@mmmbuto/nexuscrew 0.9.73 → 0.9.75

package/frontend/dist/index.html

@@ -11,8 +11,8 @@
   <meta name="apple-mobile-web-app-title" content="NexusCrew" />
   <link rel="manifest" href="/manifest.json" />
   <title>NexusCrew</title>
-  <script type="module" crossorigin src="/assets/index-EAHAmDmX.js"></script>
-  <link rel="stylesheet" crossorigin href="/assets/index-C_z6r985.css">
+  <script type="module" crossorigin src="/assets/index-DMfpKI3n.js"></script>
+  <link rel="stylesheet" crossorigin href="/assets/index-B9GW2LHm.css">
 </head>
 <body>
   <div id="root"></div>

package/frontend/dist/version.json

@@ -1 +1 @@
-{"version":"0.9.73"}
+{"version":"0.9.75"}

package/lib/fleet/builtin.js

@@ -38,10 +38,13 @@ const {
 } = require('./definitions.js');
 const {
   publicCatalog, describeManaged, describeCatalogCredential, defaultShellEngine, defaultAgyEngine, defaultKimiEngine, defaultGrokEngine, defaultVlEngine,
-  CATALOG, credential: resolveProfileCredential, extraModelsFrom, knownMcpServerNames, profileFor,
+  CATALOG, CLIENT_LABELS, CLIENT_ORDER, engineClient, ordinaEngine, isStandardClient,
+  credential: resolveProfileCredential, extraModelsFrom, knownMcpServerNames, profileFor,
   normalizeManagedSpec, codexSurfaceNames,
+  engineModelDiscoveryPlan, ollamaCloudCatalogModels, declaredModelsFor, ALIBABA_PI_MODELS,
 } = require('./managed.js');
 const { probeModel, probeCustomEndpoint } = require('./model-probe.js');
+const { createModelDiscovery, DISCOVERY_PROPOSAL_CAP } = require('./model-discovery.js');
 const { sharedProbe: defaultEndpointProbe } = require('./endpoint-probe.js');
 const { validEnvKey } = require('./env-key.js');
 const { isReservedLiveName } = require('../live-host/reserved.js');
@@ -696,10 +699,14 @@ async function createBuiltinFleet(cfg = {}) {
       }
       boot = persistito;
     }
-    boot = backfillShellEngine(defsPath, boot, cfg.log);
+    // L'ordine delle aggiunte segue CLIENT_ORDER (agy, grok, shell...) e poi i
+    // client fuori lista in ordine stabile (kimi, vl): un fleet.json backfillato
+    // nasce gia' nell'ordine che il payload mostra. Ogni backfill resta
+    // idempotente e indipendente: il riordino non cambia cosa viene aggiunto.
     boot = backfillAgyEngine(defsPath, boot, cfg);
-    boot = backfillKimiEngine(defsPath, boot, cfg.log);
     boot = backfillGrokEngine(defsPath, boot, cfg);
+    boot = backfillShellEngine(defsPath, boot, cfg.log);
+    boot = backfillKimiEngine(defsPath, boot, cfg.log);
     boot = backfillVlEngine(defsPath, boot, cfg.log);
     // Ripara (non aggiunge) un desktop.local gia' presente col comando relativo.
     // Il logger va PASSATO: senza, il messaggio di fallimento si ferma a un
@@ -1204,7 +1211,10 @@ async function createBuiltinFleet(cfg = {}) {
     // rifiutato se la dichiarazione non c'e' ancora — fail-closed corretto, ma
     // che al ripristino si legge come «il backup era rotto».
