- PiUpstreamClient: one Models per upstream holding only its provider; credential
store adapter maps to that upstream's secret, so several accounts of one provider
coexist; host env is only read for authKind none (ambient cloud creds)
- provider catalog from builtinProviders() plus static oauth modes, env fields and
subscription terms notes; openai-compatible custom endpoints
- fake upstream provider with mock OAuth (browser paste / device approval)
- PiAgentRuntime accepts an upstream; thinking level clamped to the model
Co-Authored-By: Claude Opus 5.5 <[email protected]>
