@omercnet/paseo-omp 0.3.0-next.103.1 → 0.3.0-next.105.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omercnet/paseo-omp",
-  "version": "0.3.0-next.103.1",
+  "version": "0.3.0-next.105.1",
   "type": "module",
   "description": "Paseo integration for OMP, including its direct provider and workspace tooling.",
   "license": "MIT",

package/server/provider/catalog.ts

@@ -48,6 +48,27 @@ const THINKING_OPTIONS: readonly ProviderThinkingOption[] = [
   { id: "xhigh", label: "XHigh", description: "Extra-high reasoning" },
   { id: "max", label: "Max", description: "Maximum reasoning" },
 ];
+export const OMP_MAX_CATALOG_MODELS = 256;
+
+export function selectOmpModels(
+  models: readonly OmpModel[],
+  activeModel: OmpModel | null | undefined,
+): OmpModel[] {
+  if (models.length <= OMP_MAX_CATALOG_MODELS) return [...models];
+  const selected = models.slice(0, OMP_MAX_CATALOG_MODELS);
+  if (!activeModel) return selected;
+  const active = models.find(
+    (model) => model.provider === activeModel.provider && model.id === activeModel.id,
+  );
+  if (
+    !active ||
+    selected.some((model) => model.provider === active.provider && model.id === active.id)
+  ) {
+    return selected;
+  }
+  selected[OMP_MAX_CATALOG_MODELS - 1] = active;
+  return selected;
+}
 
 export function nativeOmpModelId(model: OmpModel): string {
   if (model.provider.includes("/")) {
@@ -60,14 +81,9 @@ export function ompModelId(model: OmpModel): string {
   const nativeIdentity = `${Buffer.byteLength(model.provider, "utf8")}:${model.provider}${Buffer.byteLength(model.id, "utf8")}:${model.id}`;
   return `omp:model:${createHash("sha256").update(nativeIdentity).digest("hex")}`;
 }
-
-export function mapOmpModels(
-  models: readonly OmpModel[],
-  serializer = new OmpPublicDataSerializer(),
-): ProviderModel[] {
+export function validateOmpModelIdentities(models: readonly OmpModel[]): void {
   const seenIds = new Map<string, string>();
-  return models.map((model) => {
-    const thinkingOptions = thinkingForModel(model);
+  for (const model of models) {
     const id = ompModelId(model);
     const nativeIdentity = nativeOmpModelId(model);
     const existing = seenIds.get(id);
@@ -76,6 +92,17 @@ export function mapOmpModels(
     }
     if (existing !== undefined) throw new Error("OMP reported a duplicate model identity");
     seenIds.set(id, nativeIdentity);
+  }
+}
+
+export function mapOmpModels(
+  models: readonly OmpModel[],
+  serializer = new OmpPublicDataSerializer(),
+): ProviderModel[] {
+  validateOmpModelIdentities(models);
+  return models.map((model) => {
+    const thinkingOptions = thinkingForModel(model);
+    const id = ompModelId(model);
     const provider = serializer.text(model.provider, 256);
     const modelId = serializer.text(model.id, 256);
     const name = model.name ? serializer.text(model.name, 256) : modelId;
@@ -143,14 +170,16 @@ export async function discoverOmpCatalog(
         ? [...configuredValues, ...(session.inheritedRedactionValues ?? [])]
         : configuredValues,
     );
-    const models = mapOmpModels(nativeModels, serializer);
+    validateOmpModelIdentities(nativeModels);
+    const selectedNativeModels = selectOmpModels(nativeModels, state.model);
+    const models = mapOmpModels(selectedNativeModels, serializer);
     if (models.length === 0) throw new Error("OMP reported no available models");
     const defaultModel = state.model ? ompModelId(state.model) : models[0]?.id;
     const currentModel = state.model
-      ? nativeModels.find(
+      ? selectedNativeModels.find(
           (model) => model.provider === state.model?.provider && model.id === state.model.id,
         )
-      : nativeModels[0];
+      : selectedNativeModels[0];
     if (state.model && !currentModel) throw new Error("OMP reported an unadvertised active model");
     const thinkingOptions = thinkingForModel(currentModel);
     const defaultThinkingOption = thinkingOptions.some(

