@gajae-code/coding-agent 0.15.6 → 0.16.1

package/src/config/model-profiles.ts

@@ -241,11 +241,11 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 		architect: ["anthropic/claude-opus-5:xhigh", "anthropic/claude-opus-4-6:xhigh"],
 	}),
 	profile("claude-fable", ["anthropic"], {
-		default: "anthropic/claude-fable-5:xhigh",
+		default: "anthropic/claude-fable-5-1:xhigh",
 		executor: "anthropic/claude-sonnet-5",
-		planner: "anthropic/claude-fable-5:low",
-		critic: "anthropic/claude-fable-5:high",
-		architect: "anthropic/claude-fable-5:xhigh",
+		planner: "anthropic/claude-fable-5-1:low",
+		critic: "anthropic/claude-fable-5-1:high",
+		architect: "anthropic/claude-fable-5-1:xhigh",
 	}),
 	profile("glm-eco", ["zai"], {
 		default: "zai/glm-5.3-flash:low",
@@ -482,7 +482,7 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 		architect: "openai-codex/gpt-5.6-sol:high",
 	}),
 	profile("fable-opus-codex", ["anthropic", "openai-codex"], {
-		default: "anthropic/claude-fable-5:high",
+		default: "anthropic/claude-fable-5-1:high",
 		executor: "openai-codex/gpt-5.6-terra:medium",
 		planner: "anthropic/claude-opus-5:medium",
 		critic: "anthropic/claude-opus-5:high",

package/src/config/model-registry.ts

@@ -39,7 +39,11 @@ import {
 	UNK_MAX_TOKENS,
 	unregisterCustomApis,
 } from "@gajae-code/ai/core";
-import { resolveLoopbackOpenAIBaseUrl } from "@gajae-code/ai/utils/discovery/openai-compatible";
+import { fetchModelsDevPayload } from "@gajae-code/ai/provider-models/openai-compat";
+import {
+	detectDiscoveredApiFamily,
+	resolveLoopbackOpenAIBaseUrl,
+} from "@gajae-code/ai/utils/discovery/openai-compatible";
 
 // Sentinels for local-only OAuth tokens — declared inline to avoid loading provider
 // modules at startup. Must match the provider OAuth modules.
@@ -66,6 +70,7 @@ import {
 } from "../sdk/providers";
 import type { AuthStorage, OAuthCredential } from "../session/auth-storage";
 import type { ActiveSearchModelContext, WebSearchMode } from "../web/search/types";
+import { type BillingPath, deriveBillingPath } from "./billing-path";
 import { ConfigError, ConfigFile } from "./config-file";
 import { isAuthenticated, kNoAuth } from "./model-auth";
 import { type ConfiguredModelBindings, ModelBindingsApplier } from "./model-bindings-applier";
@@ -112,6 +117,7 @@ import {
 } from "./provider-selection-policy";
 import { type Settings, settings } from "./settings";
 
+export type { BillingPath, BillingPathKind } from "./billing-path";
 export type { EffectiveProviderAuth, ProviderSelectionPolicy } from "./provider-selection-policy";
 export type { CanonicalModelIndex, CanonicalModelRecord, CanonicalModelVariant, ModelEquivalenceConfig };
 