     const models = Array.isArray(opts.models) ? opts.models : [];
-    if (models.length > 64) throw httpError(400, 'troppi modelli nel backup');
+    // Il tetto dei modelli accettati e' lo stesso della validazione del
+    // fleet.json (CAPS.MAX_MODELS): un hardcode separato qui era gia'
+    // divergente (64 contro 128) e rifiutava backup validi.
+    if (models.length > CAPS.MAX_MODELS) throw httpError(400, `troppi modelli nel backup (max ${CAPS.MAX_MODELS})`);
     for (const m of models) {
       if (!m || typeof m !== 'object' || Array.isArray(m)) throw httpError(400, 'definizione modello non valida');
       if (typeof m.id !== 'string' || !m.id.trim() || typeof m.engine !== 'string' || !m.engine.trim()) {
@@ -1378,9 +1388,20 @@ async function createBuiltinFleet(cfg = {}) {
     const realHome = resolveCwd(home, home);
     return {
       schemaVersion: defs.schemaVersion,
-      engines: defs.engines.map((e) => {
+      // UNICO punto di ordinamento del payload: API, UI e tool MCP leggono
+      // tutti da qui. ordinaEngine riordina in lettura: il fleet.json resta
+      // com'e', mai riscritto.
+      engines: ordinaEngine(defs.engines).map((e) => {
         const out = { ...e, envKeys: Object.keys(e.env || {}).sort() };
         delete out.env;
+        // `standard`: calcolato dal client (CLIENT_ORDER), mai persistito nel
+        // fleet.json. La UI ci divide i selettori in due gruppi senza
+        // duplicare la lista dei client standard.
+        out.standard = isStandardClient(engineClient(e));
+        // Le etichette escono in minuscolo: vale per le label generate dai
+        // client e anche per quelle scritte a mano nel fleet.json, che nel
+        // file restano esattamente come le ha scritte l'operatore.
+        if (typeof out.label === 'string' && out.label) out.label = out.label.toLowerCase();
         if (e.managed) out.managedInfo = describeManaged(e.managed, {
           ...cfg, home, extraModels: extraModelsFrom(defs), engineId: e.id,
           endpointProbe: cfg.endpointProbe || defaultEndpointProbe,
@@ -1541,7 +1562,9 @@ async function createBuiltinFleet(cfg = {}) {
         rc: { type: 'boolean', required: false, default: false },
         managed: {
           type: 'object', requiredFor: 'managed',
-          client: { type: 'enum', values: ['claude', 'codex', 'codex-vl', 'grok', 'vl', 'pi', 'agy', 'kimi', 'shell'] },
+          // Enum allineato a CLIENT_ORDER (standard prima, nell'ordine voluto)
+          // e poi i client noti fuori lista, in ordine stabile.
+          client: { type: 'enum', values: [...CLIENT_ORDER, ...Object.keys(CLIENT_LABELS).filter((c) => !CLIENT_ORDER.includes(c))] },
           provider: { type: 'catalog', source: 'managedCatalog' },
           credentialProfile: { type: 'string', required: false, max: 32 },
           model: { type: 'string', required: false, max: CAPS.MAX_MODEL_VAL_LEN },
@@ -1627,7 +1650,7 @@ async function createBuiltinFleet(cfg = {}) {
   }
 
