@oh-my-pi/pi-coding-agent 17.0.7 → 17.0.9

package/dist/types/tools/report-tool-issue.d.ts

@@ -5,16 +5,21 @@
  * `xd://report_issue`, and the system prompt tells the model to write
  * `<tool>: <concise description>` there when auto-QA is enabled.
  *
- * Enabled by default; gated behind PI_AUTO_QA=1 / `dev.autoqa` so a user who
- * flips the setting off short-circuits injection entirely.
+ * Enabled by default (`dev.autoqa` defaults to true); `PI_AUTO_QA=0` or an
+ * explicit `dev.autoqa: false` short-circuits injection entirely. When the
+ * user is only enabled by default (never configured `dev.autoqa` themselves),
+ * a persisted `dev.autoqaConsent: "denied"` also disables injection so a "No"
+ * in the consent dialog fully turns the feature off.
  * Records grievances to a local SQLite database; never throws from the device
  * dispatch path.
  *
- * Before the first record lands, the user's consent is checked. If they've
- * never been asked (`dev.autoqaConsent === "unset"`) the process-global
- * consent handler — wired by `InteractiveMode` to a Yes/No popup — is invoked
- * exactly once and the decision is persisted. Subsequent calls (including from
- * subagents) read the cached decision without prompting.
+ * Nothing is written until consent resolves. If the user has never been asked
+ * (`dev.autoqaConsent === "unset"`) the process-global consent handler —
+ * wired by `InteractiveMode` to a Yes/No popup — is invoked exactly once and
+ * the decision is persisted; a denial (or dismissal) drops the pending report
+ * without touching the database. Subsequent calls (including from subagents)
+ * read the cached decision without prompting. `PI_AUTO_QA_PUSH=1` bypasses
+ * the dialog for headless environments.
  *
  * When the user grants consent, push is automatically active against the
  * bundled endpoint (`dev.autoqaPush.endpoint`, default `qa.omp.sh`). Each
@@ -42,6 +47,14 @@ export declare function isReportIssueToolCall(toolCall: {
 }): boolean;
 /** Call preview for an `xd://report_issue` write. */
 export declare function renderReportIssueDeviceCall(content: unknown, uiTheme: Theme): Component;
+/**
+ * Whether Auto-QA is active for this session.
+ *
+ * Precedence: `PI_AUTO_QA` env flag > explicit `dev.autoqa` setting >
+ * default-on unless the user previously denied consent. The denial veto only
+ * applies to the default: explicitly configuring `dev.autoqa: true` re-enables
+ * injection (recording still no-ops until consent is granted).
+ */
 export declare function isAutoQaEnabled(settings?: Settings): boolean;
 /**
  * Resolver for the user's "share grievances?" consent.
@@ -82,8 +95,8 @@ export declare function __resetAutoQaConsentForTests(): void;
 export declare function resolveAutoQaConsent(settings: Settings | undefined): Promise<boolean>;
 /**
  * Open (or return the cached handle for) the auto-QA SQLite database at
- * `~/.omp/agent/autoqa.db`, creating the schema lazily. Returns `null` when
- * the agent data dir cannot be resolved.
+ * `~/.omp/autoqa.db` (XDG: `$XDG_DATA_HOME/omp/autoqa.db`), creating the
+ * schema lazily. Returns `null` when the path cannot be resolved or opened.
  */
 export declare function openAutoQaDb(): Database | null;
 export interface FlushResult {
@@ -127,6 +140,8 @@ export declare function __resetAutoQaFlushStateForTests(): void;
  * Flush queued grievances to the configured backend.
  */
 export declare function flushGrievances(db?: Database, settings?: Settings, options?: FlushOptions): Promise<FlushResult>;
+/** Test-only: await the last consent → insert → flush pipeline. */
+export declare function __awaitAutoQaRecordPipelineForTests(): Promise<void>;
 /**
  * Execute `write xd://report_issue`. `text` must be either:
  * - `<tool>: <concise description>` on one line, or