package/server/provider/omp-rpc.ts

@@ -70,6 +70,7 @@ const MAX_OPTIONAL_METADATA_NODES = 4_096;
 const MAX_TASK_CORRELATION_BYTES = 256 * 1024;
 const MAX_TASK_CORRELATION_ITEMS = 1_024;
 const MAX_TASK_CORRELATION_NODES = 4_096;
+const MAX_MODEL_CATALOG_ITEMS = 4_096;
 // Tool-intensive OMP turns legitimately exceed 64 blocks; transport byte/node budgets remain the
 // primary resource bounds.
 export const OMP_MAX_CONTENT_PARTS = 4_096;
@@ -84,6 +85,32 @@ const MAX_COST_USD = 1_000_000_000;
 const MAX_RPC_ERROR_BYTES = 4_096;
 const MAX_RPC_ERROR_CODE_BYTES = 256;
 const PROMPT_SCHEDULING_FAILURE = "OMP prompt scheduling failed";
+const PROTOCOL_VIOLATION_COALESCE_MS = 10_000;
+
+export type OmpProtocolViolationCategory =
+  | "duplicate-ready"
+  | "frame-limit"
+  | "incomplete-frame"
+  | "interleaved-chunk"
+  | "invalid-chunk"
+  | "invalid-envelope"
+  | "invalid-event"
+  | "invalid-event-state"
+  | "invalid-json"
+  | "invalid-ready"
+  | "invalid-response"
+  | "remote-frame-error";
+
+export interface OmpProtocolViolationDiagnostic {
+  category: OmpProtocolViolationCategory;
+  occurrenceCount: number;
+  frameType?: "ready" | "response" | "rpc_chunk" | "rpc_frame_error";
+  maxByteSize?: number;
+}
+
+type PendingProtocolViolation = Omit<OmpProtocolViolationDiagnostic, "occurrenceCount"> & {
+  occurrenceCount: number;
+};
 const MAX_CONTEXT_PERCENT = 1_000_000;
 function boundedJsonString(maxBytes: number, minBytes = 0) {
   return z.string().refine((value) => {
@@ -115,6 +142,17 @@ function boundedString(maxBytes: number, minBytes = 0) {
     return bytes >= minBytes && bytes <= maxBytes;
   });
 }
+function boundedOptionalStringArray(maxItems: number, maxBytes: number) {
+  return z.unknown().transform((value): string[] | undefined => {
+    if (!Array.isArray(value)) return undefined;
+    return value
+      .filter(
+        (item): item is string =>
+          typeof item === "string" && item.length > 0 && utf8Bytes(item) <= maxBytes,
+      )
+      .slice(0, maxItems);
+  });
+}
 
 const IDENTIFIER = boundedString(MAX_ID_LENGTH, 1);
 const NAME = boundedString(MAX_NAME_LENGTH, 1);
@@ -191,6 +229,7 @@ function sanitizeLiveDisplayFrame(value: unknown): unknown {
   return changed ? { ...frame, messages } : value;
 }
 const OmpThinkingLevelSchema = z.enum(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
+const OmpCurrentThinkingLevelSchema = boundedString(32).optional().catch(undefined);
 
