@gajae-code/coding-agent 0.12.7 → 0.12.10

package/src/config/model-registry.ts

@@ -37,6 +37,11 @@ import type { OAuthCredentials, OAuthLoginCallbacks } from "@gajae-code/ai/utils
 import { $pickCredentialEnv, isRecord, logger } from "@gajae-code/utils";
 import { parseModelString, resolveProviderModelReference } from "../config/model-resolver";
 import { isValidThemeColor, type ThemeColor } from "../modes/theme/theme";
+import {
+	type ActiveProviderDescriptor,
+	ActiveProviderResolutionError,
+	projectActiveProviderDescriptors,
+} from "../sdk/providers";
 import type { AuthStorage, OAuthCredential } from "../session/auth-storage";
 import type { ActiveSearchModelContext, WebSearchMode } from "../web/search/types";
 import { type ConfigError, ConfigFile } from "./config-file";
@@ -77,6 +82,20 @@ export type { CanonicalModelIndex, CanonicalModelRecord, CanonicalModelVariant,
 export { isAuthenticated, kNoAuth };
 
 const MAX_SESSION_CANONICAL_VARIANTS = 64;
+function redactDiscoveryUrl(value: string | URL): string {
+	try {
+		const url = typeof value === "string" ? new URL(value) : value;
+		return `${url.origin}${url.pathname}`;
+	} catch {
+		return "(invalid URL)";
+	}
+}
+function stripUrlQuery(value: string): string {
+	const queryStart = value.indexOf("?");
+	if (queryStart < 0) return value;
+	const fragmentStart = value.indexOf("#", queryStart);
+	return value.slice(0, queryStart) + (fragmentStart < 0 ? "" : value.slice(fragmentStart));
+}
 
 function envAvailabilityFingerprint(): string {
 	return Object.entries(process.env)
@@ -312,7 +331,10 @@ function validateProviderConfiguration(
 			throw new Error(
 				mode === "runtime-register"
 					? `Provider ${providerName}: "apiKey" or "oauth" is required when defining models.`
-					: `Provider ${providerName}: "apiKey" or "apiKeyEnv" is required when defining custom models unless auth is "none".`,
+					: `Provider ${providerName}: custom models need a credential source, but none is configured. ` +
+							`"auth" only selects the scheme ("auth: apiKey" does not supply a key). ` +
+							`Fix by adding "apiKeyEnv: <ENV_VAR>" (recommended) or "apiKey: <literal-key>", ` +
+							`or set "auth: none" if the endpoint is genuinely unauthenticated.`,
 			);
 		}
 	}
@@ -1014,6 +1036,24 @@ function getConfiguredProviderOrderFromSettings(): string[] {
 		return [];
 	}
 }
+interface ProviderActivityEvidence {
+	staticModelIds: ReadonlySet<string>;
+	staticConfigured: boolean;
+	discoveryConfigured: boolean;
+	implicitDiscovery: boolean;
+	descriptorBacked: boolean;
+	descriptorFresh: boolean;
+	descriptorModelIds: ReadonlySet<string>;
+	authGeneration: string;
+	endpoint: string;
+}
+
+interface ModelManagerDiscoveryOptions {
+	options: ModelManagerOptions<Api>;
+	authGeneration: string;
+	apiKey: string | undefined;
+	endpoint: string;
+}
 
 /**
  * Model registry - loads and manages models, resolves API keys via AuthStorage.
@@ -1028,6 +1068,21 @@ export class ModelRegistry {
 	#customProviderApiKeys: Map<string, string> = new Map();
 	#providerWebSearchModes: Map<string, WebSearchMode> = new Map();
 	#keylessProviders: Set<string> = new Set();
+	#optionalAuthProviders: Set<string> = new Set();
+	#credentiallessAuthFallbackProviders: Map<string, string> = new Map();
+	#providerEvidenceApiKeys: Map<string, string | undefined> = new Map();
+	#providerActivity: ReadonlyMap<string, ProviderActivityEvidence> = new Map();
+	#configuredProviderIds: ReadonlySet<string> = new Set();
+	#configuredDiscoveryProviderIds: ReadonlySet<string> = new Set();
+	#descriptorDiscoveryEvidence = new Map<
+		string,
+		{ fresh: boolean; modelIds: ReadonlySet<string>; authGeneration: string; endpoint: string }
+	>();
+	#descriptorDiscoveryGenerations = new Map<string, number>();
+	#configuredDiscoveryEvidence = new Map<
+		string,
+		{ authGeneration: string; endpoint: string; modelIds: ReadonlySet<string> }
+	>();
 	#discoveryManager = new ModelDiscoveryManager<DiscoveryProviderConfig>();
 	#customModelOverlays: CustomModelOverlay[] = [];
 	#providerOverrides: Map<string, ProviderOverride> = new Map();
@@ -1038,6 +1093,9 @@ export class ModelRegistry {
 	#configError: ConfigError | undefined = undefined;
 	#modelsConfigFile: ConfigFile<ModelsConfig>;
 	#lastStaticLoadMtime: number | null = null;
+	#lastStaticLoadEnvironmentFingerprint: string | undefined;
+	#staticModelsLoaded = false;
+	#lastDisabledProviderKey: string | undefined;
 	#registeredProviderSources: Set<string> = new Set();
 	#cacheDbPath?: string;
 	#suppressedSelectors: Map<string, number> = new Map();
@@ -1051,6 +1109,9 @@ export class ModelRegistry {
 	#runtimeProviderSourceByName: Map<string, string> = new Map();
 	#rebuildPending: boolean = false;
 	#rebuildSuspended: number = 0;
+	#configuredApiKeyEnvNames: Set<string> = new Set();
+	#optionalAuthPreflightGenerations = new Map<string, number>();
+	#optionalAuthPreflightEpoch = 0;
 
 	/**
 	 * @param authStorage - Auth storage for API key resolution
@@ -1120,17 +1181,48 @@ export class ModelRegistry {
 		}
 	}
 
+	#getStaticLoadEnvironmentFingerprint(): string {
+		const providerBaseUrlEnvKeys = new Set(
+			[
+				...getBundledProviders(),
+				...PROVIDER_DESCRIPTORS.map(descriptor => descriptor.providerId),
+				...this.#configuredProviderIds,
+			].flatMap(getProviderBaseUrlEnvKeys),
+		);
+		return JSON.stringify({
+			apiKeyEnv: [...this.#configuredApiKeyEnvNames].sort().map(name => [name, Bun.env[name] ?? ""]),
+			implicitEndpoints: [
+				["OLLAMA_BASE_URL", Bun.env.OLLAMA_BASE_URL || ""],
+				["LLAMA_CPP_BASE_URL", Bun.env.LLAMA_CPP_BASE_URL || ""],
+				["LM_STUDIO_BASE_URL", Bun.env.LM_STUDIO_BASE_URL || ""],
+			],
+			providerBaseUrls: [...providerBaseUrlEnvKeys].sort().map(name => [name, Bun.env[name] ?? ""]),
+		});
+	}
+
 	#reloadStaticModels(): void {
 		const currentMtime = this.#modelsConfigFile.getMtimeMs();
-		if (currentMtime !== null && currentMtime === this.#lastStaticLoadMtime) {
-			// models.json unchanged since last load; reload + canonical rebuild would be redundant.
+		const disabledProviderKey = [...getDisabledProviderIdsFromSettings()].sort().join("\u0000");
+		const environmentFingerprint = this.#getStaticLoadEnvironmentFingerprint();
+		if (
+			this.#staticModelsLoaded &&
+			currentMtime === this.#lastStaticLoadMtime &&
+			disabledProviderKey === this.#lastDisabledProviderKey &&
+			environmentFingerprint === this.#lastStaticLoadEnvironmentFingerprint
+		) {
+			// models.json and settings-derived implicit provider state are unchanged.
 			return;
 		}
 		this.#modelsConfigFile.invalidate();
 		this.#customProviderApiKeys.clear();
 		this.#providerWebSearchModes.clear();
 		this.#keylessProviders.clear();
+		this.#optionalAuthProviders.clear();
+		this.#credentiallessAuthFallbackProviders.clear();
+		this.#optionalAuthPreflightEpoch += 1;
 		this.#discoveryManager.reset();
+		for (const descriptor of PROVIDER_DESCRIPTORS) this.#clearDescriptorDiscoveryEvidence(descriptor.providerId);
+		this.#configuredDiscoveryEvidence.clear();
 		// Drop config-sourced apiKeys from AuthStorage before reload; entries
 		// removed from models.yml must actually disappear from the resolver, not
 		// linger from the previous parse. The post-load setters below repopulate.
@@ -1146,6 +1238,7 @@ export class ModelRegistry {
 		this.#modelBindingsApplier.setBindings(undefined);
 		this.#configError = undefined;
 		this.#loadModels();
+		this.#lastDisabledProviderKey = disabledProviderKey;
 	}
 
