@audiofool/moondog 0.2.0-beta.7 → 0.2.0

package/src/runtime/pi/custom-endpoints.mjs

@@ -0,0 +1,229 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+import { createProvider } from "@earendil-works/pi-ai";
+import { anthropicMessagesApi } from "@earendil-works/pi-ai/api/anthropic-messages.lazy";
+import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
+import { builtinModels } from "@earendil-works/pi-ai/providers/all";
+
+import { acquirePrivateFileLock, resolveMoondogAuthFile } from "./persistent-credential-store.mjs";
+
+// Endpoints the listener adds by address: any service that speaks OpenAI's Chat Completions or
+// Anthropic's Messages, such as DeepSeek, Kimi, GLM, OpenRouter, a company gateway or a model on
+// this Mac. Their keys stay in this private file. auth.json is read with a fixed set of providers
+// by older Moondogs, which would refuse the whole store with an entry they don't know.
+const DOCUMENT_VERSION = 1;
+const MAX_ENDPOINTS = 20;
+const MAX_MODELS = 500;
+const MAX_LISTING_BYTES = 2 * 1024 * 1024;
+const PREFIX = "endpoint-";
+export const ENDPOINT_FORMATS = Object.freeze(["openai", "anthropic"]);
+const apis = { openai: "openai-completions", anthropic: "anthropic-messages" };
+const transports = { openai: openAICompletionsApi, anthropic: anthropicMessagesApi };
+// Local servers often take no key, but the SDKs under Pi always send one.
+const NO_KEY = "moondog-no-key";
+const LOOPBACK = new Set(["localhost", "127.0.0.1", "[::1]"]);
+
+const printable = (value, max) => typeof value === "string" && value.length > 0 && value.length <= max && !/[\p{C}]/u.test(value);
+const plainId = (value, max) => printable(value, max) && !/\s/u.test(value);
+
+function endpointError(code, message, cause) {
+  const error = new Error(message, cause ? { cause } : undefined);
+  error.name = "MoondogRuntimeSettingsError";
+  error.code = code;
+  return error;
+}
+
+export const isEndpointProvider = (providerId) => typeof providerId === "string" && providerId.startsWith(PREFIX);
+
+// The address as the listener copied it, down to the base its format's SDK adds paths to: an
+// operation's own URL loses that operation, and Anthropic's SDK adds /v1 itself.
+export function normalizeBaseUrl(value, format) {
+  let url;
+  try { url = new URL(String(value ?? "").trim()); } catch { throw endpointError("endpoint_url_invalid", "Enter the endpoint's address, starting with https://."); }
+  if (url.username || url.password || url.search || url.hash) {
+    throw endpointError("endpoint_url_invalid", "Enter the address without a key, a query or a fragment in it.");
+  }
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && LOOPBACK.has(url.hostname))) {
+    throw endpointError("endpoint_url_invalid", "Use https://, or http:// only for a server on this Mac.");
+  }
+  url.pathname = url.pathname.replace(/\/(?:chat\/completions|responses|messages|models)\/?$/u, "").replace(/\/+$/u, "");
+  if (format === "anthropic") url.pathname = url.pathname.replace(/\/v1$/u, "");
+  return url.href.replace(/\/$/u, "");
+}
+
+export function parseModelIds(value) {
+  const ids = Array.isArray(value) ? value : String(value ?? "").split(/[\s,]+/u);
+  const kept = [...new Set(ids.map((id) => String(id).trim()).filter(Boolean))];
+  if (kept.some((id) => !plainId(id, 200))) throw endpointError("endpoint_models_invalid", "A model ID has spaces or characters an endpoint can't take.");
+  if (kept.length > MAX_MODELS) throw endpointError("endpoint_models_invalid", `An endpoint can list at most ${MAX_MODELS} models.`);
+  return kept;
+}
+
+function validEndpoint(value) {
+  if (!value || typeof value !== "object" || !isEndpointProvider(value.id) || !plainId(value.id, 60) ||
+      !printable(value.name, 60) || !ENDPOINT_FORMATS.includes(value.format) || typeof value.baseUrl !== "string" ||
+      (value.key !== undefined && !plainId(value.key, 8192)) || !Array.isArray(value.models)) {
+    throw endpointError("endpoint_store_invalid", "Moondog's endpoint file has an entry it can't read. Remove it in Settings, or delete endpoints.json.");
+  }
