@gajae-code/coding-agent 0.18.12 → 0.19.0

package/src/config/model-registry.ts

@@ -45,6 +45,7 @@ import {
 } from "@gajae-code/ai/core";
 import { fetchModelsDevPayload } from "@gajae-code/ai/provider-models/openai-compat";
 import { isDirectXaiReasoningEffortModel } from "@gajae-code/ai/providers/openai-completions-compat";
+import { getAntigravityDiscoveryUserAgent } from "@gajae-code/ai/utils/discovery/antigravity";
 import {
 	detectDiscoveredApiFamily,
 	isSafeCatalogModelId,
@@ -1115,7 +1116,8 @@ function filterMaterializedRegistryProfiles(
 type SpecialProviderDescriptor = {
 	providerId: string;
 	resolveKey: (value: string | undefined) => string | undefined;
-	createOptions: (key: string) => ModelManagerOptions<Api>;
+	resolveProjectId?: (key: string, rawValue: string | undefined) => string | undefined;
+	createOptions: (key: string, projectId?: string) => ModelManagerOptions<Api>;
 };
 
 const PROVIDER_BASE_URL_ENV_ALIASES: Record<string, readonly string[]> = {
@@ -1297,17 +1299,33 @@ function fingerprintConfiguredDiscoveryRequestShape(
 	return crypto.createHash("sha256").update("gajae:model-discovery-provenance\0").update(context).digest("hex");
 }
 
-function fingerprintDescriptorDiscoveryProvenance(authEvidence: string, endpoint: string): string | undefined {
+function fingerprintDescriptorDiscoveryProvenance(
+	providerId: string,
+	authEvidence: string,
+	endpoint: string,
+	projectId?: string,
+): string | undefined {
 	try {
 		const parsed = new URL(endpoint);
 		if (parsed.username || parsed.password || parsed.search) return undefined;
 	} catch {
 		return undefined;
 	}
+	const discoveryIdentity =
+		providerId === "google-antigravity" || providerId === "google-gemini-cli"
+			? getAntigravityDiscoveryUserAgent()
+			: undefined;
 	return crypto
 		.createHash("sha256")
 		.update("gajae:model-discovery-provenance\0")
-		.update(JSON.stringify({ authEvidence, endpoint }))
+		.update(
+			JSON.stringify({
+				authEvidence,
+				endpoint,
+				...(projectId !== undefined ? { projectId } : {}),
+				...(discoveryIdentity !== undefined ? { discoveryIdentity } : {}),
+			}),
+		)
 		.digest("hex");
 }
 
@@ -1444,6 +1462,48 @@ function getOAuthCredentialsForProvider(authStorage: AuthStorage, provider: stri
 	return entries.filter((entry): entry is OAuthCredential => entry.type === "oauth");
 }
 
+/** Internal pure parser shared by discovery; exported for regression coverage. */
+export function extractGoogleOAuthProjectId(value: string | undefined, accessToken: string): string | undefined {
+	if (!value) return undefined;
+	try {
+		const parsed = JSON.parse(value) as { token?: unknown; projectId?: unknown; project_id?: unknown };
+		if (typeof parsed.token !== "string" || parsed.token.trim() !== accessToken) return undefined;
+		const projectId = typeof parsed.projectId === "string" ? parsed.projectId : parsed.project_id;
+		return typeof projectId === "string" ? projectId.trim() || undefined : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+function resolveGoogleOAuthProjectId(
+	authStorage: AuthStorage,
+	provider: string,
+	accessToken: string,
+	rawValue?: string,
+	sessionId?: string,
+	owner?: object,
+): string | undefined {
+	const configuredProjectId = extractGoogleOAuthProjectId(rawValue, accessToken);
+	if (authStorage.getEffectiveCredentialType(provider, sessionId, owner ? { owner } : undefined) !== "oauth") {
+		return configuredProjectId;
+	}
+	const selector = authStorage.resolveEffectiveCredentialSelector(provider, sessionId);
+	if (selector) {
+		const selectedCredential = authStorage.getOAuthCredential(provider, sessionId, owner ? { owner } : undefined);
+		if (selectedCredential?.access !== accessToken) return configuredProjectId;
+		return selectedCredential.projectId?.trim() || configuredProjectId;
+	}
+	const matchingCredentials = getOAuthCredentialsForProvider(authStorage, provider).filter(
+		credential => credential.access === accessToken,
+	);
+	if (matchingCredentials.length === 0) return configuredProjectId;
+	const projectId = matchingCredentials[0]?.projectId?.trim();
+	if (matchingCredentials.some(credential => (credential.projectId?.trim() ?? "") !== (projectId ?? ""))) {
+		return configuredProjectId;
+	}
+	return projectId || configuredProjectId;
+}
+
 function resolveOAuthAccountIdForAccessToken(
 	authStorage: AuthStorage,
 	provider: string,
@@ -2010,6 +2070,12 @@ interface ModelManagerDiscoveryOptions {
 	apiKey: string | undefined;
 	endpoint: string;
 	endpointContainsUserinfo: boolean;
+	projectId?: string;
+	isCurrentContext?: () => boolean;
+}
+
+interface GoogleSessionDiscoveryCatalog {
+	models: Model<Api>[];
 }
 