 	/**
@@ -1172,6 +1265,8 @@ export class ModelRegistry {
 		this.#configError = configError;
 		this.#keylessProviders = keylessProviders;
 		this.#discoveryManager.setProviders(discoverableProviders);
+		this.#configuredProviderIds = new Set(configuredProviders);
+		this.#configuredDiscoveryProviderIds = new Set(discoverableProviders.map(provider => provider.provider));
 		this.#customModelOverlays = customModels;
 		this.#providerOverrides = overrides;
 		this.#modelOverrides = modelOverrides;
@@ -1192,10 +1287,57 @@ export class ModelRegistry {
 		const combined = this.#mergeCustomModels(withConfigModels, this.#runtimeModelOverlays);
 		const withModelOverrides = this.#applyModelOverrides(combined, this.#modelOverrides);
 		this.#models = applyFinalCodexGpt56ContextCap(this.#applyRuntimeProviderOverrides(withModelOverrides));
+		this.#rebuildProviderActivity();
 		this.#rebuildCanonicalIndex();
 		this.#lastStaticLoadMtime = this.#modelsConfigFile.getMtimeMs();
+		this.#lastStaticLoadEnvironmentFingerprint = this.#getStaticLoadEnvironmentFingerprint();
+		this.#staticModelsLoaded = true;
 	}
 
+	#rebuildProviderActivity(): void {
+		const staticModelIds = new Map<string, Set<string>>();
+		const addStaticModel = (provider: string, id: string) => {
+			const modelIds = staticModelIds.get(provider) ?? new Set<string>();
+			modelIds.add(id);
+			staticModelIds.set(provider, modelIds);
+		};
+		for (const provider of getBundledProviders()) {
+			for (const model of getBundledModels(provider as Parameters<typeof getBundledModels>[0]) as Model<Api>[])
+				addStaticModel(provider, model.id);
+		}
+		for (const overlay of [...this.#customModelOverlays, ...this.#runtimeModelOverlays])
+			addStaticModel(overlay.provider, overlay.id);
+
+		const runtimeProviderIds = new Set(this.#runtimeProviderSourceByName.keys());
+		const providerIds = new Set<string>([
+			...this.#configuredProviderIds,
+			...this.#keylessProviders,
+			...this.#discoveryManager.providerIds(),
+			...this.#descriptorDiscoveryEvidence.keys(),
+			...runtimeProviderIds,
+			...staticModelIds.keys(),
+		]);
+		const activity = new Map<string, ProviderActivityEvidence>();
+		for (const provider of providerIds) {
+			const discoveryConfigured = this.#configuredDiscoveryProviderIds.has(provider);
+			const isDiscoveryProvider = this.#discoveryManager.providerIds().has(provider);
+			const descriptorEvidence = this.#descriptorDiscoveryEvidence.get(provider);
+			activity.set(provider, {
+				staticModelIds: new Set(staticModelIds.get(provider) ?? []),
+				staticConfigured: staticModelIds.has(provider),
+				discoveryConfigured,
+				implicitDiscovery: isDiscoveryProvider && !discoveryConfigured,
+				descriptorBacked:
+					descriptorEvidence !== undefined ||
+					(!discoveryConfigured && PROVIDER_DESCRIPTORS.some(descriptor => descriptor.providerId === provider)),
+				descriptorFresh: descriptorEvidence?.fresh ?? false,
+				descriptorModelIds: new Set(descriptorEvidence?.modelIds ?? []),
+				authGeneration: descriptorEvidence?.authGeneration ?? "",
+				endpoint: descriptorEvidence?.endpoint ?? "",
+			});
+		}
+		this.#providerActivity = activity;
+	}
 	/** Load built-in models, applying provider-level overrides only.
 	 *  Per-model overrides are applied later by #applyModelOverrides. */
 	#loadBuiltInModels(overrides: Map<string, ProviderOverride>): Model<Api>[] {
@@ -1338,6 +1480,12 @@ export class ModelRegistry {
 	}
 
 	#normalizeDiscoverableModels(providerConfig: DiscoveryProviderConfig, models: Model<Api>[]): Model<Api>[] {
+		const liveBaseUrl =
+			providerConfig.discovery.type === "openai-models-list" || providerConfig.discovery.type === "lm-studio"
+				? this.#normalizeOpenAIModelsListBaseUrl(
+						this.#getProviderBaseUrlForDiscovery(providerConfig.provider) ?? providerConfig.baseUrl,
+					)
+				: undefined;
 		return models.map(model => {
 			const normalized =
 				providerConfig.provider === "ollama" &&
@@ -1345,8 +1493,10 @@ export class ModelRegistry {
 				model.api === "openai-completions"
 					? ({ ...model, api: "openai-responses" } as Model<Api>)
 					: model;
+			const baseUrl = this.#restoreLiveDiscoveryBaseUrl(normalized.baseUrl, liveBaseUrl);
 			return {
 				...normalized,
+				...(baseUrl !== normalized.baseUrl ? { baseUrl } : {}),
 				requestTransform: providerConfig.requestTransform
 					? mergeRequestTransform(undefined, providerConfig.requestTransform)
 					: undefined,
@@ -1354,6 +1504,21 @@ export class ModelRegistry {
 			};
 		});
 	}
+	#sanitizeDiscoverableModelsForCache(providerConfig: DiscoveryProviderConfig, models: Model<Api>[]): Model<Api>[] {
+		return providerConfig.discovery.type === "openai-models-list" || providerConfig.discovery.type === "lm-studio"
+			? this.#stripModelBaseUrlQueries(models)
+			: models;
+	}
+	#stripModelBaseUrlQueries(models: readonly Model<Api>[]): Model<Api>[] {
+		return models.map(model => (model.baseUrl ? { ...model, baseUrl: stripUrlQuery(model.baseUrl) } : model));
+	}
+	#restoreLiveDiscoveryBaseUrl(modelBaseUrl: string | undefined, liveBaseUrl: string | undefined): string | undefined {
+		if (!modelBaseUrl || !liveBaseUrl?.includes("?")) return modelBaseUrl;
+		return this.#normalizeDiscoveryEvidenceEndpoint(stripUrlQuery(modelBaseUrl)) ===
+			this.#normalizeDiscoveryEvidenceEndpoint(stripUrlQuery(liveBaseUrl))
+			? liveBaseUrl
+			: modelBaseUrl;
+	}
 
 	#addImplicitDiscoverableProviders(configuredProviders: Set<string>): void {
 		const disabledProviders = getDisabledProviderIdsFromSettings();
@@ -1365,6 +1530,8 @@ export class ModelRegistry {
 				discovery: { type: "ollama" },
 				optional: true,
 			});
+			// Implicit Ollama auth is optional and may be added after startup.
+			this.#optionalAuthProviders.add("ollama");
 			this.#keylessProviders.add("ollama");
 		}
 		if (!configuredProviders.has("llama.cpp") && !disabledProviders.has("llama.cpp")) {
@@ -1375,10 +1542,9 @@ export class ModelRegistry {
 				discovery: { type: "llama.cpp" },
 				optional: true,
 			});
-			// Only mark as keyless if no API key is configured
-			if (!this.authStorage.hasAuth("llama.cpp")) {
-				this.#keylessProviders.add("llama.cpp");
-			}
+			// Implicit llama.cpp auth is optional and may be added after startup.
+			this.#optionalAuthProviders.add("llama.cpp");
+			this.#keylessProviders.add("llama.cpp");
 		}
 		if (!configuredProviders.has("lm-studio") && !disabledProviders.has("lm-studio")) {
 			this.#discoveryManager.addProvider({
@@ -1388,11 +1554,14 @@ export class ModelRegistry {
 				discovery: { type: "lm-studio" },
 				optional: true,
 			});
+			// Implicit LM Studio auth is optional and may be added after startup.
+			this.#optionalAuthProviders.add("lm-studio");
 			this.#keylessProviders.add("lm-studio");
 		}
 	}
 
