@maudecode/talaria-web 1.18.0 → 1.20.0

package/dist/cli/supervise.js

@@ -2,33 +2,174 @@
  * `talaria-web serve` runs the server in a child so a self-update can restart it
  * (Python `os.execv`; Node has no in-place exec). The supervisor keeps the PID
  * that ctl, launchd, and systemd track, forwards signals, and respawns only
- * when the child exits with `RESTART_EXIT_CODE`.
+ * when the child requests a restart, or once after an updated worker fails before readiness.
+ *
+ * Lifetime contract (TAL-1432): a worker never outlives its supervisor holding the port.
+ * - The supervisor forwards the first stop signal once, kills its own worker if it has not exited
+ *   within `stopGraceMs`, and returns or respawns only after that worker's `close`.
+ * - The worker (`watchRetirement`) retires on a stop signal or when its IPC supervisor disconnects:
+ *   before its close path exists it exits at once; after, it stops listening, drains, and exits
+ *   within `WORKER_SHUTDOWN_MS`, which is shorter than the supervisor's grace.
+ * A process stuck in an uninterruptible kernel wait ignores SIGKILL too; the supervisor then keeps
+ * waiting rather than start a successor that cannot bind.
  */
 import { spawn } from 'node:child_process';
+import { existsSync, renameSync, rmSync } from 'node:fs';
+import { atomicWriteText } from '../fs/atomic.js';
+import { readUpdateRollback, rollbackPaths } from '../tools/update-rollback.js';
+import { homeDotenvKeys, setHomeDotenvKeys } from './dotenv.js';
 export const RESTART_EXIT_CODE = 75;
 export const WORKER_ENV = 'TALARIA_WEB_WORKER';
+export const WORKER_SHUTDOWN_MS = 10_000;
+export const STOP_GRACE_MS = 15_000;
 export async function supervise(opts) {
     const [cmd, ...args] = opts.command;
     if (!cmd)
         throw new Error('supervise: empty command');
     const cwd = process.cwd();
     let stopping = false;
+    let afterRestart = false;
+    let rolledBack = false;
     for (;;) {
-        const child = spawn(cmd, args, { cwd, stdio: 'inherit', env: { ...opts.env, [WORKER_ENV]: '1' } });
-        const forward = (signal) => () => { stopping = true; child.kill(signal); };
+        const env = { ...opts.env, [WORKER_ENV]: '1' };
+        // Reload home-file values in each worker; the supervisor may hold credentials revoked since startup.
+        for (const key of homeDotenvKeys(env))
+            Reflect.deleteProperty(env, key);
+        setHomeDotenvKeys(env, new Set());
+        const paths = opts.packageRoot && opts.stateDir ? rollbackPaths(opts.packageRoot, opts.stateDir) : null;
+        const pendingUpdate = paths && existsSync(paths.previous) ? readUpdateRollback(opts.stateDir) : null;
+        const child = spawn(cmd, args, { cwd, stdio: ['inherit', 'inherit', 'inherit', 'ipc'], env });
+        let ready = false;
+        child.on('message', (message) => {
+            if (message !== 'ready' || ready)
+                return;
+            ready = true;
+            if (afterRestart && !rolledBack && paths && pendingUpdate) {
+                // A later update may already have written a different marker after this worker started listening.
+                if (JSON.stringify(readUpdateRollback(opts.stateDir)) !== JSON.stringify(pendingUpdate))
+                    return;
+                try {
+                    rmSync(paths.failed, { recursive: true, force: true });
+                    rmSync(paths.marker, { force: true });
+                }
+                catch (error) {
+                    opts.log(`[serve] could not finish update recovery cleanup: ${error.message}`);
+                }
+            }
+        });
+        let killTimer;
+        const forward = (signal) => () => {
+            // The worker shuts down once; repeating the signal would only cut its cleanup short.
+            if (stopping)
+                return;
+            stopping = true;
+            child.kill(signal);
+            const graceMs = opts.stopGraceMs ?? STOP_GRACE_MS;
+            killTimer = setTimeout(() => {
+                opts.log(`[serve] worker ${String(child.pid)} did not exit within ${String(graceMs)} ms of ${signal}; killing it`);
+                child.kill('SIGKILL');
+            }, graceMs);
+        };
         const handlers = [['SIGTERM', forward('SIGTERM')], ['SIGINT', forward('SIGINT')], ['SIGHUP', forward('SIGHUP')]];
         for (const [signal, handler] of handlers)
             process.on(signal, handler);
         const code = await new Promise((resolve) => {
-            child.on('exit', (status, signal) => { resolve(status ?? (signal ? 128 + (signal === 'SIGKILL' ? 9 : 15) : 1)); });
-            child.on('error', (error) => { opts.log(`[serve] worker failed to start: ${error.message}`); resolve(1); });
+            child.on('close', (status, signal) => { resolve(status ?? (signal ? 128 + (signal === 'SIGKILL' ? 9 : 15) : 1)); });
+            child.on('error', (error) => {
+                // A started worker still owns its port: wait for its close rather than return or respawn beside it.