+  return { id: value.id, name: value.name, format: value.format, baseUrl: normalizeBaseUrl(value.baseUrl, value.format),
+    ...(value.key ? { key: value.key } : {}), models: parseModelIds(value.models) };
+}
+
+export function resolveEndpointsFile(environment = process.env) {
+  return path.join(path.dirname(resolveMoondogAuthFile(environment)), "endpoints.json");
+}
+
+export async function readEndpoints(environment = process.env) {
+  let source;
+  try {
+    source = await readFile(resolveEndpointsFile(environment), "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") return [];
+    throw endpointError("endpoint_store_invalid", "Moondog could not read its endpoints.", error);
+  }
+  let document;
+  try { document = JSON.parse(source); } catch (error) { throw endpointError("endpoint_store_invalid", "Moondog's endpoint file is not valid JSON.", error); }
+  if (!document || document.version !== DOCUMENT_VERSION || !Array.isArray(document.endpoints) || document.endpoints.length > MAX_ENDPOINTS) {
+    throw endpointError("endpoint_store_invalid", "Moondog's endpoint file uses an unsupported shape.");
+  }
+  return document.endpoints.map(validEndpoint);
+}
+
+// What a window may see of an endpoint: never its key.
+export function publicEndpoint({ key, ...shown }) {
+  return { ...shown, keySaved: Boolean(key) };
+}
+
+async function writeEndpoints(file, endpoints) {
+  await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+  const temporary = `${file}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, `${JSON.stringify({ version: DOCUMENT_VERSION, endpoints }, null, 2)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    await rename(temporary, file);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+
+const slug = (name) => name.toLowerCase().normalize("NFKD").replace(/[^a-z0-9]+/gu, "-").replace(/^-+|-+$/gu, "").slice(0, 40) || "endpoint";
+
+// Adds an endpoint, or changes the one with input.id. A key left blank keeps the saved one only while
+// the address stays the same, so a key never travels to an address it wasn't entered for. Without
+// model IDs, the endpoint is asked for its list.
+export async function saveEndpoint(input, environment = process.env, { discover = discoverModels } = {}) {
+  const format = ENDPOINT_FORMATS.includes(input?.format) ? input.format : "openai";
+  const name = String(input?.name ?? "").trim();
+  if (!printable(name, 60)) throw endpointError("endpoint_name_invalid", "Give the endpoint a short name.");
+  const baseUrl = normalizeBaseUrl(input?.baseUrl, format);
+  const typedKey = String(input?.key ?? "").trim();
+  if (typedKey && !plainId(typedKey, 8192)) throw endpointError("endpoint_key_invalid", "The key has spaces or characters a key can't have.");
+  const typedModels = parseModelIds(input?.models);
+
+  const file = resolveEndpointsFile(environment);
+  await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+  const release = await acquirePrivateFileLock(file);
+  try {
+    const endpoints = await readEndpoints(environment);
+    const previous = input?.id ? endpoints.find((endpoint) => endpoint.id === input.id) : undefined;
+    if (input?.id && !previous) throw endpointError("endpoint_unknown", "That endpoint is no longer saved.");
+    if (!previous && endpoints.length >= MAX_ENDPOINTS) throw endpointError("endpoint_limit", `Moondog keeps at most ${MAX_ENDPOINTS} endpoints.`);
+    const key = typedKey || (previous && previous.baseUrl === baseUrl && previous.format === format ? previous.key : undefined);
+    const models = typedModels.length ? typedModels : await discover({ format, baseUrl, key });
+    if (!models.length) throw endpointError("endpoint_models_missing", "The endpoint listed no models. Enter their IDs.");
+    let id = previous?.id;
+    if (!id) {
+      const base = `${PREFIX}${slug(name)}`;
+      id = base;
+      for (let count = 2; endpoints.some((endpoint) => endpoint.id === id); count++) id = `${base}-${count}`;
+    }
+    const saved = { id, name, format, baseUrl, ...(key ? { key } : {}), models };
+    const next = previous ? endpoints.map((endpoint) => (endpoint.id === id ? saved : endpoint)) : [...endpoints, saved];