 	#loadCustomModels(): CustomModelsResult {
+		this.#configuredApiKeyEnvNames.clear();
 		const { value, error, status } = this.#modelsConfigFile.tryLoad();
 
 		if (status === "error") {
@@ -1428,6 +1597,12 @@ export class ModelRegistry {
 		const configuredProviders = new Set(Object.keys(value.providers ?? {}));
 
 		for (const [providerName, providerConfig] of providerEntries) {
+			if (providerConfig.apiKeyEnv) this.#configuredApiKeyEnvNames.add(providerConfig.apiKeyEnv);
+			if (providerConfig.apiKey) this.#configuredApiKeyEnvNames.add(providerConfig.apiKey);
+			if (providerConfig.openaiCompat?.apiKeyEnv)
+				this.#configuredApiKeyEnvNames.add(providerConfig.openaiCompat.apiKeyEnv);
+			if (providerConfig.openaiCompat?.apiKey)
+				this.#configuredApiKeyEnvNames.add(providerConfig.openaiCompat.apiKey);
 			if (providerConfig.webSearch) this.#providerWebSearchModes.set(providerName, providerConfig.webSearch);
 			const providerApiKeyConfig = providerConfig.apiKey ?? resolveApiKeyEnvConfig(providerConfig.apiKeyEnv);
 			const localOpenAICompat = providerConfig.openaiCompat;
@@ -1467,6 +1642,7 @@ export class ModelRegistry {
 					this.authStorage.setConfigApiKey(providerName, localCompatResolvedKey);
 				} else {
 					keylessProviders.add(providerName);
+					this.#optionalAuthProviders.add(providerName);
 				}
 			}
 			// Always set overrides when baseUrl/headers/apiKey/authHeader/compat/disableStrictTools/transport are present
@@ -1701,15 +1877,145 @@ export class ModelRegistry {
 		).filter(provider => !disabledProviders.has(provider.provider));
 		const configuredDiscoveriesPromise =
 			selectedDiscoverableProviders.length === 0
-				? Promise.resolve<Model<Api>[]>([])
+				? Promise.resolve(
+						[] as Array<{
+							provider: string;
+							current: boolean;
+							models: Model<Api>[];
+							authGeneration: string;
+							configurationGeneration: number;
+							endpoint: string;
+							fetched: boolean;
+						}>,
+					)
 				: Promise.all(
 						selectedDiscoverableProviders.map(provider => this.#discoverProviderModels(provider, strategy)),
-					).then(results => results.flat());
-		const [configuredDiscovered, builtInDiscovered] = await Promise.all([
+					);
+		const [configuredDiscoveryResults, builtInDiscovered] = await Promise.all([
 			configuredDiscoveriesPromise,
 			this.#discoverBuiltInProviderModels(strategy, providerFilter),
 		]);
-		const discovered = [...configuredDiscovered, ...builtInDiscovered];
+		const currentConfiguredDiscoveryResults = configuredDiscoveryResults.map(result => {
+			const providerConfig = selectedDiscoverableProviders.find(provider => provider.provider === result.provider);
+			const current =
+				result.current &&
+				providerConfig !== undefined &&
+				(() => {
+					try {
+						return (
+							result.authGeneration ===
+								this.#getProviderEvidenceGeneration(
+									result.provider,
+									this.#providerEvidenceApiKeys.get(result.provider),
+								) &&
+							result.endpoint ===
+								this.#normalizeDiscoveryEvidenceEndpoint(
+									this.#effectiveDiscoveryProviderConfig(providerConfig).baseUrl ?? "",
+								)
+						);
+					} catch {
+						return false;
+					}
+				})();
+			const invalidatesPublishedState =
+				result.current &&
+				providerConfig !== undefined &&
+				(() => {
+					try {
+						return (
+							result.authGeneration !==
+								this.#getProviderEvidenceGeneration(
+									result.provider,
+									this.#providerEvidenceApiKeys.get(result.provider),
+								) ||
+							result.configurationGeneration !==
+								this.authStorage.getProviderConfigurationGeneration(result.provider) ||
+							result.endpoint !==
+								this.#normalizeDiscoveryEvidenceEndpoint(
+									this.#effectiveDiscoveryProviderConfig(providerConfig).baseUrl ?? "",
+								)
+						);
+					} catch {
+						return true;
+					}
+				})();
+			return current
+				? { ...result, invalidatesPublishedState }
+				: { ...result, current: false, models: [], fetched: false, invalidatesPublishedState };
+		});
+		const currentBuiltInDiscovered = builtInDiscovered.filter(model => {
+			const evidence = this.#descriptorDiscoveryEvidence.get(model.provider);
+			const currentEndpoint = this.#normalizeDiscoveryEvidenceEndpoint(
+				this.#getProviderBaseUrlForDiscovery(model.provider) ?? model.baseUrl ?? "",
+			);
+			const canUseCredentialDerivedXiaomiEndpoint =
+				model.provider === "xiaomi" &&
+				this.#providerEvidenceApiKeys.get("xiaomi")?.startsWith("tp-") === true &&
+				this.#runtimeProviderOverrides.get("xiaomi")?.baseUrl === undefined &&
+				this.#providerOverrides.get("xiaomi")?.baseUrl === undefined &&
+				resolveProviderBaseUrlFromEnv("xiaomi") === undefined;
+			try {
+				return (
+					evidence !== undefined &&
+					evidence.authGeneration ===
+						this.#getProviderEvidenceGeneration(
+							model.provider,
+							this.#providerEvidenceApiKeys.get(model.provider),
+						) &&
+					(evidence.endpoint === currentEndpoint ||
+						(canUseCredentialDerivedXiaomiEndpoint &&
+							evidence.endpoint === this.#normalizeDiscoveryEvidenceEndpoint(model.baseUrl ?? ""))) &&
+					evidence.modelIds.has(model.id)
+				);
+			} catch {
+				return false;
+			}
+		});
+		const configuredDiscoveryEvidence = new Map(
+			currentConfiguredDiscoveryResults
+				.filter(result => result.current)
+				.map(result => [
+					result.provider,
+					{
+						authGeneration: result.authGeneration,
+						endpoint: result.endpoint,
+						modelIds: new Set(result.models.map(model => model.id)),
+					},
+				]),
+		);
+		const configuredDiscoveries = new Map(currentConfiguredDiscoveryResults.map(result => [result.provider, result]));
+		const configuredDiscovered = currentConfiguredDiscoveryResults.flatMap(result => result.models);
+		const discovered = [...configuredDiscovered, ...currentBuiltInDiscovered];
+		for (const provider of selectedDiscoverableProviders) {
+			const evidence = configuredDiscoveryEvidence.get(provider.provider);
+			const discovery = configuredDiscoveries.get(provider.provider);
+			const state = this.#discoveryManager.getState(provider.provider);
+			if (!discovery?.current) {
+				if (discovery?.invalidatesPublishedState) this.#discoveryManager.invalidate(provider.provider);
+				continue;
+			}
+			const currentAuthGeneration = discovery.authGeneration;
+			const currentEndpoint = this.#normalizeDiscoveryEvidenceEndpoint(
+				this.#effectiveDiscoveryProviderConfig(provider).baseUrl ?? "",
+			);
+			if (
+				evidence !== undefined &&
+				state?.status === "ok" &&
+				discovery.fetched &&
+				currentAuthGeneration === evidence.authGeneration &&
+				currentEndpoint === evidence.endpoint
+			) {
+				this.#configuredDiscoveryEvidence.set(provider.provider, evidence);
+			} else if (
+				(state?.status !== "cached" && !(state?.status === "ok" && !discovery.fetched)) ||
+				state.error !== undefined ||
+				this.#configuredDiscoveryEvidence.get(provider.provider)?.authGeneration !== currentAuthGeneration ||
+				this.#configuredDiscoveryEvidence.get(provider.provider)?.endpoint !== currentEndpoint
+			) {
+				this.#configuredDiscoveryEvidence.delete(provider.provider);
+			}
+		}
+		this.#rebuildProviderActivity();
 		if (discovered.length === 0) {
 			return;
 		}
@@ -1734,40 +2040,198 @@ export class ModelRegistry {
 	async #discoverProviderModels(
 		providerConfig: DiscoveryProviderConfig,
 		strategy: ModelRefreshStrategy,
-	): Promise<Model<Api>[]> {
-		const mergeInput = await this.#discoveryManager.discover(providerConfig, strategy, {
+	): Promise<{
+		provider: string;
+		current: boolean;
+		models: Model<Api>[];
+		authGeneration: string;
+		configurationGeneration: number;
+		endpoint: string;
+		fetched: boolean;
+	}> {
+		const provider = providerConfig.provider;
+		const preflightEpoch = this.#optionalAuthPreflightEpoch;
+		const preflightGeneration = (this.#optionalAuthPreflightGenerations.get(provider) ?? 0) + 1;
