@oar-sh/oar 0.9.23 → 0.9.25

package/server/services/media-index-service.mjs

@@ -0,0 +1,221 @@
+import fs from 'node:fs';
+
+import { createMediaRepository } from '../repositories/media-repository.mjs';
+import { extractMediaFromMessage } from './media-extract.mjs';
+
+// Fills the media gallery index (migration 0039) from its queue. The
+// triggers on `messages` only queue ids; this service reads each queued
+// message, extracts its media and replaces the message's rows, a batch per
+// transaction.
+//
+// Draining is synchronous (better-sqlite3), so a batch never interleaves with
+// a turn's writes; a message written after it was read is re-queued (its seq
+// grows) and indexed by a later batch.
+//
+// Scheduling: a background loop runs only while the queue has rows (the
+// backfill after the migration, or what piled up since the last gallery
+// request) and stops when it is empty, so an idle relay runs no timer for
+// the gallery. Every gallery request first drains a bounded number of
+// messages itself (`drainForRequest`) so new pictures show at once, and
+// restarts the loop when rows are left.
+
+export const MEDIA_INDEX_BATCH_SIZE = 10;
+export const MEDIA_INDEX_REQUEST_DRAIN = 200;
+// Time budgets per drain, so indexing never holds the event loop for long:
+// the background loop indexes for ~20 ms every 500 ms in batches of ten
+// messages (a slice ends with its batch's commit), a gallery request up to
+// 100 ms; the rest waits for the loop.
+export const MEDIA_INDEX_LOOP_BUDGET_MS = 20;
+export const MEDIA_INDEX_REQUEST_BUDGET_MS = 100;
+export const MEDIA_INDEX_INTERVAL_MS = 500;
+// A message body above this is read in a slice of its own.
+export const MEDIA_INDEX_LARGE_BODY_BYTES = 1024 * 1024;
+
+export function createMediaIndexService({
+  db,
+  repository = createMediaRepository(db),
+  extract = extractMediaFromMessage,
+  platform = process.platform,
+  batchSize = MEDIA_INDEX_BATCH_SIZE,
+  intervalMs = MEDIA_INDEX_INTERVAL_MS,
+  setTimer = setTimeout,
+  clearTimer = clearTimeout,
+  logger = console,
+  now = () => performance.now(),
+} = {}) {
+  let timer = null;
+  let stopped = true;
+  let warnedExtractError = false;
+
+  function indexRow(row) {
+    let items = [];
+    try {
+      items = extract({
+        role: row.role,
+        text: row.text,
+        attachments: row.attachments,
+        conversationId: row.conversationId,
+        messageId: row.messageId,
+        workspaceRoot: row.workspaceRoot || '',
+        platform,
+      });
+    } catch (error) {
+      // A message the extractor cannot read gets no media; its queue row
+      // still goes, so it cannot block the queue.
+      if (!warnedExtractError) {
+        warnedExtractError = true;
+        logger?.warn?.(`[media-index] could not read a message; it gets no media: ${error?.message || error}`);
+      }
+      items = [];
+    }
+    return repository.replaceMessageItems(row, items);
+  }
+
+  /** Indexes up to `maxMessages` queued messages now, within `budgetMs`; says how many are left. */
+  function drain(options = {}) {
+    const result = drainSlice(options);
+    return { ...result, pending: repository.hasPending() ? repository.pendingCount() : 0 };
+  }
+
+  function drainSlice({ maxMessages = batchSize, budgetMs = Infinity } = {}) {
+    let indexed = 0;
+    let items = 0;
+    if (!repository.available) return { indexed, items };
+    const started = now();
+    let outOfTime = false;
+    while (indexed < maxMessages && !outOfTime) {
+      const rows = repository.nextQueueBatch(Math.min(batchSize, maxMessages - indexed));
+      if (!rows.length) break;
+      // One commit per batch: a commit per message costs more than the indexing.
+      repository.inTransaction(() => {
+        for (const entry of rows) {
+          // A large body (a pasted data image) is read only at the start of a
+          // slice, so reading it never adds to work already done in the slice.