 function isBoundedJson(
   value: unknown,
@@ -546,19 +585,33 @@ const OmpAvailableCommandSchema = z.object({
     .optional(),
   source: boundedString(64).optional(),
 });
+const OmpThinkingMetadataSchema = z
+  .unknown()
+  .transform((value): { efforts?: string[]; defaultLevel?: string } | undefined => {
+    if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+    const record = value as Record<string, unknown>;
+    const efforts = boundedOptionalStringArray(16, 32).parse(record.efforts);
+    const defaultLevel = boundedString(32).optional().catch(undefined).parse(record.defaultLevel);
+    return {
+      ...(efforts !== undefined ? { efforts } : {}),
+      ...(defaultLevel !== undefined ? { defaultLevel } : {}),
+    };
+  });
 const OmpModelSchema = z.object({
   provider: OMP_PROVIDER_NAME,
   id: NAME,
-  name: boundedString(MAX_NAME_LENGTH).optional(),
-  reasoning: z.boolean().optional(),
-  thinking: z
-    .object({
-      efforts: z.array(boundedString(32)).max(16).optional(),
-      defaultLevel: boundedString(32).optional(),
-    })
-    .optional(),
-  input: z.array(NAME).max(16).optional(),
-  contextWindow: z.number().int().nonnegative().max(100_000_000).nullable().optional(),
+  name: boundedString(MAX_NAME_LENGTH).optional().catch(undefined),
+  reasoning: z.boolean().optional().catch(undefined),
+  thinking: OmpThinkingMetadataSchema.optional(),
+  input: boundedOptionalStringArray(16, MAX_NAME_LENGTH).optional(),
+  contextWindow: z
+    .number()
+    .int()
+    .nonnegative()
+    .max(100_000_000)
+    .nullable()
+    .optional()
+    .catch(undefined),
 });
 const TokenCountSchema = z.number().int().nonnegative().max(MAX_TOKEN_COUNT);
 const OptionalTokenCountSchema = TokenCountSchema.nullable().optional();
@@ -610,13 +663,13 @@ const OmpCompactionResultSchema = z.object({
 });
 const OmpSessionStateSchema = z.object({
   model: OmpModelSchema.nullable().optional(),
-  thinkingLevel: OmpThinkingLevelSchema.optional(),
+  thinkingLevel: OmpCurrentThinkingLevelSchema,
   isStreaming: z.boolean(),
   isCompacting: z.boolean(),
   sessionId: IDENTIFIER,
   autoCompactionEnabled: z.boolean().optional(),
-  contextUsage: OmpContextUsageSchema.nullable().optional(),
-  sessionFile: boundedString(MAX_PATH_LENGTH).optional(),
+  contextUsage: OmpContextUsageSchema.nullable().optional().catch(undefined),
+  sessionFile: boundedString(MAX_PATH_LENGTH).optional().catch(undefined),
 });
 const OmpReadyFrameSchema = z.object({
   type: z.literal("ready"),
@@ -1217,7 +1270,7 @@ function runtimeFrameCollectionLimit(frame: Record<string, unknown>): number {
   return 1_024;
 }
 const OmpModelsResultSchema = z.object({
-  models: z.array(OmpModelSchema).min(1).max(256),
+  models: z.array(OmpModelSchema).min(1).max(MAX_MODEL_CATALOG_ITEMS),
 });
 const OmpPromptAckSchema = z.object({ agentInvoked: z.boolean().optional() }).optional();
 const OmpAvailableCommandsResultSchema = z.object({
@@ -1412,6 +1465,7 @@ export interface OmpRpcRuntimeOptions {
   terminateProcessTree?: (pid: number) => Promise<boolean | "uncertain">;
   environment?: NodeJS.ProcessEnv;
   requestTimeoutMs?: number;
+  reportProtocolViolation?: (diagnostic: OmpProtocolViolationDiagnostic) => void | Promise<void>;
   listSessions?: (
     options: OmpSessionListOptions,
   ) => OmpSessionDescriptor[] | Promise<OmpSessionDescriptor[]>;
@@ -1943,12 +1997,20 @@ class OmpRpcProcess {
   private spawnFailedWithoutProcess = false;
   private readyReceived = false;
   private outputSettled = false;
+  private readonly pendingProtocolViolations = new Map<
+    OmpProtocolViolationCategory,
+    PendingProtocolViolation
+  >();
+  private protocolViolationTimer: TimerHandle | null = null;
 
   constructor(
     options: OmpStartOptions,
     spawnProcess?: OmpRpcRuntimeOptions["spawnProcess"],
     terminateProcessTree?: OmpRpcRuntimeOptions["terminateProcessTree"],
     private readonly requestTimeoutMs = REQUEST_TIMEOUT_MS,
+    private readonly reportProtocolViolation: (
+      diagnostic: OmpProtocolViolationDiagnostic,
+    ) => void | Promise<void> = (diagnostic) => console.error("OMP protocol violation", diagnostic),
   ) {
     const ready = Promise.withResolvers<ReadyFrame>();
     this.rejectReady = ready.reject;
@@ -2037,7 +2099,11 @@ class OmpRpcProcess {
   private settleOutput(): void {
     if (this.outputSettled) return;
     this.outputSettled = true;
-    if (this.lineBytes > 0 || this.discardingLine) this.recordProtocolViolation();
+    if (this.lineBytes > 0 || this.discardingLine) {
+      this.recordProtocolViolation("incomplete-frame", {
+        maxByteSize: this.discardingLine ? this.discardedLineBytes : this.lineBytes,
+      });
+    }
     this.lineParts = [];
     this.lineBytes = 0;
     this.discardingLine = false;
@@ -2220,6 +2286,7 @@ class OmpRpcProcess {
 