package/dist/types/tools/tool-timeouts.d.ts

@@ -46,6 +46,12 @@ export declare const TOOL_TIMEOUTS: {
 export type ToolWithTimeout = keyof typeof TOOL_TIMEOUTS;
 /**
  * Clamp a raw timeout to the allowed range for a tool.
- * If rawTimeout is undefined, returns the tool's default.
+ *
+ * When `rawTimeout` is undefined the tool's `default` is used. A positive
+ * `maxTimeout` (the `tools.maxTimeout` global ceiling) caps the *resolved*
+ * value — including the default-fallback path — before the per-tool `min`/`max`
+ * floor and ceiling apply, so a configured global cap governs calls where the
+ * agent omits `timeout`, not only explicitly-passed values. `maxTimeout <= 0`
+ * means no global cap.
  */
-export declare function clampTimeout(tool: ToolWithTimeout, rawTimeout?: number): number;
+export declare function clampTimeout(tool: ToolWithTimeout, rawTimeout?: number, maxTimeout?: number): number;

package/dist/types/utils/changelog.d.ts

@@ -23,13 +23,11 @@ export interface StartupChangelogSelection {
     selectedEntries: number;
 }
 /**
- * Parse changelog entries from the file at `changelogPath`. Scans for `## [x.y.z]`
- * headings and collects each block until the next heading or EOF.
+ * Parse changelog entries from omp's package asset when available, falling back
+ * to the copy embedded in compiled binaries.
  *
- * Returns `[]` when `changelogPath` is `undefined` (package directory not
- * resolvable — see `getChangelogPath`) or the file is missing. Callers MUST NOT
- * synthesize a fallback path from the host project's cwd; doing so caused issue
- * #1423 (the host project's `CHANGELOG.md` was rendered as omp's).
+ * The embedded fallback keeps standalone binaries self-contained without
+ * resolving relative to the host project's cwd, which caused issue #1423.
  */
 export declare function parseChangelog(changelogPath: string | undefined): Promise<ChangelogEntry[]>;
 /**

package/dist/types/web/search/providers/firecrawl.d.ts

@@ -23,6 +23,15 @@ export declare function searchFirecrawl(params: SearchParams): Promise<SearchRes
 export declare class FirecrawlProvider extends SearchProvider {
     readonly id = "firecrawl";
     readonly label = "Firecrawl";
+    /**
+     * Auto-chain admission: requires a credential so an unconfigured Firecrawl
+     * doesn't displace other providers that the user has set up with API keys.
+     */
     isAvailable(authStorage: AuthStorage): boolean;
+    /**
+     * Firecrawl supports keyless mode, so an explicit user selection
+     * (`webSearch: firecrawl`) works without any credential configured.
+     */
+    isExplicitlyAvailable(_authStorage: AuthStorage): boolean;
     search(params: SearchParams): Promise<SearchResponse>;
 }

package/dist/types/web/search/types.d.ts

@@ -54,7 +54,7 @@ export declare const SEARCH_PROVIDER_OPTIONS: readonly [{
 }, {
     readonly value: "firecrawl";
     readonly label: "Firecrawl";
-    readonly description: "Requires FIRECRAWL_API_KEY";
+    readonly description: "Uses Firecrawl API when FIRECRAWL_API_KEY is set; falls back to keyless mode";
 }, {
     readonly value: "brave";
     readonly label: "Brave";

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-coding-agent",
-	"version": "17.0.7",
+	"version": "17.0.9",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -51,18 +51,19 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.2.1",
 		"@babel/parser": "^7.29.7",
+		"@babel/traverse": "^7.29.7",
 		"@mozilla/readability": "^0.6.0",
-		"@oh-my-pi/hashline": "17.0.7",
-		"@oh-my-pi/omp-stats": "17.0.7",
-		"@oh-my-pi/pi-agent-core": "17.0.7",
-		"@oh-my-pi/pi-ai": "17.0.7",
-		"@oh-my-pi/pi-catalog": "17.0.7",
-		"@oh-my-pi/pi-mnemopi": "17.0.7",
-		"@oh-my-pi/pi-natives": "17.0.7",
-		"@oh-my-pi/pi-tui": "17.0.7",
-		"@oh-my-pi/pi-utils": "17.0.7",
-		"@oh-my-pi/pi-wire": "17.0.7",
-		"@oh-my-pi/snapcompact": "17.0.7",
+		"@oh-my-pi/hashline": "17.0.9",
+		"@oh-my-pi/omp-stats": "17.0.9",
+		"@oh-my-pi/pi-agent-core": "17.0.9",
+		"@oh-my-pi/pi-ai": "17.0.9",
+		"@oh-my-pi/pi-catalog": "17.0.9",
+		"@oh-my-pi/pi-mnemopi": "17.0.9",
+		"@oh-my-pi/pi-natives": "17.0.9",
+		"@oh-my-pi/pi-tui": "17.0.9",
+		"@oh-my-pi/pi-utils": "17.0.9",
+		"@oh-my-pi/pi-wire": "17.0.9",
+		"@oh-my-pi/snapcompact": "17.0.9",
 		"@opentelemetry/api": "^1.9.1",
 		"@opentelemetry/api-logs": "^0.220.0",
 		"@opentelemetry/context-async-hooks": "^2.9.0",
@@ -79,7 +80,6 @@
 		"@xterm/headless": "^6.0.0",
 		"arktype": "2.2.3",
 		"chalk": "^5.6.2",
-		"diff": "^9.0.0",
 		"fast-xml-parser": "^5.9.3",
 		"handlebars": "^4.7.9",
 		"header-generator": "^2.1.82",

