[codex] Fetch dynamic Pi models and add arrow picker

.agents/skills/pi-setup-development/SKILL.md

@@ -20,6 +20,8 @@ Current runtime contract:
 - base URL: `https://api.gonkagate.com/v1`
 - Pi API type: `openai-completions`
 - auth binding: `apiKey: "$GONKAGATE_API_KEY"`
+- model list source: setup-time `GET /v1/models`
+- interactive model selection: arrow-key picker
 - setup success: `configured`, not live `verified`
 
 Rules:
@@ -35,7 +37,7 @@ Rules:
 - never add a plain `--api-key` flag
 - do not mutate shell profiles
 - do not generate `.env` files
-- do not add arbitrary custom base URLs or arbitrary custom model ids
+- do not add arbitrary custom base URLs or model ids outside `/v1/models`
 - do not claim default live GonkaGate/Pi verification
 - keep TypeScript imports runtime-correct for compiled ESM
 - run `npm run ci` before calling the change ready

.claude/skills/pi-setup-development/SKILL.md

@@ -20,6 +20,8 @@ Current runtime contract:
 - base URL: `https://api.gonkagate.com/v1`
 - Pi API type: `openai-completions`
 - auth binding: `apiKey: "$GONKAGATE_API_KEY"`
+- model list source: setup-time `GET /v1/models`
+- interactive model selection: arrow-key picker
 - setup success: `configured`, not live `verified`
 
 Rules:
@@ -35,7 +37,7 @@ Rules:
 - never add a plain `--api-key` flag
 - do not mutate shell profiles
 - do not generate `.env` files
-- do not add arbitrary custom base URLs or arbitrary custom model ids
+- do not add arbitrary custom base URLs or model ids outside `/v1/models`
 - do not claim default live GonkaGate/Pi verification
 - keep TypeScript imports runtime-correct for compiled ESM
 - run `npm run ci` before calling the change ready

AGENTS.md

@@ -24,6 +24,9 @@ Current honest state:
   `~/.pi/agent/models.json`
 - the CLI reads a GonkaGate API key from `GONKAGATE_API_KEY`,
   `--api-key-stdin`, or a hidden prompt
+- the CLI fetches available models from GonkaGate `/v1/models` after API-key
+  input
+- the CLI uses an arrow-key model picker in interactive terminals
 - the CLI writes a Pi-compatible `gonkagate` API-key entry in
   `~/.pi/agent/auth.json`
 - the CLI sets `defaultProvider` and `defaultModel` in
@@ -40,12 +43,13 @@ The intended minimal happy path is:
 
 1. user runs `npx -y @gonkagate/pi-setup@latest`
 2. installer resolves the Pi `models.json` path
-3. installer lets the user choose a curated GonkaGate model or uses the
-   recommended model in non-interactive mode
-4. installer upserts the curated GonkaGate provider config
-5. installer stores the API key in Pi `auth.json` without printing it
-6. installer sets Pi defaults in `settings.json`
-7. user returns to plain `pi`
+3. installer fetches available models from GonkaGate `/v1/models`
+4. installer lets the user choose a fetched GonkaGate model or uses the first
+   fetched model in non-interactive mode
+5. installer upserts the GonkaGate provider config with fetched models
+6. installer stores the API key in Pi `auth.json` without printing it
+7. installer sets Pi defaults in `settings.json`
+8. user returns to plain `pi`
 
 ## Fixed Product Invariants
 
@@ -59,7 +63,7 @@ The intended minimal happy path is:
 - the durable Pi settings config target is `~/.pi/agent/settings.json`
 - the managed provider key is `providers.gonkagate`
 - the managed auth key is `gonkagate`
-- the managed provider catalog includes every public curated GonkaGate model
+- the managed provider catalog comes from GonkaGate `/v1/models` at setup time
 - the CLI must preserve unrelated providers and top-level config values
 - the provider auth binding remains exactly `apiKey: "$GONKAGATE_API_KEY"`
 - the allowed secret inputs are `GONKAGATE_API_KEY`, `--api-key-stdin`, and a
@@ -68,7 +72,7 @@ The intended minimal happy path is:
 - shell profile mutation is out of scope
 - `.env` file generation is out of scope
 - arbitrary custom base URLs are out of scope
-- arbitrary custom model ids are out of scope
+- arbitrary custom model ids outside fetched `/v1/models` are out of scope
 - concurrent-writer safety is not claimed without locking or an equivalent
   design
 - live GonkaGate/Pi session verification is out of scope for the initial
@@ -92,7 +96,8 @@ The intended minimal happy path is:
 - `src/config.ts` owns the Pi `models.json` merge behavior
 - `src/install/user-config.ts` owns the Pi `auth.json` and `settings.json`
   merge behavior
-- `src/constants.ts` owns the GonkaGate provider and curated model contract
+- `src/constants.ts` owns the GonkaGate provider endpoint constants
+- `src/install/deps.ts` owns setup-time GonkaGate `/v1/models` fetching
 - `src/paths.ts` owns default Pi path resolution
 - `docs/specs/pi-setup-prd/spec.md` is the current product requirements
   document and task-planning source

CHANGELOG.md

@@ -4,9 +4,10 @@
 
 ### Features
 
-- Add v2 Pi setup flow with curated model selection, safe API-key intake via
-  `GONKAGATE_API_KEY`, `--api-key-stdin`, or a hidden prompt, Pi `auth.json`
-  storage, and Pi default model settings.
+- Add v2 Pi setup flow with `/v1/models` model selection, safe API-key intake
+  via `GONKAGATE_API_KEY`, `--api-key-stdin`, or a hidden prompt, Pi
+  `auth.json` storage, and Pi default model settings.
+- Add an arrow-key interactive model picker for TTY setup.
 