+                if (child.pid !== undefined) {
+                    opts.log(`[serve] worker error: ${error.message}`);
+                    return;
+                }
+                opts.log(`[serve] worker failed to start: ${error.message}`);
+                resolve(1);
+            });
         });
+        clearTimeout(killTimer);
         for (const [signal, handler] of handlers)
             process.off(signal, handler);
-        if (code !== RESTART_EXIT_CODE || stopping)
+        if (stopping)
             return code;
+        if (code !== RESTART_EXIT_CODE) {
+            const marker = readUpdateRollback(opts.stateDir);
+            if (!afterRestart || ready || rolledBack || !marker || !paths || !opts.packageRoot || !existsSync(paths.previous))
+                return code;
+            try {
+                rmSync(paths.failed, { recursive: true, force: true });
+                renameSync(opts.packageRoot, paths.failed);
+                try {
+                    renameSync(paths.previous, opts.packageRoot);
+                }
+                catch (error) {
+                    renameSync(paths.failed, opts.packageRoot);
+                    throw error;
+                }
+                // Record the attempt before spawning again; never loop if the restored worker also crashes.
+                rolledBack = true;
+                try {
+                    atomicWriteText(paths.marker, JSON.stringify({ ...marker, failedVersion: marker.version }));
+                }
+                catch (error) {
+                    opts.log(`[serve] could not persist failed update: ${error.message}`);
+                }
+                opts.log(`[serve] update to ${marker.version} failed to start; restored ${marker.previousVersion}`);
+                continue;
+            }
+            catch (error) {
+                opts.log(`[serve] update rollback failed: ${error.message}`);
+                return code;
+            }
+        }
+        rolledBack = false;
+        afterRestart = true;
         opts.log('[serve] restarting the server with the updated source');
         await new Promise((r) => setTimeout(r, opts.restartDelayMs ?? 500));
     }
 }
+/** Retires the server on SIGTERM/SIGINT/SIGHUP and, for a supervised worker, on loss of its supervisor. */
+export function watchRetirement(opts) {
+    const events = opts.events ?? process;
+    const exit = opts.exit ?? ((code) => { process.exit(code); });
+    const deadlineMs = opts.deadlineMs ?? WORKER_SHUTDOWN_MS;
+    let close = null;
+    let retiring = false;
+    let exited = false;
+    const finish = (code) => { if (!exited) {
+        exited = true;
+        exit(code);
+    } };
+    const run = (shutdown) => {
+        const timer = setTimeout(() => {
+            opts.log(`[webui] shutdown did not finish within ${String(deadlineMs)} ms; exiting`);
+            finish(1);
+        }, deadlineMs);
+        void Promise.resolve().then(shutdown).then(() => { clearTimeout(timer); finish(0); }, (error) => { clearTimeout(timer); opts.log(`[webui] shutdown failed: ${error.message}`); finish(1); });
+    };
+    const retire = (reason) => {
+        if (retiring)
+            return;
+        retiring = true;
+        opts.log(`[webui] ${reason}; shutting down`);
+        // Nothing has been served before the close path exists.
+        if (close)
+            run(close);
+        else
+            finish(0);
+    };
+    for (const signal of ['SIGTERM', 'SIGINT', 'SIGHUP'])
+        events.on(signal, () => { retire(`${signal} received`); });
+    if (opts.supervised) {
+        events.on('disconnect', () => { retire('supervisor disconnected'); });
+        // The listener must not keep a worker alive that would otherwise exit.