   function capabilities() {
-    return ['status', 'up', 'down', 'restart', 'engine', 'boot', 'define', 'edit', 'remove', 'import', 'restore', 'schema', 'definitions', 'credentials', 'model-test', 'edit-model'];
+    return ['status', 'up', 'down', 'restart', 'engine', 'boot', 'define', 'edit', 'remove', 'import', 'restore', 'schema', 'definitions', 'credentials', 'model-test', 'model-discovery', 'edit-model'];
   }
 
   // Un engine del documento con un `baseUrl` dichiarato a mano: indirizzo e
@@ -1693,6 +1716,153 @@ async function createBuiltinFleet(cfg = {}) {
     return { engine: profile.id, model: wanted, ...out };
   }
 
+  // Model discovery for the engine editor: the «you can use these» list with
+  // per-field provenance (user > api > public catalog > backup). The engine's
+  // endpoint and credential are resolved on the SAME road the launcher and
+  // testModel use, live in memory only, and never enter the response: the
+  // return shape is curated field by field below and the discovery module's
+  // errors are fixed strings by construction (no key, no URL, ever).
+  const engineModelDiscovery = createModelDiscovery();
+  function backupModelsFor(profile) {
+    if (!profile) return [];
+    // ollama-cloud carries real measured descriptors: context window and
+    // capabilities from the wired catalog, not bare ids.
+    if (profile.provider === 'ollama-cloud') {
+      return ollamaCloudCatalogModels().map((m) => ({
+        id: m.id,
+        ...(Number.isFinite(m.contextWindow) ? { contextWindow: m.contextWindow } : {}),
+        ...(Array.isArray(m.input) && m.input.includes('image') ? { vision: true } : {}),
+        ...(m.reasoning === true ? { reasoning: true } : {}),
+      }));
+    }
+    return (Array.isArray(profile.models) ? profile.models : [])
+      .filter((id) => typeof id === 'string' && id).map((id) => ({ id }));
+  }
+  // Internal-catalog PROPOSALS for the missing-data dialog (lot 3b): what the
+  // wired database knows about a model id, for fields the discovery layers
+  // could NOT fill. These are PROPOSALS only — they never join the merge, so
+  // precedence and discovery stay untouched; the dialog shows them pre-filled
+  // and whatever the operator confirms becomes a user value in fleet.json.
+  // Lookup mirrors the wired ollama rule: exact key first, then the base name
+  // without the ':tag' suffix ('deepseek-v4-flash:0731' -> 'deepseek-v4-flash').
+  function internalModelIndex(profile) {
+    const index = new Map();
+    const add = (id, values) => {
+      if (!id || !values) return;
+      const known = index.get(id) || {};
+      for (const field of ['contextWindow', 'maxTokens']) {
+        if (values[field] !== undefined) known[field] = values[field];
+      }
+      if (Object.keys(known).length) index.set(id, known);
+    };
+    if (profile?.provider === 'ollama-cloud') {
+      for (const m of ollamaCloudCatalogModels()) add(m.id, { contextWindow: m.contextWindow });
+    }
+    if (profile?.provider === 'alibaba-token-plan') {
+      // ALIBABA_PI_MODELS carries the full descriptors (context, output) of
+      // the wired database; the profile's own `models` list is bare ids.
+      for (const m of ALIBABA_PI_MODELS) add(m.id, { contextWindow: m.contextWindow, maxTokens: m.maxTokens });
+    }
+    return index;
+  }
+  function internalValueFor(index, id) {
+    if (!index.size || typeof id !== 'string') return null;
+    if (index.has(id)) return index.get(id);
+    const base = id.replace(/:[^:/]+$/, '');
+    return base !== id && index.has(base) ? index.get(base) : null;
+  }
+  async function discoverEngineModels(engineId, opts = {}) {
+    const id = String(engineId || '');
+    if (!id || id.length > 64 || !/^[A-Za-z0-9._-]+$/.test(id)) {
+      const e = new Error('engine non valido'); e.status = 400; throw e;
+    }
+    const defs = reloadDefs();
+    const declared = findEngine(defs, id);
+    let profile = null;
+    let spec = null;
+    if (declared && declared.managed) {
+      spec = normalizeManagedSpec(declared.managed, { extraModels: extraModelsFrom(defs), engineId: declared.id });