@@ -135,6 +141,69 @@ function redactDiscoveryUrl(value: string | URL): string {
 		return "(invalid URL)";
 	}
 }
+
+/** Whether a structured transport code proves that no listener accepted the connection. */
+function isConnectionRefusedDiscoveryCode(value: unknown): boolean {
+	if (typeof value === "string") {
+		const normalized = value.replace(/[^A-Za-z0-9]/gu, "").toUpperCase();
+		return (
+			normalized === "ECONNREFUSED" || normalized === "CONNECTIONREFUSED" || normalized === "ERRCONNECTIONREFUSED"
+		);
+	}
+	if (typeof value !== "number" || !Number.isInteger(value)) return false;
+	// ECONNREFUSED errno values used by the supported runtimes/OSes.
+	return value === 61 || value === -61 || value === 111 || value === -111 || value === 10061 || value === -10061;
+}
+
+function isConnectionRefusedDiscoveryEvidence(error: unknown): boolean {
+	const seen = new Set<unknown>();
+	const queue: unknown[] = [error];
+	while (queue.length > 0) {
+		const current = queue.shift();
+		if (current === null || typeof current !== "object" || seen.has(current)) continue;
+		seen.add(current);
+		for (const field of ["code", "errno", "errorCode", "transportCode"]) {
+			let value: unknown;
+			try {
+				value = Reflect.get(current, field);
+			} catch {
+				value = undefined;
+			}
+			if (isConnectionRefusedDiscoveryCode(value)) return true;
+		}
+		for (const field of ["cause", "error", "transport"]) {
+			let nested: unknown;
+			try {
+				nested = Reflect.get(current, field);
+			} catch {
+				nested = undefined;
+			}
+			if (nested !== undefined) queue.push(nested);
+		}
+	}
+	return false;
+}
+
+/** Whether `hostname` (as `URL.hostname` reports it) names this machine's loopback. */
+function isLoopbackDiscoveryHost(hostname: string): boolean {
+	if (hostname === "localhost" || hostname === "[::1]" || hostname === "::1") return true;
+	return /^127(?:\.\d{1,3}){3}$/u.test(hostname);
+}
+
+/**
+ * A loopback discovery endpoint that is proven to have no listener is the normal state of
+ * a machine without a local model server. Structured transport evidence is required when
+ * available; DNS, routing, proxy, TLS, and HTTP failures remain warnings.
+ */
+export function isQuietLocalDiscoveryFailure(baseUrl: string, _warning: string, evidence?: unknown): boolean {
+	let host: string;
+	try {
+		host = new URL(baseUrl).hostname;
+	} catch {
+		return false;
+	}
+	return isLoopbackDiscoveryHost(host) && evidence !== undefined && isConnectionRefusedDiscoveryEvidence(evidence);
+}
 function stripUrlQuery(value: string): string {
 	const queryStart = value.indexOf("?");
 	if (queryStart < 0) return value;
@@ -272,6 +341,44 @@ type ProviderValidationMode = "models-config" | "runtime-register";
 
 const OPENAI_REQUEST_TRANSFORM_APIS = new Set<Api>(["openai-completions", "openai-responses"]);
 
+const OPENAI_FAMILY_APIS = new Set<Api>([
+	"openai-completions",
+	"openai-responses",
+	"openai-codex-responses",
+	"azure-openai-responses",
+]);
+
+/** Whether an api uses an OpenAI-shaped request/response transport. */
+function isOpenAIFamilyApi(api: Api): boolean {
+	return OPENAI_FAMILY_APIS.has(api);
+}
+
+/**
+ * The most frequent OpenAI-family api among statically-configured models, used
+ * as the default api for auto-enabled `/v1/models` discovery on a custom
+ * provider that sets `api` only per model. Returns `undefined` when no
+ * configured model uses an OpenAI-family api (e.g. an Anthropic-only base),
+ * which suppresses auto-discovery for that provider.
+ */
+function dominantOpenAIFamilyModelApi(models: readonly { api?: string }[] | undefined): Api | undefined {
+	if (!models || models.length === 0) return undefined;
+	const counts = new Map<Api, number>();
+	for (const model of models) {
+		const api = model.api as Api | undefined;
+		if (api === undefined || !isOpenAIFamilyApi(api)) continue;
+		counts.set(api, (counts.get(api) ?? 0) + 1);
+	}
+	let best: Api | undefined;
+	let bestCount = 0;
+	for (const [api, count] of counts) {
+		if (count > bestCount) {
+			best = api;
+			bestCount = count;
+		}
+	}
+	return best;
+}
+
 function getKnownProviderApis(providerName: string): Set<Api> {
 	const apis = new Set<Api>();
 	for (const model of getBundledModels(providerName as Parameters<typeof getBundledModels>[0])) {
@@ -1192,6 +1299,7 @@ type CustomModelOverlay = {
 	wireModelId?: string;
 	requestTransform?: ModelRequestTransform;
 	cacheRetention?: CacheRetention;
+	transport?: Model<Api>["transport"];
 	isOAuth?: boolean;
 };
 
