refactor: add aws-sdk auth mode and tighten provider auth

src/agents/pi-embedded-runner/compact.ts

@@ -115,7 +115,13 @@ export async function compactEmbeddedPiSession(params: {
           agentDir,
         });
 
-        if (model.provider === "github-copilot") {
+        if (!apiKeyInfo.apiKey) {
+          if (apiKeyInfo.mode !== "aws-sdk") {
+            throw new Error(
+              `No API key resolved for provider "${model.provider}" (auth mode: ${apiKeyInfo.mode}).`,
+            );
+          }
+        } else if (model.provider === "github-copilot") {
           const { resolveCopilotApiToken } =
             await import("../../providers/github-copilot-token.js");
           const copilotToken = await resolveCopilotApiToken({

src/agents/pi-embedded-runner/model.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+
+import { buildInlineProviderModels } from "./model.js";
+
+const makeModel = (id: string) => ({
+  id,
+  name: id,
+  reasoning: false,
+  input: ["text"] as const,
+  cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+  contextWindow: 1,
+  maxTokens: 1,
+});
+
+describe("buildInlineProviderModels", () => {
+  it("attaches provider ids to inline models", () => {
+    const providers = {
+      " alpha ": { models: [makeModel("alpha-model")] },
+      beta: { models: [makeModel("beta-model")] },
+    };
+
+    const result = buildInlineProviderModels(providers);
+
+    expect(result).toEqual([
+      { ...makeModel("alpha-model"), provider: "alpha" },
+      { ...makeModel("beta-model"), provider: "beta" },
+    ]);
+  });
+});

src/agents/pi-embedded-runner/model.ts

@@ -2,9 +2,23 @@ import type { Api, Model } from "@mariozechner/pi-ai";
 import { discoverAuthStorage, discoverModels } from "@mariozechner/pi-coding-agent";
 
 import type { ClawdbotConfig } from "../../config/config.js";
+import type { ModelDefinitionConfig } from "../../config/types.js";
 import { resolveClawdbotAgentDir } from "../agent-paths.js";
 import { DEFAULT_CONTEXT_TOKENS } from "../defaults.js";
 import { normalizeModelCompat } from "../model-compat.js";
+import { normalizeProviderId } from "../model-selection.js";
+
+type InlineModelEntry = ModelDefinitionConfig & { provider: string };
+
+export function buildInlineProviderModels(
+  providers: Record<string, { models?: ModelDefinitionConfig[] }>,
+): InlineModelEntry[] {
+  return Object.entries(providers).flatMap(([providerId, entry]) => {
+    const trimmed = providerId.trim();
+    if (!trimmed) return [];
+    return (entry?.models ?? []).map((model) => ({ ...model, provider: trimmed }));
+  });
+}
 
 export function buildModelAliasLines(cfg?: ClawdbotConfig) {
   const models = cfg?.agents?.defaults?.models ?? {};
@@ -38,12 +52,12 @@ export function resolveModel(
   const model = modelRegistry.find(provider, modelId) as Model<Api> | null;
   if (!model) {
     const providers = cfg?.models?.providers ?? {};
-    const inlineModels =
-      providers[provider]?.models?.map((entry) => ({ ...entry, provider })) ??
-      Object.values(providers)
-        .flatMap((entry) => entry?.models ?? [])
-        .map((entry) => ({ ...entry, provider }));
-    const inlineMatch = inlineModels.find((entry) => entry.id === modelId);
+    const inlineModels = buildInlineProviderModels(providers);
+    const normalizedProvider = normalizeProviderId(provider);
+    const inlineMatch = inlineModels.find(
+      (entry) =>
+        normalizeProviderId(entry.provider) === normalizedProvider && entry.id === modelId,
+    );
     if (inlineMatch) {
       const normalized = normalizeModelCompat(inlineMatch as Model<Api>);
       return {

src/agents/pi-embedded-runner/run.ts

@@ -21,6 +21,7 @@ import {
   ensureAuthProfileStore,
   getApiKeyForModel,
   resolveAuthProfileOrder,
+  type ResolvedProviderAuth,
 } from "../model-auth.js";
 import { ensureClawdbotModelsJson } from "../models-config.js";
 import {
@@ -47,11 +48,7 @@ import { buildEmbeddedRunPayloads } from "./run/payloads.js";
 import type { EmbeddedPiAgentMeta, EmbeddedPiRunResult } from "./types.js";
 import { describeUnknownError } from "./utils.js";
 
-type ApiKeyInfo = {
-  apiKey: string;
-  profileId?: string;
-  source: string;
-};
+type ApiKeyInfo = ResolvedProviderAuth;
 
 export async function runEmbeddedPiAgent(
   params: RunEmbeddedPiAgentParams,
@@ -151,6 +148,15 @@ export async function runEmbeddedPiAgent(
 
       const applyApiKeyInfo = async (candidate?: string): Promise<void> => {
         apiKeyInfo = await resolveApiKeyForCandidate(candidate);
+        if (!apiKeyInfo.apiKey) {
+          if (apiKeyInfo.mode !== "aws-sdk") {
+            throw new Error(
+              `No API key resolved for provider "${model.provider}" (auth mode: ${apiKeyInfo.mode}).`,
+            );
+          }
+          lastProfileId = apiKeyInfo.profileId;
+          return;
+        }
         if (model.provider === "github-copilot") {
           const { resolveCopilotApiToken } =
             await import("../../providers/github-copilot-token.js");