   private async closeProcess(): Promise<void> {
     this.closed = true;
+    this.flushProtocolViolations();
     this.clearChunk();
     this.failPending(new Error("OMP RPC process was closed"));
     if (!this.exited) {
@@ -2316,7 +2383,7 @@ class OmpRpcProcess {
       this.lineParts = [];
       this.lineBytes = 0;
       this.discardingLine = true;
-      this.recordProtocolViolation();
+      this.recordProtocolViolation("frame-limit", { maxByteSize: nextBytes });
       return;
     }
     this.lineParts.push(part);
@@ -2337,7 +2404,7 @@ class OmpRpcProcess {
     try {
       decoded = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(payload));
     } catch {
-      this.recordProtocolViolation();
+      this.recordProtocolViolation("invalid-json", { maxByteSize: payload.byteLength });
       return;
     }
     this.receiveDecodedFrame(decoded, payload.byteLength);
@@ -2407,7 +2474,7 @@ class OmpRpcProcess {
     try {
       decodedFrame = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(reassembled));
     } catch {
-      this.recordProtocolViolation();
+      this.recordProtocolViolation("invalid-json", { maxByteSize: reassembled.byteLength });
       return;
     }
     this.receiveDecodedFrame(decodedFrame, reassembled.byteLength);
@@ -2433,10 +2500,10 @@ class OmpRpcProcess {
     const sanitized = sanitizeLiveDisplayFrame(value);
     const frame = JsonObjectSchema.safeParse(sanitized);
     if (!frame.success) {
-      this.recordProtocolViolation();
+      this.recordProtocolViolation("invalid-envelope", { maxByteSize: rawByteLength });
       return;
     }
-    this.receiveFrame(frame.data);
+    this.receiveFrame(frame.data, rawByteLength);
   }
 
   private receiveKnownResponse(value: unknown): boolean {
@@ -2461,7 +2528,7 @@ class OmpRpcProcess {
       if (rawId && knownPending) {
         this.takePending(rawId)?.reject(new Error("OMP RPC response is invalid"));
       } else if (!rawId || !this.emitAcceptedPromptFailure(rawId, frame)) {
-        this.recordProtocolViolation();
+        this.recordProtocolViolation("invalid-response", { frameType: "response" });
       }
       return;
     }
@@ -2480,13 +2547,19 @@ class OmpRpcProcess {
       : response.data.data;
     const boundedFrame =
       responseData === response.data.data ? frame : { ...frame, data: responseData };
-    const responseItemLimit = isBranchHistory ? 1_024 : isHistory ? 100_000 : MAX_ARRAY_ITEMS;
+    const responseItemLimit = isBranchHistory
+      ? 1_024
+      : isHistory
+        ? 100_000
+        : pending.command === "get_available_models"
+          ? MAX_MODEL_CATALOG_ITEMS
+          : MAX_ARRAY_ITEMS;
     const responseByteLimit =
       isBranchHistory || isHistory
         ? Math.min(MAX_REASSEMBLED_FRAME_BYTES, this.reassembledFrameLimit)
         : 2 * 1024 * 1024;
-    // A model catalog contains up to 256 structured models, so its aggregate
-    // node budget must exceed the small state/command-response budget.
+    // Model catalogs are truncated before publication, while the transport still enforces
+    // aggregate byte and node budgets over the complete response.
     const responseNodeLimit = isBranchHistory
       ? 4_096
       : isHistory
@@ -2610,10 +2683,10 @@ class OmpRpcProcess {
     return true;
   }
 