@@ -1303,6 +1411,7 @@ function buildCustomModelOverlay(
 	providerRequestTransform: ModelRequestTransform | undefined,
 	providerAuth: ProviderAuthMode | undefined,
 	providerCacheRetention: CacheRetention | undefined,
+	providerTransport: Model<Api>["transport"] | undefined,
 	modelDef: CustomModelDefinitionLike,
 ): CustomModelOverlay | undefined {
 	const api = modelDef.api ?? providerApi;
@@ -1331,6 +1440,7 @@ function buildCustomModelOverlay(
 		contextPromotionTarget: modelDef.contextPromotionTarget,
 		premiumMultiplier: modelDef.premiumMultiplier,
 		cacheRetention: modelDef.cacheRetention ?? providerCacheRetention,
+		transport: providerTransport,
 		isOAuth: resolveCustomModelIsOAuth(api, providerAuth),
 	};
 }
@@ -1466,6 +1576,7 @@ function finalizeCustomModel(model: CustomModelOverlay, options: CustomModelBuil
 		wireModelId: resolvedModel.wireModelId,
 		requestTransform: resolvedModel.requestTransform,
 		cacheRetention: resolvedModel.cacheRetention ?? reference?.cacheRetention,
+		transport: resolvedModel.transport,
 		premiumMultiplier: resolvedModel.premiumMultiplier,
 		isOAuth: resolvedModel.isOAuth,
 	} as Model<Api>);
@@ -2291,6 +2402,7 @@ export class ModelRegistry {
 					// re-merge bundled transport metadata here.
 					headers: customModel.headers,
 					compat: customModel.compat,
+					transport: customModel.transport,
 					contextPromotionTarget: customModel.contextPromotionTarget ?? existingModel.contextPromotionTarget,
 					wireModelId: customModel.wireModelId,
 					requestTransform: customModel.requestTransform,
@@ -2669,17 +2781,48 @@ export class ModelRegistry {
 				keylessProviders.add(providerName);
 			}
 
-			if (providerConfig.discovery && providerConfig.api) {
+			// Explicit discovery config is authoritative. Otherwise auto-enable
+			// OpenAI-compatible `/v1/models` discovery for any custom provider that
+			// declares an OpenAI-family `api` and a `baseUrl`: a subscription-style
+			// gateway (e.g. CLIProxyAPI) then auto-populates `/model` with its live
+			// catalog and auto-routes each model's wire family, with no manual
+			// `discovery:` block. It stays optional so an endpoint without
+			// `/v1/models` degrades to the configured static models instead of
+			// failing. Providers that route through the local `openaiCompat` proxy
+			// already register their own discovery above, so skip them here.
+			const effectiveDiscoveryBaseUrl = providerConfig.baseUrl ?? resolveProviderBaseUrlFromEnv(providerName);
+			// The default api for discovered models: the provider-level `api` when
+			// set, otherwise the most common OpenAI-family `api` among the
+			// statically-configured models. For withfox-style configs that only set
+			// `api` per model (`openai-responses` for gpt, `anthropic-messages` for
+			// claude), this preserves the intended OpenAI transport for discovered
+			// OpenAI models while `detectDiscoveredApiFamily` still flips claude ids
+			// to Anthropic.
+			const providerApi =
+				(providerConfig.api as Api | undefined) ??
+				dominantOpenAIFamilyModelApi(providerConfig.models as { api?: string }[] | undefined);
+			const autoDiscovery: ProviderDiscovery | undefined =
+				!providerConfig.discovery &&
+				!localOpenAICompat &&
+				providerName !== "vllm" &&
+				providerName !== "sglang" &&
+				providerApi !== undefined &&
+				isOpenAIFamilyApi(providerApi) &&
+				effectiveDiscoveryBaseUrl !== undefined
+					? { type: "openai-models-list" }
+					: undefined;
+			const effectiveDiscovery = providerConfig.discovery ?? autoDiscovery;
+			if (effectiveDiscovery && providerApi) {
 				discoverableProviders.push({
 					provider: providerName,
-					api: providerConfig.api as Api,
-					baseUrl: providerConfig.baseUrl ?? resolveProviderBaseUrlFromEnv(providerName),
+					api: providerApi,
+					baseUrl: effectiveDiscoveryBaseUrl,
 					headers: providerConfig.headers,
 					compat: providerConfig.compat,
 					requestTransform: providerConfig.requestTransform,
 					cacheRetention: providerConfig.cacheRetention,
-					discovery: providerConfig.discovery,
-					optional: false,
+					discovery: effectiveDiscovery,
+					optional: !providerConfig.discovery,
 				});
 			}
 