+    await writeEndpoints(file, next);
+    return { endpoint: publicEndpoint(saved), typedModels: typedModels.length > 0 };
+  } finally {
+    await release();
+  }
+}
+
+export async function removeEndpoint(id, environment = process.env) {
+  const file = resolveEndpointsFile(environment);
+  await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+  const release = await acquirePrivateFileLock(file);
+  try {
+    const endpoints = await readEndpoints(environment);
+    if (!endpoints.some((endpoint) => endpoint.id === id)) return false;
+    await writeEndpoints(file, endpoints.filter((endpoint) => endpoint.id !== id));
+    return true;
+  } finally {
+    await release();
+  }
+}
+
+// The model list an endpoint publishes, in its order: OpenAI's /models or Anthropic's /v1/models.
+// Its body and errors never reach the window; only whether it worked.
+export async function discoverModels({ format, baseUrl, key }, { fetchImpl = globalThis.fetch, timeoutMs = 8000 } = {}) {
+  const url = format === "anthropic" ? `${baseUrl}/v1/models?limit=1000` : `${baseUrl}/models`;
+  const headers = format === "anthropic"
+    ? { Accept: "application/json", "anthropic-version": "2023-06-01", ...(key ? { "x-api-key": key } : {}) }
+    : { Accept: "application/json", ...(key ? { Authorization: `Bearer ${key}` } : {}) };
+  let ids;
+  try {
+    const response = await fetchImpl(url, { headers, redirect: "error", credentials: "omit", signal: AbortSignal.timeout(timeoutMs) });
+    if (!response.ok || Number(response.headers.get("content-length")) > MAX_LISTING_BYTES) throw new Error(`HTTP ${response.status}`);
+    const text = await response.text();
+    if (text.length > MAX_LISTING_BYTES) throw new Error("oversized");
+    const document = JSON.parse(text);
+    ids = (Array.isArray(document?.data) ? document.data : Array.isArray(document?.models) ? document.models : [])
+      .map((entry) => (typeof entry === "string" ? entry : entry?.id)).filter((id) => typeof id === "string");
+  } catch (error) {
+    throw endpointError("endpoint_models_unavailable", "The endpoint didn't list its models. Check the address and key, or enter the model IDs.", error);
+  }
+  return parseModelIds(ids.slice(0, MAX_MODELS));
+}
+
+// A model Pi already knows by the same ID, such as deepseek-chat or anthropic/claude-sonnet-5, keeps
+// its name and limits; through the same kind of API it also keeps its thinking levels and request
+// details. Any other model is plain text without thinking, which every compatible server takes.
+let known;
+function knownModels() {
+  if (!known) {
+    known = new Map();
+    for (const model of builtinModels().getModels()) {
+      const list = known.get(model.id) ?? [];
+      list.push(model);
+      known.set(model.id, list);
+    }
+  }
+  return known;
+}
+
+function endpointModel(endpoint, id) {
+  const api = apis[endpoint.format];
+  const matches = knownModels().get(id) ?? [];
+  const same = matches.find((model) => model.api === api);
+  const match = same ?? matches[0];
+  return {
+    id, name: match?.name ?? id, provider: endpoint.id, api, baseUrl: endpoint.baseUrl,
+    reasoning: same?.reasoning === true,
+    input: match?.input ? [...match.input] : ["text"],
+    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+    contextWindow: match?.contextWindow ?? 128_000,
+    maxTokens: match?.maxTokens ?? 8192,
+    ...(same?.thinkingLevelMap ? { thinkingLevelMap: structuredClone(same.thinkingLevelMap) } : {}),
+    ...(same?.compat ? { compat: structuredClone(same.compat) } : {}),
+  };
+}
+
+export function addEndpoints(models, endpoints = []) {
+  for (const endpoint of endpoints) {
+    models.setProvider(createProvider({
+      id: endpoint.id, name: endpoint.name, baseUrl: endpoint.baseUrl,
+      models: endpoint.models.map((id) => endpointModel(endpoint, id)),
+      auth: { apiKey: { name: `${endpoint.name} key`, resolve: async () => ({ auth: { apiKey: endpoint.key ?? NO_KEY }, source: "stored credential" }) } },
+      api: transports[endpoint.format](),
+    }));
+  }
+  return models;
+}

