Refactor OAuth/API key handling: AuthStorage and ModelRegistry

- Add AuthStorage class for credential storage (auth.json)
- Add ModelRegistry class for model management with API key resolution
- Add discoverAuthStorage() and discoverModels() discovery functions
- Add migration from legacy oauth.json and settings.json apiKeys to auth.json
- Remove configureOAuthStorage, defaultGetApiKey, findModel, discoverAvailableModels
- Remove apiKeys from Settings type and SettingsManager methods
- Rename getOAuthPath to getAuthPath
- Update SDK, examples, docs, tests, and mom package

Fixes #296

packages/coding-agent/src/modes/interactive/components/footer.ts

@@ -3,7 +3,7 @@ import type { AssistantMessage } from "@mariozechner/pi-ai";
 import { type Component, visibleWidth } from "@mariozechner/pi-tui";
 import { existsSync, type FSWatcher, readFileSync, watch } from "fs";
 import { dirname, join } from "path";
-import { isModelUsingOAuth } from "../../../core/models-json.js";
+import type { ModelRegistry } from "../../../core/model-registry.js";
 import { theme } from "../theme/theme.js";
 
 /**
@@ -31,13 +31,15 @@ function findGitHeadPath(): string | null {
  */
 export class FooterComponent implements Component {
 	private state: AgentState;
+	private modelRegistry: ModelRegistry;
 	private cachedBranch: string | null | undefined = undefined; // undefined = not checked yet, null = not in git repo, string = branch name
 	private gitWatcher: FSWatcher | null = null;
 	private onBranchChange: (() => void) | null = null;
 	private autoCompactEnabled: boolean = true;
 
-	constructor(state: AgentState) {
+	constructor(state: AgentState, modelRegistry: ModelRegistry) {
 		this.state = state;
+		this.modelRegistry = modelRegistry;
 	}
 
 	setAutoCompactEnabled(enabled: boolean): void {
@@ -207,7 +209,7 @@ export class FooterComponent implements Component {
 		if (totalCacheWrite) statsParts.push(`W${formatTokens(totalCacheWrite)}`);
 
 		// Show cost with "(sub)" indicator if using OAuth subscription
-		const usingSubscription = this.state.model ? isModelUsingOAuth(this.state.model) : false;
+		const usingSubscription = this.state.model ? this.modelRegistry.isUsingOAuth(this.state.model) : false;
 		if (totalCost || usingSubscription) {
 			const costStr = `$${totalCost.toFixed(3)}${usingSubscription ? " (sub)" : ""}`;
 			statsParts.push(costStr);

packages/coding-agent/src/modes/interactive/components/model-selector.ts

@@ -10,7 +10,7 @@ import {
 	Text,
 	type TUI,
 } from "@mariozechner/pi-tui";
-import { getAvailableModels } from "../../../core/models-json.js";
+import type { ModelRegistry } from "../../../core/model-registry.js";
 import type { SettingsManager } from "../../../core/settings-manager.js";
 import { fuzzyFilter } from "../../../utils/fuzzy.js";
 import { theme } from "../theme/theme.js";
@@ -38,6 +38,7 @@ export class ModelSelectorComponent extends Container {
 	private selectedIndex: number = 0;
 	private currentModel: Model<any> | null;
 	private settingsManager: SettingsManager;
+	private modelRegistry: ModelRegistry;
 	private onSelectCallback: (model: Model<any>) => void;
 	private onCancelCallback: () => void;
 	private errorMessage: string | null = null;
@@ -48,6 +49,7 @@ export class ModelSelectorComponent extends Container {
 		tui: TUI,
 		currentModel: Model<any> | null,
 		settingsManager: SettingsManager,
+		modelRegistry: ModelRegistry,
 		scopedModels: ReadonlyArray<ScopedModelItem>,
 		onSelect: (model: Model<any>) => void,
 		onCancel: () => void,
@@ -57,6 +59,7 @@ export class ModelSelectorComponent extends Container {
 		this.tui = tui;
 		this.currentModel = currentModel;
 		this.settingsManager = settingsManager;
+		this.modelRegistry = modelRegistry;
 		this.scopedModels = scopedModels;
 		this.onSelectCallback = onSelect;
 		this.onCancelCallback = onCancel;
@@ -113,26 +116,29 @@ export class ModelSelectorComponent extends Container {
 				model: scoped.model,
 			}));
 		} else {
-			// Load available models fresh (includes custom models from models.json)
-			// Pass settings manager's key resolver as fallback for settings.json apiKeys
-			const { models: availableModels, error } = await getAvailableModels(undefined, (provider) =>
-				this.settingsManager.getApiKey(provider),
-			);
+			// Refresh to pick up any changes to models.json
+			this.modelRegistry.refresh();
 