package/scripts/legacy-pi-virtual-module.ts

@@ -19,7 +19,7 @@ const BUNDLED_PACKAGES: readonly BundledPackage[] = [
 	{ dir: "ai", identifier: "PiAi", rootShim: "legacy-pi-ai-shim.ts" },
 	{ dir: "coding-agent", identifier: "PiCodingAgent", rootShim: "legacy-pi-coding-agent-shim.ts" },
 	{ dir: "natives", identifier: "PiNatives", rootShim: null },
-	{ dir: "tui", identifier: "PiTui", rootShim: null },
+	{ dir: "tui", identifier: "PiTui", rootShim: "legacy-pi-tui-shim.ts" },
 	{ dir: "utils", identifier: "PiUtils", rootShim: null },
 ];
 

package/src/cli/grievances-cli.ts

@@ -41,7 +41,7 @@ export async function listGrievances(options: ListGrievancesOptions): Promise<vo
 			console.log("[]");
 		} else {
 			console.log(
-				chalk.dim("No grievances database found. Enable auto-QA with PI_AUTO_QA=1 or the dev.autoqa setting."),
+				chalk.dim("No grievances database found. Auto-QA has not recorded any reports yet (or was disabled)."),
 			);
 		}
 		return;
@@ -110,7 +110,7 @@ export async function cleanGrievances(options: CleanGrievancesOptions): Promise<
 			console.log(JSON.stringify({ deleted: 0 }));
 		} else {
 			console.log(
-				chalk.dim("No grievances database found. Enable auto-QA with PI_AUTO_QA=1 or the dev.autoqa setting."),
+				chalk.dim("No grievances database found. Auto-QA has not recorded any reports yet (or was disabled)."),
 			);
 		}
 		return;

package/src/cli/models-cli.ts

@@ -17,8 +17,14 @@ import { formatNumber, getProjectDir } from "@oh-my-pi/pi-utils";
 import chalk from "chalk";
 import { ModelRegistry } from "../config/model-registry";
 import { Settings } from "../config/settings";
-import { discoverAndLoadExtensions, loadExtensions } from "../extensibility/extensions";
+import {
+	discoverAndLoadExtensions,
+	ExtensionRunner,
+	emitSessionShutdownEvent,
+	loadExtensions,
+} from "../extensibility/extensions";
 import { discoverAuthStorage } from "../sdk";
+import { SessionManager } from "../session/session-manager";
 import { EventBus } from "../utils/event-bus";
 
 export type ModelsAction = "ls" | "find" | "refresh";
@@ -303,25 +309,39 @@ export async function runModelsListing(options: RunModelsListingOptions): Promis
 				eventBus,
 				disabledExtensionIds,
 			);
+	const extensionRunner =
+		extensionsResult.extensions.length > 0
+			? new ExtensionRunner(
+					extensionsResult.extensions,
+					extensionsResult.runtime,
+					cwd,
+					SessionManager.inMemory(cwd),
+					modelRegistry,
+				)
+			: undefined;
 
-	for (const { path: extPath, error } of extensionsResult.errors) {
-		process.stderr.write(`Failed to load extension: ${extPath}: ${error}\n`);
-	}
+	try {
+		for (const { path: extPath, error } of extensionsResult.errors) {
+			process.stderr.write(`Failed to load extension: ${extPath}: ${error}\n`);
+		}
 