package/src/runtime/pi/model-catalog.mjs

@@ -4,11 +4,10 @@ import { zaiProvider } from "@earendil-works/pi-ai/providers/zai";
 
 const zaiApiBaseUrl = "https://api.z.ai/api/paas/v4";
 const providerDisplayNames = {
-  anthropic: "Anthropic (Claude)",
+  anthropic: "Anthropic",
   moonshotai: "Moonshot AI (Kimi)",
   "moonshotai-cn": "Moonshot AI China (Kimi)",
-  openai: "OpenAI (GPT)",
-  xai: "xAI (Grok)",
+  xai: "xAI",
 };
 
 export function zaiApiProvider() {
@@ -28,6 +27,9 @@ export function zaiApiProvider() {
   });
 }
 
+// Saved selections may still name these; lists offer the canonical model instead.
+export const LEGACY_MODEL_ALIASES = Object.freeze(["deepseek-v4-flash", "deepseek-v4-flash-vision-exp"]);
+
 // Pi supplies canonical Flash metadata. Keep legacy IDs as aliases so saved
 // Moondog selections continue to resolve without rewriting the listener's settings.
 function currentDeepSeekModels(nativeModels) {
@@ -39,6 +41,8 @@ function currentDeepSeekModels(nativeModels) {
 
 export function createPiModels({ catalogModels, ...options } = {}) {
   const models = builtinModels(options);
+  // ChatGPT signs in through OpenAI's own provider now; Pi's older Codex route is not offered.
+  models.deleteProvider("openai-codex");
   models.setProvider(zaiApiProvider());
   for (const native of models.getProviders()) {
     if (native.id !== "deepseek" && !catalogModels?.has(native.id)) continue;