-  private receiveFrame(frame: Record<string, unknown>): void {
+  private receiveFrame(frame: Record<string, unknown>, rawByteLength: number): void {
     const type = typeof frame.type === "string" && frame.type.length <= 64 ? frame.type : null;
     if (!type) {
-      this.recordProtocolViolation();
+      this.recordProtocolViolation("invalid-envelope", { maxByteSize: rawByteLength });
       return;
     }
     const safeFrame = mapRuntimeFrameDetails(frame, createOptionalMetadataSanitizer());
@@ -2627,7 +2700,7 @@ class OmpRpcProcess {
         4_096,
       ) === Number.POSITIVE_INFINITY
     ) {
-      this.recordProtocolViolation();
+      this.recordProtocolViolation("frame-limit", { maxByteSize: rawByteLength });
       return;
     }
     if (type === "rpc_chunk") {
@@ -2638,20 +2711,20 @@ class OmpRpcProcess {
     }
     if (this.chunk) {
       this.clearChunk();
-      this.recordProtocolViolation();
+      this.recordProtocolViolation("interleaved-chunk");
     }
     if (type === "rpc_frame_error") {
-      this.recordProtocolViolation();
+      this.recordProtocolViolation("remote-frame-error", { frameType: "rpc_frame_error" });
       return;
     }
     if (type === "ready") {
       if (this.readyReceived) {
-        this.recordProtocolViolation();
+        this.recordProtocolViolation("duplicate-ready", { frameType: "ready" });
         return;
       }
       const ready = OmpReadyFrameSchema.safeParse(safeFrame);
       if (!ready.success) {
-        this.recordProtocolViolation();
+        this.recordProtocolViolation("invalid-ready", { frameType: "ready" });
       } else {
         this.readyReceived = true;
         this.resolveReady(ready.data);
@@ -2666,11 +2739,11 @@ class OmpRpcProcess {
     if (!event.success) {
       this.rejectMatchingToolApproval(safeFrame);
       if (type === "agent_end" && this.receiveDegradedAgentEnd(safeFrame, false)) return;
-      this.recordProtocolViolation();
+      this.recordProtocolViolation("invalid-event", { maxByteSize: rawByteLength });
       return;
     }
     if (!this.acceptEventState(event.data)) {
-      this.recordProtocolViolation();
+      this.recordProtocolViolation("invalid-event-state", { maxByteSize: rawByteLength });
       return;
     }
     this.emit(event.data);
@@ -2775,11 +2848,48 @@ class OmpRpcProcess {
 
   private rejectChunk(): void {
     this.clearChunk();
-    this.recordProtocolViolation();
+    this.recordProtocolViolation("invalid-chunk", { frameType: "rpc_chunk" });
+  }
+
+  private recordProtocolViolation(
+    category: OmpProtocolViolationCategory,
+    metadata: Omit<OmpProtocolViolationDiagnostic, "category" | "occurrenceCount"> = {},
+  ): void {
+    if (!this.protocolViolationTimer) {
+      this.emitProtocolViolation({ category, occurrenceCount: 1, ...metadata });
+      this.protocolViolationTimer = setTimeout(
+        () => this.flushProtocolViolations(),
+        PROTOCOL_VIOLATION_COALESCE_MS,
+      );
+      return;
+    }
+    const pending = this.pendingProtocolViolations.get(category);
+    if (!pending) {
+      this.pendingProtocolViolations.set(category, { category, occurrenceCount: 1, ...metadata });
+      return;
+    }
+    pending.occurrenceCount = Math.min(Number.MAX_SAFE_INTEGER, pending.occurrenceCount + 1);
+    pending.maxByteSize =
+      Math.max(pending.maxByteSize ?? 0, metadata.maxByteSize ?? 0) || undefined;
+    if (pending.frameType !== metadata.frameType) pending.frameType = undefined;
+  }
+
+  private flushProtocolViolations(): void {
+    if (this.protocolViolationTimer) clearTimeout(this.protocolViolationTimer);
+    this.protocolViolationTimer = null;
+    for (const diagnostic of this.pendingProtocolViolations.values()) {
+      this.emitProtocolViolation(diagnostic);
+    }
+    this.pendingProtocolViolations.clear();
   }
 