-	// Mirror sdk.ts: drain pending provider registrations into the registry.
-	const activeSources = extensionsResult.extensions.map(extension => extension.path);
-	modelRegistry.syncExtensionSources(activeSources);
-	for (const sourceId of new Set(activeSources)) {
-		modelRegistry.clearSourceRegistrations(sourceId);
-	}
-	for (const { name, config, sourceId } of extensionsResult.runtime.pendingProviderRegistrations) {
-		modelRegistry.registerProvider(name, config, sourceId);
-	}
-	extensionsResult.runtime.pendingProviderRegistrations = [];
-	// Discover runtime (extension) provider catalogs now that they are registered.
-	await modelRegistry.refreshRuntimeProviders(action === "refresh" ? "online" : "online-if-uncached");
+		// Mirror sdk.ts: drain pending provider registrations into the registry.
+		const activeSources = extensionsResult.extensions.map(extension => extension.path);
+		modelRegistry.syncExtensionSources(activeSources);
+		for (const sourceId of new Set(activeSources)) {
+			modelRegistry.clearSourceRegistrations(sourceId);
+		}
+		for (const { name, config, sourceId } of extensionsResult.runtime.pendingProviderRegistrations) {
+			modelRegistry.registerProvider(name, config, sourceId);
+		}
+		extensionsResult.runtime.pendingProviderRegistrations = [];
+		// Discover runtime (extension) provider catalogs now that they are registered.
+		await modelRegistry.refreshRuntimeProviders(action === "refresh" ? "online" : "online-if-uncached");
 
-	renderProviderModels(modelRegistry, action, pattern, json);
+		renderProviderModels(modelRegistry, action, pattern, json);
+	} finally {
+		await emitSessionShutdownEvent(extensionRunner);
+	}
 }
 
 /**

package/src/cli/update-cli.ts

@@ -556,6 +556,19 @@ async function pruneBunCacheAfterGlobalInstall(): Promise<BunInstallCachePruneRe
 	return await pruneBunInstallCache(cacheDir, packageNames.size === 0 ? undefined : packageNames);
 }
 
+/**
+ * Detect a musl-libc Linux host (Alpine, Void-musl) so self-update replaces a
+ * musl binary with the musl release asset instead of the glibc build, which
+ * would fail to start on the next run. Mirrors the detection in
+ * scripts/install.sh.
+ */
+function isMuslLinux(): boolean {
+	if (process.platform !== "linux") return false;
+	if (fs.existsSync("/etc/alpine-release")) return true;
+	const loaderArch = process.arch === "arm64" ? "aarch64" : "x86_64";
+	return fs.existsSync(`/lib/ld-musl-${loaderArch}.so.1`);
+}
+
 /**
  * Get the appropriate binary name for this platform.
  */
@@ -566,7 +579,7 @@ function getBinaryName(): string {
 	let os: string;
 	switch (platform) {
 		case "linux":
-			os = "linux";
+			os = isMuslLinux() ? "linux-musl" : "linux";
 			break;
 		case "darwin":
 			os = "darwin";

package/src/cli/usage-cli.ts

@@ -409,7 +409,7 @@ function formatLimitLine(limit: UsageLimit, labelWidth: number, nowMs: number):
 	const details: string[] = [describeAmount(limit)];
 	const resetsAt = limit.window?.resetsAt;
 	if (resetsAt !== undefined && resetsAt > nowMs) {
-		details.push(`resets in ${formatDuration(resetsAt - nowMs)}`);
+		details.push(`${limit.window?.resetLabel ?? "resets"} in ${formatDuration(resetsAt - nowMs)}`);
 	}
 	const lines = [
 		`      ${STATUS_COLOR[status]("●")} ${padded}  ${renderBar(limit)}  ${chalk.dim(details.join(" · "))}`,