@@ -2957,27 +3100,71 @@ export class ModelRegistry {
 				? { ...result, invalidatesPublishedState }
 				: { ...result, current: false, models: [], fetched: false, invalidatesPublishedState };
 		});
+		// Every field below except `model.baseUrl` and `model.id` depends only on
+		// `model.provider`. The built-in catalog carries thousands of models across
+		// only a few dozen providers, and `#getProviderEvidenceGeneration` reaches
+		// into AuthStorage while `#getProviderBaseUrlForDiscovery` parses URLs, so
+		// recomputing per model turned this filter into a per-refresh UI-thread
+		// stall. Memoize the provider-keyed work once per provider.
+		interface BuiltInProviderEvidenceState {
+			evidence:
+				| {
+						fresh: boolean;
+						modelIds: ReadonlySet<string>;
+						profileModelIds?: ReadonlySet<string>;
+						profileFresh?: boolean;
+						profileEndpoint?: string;
+						authGeneration: string;
+						endpoint: string;
+				  }
+				| undefined;
+			expectedAuthGeneration: string | undefined;
+			authGenerationThrew: boolean;
+			providerBaseEndpoint: string | undefined;
+			canUseCredentialDerivedXiaomiEndpoint: boolean;
+		}
+		const builtInProviderStates = new Map<string, BuiltInProviderEvidenceState>();
+		const builtInProviderStateFor = (provider: string): BuiltInProviderEvidenceState => {
+			const cached = builtInProviderStates.get(provider);
+			if (cached) return cached;
+			let expectedAuthGeneration: string | undefined;
+			let authGenerationThrew = false;
+			try {
+				expectedAuthGeneration = this.#getProviderEvidenceGeneration(
+					provider,
+					this.#providerEvidenceApiKeys.get(provider),
+				);
+			} catch {
+				authGenerationThrew = true;
+			}
+			const providerBaseUrl = this.#getProviderBaseUrlForDiscovery(provider);
+			const state: BuiltInProviderEvidenceState = {
+				evidence: this.#descriptorDiscoveryEvidence.get(provider),
+				expectedAuthGeneration,
+				authGenerationThrew,
+				providerBaseEndpoint:
+					providerBaseUrl !== undefined ? this.#normalizeDiscoveryEvidenceEndpoint(providerBaseUrl) : undefined,
+				canUseCredentialDerivedXiaomiEndpoint:
+					provider === "xiaomi" &&
+					this.#providerEvidenceApiKeys.get("xiaomi")?.startsWith("tp-") === true &&
+					this.#runtimeProviderOverrides.get("xiaomi")?.baseUrl === undefined &&
+					this.#providerOverrides.get("xiaomi")?.baseUrl === undefined &&
+					resolveProviderBaseUrlFromEnv("xiaomi") === undefined,
+			};
+			builtInProviderStates.set(provider, state);
+			return state;
+		};
 		const currentBuiltInDiscovered = builtInDiscovered.filter(model => {
-			const evidence = this.#descriptorDiscoveryEvidence.get(model.provider);
-			const currentEndpoint = this.#normalizeDiscoveryEvidenceEndpoint(
-				this.#getProviderBaseUrlForDiscovery(model.provider) ?? model.baseUrl ?? "",
-			);
-			const canUseCredentialDerivedXiaomiEndpoint =
-				model.provider === "xiaomi" &&
-				this.#providerEvidenceApiKeys.get("xiaomi")?.startsWith("tp-") === true &&
-				this.#runtimeProviderOverrides.get("xiaomi")?.baseUrl === undefined &&
-				this.#providerOverrides.get("xiaomi")?.baseUrl === undefined &&
-				resolveProviderBaseUrlFromEnv("xiaomi") === undefined;
+			const state = builtInProviderStateFor(model.provider);
+			const { evidence } = state;
+			if (evidence === undefined || state.authGenerationThrew) return false;
+			if (evidence.authGeneration !== state.expectedAuthGeneration) return false;
 			try {
+				const currentEndpoint =
+					state.providerBaseEndpoint ?? this.#normalizeDiscoveryEvidenceEndpoint(model.baseUrl ?? "");
 				return (
-					evidence !== undefined &&
-					evidence.authGeneration ===
-						this.#getProviderEvidenceGeneration(
-							model.provider,
-							this.#providerEvidenceApiKeys.get(model.provider),
-						) &&
 					(evidence.endpoint === currentEndpoint ||
-						(canUseCredentialDerivedXiaomiEndpoint &&
+						(state.canUseCredentialDerivedXiaomiEndpoint &&
 							evidence.endpoint === this.#normalizeDiscoveryEvidenceEndpoint(model.baseUrl ?? ""))) &&
 					evidence.modelIds.has(model.id)
 				);
@@ -3222,6 +3409,8 @@ export class ModelRegistry {
 					(evidence.authGeneration !== authGenerationBeforeDiscovery || evidence.endpoint !== endpoint)))
 				? "online"
 				: strategy;
+		let discoveryFailureEvidence: unknown;
+
 		const mergeInput = await this.#discoveryManager.discover(effectiveProviderConfig, refreshStrategy, {
 			cacheDbPath: this.#cacheDbPath,
 			requiresAuth: provider =>
@@ -3234,11 +3423,17 @@ export class ModelRegistry {
 							baseUrl: provider.baseUrl,
 						}),
 			isAuthenticated,
-			fetchModels: async (provider, apiKey) =>
-				this.#sanitizeDiscoverableModelsForCache(
-					provider,
-					await this.#discoverModelsByProviderType(provider, apiKey),
-				),
+			fetchModels: async (provider, apiKey) => {
+				try {
+					return this.#sanitizeDiscoverableModelsForCache(
+						provider,
+						await this.#discoverModelsByProviderType(provider, apiKey),
+					);
+				} catch (error) {
+					discoveryFailureEvidence = error;
+					throw error;
+				}
+			},
 			getEvidenceGeneration: provider => this.#getProviderEvidenceGeneration(provider.provider, preflightApiKey),
 			cacheDynamicModelProvenance: cacheLookupProvenance,
 			canPublishCache: () => isCurrentEndpoint() && isCurrentProviderRefresh(),
@@ -3262,11 +3457,15 @@ export class ModelRegistry {
 			};
 		}
 		if (mergeInput.warning) {
-			logger.warn("model discovery failed for provider", {
+			const baseUrl = effectiveProviderConfig.baseUrl ?? "";
+			const fields = {
 				provider: effectiveProviderConfig.provider,
-				url: redactDiscoveryUrl(effectiveProviderConfig.baseUrl ?? ""),
+				url: redactDiscoveryUrl(baseUrl),
 				error: mergeInput.warning,
-			});
+			};
+			if (isQuietLocalDiscoveryFailure(baseUrl, mergeInput.warning, discoveryFailureEvidence))
+				logger.debug("model discovery failed for provider", fields);
+			else logger.warn("model discovery failed for provider", fields);
 		}
 		this.#providerEvidenceApiKeys.set(effectiveProviderConfig.provider, preflightApiKey);
 		return {
@@ -3826,27 +4025,47 @@ export class ModelRegistry {
 		return this.#applyProviderModelOverrides(providerConfig.provider, discovered);
 	}
 
