qwen3-embedding:0.6b", dimensions: 1024 },
     sessionModels: () => [],
     metadataModels: () => [],
@@ -909,7 +908,7 @@ test("session lifecycle locates a B session when installation default is A", asy
 
   active = undefined;
   expect((await app.inject({ method: "POST", url: "/sessions/session-b/resume" })).json())
-    .toEqual({ id: "session-b", alreadyActive: false });
+    .toEqual({ id: "session-b", alreadyActive: false, workspaceId: "b-workspace" });
   expect(calls).toContain(`new:${bPath}`);
   expect(calls).toContain(`list:${bPath}`);
   expect(calls).toContain(`show:${bPath}`);
@@ -1179,6 +1178,29 @@ test("POST /sessions/:id/resume uses the manifest's retained workspace revision"
   );
 });
 
+test.each([undefined, { provider: "local", model: "qwen" }])("resume uses the global model/default, not the historical manifest (%j)", async (payload) => {
+  const configure = vi.fn(async () => {});
+  const manifest = { status: "open", archived: false, provider: "retired", model: "old-model" };
+  const runtime = { bridge: { onClientEvent: () => {}, emitClientEvent: () => {} } };
+  let current: any;
+  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
+    mgr: {
+      get: () => current,
+      createFor: () => { current = runtime; return runtime; },
+      configure, start: () => {},
+    } as any,
+    thtRunner: { sessionShow: async () => manifest, reopenSession: async () => {} } as any,
+    readiness: { ensure: async () => ({ ok: true }) } as any,
+    runtimeModelCatalog: sessionCatalog("zai/glm-5.2", ["zai/glm-5.2", "local/qwen"]),
+    getSettings: () => ({ workspace: "psd", thinking: "medium" }) as any,
+  });
+  const response = await app.inject({ method: "POST", url: "/sessions/model-resume/resume", ...(payload ? { payload } : {}) });
+  expect(response.statusCode).toBe(200);
+  await new Promise((resolve) => setImmediate(resolve));
+  expect(configure).toHaveBeenCalledWith(expect.anything(), expect.objectContaining(payload ?? { provider: "zai", model: "glm-5.2" }));
+  expect(manifest).toMatchObject({ provider: "retired", model: "old-model" });
+});
+
 test("POST /sessions/:id/resume returns a sanitized error when its retained revision is unavailable", async () => {
   const rawFailure = "cannot read /data/workspace-registry/snapshots/secret-revision";
   const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
@@ -2691,7 +2713,7 @@ test("POST /sessions proceeds when ollamaEnsure succeeds", async () => {
   expect(ensureWs).toContain(`/snapshots/${"e".repeat(40)}/psd.yaml`);
 });
 
-test("POST /sessions falls back from a stale requested model to the catalog default", async () => {
+test("POST /sessions rejects a stale requested model without silently using the default", async () => {
   let created = 0;
   let persisted: any;
   const runtime = { bridge: { onClientEvent: () => {} } };
@@ -2721,13 +2743,10 @@ test("POST /sessions falls back from a stale requested model to the catalog defa
     payload: { question: "q", provider: "deepseek", model: "deepseek-v4-pro" },
   });
 
-  expect(res.statusCode).toBe(200);
-  expect(res.json()).toEqual({
-    id: "fallback",
-    warning: "Configured model deepseek/deepseek-v4-pro is unavailable; using zai/glm-5.2.",
-  });
-  expect(persisted).toMatchObject({ provider: "zai", model: "glm-5.2" });
-  expect(created).toBe(1);
+  expect(res.statusCode).toBe(503);
+  expect(res.json()).toMatchObject({ code: "model_unavailable" });
+  expect(persisted).toBeUndefined();
+  expect(created).toBe(0);
 });
 
 test("POST /sessions marks a persisted session failed when runtime construction throws", async () => {

backend/test/routes-sql-meta.test.ts

@@ -160,8 +160,7 @@ test("GET /models returns session choices from the installation model catalog",
   const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
     thtRunner: {} as any,
     runtimeModelCatalog: {
-      defaultSession: "zai/glm-5.2",
-      defaultMetadataGeneration: null,
+      defaultInteraction: "zai/glm-5.2",
       embedding: { id: "ollama/qwen3-embedding:0.6b", dimensions: 1024 },
       sessionModels: () => [{
         id: "zai/glm-5.2", provider: "zai", model: "glm-5.2", label: "GLM 5.2",
@@ -187,8 +186,7 @@ test("GET /models returns an empty list when the catalog has no session models",
   const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
     thtRunner: {} as any,
     runtimeModelCatalog: {
-      defaultSession: null,
-      defaultMetadataGeneration: null,
+      defaultInteraction: null,
       embedding: null,
       sessionModels: () => [],
       metadataModels: () => [],