package/src/config/__tests__/model-registry.test.ts

@@ -0,0 +1,147 @@
+import { afterEach, beforeEach, describe, expect, test, vi } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import type { AuthStorage } from "@oh-my-pi/pi-ai";
+import { ModelRegistry } from "../model-registry";
+
+/**
+ * Stub AuthStorage that satisfies the surface used by ModelRegistry's
+ * constructor (#loadModels → clearConfigApiKeys, constructor →
+ * setFallbackResolver). The awaiter under test never reaches auth-gated code
+ * paths, so no real credential store is required.
+ */
+function createStubAuthStorage(): AuthStorage {
+	const stub = {
+		setFallbackResolver: () => {},
+		clearConfigApiKeys: () => {},
+		hasAuth: () => false,
+	};
+	return stub as unknown as AuthStorage;
+}
+
+describe("ModelRegistry.awaitBackgroundRefresh", () => {
+	let tmpDir: string;
+	let registry: ModelRegistry;
+
+	beforeEach(() => {
+		tmpDir = mkdtempSync(path.join(os.tmpdir(), "omp-reg-"));
+		// Construct with an explicit modelsPath inside the temp dir so the
+		// constructor's #loadModels read returns "not-found" rather than
+		// touching the host's ~/.omp/agent/models.yaml. isBunTestRuntime()
+		// auto-stubs #fetch in the constructor.
+		registry = new ModelRegistry(createStubAuthStorage(), path.join(tmpDir, "models.yaml"));
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+		rmSync(tmpDir, { recursive: true, force: true });
+	});
+
+	test("resolves immediately when no background refresh is in flight", async () => {
+		// No refreshInBackground() called → #backgroundRefresh is undefined.
+		// The awaiter must settle within a single microtask, never hanging.
+		let settled = false;
+		const p = registry.awaitBackgroundRefresh().then(() => {
+			settled = true;
+		});
+		await Promise.resolve();
+		await p;
+		expect(settled).toBe(true);
+	});
+
+	test("blocks until the in-flight background refresh resolves, then resolves", async () => {
+		// Drive refreshInBackground with a controlled refresh() return value so
+		// #backgroundRefresh is captured but not yet settled.
+		const { promise, resolve } = Promise.withResolvers<void>();
+		const refreshSpy = vi.spyOn(registry, "refresh").mockReturnValue(promise);
+
+		registry.refreshInBackground();
+		expect(refreshSpy).toHaveBeenCalledTimes(1);
+
+		let settled = false;
+		const awaitPromise = registry.awaitBackgroundRefresh().then(() => {
+			settled = true;
+		});
+
+		// Yield to the microtask queue: the awaiter must still be pending.
+		for (let i = 0; i < 5; i++) await Promise.resolve();
+		expect(settled).toBe(false);
+
+		resolve();
+
+		await awaitPromise;
+		expect(settled).toBe(true);
+	});
+
+	test("resolves even when the underlying refresh rejects (refreshInBackground swallows)", async () => {
+		// refreshInBackground wraps refresh() in .catch(...) so discovery errors
+		// never reach awaitBackgroundRefresh callers. The awaiter must resolve,
+		// not propagate the rejection.
+		const { promise, reject } = Promise.withResolvers<void>();
+		vi.spyOn(registry, "refresh").mockReturnValue(promise);
+
+		registry.refreshInBackground();
+
+		let settled = false;
+		const awaitPromise = registry.awaitBackgroundRefresh().then(() => {
+			settled = true;
+		});
+
+		reject(new Error("synthetic discovery failure"));
+
+		await awaitPromise;
+		expect(settled).toBe(true);
+	});
+
+	test("awaiter is a no-op after the in-flight refresh settles and clears #backgroundRefresh", async () => {
+		// Once refreshInBackground's promise resolves, #backgroundRefresh is
+		// cleared in the .finally. A subsequent awaitBackgroundRefresh must be
+		// an immediate no-op (microtask), not hang waiting for a stale promise
+		// or a second refresh that was never started.
+		const { promise, resolve } = Promise.withResolvers<void>();
+		vi.spyOn(registry, "refresh").mockReturnValue(promise);
+
+		registry.refreshInBackground();
+		resolve();
+		await registry.awaitBackgroundRefresh();
+
+		// Now #backgroundRefresh is cleared. A fresh await must resolve in a
+		// single microtask — measure by asserting it settles before a second
+		// microtask tick.
+		let settled = false;
+		const p = registry.awaitBackgroundRefresh().then(() => {
+			settled = true;
+		});
+		await Promise.resolve();
+		expect(settled).toBe(true);
+		await p;
+	});
+
+	test("refreshInBackground deduplicates: a second call while in-flight starts no new refresh", async () => {
+		// The guard `if (this.#backgroundRefresh) return` at the top of
+		// refreshInBackground prevents concurrent refreshes. A second call
+		// while the first is still pending must not invoke refresh() again.
+		const { promise, resolve } = Promise.withResolvers<void>();
+		const refreshSpy = vi.spyOn(registry, "refresh").mockReturnValue(promise);
+
+		registry.refreshInBackground();
+		registry.refreshInBackground();
+		registry.refreshInBackground();
+
+		expect(refreshSpy).toHaveBeenCalledTimes(1);
+
+		resolve();
+		await registry.awaitBackgroundRefresh();
+
+		// After settle, #backgroundRefresh is cleared — a new call DOES start
+		// a fresh refresh.
+		const { promise: secondPromise, resolve: secondResolve } = Promise.withResolvers<void>();
+		refreshSpy.mockReturnValue(secondPromise);
+		registry.refreshInBackground();
+		expect(refreshSpy).toHaveBeenCalledTimes(2);
+
+		secondResolve();
+		await registry.awaitBackgroundRefresh();
+	});
+});