+		this.#optionalAuthPreflightGenerations.set(provider, preflightGeneration);
+		const isCurrentPreflight = () =>
+			this.#optionalAuthPreflightEpoch === preflightEpoch &&
+			this.#optionalAuthPreflightGenerations.get(provider) === preflightGeneration;
+		let preflightApiKey: string | undefined;
+		let preflightFailed = false;
+		let preflightStale = false;
+		let preflightCompleted = false;
+		const optionalAuth = this.#optionalAuthProviders.has(provider);
+		const shouldPreflightAuth = optionalAuth
+			? this.authStorage.has(provider) || this.authStorage.hasAuth(provider)
+			: !this.#isCredentiallessProvider(provider);
+		let preflightAuthConfigurationGeneration = this.authStorage.getProviderConfigurationGeneration(provider);
+		let preflightOAuthRefreshGeneration = this.authStorage.getProviderOAuthRefreshGeneration(provider);
+		if (shouldPreflightAuth) {
+			if (optionalAuth && isCurrentPreflight()) this.#credentiallessAuthFallbackProviders.delete(provider);
+			let apiKey: string | undefined;
+			try {
+				apiKey = await this.#peekApiKeyForProvider(provider, {
+					ignoreCredentiallessFallback: optionalAuth,
+					refreshOAuth: true,
+					baseUrl: providerConfig.baseUrl,
+				});
+				const currentAuthConfigurationGeneration = this.authStorage.getProviderConfigurationGeneration(provider);
+				if (preflightAuthConfigurationGeneration !== currentAuthConfigurationGeneration) {
+					const currentOAuthRefreshGeneration = this.authStorage.getProviderOAuthRefreshGeneration(provider);
+					if (
+						currentOAuthRefreshGeneration === preflightOAuthRefreshGeneration ||
+						currentAuthConfigurationGeneration - preflightAuthConfigurationGeneration !==
+							currentOAuthRefreshGeneration - preflightOAuthRefreshGeneration
+					) {
+						preflightStale = true;
+					} else {
+						preflightAuthConfigurationGeneration = currentAuthConfigurationGeneration;
+						preflightOAuthRefreshGeneration = currentOAuthRefreshGeneration;
+					}
+				}
+			} catch (error) {
+				preflightFailed = true;
+				logger.warn("model discovery credential preflight failed", {
+					provider,
+					error: error instanceof Error ? error.message : String(error),
+				});
+			}
+			preflightApiKey = apiKey;
+			preflightCompleted = true;
+			if (!preflightFailed && optionalAuth && isCurrentPreflight()) {
+				this.#providerEvidenceApiKeys.set(provider, apiKey);
+				const authGeneration = this.authStorage.getProviderEvidenceGeneration(provider, apiKey);
+				if (apiKey === undefined) this.#credentiallessAuthFallbackProviders.set(provider, authGeneration);
+				else this.#credentiallessAuthFallbackProviders.delete(provider);
+			}
+		}
+		const effectiveProviderConfig = this.#effectiveDiscoveryProviderConfig(providerConfig);
+		const endpoint = this.#normalizeDiscoveryEvidenceEndpoint(effectiveProviderConfig.baseUrl ?? "");
+		if (!isCurrentPreflight() || preflightStale) {
+			return {
+				provider: effectiveProviderConfig.provider,
+				current: false,
+				models: [],
+				authGeneration: this.#getProviderEvidenceGeneration(provider, preflightApiKey),
+				configurationGeneration: preflightAuthConfigurationGeneration,
+				endpoint,
+				fetched: false,
+			};
+		}
+		if (optionalAuth && preflightFailed) {
+			return {
+				provider: effectiveProviderConfig.provider,
+				current: false,
+				models: [],
+				authGeneration: this.#getProviderEvidenceGeneration(provider, preflightApiKey),
+				configurationGeneration: preflightAuthConfigurationGeneration,
+				endpoint,
+				fetched: false,
+			};
+		}
+		const authGenerationBeforeDiscovery = this.#getProviderEvidenceGeneration(provider, preflightApiKey);
+		const isCurrentEndpoint = () =>
+			endpoint ===
+			this.#normalizeDiscoveryEvidenceEndpoint(this.#effectiveDiscoveryProviderConfig(providerConfig).baseUrl ?? "");
+		const evidence = this.#configuredDiscoveryEvidence.get(provider);
+		const refreshStrategy =
+			strategy === "online-if-uncached" &&
+			evidence !== undefined &&
+			(evidence.authGeneration !== authGenerationBeforeDiscovery || evidence.endpoint !== endpoint)
+				? "online"
+				: strategy;
+		const mergeInput = await this.#discoveryManager.discover(effectiveProviderConfig, refreshStrategy, {
 			cacheDbPath: this.#cacheDbPath,
-			requiresAuth: provider => !this.#keylessProviders.has(provider.provider),
-			peekApiKey: provider => this.#peekApiKeyForProvider(provider.provider),
+			requiresAuth: provider => !this.#isCredentiallessProvider(provider.provider),
+			peekApiKey: async provider =>
+				preflightCompleted
+					? preflightApiKey
+					: this.#peekApiKeyForProvider(provider.provider, {
+							refreshOAuth: true,
+							baseUrl: provider.baseUrl,
+						}),
 			isAuthenticated,
-			fetchModels: provider => this.#discoverModelsByProviderType(provider),
+			fetchModels: async (provider, apiKey) =>
+				this.#sanitizeDiscoverableModelsForCache(
+					provider,
+					await this.#discoverModelsByProviderType(provider, apiKey),
+				),
+			getEvidenceGeneration: provider => this.#getProviderEvidenceGeneration(provider.provider, preflightApiKey),
+			canPublishCache: () => isCurrentEndpoint(),
 		});
-		if (!mergeInput.current) return [];
+		const authGeneration =
+			mergeInput.authGeneration ??
+			this.#getProviderEvidenceGeneration(effectiveProviderConfig.provider, preflightApiKey);
+		const current =
+			mergeInput.current &&
+			authGeneration === this.#getProviderEvidenceGeneration(effectiveProviderConfig.provider, preflightApiKey) &&
+			isCurrentEndpoint();
+		if (!current) {
+			return {
+				provider: effectiveProviderConfig.provider,
+				current: false,
+				models: [],
+				authGeneration,
+				configurationGeneration: preflightAuthConfigurationGeneration,
+				endpoint,
+				fetched: false,
+			};
+		}
 		if (mergeInput.warning) {
 			logger.warn("model discovery failed for provider", {
-				provider: providerConfig.provider,
-				url: providerConfig.baseUrl,
+				provider: effectiveProviderConfig.provider,
+				url: redactDiscoveryUrl(effectiveProviderConfig.baseUrl ?? ""),
 				error: mergeInput.warning,
 			});
 		}
-		return this.#applyProviderModelOverrides(
-			providerConfig.provider,
-			this.#normalizeDiscoverableModels(
-				providerConfig,
-				this.#applyProviderCompat(providerConfig.compat, [...mergeInput.models]),
+		this.#providerEvidenceApiKeys.set(effectiveProviderConfig.provider, preflightApiKey);
+		return {
+			provider: effectiveProviderConfig.provider,
+			current: true,
+			authGeneration,
+			configurationGeneration: preflightAuthConfigurationGeneration,
+			endpoint,
+			fetched: mergeInput.fetched ?? false,
+			models: this.#applyProviderModelOverrides(
+				effectiveProviderConfig.provider,
+				this.#normalizeDiscoverableModels(
+					effectiveProviderConfig,
+					this.#applyProviderCompat(effectiveProviderConfig.compat, [...mergeInput.models]),
+				),
 			),
-		);
+		};
+	}
+	#effectiveDiscoveryProviderConfig(providerConfig: DiscoveryProviderConfig): DiscoveryProviderConfig {
+		const override = this.#runtimeProviderOverrides.get(providerConfig.provider);
+		const baseUrl = this.#getProviderBaseUrlForDiscovery(providerConfig.provider) ?? providerConfig.baseUrl;
+		const effectiveBaseUrl =
+			providerConfig.discovery.type === "ollama"
+				? this.#normalizeOllamaBaseUrl(baseUrl)
+				: providerConfig.discovery.type === "llama.cpp"
+					? this.#normalizeLlamaCppBaseUrl(baseUrl)
+					: this.#normalizeOpenAIModelsListBaseUrl(baseUrl);
+		return {
+			...providerConfig,
+			baseUrl: effectiveBaseUrl,
+			headers: override?.headers ? { ...providerConfig.headers, ...override.headers } : providerConfig.headers,
+			compat: override?.compat ? mergeCompat(providerConfig.compat, override.compat) : providerConfig.compat,
+			requestTransform: mergeRequestTransform(providerConfig.requestTransform, override?.requestTransform),
+			cacheRetention: override?.cacheRetention ?? providerConfig.cacheRetention,
+		};
 	}
 
