pi-commandcode-provider 0.6.3

Summary

• Fix Oh My Pi chat returning 401 Invalid 'Authorization' header after /login. OMP kept the unresolved $COMMAND_CODE_API_KEY placeholder as a literal config API key that shadowed its stored credentials and was sent as the Bearer token. The placeholder is now registered only on pi, where it keeps the API-key login method and --api-key working next to OAuth; on OMP the provider omits apiKey unless a real key is configured. Host-supplied placeholders are resolved or stripped on every stream path, and the legacy generate transport resolves its key through the same rule. (#78)
• Stored /login OAuth and API-key credentials, --api-key, and env keys are now covered end to end on both pi and Oh My Pi, asserting the exact Bearer token the mock API receives. CI runs the pi end-to-end suite against a real pi binary instead of skipping it.

Contributors

• @ebreen — reported and diagnosed the Oh My Pi /login 401, and opened the fix that this release builds on (#78).

Validation

• npm test with PI_LOCAL_REQUIRED=1 and OMP_COMPAT_REQUIRED=1 (pi 0.84.3/0.84.4, Oh My Pi 18.1.4) — all suites pass
• npm run typecheck, npm run format:check, git diff --check
• npm audit --audit-level=moderate — 0 vulnerabilities
• npm pack --dry-run — 29 files, 51.1 kB
• CI green on #78 and #79

Links

• #78 — fix(auth): stop the API key placeholder from shadowing Oh My Pi /login credentials
• #79 — release PR