+        if (events === process)
+            process.channel?.unref();
+        if (!events.connected)
+            retire('supervisor disconnected');
+    }
+    return {
+        get retiring() { return retiring; },
+        attach: (shutdown) => { if (!retiring)
+            close = shutdown; },
+    };
+}
 //# sourceMappingURL=supervise.js.map

package/dist/cli/supervise.js.map

@@ -1 +1 @@
-{"version":3,"file":"supervise.js","sourceRoot":"","sources":["../../src/cli/supervise.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAA;AACnC,MAAM,CAAC,MAAM,UAAU,GAAG,oBAAoB,CAAA;AAU9C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB;IACpD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAA;IACnC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;QAClG,MAAM,OAAO,GAAG,CAAC,MAAsB,EAAE,EAAE,CAAC,GAAS,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA,CAAC,CAAC,CAAA;QAC/F,MAAM,QAAQ,GAAmC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;QAChJ,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,QAAQ;YAAE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACrE,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACjD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YACjH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC5G,CAAC,CAAC,CAAA;QACF,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACtE,IAAI,IAAI,KAAK,iBAAiB,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAA;QACvD,IAAI,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAA;QACjE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC,CAAA;IACrE,CAAC;AACH,CAAC"}
+{"version":3,"file":"supervise.js","sourceRoot":"","sources":["../../src/cli/supervise.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAA;AACnC,MAAM,CAAC,MAAM,UAAU,GAAG,oBAAoB,CAAA;AAC9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AACxC,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAA;AAcnC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB;IACpD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAA;IACnC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACzB,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,IAAI,UAAU,GAAG,KAAK,CAAA;IACtB,SAAS,CAAC;QACR,MAAM,GAAG,GAAsB,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAA;QACjE,qGAAqG;QACrG,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACvE,iBAAiB,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACvG,MAAM,aAAa,GAAG,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACpG,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;QAC7F,IAAI,KAAK,GAAG,KAAK,CAAA;QACjB,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;YAC9B,IAAI,OAAO,KAAK,OAAO,IAAI,KAAK;gBAAE,OAAM;YACxC,KAAK,GAAG,IAAI,CAAA;YACZ,IAAI,YAAY,IAAI,CAAC,UAAU,IAAI,KAAK,IAAI,aAAa,EAAE,CAAC;gBAC1D,kGAAkG;gBAClG,IAAI,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;oBAAE,OAAM;gBAC/F,IAAI,CAAC;oBACH,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;oBACtD,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBACvC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,CAAC,qDAAsD,KAAe,CAAC,OAAO,EAAE,CAAC,CAAA;gBAAC,CAAC;YAC/G,CAAC;QACH,CAAC,CAAC,CAAA;QACF,IAAI,SAAqC,CAAA;QACzC,MAAM,OAAO,GAAG,CAAC,MAAsB,EAAE,EAAE,CAAC,GAAS,EAAE;YACrD,qFAAqF;YACrF,IAAI,QAAQ;gBAAE,OAAM;YACpB,QAAQ,GAAG,IAAI,CAAA;YACf,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAClB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,IAAI,aAAa,CAAA;YACjD,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,IAAI,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,OAAO,CAAC,UAAU,MAAM,cAAc,CAAC,CAAA;gBAClH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACvB,CAAC,EAAE,OAAO,CAAC,CAAA;QACb,CAAC,CAAA;QACD,MAAM,QAAQ,GAAmC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;QAChJ,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,QAAQ;YAAE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACrE,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACjD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YAClH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,oGAAoG;gBACpG,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;oBAAC,OAAM;gBAAC,CAAC;gBAC3F,IAAI,CAAC,GAAG,CAAC,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC5D,OAAO,CAAC,CAAC,CAAC,CAAA;YACZ,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,YAAY,CAAC,SAAS,CAAC,CAAA;QACvB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACtE,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAA;QACzB,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAChD,IAAI,CAAC,YAAY,IAAI,KAAK,IAAI,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC9H,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBACtD,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;gBAC1C,IAAI,CAAC;oBAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;gBAAC,CAAC;gBACpD,OAAO,KAAK,EAAE,CAAC;oBAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;oBAAC,MAAM,KAAK,CAAA;gBAAC,CAAC;gBACzE,4FAA4F;gBAC5F,UAAU,GAAG,IAAI,CAAA;gBACjB,IAAI,CAAC;oBAAC,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;gBAAC,CAAC;gBACnG,OAAO,KAAK,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,CAAC,4CAA6C,KAAe,CAAC,OAAO,EAAE,CAAC,CAAA;gBAAC,CAAC;gBAClG,IAAI,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,OAAO,8BAA8B,MAAM,CAAC,eAAe,EAAE,CAAC,CAAA;gBACnG,SAAQ;YACV,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,GAAG,CAAC,mCAAoC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAA;gBACvE,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,UAAU,GAAG,KAAK,CAAA;QAClB,YAAY,GAAG,IAAI,CAAA;QACnB,IAAI,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAA;QACjE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC,CAAA;IACrE,CAAC;AACH,CAAC;AAkBD,2GAA2G;AAC3G,MAAM,UAAU,eAAe,CAAC,IAAuB;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAA;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,kBAAkB,CAAA;IACxD,IAAI,KAAK,GAAiC,IAAI,CAAA;IAC9C,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAAC,CAAC,CAAC,CAAC,CAAA;IACrF,MAAM,GAAG,GAAG,CAAC,QAA6B,EAAQ,EAAE;QAClD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,GAAG,CAAC,0CAA0C,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;YACpF,MAAM,CAAC,CAAC,CAAC,CAAA;QACX,CAAC,EAAE,UAAU,CAAC,CAAA;QACd,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CACxC,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,EACxC,CAAC,KAAc,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA6B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CACzH,CAAA;IACH,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,CAAC,MAAc,EAAQ,EAAE;QACtC,IAAI,QAAQ;YAAE,OAAM;QACpB,QAAQ,GAAG,IAAI,CAAA;QACf,IAAI,CAAC,GAAG,CAAC,WAAW,MAAM,iBAAiB,CAAC,CAAA;QAC5C,wDAAwD;QACxD,IAAI,KAAK;YAAE,GAAG,CAAC,KAAK,CAAC,CAAA;;YAChB,MAAM,CAAC,CAAC,CAAC,CAAA;IAChB,CAAC,CAAA;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAU;QAAE,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IACxH,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACpE,uEAAuE;QACvE,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,CAAA;QAChD,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,yBAAyB,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO;QACL,IAAI,QAAQ,KAAK,OAAO,QAAQ,CAAA,CAAC,CAAC;QAClC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ;YAAE,KAAK,GAAG,QAAQ,CAAA,CAAC,CAAC;KAC1D,CAAA;AACH,CAAC"}

