Fix subscription auth in BTW sub-sessions

[juicetin]

Summary

Fix /btw, BTW model overrides, and /btw:summarize for subscription and OAuth providers whose successful request authentication does not include an API key.

The production change replaces three apiKey presence checks with the ResolvedRequestAuth.ok discriminator defined by Pi. API-key providers keep the same behavior.

Context and root cause

Pi defines successful request authentication as:

{ ok: true; apiKey?: string; headers?: Record<string, string>; env?: Record<string, string> }

The contract makes all three request fields optional. getApiKeyAndHeaders() also has explicit successful paths that return headers without an API key. See Pi's ResolvedRequestAuth and resolver implementation and the successful keyless return paths.

pi-btw treated auth.ok && auth.apiKey as success when selecting an override and treated !auth.apiKey as failure before normal chat and summary sub-sessions. Valid subscription authentication therefore produced a missing-credentials error before createAgentSession() could use the supplied model registry.

I searched the repository's open and closed issues and pull requests for OAuth, subscription, API-key, and credential fixes. I did not find an existing proposal for this defect.

Affected upstream revision: pi-btw 0.4.1 at 4f858102706910ee9d520a9666832f3103631b61. The same checks are present in the published 0.4.0 package.

Reproduction

1. Log in to a Pi provider through subscription or OAuth so getApiKeyAndHeaders() resolves { ok: true, headers, env? } without apiKey.
2. Select that model in the main session or through /btw:model.
3. Run /btw test subscription auth.
4. Before this patch, BTW reports missing credentials and does not create or prompt its sub-session.
5. If a thread was created with another model and the subscription model is then used for /btw:summarize, summarization fails at the same preflight check.

Fix

Use auth.ok as the sole success discriminator at the three preflight sites:

• BTW model override selection
• normal BTW chat
• BTW summarization

The existing createAgentSession() calls still receive ctx.modelRegistry, so Pi remains responsible for resolving the actual request authentication. ok: false still preserves the resolver's error and the existing fallback behavior.

No dependencies, public APIs, persistence formats, or unrelated TUI behavior changed.

Automated tests

Added command-level regression coverage through pi-btw's registered public commands:

• normal /btw chat with successful header/env subscription auth and no API key
• BTW-only model override selection with successful header auth and no API key
• /btw:summarize with successful header auth and no API key
• existing ok: false missing-credential and override-fallback cases remain covered

Red evidence before the production change:

2 failed: normal subscription chat created 0 sessions; subscription summarize created 1 instead of 2

Checks after the fix:

npm test
Test Files  1 passed (1)
Tests       58 passed (58)

npx tsc --noEmit
passed

Production and rollout instructions

This is a client extension fix. It needs no data migration or configuration change.

After a release containing the patch, update pi-btw and run /reload or restart Pi. Validate with the affected subscription model by running one /btw question and one /btw:summarize handoff. Existing hidden BTW entries and API-key providers are unchanged.

Rollback consists of reinstalling the previous pi-btw release and reloading Pi. That restores the prior behavior, including the subscription-auth failure.

Maintainer self-fix prompt

If you would rather reproduce and implement this independently, this prompt captures the observed contract and acceptance criteria:

Read every applicable contributor and agent instruction in dbachelder/pi-btw before editing. Reproduce the subscription-auth failure on main at 4f858102706910ee9d520a9666832f3103631b61. Compare the three getApiKeyAndHeaders checks in extensions/btw.ts with Pi's ResolvedRequestAuth contract, where ok:true may omit apiKey and carry headers or env instead. Add command-level regression tests that fail before the fix for normal /btw chat, BTW model override selection, and /btw:summarize with successful keyless auth. Preserve ok:false errors and existing fallback behavior. Implement the smallest fix in extensions/btw.ts without unrelated refactoring or new fallback behavior. Run npm test and npx tsc --noEmit, then report red/green evidence and the final diff.