package/src/runtime/pi/model-list.mjs

@@ -0,0 +1,122 @@
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+
+import { resolveMoondogAuthFile } from "./persistent-credential-store.mjs";
+
+// The models the listener keeps at hand: the window's model menu shows these, flat, in this order.
+// Which one answers by default stays in settings.json, which older Moondogs read with a fixed shape,
+// so the list lives in its own file beside it.
+const LIST_VERSION = 1;
+const MAX_MODELS = 40;
+const printable = (value, max) => typeof value === "string" && value.length > 0 && value.length <= max && !/[\p{C}\s]/u.test(value);
+
+function listError(message, cause) {
+  const error = new Error(message, cause ? { cause } : undefined);
+  error.name = "MoondogRuntimeSettingsError";
+  error.code = "model_list_invalid";
+  return error;
+}
+
+export const sameModel = (left, right) => Boolean(left && right) && left.provider === right.provider && left.model === right.model;
+
+export function normalizeModelList(value) {
+  if (!Array.isArray(value)) throw listError("Moondog's model list must be a list.");
+  const models = [];
+  for (const entry of value) {
+    const provider = typeof entry?.provider === "string" ? entry.provider.trim().toLowerCase() : "";
+    const model = typeof entry?.model === "string" ? entry.model.trim() : "";
+    if (!printable(provider, 80) || !printable(model, 200)) throw listError("Moondog's model list has an entry without a provider and model.");
+    if (!models.some((kept) => sameModel(kept, { provider, model }))) models.push({ provider, model });
+  }
+  if (models.length > MAX_MODELS) throw listError(`Moondog keeps at most ${MAX_MODELS} models in its list.`);
+  return models;
+}
+
+export function resolveModelListFile(environment = process.env) {
+  return path.join(path.dirname(resolveMoondogAuthFile(environment)), "models.json");
+}
+
+// Undefined until the listener first changes the list; the window then starts it from the default.
+export async function readModelList(environment = process.env) {
+  let source;
+  try {
+    source = await readFile(resolveModelListFile(environment), "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") return undefined;
+    throw listError("Moondog could not read its model list.", error);
+  }
+  let document;
+  try {
+    document = JSON.parse(source);
+  } catch (error) {
+    throw listError("Moondog's model list is not valid JSON.", error);
+  }
+  if (!document || typeof document !== "object" || document.version !== LIST_VERSION) {
+    throw listError("Moondog's model list uses an unsupported shape.");
+  }
+  return normalizeModelList(document.models);
+}
+
+export async function writeModelList(models, environment = process.env) {
+  const normalized = normalizeModelList(models);
+  const file = resolveModelListFile(environment);
+  await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+  // Another Moondog may read the list at any moment, so it never sees half a file.
+  const temporary = `${file}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, `${JSON.stringify({ version: LIST_VERSION, models: normalized }, null, 2)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    await rename(temporary, file);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+  return normalized;
+}
+
+// The model each conversation was given in the window's menu, by conversation id, so a conversation
+// keeps its own model across launches; every other one answers with the default. The oldest go first
+// past a few hundred.
+const MAX_CONVERSATIONS = 500;
+const resolveConversationModelsFile = (environment) => path.join(path.dirname(resolveMoondogAuthFile(environment)), "conversation-models.json");
+
+export async function readConversationModels(environment = process.env) {
+  let document;
+  try {
+    document = JSON.parse(await readFile(resolveConversationModelsFile(environment), "utf8"));
+  } catch (error) {
+    if (error?.code === "ENOENT") return {};
+    throw listError("Moondog could not read the models chosen for conversations.", error);
+  }
+  if (!document || document.version !== LIST_VERSION || !document.conversations || typeof document.conversations !== "object") {
+    throw listError("Moondog's conversation models use an unsupported shape.");
+  }
+  const kept = {};
+  for (const [session, value] of Object.entries(document.conversations).slice(-MAX_CONVERSATIONS)) {
+    if (!printable(session, 100)) continue;
+    const [entry] = normalizeModelList([value]);
+    kept[session] = { ...entry, ...(typeof value.effort === "string" && printable(value.effort, 20) ? { effort: value.effort } : {}) };
+  }
+  return kept;
+}
+
+// One change at a time, so two quick choices never lose either.
+let writing = Promise.resolve();
+export function writeConversationModel(session, selection, environment = process.env) {
+  const next = writing.then(async () => {
+    const saved = await readConversationModels(environment).catch(() => ({}));
+    delete saved[session];
+    if (selection) saved[session] = { provider: selection.provider, model: selection.model, ...(selection.effort ? { effort: selection.effort } : {}) };
+    const conversations = Object.fromEntries(Object.entries(saved).slice(-MAX_CONVERSATIONS));
+    const file = resolveConversationModelsFile(environment);
+    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    try {
+      await writeFile(temporary, `${JSON.stringify({ version: LIST_VERSION, conversations }, null, 2)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+      await rename(temporary, file);
+    } finally {
+      await rm(temporary, { force: true });
+    }
+  });
+  writing = next.catch(() => {});
+  return next;
+}

package/src/runtime/pi/model-settings.mjs

@@ -6,15 +6,22 @@ import {
   createPiAuthentication,
   supportedAuthProviderIds,
 } from "./authentication.mjs";
+import { isEndpointProvider, removeEndpoint, saveEndpoint } from "./custom-endpoints.mjs";
+import { LEGACY_MODEL_ALIASES } from "./model-catalog.mjs";
+import { readConversationModels, readModelList, sameModel, writeConversationModel, writeModelList } from "./model-list.mjs";
+import { chatgptProviderId } from "./provider-registry.mjs";
 import { createPersistentCredentialStore } from "./persistent-credential-store.mjs";
 import { getPublicPiModelCatalog } from "./public-model-catalog.mjs";
-import { readPiRuntimeSelection } from "./runtime-settings.mjs";
+import { clampEffort, readPiRuntimeSelection } from "./runtime-settings.mjs";
 
 // The desktop window picks models and signs in through this service, as the
 // terminal does with /model and /auth. It returns status shapes only: never a
 // credential, a prompt answer or raw provider text.
 