-  private recordProtocolViolation(): void {
-    // Malformed bounded frames are isolated so the following frame starts from clean state.
+  private emitProtocolViolation(diagnostic: OmpProtocolViolationDiagnostic): void {
+    try {
+      const reporting = this.reportProtocolViolation(diagnostic);
+      if (reporting) void reporting.catch(() => undefined);
+    } catch {
+      // Diagnostics must never alter transport flow or cleanup.
+    }
   }
 
   private fail(error: Error): void {
@@ -3128,6 +3238,7 @@ export class OmpRpcRuntime implements OmpRuntime {
       this.options.spawnProcess,
       this.options.terminateProcessTree,
       options.requestTimeoutMs ?? this.options.requestTimeoutMs,
+      this.options.reportProtocolViolation,
     );
     const abort = () => void process.close().catch(() => undefined);
     options.signal?.addEventListener("abort", abort, { once: true });

package/server/provider/session.ts

@@ -11,7 +11,15 @@ import type {
   ProviderUsage,
 } from "@getpaseo/plugin/server/provider";
 import { getForgeDefinitionOrNeutral } from "@getpaseo/protocol/forge-manifest";
-import { mapOmpModels, nativeOmpModelId, OMP_MODES, ompModelId, thinkingForModel } from "./catalog";
+import {
+  mapOmpModels,
+  nativeOmpModelId,
+  OMP_MODES,
+  ompModelId,
+  selectOmpModels,
+  thinkingForModel,
+  validateOmpModelIdentities,
+} from "./catalog";
 import {
   normalizeOmpSessionConfig,
   type OmpRecoveryOptions,
@@ -939,6 +947,8 @@ export class OmpProviderSession {
   private readonly pendingToolPermissions = new Map<string, PendingToolPermission>();
   private readonly inFlightToolPermissions = new Map<string, PendingToolPermission>();
   private readonly resolvedToolApprovalIds = new BoundedStringSet(MAX_TRACKED_ENTRY_IDS);
+  private unsupportedThinkingNoticePending = false;
+  private unsupportedThinkingNoticePublished = false;
 