+      profile = spec ? profileFor(spec.client, spec.provider, spec.credentialProfile || '') : null;
+    }
+    if (!profile) {
+      // Not declared (or not resolvable): the catalog profile alone still
+      // knows client, provider, endpoint and credential key.
+      profile = CATALOG.find((p) => p.id === id) || null;
+      spec = profile ? { client: profile.client, provider: profile.provider, ...(profile.credentialProfile ? { credentialProfile: profile.credentialProfile } : {}) } : null;
+    }
+    if (!profile) { const e = new Error(`engine sconosciuto: ${id}`); e.status = 404; throw e; }
+    const plan = engineModelDiscoveryPlan(profile, spec, cfg, home, id);
+    if (!plan) {
+      // No HTTP listing to interrogate (login/native flows, local providers
+      // without a base URL): an honest empty answer, never an error, so the
+      // editor stays usable. The UI hides the section on `supported: false`.
+      return { engine: id, supported: false, source: 'unsupported', models: [] };
+    }
+    // User layer: models declared in fleet.json for this engine (or its
+    // profile) — the values the operator chose, always on top and never
+    // rewritten by discovery.
+    const extraModels = extraModelsFrom(defs);
+    const userModels = [];
+    const seenUser = new Set();
+    for (const key of (id !== profile.id ? [id, profile.id] : [id])) {
+      for (const m of declaredModelsFor(extraModels, key)) {
+        if (seenUser.has(m.id)) continue;
+        seenUser.add(m.id);
+        userModels.push({
+          id: m.id,
+          ...(Number.isFinite(m.contextWindow) ? { contextWindow: m.contextWindow } : {}),
+          ...(Number.isFinite(m.maxTokens) ? { maxTokens: m.maxTokens } : {}),
+          // definitions.js parses `reasoning` as a boolean: `false` is an
+          // explicit operator answer, not an absence. Keep it exactly like
+          // that, or a provider's `true` would override the user layer here
+          // (the merge itself already handles booleans correctly).
+          ...(typeof m.reasoning === 'boolean' ? { reasoning: m.reasoning } : {}),
+        });
+      }
+    }
+    const backupModels = backupModelsFor(profile);
+    const wanted = [...new Set([...userModels, ...backupModels].map((m) => m.id))].slice(0, 32);
+    const result = await engineModelDiscovery.discoverEngine({
+      ...plan,
+      home,
+      userModels, backupModels,
+      ...(wanted.length ? { detailIds: wanted } : {}),
+      publicCatalog: { provider: profile.provider, baseUrl: plan.baseUrl, ...(opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {}) },
+      ...(opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {}),
+      ...(opts.refresh === true ? { noCache: true } : {}),
+    });
+    // Curated response: `plan` (baseUrl, apiKey) stays out; apiModels is
+    // already merged (with provenance) into `models`.
+    // `backupValues` rides along only for fields NO layer could fill: the
+    // internal catalog's proposal for the missing-data dialog. A field any
+    // layer answered carries no proposal — the dialog asks for what nobody
+    // knows, and the operator's confirmation is what turns a proposal into a
+    // user value.
+    const internalIndex = internalModelIndex(profile);
+    const models = result.models.map((m) => {
+      const backupValues = {};
+      for (const field of ['contextWindow', 'maxTokens']) {
+        if (m[field] === undefined) {
+          const known = internalValueFor(internalIndex, m.id);
+          if (known && known[field] !== undefined) backupValues[field] = known[field];
+        }
+      }
+      return Object.keys(backupValues).length ? { ...m, backupValues } : m;
+    });
+    return {
+      engine: id,
+      supported: true,
+      source: result.source,
+      status: result.status,
+      stale: result.stale === true,
+      error: result.error || '',
+      ...(result.fetchedAt ? { fetchedAt: result.fetchedAt } : {}),
+      ...(result.publicCatalog ? { publicCatalog: result.publicCatalog } : {}),
+      models,
+      cap: DISCOVERY_PROPOSAL_CAP,
+    };
+  }
+
   async function close() { await launchBroker.close(); if (leaseManager) leaseManager.close(); }
 