-const OAUTH_PROVIDER = "openai-codex";
+// The providers every listener is offered, in this order: OpenAI by a ChatGPT subscription or an API
+// key, then Anthropic, Google and xAI. Any other service is reached as an endpoint by address; Pi's
+// other providers show only once a key for one is saved or in the environment.
+const FEATURED = ["openai", "anthropic", "google", "xai"];
 // Moondog's own errors carry fixed text. Pi wraps them, and its own text may not be safe.
 const moondogErrorNames = new Set(["MoondogCredentialStoreError", "MoondogRuntimeSettingsError"]);
 
@@ -33,7 +40,7 @@ function moondogError(error) {
 const aborted = () => new DOMException("The sign-in was cancelled.", "AbortError");
 
 function signInKind(providerId) {
-  if (providerId === OAUTH_PROVIDER) return "oauth";
+  if (isEndpointProvider(providerId)) return "endpoint";
   return supportedAuthProviderIds.includes(providerId) ? "api_key" : "environment_only";
 }
 
@@ -88,25 +95,23 @@ export function createModelSettings({
     }
   };
 
-  // The same list as the terminal's /model picker: providers with models, the
-  // current one first, then ChatGPT sign-in, then by name.
-  const listed = (source, currentProvider) => source.providers()
-    .filter(provider => provider.modelCount > 0)
-    .sort((left, right) => {
-      const priority = provider => provider.id === currentProvider ? 0 : provider.id === OAUTH_PROVIDER ? 1 : 2;
-      return priority(left) - priority(right) || left.name.localeCompare(right.name);
-    });
+  const listed = (source) => source.providers().filter(provider => provider.modelCount > 0);
+  const withAuth = (source) => source.createModels({
+    credentials: createPersistentCredentialStore(environment),
+    authContext: createPiAuthContext(environment),
+  });
 
   const rows = async (source, providers) => {
     try {
-      const models = source.createModels({
-        credentials: createPersistentCredentialStore(environment),
-        authContext: createPiAuthContext(environment),
-      });
+      const models = withAuth(source);
       return await Promise.all(providers.map(async ({ id, name, modelCount }) => {
         // checkAuth reads only local state. It never refreshes OAuth or calls a provider.
         const auth = await models.checkAuth(id);
-        return { id, name, modelCount, signIn: signInKind(id), signedIn: Boolean(auth), source: signInSource(auth) };
+        const endpoint = source.endpoints?.find(entry => entry.id === id);
+        // OpenAI takes a ChatGPT sign-in as well as a key; method says which one it has.
+        return { id, name, modelCount, signIn: signInKind(id), signedIn: Boolean(auth), source: signInSource(auth),
+          ...(id === chatgptProviderId ? { chatgpt: true } : {}), ...(auth ? { method: auth.type === "oauth" ? "oauth" : "api_key" } : {}),
+          ...(endpoint ? { endpoint: { format: endpoint.format, baseUrl: endpoint.baseUrl, keySaved: Boolean(endpoint.key), models: [...endpoint.models] } } : {}) };
       }));
     } catch (error) {
       throw moondogError(error) ?? failure("auth_status_failed", "Moondog could not read its saved sign-ins.");
@@ -118,6 +123,20 @@ export function createModelSettings({
     return (await rows(source, listed(source).filter(provider => provider.id === providerId)))[0];
   };
 
+  // The models the window's menu offers: the saved list, or the default alone until the listener
+  // changes it. The default is always among them.
+  const menu = async (selection) => {
+    let entries;
+    try {
+      entries = await readModelList(environment);
+    } catch (error) {
+      throw moondogError(error) ?? failure("model_list_invalid", "Moondog could not read its model list.");
+    }
+    entries ??= [];
+    if (selection && !entries.some(entry => sameModel(entry, selection))) entries = [{ provider: selection.provider, model: selection.model }, ...entries];
+    return entries;
+  };
+
   const assertSignInProvider = (providerId) => {
     if (!supportedAuthProviderIds.includes(providerId)) {
       throw failure("auth_provider_unsupported", "Moondog can't save a sign-in for this provider. Set its API key in the environment instead.");
@@ -127,10 +146,101 @@ export function createModelSettings({
   return {
     current,
 