-	#discoverModelsByProviderType(providerConfig: DiscoveryProviderConfig): Promise<Model<Api>[]> {
+	#discoverModelsByProviderType(
+		providerConfig: DiscoveryProviderConfig,
+		apiKey: string | undefined,
+	): Promise<Model<Api>[]> {
 		switch (providerConfig.discovery.type) {
 			case "ollama":
-				return this.#discoverOllamaModels(providerConfig);
+				return this.#discoverOllamaModels(providerConfig, apiKey);
 			case "llama.cpp":
-				return this.#discoverLlamaCppModels(providerConfig);
+				return this.#discoverLlamaCppModels(providerConfig, apiKey);
 			case "lm-studio":
 			case "openai-models-list":
-				return this.#discoverOpenAIModelsList(providerConfig);
+				return this.#discoverOpenAIModelsList(providerConfig, apiKey);
 		}
 	}
 
@@ -1777,22 +2241,21 @@ export class ModelRegistry {
 	): Promise<Model<Api>[]> {
 		// Skip providers already handled by configured discovery (e.g. user-configured ollama with discovery.type)
 		const configuredDiscoveryProviders = new Set(this.#discoveryManager.providers.map(p => p.provider));
-		const managerOptions = (await this.#collectBuiltInModelManagerOptions()).filter(opts => {
-			if (configuredDiscoveryProviders.has(opts.providerId)) {
-				return false;
-			}
-			return providerFilter ? providerFilter.has(opts.providerId) : true;
-		});
+		const managerOptions = (await this.#collectBuiltInModelManagerOptions(configuredDiscoveryProviders)).filter(
+			entry => (providerFilter ? providerFilter.has(entry.options.providerId) : true),
+		);
 		if (managerOptions.length === 0) {
 			return [];
 		}
 		const discoveries = await Promise.all(
-			managerOptions.map(options => this.#discoverWithModelManager(options, strategy)),
+			managerOptions.map(entry => this.#discoverWithModelManager(entry, strategy)),
 		);
 		return discoveries.flat();
 	}
 
-	async #collectBuiltInModelManagerOptions(): Promise<ModelManagerOptions<Api>[]> {
+	async #collectBuiltInModelManagerOptions(
+		excludedProviderIds: ReadonlySet<string> = new Set(),
+	): Promise<ModelManagerDiscoveryOptions[]> {
 		const specialProviderDescriptors: Array<{
 			providerId: string;
 			resolveKey: (value: string | undefined) => string | undefined;
@@ -1830,55 +2293,180 @@ export class ModelRegistry {
 		];
 		const disabledProviders = getDisabledProviderIdsFromSettings();
 		const standardProviderDescriptors = PROVIDER_DESCRIPTORS.filter(
-			descriptor => !disabledProviders.has(descriptor.providerId),
+			descriptor => !disabledProviders.has(descriptor.providerId) && !excludedProviderIds.has(descriptor.providerId),
 		);
 		const enabledSpecialProviderDescriptors = specialProviderDescriptors.filter(
-			descriptor => !disabledProviders.has(descriptor.providerId),
+			descriptor => !disabledProviders.has(descriptor.providerId) && !excludedProviderIds.has(descriptor.providerId),
 		);
+		for (const descriptor of standardProviderDescriptors) {
+			if (!descriptor.allowUnauthenticated) continue;
+			this.#keylessProviders.add(descriptor.providerId);
+			this.#optionalAuthProviders.add(descriptor.providerId);
+		}
 		// Use peekApiKey to avoid OAuth token refresh during discovery.
 		// The token is only needed if the dynamic fetch fires (cache miss),
 		// and failures there are handled gracefully.
-		const peekKey = (descriptor: { providerId: string }) => this.#peekApiKeyForProvider(descriptor.providerId);
-		const [standardProviderKeys, specialKeys] = await Promise.all([
+		const peekKey = async (descriptor: { providerId: string }) => {
+			const configurationGeneration = this.authStorage.getProviderConfigurationGeneration(descriptor.providerId);
+			const apiKey = await this.#peekApiKeyForProvider(descriptor.providerId);
+			if (configurationGeneration !== this.authStorage.getProviderConfigurationGeneration(descriptor.providerId)) {
+				return { apiKey: undefined, authGeneration: undefined };
+			}
+			return {
+				apiKey,
+				authGeneration: this.#getProviderEvidenceGeneration(descriptor.providerId, apiKey),
+			};
+		};
+		const [standardProviderCredentials, specialProviderCredentials] = await Promise.all([
 			Promise.all(standardProviderDescriptors.map(peekKey)),
 			Promise.all(enabledSpecialProviderDescriptors.map(peekKey)),
 		]);
-		const options: ModelManagerOptions<Api>[] = [];
+		const options: ModelManagerDiscoveryOptions[] = [];
 		for (let i = 0; i < standardProviderDescriptors.length; i++) {
 			const descriptor = standardProviderDescriptors[i];
-			const apiKey = standardProviderKeys[i];
-			if (isAuthenticated(apiKey) || descriptor.allowUnauthenticated) {
-				options.push(
-					descriptor.createModelManagerOptions({
+			const { apiKey, authGeneration } = standardProviderCredentials[i];
+			if (
+				authGeneration !== undefined &&
+				authGeneration === this.#getProviderEvidenceGeneration(descriptor.providerId, apiKey) &&
+				(isAuthenticated(apiKey) || descriptor.allowUnauthenticated)
+			) {
+				const baseUrl = this.#getProviderBaseUrlForDiscovery(descriptor.providerId);
+				options.push({
+					options: descriptor.createModelManagerOptions({
 						apiKey: isAuthenticated(apiKey) ? apiKey : undefined,
-						baseUrl: this.#getProviderBaseUrlForDiscovery(descriptor.providerId),
+						baseUrl,
 					}),
-				);
+					authGeneration,
+					apiKey,
+					endpoint: this.#normalizeDiscoveryEvidenceEndpoint(baseUrl ?? ""),
+				});
 			}
 		}
 