package/src/config/model-registry.ts

@@ -23,6 +23,7 @@ import { getBundledModels, getBundledProviders } from "@oh-my-pi/pi-catalog/mode
 import {
 	googleAntigravityModelManagerOptions,
 	googleGeminiCliModelManagerOptions,
+	type OpenAICodexAccount,
 	openaiCodexModelManagerOptions,
 	PROVIDER_DESCRIPTORS,
 } from "@oh-my-pi/pi-catalog/provider-models";
@@ -157,7 +158,7 @@ interface ProviderOverride {
 export function mergeDiscoveredModel<TApi extends Api>(
 	model: Model<TApi>,
 	existing: Model<Api> | undefined,
-	providerOverride?: Pick<ProviderOverride, "baseUrl" | "headers" | "remoteCompaction" | "transport">,
+	providerOverride?: Pick<ProviderOverride, "baseUrl" | "compat" | "headers" | "remoteCompaction" | "transport">,
 ): Model<TApi> {
 	if (existing) {
 		const supportsTools = model.supportsTools ?? existing.supportsTools;
@@ -171,7 +172,7 @@ export function mergeDiscoveredModel<TApi extends Api>(
 				providerOverride?.remoteCompaction,
 			),
 			...(supportsTools !== undefined ? { supportsTools } : {}),
-			compat: model.compatConfig,
+			compat: mergeCompat(model.compatConfig, providerOverride?.compat),
 		} as ModelSpec<TApi>);
 	}
 	if (providerOverride) {
@@ -184,7 +185,7 @@ export function mergeDiscoveredModel<TApi extends Api>(
 				model.remoteCompaction,
 				providerOverride.remoteCompaction,
 			),
-			compat: model.compatConfig,
+			compat: mergeCompat(model.compatConfig, providerOverride.compat),
 		} as ModelSpec<TApi>);
 	}
 	return model;
@@ -427,20 +428,35 @@ function getOAuthCredentialsForProvider(authStorage: AuthStorage, provider: stri
 	return entries.filter((entry): entry is OAuthCredential => entry.type === "oauth");
 }
 
-function resolveOAuthAccountIdForAccessToken(
+/**
+ * Resolve every configured Codex OAuth account for catalog discovery, refreshing
+ * each credential exactly once. Codex `/models` is account-scoped, so discovery
+ * must fetch per account and union the results; resolving a single access token
+ * (as before) hid models available only through a sibling account (#6265).
+ *
+ * Returns `null` when any stored account fails to resolve (e.g. a transient
+ * refresh failure): the Codex manager is authoritative, so unioning only the
+ * accounts that resolved would cache a partial catalog and hide the failed
+ * account's models for the cache TTL. Aborting keeps the previous/bundled
+ * catalog instead.
+ */
+async function resolveCodexDiscoveryAccounts(
 	authStorage: AuthStorage,
-	provider: string,
-	accessToken: string,
-): string | undefined {
-	const oauthCredentials = getOAuthCredentialsForProvider(authStorage, provider);
-	const matchingCredential = oauthCredentials.find(credential => credential.access === accessToken);
-	if (matchingCredential) {
-		return matchingCredential.accountId;
-	}
-	if (oauthCredentials.length === 1) {
-		return oauthCredentials[0].accountId;
+	resolvedAccessToken: string,
+): Promise<OpenAICodexAccount[] | null> {
+	const accesses = await authStorage.getOAuthAccesses("openai-codex");
+	const accounts: OpenAICodexAccount[] = [];
+	for (const access of accesses) {
+		if (!access.ok) return null;
+		accounts.push({ accessToken: access.accessToken, accountId: access.accountId });
+	}
+	if (!accounts.some(account => account.accessToken === resolvedAccessToken)) {
+		const matchingCredential = getOAuthCredentialsForProvider(authStorage, "openai-codex").find(
+			credential => credential.access === resolvedAccessToken,
+		);
+		accounts.push({ accessToken: resolvedAccessToken, accountId: matchingCredential?.accountId });
 	}
-	return undefined;
+	return accounts;
 }
 
 function mergeCompat<TBase extends object, TOverride extends object>(
@@ -853,6 +869,28 @@ export class ModelRegistry {
 		this.#backgroundRefresh = refreshPromise;
 	}
 