-	#resolveDiscoveredModelApi(providerConfig: DiscoveryProviderConfig, modelId: string): Api {
-		let api = providerConfig.api;
+	#resolveDiscoveredModelApi(
+		providerConfig: DiscoveryProviderConfig,
+		modelId: string,
+		entry?: { id?: unknown; owned_by?: unknown },
+	): Api {
+		// 1. Explicit per-prefix routing from models.yml always wins — the user
+		//    stated the transport for these ids, so never second-guess it.
 		let matchedPrefixLength = -1;
+		let prefixApi: Api | undefined;
 		for (const [prefix, routedApi] of Object.entries(providerConfig.discovery.apiByModelPrefix ?? {})) {
 			if (modelId.startsWith(prefix) && prefix.length > matchedPrefixLength) {
-				api = routedApi;
+				prefixApi = routedApi;
 				matchedPrefixLength = prefix.length;
 			}
 		}
-		return api;
+		if (prefixApi !== undefined) return prefixApi;
+		// 2. For OpenAI-compatible gateways that can front both OpenAI and
+		//    Anthropic upstreams (e.g. CLIProxyAPI), auto-detect the wire family
+		//    per model from the `/v1/models` `owned_by` owner and the model id.
+		//    A mixed gateway then routes `claude-*` through Anthropic Messages
+		//    with zero manual config. OpenAI-family models keep the provider's
+		//    configured OpenAI transport (e.g. `openai-responses` vs
+		//    `openai-completions`) rather than being forced to chat-completions,
+		//    because a `/v1/models` list cannot reveal which OpenAI API the
+		//    gateway expects. Only override to `openai-completions` when the
+		//    provider default is not itself an OpenAI-family api.
+		if (providerConfig.discovery.type === "openai-models-list") {
+			const detected = detectDiscoveredApiFamily(entry ?? { id: modelId });
+			if (detected === "anthropic-messages") return "anthropic-messages";
+			if (detected === "openai-completions") {
+				return isOpenAIFamilyApi(providerConfig.api) ? providerConfig.api : "openai-completions";
+			}
+		}
+		// 3. Fall back to the provider-level default api.
+		return providerConfig.api;
 	}
 