 interface ConfiguredDiscoveryResult {
@@ -2232,9 +2298,11 @@ export class ModelRegistry {
 		bySelector: new Map(),
 		aliases: new Map(),
 	};
-	#availableModelsCache: Model<Api>[] | undefined;
-	#availableModelsDisabledProviders: string | undefined;
-	#availableModelsEnvFingerprint: string | undefined;
+	#availableModelsCache = new Map<
+		string,
+		{ models: Model<Api>[]; disabledProviders: string; envFingerprint: string }
+	>();
+	#googleSessionDiscoveryCatalogs = new Map<string, Map<string, GoogleSessionDiscoveryCatalog>>();
 	#sessionCanonicalVariants = new Map<string, string>();
 	#customProviderApiKeys: Map<string, string> = new Map();
 	#customProviderApiKeyEnvNames: Map<string, string> = new Map();
@@ -2254,6 +2322,7 @@ export class ModelRegistry {
 			modelIds: ReadonlySet<string>;
 			authGeneration: string;
 			endpoint: string;
+			projectId?: string;
 		}
 	>();
 	#descriptorDiscoveryGenerations = new Map<string, number>();
@@ -2295,7 +2364,7 @@ export class ModelRegistry {
 	#cacheDbPath?: string;
 	#suppressedSelectors: Map<string, number> = new Map();
 	#selectorCircuits: Map<string, SelectorCircuit> = new Map();
-	#backgroundRefresh?: Promise<void>;
+	#backgroundRefreshes: Map<string, Promise<void>> = new Map();
 	#catalogMutationTail: Promise<void> = Promise.resolve();
 	#pendingCatalogMutations = 0;
 	#catalogRefreshGeneration = 0;
@@ -2392,6 +2461,12 @@ export class ModelRegistry {
 
 	#copyRuntimeStateFrom(source: ModelRegistry): void {
 		this.#sessionCanonicalVariants = new Map(source.#sessionCanonicalVariants);
+		this.#googleSessionDiscoveryCatalogs = new Map(
+			[...source.#googleSessionDiscoveryCatalogs].map(([provider, catalogs]) => [
+				provider,
+				new Map([...catalogs].map(([identity, catalog]) => [identity, { models: [...catalog.models] }])),
+			]),
+		);
 		this.#suppressedSelectors = new Map(source.#suppressedSelectors);
 		this.#selectorCircuits = new Map(
 			[...source.#selectorCircuits].map(([selector, circuit]) => [selector, structuredClone(circuit)]),
@@ -2471,13 +2546,9 @@ export class ModelRegistry {
 			other.#availableModelsCache,
 			this.#availableModelsCache,
 		];
-		[this.#availableModelsDisabledProviders, other.#availableModelsDisabledProviders] = [
-			other.#availableModelsDisabledProviders,
-			this.#availableModelsDisabledProviders,
-		];
-		[this.#availableModelsEnvFingerprint, other.#availableModelsEnvFingerprint] = [
-			other.#availableModelsEnvFingerprint,
-			this.#availableModelsEnvFingerprint,
+		[this.#googleSessionDiscoveryCatalogs, other.#googleSessionDiscoveryCatalogs] = [
+			other.#googleSessionDiscoveryCatalogs,
+			this.#googleSessionDiscoveryCatalogs,
 		];
 		[this.#customProviderApiKeys, other.#customProviderApiKeys] = [
 			other.#customProviderApiKeys,
@@ -2626,7 +2697,7 @@ export class ModelRegistry {
 		other.#modelBindingsApplier.setBindings(previousBindings);
 		this.#modelBindingsApplier.apply();
 		this.#modelsConfigFile.invalidate();
-		this.#availableModelsCache = undefined;
+		this.#invalidateAvailableModels();
 	}
 