package/dist/config/agent-config.d.ts

@@ -1,4 +1,10 @@
+import type { SidecarResult } from '@maudecode/talaria-web-contracts';
 import type { SidecarLike } from '../sidecar/client.js';
+export type SpeedTier = SidecarResult<'models.speed_tiers'>['tiers'][number][number];
+/** One auxiliary slot as the Agent lists it (TAL-800); the static catalog's rows carry no effort or inheritance. */
+export type AuxSlot = Omit<SidecarResult<'aux.tasks'>['tasks'][number], 'reasoning_effort'> & {
+    reasoning_effort: string | null;
+};
 export type Config = Record<string, unknown>;
 export type Dict = Record<string, unknown>;
 export declare const isDict: (v: unknown) => v is Dict;
@@ -26,9 +32,28 @@ export declare class AgentConfig {
     /** Parsed config.yaml (empty object when the file is missing). */
     read(profileHome: string, opts?: ConfigFileOptions): Promise<Config>;
     /** Synchronous last-known config for callers that cannot await (workspace resolution); refreshes in the background. */
-    peek(profileHome: string): Config | null;
+    peek(profileHome: string, opts?: {
+        refresh?: boolean;
+    }): Config | null;
     /** Read-modify-write under a per-file lock (homes sharing an `HERMES_CONFIG_PATH` override serialise); `mutate` returns false to skip the write. */
     update(profileHome: string, mutate: (config: Config) => unknown, opts?: ConfigFileOptions): Promise<Config>;
+    /** The Agent owns speed eligibility. A failed lookup must not erase a saved tier. */
+    speedTiers(profileHome: string, config: Config, models: {
+        model: string;
+        provider: string;
+    }[]): Promise<SpeedTier[][]>;
+    /**
+     * TAL-800: the profile's auxiliary slots as its Agent lists them (plugin tasks included), and the Agent's other
+     * `auxiliary.*` keys. The static catalog only when the Agent cannot list them; `reserved` is then unknown (null).
+     */
+    auxiliarySlots(profileHome: string): Promise<{
+        slots: AuxSlot[];
+        reserved: string[] | null;
+    }>;
+    /** TAL-901: the personalities the profile's Agent offers for its config; throws when the Agent cannot list them. */
+    agentPersonalities(profileHome: string): Promise<PersonalityRow[]>;
+    /** The Agent's personalities to list and select from; the config's own block only while the sidecar cannot list them. */
+    personalities(profileHome: string): Promise<PersonalityRow[]>;
     invalidate(profileHome?: string): void;
 }
 /** Settings `provider_cost_budget` → positive number or null. */
@@ -67,6 +92,7 @@ export interface ReasoningStatus {
     supported_efforts: string[];
     supports_reasoning_effort: boolean;
     supports_thinking_toggle: boolean;
+    supports_session_scope: boolean;
 }
 export type EffortsResolver = (model: string, provider: string, baseUrl: string) => Promise<string[]>;
 /**
@@ -75,25 +101,25 @@ export type EffortsResolver = (model: string, provider: string, baseUrl: string)
  * endpoint never receives a supra-ceiling level.
  */
 export declare function coerceReasoningEffort(effort: string, supported: string[], provider?: string): string;
+/** The Web display preference, shared by the settings response and native-owner watches. */
+export declare function showReasoning(config: Config): boolean;
 export declare function reasoningStatus(config: Config, resolve: EffortsResolver, opts?: {
     model?: string | null;
     provider?: string | null;
     baseUrl?: string | null;
 }): Promise<ReasoningStatus>;
 export declare function validReasoningEffort(effort: string): boolean;
-export declare function personalityRows(config: Config): {
-    name: string;
-    description: string;
-}[];
-/** Python `/api/personality/set` prompt resolution; null when the personality is unknown. */
-export declare function personalityPrompt(config: Config, name: string): string | null;
+export type PersonalityRow = SidecarResult<'personalities.list'>['personalities'][number];
+/** The pre-TAL-901 reading of `agent.personalities` alone, kept only for when the sidecar cannot list the Agent's. */
+export declare function configPersonalities(config: Config): PersonalityRow[];
+/** The personality `name` selects, compared case-folded as the Agent does; undefined when there is none. */
+export declare function findPersonality(rows: PersonalityRow[], name: string): PersonalityRow | undefined;
 /** Python `_apply_advanced_model_options` (in place). */
 export declare function applyAdvancedModelOptions(target: Dict, advanced: unknown): void;
 export declare function publicAdvancedModelOptions(modelCfg: Dict): Dict;
-export declare function isOpenAiFamilyProvider(provider: unknown): boolean;
-/** Python `_main_model_supports_service_tier`: OpenAI-family GPT-5-class models take `priority`. */
-export declare function mainModelSupportsServiceTier(model: unknown, provider: unknown): boolean;
-export declare function auxiliaryModels(config: Config): {
+/** Effective configured endpoint, shared by speed display and validation after model selection. */
+export declare function modelBaseUrl(config: Config, provider: string): string;
+export declare function auxiliaryModels(config: Config, tiers: SpeedTier[], slots: AuxSlot[]): {
     tasks: Dict[];
     main: Dict;
 };

package/dist/config/agent-config.js

@@ -6,11 +6,11 @@
  * Policy helpers (model section, reasoning, max_tokens, auxiliary slots,
  * personalities) port Python `api/config.py`.