 ### Security
 

README.md

@@ -29,16 +29,19 @@ Pi's provider, auth, or default-model config.
 - Preserves unrelated Pi providers and top-level config.
 - Reads your API key from `GONKAGATE_API_KEY`, `--api-key-stdin`, or a hidden
   prompt.
+- Fetches the current GonkaGate model list from `/v1/models` using that API key.
+- Shows an arrow-key model picker in interactive terminals.
 - Writes a Pi-compatible `gonkagate` API-key entry to
   `~/.pi/agent/auth.json`.
 - Sets `defaultProvider` and `defaultModel` in `~/.pi/agent/settings.json`.
 - Creates sibling backups before replacing existing managed files.
-- Installs the curated GonkaGate model catalog for Pi Coding Agent.
+- Installs the fetched GonkaGate model list for Pi Coding Agent.
 - Does not accept a plain `--api-key` flag and never prints `gp-...` keys.
 
 Setup success means `configured`: GonkaGate config and Pi auth/default settings
-were written or already matched. It does not mean `verified`; default setup does
-not make a live GonkaGate API call.
+were written or already matched. It does not mean `verified`; default setup only
+calls `/v1/models` for model metadata and does not verify a live Pi chat
+session.
 
 ## Quick Start
 
@@ -59,6 +62,9 @@ Preview the generated config without writing:
 npx -y @gonkagate/pi-setup@latest --dry-run
 ```
 
+Dry runs still need an API-key source because model choices come from
+`/v1/models`.
+
 Use a custom config path during testing:
 
 ```bash
@@ -71,10 +77,10 @@ pattern beside `auth.json` and `settings.json`.
 
 ## Limits
 
-The setup is local-file-only and network-free. It does not mutate shell
+The setup only makes the `/v1/models` metadata request. It does not mutate shell
 profiles, generate `.env` files, accept `--api-key`, support arbitrary custom
-base URLs, support arbitrary custom model ids, claim concurrent-writer safety,
-or run default live GonkaGate/Pi verification.
+base URLs, support arbitrary custom model ids outside `/v1/models`, claim
+concurrent-writer safety, or run default live GonkaGate/Pi verification.
 
 Deferred features require the evidence gates in
 [`docs/specs/pi-setup-prd/spec.md`](docs/specs/pi-setup-prd/spec.md) before

docs/how-it-works.md

@@ -1,7 +1,8 @@
 # How It Works
 
 Pi supports custom providers through `~/.pi/agent/models.json`. This package
-upserts a single managed provider:
+fetches current models from GonkaGate `/v1/models`, then upserts a single
+managed provider:
 
 ```json
 {
@@ -11,28 +12,32 @@ upserts a single managed provider:
       "baseUrl": "https://api.gonkagate.com/v1",
       "api": "openai-completions",
       "apiKey": "$GONKAGATE_API_KEY",
-      "models": [{ "id": "moonshotai/Kimi-K2.6" }]
+      "models": [{ "id": "dynamic/model-id", "name": "dynamic/model-id" }]
     }
   }
 }
 ```
 
 The CLI reads any existing JSON object, preserves unrelated keys, replaces only
 `providers.gonkagate`, writes a backup when the target file already exists, and
-then writes the updated JSON.
+then writes the updated JSON. The managed model list comes from setup-time
+`/v1/models`, not a repository registry.
 
 For v2 it also updates two Pi-native user files beside `models.json`:
 
 - `auth.json`: writes only the `gonkagate` API-key entry.
 - `settings.json`: sets `defaultProvider` and `defaultModel`.
 
 The API key comes from `GONKAGATE_API_KEY`, `--api-key-stdin`, or a hidden
-prompt. The CLI never accepts `--api-key` and never prints raw `gp-...` keys.
+prompt. The CLI uses it to fetch `/v1/models`, never accepts `--api-key`, and
+never prints raw `gp-...` keys.
+
+Interactive terminals use an arrow-key picker for the fetched model list.
 
 Every changed existing file gets a sibling `*.backup-*` file before replacement.
 If a later write fails, already-written files are rolled back from their backup
 or removed when newly created.
 
 The setup does not mutate shell profiles, generate `.env` files, accept
-arbitrary base URLs or model ids, or verify a live Pi/GonkaGate session by
-default.
+arbitrary base URLs or model ids outside `/v1/models`, or verify a live
+Pi/GonkaGate chat session by default.

docs/security.md

@@ -18,14 +18,17 @@ models load consistently with Pi's provider schema:
 }
 ```
 
+The CLI also uses the supplied API key for the setup-time `/v1/models` metadata
+request. It does not print or store that key outside Pi `auth.json`.
+
 Security rules:
 
 - no `--api-key` flag
 - no raw `gp-...` key in stdout or stderr
 - no repository-local secret storage
 - no shell profile mutation
 - no `.env` generation
-- no arbitrary custom base URLs or arbitrary custom model ids
+- no arbitrary custom base URLs or model ids outside fetched `/v1/models`
 - no default live Pi/GonkaGate verification
 - backup before replacing existing `models.json`, `auth.json`, or
   `settings.json`