 	#reconcileOwnedConfigApiKeys(
@@ -2792,6 +2863,7 @@ export class ModelRegistry {
 			for (const provider of changedProviders) {
 				copyProviderEntry(registry.#configuredDiscoveryEvidence, this.#configuredDiscoveryEvidence, provider);
 				copyProviderEntry(registry.#descriptorDiscoveryEvidence, this.#descriptorDiscoveryEvidence, provider);
+				registry.#googleSessionDiscoveryCatalogs.delete(provider);
 				copyProviderEntry(registry.#descriptorDiscoveryGenerations, this.#descriptorDiscoveryGenerations, provider);
 				copyProviderEntry(registry.#providerEvidenceApiKeys, this.#providerEvidenceApiKeys, provider);
 				copyProviderEntry(
@@ -3088,9 +3160,12 @@ export class ModelRegistry {
 	}
 
 	refreshInBackground(strategy: ModelRefreshStrategy = "online-if-uncached", credentialSessionId?: string): void {
-		if (this.#backgroundRefresh) {
-			return;
-		}
+		// Each credential context has an isolated discovery catalog. Coalescing every
+		// request behind one global promise discarded B's refresh when A was pending.
+		// Equivalent contexts still coalesce; distinct ones queue through the catalog
+		// mutation tail so their overlays remain independently populated.
+		const contextKey = `${strategy}\u0000${credentialSessionId ?? ""}`;
+		if (this.#backgroundRefreshes.has(contextKey)) return;
 		const refreshPromise = this.refresh(strategy, credentialSessionId)
 			.catch(error => {
 				logger.warn("background model refresh failed", {
@@ -3098,11 +3173,11 @@ export class ModelRegistry {
 				});
 			})
 			.finally(() => {
-				if (this.#backgroundRefresh === refreshPromise) {
-					this.#backgroundRefresh = undefined;
+				if (this.#backgroundRefreshes.get(contextKey) === refreshPromise) {
+					this.#backgroundRefreshes.delete(contextKey);
 				}
 			});
-		this.#backgroundRefresh = refreshPromise;
+		this.#backgroundRefreshes.set(contextKey, refreshPromise);
 	}
 
 	async refreshProvider(
@@ -3698,6 +3773,7 @@ export class ModelRegistry {
 			}
 			const cache = readModelCache<Api>(descriptor.providerId, 24 * 60 * 60 * 1000, Date.now, this.#cacheDbPath);
 			const expectedProvenance = fingerprintDescriptorDiscoveryProvenance(
+				descriptor.providerId,
 				authEvidence ?? this.#getProviderEvidenceGeneration(descriptor.providerId),
 				this.#normalizeDiscoveryEvidenceEndpoint(this.#getProviderBaseUrlForDiscovery(descriptor.providerId) ?? ""),
 			);
@@ -4367,6 +4443,12 @@ export class ModelRegistry {
 		credentialSessionId?: string,
 	): Promise<void> {
 		const profileAvailabilityEvidenceBefore = this.#profileAvailabilityEvidenceFingerprint();
+		const googleDescriptorGenerationsBefore = new Map(
+			(["google-antigravity", "google-gemini-cli"] as const).map(provider => [
+				provider,
+				this.#descriptorDiscoveryGenerations.get(provider) ?? 0,
+			]),
+		);
 		const disabledProviders = getDisabledProviderIdsFromSettings(this.#settings);
 		const selectedDiscoverableProviders = (
 			providerFilter
@@ -4518,6 +4600,38 @@ export class ModelRegistry {
 				return false;
 			}
 		});
+		let sessionCatalogChanged = false;
+		for (const provider of ["google-antigravity", "google-gemini-cli"] as const) {
+			if (
+				this.authStorage.getEffectiveCredentialType(provider, credentialSessionId, {
+					owner: this.#authStorageConfigOwner,
+				}) !== "oauth"
+			) {
+				continue;
+			}
+			if (
+				(this.#descriptorDiscoveryGenerations.get(provider) ?? 0) ===
+				googleDescriptorGenerationsBefore.get(provider)
+			) {
+				continue;
+			}
+			const evidence = this.#descriptorDiscoveryEvidence.get(provider);
+			if (!evidence) continue;
+			const identity = this.#googleDescriptorContextIdentity(
+				provider,
+				evidence.authGeneration,
+				evidence.endpoint,
+				evidence.projectId,
+			);
+			if (!identity || identity !== this.#googleSessionDescriptorIdentity(provider, credentialSessionId)) continue;
+			const catalogs = this.#googleSessionDiscoveryCatalogs.get(provider) ?? new Map();
+			const models = currentBuiltInDiscovered.filter(model => model.provider === provider);
+			const previous = catalogs.get(identity);
+			if (models.length === 0 && evidence.fresh === false && previous !== undefined) continue;
+			if (!isDeepStrictEqual(previous?.models, models)) sessionCatalogChanged = true;
+			catalogs.set(identity, { models });
+			this.#googleSessionDiscoveryCatalogs.set(provider, catalogs);
+		}
 		const configuredDiscoveryEvidence = new Map(
 			currentConfiguredDiscoveryResults
 				.filter(result => result.current)
@@ -4585,6 +4699,10 @@ export class ModelRegistry {
 				);
 			});
 		}
+		if (sessionCatalogChanged) {
+			this.#invalidateAvailableModels();
+			this.#notifyCatalogChanged();
+		}
 		if (discovered.length === 0) {
 			if (
 				clearPublishedModelIds.size > 0 ||
@@ -4597,6 +4715,53 @@ export class ModelRegistry {
 		this.#mergeDiscoveredModels(discovered);
 	}
 