   return {
@@ -1702,7 +1872,7 @@ async function createBuiltinFleet(cfg = {}) {
     defineEngine, editEngine, removeEngine,
     defineCell, editCell, removeCell, importCell, restoreCells, restoreEngines,
     schema, definitions, capabilities,
-    credentialStatus, setLocalCredential, removeLocalCredential, testModel,
+    credentialStatus, setLocalCredential, removeLocalCredential, testModel, discoverEngineModels,
     defineModel, editModel, removeModel, close,
     // Fetta 2b: il lease Live esposto alle route /api/lease, che il bridge
     // MCP delle celle consuma per register/refresh/recovery. Assente se il

package/lib/fleet/managed.js

@@ -10,6 +10,7 @@ const { execFile } = require('node:child_process');
 const { ENV_KEY_RE } = require('./env-key.js');
 const { termuxRuntimePaths } = require('../runtime/env.js');
 const { readCredentialStore, safePrivateDir } = require('./credentials.js');
+const { createModelDiscovery } = require('./model-discovery.js');
 const { argomentiHookCodex, gateVersione, gatePiattaforma, EVENTI_CODEX } = require('./codex-hooks.js');
 
 const OLLAMA_CLOUD_MODELS = Object.freeze([
@@ -446,7 +447,40 @@ const CREDENTIAL_SOURCE_VALUES = Object.freeze([
   'providers-shell', 'keys-file', 'secure-file', 'legacy',
   'compatibility', 'missing', 'unreadable',
 ]);
-const CLIENT_LABELS = Object.freeze({ claude: 'Claude Code', codex: 'Codex', 'codex-vl': 'Codex-VL', grok: 'Grok', vl: 'VL', pi: 'Pi', agy: 'Agy', kimi: 'Kimi Code CLI', shell: 'Shell' });
+// Etichette dei client in minuscolo (decisione operatore 2026-10-17): il nome
+// mostrato e' il client stesso. La normalizzazione vale in uscita (payload,
+// UI, tool MCP); il testo scritto a mano nel fleet.json resta nel file cosi'
+// com'e' e viene mostrato in minuscolo dal punto di uscita del payload.
+const CLIENT_LABELS = Object.freeze({ claude: 'claude', codex: 'codex', 'codex-vl': 'codex-vl', grok: 'grok', vl: 'vl', pi: 'pi', opencode: 'opencode', agy: 'agy', kimi: 'kimi', shell: 'shell' });
+// Client "standard" nell'ordine voluto dall'operatore (2026-10-17). E' LA
+// lista: il campo calcolato `standard` del payload delle definizioni, il rango
+// di ordinaEngine(), l'ordine del seed e l'enum client dello schema derivano
+// tutti da qui. I client fuori lista (vl, kimi, custom...) sono supportati:
+// chiudono l'elenco in ordine stabile, mai buttati via.
+const CLIENT_ORDER = Object.freeze(['claude', 'codex-vl', 'codex', 'pi', 'opencode', 'agy', 'grok', 'shell']);
+// Il client di un engine: managed.client quando c'e' (engine gestiti), primo
+// segmento dell'id altrimenti (claude.hosted -> claude): cosi' i derivati
+// restano attaccati al loro client anche quando nascono come id.
+function engineClient(engine) {
+  if (engine && engine.managed && typeof engine.managed.client === 'string' && engine.managed.client) return engine.managed.client;
+  if (engine && typeof engine.id === 'string' && engine.id) return engine.id.split('.')[0];
+  return '';
+}
+// Ordine di SOLA LETTURA: nessun fleet.json viene riscritto. Rango del client
+// secondo CLIENT_ORDER, a parita' di rango resta l'ordine di inserimento
+// (Array#sort e' stabile da ES2019); i client fuori lista chiudono l'array.
+function ordinaEngine(engines) {
+  if (!Array.isArray(engines)) return engines;
+  const rank = new Map(CLIENT_ORDER.map((client, index) => [client, index]));
+  return [...engines].sort((a, b) => {
+    const ra = rank.get(engineClient(a));
+    const rb = rank.get(engineClient(b));
+    return (ra === undefined ? CLIENT_ORDER.length : ra) - (rb === undefined ? CLIENT_ORDER.length : rb);
+  });
+}
+function isStandardClient(client) {
+  return typeof client === 'string' && CLIENT_ORDER.includes(client);
+}
 const PROVIDER_ID_RE = /^[a-z][a-z0-9_-]{0,31}$/;
 
 function validBaseUrl(value) {
@@ -588,6 +622,23 @@ const CATALOG = Object.freeze([
   { id: 'pi.ollama', client: 'pi', provider: 'ollama', label: 'Ollama local', auth: 'none', protocol: 'openai-completions', piProvider: 'ollama', requiresModel: true, core: true, piExtension: { baseUrl: 'http://127.0.0.1:11434/v1', apiKey: 'ollama' } },
   { id: 'pi.custom', client: 'pi', provider: 'custom', label: 'Custom provider', auth: 'dynamic', protocol: 'openai-responses', protocols: ['openai-responses', 'anthropic-messages', 'openai-completions', 'google-generative-ai'], custom: true, core: true },
 