+          if (indexed > 0 && Number(entry.bytes) > MEDIA_INDEX_LARGE_BODY_BYTES) {
+            outOfTime = true;
+            break;
+          }
+          const row = repository.loadQueuedMessage(entry);
+          if (row) items += indexRow(row);
+          indexed += 1;
+          if (now() - started >= budgetMs) {
+            outOfTime = true;
+            break;
+          }
+        }
+      });
+      if (rows.length < batchSize) break;
+    }
+    return { indexed, items };
+  }
+
+  function schedule() {
+    if (stopped || timer || !repository.available) return;
+    timer = setTimer(tick, intervalMs);
+    timer?.unref?.();
+  }
+
+  function tick() {
+    timer = null;
+    if (stopped) return;
+    let more = false;
+    try {
+      drainSlice({ maxMessages: Infinity, budgetMs: MEDIA_INDEX_LOOP_BUDGET_MS });
+      more = repository.hasPending();
+    } catch (error) {
+      logger?.warn?.(`[media-index] indexing failed; retrying later: ${error?.message || error}`);
+      more = true;
+    }
+    if (more) schedule();
+  }
+
+  return {
+    get available() {
+      return repository.available;
+    },
+    drain,
+    /** Before answering a gallery request: index what is new, keep the rest for the loop. */
+    drainForRequest() {
+      const result = drain({ maxMessages: MEDIA_INDEX_REQUEST_DRAIN, budgetMs: MEDIA_INDEX_REQUEST_BUDGET_MS });
+      if (result.pending > 0) schedule();
+      return result;
+    },
+    start() {
+      if (!repository.available) return;
+      stopped = false;
+      try {
+        repository.removeOrphanQueueRows();
+      } catch (error) {
+        logger?.warn?.(`[media-index] could not clean the queue: ${error?.message || error}`);
+      }
+      if (repository.hasPending()) schedule();
+    },
+    stop() {
+      stopped = true;
+      if (timer) clearTimer(timer);
+      timer = null;
+    },
+    pendingCount: () => repository.pendingCount(),
+    isScheduled: () => timer !== null,
+  };
+}
+
+// --- whether a file is still there -------------------------------------------
+
+export const FILE_PRESENCE_TTL_MS = 60_000;
+export const FILE_PRESENCE_MAX_ENTRIES = 5000;
+export const FILE_PRESENCE_TIMEOUT_MS = 1500;
+
+/**
+ * A short-lived cache of "is this a regular file" answers, for hiding gallery
+ * items whose file was deleted or moved. Async stat with a timeout: a mapped
+ * network drive that is offline must not hold a gallery page. A stat that
+ * times out counts as missing for this page and is not cached.
+ */
+export function createFilePresenceCache({
+  stat = (filePath) => fs.promises.stat(filePath),
+  ttlMs = FILE_PRESENCE_TTL_MS,
+  maxEntries = FILE_PRESENCE_MAX_ENTRIES,
+  timeoutMs = FILE_PRESENCE_TIMEOUT_MS,
+  now = () => Date.now(),
+} = {}) {
+  const entries = new Map();
+
+  function remember(filePath, present) {
+    entries.delete(filePath);
+    entries.set(filePath, { present, at: now() });
+    while (entries.size > maxEntries) {
+      entries.delete(entries.keys().next().value);
+    }
+  }
+
+  async function isFile(filePath) {
+    const key = String(filePath || '');
+    if (!key) return false;
+    const cached = entries.get(key);
+    if (cached && now() - cached.at < ttlMs) return cached.present;
+    let timeoutHandle = null;
+    const timeout = new Promise((resolve) => {
+      timeoutHandle = setTimeout(() => resolve('timeout'), timeoutMs);
+      timeoutHandle?.unref?.();
+    });
+    try {
+      const result = await Promise.race([
+        Promise.resolve().then(() => stat(key)).then((info) => info.isFile(), () => false),
+        timeout,
+      ]);
+      if (result === 'timeout') return false;
+      remember(key, result === true);
+      return result === true;
+    } finally {
+      clearTimeout(timeoutHandle);
+    }
+  }
+
+  return {
+    isFile,
+    forget: (filePath) => entries.delete(String(filePath || '')),
+    clear: () => entries.clear(),
+    size: () => entries.size,
+  };
+}

package/server/services/model-refresh-scheduler.mjs

@@ -0,0 +1,153 @@
+'use strict';
+
+// The background "Check for new models" (Settings → General → Models).