+	#googleDescriptorContextIdentity(
+		provider: "google-antigravity" | "google-gemini-cli",
+		authGeneration: string,
+		endpoint: string,
+		projectId?: string,
+	): string | undefined {
+		return fingerprintDescriptorDiscoveryProvenance(provider, authGeneration, endpoint, projectId);
+	}
+
+	#googleSessionDescriptorIdentity(
+		provider: "google-antigravity" | "google-gemini-cli",
+		credentialSessionId?: string,
+	): string | undefined {
+		if (
+			this.authStorage.getEffectiveCredentialType(provider, credentialSessionId, {
+				owner: this.#authStorageConfigOwner,
+			}) !== "oauth"
+		) {
+			return undefined;
+		}
+		const credential = this.authStorage.getOAuthCredential(provider, credentialSessionId, {
+			owner: this.#authStorageConfigOwner,
+		});
+		if (!credential) return undefined;
+		const endpoint = this.#normalizeDiscoveryEvidenceEndpoint(this.#getProviderBaseUrlForDiscovery(provider) ?? "");
+		try {
+			return this.#googleDescriptorContextIdentity(
+				provider,
+				this.#getProviderEvidenceGeneration(provider, credential.access),
+				endpoint,
+				credential.projectId?.trim() || undefined,
+			);
+		} catch {
+			return undefined;
+		}
+	}
+
+	#getGoogleSessionDiscoveryModels(credentialSessionId?: string): Model<Api>[] {
+		const models: Model<Api>[] = [];
+		for (const provider of ["google-antigravity", "google-gemini-cli"] as const) {
+			const identity = this.#googleSessionDescriptorIdentity(provider, credentialSessionId);
+			if (!identity) continue;
+			models.push(...(this.#googleSessionDiscoveryCatalogs.get(provider)?.get(identity)?.models ?? []));
+		}
+		return models;
+	}
+
 	#profileAvailabilityEvidenceFingerprint(): string {
 		return JSON.stringify({
 			descriptor: [...this.#descriptorDiscoveryEvidence.entries()]
@@ -4606,6 +4771,7 @@ export class ModelRegistry {
 					evidence.fresh,
 					evidence.authGeneration,
 					evidence.endpoint,
+					evidence.projectId,
 					[...evidence.modelIds].sort(),
 				]),
 			configured: [...this.#configuredDiscoveryEvidence.entries()]
@@ -4619,23 +4785,37 @@ export class ModelRegistry {
 		});
 	}
 