+  // OpenCode (client nativo, 0.9.75): TUI headless-friendly con gateway proprio
+  // («provider» integrato `opencode`) e login locale (`opencode auth login`).
+  // MISURATO su opencode 1.18.33 (zero credenziali salvate):
+  // i modelli *-free del gateway rispondono ANONYMOUS, quindi la cella parte
+  // anche prima del login; il set completo arriva con l'account. Per questo
+  // auth e' 'login' (delegato, mai chiavi gestite da NexusCrew) e NON c'e'
+  // l'array `models`: l'elenco dei modelli del gateway ruota lato opencode e
+  // un elenco statico qui marcirebbe in silenzio; il modello resta libero
+  // (niente strictModels) e la forma e' `<model>` (prefisso gateway aggiunto
+  // dal launcher) oppure `provider/model` esplicito per chi sa cosa chiede.
+  // I provider A CHIAVE del catalogo (zai, ollama-cloud, openrouter...) NON
+  // entrano in questo client oggi: opencode.jsonc accetta `apiKey` SOLO come
+  // stringa letterale (il riferimento {env:...} e' rifiutato, misurato), e
+  // scrivere una chiave su disco viola la regola del repo (mai segreti nei
+  // file generati). Residuo dichiarato nel referto del lotto.
+  { id: 'opencode.native', client: 'opencode', provider: 'native', label: 'OpenCode account (gateway + local login)', auth: 'login', protocol: 'opencode_native', core: true, notice: 'opencode-native' },
+
   // Agy: client gestito primario (Linux/macOS non-Termux). Auth delegata al
   // login locale del client (nessuno store letto/copiato). Nessun remote-control
   // NexusCrew; permission default 'standard' (unsafe aggiunge --dangerously-skip-
@@ -744,10 +795,13 @@ function normalizeManagedSpec(value, { extraModels = null, engineId = null, onIs
 function defaultDefinitions() {
   return {
     schemaVersion: 1,
-    engines: CATALOG.filter((p) => p.default).map((p) => ({
+    // Il seed segue CLIENT_ORDER: una flotta nuova nasce gia' nell'ordine che
+    // il payload mostra (ordinaEngine), senza dover contare sull'ordine con
+    // cui le voci default sono scritte nel CATALOG.
+    engines: ordinaEngine(CATALOG.filter((p) => p.default).map((p) => ({
       id: p.id, label: CLIENT_LABELS[p.client], rc: !!p.rc,
       managed: { client: p.client, provider: p.provider, model: p.model || '', permissionPolicy: p.client === 'claude' ? 'unsafe' : 'standard' },
-    })),
+    }))),
     cells: [],
   };
 }
@@ -1242,6 +1296,50 @@ function applyStoreNeutralization(env, spec, profile) {
 }
 
