fix: resolve Pi LLM auth through modelRegistry

- Call ctx.modelRegistry.getApiKeyAndHeaders(model) to resolve auth
- Pass resolved apiKey and headers to complete() options
- Provides clear error message if auth fails ( directs user to /login )
- Update test mock to include ok: true on auth response
- No external fetch() — Pi handles all transport and auth

src/pi-llm-client.ts

@@ -34,6 +34,15 @@ export class PiLLMClient implements LLMClient {
 			// Dynamically import Pi's AI module (available in the Pi runtime)
 			const { complete } = await import("@mariozechner/pi-ai");
 
+			// Resolve auth through Pi's model registry (handles /login, env vars, etc.)
+			const auth = await ctx.modelRegistry?.getApiKeyAndHeaders?.(model);
+			if (auth && !auth.ok) {
+				throw new LLMError(
+					`Pi LLM auth error: ${auth.error}. ` +
+						"Run /login in Pi to configure authentication.",
+				);
+			}
+
 			const response = await complete(
 				model,
 				{
@@ -50,6 +59,7 @@ export class PiLLMClient implements LLMClient {
 				{
 					temperature: 0.1,
 					maxTokens: 256,
+					...(auth?.ok ? { apiKey: auth.apiKey, headers: auth.headers } : {}),
 				},
 			);
 

tests/pi-extension.test.ts

@@ -60,6 +60,7 @@ describe("pi-extension", () => {
 			},
 			modelRegistry: {
 				getApiKeyAndHeaders: vi.fn(async () => ({
+					ok: true,
 					apiKey: "test-key",
 					headers: {},
 				})),