 		for (let i = 0; i < enabledSpecialProviderDescriptors.length; i++) {
 			const descriptor = enabledSpecialProviderDescriptors[i];
-			const key = descriptor.resolveKey(specialKeys[i]);
-			if (!isAuthenticated(key)) {
-				continue;
+			const { apiKey: apiKeyValue, authGeneration } = specialProviderCredentials[i];
+			const key = descriptor.resolveKey(apiKeyValue);
+			if (
+				authGeneration !== undefined &&
+				authGeneration === this.#getProviderEvidenceGeneration(descriptor.providerId, apiKeyValue) &&
+				isAuthenticated(key)
+			) {
+				const managerOptions = descriptor.createOptions(key);
+				options.push({
+					options: managerOptions,
+					authGeneration,
+					apiKey: apiKeyValue,
+					endpoint: this.#normalizeDiscoveryEvidenceEndpoint(
+						this.#getProviderBaseUrlForDiscovery(descriptor.providerId) ?? "",
+					),
+				});
 			}
-			options.push(descriptor.createOptions(key));
 		}
 		return options;
 	}
 
 	async #discoverWithModelManager(
-		options: ModelManagerOptions<Api>,
+		{ options, authGeneration, apiKey, endpoint }: ModelManagerDiscoveryOptions,
 		strategy: ModelRefreshStrategy,
 	): Promise<Model<Api>[]> {
+		const generation = (this.#descriptorDiscoveryGenerations.get(options.providerId) ?? 0) + 1;
+		this.#descriptorDiscoveryGenerations.set(options.providerId, generation);
+		const canUseCredentialDerivedXiaomiEndpoint =
+			options.providerId === "xiaomi" &&
+			apiKey?.startsWith("tp-") === true &&
+			this.#runtimeProviderOverrides.get("xiaomi")?.baseUrl === undefined &&
+			this.#providerOverrides.get("xiaomi")?.baseUrl === undefined &&
+			resolveProviderBaseUrlFromEnv("xiaomi") === undefined;
+		let credentialDerivedEndpoint: string | undefined;
+		const isCurrentDiscovery = () =>
+			(this.#descriptorDiscoveryGenerations.get(options.providerId) ?? 0) === generation &&
+			this.#getProviderEvidenceGeneration(options.providerId, apiKey) === authGeneration &&
+			(endpoint ===
+				this.#normalizeDiscoveryEvidenceEndpoint(this.#getProviderBaseUrlForDiscovery(options.providerId) ?? "") ||
+				(canUseCredentialDerivedXiaomiEndpoint && credentialDerivedEndpoint !== undefined));
 		try {
-			const manager = createModelManager({ ...options, cacheDbPath: this.#cacheDbPath });
-			const result = await manager.refresh(strategy);
-			return result.models.map(model =>
-				model.provider === options.providerId ? model : { ...model, provider: options.providerId },
-			);
+			const manager = createModelManager({
+				...options,
+				cacheDbPath: this.#cacheDbPath,
+				canPublishCache: isCurrentDiscovery,
+				...(options.fetchDynamicModels
+					? {
+							fetchDynamicModels: async () => {
+								const models = await options.fetchDynamicModels?.();
+								if (models === null) return null;
+								const sanitizedModels = this.#stripModelBaseUrlQueries(models ?? []);
+								if (canUseCredentialDerivedXiaomiEndpoint) {
+									credentialDerivedEndpoint = sanitizedModels[0]?.baseUrl;
+								}
+								return sanitizedModels;
+							},
+						}
+					: {}),
+				...(options.modelsDev
+					? {
+							modelsDev: {
+								...options.modelsDev,
+								map: (payload, providerId) =>
+									this.#stripModelBaseUrlQueries(options.modelsDev?.map(payload, providerId) ?? []),
+							},
+						}
+					: {}),
+			});
+			const evidence = this.#descriptorDiscoveryEvidence.get(options.providerId);
+			const refreshStrategy =
+				strategy === "online-if-uncached" &&
+				(evidence?.authGeneration !== authGeneration || evidence.endpoint !== endpoint)
+					? "online"
+					: strategy;
+			const result = await manager.refresh(refreshStrategy);
+			const liveBaseUrl = this.#getProviderBaseUrlForDiscovery(options.providerId);
+			const models = result.models.map(model => {
+				const baseUrl = this.#restoreLiveDiscoveryBaseUrl(model.baseUrl, liveBaseUrl);
+				return {
+					...(model.provider === options.providerId ? model : { ...model, provider: options.providerId }),
+					...(baseUrl !== model.baseUrl ? { baseUrl } : {}),
+				};
+			});
+			if (
+				isCurrentDiscovery() &&
+				(result.fetched ||
+					result.stale ||
+					this.#descriptorDiscoveryEvidence.get(options.providerId)?.authGeneration !== authGeneration ||
+					this.#descriptorDiscoveryEvidence.get(options.providerId)?.endpoint !== endpoint)
+			) {
+				this.#descriptorDiscoveryEvidence.set(options.providerId, {
+					fresh: result.fetched,
+					modelIds: new Set(models.map(model => model.id)),
+					authGeneration,
+					endpoint: this.#normalizeDiscoveryEvidenceEndpoint(models[0]?.baseUrl ?? endpoint),
+				});
+			}
+			if (!isCurrentDiscovery()) {
+				return [];
+			}
+			this.#providerEvidenceApiKeys.set(options.providerId, apiKey);
+			if (options.providerId === "opencodex" && !isAuthenticated(apiKey)) {
+				this.#credentiallessAuthFallbackProviders.set(options.providerId, authGeneration);
+				const evidence = this.#descriptorDiscoveryEvidence.get(options.providerId);
+				if (evidence?.authGeneration === authGeneration) {
+					this.#descriptorDiscoveryEvidence.set(options.providerId, {
+						...evidence,
+						authGeneration: this.#getProviderEvidenceGeneration(options.providerId),
+					});
+				}
+			}
+			return models;
 		} catch (error) {
+			if (isCurrentDiscovery()) {
+				this.#providerEvidenceApiKeys.set(options.providerId, apiKey);
+				this.#descriptorDiscoveryEvidence.set(options.providerId, {
+					fresh: false,
+					modelIds: new Set(),
+					authGeneration,
+					endpoint,
+				});
+			}
 			logger.warn("model discovery failed for provider", {
 				provider: options.providerId,
 				error: error instanceof Error ? error.message : String(error),
@@ -1938,10 +2526,21 @@ export class ModelRegistry {
 		}
 	}
 
-	async #discoverOllamaModels(providerConfig: DiscoveryProviderConfig): Promise<Model<Api>[]> {
+	async #discoverOllamaModels(
+		providerConfig: DiscoveryProviderConfig,
+		discoveryApiKey?: string,
+	): Promise<Model<Api>[]> {
 		const endpoint = this.#normalizeOllamaBaseUrl(providerConfig.baseUrl);
 		const tagsUrl = `${endpoint}/api/tags`;
-		const headers = { ...(providerConfig.headers ?? {}) };
+		const headers: Record<string, string> = { ...(providerConfig.headers ?? {}) };
+		const apiKey =
+			discoveryApiKey ??
+			(this.#isCredentiallessProvider(providerConfig.provider)
+				? kNoAuth
+				: await this.authStorage.getApiKey(providerConfig.provider));
+		if (apiKey && apiKey !== DEFAULT_LOCAL_TOKEN && apiKey !== kNoAuth) {
+			headers.Authorization = `Bearer ${apiKey}`;
+		}
 		const response = await fetch(tagsUrl, {
 			headers,
 			signal: AbortSignal.timeout(250),
@@ -2006,12 +2605,19 @@ export class ModelRegistry {
 		}
 	}
 
-	async #discoverLlamaCppModels(providerConfig: DiscoveryProviderConfig): Promise<Model<Api>[]> {
+	async #discoverLlamaCppModels(
+		providerConfig: DiscoveryProviderConfig,
+		discoveryApiKey?: string,
+	): Promise<Model<Api>[]> {
 		const baseUrl = this.#normalizeLlamaCppBaseUrl(providerConfig.baseUrl);
 		const modelsUrl = `${baseUrl}/models`;
 
 		const headers: Record<string, string> = { ...(providerConfig.headers ?? {}) };
-		const apiKey = await this.authStorage.getApiKey(providerConfig.provider);
+		const apiKey =
+			discoveryApiKey ??
+			(this.#isCredentiallessProvider(providerConfig.provider)
+				? kNoAuth
+				: await this.authStorage.getApiKey(providerConfig.provider));
 		if (apiKey && apiKey !== DEFAULT_LOCAL_TOKEN && apiKey !== kNoAuth) {
 			headers.Authorization = `Bearer ${apiKey}`;
 		}
@@ -2056,15 +2662,24 @@ export class ModelRegistry {
 		return this.#applyProviderModelOverrides(providerConfig.provider, discovered);
 	}
 
