From 4806b8f9f43bc1e89cc504dbbca92fb4c6bf6069 Mon Sep 17 00:00:00 2001
From: Cristina Poncela Cubeiro
 <140309543+cristinaponcela@users.noreply.github.com>
Date: Thu, 18 Jun 2026 15:41:47 +0200
Subject: [PATCH] fix: use radius creds instead of api key

---
 packages/orchestrator/src/ipc/protocol.ts |  3 +-
 packages/orchestrator/src/radius.ts       | 35 +++++++++++++++++------
 packages/orchestrator/src/serve.ts        |  2 +-
 3 files changed, 30 insertions(+), 10 deletions(-)

diff --git a/packages/orchestrator/src/ipc/protocol.ts b/packages/orchestrator/src/ipc/protocol.ts
index 09744a73..93d7e597 100644
--- a/packages/orchestrator/src/ipc/protocol.ts
+++ b/packages/orchestrator/src/ipc/protocol.ts
@@ -123,6 +123,7 @@ export interface ResponseMap {
 export type OrchestratorResponse = ResponseMap[keyof ResponseMap] | ErrorResponse;
 export type AttachClientRequest = AttachRpcRequest;
 export type AttachServerResponse = AttachReadyResponse | AttachEventResponse | AttachRpcResponse | ErrorResponse;
+export type ProtocolMessage = OrchestratorRequest | OrchestratorResponse | AttachClientRequest | AttachServerResponse;
 
 export type ResponseFor<T extends OrchestratorRequest> = T extends { type: infer K }
 	? K extends keyof ResponseMap
@@ -130,7 +131,7 @@ export type ResponseFor<T extends OrchestratorRequest> = T extends { type: infer
 		: ErrorResponse
 	: ErrorResponse;
 
-export function encodeMessage(message: unknown): string {
+export function encodeMessage(message: ProtocolMessage): string {
 	return `${JSON.stringify(message)}\n`;
 }
 
diff --git a/packages/orchestrator/src/radius.ts b/packages/orchestrator/src/radius.ts
index b737f5ac..a6dcad7f 100644
--- a/packages/orchestrator/src/radius.ts
+++ b/packages/orchestrator/src/radius.ts
@@ -1,4 +1,5 @@
 import { hostname, platform } from "node:os";
+import { AuthStorage, type OAuthCredential } from "@earendil-works/pi-coding-agent";
 import { getOrchestratorDir, getSocketPath } from "./config.ts";
 import { loadMachine, saveMachine } from "./storage.ts";
 import type { InstanceRecord, MachineRecord, RadiusRegistration } from "./types.ts";
@@ -7,6 +8,7 @@ const DEFAULT_RADIUS_URL = "https://radius.pi.dev/";
 const DEFAULT_ORCHESTRATOR_BASE_PATH = "/v1/";
 const ORCHESTRATOR_VERSION = "0.79.6";
 const NOT_FOUND_RETRY_THRESHOLD = 3;
+const RADIUS_PROVIDER = "radius";
 
 interface RegisterMachineResponse extends RadiusRegistration {
 	id: string;
@@ -42,7 +44,7 @@ async function post<T>(path: string, body: unknown): Promise<T> {
 	const response = await fetch(new URL(path, getRadiusOrchestratorBaseUrl()), {
 		method: "POST",
 		headers: {
-			Authorization: `Bearer ${getRadiusApiKey()}`,
+			Authorization: `Bearer ${getRadiusAccessToken()}`,
 			"Content-Type": "application/json",
 		},
 		body: JSON.stringify(body),
@@ -59,7 +61,7 @@ async function maybePost(path: string, body: unknown): Promise<void> {
 	const response = await fetch(new URL(path, getRadiusOrchestratorBaseUrl()), {
 		method: "POST",
 		headers: {
-			Authorization: `Bearer ${getRadiusApiKey()}`,
+			Authorization: `Bearer ${getRadiusAccessToken()}`,
 			"Content-Type": "application/json",
 		},
 		body: JSON.stringify(body),
@@ -86,16 +88,33 @@ export function getRadiusOrchestratorBaseUrl(): string {
 	return new URL(DEFAULT_ORCHESTRATOR_BASE_PATH, getRadiusUrl()).toString();
 }
 
-export function getRadiusApiKey(): string {
-	const apiKey = process.env.PI_RADIUS_API_KEY;
-	if (!apiKey) {
-		throw new Error("PI_RADIUS_API_KEY is required for Radius integration");
+const radiusAuthStorage = AuthStorage.create();
+
+function getStoredRadiusCredential(): OAuthCredential | undefined {
+	radiusAuthStorage.reload();
+	const credential = radiusAuthStorage.get(RADIUS_PROVIDER);
+	if (!credential || credential.type !== "oauth") {
+		return undefined;
 	}
-	return apiKey;
+	return credential;
+}
+
+export function getRadiusAccessToken(): string {
+	const storedCredential = getStoredRadiusCredential();
+	if (typeof storedCredential?.access === "string" && storedCredential.access) {
+		return storedCredential.access;
+	}
+
+	const apiKey = process.env.PI_RADIUS_API_KEY;
+	if (apiKey) {
+		return apiKey;
+	}
+
+	throw new Error("Radius credentials are required in ~/.pi/agent/auth.json or PI_RADIUS_API_KEY");
 }
 
 export function isRadiusEnabled(): boolean {
-	return !!process.env.PI_RADIUS_API_KEY;
+	return !!getStoredRadiusCredential()?.access || !!process.env.PI_RADIUS_API_KEY;
 }
 
 export class RadiusPresence {
diff --git a/packages/orchestrator/src/serve.ts b/packages/orchestrator/src/serve.ts
index 176c6539..acc4e9fc 100644
--- a/packages/orchestrator/src/serve.ts
+++ b/packages/orchestrator/src/serve.ts
@@ -17,7 +17,7 @@ export async function serve(): Promise<void> {
 			console.log(`radius machine id: ${machine.id}`);
 		}
 	} else {
-		console.log("radius integration disabled: set PI_RADIUS_API_KEY to enable");
+		console.log("radius integration disabled: login radius in ~/.pi/agent/auth.json or set PI_RADIUS_API_KEY");
 	}
 	const server = await startIpcServer(
 		Object.assign(handleIpcRequest, {