-			// If there's an error loading models.json, we'll show it via the "no models" path
-			// The error will be displayed to the user
-			if (error) {
-				this.allModels = [];
-				this.filteredModels = [];
-				this.errorMessage = error;
-				return;
+			// Check for models.json errors
+			const loadError = this.modelRegistry.getError();
+			if (loadError) {
+				this.errorMessage = loadError;
 			}
 
-			models = availableModels.map((model) => ({
-				provider: model.provider,
-				id: model.id,
-				model,
-			}));
+			// Load available models (built-in models still work even if models.json failed)
+			try {
+				const availableModels = await this.modelRegistry.getAvailable();
+				models = availableModels.map((model: Model<any>) => ({
+					provider: model.provider,
+					id: model.id,
+					model,
+				}));
+			} catch (error) {
+				this.allModels = [];
+				this.filteredModels = [];
+				this.errorMessage = error instanceof Error ? error.message : String(error);
+				return;
+			}
 		}
 
 		// Sort: current model first, then by provider

packages/coding-agent/src/modes/interactive/components/oauth-selector.ts

@@ -1,6 +1,6 @@
-import { loadOAuthCredentials } from "@mariozechner/pi-ai";
+import { getOAuthProviders, type OAuthProviderInfo } from "@mariozechner/pi-ai";
 import { Container, isArrowDown, isArrowUp, isEnter, isEscape, Spacer, TruncatedText } from "@mariozechner/pi-tui";
-import { getOAuthProviders, type OAuthProviderInfo } from "../../../core/oauth/index.js";
+import type { AuthStorage } from "../../../core/auth-storage.js";
 import { theme } from "../theme/theme.js";
 import { DynamicBorder } from "./dynamic-border.js";
 
@@ -12,13 +12,20 @@ export class OAuthSelectorComponent extends Container {
 	private allProviders: OAuthProviderInfo[] = [];
 	private selectedIndex: number = 0;
 	private mode: "login" | "logout";
+	private authStorage: AuthStorage;
 	private onSelectCallback: (providerId: string) => void;
 	private onCancelCallback: () => void;
 
-	constructor(mode: "login" | "logout", onSelect: (providerId: string) => void, onCancel: () => void) {
+	constructor(
+		mode: "login" | "logout",
+		authStorage: AuthStorage,
+		onSelect: (providerId: string) => void,
+		onCancel: () => void,
+	) {
 		super();
 
 		this.mode = mode;
+		this.authStorage = authStorage;
 		this.onSelectCallback = onSelect;
 		this.onCancelCallback = onCancel;
 
@@ -49,7 +56,6 @@ export class OAuthSelectorComponent extends Container {
 
 	private loadProviders(): void {
 		this.allProviders = getOAuthProviders();
-		this.allProviders = this.allProviders.filter((p) => p.available);
 	}
 
 	private updateList(): void {
@@ -63,8 +69,8 @@ export class OAuthSelectorComponent extends Container {
 			const isAvailable = provider.available;
 
 			// Check if user is logged in for this provider
-			const credentials = loadOAuthCredentials(provider.id);
-			const isLoggedIn = credentials !== null;
+			const credentials = this.authStorage.get(provider.id);
+			const isLoggedIn = credentials?.type === "oauth";
 			const statusIndicator = isLoggedIn ? theme.fg("success", " ✓ logged in") : "";
 
 			let line = "";