feat(pi): support egress injected api keys

tests/unit/test_agent_provider.py

@@ -322,6 +322,38 @@ class TestAgentProviderRuntime(unittest.TestCase):
         self.assertTrue(provider["compat"]["supportsDeveloperRole"])
         self.assertTrue(provider["compat"]["supportsReasoningEffort"])
 
+    def test_pi_plan_can_target_openrouter_with_egress_injected_api_key(self):
+        with tempfile.TemporaryDirectory(prefix="bb-provider.") as tmp:
+            plan = build_agent_provision_plan(
+                template="pi",
+                dockerfile="",
+                state_dir=Path(tmp),
+                instance_name="bot-bottle-test",
+                prompt_file=Path(tmp) / "prompt.txt",
+                provider_settings={
+                    "provider": "openrouter",
+                    "base_url": "https://openrouter.ai/api/v1",
+                    "api": "openai-completions",
+                    "api_key_env": "OPENROUTER_API_KEY",
+                    "models": ["google/gemma-4-26b-a4b-it:free"],
+                    "supports_reasoning_effort": True,
+                },
+            )
+            models = json.loads(Path(tmp, "pi-models.json").read_text())
+        provider = models["providers"]["openrouter"]
+        self.assertEqual("https://openrouter.ai/api/v1", provider["baseUrl"])
+        self.assertEqual("openai-completions", provider["api"])
+        self.assertEqual("egress-placeholder", provider["apiKey"])
+        self.assertEqual(
+            [{"id": "google/gemma-4-26b-a4b-it:free"}],
+            provider["models"],
+        )
+        self.assertEqual("openrouter.ai", plan.egress_routes[0].host)
+        self.assertEqual("Bearer", plan.egress_routes[0].auth_scheme)
+        self.assertEqual("OPENROUTER_API_KEY", plan.egress_routes[0].token_ref)
+        self.assertNotIn("OPENROUTER_API_KEY", plan.guest_env)
+        self.assertTrue(provider["compat"]["supportsReasoningEffort"])
+
     def test_pi_prompt_mode_uses_print_flag(self):
         self.assertEqual(
             ["-p", "Read and follow the instructions in /home/node/.bot-bottle-prompt.txt."],

tests/unit/test_manifest_egress.py

@@ -115,6 +115,7 @@ class TestAgentProviderHostCredentials(unittest.TestCase):
         b = _provider_config_bottle({
             "template": "pi",
             "settings": {
+                "provider": "ollama",
                 "base_url": "http://ollama:11434/v1",
                 "api": "openai-completions",
                 "api_key": "ollama",
@@ -125,6 +126,7 @@ class TestAgentProviderHostCredentials(unittest.TestCase):
         })
         self.assertEqual(
             {
+                "provider": "ollama",
                 "base_url": "http://ollama:11434/v1",
                 "api": "openai-completions",
                 "api_key": "ollama",
@@ -135,6 +137,29 @@ class TestAgentProviderHostCredentials(unittest.TestCase):
             b.agent_provider.settings,
         )
 
+    def test_settings_allowed_for_pi_api_key_env(self):
+        b = _provider_config_bottle({
+            "template": "pi",
+            "settings": {
+                "provider": "openrouter",
+                "base_url": "https://openrouter.ai/api/v1",
+                "api": "openai-completions",
+                "api_key_env": "OPENROUTER_API_KEY",
+                "models": ["google/gemma-4-26b-a4b-it:free"],
+            },
+        })
+        self.assertEqual("OPENROUTER_API_KEY", b.agent_provider.settings["api_key_env"])
+
+    def test_settings_rejects_api_key_and_api_key_env_together(self):
+        with self.assertRaises(ManifestError):
+            _provider_config_bottle({
+                "template": "pi",
+                "settings": {
+                    "api_key": "literal",
+                    "api_key_env": "OPENROUTER_API_KEY",
+                },
+            })
+
     def test_settings_rejected_for_claude(self):
         with self.assertRaises(ManifestError):
             _provider_config_bottle({