+	#removeDescriptorDiscoveredModels(provider: string, modelIds: ReadonlySet<string>): boolean {
+		const staticModelIds = this.#providerActivity.get(provider)?.staticModelIds;
+		const previousLength = this.#models.length;
+		this.#models = this.#models.filter(model => {
+			if (model.provider !== provider || !modelIds.has(model.id)) return true;
+			return staticModelIds?.has(model.id) === true;
+		});
+		return this.#models.length !== previousLength;
+	}
+
 	#mergeDiscoveredModels(discovered: readonly Model<Api>[]): void {
+		this.#models = this.#resolveDiscoveredModelCatalog(this.#models, discovered);
+		this.#rebuildCanonicalIndex();
+	}
+
+	#resolveDiscoveredModelCatalog(baseModels: readonly Model<Api>[], discovered: readonly Model<Api>[]): Model<Api>[] {
 		const discoveredModels = this.#applyHardcodedModelPolicies(
 			discovered.map(model =>
 				mergeDiscoveredModel(
 					model,
-					this.find(model.provider, model.id),
+					baseModels.find(candidate => candidate.provider === model.provider && candidate.id === model.id),
 					this.#resolveProviderOverride(model.provider),
 				),
 			),
 		);
-		const resolved = this.#mergeResolvedModels(this.#models, discoveredModels);
+		const resolved = this.#mergeResolvedModels([...baseModels], discoveredModels);
 		const withConfigModels = this.#mergeCustomModels(resolved, this.#customModelOverlays);
 		// Merge runtime extension models so they survive online discovery completion
 		const combined = this.#mergeCustomModels(withConfigModels, this.#runtimeModelOverlays);
 		const withModelOverrides = this.#applyModelOverrides(combined, this.#modelOverrides);
-		this.#models = this.#finalizeModels(this.#applyRuntimeProviderOverrides(withModelOverrides));
-		this.#rebuildCanonicalIndex();
+		return this.#finalizeModels(this.#applyRuntimeProviderOverrides(withModelOverrides));
 	}
 
 	async #discoverProviderModels(
@@ -4966,19 +5146,39 @@ export class ModelRegistry {
 			{
 				providerId: "google-antigravity",
 				resolveKey: extractGoogleOAuthToken,
-				createOptions: oauthToken =>
+				resolveProjectId: (oauthToken, rawValue) =>
+					resolveGoogleOAuthProjectId(
+						this.authStorage,
+						"google-antigravity",
+						oauthToken,
+						rawValue,
+						credentialSessionId,
+						this.#authStorageConfigOwner,
+					),
+				createOptions: (oauthToken, projectId) =>
 					googleAntigravityModelManagerOptions({
 						oauthToken,
 						endpoint: this.getProviderBaseUrl("google-antigravity"),
+						project: projectId,
 					}),
 			},
 			{
 				providerId: "google-gemini-cli",
 				resolveKey: extractGoogleOAuthToken,
-				createOptions: oauthToken =>
+				resolveProjectId: (oauthToken, rawValue) =>
+					resolveGoogleOAuthProjectId(
+						this.authStorage,
+						"google-gemini-cli",
+						oauthToken,
+						rawValue,
+						credentialSessionId,
+						this.#authStorageConfigOwner,
+					),
+				createOptions: (oauthToken, projectId) =>
 					googleGeminiCliModelManagerOptions({
 						oauthToken,
 						endpoint: this.getProviderBaseUrl("google-gemini-cli"),
+						project: projectId,
 					}),
 			},
 			{
@@ -5087,7 +5287,11 @@ export class ModelRegistry {
 				authGeneration === this.#getProviderEvidenceGeneration(descriptor.providerId, apiKeyValue) &&
 				isAuthenticated(key)
 			) {
-				const managerOptions = descriptor.createOptions(key);
+				const projectId = descriptor.resolveProjectId?.(key, apiKeyValue);
+				const isCurrentContext = descriptor.resolveProjectId
+					? () => descriptor.resolveProjectId?.(key, apiKeyValue) === projectId
+					: undefined;
+				const managerOptions = descriptor.createOptions(key, projectId);
 				const baseUrl = this.#getProviderBaseUrlForDiscovery(descriptor.providerId) ?? "";
 				options.push({
 					options: managerOptions,
@@ -5095,6 +5299,8 @@ export class ModelRegistry {
 					apiKey: apiKeyValue,
 					endpoint: this.#normalizeDiscoveryEvidenceEndpoint(baseUrl),
 					endpointContainsUserinfo: this.#urlContainsUserinfo(baseUrl),
+					projectId,
+					...(isCurrentContext ? { isCurrentContext } : {}),
 				});
 			}
 		}
@@ -5102,12 +5308,28 @@ export class ModelRegistry {
 	}
 