-	async #discoverOpenAIModelsList(providerConfig: DiscoveryProviderConfig): Promise<Model<Api>[]> {
+	async #discoverOpenAIModelsList(
+		providerConfig: DiscoveryProviderConfig,
+		discoveryApiKey?: string,
+	): Promise<Model<Api>[]> {
 		const baseUrl = this.#normalizeOpenAIModelsListBaseUrl(providerConfig.baseUrl);
-		const modelsUrl = `${baseUrl}/models`;
+		const modelsUrl = new URL(baseUrl);
+		const requestBaseUrl = baseUrl;
+		modelsUrl.pathname = `${modelsUrl.pathname.replace(/\/+$/g, "")}/models`;
 
 		const headers: Record<string, string> = { ...(providerConfig.headers ?? {}) };
 		// Resolve with the same baseUrl context completion requests use so an
 		// endpoint-scoped (or config-pinned) credential wins here exactly as it
 		// does for chat completions.
-		const apiKey = await this.authStorage.getApiKey(providerConfig.provider, undefined, { baseUrl });
+		const apiKey =
+			discoveryApiKey ??
+			(this.#isCredentiallessProvider(providerConfig.provider)
+				? kNoAuth
+				: await this.authStorage.getApiKey(providerConfig.provider, undefined, { baseUrl }));
 		if (apiKey && apiKey !== DEFAULT_LOCAL_TOKEN && apiKey !== kNoAuth) {
 			headers.Authorization = `Bearer ${apiKey}`;
 		}
@@ -2078,10 +2693,10 @@ export class ModelRegistry {
 				// Redacted by construction: name the provider, endpoint, and the
 				// config surface to fix — never the resolved key.
 				throw new Error(
-					`HTTP ${response.status} from ${modelsUrl}: provider "${providerConfig.provider}" credential was rejected for OpenAI models-list discovery; check providers.${providerConfig.provider}.apiKey/apiKeyEnv.`,
+					`HTTP ${response.status} from ${redactDiscoveryUrl(modelsUrl)}: provider "${providerConfig.provider}" credential was rejected for OpenAI models-list discovery; check providers.${providerConfig.provider}.apiKey/apiKeyEnv.`,
 				);
 			}
-			throw new Error(`HTTP ${response.status} from ${modelsUrl}`);
+			throw new Error(`HTTP ${response.status} from ${redactDiscoveryUrl(modelsUrl)}`);
 		}
 		const payload = (await response.json()) as { data?: Array<{ id: string }> };
 		const models = payload.data ?? [];
@@ -2095,7 +2710,7 @@ export class ModelRegistry {
 					name: id,
 					api: providerConfig.api,
 					provider: providerConfig.provider,
-					baseUrl,
+					baseUrl: requestBaseUrl,
 					reasoning: false,
 					input: ["text"],
 					cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
@@ -2124,7 +2739,6 @@ export class ModelRegistry {
 			return raw;
 		}
 	}
-
 	#toLlamaCppNativeBaseUrl(baseUrl: string): string {
 		try {
 			const parsed = new URL(baseUrl);
@@ -2136,7 +2750,43 @@ export class ModelRegistry {
 			return baseUrl.endsWith("/v1") ? baseUrl.slice(0, -3) : baseUrl;
 		}
 	}
-
+	#normalizeDiscoveryEvidenceEndpoint(endpoint: string): string {
+		try {
+			const parsed = new URL(endpoint);
+			const trimmedPath = parsed.pathname.replace(/\/+$/g, "");
+			return `${parsed.protocol}//${parsed.host}${trimmedPath}${parsed.search}`;
+		} catch {
+			return endpoint.replace(/\/+$/g, "");
+		}
+	}
+	#isCredentiallessProvider(provider: string): boolean {
+		let fallbackMatchesCurrentEvidence = false;
+		const fallbackEvidenceGeneration = this.#credentiallessAuthFallbackProviders.get(provider);
+		if (fallbackEvidenceGeneration !== undefined) {
+			try {
+				fallbackMatchesCurrentEvidence =
+					fallbackEvidenceGeneration ===
+					this.authStorage.getProviderEvidenceGeneration(provider, this.#providerEvidenceApiKeys.get(provider));
+			} catch {
+				// AuthStorage may be unavailable while a registry is being torn down.
+			}
+		}
+		return (
+			this.#keylessProviders.has(provider) &&
+			(!this.#optionalAuthProviders.has(provider) ||
+				(!this.authStorage.hasAuth(provider) && !this.authStorage.has(provider)) ||
+				fallbackMatchesCurrentEvidence)
+		);
+	}
+	#getProviderEvidenceGeneration(provider: string, resolvedApiKey?: string): string {
+		if (this.#isCredentiallessProvider(provider)) {
+			return `credentialless:${provider}`;
+		}
+		return this.authStorage.getProviderEvidenceGeneration(
+			provider,
+			resolvedApiKey ?? this.#providerEvidenceApiKeys.get(provider),
+		);
+	}
 	#normalizeOpenAIModelsListBaseUrl(baseUrl?: string): string {
 		const defaultBaseUrl = "http://127.0.0.1:1234/v1";
 		const raw = baseUrl || defaultBaseUrl;
@@ -2144,7 +2794,7 @@ export class ModelRegistry {
 			const parsed = new URL(raw);
 			const trimmedPath = parsed.pathname.replace(/\/+$/g, "");
 			parsed.pathname = trimmedPath.endsWith("/v1") ? trimmedPath || "/v1" : `${trimmedPath}/v1`;
-			return `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+			return `${parsed.protocol}//${parsed.host}${parsed.pathname}${parsed.search}`;
 		} catch {
 			return raw;
 		}
@@ -2189,6 +2839,7 @@ export class ModelRegistry {
 