  */
-import { statSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, resolve as resolvePath } from 'node:path';
-import { PORTAL_PROVIDERS, PROVIDER_ALIASES, PROVIDER_DISPLAY, PROVIDER_MODELS, VALID_REASONING_EFFORTS, AUXILIARY_TASK_CATALOG, AUX_TASK_SLOTS, RETIRED_AUX_TASK_SLOTS } from '../providers/tables.js';
+import { LOCAL_RUNTIME_PROVIDER, PORTAL_PROVIDERS, PROVIDER_ALIASES, PROVIDER_DISPLAY, PROVIDER_MODELS, VALID_REASONING_EFFORTS, AUXILIARY_TASK_CATALOG, RETIRED_AUX_TASK_SLOTS } from '../providers/tables.js';
 import { str } from '../util.js';
+import { fileStatKey } from '../fs/stat.js';
 export const isDict = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
 export const dict = (v) => (isDict(v) ? v : {});
 export class ConfigUnavailable extends Error {
@@ -30,9 +30,8 @@ export class AgentConfig {
     /** Fingerprint of the config file; `missing` only when it does not exist. Any other stat failure (EACCES, EIO, ...) is unreadable, never empty. */
     statKey(profileHome, opts = {}) {
         try {
-            const st = statSync(this.path(profileHome, opts), { bigint: true });
             // ctime moves on chmod/chown, so a permission change re-reads through the sidecar instead of serving the old parse.
-            return `${String(st.mtimeNs)}:${String(st.ctimeNs)}:${String(st.size)}:${String(st.ino)}`;
+            return fileStatKey(this.path(profileHome, opts));
         }
         catch (error) {
             const code = error.code;
@@ -76,7 +75,7 @@ export class AgentConfig {
         throw new ConfigUnavailable('config.yaml changed while it was being read; retry');
     }
     /** Synchronous last-known config for callers that cannot await (workspace resolution); refreshes in the background. */
-    peek(profileHome) {
+    peek(profileHome, opts = {}) {
         let key;
         try {
             key = this.statKey(profileHome);
@@ -90,7 +89,8 @@ export class AgentConfig {
         if (key === 'missing')
             return {};
         // A changed file invalidates the snapshot: callers gate on `null` (fail closed) until the matching read lands.
-        void this.read(profileHome).catch(() => undefined);
+        if (opts.refresh !== false)
+            void this.read(profileHome).catch(() => undefined);
         return null;
     }
     /** Read-modify-write under a per-file lock (homes sharing an `HERMES_CONFIG_PATH` override serialise); `mutate` returns false to skip the write. */
@@ -99,7 +99,7 @@ export class AgentConfig {
         const prev = this.locks.get(file) ?? Promise.resolve();
         const run = prev.catch(() => undefined).then(async () => {
             const config = await this.read(profileHome, opts);
-            if (mutate(config) === false)
+            if (await mutate(config) === false)
                 return config;
             const sidecar = this.deps.sidecar();
             if (!sidecar)
@@ -111,6 +111,48 @@ export class AgentConfig {
         this.locks.set(file, run);
         return run;
     }
+    /** The Agent owns speed eligibility. A failed lookup must not erase a saved tier. */
+    async speedTiers(profileHome, config, models) {
+        const sidecar = this.deps.sidecar();
+        if (!sidecar)
+            throw new ConfigUnavailable('Hermes Agent sidecar is not running; speed tiers are unavailable');
+        try {
+            const routes = models.map(({ model, provider }) => ({ model, provider: resolveProviderAlias(provider), base_url: modelBaseUrl(config, provider) }));
+            const result = await sidecar.call('models.speed_tiers', { profile_home: profileHome, routes });
+            if (result.tiers.length !== routes.length)
+                throw new Error('incomplete speed tier response');
+            return result.tiers;
+        }
+        catch (error) {
+            throw new ConfigUnavailable(`Speed tiers are unavailable: ${String(error)}`);
+        }
+    }
+    /**
+     * TAL-800: the profile's auxiliary slots as its Agent lists them (plugin tasks included), and the Agent's other
+     * `auxiliary.*` keys. The static catalog only when the Agent cannot list them; `reserved` is then unknown (null).