+    // Settings' providers: the featured ones in their order, then any other provider that has a key or
+    // is in use, by name, then the listener's endpoints in the order they were added.
     async providers({ current: currentProvider } = {}) {
       currentProvider ??= (await current().catch(() => null))?.provider;
       const source = await catalog();
-      return rows(source, listed(source, currentProvider));
+      const all = await rows(source, listed(source));
+      const featured = FEATURED.map(id => all.find(provider => provider.id === id)).filter(Boolean);
+      const others = all.filter(provider => !FEATURED.includes(provider.id) && provider.signIn !== "endpoint" &&
+        (provider.signedIn || provider.id === currentProvider)).sort((left, right) => left.name.localeCompare(right.name));
+      const endpoints = (source.endpoints ?? []).map(endpoint => all.find(provider => provider.id === endpoint.id)).filter(Boolean);
+      return [...featured, ...others, ...endpoints];
+    },
+
+    // The menu's models, each with its provider's name and whether it can answer now, and the default
+    // with the thinking level it asks for and the one its model gets.
+    async list() {
+      const selection = await current();
+      const source = await catalog();
+      const entries = await menu(selection);
+      let models;
+      try {
+        models = withAuth(source);
+      } catch (error) {
+        throw moondogError(error) ?? failure("auth_status_failed", "Moondog could not read its saved sign-ins.");
+      }
+      const names = new Map(source.providers().map(provider => [provider.id, provider.name]));
+      const ready = new Map();
+      for (const provider of new Set(entries.map(entry => entry.provider))) {
+        ready.set(provider, Boolean(await models.checkAuth(provider).catch(() => undefined)));
+      }
+      const thinks = model => Boolean(model) && getSupportedThinkingLevels(model).length > 1;
+      const defaultModel = selection && models.getModel(selection.provider, selection.model);
+      return {
+        models: entries.map(entry => {
+          const model = models.getModel(entry.provider, entry.model);
+          return { provider: entry.provider, model: entry.model, name: model?.name ?? entry.model,
+            providerName: names.get(entry.provider) ?? entry.provider, ready: Boolean(model) && ready.get(entry.provider) === true,
+            reasoning: thinks(model) };
+        }),
+        default: selection ? { provider: selection.provider, model: selection.model, effort: selection.effort ?? null,
+          reasoning: thinks(defaultModel), thinking: selection.effort && defaultModel ? clampEffort(defaultModel, selection.effort) : null } : null,
+      };
+    },
+
+    // The model each conversation was given in the window's menu, and a change to one: null gives a
+    // conversation back to the default.
+    conversationModels: () => readConversationModels(environment),
+    setConversationModel: (session, selection) => writeConversationModel(String(session), selection ?? null, environment),
+
+    // Adds a model to the menu or takes it off. The default stays.
+    async setListed(provider, model, listed) {
+      const selection = await current();
+      const entry = { provider: String(provider ?? "").trim().toLowerCase(), model: String(model ?? "").trim() };
+      if (!listed && sameModel(entry, selection)) return;
+      const entries = await menu(selection);
+      const next = listed ? (entries.some(kept => sameModel(kept, entry)) ? entries : [...entries, entry])
+        : entries.filter(kept => !sameModel(kept, entry));
+      try {
+        await writeModelList(next, environment);
+      } catch (error) {
+        throw moondogError(error) ?? failure("model_list_invalid", "Moondog could not save its model list.");
+      }
+    },
+
+    // A new endpoint whose model IDs were typed goes straight into the menu with them; listed ones
+    // wait to be chosen, since an endpoint such as OpenRouter lists hundreds.
+    async saveEndpoint(input) {
+      let saved;
+      try {
+        saved = await saveEndpoint(input, environment);
+      } catch (error) {
+        throw moondogError(error) ?? failure("endpoint_save_failed", "Moondog could not save that endpoint.");
+      }
+      if (!input?.id && saved.typedModels) {
+        const entries = await menu(await current());
+        const added = saved.endpoint.models.map(model => ({ provider: saved.endpoint.id, model }));
+        await writeModelList([...entries, ...added.filter(entry => !entries.some(kept => sameModel(kept, entry)))].slice(0, 40), environment);
+      }
+      await (await catalog()).readEndpoints?.();
+      return saved.endpoint;
+    },
+
+    // Removes an endpoint, its key and its models from the menu. A default on it stays saved, and asks
+    // for another model until one is chosen.
+    async removeEndpoint(id) {
+      try {
+        await removeEndpoint(id, environment);
+      } catch (error) {
+        throw moondogError(error) ?? failure("endpoint_remove_failed", "Moondog could not remove that endpoint.");
+      }
+      const selection = await current();
+      const entries = await menu(null);
+      const kept = entries.filter(entry => entry.provider !== id || sameModel(entry, selection));
+      if (kept.length !== entries.length) await writeModelList(kept, environment);
+      await (await catalog()).readEndpoints?.();
     },
 