 	async #discoverWithModelManager(
-		{ options, authGeneration, apiKey, endpoint, endpointContainsUserinfo }: ModelManagerDiscoveryOptions,
+		{
+			options,
+			authGeneration,
+			apiKey,
+			endpoint,
+			endpointContainsUserinfo,
+			projectId,
+			isCurrentContext,
+		}: ModelManagerDiscoveryOptions,
 		strategy: ModelRefreshStrategy,
 		providerRefresh?: ProviderRefreshFence,
 	): Promise<Model<Api>[]> {
 		const generation = (this.#descriptorDiscoveryGenerations.get(options.providerId) ?? 0) + 1;
 		this.#descriptorDiscoveryGenerations.set(options.providerId, generation);
+		const previousEvidence = this.#descriptorDiscoveryEvidence.get(options.providerId);
+		const discoveryContextChanged =
+			previousEvidence !== undefined &&
+			(previousEvidence.authGeneration !== authGeneration ||
+				previousEvidence.endpoint !== endpoint ||
+				previousEvidence.projectId !== projectId);
+		const isGoogleProjectScopedProvider =
+			options.providerId === "google-antigravity" || options.providerId === "google-gemini-cli";
 		const canUseCredentialDerivedXiaomiEndpoint =
 			options.providerId === "xiaomi" &&
 			apiKey?.startsWith("tp-") === true &&
@@ -5117,8 +5339,7 @@ export class ModelRegistry {
 		let credentialDerivedEndpoint: string | undefined;
 		const reusableCacheProvenance = endpointContainsUserinfo
 			? undefined
-			: fingerprintDescriptorDiscoveryProvenance(authGeneration, endpoint);
-		if (reusableCacheProvenance === undefined && strategy === "offline") return [];
+			: fingerprintDescriptorDiscoveryProvenance(options.providerId, authGeneration, endpoint, projectId);
 		// Signed/userinfo endpoints may still publish a sanitized best-effort row,
 		// but each refresh gets a new opaque nonce. The nonce contains no endpoint
 		// secret and can never match a previous invocation, so constructor loads,
@@ -5128,6 +5349,7 @@ export class ModelRegistry {
 		const isCurrentDiscoveryContext = () =>
 			(this.#descriptorDiscoveryGenerations.get(options.providerId) ?? 0) === generation &&
 			this.#getProviderEvidenceGeneration(options.providerId, apiKey) === authGeneration &&
+			(isCurrentContext?.() ?? true) &&
 			(endpoint ===
 				this.#normalizeDiscoveryEvidenceEndpoint(this.#getProviderBaseUrlForDiscovery(options.providerId) ?? "") ||
 				(canUseCredentialDerivedXiaomiEndpoint && credentialDerivedEndpoint !== undefined));
@@ -5148,6 +5370,40 @@ export class ModelRegistry {
 					? strategy !== "online-if-uncached" || isCurrentDiscovery()
 					: isCurrentProviderRefresh()));
 		try {
+			if (!isCurrentDiscovery()) return [];
+			if (discoveryContextChanged && previousEvidence) {
+				const removedPreviousModels = this.#removeDescriptorDiscoveredModels(
+					options.providerId,
+					previousEvidence.modelIds,
+				);
+				if (removedPreviousModels) {
+					this.#rebuildProviderActivity();
+					this.#rebuildCanonicalIndex();
+				}
+			}
+			if (strategy === "offline") {
+				const cache =
+					reusableCacheProvenance !== undefined && isGoogleProjectScopedProvider
+						? readModelCache<Api>(options.providerId, 24 * 60 * 60 * 1000, Date.now, this.#cacheDbPath)
+						: null;
+				const hasCurrentProjectCache =
+					cache?.dynamicModelIds !== undefined && cache.dynamicModelProvenance === reusableCacheProvenance;
+				if (reusableCacheProvenance === undefined || (isGoogleProjectScopedProvider && !hasCurrentProjectCache)) {
+					if (discoveryContextChanged) {
+						this.#providerEvidenceApiKeys.set(options.providerId, apiKey);
+						this.#descriptorDiscoveryEvidence.set(options.providerId, {
+							fresh: false,
+							modelIds: new Set(),
+							authGeneration,
+							endpoint,
+							projectId,
+						});
+						this.#rebuildProviderActivity();
+						this.#rebuildCanonicalIndex();
+					}
+					return [];
+				}
+			}
 			const manager = createModelManager({
 				...options,
 				cacheDbPath: this.#cacheDbPath,
@@ -5179,7 +5435,9 @@ export class ModelRegistry {
 			const evidence = this.#descriptorDiscoveryEvidence.get(options.providerId);
 			const refreshStrategy =
 				strategy === "online-if-uncached" &&
-				(evidence?.authGeneration !== authGeneration || evidence.endpoint !== endpoint)
+				(evidence?.authGeneration !== authGeneration ||
+					evidence.endpoint !== endpoint ||
+					evidence.projectId !== projectId)
 					? "online"
 					: strategy;
 			const result = await manager.refresh(refreshStrategy);
@@ -5194,7 +5452,7 @@ export class ModelRegistry {
 			const preservesExistingDescriptorEvidence =
 				(result.dynamicModelIds === undefined && !result.fetched && !result.stale) ||
 				(result.stale && result.cacheFresh && result.cacheAuthoritative && evidence?.fresh === true) ||
-				(strategy === "offline" && result.dynamicModelIds === undefined);
+				(strategy === "offline" && result.dynamicModelIds === undefined && !discoveryContextChanged);
 			if (
 				isCurrentDiscovery() &&
 				!preservesExistingDescriptorEvidence &&
@@ -5202,13 +5460,15 @@ export class ModelRegistry {
 					result.dynamicModelIds !== undefined ||
 					result.stale ||
 					this.#descriptorDiscoveryEvidence.get(options.providerId)?.authGeneration !== authGeneration ||
-					this.#descriptorDiscoveryEvidence.get(options.providerId)?.endpoint !== endpoint)
+					this.#descriptorDiscoveryEvidence.get(options.providerId)?.endpoint !== endpoint ||
+					this.#descriptorDiscoveryEvidence.get(options.providerId)?.projectId !== projectId)
 			) {
 				this.#descriptorDiscoveryEvidence.set(options.providerId, {
 					fresh: result.fetched,
 					modelIds: new Set(models.map(model => model.id)),
 					authGeneration,
 					endpoint: this.#normalizeDiscoveryEvidenceEndpoint(models[0]?.baseUrl ?? endpoint),
+					projectId,
 				});
 			}
 			if (!isCurrentDiscovery()) {
@@ -5234,6 +5494,7 @@ export class ModelRegistry {
 					modelIds: new Set(),
 					authGeneration,
 					endpoint,
+					projectId,
 				});
 			}
 			logger.warn("model discovery failed for provider", {
@@ -6213,9 +6474,7 @@ export class ModelRegistry {
 	}
 