+//
+// A minute after boot, then every quarter of an hour, the scheduler asks
+// which providers are due and refreshes those through the same helper as the
+// Select Models Refresh button (provider-model-refresh.mjs), with reason
+// `background`. A provider is due when the check is on, the provider is not
+// left out, it is enabled and set up, its last successful refresh (by
+// anything: the button, a save, a login, the boot) is at least the interval
+// old, and its last failure at least an hour old. A provider never refreshed
+// is due at the first tick, which is how an overdue provider is checked after
+// boot. Time and timers are injected so a test can drive it with a fake clock.
+
+import {
+  MODEL_REFRESH_FAILURE_RETRY_MS,
+  MODEL_REFRESH_FIRST_TICK_MS,
+  MODEL_REFRESH_PROVIDERS,
+  MODEL_REFRESH_TICK_MS,
+} from '../../shared/model-refresh-schedule.mjs';
+import { modelRefreshErrorSummary } from './provider-model-refresh.mjs';
+
+const HOUR_MS = 60 * 60 * 1000;
+
+function timeOf(value) {
+  const ms = Date.parse(String(value || ''));
+  return Number.isFinite(ms) ? ms : null;
+}
+
+function notInFuture(ms, nowMs) {
+  return ms !== null && ms > nowMs ? null : ms;
+}
+
+/**
+ * The providers due at `nowMs`, in the canonical order. `settings` is
+ * `{ auto, intervalHours, excluded }`, `last` the ledger's entries, `table`
+ * the provider table (buildProviderRefreshTable).
+ */
+export function dueModelRefreshProviders({ settings = {}, last = {}, table = {}, nowMs = Date.now() } = {}) {
+  if (settings.auto === false) return [];
+  const intervalMs = Math.max(1, Number(settings.intervalHours) || 24) * HOUR_MS;
+  const excluded = new Set(Array.isArray(settings.excluded) ? settings.excluded : []);
+  const due = [];
+  for (const { id } of MODEL_REFRESH_PROVIDERS) {
+    const entry = table[id];
+    if (!entry || excluded.has(id) || typeof entry.refresh !== 'function') continue;
+    let setUp = false;
+    try {
+      setUp = entry.isSetUp?.() === true;
+    } catch {
+      setUp = false;
+    }
+    if (!setUp) continue;
+    // A stamp later than now (a clock set back, a hand edit) cannot be
+    // trusted: the provider is due rather than skipped until then.
+    const lastOk = notInFuture(timeOf(last[id]?.lastOkAt), nowMs);
+    const lastFailure = notInFuture(timeOf(last[id]?.lastFailureAt), nowMs);
+    if (lastOk !== null && nowMs - lastOk < intervalMs) continue;
+    if (lastFailure !== null && nowMs - lastFailure < MODEL_REFRESH_FAILURE_RETRY_MS) continue;
+    due.push(id);
+  }
+  return due;
+}
+
+export function createModelRefreshScheduler({
+  // () => { auto, intervalHours, excluded }
+  getSettings = () => ({ auto: true, intervalHours: 24, excluded: [] }),
+  // () => { <provider>: { lastOkAt, lastFailureAt } } (the ledger)
+  getLast = () => ({}),
+  // () => the provider table (buildProviderRefreshTable)
+  getTable = () => ({}),
+  // ({ providers, reason }) => Promise<{ results, changed }>
+  refreshProviders = async () => ({ results: {}, changed: false }),
+  now = () => Date.now(),
+  setTimeoutFn = setTimeout,
+  clearTimeoutFn = clearTimeout,
+  firstTickMs = MODEL_REFRESH_FIRST_TICK_MS,
+  tickMs = MODEL_REFRESH_TICK_MS,
+  logger = console,
+} = {}) {
+  let timer = null;
+  let running = null;
+  let disposed = false;
+  // Set by the routes layer, which owns the models_updated payload.