+     */
+    async auxiliarySlots(profileHome) {
+        const sidecar = this.deps.sidecar();
+        // A failed listing offers the built-in table only, so a plugin slot is never assignable without the Agent vouching for it.
+        const listed = sidecar ? await sidecar.call('aux.tasks', { profile_home: profileHome }).catch(() => null) : null;
+        return listed ? { slots: listed.tasks, reserved: listed.reserved } : { slots: AUXILIARY_TASK_CATALOG.map((slot) => ({ ...slot, inherit_from: null, reasoning_effort: null, effective: null })), reserved: null };
+    }
+    /** TAL-901: the personalities the profile's Agent offers for its config; throws when the Agent cannot list them. */
+    async agentPersonalities(profileHome) {
+        const sidecar = this.deps.sidecar();
+        if (!sidecar)
+            throw new ConfigUnavailable('Hermes Agent sidecar is not running; personalities are unavailable');
+        return (await sidecar.call('personalities.list', { config: await this.read(profileHome) })).personalities;
+    }
+    /** The Agent's personalities to list and select from; the config's own block only while the sidecar cannot list them. */
+    async personalities(profileHome) {
+        try {
+            return await this.agentPersonalities(profileHome);
+        }
+        catch {
+            return configPersonalities(await this.read(profileHome));
+        }
+    }
     invalidate(profileHome) {
         if (profileHome)
             this.cache.delete(this.path(profileHome));
@@ -148,7 +190,7 @@ export function canonicaliseProviderId(name) {
     if (raw in PROVIDER_DISPLAY || raw in PROVIDER_MODELS)
         return raw;
     const resolved = resolveProviderAlias(raw);
-    if (resolved && (resolved in PROVIDER_DISPLAY || resolved in PROVIDER_MODELS))
+    if (resolved && (resolved in PROVIDER_DISPLAY || resolved in PROVIDER_MODELS || resolved === LOCAL_RUNTIME_PROVIDER))
         return resolved;
     return raw;
 }
@@ -317,8 +359,14 @@ export function coerceReasoningEffort(effort, supported, provider = '') {
     }
     return raw;
 }
-export async function reasoningStatus(config, resolve, opts = {}) {
+/** The Web display preference, shared by the settings response and native-owner watches. */
+export function showReasoning(config) {
     const display = dict(config.display);
+    const webui = dict(dict(display.platforms).webui).show_reasoning;
+    const raw = typeof webui === 'boolean' ? webui : display.show_reasoning;
+    return typeof raw === 'boolean' ? raw : true;
+}
+export async function reasoningStatus(config, resolve, opts = {}) {
     const agent = dict(config.agent);
     let model = str(opts.model).trim();
     let provider = str(opts.provider).trim();
@@ -332,48 +380,41 @@ export async function reasoningStatus(config, resolve, opts = {}) {
             baseUrl = str(m.base_url).trim();
     }
     const supported = model ? await resolve(model, provider, baseUrl) : [];
-    const showRaw = display.show_reasoning;
     return {
-        show_reasoning: typeof showRaw === 'boolean' ? showRaw : true,
+        show_reasoning: showReasoning(config),
         reasoning_effort: coerceReasoningEffort(str(agent.reasoning_effort), supported, provider),
         supported_efforts: supported,
         supports_reasoning_effort: supported.length > 0,
         supports_thinking_toggle: supported.length > 0,
+        supports_session_scope: true,
     };
 }
 export function validReasoningEffort(effort) {
     const raw = effort.trim().toLowerCase();
     return !raw || raw === 'none' || VALID_REASONING_EFFORTS.includes(raw);
 }
-// ── personalities ─────────────────────────────────────────────────────
-export function personalityRows(config) {
+/** The pre-TAL-901 reading of `agent.personalities` alone, kept only for when the sidecar cannot list the Agent's. */
+export function configPersonalities(config) {
     const raw = dict(config.agent).personalities;
     if (!isDict(raw))
         return [];
     return Object.entries(raw).map(([name, value]) => {
-        let desc = '';
-        if (isDict(value))
-            desc = str(value.description);
-        else if (typeof value === 'string')
-            desc = value.slice(0, 80) + (value.length > 80 ? '...' : '');
-        return { name, description: desc };
+        if (isDict(value)) {
+            const parts = [str(value.system_prompt) || str(value.prompt)];
+            if (value.tone)
+                parts.push(`Tone: ${str(value.tone)}`);
+            if (value.style)
+                parts.push(`Style: ${str(value.style)}`);
+            return { name, description: str(value.description), prompt: parts.filter(Boolean).join('\n') };
+        }
+        const text = str(value);
+        return { name, description: text.slice(0, 80) + (text.length > 80 ? '...' : ''), prompt: text };
     });
 }
-/** Python `/api/personality/set` prompt resolution; null when the personality is unknown. */
-export function personalityPrompt(config, name) {
-    const raw = dict(config.agent).personalities;
-    if (!isDict(raw) || !(name in raw))
-        return null;
-    const value = raw[name];
-    if (isDict(value)) {
-        const parts = [str(value.system_prompt) || str(value.prompt)];
-        if (value.tone)
-            parts.push(`Tone: ${str(value.tone)}`);
-        if (value.style)
-            parts.push(`Style: ${str(value.style)}`);