 	#invalidateAvailableModels(): void {
-		this.#availableModelsCache = undefined;
-		this.#availableModelsDisabledProviders = undefined;
-		this.#availableModelsEnvFingerprint = undefined;
+		this.#availableModelsCache.clear();
 	}
 
 	#notifyCatalogChanged(): void {
@@ -6290,10 +6549,11 @@ export class ModelRegistry {
 
 	/**
 	 * Get all models (embedded + accepted registry + custom).
+	 * Supplying a credential session selects only that session's Google OAuth discovery catalog.
 	 * If models.yml had errors, returns embedded plus accepted registry models.
 	 */
-	getAll(): Model<Api>[] {
-		return this.#models;
+	getAll(credentialSessionId?: string): Model<Api>[] {
+		return credentialSessionId === undefined ? this.#models : this.#getCredentialScopedCatalog(credentialSessionId);
 	}
 
 	/** Provider ids declared in models.yml, including override-only providers. */
@@ -6381,12 +6641,16 @@ export class ModelRegistry {
 		);
 	}
 
-	#isModelAvailable(model: Model<Api>, disabledProviders?: ReadonlySet<string>): boolean {
+	#isModelAvailable(
+		model: Model<Api>,
+		disabledProviders?: ReadonlySet<string>,
+		credentialSessionId?: string,
+	): boolean {
 		const disabled = disabledProviders ?? getDisabledProviderIdsFromSettings(this.#settings);
 		return (
 			!disabled.has(model.provider) &&
 			(this.#keylessProviders.has(model.provider) ||
-				this.authStorage.hasAuth(model.provider, undefined, { owner: this.#authStorageConfigOwner }))
+				this.authStorage.hasAuth(model.provider, credentialSessionId, { owner: this.#authStorageConfigOwner }))
 		);
 	}
 	/** Per-query precomputed variant filter inputs; plan fields are authoritative when provided. */
@@ -6821,23 +7085,54 @@ export class ModelRegistry {
 	 * is authoritative for visibility: live discovery only enriches entries and
 	 * adds unknown ids, and never removes a bundled model. A provider that cannot
 	 * serve a model reports its own error when the model is used.
+	 * Without a credential session, project-scoped Google OAuth discoveries are omitted.
 	 */
-	getAvailable(): Model<Api>[] {
+	getAvailable(credentialSessionId?: string): Model<Api>[] {
 		this.#synchronizeEnvironmentCredentials();
 		const disabledProviders = getDisabledProviderIdsFromSettings(this.#settings);
 		const disabledProviderKey = [...disabledProviders].sort().join("\u0000");
 		const envFingerprint = envAvailabilityFingerprint(this.#configuredApiKeyEnvNames);
-		if (
-			this.#availableModelsCache &&
-			this.#availableModelsDisabledProviders === disabledProviderKey &&
-			this.#availableModelsEnvFingerprint === envFingerprint
-		) {
-			return this.#availableModelsCache;
-		}
-		this.#availableModelsCache = this.#models.filter(model => this.#isModelAvailable(model, disabledProviders));
-		this.#availableModelsDisabledProviders = disabledProviderKey;
-		this.#availableModelsEnvFingerprint = envFingerprint;
-		return this.#availableModelsCache;
+		const cacheKey = credentialSessionId ?? "";
+		const cached = this.#availableModelsCache.get(cacheKey);
+		if (cached?.disabledProviders === disabledProviderKey && cached.envFingerprint === envFingerprint) {
+			return cached.models;
+		}
+		const catalog = this.#getCredentialScopedCatalog(credentialSessionId);
+		const models = catalog.filter(model => this.#isModelAvailable(model, disabledProviders, credentialSessionId));