     async models(providerId, { force = false, signal } = {}) {
@@ -150,7 +260,7 @@ export function createModelSettings({
       return {
         provider: providerId,
         refresh,
-        models: source.models(providerId).map(({ id, name, contextWindow, reasoning, catalogNote }) => {
+        models: source.models(providerId).filter(({ id }) => !LEGACY_MODEL_ALIASES.includes(id)).map(({ id, name, contextWindow, reasoning, catalogNote }) => {
           const model = full.getModel(providerId, id);
           return { id, name, ...(contextWindow ? { contextWindow } : {}), reasoning,
             effortLevels: model ? getSupportedThinkingLevels(model) : [],
@@ -159,7 +269,8 @@ export function createModelSettings({
       };
     },
 
-    async signIn(providerId, interaction) {
+    // method "oauth" signs in to OpenAI with ChatGPT; anything else asks for a key.
+    async signIn(providerId, interaction, { method } = {}) {
       assertSignInProvider(providerId);
       if (typeof interaction?.prompt !== "function" || typeof interaction.notify !== "function") {
         throw failure("auth_interaction_invalid", "Sign-in needs a way to ask and to show progress.");
@@ -180,7 +291,7 @@ export function createModelSettings({
             if (!shape) return;
             try { interaction.notify(shape); } catch { /* A closed window cannot stop the sign-in. */ }
           },
-        });
+        }, { method: method === "oauth" ? "oauth" : "api_key" });
       } catch (error) {
         const safe = wrapLoginError(signal?.aborted ? aborted() : moondogError(error) ?? error, providerId);
         throw failure(safe.code, safe.message);

package/src/runtime/pi/model-transport.mjs

@@ -25,7 +25,7 @@ export function safeProviderErrorMessage(value, provider) {
   const message = typeof value === "string" && value.trim()
     ? value.trim() : "The model provider request failed.";
   if (credentialBearingErrorPattern.test(message)) {
-    return `${provider === "openai-codex" ? "OpenAI Codex" : provider} authentication failed. Run moondog auth login ${provider} and try again.`;
+    return `${provider === "openai" ? "OpenAI" : provider} authentication failed. Run moondog auth login ${provider}${provider === "openai" ? " --chatgpt, or with an API key," : ""} and try again.`;
   }
   return message;
 }
@@ -66,7 +66,7 @@ export function isModelConnectionFailure(value) {
 
 export function createModelConnectionError({ provider, cause, toolsExecuted = false }) {
   const label = ({
-    "openai-codex": "OpenAI Codex", openai: "OpenAI", anthropic: "Anthropic",
+    openai: "OpenAI", anthropic: "Anthropic",
     deepseek: "DeepSeek", moonshotai: "Moonshot AI", "moonshotai-cn": "Moonshot AI China",
     xai: "xAI", zai: "Z.AI",
   })[provider] ?? (/^[a-z0-9][a-z0-9._-]{0,63}$/iu.test(provider ?? "") ? provider : "The model provider");