-        return parts.filter(Boolean).join('\n');
-    }
-    return str(value);
+/** The personality `name` selects, compared case-folded as the Agent does; undefined when there is none. */
+export function findPersonality(rows, name) {
+    const key = name.trim().toLowerCase();
+    return key ? rows.find((row) => row.name.toLowerCase() === key) : undefined;
 }
 // ── advanced model options / auxiliary slots ──────────────────────────
 function coerceOptionalPositiveInt(value, field) {
@@ -434,10 +475,10 @@ export function applyAdvancedModelOptions(target, advanced) {
         const tier = str(advanced.service_tier).trim().toLowerCase();
         if (!tier || tier === 'default')
             Reflect.deleteProperty(target, 'service_tier');
-        else if (tier === 'priority')
-            target.service_tier = 'priority';
+        else if (tier === 'priority' || tier === 'ultrafast')
+            target.service_tier = tier;
         else
-            throw new Error('service_tier must be one of: default, priority');
+            throw new Error('service_tier must be one of: default, priority, ultrafast');
     }
     if (advanced.api_key_clear)
         Reflect.deleteProperty(target, 'api_key');
@@ -455,21 +496,24 @@ export function publicAdvancedModelOptions(modelCfg) {
         api_key_set: Boolean(str(modelCfg.api_key).trim()),
     };
 }
-export function isOpenAiFamilyProvider(provider) {
-    const resolved = resolveProviderAlias(provider);
-    return resolved === 'openai' || resolved === 'openai-api' || resolved === 'openai-codex';
-}
-/** Python `_main_model_supports_service_tier`: OpenAI-family GPT-5-class models take `priority`. */
-export function mainModelSupportsServiceTier(model, provider) {
-    if (!isOpenAiFamilyProvider(provider))
-        return false;
-    const id = str(model).trim().toLowerCase().replace(/^openai\//, '');
-    return id.startsWith('gpt-5') || /^o[0-9]/.test(id);
-}
-function auxTaskPayload(key, entry, label, description) {
+/** Effective configured endpoint, shared by speed display and validation after model selection. */
+export function modelBaseUrl(config, provider) {
+    const pid = canonicaliseProviderId(provider);
+    const model = modelSection(config);
+    if (canonicaliseProviderId(model.provider) === pid && str(model.base_url).trim())
+        return str(model.base_url).trim();
+    const providers = dict(config.providers);
+    const key = Object.keys(providers).find((k) => canonicaliseProviderId(k) === pid);
+    const base = str(dict(key ? providers[key] : null).base_url).trim();
+    if (base)
+        return base;
+    const custom = customProviderEntries(config).find((cp) => customProviderSlug(cp.name) === pid);
+    return str(custom?.base_url).trim();
+}
+function auxTaskPayload(slot, entry) {
     const e = dict(entry);
     return {
-        task: key,
+        task: slot.key,
         provider: str(e.provider).trim() || 'auto',
         model: str(e.model).trim(),
         base_url: str(e.base_url).trim(),
@@ -478,23 +522,26 @@ function auxTaskPayload(key, entry, label, description) {
         max_concurrency: e.max_concurrency ?? '',
         extra_body: isDict(e.extra_body) ? e.extra_body : {},
         api_key_set: Boolean(str(e.api_key).trim()),
-        label,
-        description,
+        label: slot.label,
+        description: slot.description,
+        inherit_from: slot.inherit_from,
+        reasoning_effort: slot.reasoning_effort,
+        effective: slot.effective,
     };
 }
-export function auxiliaryModels(config) {
+export function auxiliaryModels(config, tiers, slots) {
     const modelCfg = modelSection(config);
     const aux = dict(config.auxiliary);
     const mainProvider = str(modelCfg.provider).trim();
     const mainModel = str(modelCfg.default ?? modelCfg.name).trim();
-    const supportsFast = mainModelSupportsServiceTier(mainModel, mainProvider);
     return {
-        tasks: AUXILIARY_TASK_CATALOG.map((slot) => auxTaskPayload(slot.key, aux[slot.key], slot.label, slot.description)),
+        tasks: slots.map((slot) => auxTaskPayload(slot, slot.key === DELEGATION_TASK ? config.delegation : aux[slot.key])),
         main: {
             provider: mainProvider,
             model: mainModel,
-            supports_fast_tier: supportsFast,
-            service_tier: supportsFast && str(modelCfg.service_tier).trim().toLowerCase() === 'priority' ? 'priority' : '',
+            supports_fast_tier: tiers.some((t) => t.service_tier === 'priority'),
+            supported_speed_tiers: tiers,
+            service_tier: tiers.find((t) => t.service_tier === str(modelCfg.service_tier).trim().toLowerCase())?.service_tier ?? 'default',
             ...publicAdvancedModelOptions(modelCfg),
         },
     };
@@ -512,9 +559,27 @@ function auxiliarySelection(providerRaw, modelRaw) {
     return [provider === 'auto' ? parsed[1] : provider, parsed[0]];
 }
 const isCustomProvider = (provider) => { const p = str(provider).trim(); return p === 'custom' || p.startsWith('custom:'); };
+/**
+ * TAL-1273: the Agent's subagent slot. `delegate_task` reads top-level `delegation`, where Auto (inherit the parent) is
+ * stored as empty strings, and a `base_url` outranks `provider`. Only `custom` keeps a direct endpoint; any other pick
+ * clears its `base_url` and `api_mode` so the child really runs on the picked provider.