+  let onModelsChanged = () => {};
+
+  function schedule(delayMs) {
+    if (disposed) return;
+    if (timer) clearTimeoutFn(timer);
+    timer = setTimeoutFn(() => {
+      timer = null;
+      void tick().finally(() => schedule(tickMs));
+    }, Math.max(0, Number(delayMs) || 0));
+    timer?.unref?.();
+  }
+
+  /** One look: refreshes what is due. Never rejects; one run at a time. */
+  async function tick() {
+    if (disposed) return { providers: [], results: {}, changed: false };
+    if (running) return running;
+    // Cleared in a .finally of its own: a run with nothing due settles
+    // before the assignment would otherwise have happened.
+    running = (async () => {
+      let providers = [];
+      try {
+        providers = dueModelRefreshProviders({ settings: getSettings(), last: getLast(), table: getTable(), nowMs: now() });
+        if (!providers.length) return { providers, results: {}, changed: false };
+        logger.log?.(`[model-refresh] background model refresh: ${providers.join(', ')}`);
+        const { results = {}, changed = false } = await refreshProviders({ providers, reason: 'background' }) || {};
+        const failed = providers.filter((id) => results[id] && results[id].ok !== true && results[id].skipped !== true);
+        if (failed.length) {
+          // The provider and the kind of failure only: an answer's body may
+          // echo what was sent with the request.
+          logger.warn?.(`[model-refresh] background model refresh failed for ${failed.map((id) => `${id} (${modelRefreshErrorSummary(results[id].error)})`).join(', ')}`);
+        }
+        if (changed && !disposed) {
+          try {
+            onModelsChanged();
+          } catch (error) {
+            logger.warn?.(`[model-refresh] models-changed listener failed: ${error?.message || error}`);
+          }
+        }
+        return { providers, results, changed };
+      } catch (error) {
+        logger.warn?.(`[model-refresh] background model refresh failed: ${modelRefreshErrorSummary(error?.message || error)}`);
+        return { providers, results: {}, changed: false };
+      }
+    })().finally(() => {
+      running = null;
+    });
+    return running;
+  }
+
+  function start() {
+    if (disposed || timer) return;
+    schedule(firstTickMs);
+  }
+
+  function setOnModelsChanged(listener) {
+    onModelsChanged = typeof listener === 'function' ? listener : () => {};
+  }
+
+  async function dispose() {
+    disposed = true;
+    if (timer) {
+      clearTimeoutFn(timer);
+      timer = null;
+    }
+    try { await running; } catch { /* tick() never rejects */ }
+  }
+
+  return { start, tick, dispose, setOnModelsChanged, isStarted: () => timer !== null };
+}

package/server/services/model-variant-catalog-service.mjs

@@ -28,7 +28,13 @@
 //   * curated ids only seed an EMPTY catalog; once an authoritative snapshot
 //     (a running engine or the server-side discovery) has listed the models,
 //     anything absent from it is marked `unavailable` (enabled rows stay
-//     listed so a picker can show them greyed; disabled ones are pruned).
+//     listed so a picker can show them greyed; disabled ones are pruned);
+//   * with a model map (`copilot_model_state`, provider-model-state.mjs) a row
+//     seen for the first time starts as the user would expect: off when the
+//     user turned that row off before (a pruned row is remembered), like the
+//     model's other rows for a new effort level, and as the "Turn new models
+//     on automatically" switch says for a whole new model, which is also
+//     flagged new. Without one (tests, older wiring) new rows start off.