 	async #discoverModelsDevProvider(providerConfig: DiscoveryProviderConfig): Promise<Model<Api>[]> {
 		const baseUrl = providerConfig.baseUrl;
 		if (!baseUrl) throw new Error(`Provider "${providerConfig.provider}" requires baseUrl for models.dev discovery.`);
-		const response = await fetch("https://models.dev/api.json", {
-			headers: { Accept: "application/json" },
-			signal: AbortSignal.timeout(5_000),
-		});
-		if (!response.ok) throw new Error(`HTTP ${response.status} from https://models.dev/api.json`);
-		const payload: unknown = await response.json();
+		const payload: unknown = await fetchModelsDevPayload();
 		if (!isRecord(payload)) return [];
 		const catalogProvider = payload[providerConfig.discovery.modelsDevProvider ?? providerConfig.provider];
 		if (!isRecord(catalogProvider) || !isRecord(catalogProvider.models)) return [];
@@ -3952,7 +4171,7 @@ export class ModelRegistry {
 				item.max_tokens,
 				item.max_output_tokens,
 			);
-			const api = this.#resolveDiscoveredModelApi(providerConfig, id);
+			const api = this.#resolveDiscoveredModelApi(providerConfig, id, item);
 			discovered.push(
 				enrichModelThinking({
 					id,
@@ -4452,6 +4671,7 @@ export class ModelRegistry {
 					providerConfig.requestTransform,
 					(providerConfig.auth as ProviderAuthMode | undefined) ?? undefined,
 					providerConfig.cacheRetention,
+					providerConfig.transport,
 					modelDef as CustomModelDefinitionLike,
 				);
 				if (!model) continue;
@@ -4584,6 +4804,22 @@ export class ModelRegistry {
 	autoroutingProviderOrder(): readonly string[] {
 		return projectCatalogProviderOrder(getConfiguredProviderOrderFromSettings(), this.#models);
 	}
+
+	/**
+	 * Provider priority for automatic model selection. Explicit provider order
+	 * wins first, followed by omitted OAuth providers, then other providers;
+	 * catalog order breaks ties within each policy band.
+	 */
+	automaticProviderOrder(sessionId?: string): readonly string[] {
+		const policy = this.#buildProviderSelectionPolicy(sessionId);
+		return [...policy.orderedProviders()].sort((left, right) => {
+			const rankDifference = policy.rank(left) - policy.rank(right);
+			return rankDifference !== 0
+				? rankDifference
+				: policy.providerCatalogIndex(left) - policy.providerCatalogIndex(right);
+		});
+	}
+
 	#providerRankMap(policy: ProviderSelectionPolicy): Map<string, number> {
 		const providerRank = new Map<string, number>();
 		for (const provider of policy.orderedProviders()) {
@@ -4820,6 +5056,18 @@ export class ModelRegistry {
 		return this.#effectiveProviderAuth(provider, sessionId);
 	}
 