+	/**
+	 * Wait for any in-flight background model discovery to settle.
+	 *
+	 * Background discovery started by {@link refreshInBackground} is
+	 * fire-and-forget; RPC consumers (e.g. `get_available_models`,
+	 * `set_model`) and deferred `--model` resolution that read the registry
+	 * immediately after session creation can otherwise observe a partial
+	 * catalog before discovery-backed providers have populated `#models`.
+	 * Awaiting the tracked promise ensures the response reflects every
+	 * configured provider once the initial background refresh resolves.
+	 *
+	 * No-op when no refresh is in flight (`#backgroundRefresh` cleared in the
+	 * `finally` of `refreshInBackground` on completion). Resolves immediately
+	 * in that case so already-warm sessions are unaffected. Discovery errors
+	 * remain swallowed by `refreshInBackground`'s existing `.catch`.
+	 */
+	async awaitBackgroundRefresh(): Promise<void> {
+		if (this.#backgroundRefresh) {
+			await this.#backgroundRefresh;
+		}
+	}
+
 	async refreshProvider(providerId: string, strategy: ModelRefreshStrategy = "online"): Promise<void> {
 		this.#reloadStaticModels();
 		for (const selector of this.#suppressedSelectors.keys()) {
@@ -1143,8 +1181,18 @@ export class ModelRegistry {
 					models.push(spec);
 					continue;
 				}
-				if (unrestorableHeaderIds.has(spec.id)) continue;
-				const bundledHeaders = bundledById?.get(spec.id)?.headers;
+				// Current unrestorable markers prove that neither same-id nor
+				// request-model bundled headers matched the live model. Only markers
+				// from the old id-only writer may recover through `requestModelId`.
+				const unrestorable = unrestorableHeaderIds.has(spec.id);
+				const bundledHeaders = (
+					unrestorable
+						? cache.legacyHeaderRestoreMarkers && spec.requestModelId
+							? bundledById?.get(spec.requestModelId)
+							: undefined
+						: (bundledById?.get(spec.id) ??
+							(spec.requestModelId ? bundledById?.get(spec.requestModelId) : undefined))
+				)?.headers;
 				if (!bundledHeaders) continue;
 				models.push({ ...spec, headers: bundledHeaders });
 			}
@@ -1723,14 +1771,11 @@ export class ModelRegistry {
 				providerId: "openai-codex",
 				authoritative: true,
 				resolveKey: value => value,
-				createOptions: accessToken => {
-					const accountId = resolveOAuthAccountIdForAccessToken(this.authStorage, "openai-codex", accessToken);
-					return openaiCodexModelManagerOptions({
-						accessToken,
-						accountId,
+				createOptions: accessToken =>
+					openaiCodexModelManagerOptions({
+						resolveAccounts: () => resolveCodexDiscoveryAccounts(this.authStorage, accessToken),
 						fetch: this.#fetch,
-					});
-				},
+					}),
 			},
 		];
 		const disabledProviders = getDisabledProviderIdsFromSettings();
@@ -2078,6 +2123,24 @@ export class ModelRegistry {
 			.map(provider => provider.provider);
 	}
 
+	/**
+	 * Whether `providerId` is known to the registry: it has at least one live
+	 * model, or it is configured for dynamic discovery (models.yml `discovery:`
+	 * or a runtime extension provider) and is not disabled. Discovery-only
+	 * providers can hold zero models at startup — cached rows never persist
+	 * live auth headers (#5780), so a provider whose discovered models all
+	 * carry config headers (`authHeader: true`) only materializes models after
+	 * the online refresh completes.
+	 */
+	hasProvider(providerId: string): boolean {
+		if (this.#models.some(model => model.provider === providerId)) return true;
+		if (getDisabledProviderIdsFromSettings().has(providerId)) return false;
+		return (
+			this.#discoverableProviders.some(provider => provider.provider === providerId) ||
+			this.#runtimeModelManagers.has(providerId)
+		);
+	}
+
 	getProviderDiscoveryState(provider: string): ProviderDiscoveryState | undefined {
 		return this.#providerDiscoveryStates.get(provider);
 	}