 let ollamaCache = { at: 0, models: [] };
+// Shared model-discovery instance: per-engine HTTP collectors + disk cache.
+// The engine's key is resolved HERE (credentialSources/credential, the same
+// path the launcher uses) and handed to the module in memory only.
+const sharedModelDiscovery = createModelDiscovery();
+// Map a managed profile (+ normalized spec) to its model-discovery plan:
+// collector kind, endpoint base URL and the engine's own credential. This is
+// the per-engine wiring point for the discovery lots: same endpoint and same
+// key the launcher would use, never a parallel configuration. Returns null
+// when the profile has no HTTP listing to interrogate (login/native/local
+// runtimes without an HTTP endpoint, or a custom base URL that is not set).
+// `engineId` is the DECLARED engine id and becomes the cache key: two custom
+// engines of the same client resolve to one shared profile, and keying their
+// model cache by profile id would hand the second engine the first one's
+// listing without ever interrogating its endpoint. Without a declared id
+// (catalog engines) the profile id IS the engine id.
+function engineModelDiscoveryPlan(profile, spec, cfg, home, engineId) {
+  if (!profile) return null;
+  const specBase = spec && typeof spec.baseUrl === 'string' && /^https?:\/\//i.test(spec.baseUrl) ? spec.baseUrl : '';
+  const profileBase = typeof profile.endpoint === 'string' && /^https?:\/\//i.test(profile.endpoint) ? profile.endpoint : '';
+  let collector = null;
+  let baseUrl = '';
+  if (profile.provider === 'ollama' || profile.provider === 'ollama-cloud') {
+    collector = 'ollama';
+    baseUrl = specBase || profileBase || 'http://127.0.0.1:11434';
+  } else if (profile.provider === 'lmstudio') {
+    collector = 'lmstudio';
+    baseUrl = specBase || 'http://127.0.0.1:1234';
+  } else if (profile.protocol === 'anthropic_messages') {
+    collector = 'anthropic';
+    baseUrl = specBase || profileBase;
+  } else if (profile.protocol === 'openai_responses' || profile.protocol === 'openai_completions') {
+    collector = 'openai-compat';
+    baseUrl = specBase || profileBase;
+  } else {
+    return null;
+  }
+  if (!baseUrl) return null;
+  const plan = { engine: engineId || profile.id, collector, baseUrl };
+  try {
+    const cred = credential(profile, spec || {}, cfg, home);
+    if (cred && cred.value) plan.apiKey = cred.value;
+  } catch (_) { /* discovery without a key: key-less local endpoints still list */ }
+  return plan;
+}
 async function discoverOllamaModels(opts = {}) {
   const now = Date.now(); const ttl = opts.ttlMs === undefined ? 30000 : opts.ttlMs;
   if (!opts.noCache && ollamaCache.models.length && now - ollamaCache.at < ttl) return [...ollamaCache.models];
@@ -1254,13 +1352,22 @@ async function discoverOllamaModels(opts = {}) {
       || sources.local.OLLAMA_API_KEY || sources.shell.OLLAMA_API_KEY || sources.keys.OLLAMA_API_KEY
       || sources.legacy.OLLAMA_API_KEY;
     if (!apiKey) throw new Error('OLLAMA_API_KEY missing');
-    const response = await fetchImpl('https://ollama.com/api/tags', { headers: { authorization: `Bearer ${apiKey}` }, signal: AbortSignal.timeout?.(2500) });
-    if (!response.ok) throw new Error(`HTTP ${response.status}`);
-    const body = await response.json(); const available = new Set();
-    for (const item of Array.isArray(body.models) ? body.models : []) {
-      const name = typeof item?.name === 'string' ? item.name : '';
-      if (/^[A-Za-z0-9._-]+(?::[A-Za-z0-9._-]+)?$/.test(name) && name.length <= 128) available.add(name);
-    }
+    // Generalized on the model-discovery module (ollama collector): the HTTP
+    // call, the sanitized errors and the last-good-on-disk cache live there.
+    // The EXTERNAL behavior stays: the wired list filtered by what the API
+    // declares live, and the full wired list when nothing is known.
+    const layer = await sharedModelDiscovery.fetchEngineModels({
+      engine: 'ollama-cloud', collector: 'ollama', baseUrl: 'https://ollama.com',
+      apiKey, home, fetchImpl, timeoutMs: 2500, ttlMs: ttl, ...(opts.noCache ? { noCache: true } : {}),
+    });
+    // IL CONTRATTO ESTERNO NON CAMBIA (mandato L1: generalizzare «senza
+    // cambiarne il comportamento esterno»). Un valore buono di ieri servito al