 	#getProviderBaseUrlForDiscovery(provider: string): string | undefined {
 		return (
+			this.#runtimeProviderOverrides.get(provider)?.baseUrl ??
 			this.#providerOverrides.get(provider)?.baseUrl ??
 			resolveProviderBaseUrlFromEnv(provider) ??
 			this.getProviderBaseUrl(provider)
@@ -2505,6 +3156,103 @@ export class ModelRegistry {
 		this.#availableModelsEnvFingerprint = envFingerprint;
 		return this.#availableModelsCache;
 	}
+	#hasFreshOrStaticModelEvidence(model: Model<Api>): boolean {
+		const evidence = this.#providerActivity.get(model.provider);
+		if (
+			!evidence ||
+			(!evidence.staticConfigured &&
+				!evidence.discoveryConfigured &&
+				!evidence.implicitDiscovery &&
+				!evidence.descriptorBacked)
+		) {
+			return false;
+		}
+		if (evidence.staticConfigured && (!evidence.discoveryConfigured || evidence.staticModelIds.has(model.id))) {
+			return true;
+		}
+		if (
+			evidence.descriptorFresh &&
+			evidence.authGeneration === this.#getProviderEvidenceGeneration(model.provider) &&
+			evidence.endpoint ===
+				this.#normalizeDiscoveryEvidenceEndpoint(
+					this.#getProviderBaseUrlForDiscovery(model.provider) ?? model.baseUrl ?? "",
+				) &&
+			evidence.descriptorModelIds.has(model.id)
+		)
+			return true;
+		const discoveryState = this.#discoveryManager.getState(model.provider);
+		const configuredEvidence = this.#configuredDiscoveryEvidence.get(model.provider);
+		return (
+			(discoveryState?.status === "ok" || discoveryState?.status === "cached") &&
+			configuredEvidence?.authGeneration === this.#getProviderEvidenceGeneration(model.provider) &&
+			configuredEvidence.endpoint ===
+				this.#normalizeDiscoveryEvidenceEndpoint(this.#getProviderBaseUrlForDiscovery(model.provider) ?? "") &&
+			configuredEvidence.modelIds.has(model.id)
+		);
+	}
+
+	#activeConnectionKind(model: Model<Api>): ActiveProviderDescriptor["connectionKind"] | undefined {
+		const evidence = this.#providerActivity.get(model.provider);
+		if (!this.#isCredentiallessProvider(model.provider) && this.authStorage.hasUsableAuth(model.provider)) {
+			if (!evidence) return undefined;
+			const discoveryOnly =
+				!evidence.staticConfigured &&
+				(evidence.discoveryConfigured || evidence.implicitDiscovery || evidence.descriptorBacked);
+			return !discoveryOnly || this.#hasFreshOrStaticModelEvidence(model) ? "credential" : undefined;
+		}
+		if (this.#isCredentiallessProvider(model.provider)) {
+			const discoveryOnly =
+				evidence !== undefined &&
+				!evidence.staticConfigured &&
+				(evidence.discoveryConfigured || evidence.implicitDiscovery || evidence.descriptorBacked);
+			if (discoveryOnly) {
+				if (evidence.descriptorBacked)
+					return this.#hasFreshOrStaticModelEvidence(model) ? "credentialless" : undefined;
+				const configuredBaseUrl = this.#getProviderBaseUrlForDiscovery(model.provider);
+				const discoveryType = this.#discoveryManager.providers.find(
+					provider => provider.provider === model.provider,
+				)?.discovery.type;
+				const endpointFor = (baseUrl: string | undefined): string =>
+					this.#normalizeDiscoveryEvidenceEndpoint(
+						discoveryType === "ollama"
+							? `${this.#normalizeOllamaBaseUrl(baseUrl)}/v1`
+							: discoveryType === "openai-models-list" || discoveryType === "lm-studio"
+								? this.#normalizeOpenAIModelsListBaseUrl(baseUrl)
+								: (baseUrl ?? ""),
+					);
+				if (
+					endpointFor(model.baseUrl) !== endpointFor(configuredBaseUrl) ||
+					this.#discoveryManager.getState(model.provider)?.status === "empty"
+				)
+					return undefined;
+				const configuredEvidence = this.#configuredDiscoveryEvidence.get(model.provider);
+				if (
+					this.#discoveryManager.getState(model.provider)?.error !== undefined ||
+					(this.#optionalAuthProviders.has(model.provider) &&
+						(configuredEvidence === undefined ||
+							configuredEvidence.authGeneration !== this.#getProviderEvidenceGeneration(model.provider)))
+				)
+					return undefined;
+			}
+			return "credentialless";
+		}
+		return undefined;
+	}
+
+	getActiveProviders(): ActiveProviderDescriptor[] {
+		try {
+			const descriptors: ActiveProviderDescriptor[] = [];
+			const disabledProviders = getDisabledProviderIdsFromSettings();
+			const available = this.#models.filter(model => this.#isModelAvailable(model, disabledProviders));
+			for (const model of available) {
+				const connectionKind = this.#activeConnectionKind(model);
+				if (connectionKind) descriptors.push({ provider: model.provider, connectionKind });
+			}
+			return projectActiveProviderDescriptors(descriptors);
+		} catch {
+			throw new ActiveProviderResolutionError();
+		}
+	}
 
 	/**
 	 * Check whether auth is configured for a model's provider.
@@ -2571,10 +3319,14 @@ export class ModelRegistry {
 	}
 
 	async #getApiKeyOrNoAuth(provider: string, lookup: () => Promise<string | undefined>): Promise<string | undefined> {
-		if (this.#keylessProviders.has(provider) && !this.authStorage.hasAuth(provider)) {
-			return kNoAuth;
+		if (!this.#isCredentiallessProvider(provider)) return lookup();
+		if (!this.#optionalAuthProviders.has(provider)) return kNoAuth;
+		const apiKey = await lookup();
+		if (apiKey !== undefined) {
+			this.#credentiallessAuthFallbackProviders.delete(provider);
+			return apiKey;
 		}
-		return lookup();
+		return kNoAuth;
 	}
 
 	/**
@@ -2613,8 +3365,28 @@ export class ModelRegistry {
 		);
 	}
 
-	async #peekApiKeyForProvider(provider: string): Promise<string | undefined> {
-		return this.#getApiKeyOrNoAuth(provider, () => this.authStorage.peekApiKey(provider));
+	async #peekApiKeyForProvider(
+		provider: string,
+		options: {
+			ignoreCredentiallessFallback?: boolean;
+			refreshOAuth?: boolean;
+			baseUrl?: string;
+		} = {},
+	): Promise<string | undefined> {
+		if (!options.ignoreCredentiallessFallback && this.#isCredentiallessProvider(provider)) {
+			return kNoAuth;
+		}
+		try {
+			this.authStorage.getProviderEvidenceGeneration(provider);
+		} catch {
+			return undefined;
+		}
+		if (options.refreshOAuth && this.authStorage.hasOAuth(provider)) {
+			return this.authStorage.getApiKey(provider, undefined, { baseUrl: options.baseUrl });
+		}
+		return options.ignoreCredentiallessFallback
+			? this.authStorage.peekApiKey(provider)
+			: this.#getApiKeyOrNoAuth(provider, () => this.authStorage.peekApiKey(provider));
 	}
 
 	/**
@@ -2628,11 +3400,22 @@ export class ModelRegistry {
 		return this.authStorage.getSessionCredentialType(provider, sessionId);
 	}
 
+	#clearDescriptorDiscoveryEvidence(providerName: string): void {
+		this.#descriptorDiscoveryGenerations.set(
+			providerName,
+			(this.#descriptorDiscoveryGenerations.get(providerName) ?? 0) + 1,
+		);
+		this.#descriptorDiscoveryEvidence.delete(providerName);
+		this.#configuredDiscoveryEvidence.delete(providerName);
+		this.#discoveryManager.invalidate(providerName);
+	}
+
 	#clearRuntimeProviderState(providerName: string): void {
 		this.#runtimeProviderApiKeys.delete(providerName);
 		this.#runtimeProviderOverrides.delete(providerName);
 		this.#runtimeModelOverlays = this.#runtimeModelOverlays.filter(overlay => overlay.provider !== providerName);
 		this.authStorage.removeConfigApiKey(providerName);
+		this.#clearDescriptorDiscoveryEvidence(providerName);
 	}
 
 	/**
@@ -2654,6 +3437,7 @@ export class ModelRegistry {
 			this.#clearRuntimeProviderState(providerName);
 		}
 		this.#lastStaticLoadMtime = null;
+		this.#staticModelsLoaded = false;
 		this.#reloadStaticModels();
 		this.#rebuildCanonicalIndex();
 	}
@@ -2698,6 +3482,8 @@ export class ModelRegistry {
 			},
 			"runtime-register",
 		);
+		this.#clearDescriptorDiscoveryEvidence(providerName);
+		this.#rebuildProviderActivity();
 
 		if (config.streamSimple && config.api) {
 			const streamSimple = config.streamSimple;
@@ -2734,6 +3520,7 @@ export class ModelRegistry {
 		}
 		if (sourceHandoff) {
 			this.#lastStaticLoadMtime = null;
+			this.#staticModelsLoaded = false;
 			this.#reloadStaticModels();
 		}
 
@@ -2791,12 +3578,14 @@ export class ModelRegistry {
 						config.oauth.modifyModels(withRuntimeTransportOverride, credential),
 					);
 					this.#rebuildCanonicalIndex();
+					this.#rebuildProviderActivity();
 					return;
 				}
 			}
 
 			this.#models = applyFinalCodexGpt56ContextCap(withRuntimeTransportOverride);
 			this.#rebuildCanonicalIndex();
+			this.#rebuildProviderActivity();
 			return;
 		}
 
@@ -2826,6 +3615,7 @@ export class ModelRegistry {
 				return this.#applyProviderTransportOverride(m, transportOverride);
 			});
 			this.#rebuildCanonicalIndex();
+			this.#rebuildProviderActivity();
 		}
 	}