Use new getApiKeyAndHeaders to fetch the API key from the model registry

[kirberich]

getApiKey was removed from the modelRegistry in pi a few weeks ago - this made me scratch my head for a while because the only symptom of this was pi-budget-model insisting that there's no available model to pick. Switching to the new getApiKeyAndHeaders fixes it, but it does increase the required version of pi.

The other approach would have been to try using the new api and fall back to the old one, avoiding the need to increase the version dependency, but I figured I'd keep it simple.

[mgabor3141]

@greptile

[greptile-apps]

Greptile Summary

This PR migrates pi-budget-model away from the removed modelRegistry.getApiKey() to the new getApiKeyAndHeaders() API (introduced in pi around v0.57→0.63), bumping the minimum peer dependency to ^0.63.0.

• The new getApiKey wrapper (line 124–127) only forwards auth.apiKey and silently drops auth.headers. If any configured provider relies on those headers for authentication (e.g. AWS Bedrock, Azure, or any header-based auth scheme), the returned BudgetModel would still lack what's needed to make a successful API call, leaving the behaviour no better than before for those providers.

Confidence Score: 3/5

Not safe to merge without verifying that discarding auth.headers doesn't break header-authenticated providers.

There is a P1 logic issue: the migration to getApiKeyAndHeaders only extracts the API key and discards the returned headers, which may silently leave header-based auth providers broken. The fix is straightforward but the impact depends on which providers users have configured.

packages/budget-model/src/index.ts — the getApiKey wrapper and BudgetModel interface.

Important Files Changed

Filename	Overview
packages/budget-model/src/index.ts	Migrates from removed getApiKey to getApiKeyAndHeaders, but the new wrapper only extracts apiKey and discards the headers, potentially leaving header-auth providers still broken.
packages/budget-model/package.json	Bumps @mariozechner/pi-ai and @mariozechner/pi-coding-agent minimum version from ^0.57.0 to ^0.63.0 to pick up the new getApiKeyAndHeaders API.
yarn.lock	Lock file updated to add resolved 0.63.2 entries for the pi-* packages; old 0.57.0 entries remain for the wildcard/peer-dep selectors — expected for a monorepo.

Sequence Diagram

sequenceDiagram
    participant Caller
    participant findBudgetModel
    participant getApiKey_wrapper as getApiKey (new wrapper)
    participant modelRegistry

    Caller->>findBudgetModel: findBudgetModel(ctx, options)
    findBudgetModel->>getApiKey_wrapper: getApiKey(ctx, candidate)
    getApiKey_wrapper->>modelRegistry: getApiKeyAndHeaders(model)
    modelRegistry-->>getApiKey_wrapper: { ok, apiKey, headers }
    note right of getApiKey_wrapper: headers discarded here
    getApiKey_wrapper-->>findBudgetModel: apiKey (string | undefined)
    findBudgetModel-->>Caller: BudgetModel { model, apiKey }

Loading

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
packages/budget-model/src/index.ts:124-127
**Headers from `getApiKeyAndHeaders` are silently discarded**

`getApiKeyAndHeaders` was introduced precisely to carry extra auth headers alongside the API key (e.g. for AWS Bedrock or other header-based auth providers). This wrapper extracts only `auth.apiKey` and throws away `auth.headers`, so any provider that requires those headers for authentication will still fail — the returned `BudgetModel.apiKey` alone won't be enough to make a successful API call for those providers.

Consider either returning the full auth object from `getApiKey`, or updating the `BudgetModel` interface to carry `headers` too:

```ts
export interface BudgetModel {
    model: Model<Api>;
    apiKey: string;
    headers?: Record<string, string>;
}
```

and propagating `auth.headers` wherever `BudgetModel` is constructed.

_{Reviews (1): Last reviewed commit: "Use new getApiKeyAndHeaders to fetch the..." | Re-trigger Greptile}

[greptile-apps]

Headers from getApiKeyAndHeaders are silently discarded

getApiKeyAndHeaders was introduced precisely to carry extra auth headers alongside the API key (e.g. for AWS Bedrock or other header-based auth providers). This wrapper extracts only auth.apiKey and throws away auth.headers, so any provider that requires those headers for authentication will still fail — the returned BudgetModel.apiKey alone won't be enough to make a successful API call for those providers.

Consider either returning the full auth object from getApiKey, or updating the BudgetModel interface to carry headers too:

export interface BudgetModel {
    model: Model<Api>;
    apiKey: string;
    headers?: Record<string, string>;
}

and propagating auth.headers wherever BudgetModel is constructed.

Prompt To Fix With AI

This is a comment left during a code review.
Path: packages/budget-model/src/index.ts
Line: 124-127

Comment:
**Headers from `getApiKeyAndHeaders` are silently discarded**

`getApiKeyAndHeaders` was introduced precisely to carry extra auth headers alongside the API key (e.g. for AWS Bedrock or other header-based auth providers). This wrapper extracts only `auth.apiKey` and throws away `auth.headers`, so any provider that requires those headers for authentication will still fail — the returned `BudgetModel.apiKey` alone won't be enough to make a successful API call for those providers.

Consider either returning the full auth object from `getApiKey`, or updating the `BudgetModel` interface to carry `headers` too:

```ts
export interface BudgetModel {
    model: Model<Api>;
    apiKey: string;
    headers?: Record<string, string>;
}
```

and propagating `auth.headers` wherever `BudgetModel` is constructed.

How can I resolve this? If you propose a fix, please make it concise.

[mgabor3141]

Closing in favor of #53, which incorporates this commit (with original authorship preserved) and addresses two follow-ups discovered during review:

1. auth.headers was being dropped. The wrapper extracted only auth.apiKey from the new getApiKeyAndHeaders result, so providers that authenticate via headers (out-of-band Authorization, AWS Bedrock with SDK-resolved credentials, etc.) were rejected as "no key" — the same symptom this PR was meant to fix, just for a different subset of providers. (This was the P1 Greptile flagged.)
2. CI was red because the bump to pi-coding-agent ^0.63.0 left other workspaces on ^0.57.0, so two copies of pi-coding-agent resolved and ExtensionContext types diverged across packages.

#53 also extends modelOverride with an object form ({ model, auth }) that bypasses the registry's auth pipeline entirely, as a forward-compatible escape hatch for any future upstream auth-API shifts.

Thanks @kirberich for the original diagnosis and fix — the regression you identified was real and your commit is the foundation of #53.