 import { humanizeModelLabel } from '../public/app/model-selector-options.mjs';
 import { latestModelCatalogRefresh } from '../../shared/model-catalog-freshness.mjs';
 import {
@@ -39,6 +45,7 @@ import {
 import { KNOWN_REASONING_EFFORTS, MODEL_PICKER_CATEGORIES } from '../../shared/model-descriptors.mjs';
 import { copilotCatalogIndexByModel, inferCopilotVendor } from '../../shared/copilot-model-order.mjs';
 import { selectModelIdsForVariantRefresh } from '../../shared/model-refresh.mjs';
+import { decideNewCopilotVariant, migrateCopilotModelState } from './provider-model-state.mjs';
 
 export const SUPPORTED_REASONING_EFFORTS = [...KNOWN_REASONING_EFFORTS];
 /**
@@ -471,6 +478,14 @@ export function createModelVariantCatalogService({
   autoModelSentinel = 'auto',
   // (args: string[]) => Promise<string>; the `copilot help` text fallback.
   runCopilotCliCommand = async () => '',
+  // { readCopilot(), writeCopilot(state) } (provider-model-state.mjs); null
+  // keeps the old rule: every new row starts off.
+  modelStateStore = null,
+  // (baseModelIds, on) — whole new models were added (the toast).
+  onNewModels = () => {},
+  // ({ source }) — a snapshot that read the runtime's real list arrived
+  // (counts as a Copilot model refresh).
+  onAuthoritativeSnapshot = () => {},
 } = {}) {
   const DEFAULT_MODEL = String(defaultModel || 'gpt-5.4-mini').trim() || 'gpt-5.4-mini';
   const AUTO_MODEL_SENTINEL = String(autoModelSentinel || 'auto');
@@ -511,6 +526,56 @@ export function createModelVariantCatalogService({
     return modelSelectorSql.listEnabledVariants.all().map((row) => normalizeModelVariantRow(row)).sort(compareVariantRows);
   }
 
+  /**
+   * The Copilot model map, built from the table the first time (every model
+   * there known, every disabled row remembered as off). Null without a store.
+   */
+  function loadCopilotModelState(rows = null) {
+    if (!modelStateStore) return null;
+    try {
+      const stored = modelStateStore.readCopilot();
+      if (stored) return stored;
+      const migrated = migrateCopilotModelState(rows || listModelVariantRows());
+      modelStateStore.writeCopilot(migrated);
+      return migrated;
+    } catch {
+      return null;
+    }
+  }
+
+  function saveCopilotModelState(state) {
+    try {
+      modelStateStore?.writeCopilot?.(state);
+    } catch {
+      /* the rows are written; the map catches up on the next change */
+    }
+  }
+
+  /** `{ autoEnableNew, unseen }` for Select Models and the menu dot. */
+  function getCopilotModelState() {
+    const state = loadCopilotModelState();
+    const bases = new Set(listModelVariantRows().map((row) => row.baseModelId));
+    return {
+      autoEnableNew: state ? state.autoEnableNew : false,
+      unseen: state ? state.unseen.filter((baseModelId) => bases.has(baseModelId)) : [],
+    };
+  }
+
+  function setCopilotAutoEnableNew(value) {
+    const state = loadCopilotModelState();
+    if (!state || typeof value !== 'boolean') return getCopilotModelState();
+    saveCopilotModelState({ ...state, autoEnableNew: value });
+    return getCopilotModelState();
+  }
+
+  /** Clears the "New" flags; true when one was set. */
+  function markCopilotModelsSeen() {
+    const state = loadCopilotModelState();
+    if (!state || !state.unseen.length) return false;
+    saveCopilotModelState({ ...state, unseen: [] });
+    return true;
+  }
+
   /** Stored metadata per base model (first row wins; all rows carry the same). */
   function storedMetadataByModel(rows = listModelVariantRows()) {
     const byModel = {};
@@ -772,12 +837,21 @@ export function createModelVariantCatalogService({
     const existingEnabled = new Map(existingRows.map((row) => [row.variantId, row.enabled ? 1 : 0]));
     const incomingIds = new Set(normalizedEntries.map((entry) => entry.variantId));
     const incomingBaseIds = new Set(normalizedEntries.map((entry) => entry.baseModelId));
+    const enabledBaseIds = new Set(existingRows.filter((row) => row.enabled).map((row) => row.baseModelId));