+	/**
+	 * Billing path for a resolved binding — derived at the point the binding
+	 * resolves credentials (model.api + credential provenance). Not a
+	 * provider-name allowlist: a custom OpenAI-compatible provider bound
+	 * to a metered gateway is "metered-api" exactly like a first-party
+	 * key. Only the billing category is ever disclosed.
+	 */
+	getBillingPath(model: Model<Api>, sessionId?: string): BillingPath | undefined {
+		const effectiveAuth = this.#effectiveProviderAuth(model.provider, sessionId);
+		return deriveBillingPath(model.provider, model.api as Api, effectiveAuth);
+	}
+
 	/**
 	 * Forget a session's remembered canonical variant so the next resolution
 	 * for that session re-ranks from scratch (explicit reselection
@@ -5608,6 +5856,7 @@ export class ModelRegistry {
 					config.requestTransform,
 					undefined,
 					undefined,
+					config.transport,
 					modelDef as CustomModelDefinitionLike,
 				);
 				if (!overlay) {

package/src/config/model-resolver.ts

@@ -1580,6 +1580,11 @@ export async function findInitialModel(options: {
 			thinkingLevel = resolveThinkingLevelForModel(found, defaultThinkingSelector);
 			return { model, thinkingLevel, fallbackMessage: undefined };
 		}
+		return {
+			model: undefined,
+			thinkingLevel: undefined,
+			fallbackMessage: `Model ${defaultProvider}/${defaultModelId} not found`,
+		};
 	}
 
 	// 4. Try first available model with valid API key

package/src/config/settings-schema.ts

@@ -421,6 +421,12 @@ export const SETTINGS_SCHEMA = {
 		description: "Hard maximum runtime for an SDK prompt from acceptance, bounding progress-aware renewals.",
 		validate: (value: number) => Number.isSafeInteger(value) && value >= 60_000 && value <= 86_400_000,
 	},
+	"sdk.masterOrphanGraceMs": {
+		type: "number",
+		default: 120_000,
+		description: "Grace period before a master-spawned child orphaned by confirmed master loss is closed.",
+		validate: (value: number) => Number.isSafeInteger(value) && value >= 60_000 && value <= 3_600_000,
+	},
 