+ */
+const DELEGATION_TASK = 'delegation';
+function delegationRoute(entry, provider, model, advanced) {
+    const route = { ...dict(entry), provider: provider === 'auto' ? '' : provider, model };
+    if (provider !== 'custom')
+        Object.assign(route, { base_url: '', api_mode: '' });
+    if (isDict(advanced)) {
+        // The section has no timeout, concurrency, extra_body, or speed keys; only the endpoint and its key apply.
+        applyAdvancedModelOptions(route, Object.fromEntries(['base_url', 'api_key', 'api_key_clear'].filter((k) => k in advanced).map((k) => [k, advanced[k]])));
+    }
+    return route;
+}
 export async function setAuxiliaryModel(store, home, task, providerRaw, modelRaw, advanced) {
-    if (task !== '__reset__' && !AUX_TASK_SLOTS.includes(task))
-        throw new Error(`Unknown auxiliary task slot: '${task}'. Valid: [${AUX_TASK_SLOTS.map((s) => `'${s}'`).join(', ')}]`);
+    const listing = await store.auxiliarySlots(home);
+    const slots = listing.slots.map((slot) => slot.key);
+    if (task !== '__reset__' && !slots.includes(task))
+        throw new Error(`Unknown auxiliary task slot: '${task}'. Valid: [${slots.map((s) => `'${s}'`).join(', ')}]`);
     const [provider, model] = task === '__reset__' ? ['auto', ''] : auxiliarySelection(providerRaw, modelRaw);
     await store.update(home, (config) => {
         const aux = dict(config.auxiliary);
@@ -523,9 +588,20 @@ export async function setAuxiliaryModel(store, home, task, providerRaw, modelRaw
         if (task === '__reset__') {
             for (const retired of RETIRED_AUX_TASK_SLOTS)
                 Reflect.deleteProperty(aux, retired);
-            for (const slot of AUX_TASK_SLOTS)
-                aux[slot] = autoSlot(aux[slot]);
+            // A route block the Agent neither lists nor owns is a disabled or removed plugin's task: Reset All clears it too, so
+            // re-enabling the plugin does not bring back a pin the user reset. Unknown ownership (no listing) leaves it alone.
+            const { reserved } = listing;
+            const orphans = reserved ? Object.keys(aux).filter((key) => isDict(aux[key]) && !slots.includes(key) && !reserved.includes(key)) : [];
+            for (const slot of [...slots, ...orphans])
+                if (slot !== DELEGATION_TASK)
+                    aux[slot] = autoSlot(aux[slot]);
             config.auxiliary = aux;
+            if (slots.includes(DELEGATION_TASK))
+                config.delegation = delegationRoute(config.delegation, 'auto', '', null);
+            return;
+        }
+        if (task === DELEGATION_TASK) {
+            config.delegation = delegationRoute(config.delegation, provider, model, advanced);
             return;
         }
         const slot = provider === 'auto' && !model ? autoSlot(aux[task]) : dict(aux[task]);
@@ -564,7 +640,7 @@ export async function setDefaultModel(store, home, modelId, providerRaw, advance
         throw new Error('model is required');
     let persistedModel = selected;
     let persistedProvider = '';
-    await store.update(home, (config) => {
+    await store.update(home, async (config) => {
         const modelCfg = modelSection(config);
         const previousProvider = str(modelCfg.provider).trim();
         const requested = str(providerRaw).trim();
@@ -638,9 +714,15 @@ export async function setDefaultModel(store, home, modelId, providerRaw, advance
                 Reflect.deleteProperty(modelCfg, 'base_url');
         }
         applyAdvancedModelOptions(modelCfg, advanced);
-        if (!mainModelSupportsServiceTier(persistedModel, persistedProvider))
-            Reflect.deleteProperty(modelCfg, 'service_tier');
         config.model = modelCfg;
+        if (modelCfg.service_tier) {
+            const [tiers] = await store.speedTiers(home, config, [{ model: persistedModel, provider: persistedProvider }]);
+            if (!tiers.some((t) => t.service_tier === modelCfg.service_tier)) {
+                if (dict(advanced).service_tier)
+                    throw new Error('service_tier is not supported for this model and route');
+                Reflect.deleteProperty(modelCfg, 'service_tier');
+            }
+        }
     });
     return { ok: true, model: persistedModel, provider: persistedProvider || null };
 }