+    const modelState = loadCopilotModelState(existingRows);
+    const newBaseIds = new Set();
+    const prunedDisabledIds = new Set();
     const nowIso = new Date().toISOString();
     const tx = db.transaction(() => {
       for (const entry of normalizedEntries) {
-        const enabled = preserveEnabled && existingEnabled.has(entry.variantId)
-          ? existingEnabled.get(entry.variantId)
-          : (entry.enabled ? 1 : 0);
+        let enabled = entry.enabled ? 1 : 0;
+        if (preserveEnabled && existingEnabled.has(entry.variantId)) {
+          enabled = existingEnabled.get(entry.variantId);
+        } else if (modelState && !existingEnabled.has(entry.variantId)) {
+          const decision = decideNewCopilotVariant(modelState, entry, { siblingEnabled: enabledBaseIds.has(entry.baseModelId) });
+          enabled = decision.enabled ? 1 : 0;
+          if (decision.newModel) newBaseIds.add(entry.baseModelId);
+        }
         runVariantUpsert(entry, enabled, nowIso);
       }
       const orphanedEnabledBases = new Set();
@@ -788,6 +862,7 @@ export function createModelVariantCatalogService({
             // The runtime told us this model's exact levels; a row for a
             // level it does not offer is stale, not "unavailable".
             if (row.enabled) orphanedEnabledBases.add(row.baseModelId);
+            else prunedDisabledIds.add(row.variantId);
             modelSelectorSql.deleteVariant.run(row.variantId);
           } else {
             runVariantUpsert({ ...row, releaseStatus: 'unavailable' }, row.enabled, nowIso);
@@ -801,6 +876,8 @@ export function createModelVariantCatalogService({
         }
         // Variants that are both disabled and fully absent from the incoming
         // base set are no longer relevant; prune them so they do not linger.
+        // The model map remembers them as off for when they come back.
+        prunedDisabledIds.add(row.variantId);
         modelSelectorSql.deleteVariant.run(row.variantId);
       }
       // A selection must not silently vanish because its effort level did:
@@ -822,6 +899,21 @@ export function createModelVariantCatalogService({
       }
     });
     tx();
+    if (modelState) {
+      saveCopilotModelState({
+        ...modelState,
+        knownModels: [...new Set([...modelState.knownModels, ...incomingBaseIds])],
+        disabledVariants: [...new Set([...modelState.disabledVariants, ...prunedDisabledIds])],
+        unseen: [...new Set([...modelState.unseen, ...newBaseIds])],
+      });
+      if (newBaseIds.size) {
+        try {
+          onNewModels([...newBaseIds], modelState.autoEnableNew);
+        } catch {
+          /* the toast is best-effort */
+        }
+      }
+    }
     recomputeSortOrder();
     return getModelVariantSelectorState();
   }
@@ -839,23 +931,49 @@ export function createModelVariantCatalogService({
     return reconcileModelVariantRows(entries, { source, error, preserveEnabled, absentBasePolicy: 'reconcile', knownEffortBases });
   }
 
-  function setEnabledModelVariants(variantIds = []) {
+  /**
+   * The Select Models save. With `shownVariantIds` (the rows the browser
+   * drew) only those rows are set, on when listed in `variantIds`; every
+   * other row keeps its state, so a row a refresh added after the modal was
+   * drawn is not turned off. Without it (an older page) the list is the whole
+   * enabled set, as before.
+   */
+  function setEnabledModelVariants(variantIds = [], { shownVariantIds = null } = {}) {
     if (!modelSelectorSql?.disableAllVariants?.run || !modelSelectorSql?.enableVariant?.run) {
       return getModelVariantSelectorState();
     }
     const nextEnabled = new Set(
       Array.isArray(variantIds) ? variantIds.map((value) => String(value || '').trim()).filter(Boolean) : [],
     );
+    // Turning every row off would leave the pickers with the fallback model
+    // only; the route refuses it, and so does this.
