fix(ci): satisfy provider audit checks

.gitleaks.toml

@@ -41,5 +41,5 @@ title = "pi-commandcode-provider secret scan"
 [[rules]]
   id = "pi-test-api-key"
   description = "Test API key value that looks real"
-  regex = '''(user_testKey|mock-key|fake-key|test-api-key)'''
+  regex = '''['"](user_testKey|mock-key|fake-key|test-api-key)['"]'''
   tags = ["pi-extension", "test"]

CHANGELOG.md

@@ -5,7 +5,7 @@
 - Replace the reverse-engineered `/alpha/generate` integration with Command Code's documented Provider API: `/provider/v1/chat/completions` for non-Claude models and `/provider/v1/messages` for Claude models.
 - Use Pi's native OpenAI- and Anthropic-compatible providers for streaming, tools, reasoning, images, usage, errors, and retries while preserving dynamic model discovery, offline cache, refresh/status commands, pricing, and OAuth credentials.
 - Let `/login` use browser authentication, an explicit API-key prompt, or a directly pasted API key.
-- Add optional zero-data-retention headers through `CMD_ZDR=1` or `COMMANDCODE_ZDR=1`.
+- Add optional zero-data-retention headers through `COMMANDCODE_ZDR=1`.
 - Refresh GPT-5.6 Terra and Luna display prices after their temporary 50% promotion ended.
 
 ## 0.5.1 - 2026-08-11

README.md

@@ -129,7 +129,7 @@ While pi is running, use these provider commands without restarting:
 - `/commandcode-refresh` fetches and re-registers the current model catalog. Overlapping refreshes are coalesced, and a failed refresh keeps the last valid catalog active.
 - `/commandcode-status` shows redacted discovery diagnostics, including the source, model count, timestamps, cache path, endpoint, and warning.
 
-Set `CMD_ZDR=1` or `COMMANDCODE_ZDR=1` to send Command Code's documented `x-cmd-zdr: 1` zero-data-retention header.
+Set `COMMANDCODE_ZDR=1` to send Command Code's documented `x-cmd-zdr: 1` zero-data-retention header.
 
 The following environment variables are intended for tests, local mocks, and compatible API endpoints:
 

index.ts

@@ -29,7 +29,7 @@ import { MODEL_COSTS, ZERO_MODEL_COST } from "./src/pricing.ts"
 import { createCommandCodeRuntime } from "./src/runtime.ts"
 
 function commandCodeHeaders(): Record<string, string> | undefined {
-  if (process.env.CMD_ZDR === "1" || process.env.COMMANDCODE_ZDR === "1") {
+  if (process.env.COMMANDCODE_ZDR === "1") {
     return { "x-cmd-zdr": "1" }
   }
   return undefined

src/models.ts

@@ -1,6 +1,5 @@
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises"
 import { dirname } from "node:path"
-import type { Api } from "@earendil-works/pi-ai"
 
 export const DEFAULT_PROVIDER_API_BASE = "https://api.commandcode.ai/provider/v1"
 export const DEFAULT_MODELS_URL = `${DEFAULT_PROVIDER_API_BASE}/models`
@@ -9,6 +8,7 @@ export const DEFAULT_MODELS_TIMEOUT_MS = 10_000
 const DEFAULT_MAX_OUTPUT_TOKENS = 65_536
 const MODEL_CACHE_VERSION = 1
 
+export type CommandCodeApi = "openai-completions" | "anthropic-messages"
 export type CommandCodeInputType = "text" | "image"
 
 /**
@@ -161,17 +161,17 @@ interface ApiModel {
 export interface CommandCodeModel {
   id: string
   name: string
-  api: Api
+  api: CommandCodeApi
   reasoning: boolean
   contextWindow: number
   maxTokens: number
 }
 
-export function apiForModelId(id: string): Api {
+export function apiForModelId(id: string): CommandCodeApi {
   return id.startsWith("claude-") ? "anthropic-messages" : "openai-completions"
 }
 
-export function baseUrlForModel(apiBase: string, api: Api): string {
+export function baseUrlForModel(apiBase: string, api: CommandCodeApi): string {
   const normalized = apiBase.replace(/\/+$/g, "")
   if (api !== "anthropic-messages") return normalized
   return normalized.endsWith("/v1") ? normalized.slice(0, -3) : normalized