+		this.#availableModelsCache.set(cacheKey, {
+			models,
+			disabledProviders: disabledProviderKey,
+			envFingerprint,
+		});
+		return models;
+	}
+
+	#getCredentialScopedCatalog(credentialSessionId?: string): Model<Api>[] {
+		const sessionScopedProviders = new Set(
+			(["google-antigravity", "google-gemini-cli"] as const).filter(
+				provider =>
+					this.authStorage.getEffectiveCredentialType(provider, credentialSessionId, {
+						owner: this.#authStorageConfigOwner,
+					}) === "oauth",
+			),
+		);
+		const commonModels = this.#models.filter(model => {
+			if (model.provider !== "google-antigravity" && model.provider !== "google-gemini-cli") {
+				return true;
+			}
+			if (!sessionScopedProviders.has(model.provider) || this.#discoveryManager.providerIds().has(model.provider))
+				return true;
+			return this.#providerActivity.get(model.provider)?.staticModelIds.has(model.id) === true;
+		});
+		// Commands such as `--list-models` read without a credential session. The
+		// effective (default) credential still has a descriptor identity, so its
+		// discovery overlay must be visible here instead of being dropped.
+		const scopedDiscovered = this.#getGoogleSessionDiscoveryModels(credentialSessionId);
+		const catalog =
+			scopedDiscovered.length > 0
+				? this.#resolveDiscoveredModelCatalog(commonModels, scopedDiscovered)
+				: commonModels;
+		return catalog;
 	}
 
 	#synchronizeEnvironmentCredentials(): void {
@@ -7023,8 +7318,9 @@ export class ModelRegistry {
 	/**
 	 * Find a model by provider and ID.
 	 */
-	find(provider: string, modelId: string): Model<Api> | undefined {
-		return resolveProviderModelReference(provider, modelId, this.#models);
+	find(provider: string, modelId: string, credentialSessionId?: string): Model<Api> | undefined {
+		const models = credentialSessionId === undefined ? this.#models : this.getAll(credentialSessionId);
+		return resolveProviderModelReference(provider, modelId, models);
 	}
 
 	/**
@@ -7115,6 +7411,35 @@ export class ModelRegistry {
 		return apiKey;
 	}
 
+	/** Get a model API key together with the stored row that resolved it, when any. */
+	async getApiKeyWithCredentialRowId(
+		model: Model<Api>,
+		sessionId?: string,
+		options: {
+			credentialSelector?: AuthCredentialSelector;
+			preferredCredentialSelector?: AuthCredentialSelector;
+			signal?: AbortSignal;
+		} = {},
+	): Promise<{ apiKey: string | undefined; credentialRowId: number | undefined }> {
+		this.#refreshRotatingConfigApiKey(model.provider);
+		let credentialRowId: number | undefined;
+		const apiKey = await this.#getApiKeyOrNoAuth(model.provider, async () => {
+			const resolved = await this.authStorage.getApiKeyWithCredentialRowId(model.provider, sessionId, {
+				baseUrl: model.baseUrl,
+				modelId: model.id,
+				credentialSelector: options.credentialSelector,
+				preferredCredentialSelector: options.preferredCredentialSelector,
+				owner: this.#authStorageConfigOwner,
+				signal: options.signal,
+			});
+			credentialRowId = isVllmNoAuthToken(model.provider, resolved.apiKey) ? undefined : resolved.credentialRowId;
+			return resolved.apiKey;
+		});
+		if (apiKey === kNoAuth) credentialRowId = undefined;
+		this.#applyEffectiveAuthHeader(model, apiKey);
+		return { apiKey, credentialRowId };
+	}
+
 	/**
 	 * Get API key for a provider (e.g., "openai").
 	 */