 	// Notifications (shared daemon with Telegram/Discord/Slack presentation adapters)
 	"notifications.enabled": { type: "boolean", default: false },
@@ -745,7 +751,7 @@ export const SETTINGS_SCHEMA = {
 	// ────────────────────────────────────────────────────────────────────────
 	"ui.language": {
 		type: "enum",
-		values: ["en", "ko", "ja"] as const,
+		values: ["en", "ko", "zh", "ja"] as const,
 		default: "en",
 		ui: {
 			tab: "appearance",
@@ -754,6 +760,7 @@ export const SETTINGS_SCHEMA = {
 			options: [
 				{ value: "en", label: "English" },
 				{ value: "ko", label: "Korean (한국어)" },
+				{ value: "zh", label: "Chinese (简体中文)" },
 				{ value: "ja", label: "Japanese (日本語)" },
 			],
 		},
@@ -1572,14 +1579,15 @@ export const SETTINGS_SCHEMA = {
 		},
 	},
 
-	interruptMode: {
+	toolInterruptPolicy: {
 		type: "enum",
-		values: ["immediate", "wait"] as const,
-		default: "immediate",
+		values: ["abort_tools", "finish_tools"] as const,
+		default: "abort_tools",
 		ui: {
 			tab: "interaction",
-			label: "Interrupt Mode",
-			description: "When steering messages interrupt tool execution",
+			label: "Tool Interrupt Policy",
+			description:
+				"Whether a steering message aborts the tools still running in the current batch (abort_tools) or lets them finish first (finish_tools). Never changes when a steer is consumed: it is always picked up at the next tool/turn boundary either way.",
 		},
 	},
 
@@ -3036,6 +3044,17 @@ export const SETTINGS_SCHEMA = {
 			description: "Enable the browser tool (Ulixee Hero)",
 		},
 	},
+	"browser.backend": {
+		type: "enum",
+		values: ["native", "aside"] as const,
+		default: "native",
+		ui: {
+			tab: "tools",
+			label: "Browser Backend",
+			description:
+				"Browser surface offered to the model. 'native' exposes the built-in Puppeteer browser tool. 'aside' hides it and requires every browser task to run through the Aside CLI in your live logged-in browser (requires the Aside CLI).",
+		},
+	},
 
 	"browser.headless": {
 		type: "boolean",
@@ -3065,7 +3084,7 @@ export const SETTINGS_SCHEMA = {
 			tab: "tools",
 			label: "Profile reuse posture",
 			description:
-				"'auto' (default): when a usable real Chrome profile is available, the browser tool uses an isolated copy of it (cookies/session/cache) for stronger stealth, warns, and falls back to synthetic. 'opt-in': stay synthetic unless a real profile is explicitly requested.",
+				"'auto' (default): when a usable real Chrome profile is available, the browser tool uses an isolated copy of it (cookies/session/cache) for stronger stealth, warns, and falls back to synthetic. 'opt-in': stay synthetic unless a real profile is explicitly requested. On macOS, cookie decryption is brand-specific (Chrome Safe Storage vs Chromium Safe Storage Keychain); a Chrome profile copied into bundled Chromium decrypts to garbage, so auto reuses the profile only when the headless executable can decrypt it — detected system Chrome/Chromium or PUPPETEER_EXECUTABLE_PATH — otherwise it falls back to synthetic with a warning.",
 		},
 	},
 
@@ -4117,7 +4136,7 @@ export function getEnumValues(path: SettingPath): readonly string[] | undefined
 	return "values" in def ? (def.values as readonly string[]) : undefined;
 }
 
-export { CONFIG_SCHEMA_VERSION } from "./config-schema-version";
+export { CONFIG_SCHEMA_VERSION, normalizeConfigSchemaVersion } from "./config-schema-version";
 
 export type SettingsSchemaIssue = {
 	path: string;