Pi running inside the docker containers

src/servers/api/server-settings/pi-mono.ts

@@ -2,12 +2,14 @@ import { join } from 'node:path';
 import { createRouter } from '../../create-router';
 import { DATA_PATH } from '../../data-path';
 import { syncLocalProvidersToPiConfig } from './sync-pi-config';
+import { syncAllUserPiConfigs } from './sync-user-pi-config';
 import { invalidateModelCache } from '../pi/list-models';
 
 export const piMonoRouter = createRouter();
 
 const API_KEYS_FILE = join(DATA_PATH, 'pi_mono_api_keys.json');
 const LOCAL_PROVIDERS_FILE = join(DATA_PATH, 'pi_mono_local_providers.json');
+const ACCESS_POLICY_FILE = join(DATA_PATH, 'pi_access_policy.json');
 
 // --- Local provider types ---
 
@@ -163,7 +165,25 @@ async function writeApiKeys(keys: Record<string, string>) {
   await Bun.write(API_KEYS_FILE, JSON.stringify(keys, null, 2));
 }
 
-const PROVIDERS: { key: string; env: string[] }[] = [
+export type AccessPolicy = {
+  allowedModels: string[]; // e.g. ["anthropic:anthropic/claude-sonnet-4"]
+};
+
+export async function readAccessPolicy(): Promise<AccessPolicy> {
+  try {
+    const file = Bun.file(ACCESS_POLICY_FILE);
+    if (!(await file.exists())) return { allowedModels: [] };
+    return (await file.json()) as AccessPolicy;
+  } catch {
+    return { allowedModels: [] };
+  }
+}
+
+async function writeAccessPolicy(policy: AccessPolicy) {
+  await Bun.write(ACCESS_POLICY_FILE, JSON.stringify(policy, null, 2));
+}
+
+export const PROVIDERS: { key: string; env: string[] }[] = [
   { key: 'OpenAI', env: ['OPENAI_API_KEY'] },
   { key: 'Google', env: ['GOOGLE_API_KEY', 'GEMINI_API_KEY'] },
   { key: 'OpenCode Zen', env: ['OPENCODE_API_KEY'] },
@@ -216,6 +236,7 @@ piMonoRouter.put('/api-keys', async (ctx) => {
   }
   await writeApiKeys(keys);
   invalidateModelCache();
+  syncAllUserPiConfigs().catch(() => {});
   return ctx.json({ ok: true });
 });
 
@@ -304,7 +325,8 @@ piMonoRouter.post('/local-providers', async (ctx) => {
   
   // Sync to Pi config so Pi knows about this provider
   await syncLocalProvidersToPiConfig();
-  
+  syncAllUserPiConfigs().catch(() => {});
+
   return ctx.json({ ...provider, auth: provider.auth ? { type: provider.auth.type } : undefined });
 });
 
@@ -317,7 +339,25 @@ piMonoRouter.delete('/local-providers/:id', async (ctx) => {
   
   // Sync to Pi config to remove this provider
   await syncLocalProvidersToPiConfig();
-  
+  syncAllUserPiConfigs().catch(() => {});
+
+  return ctx.json({ ok: true });
+});
+
+// --- Access policy ---
+
+piMonoRouter.get('/access-policy', async (ctx) => {
+  const policy = await readAccessPolicy();
+  return ctx.json(policy);
+});
+
+piMonoRouter.put('/access-policy', async (ctx) => {
+  const body = await ctx.req.json<AccessPolicy>();
+  const policy: AccessPolicy = {
+    allowedModels: Array.isArray(body.allowedModels) ? body.allowedModels : [],
+  };
+  await writeAccessPolicy(policy);
+  await syncAllUserPiConfigs();
   return ctx.json({ ok: true });
 });