+    // posto dell'API non e' una risposta di oggi: vale come "non si sa niente",
+    // e allora si torna alla shortlist cablata intera. Solo `api` (o un valore
+    // fresco, non stantio) dice cosa e' vivo adesso.
+    const conosciuto = layer.status === 'api' || (layer.status === 'cache' && layer.stale === false);
+    if (!conosciuto) throw new Error(layer.error || 'ollama-cloud discovery unavailable');
+    const available = new Set(layer.apiModels.map((m) => m.id));
     const models = OLLAMA_CLOUD_MODELS.filter((name) => available.has(name));
     if (!models.length) throw new Error('no cloud models');
     ollamaCache = { at: now, models }; return [...models];
@@ -2422,6 +2529,9 @@ function resolveManagedEngine(engine, cell, cfg = {}) {
     // autonomous, nessuna domanda) NON e' mappato: il contratto NexusCrew
     // distingue solo standard/unsafe e il default resta interattivo.
     if (spec.client === 'kimi') args.push('--yolo');
+    // OpenCode: unsafe -> --auto (flag reale di `opencode --help` 1.18.33:
+    // «auto-approve permissions that are not explicitly denied (dangerous!)»).
+    if (spec.client === 'opencode') args.push('--auto');
   }
   let shellOneShot = false;
   if (spec.client === 'shell') {
@@ -2772,6 +2882,26 @@ function resolveManagedEngine(engine, cell, cfg = {}) {
     // dal push generico qui sotto come ultimo argomento. Senza prompt parte il
     // TUI interattivo nella cwd della cella.
     if (model) args.push('--model', model);
+  } else if (spec.client === 'opencode') {
+    // OpenCode TUI (0.9.75, misurato su 1.18.33): auth delegata al login/locale
+    // del client (gateway `opencode`, free tier anche senza credenziali) —
+    // niente env provider, niente credenziali su argv, NE' config scritta da
+    // NexusCrew: MCP e provider custom restano nell'opencode.jsonc dell'utente
+    // (o nel file per-cella che l'operatore passa con OPENCODE_CONFIG, che
+    // qui non si compone). `--standalone` NON esiste in 1.18.33: ogni
+    // invocazione gira col proprio server e muore con essa (misurato con ps
+    // dopo la chiusura), quindi il TUI parte nudo — quel flag sarebbe servito
+    // per un server di background condiviso per utente che questa versione non
+    // avvia. Il modello viaggia come `-m provider/model`: un id senza `/`
+    // e' del gateway integrato (`opencode/<model>`), uno gia' prefissato
+    // passa tale e quale (l'operatore che ha config sue sa cosa chiede).
+    // Il prompt di cella va su `--prompt` (precompila la casella di input,
+    // pattern di agy --prompt-interactive): il posizionale e' il PATH di
+    // progetto, mai testo. Niente send-keys: il classifier di readiness
+    // (prompt-delivery) copre kimi/claude/vl e un marker nuovo va misurato
+    // sul TUI vivo prima di essere fidato — residuo dichiarato.
+    if (model) args.push('-m', model.includes('/') ? model : `opencode/${model}`);
+    if (cell?.prompt) args.push('--prompt');
   } else if (spec.client === 'vl') {
     // VL/Vivling runtime TUI: auth is handled by the runtime in every variant
     // (config.toml / VL_API_KEY by name via envPassthrough), never
@@ -3014,8 +3144,8 @@ module.exports = {
   ALIBABA_CODEX_MODELS, ALIBABA_TOKEN_PLAN_CONTEXT, ALIBABA_PI_MODELS,
   OPENCODE_GO_MESSAGES_MODELS, OPENCODE_GO_RESPONSES_MODELS, OPENCODE_GO_CHAT_MODELS, OPENCODE_GO_LIMITS,
   OPENCODE_GO_ANTHROPIC_ROOT, OPENCODE_GO_API_BASE,
-  CLIENT_LABELS, normalizeManagedSpec, profileFor,
-  defaultDefinitions, defaultShellEngine, defaultAgyEngine, defaultKimiEngine, defaultGrokEngine, defaultVlEngine, describeManaged, describeCatalogCredential, discoverOllamaModels, resolveManagedEngine, needsExplicitNode,
+  CLIENT_LABELS, CLIENT_ORDER, engineClient, ordinaEngine, isStandardClient, normalizeManagedSpec, profileFor,
+  defaultDefinitions, defaultShellEngine, defaultAgyEngine, defaultKimiEngine, defaultGrokEngine, defaultVlEngine, describeManaged, describeCatalogCredential, discoverOllamaModels, engineModelDiscoveryPlan, resolveManagedEngine, needsExplicitNode,
   discoverPiModels, EXTERNAL_DISCOVERY_TIMEOUT_MS, parseEnvFile, parseProviderShellFile, findBinary, publicCatalog, writePiProviderExtension, customCatalogFor,
   codexSurfaceNames, writeCellCodexProfile,
   writeVlCellPrompt, vlSystemAppendGate,