+    if (!nextEnabled.size) return getModelVariantSelectorState();
     const existingRows = listModelVariantRows();
+    const shown = Array.isArray(shownVariantIds)
+      ? new Set(shownVariantIds.map((value) => String(value || '').trim()).filter(Boolean))
+      : null;
+    const touchedRows = shown ? existingRows.filter((row) => shown.has(row.variantId)) : existingRows;
+    const modelState = loadCopilotModelState(existingRows);
     const nowIso = new Date().toISOString();
     const tx = db.transaction(() => {
-      modelSelectorSql.disableAllVariants.run(nowIso);
-      for (const row of existingRows) {
-        if (!nextEnabled.has(row.variantId)) continue;
-        modelSelectorSql.enableVariant.run(nowIso, row.variantId);
+      if (!shown) modelSelectorSql.disableAllVariants.run(nowIso);
+      for (const row of touchedRows) {
+        if (nextEnabled.has(row.variantId)) modelSelectorSql.enableVariant.run(nowIso, row.variantId);
+        else if (shown) modelSelectorSql.disableVariant.run(nowIso, row.variantId);
       }
     });
     tx();
+    if (modelState) {
+      // A row turned on is forgotten as off; a row turned off is remembered.
+      const touchedIds = new Set(touchedRows.map((row) => row.variantId));
+      saveCopilotModelState({
+        ...modelState,
+        disabledVariants: [...new Set([
+          ...modelState.disabledVariants.filter((variantId) => !(touchedIds.has(variantId) && nextEnabled.has(variantId))),
+          ...touchedRows.filter((row) => !nextEnabled.has(row.variantId)).map((row) => row.variantId),
+        ])],
+      });
+    }
     return getModelVariantSelectorState();
   }
 
@@ -897,6 +1015,13 @@ export function createModelVariantCatalogService({
       refreshedAt: receivedMetadata ? new Date().toISOString() : modelCatalog.refreshedAt,
       error: snapshot.error ? String(snapshot.error).trim().slice(0, 300) : null,
     };
+    if (authoritative) {
+      try {
+        onAuthoritativeSnapshot({ source });
+      } catch {
+        /* the refresh clock is best-effort */
+      }
+    }
     if (modelSelectorSql?.upsertVariant?.run) {
       const existingRows = listModelVariantRows();
       const stored = storedMetadataByModel(existingRows);
@@ -1074,6 +1199,7 @@ export function createModelVariantCatalogService({
       updateSortOrderForBase: db.prepare(`UPDATE model_variants SET sort_order = ? WHERE base_model_id = ?`),
       disableAllVariants: db.prepare(`UPDATE model_variants SET enabled = 0, updated_at = ?`),
       enableVariant: db.prepare(`UPDATE model_variants SET enabled = 1, updated_at = ? WHERE variant_id = ?`),
+      disableVariant: db.prepare(`UPDATE model_variants SET enabled = 0, updated_at = ? WHERE variant_id = ?`),
       deleteVariant: db.prepare(`DELETE FROM model_variants WHERE variant_id = ?`),
       getSelectorState: db.prepare(`SELECT source, refreshed_at, error, updated_at FROM model_selector_state WHERE id = 1 LIMIT 1`),
       upsertSelectorState: db.prepare(`
@@ -1153,6 +1279,9 @@ export function createModelVariantCatalogService({
     }
     normalizeLegacyVariantIdsTx();
     recomputeSortOrder();
+    // The model map of an install from before it is built from the table as
+    // it stands now, before any snapshot adds a row.
+    loadCopilotModelState();
   }
 
   return {
@@ -1175,6 +1304,9 @@ export function createModelVariantCatalogService({
     getModelVariantSelectorState,
     upsertModelVariantCatalogEntries,
     setEnabledModelVariants,
+    getCopilotModelState,
+    setCopilotAutoEnableNew,
+    markCopilotModelsSeen,
     refreshModelVariantCatalogFromCli,
     parseModelsFromHelpConfigOutput,
     parseReasoningEffortsFromHelpOutput,