fix(pi): resolve packaged proxy token lazily

electron/api/coding-composition.ts

@@ -46,7 +46,7 @@ export interface CreateCodingCompositionOptions {
   projectStore?: CodingProjectStore;
   browser: AgentBrowserModule;
   paths: CodingCompositionPaths;
-  localProxyCredential?: string;
+  getLocalProxyCredential?(): string | undefined;
 }
 
 export function resolveCodingPiRuntimePaths(input: {
@@ -73,6 +73,7 @@ export function resolveCodingPiRuntimePaths(input: {
 export function createCodingComposition(
   options: CreateCodingCompositionOptions,
 ): CodingProductComposition {
+  const getLocalProxyCredential = options.getLocalProxyCredential;
   const projectStore = options.projectStore ?? createCodingProjectStore(options.storage);
   const attachments = new CodingAttachmentStore(
     path.join(options.paths.userDataDir, 'coding-runtime', 'attachments'),
@@ -113,8 +114,8 @@ export function createCodingComposition(
       bundledSkillsDir: options.paths.bundledSkillsDir,
       loadProviderInput,
       resolveCredential: resolvePiProviderCredentialFromSecretStore,
-      ...(options.localProxyCredential
-        ? { getLocalProxyCredential: async () => options.localProxyCredential }
+      ...(getLocalProxyCredential
+        ? { getLocalProxyCredential: async () => getLocalProxyCredential() }
         : {}),
       extensionHost,
     }),
@@ -129,8 +130,8 @@ export function createCodingComposition(
     loadProviderInput,
     resolveCredential: resolvePiProviderCredentialFromSecretStore,
     getRevision: () => revisions.current,
-    ...(options.localProxyCredential
-      ? { getLocalProxyCredential: async () => options.localProxyCredential }
+    ...(getLocalProxyCredential
+      ? { getLocalProxyCredential: async () => getLocalProxyCredential() }
       : {}),
   });
   const subagents = new PiSubagentScheduler({

electron/api/coding-provider-auth.ts

@@ -1,4 +1,7 @@
-import { resolvePiProviderCredentialFromSecretStore } from '../coding-runtime/pi/provider-config';
+import {
+  PiProviderConfigError,
+  resolvePiProviderCredentialFromSecretStore,
+} from '../coding-runtime/pi/provider-config';
 import { getProviderService } from '../services/providers/provider-service';
 import {
   getFreshWorksSquareAIGatewayCredential,
@@ -17,6 +20,7 @@ export class CodingProviderCredentialRefreshError extends Error {
 
 export function isCodingProviderAuthenticationError(error: unknown): boolean {
   return error instanceof CodingProviderCredentialRefreshError
+    || (error instanceof PiProviderConfigError && error.code === 'PROVIDER_AUTH_REQUIRED')
     || (error instanceof Error && AUTHENTICATION_ERROR_PATTERN.test(error.message));
 }