   private constructor(
     id: string,
@@ -1057,10 +1067,9 @@ export class OmpProviderSession {
     }
     const startOptions: OmpStartOptions = {
       ...normalizedConfig,
-      // Model selection is authorized only after this runtime reports its exact catalog.
-      ...(resumeSessionId
-        ? { thinkingOption: undefined, systemPrompt: undefined, resumeSessionId }
-        : {}),
+      // Thinking is authorized only after this runtime reports its exact model catalog.
+      thinkingOption: undefined,
+      ...(resumeSessionId ? { systemPrompt: undefined, resumeSessionId } : {}),
       signal,
       environment,
     };
@@ -1096,6 +1105,7 @@ export class OmpProviderSession {
           () => ({ available: false, commands: [] }),
         ),
       ]);
+      validateOmpModelIdentities(nativeModels);
       if (effectiveConfig.persist && !native.canReplayHistory) {
         throw new OmpPublicError("OMP session persistence requires negotiated RPC protocol v2");
       }
@@ -1109,12 +1119,10 @@ export class OmpProviderSession {
       if (resumeSessionId && initialState.sessionId !== resumeSessionId) {
         throw new OmpPublicError("OMP resumed a different native session");
       }
-      const models = mapOmpModels(nativeModels, new OmpPublicDataSerializer(outputRedactionValues));
-      const nativeModelsByPublicId = new Map(
-        nativeModels.map((model) => [ompModelId(model), model] as const),
-      );
       if (!resumeSessionId && input.config.model) {
-        const selected = nativeModelsByPublicId.get(input.config.model);
+        const selected = selectOmpModels(nativeModels, state.model).find(
+          (model) => ompModelId(model) === input.config.model,
+        );
         if (!selected) {
           throw new OmpPublicError("OMP model is not advertised by the configured session runtime");
         }
@@ -1123,9 +1131,29 @@ export class OmpProviderSession {
           state = await native.getState();
         }
       }
+      let currentModel = state.model
+        ? nativeModels.find(
+            (model) => model.provider === state.model?.provider && model.id === state.model.id,
+          )
+        : undefined;
+      if (state.model && !currentModel) {
+        throw new OmpPublicError("OMP runtime selected an unadvertised model");
+      }
+      if (!resumeSessionId && input.config.thinkingOption !== undefined) {
+        if (
+          !thinkingForModel(currentModel).some(
+            (option) => option.id === input.config.thinkingOption,
+          )
+        ) {
+          throw new OmpPublicError("OMP thinking level is unavailable for the selected model");
+        }
+        if (state.thinkingLevel !== input.config.thinkingOption) {
+          await native.setThinkingLevel(input.config.thinkingOption);
+        }
+      }
       const reconciledConfigRevision = bootstrapConfigRevision;
       state = await native.getState();
-      const currentModel = state.model
+      currentModel = state.model
         ? nativeModels.find(
             (model) => model.provider === state.model?.provider && model.id === state.model.id,
           )
@@ -1133,21 +1161,21 @@ export class OmpProviderSession {
       if (state.model && !currentModel) {
         throw new OmpPublicError("OMP runtime selected an unadvertised model");
       }
+      const selectedNativeModels = selectOmpModels(nativeModels, state.model);
+      const models = mapOmpModels(
+        selectedNativeModels,
+        new OmpPublicDataSerializer(outputRedactionValues),
+      );
+      const nativeModelsByPublicId = new Map(
+        nativeModels.map((model) => [ompModelId(model), model] as const),
+      );
       const thinkingOptions = thinkingForModel(currentModel);
-      const committedThinkingLevel = applicableThinkingLevel(currentModel, state.thinkingLevel);
-      if (
-        !resumeSessionId &&
-        input.config.thinkingOption !== undefined &&
-        !thinkingOptions.some((option) => option.id === input.config.thinkingOption)
-      ) {
-        throw new OmpPublicError("OMP thinking level is unavailable for the selected model");
-      }
-      if (
-        committedThinkingLevel &&
-        !thinkingOptions.some((option) => option.id === committedThinkingLevel)
-      ) {
-        throw new OmpPublicError("OMP runtime selected an unsupported thinking level");
-      }
+      const applicableLevel = applicableThinkingLevel(currentModel, state.thinkingLevel);
+      const committedThinkingLevel = thinkingOptions.some((option) => option.id === applicableLevel)
+        ? applicableLevel
+        : undefined;
+      const unsupportedThinkingLevel =
+        applicableLevel !== undefined && committedThinkingLevel === undefined;
       const configState: ProviderConfigState = {
         ...(state.model ? { model: ompModelId(state.model) } : {}),
         mode: normalizedConfig.mode ?? "full",
@@ -1210,6 +1238,7 @@ export class OmpProviderSession {
         retireRewindSession,
         scheduler,
       );
+      session.unsupportedThinkingNoticePending = unsupportedThinkingLevel;
 
       if (bootstrapConfigRevision !== reconciledConfigRevision) {
         session.configRefreshDirty = true;
@@ -1268,6 +1297,7 @@ export class OmpProviderSession {
         : {}),
       ...(this.config.title ? { title: this.dataFilter.text(this.config.title, 256) } : {}),
     });
+    this.publishUnsupportedThinkingNotice();
     this.emit({ type: "session.config", sessionId: this.id, config: this.configState });
     if (this.replayHistoryOnOpen) await this.replayHistory(true);
     this.publishCommands(this.commandCatalog);
@@ -1275,6 +1305,22 @@ export class OmpProviderSession {
     this.readyPublished = true;
     if (this.configRefreshDirty) this.scheduleCommittedConfigRefresh();
   }
+  private publishUnsupportedThinkingNotice(): void {
+    if (!this.unsupportedThinkingNoticePending || this.unsupportedThinkingNoticePublished) return;
+    this.unsupportedThinkingNoticePending = false;
+    this.unsupportedThinkingNoticePublished = true;
+    this.emit({
+      type: "session.notice",
+      sessionId: this.id,
+      notice: {
+        id: "omp:unsupported-thinking-level",
+        severity: "warning",
+        title: "OMP thinking level unavailable",
+        description:
+          "OMP reported a thinking level that the active model does not advertise. Paseo omitted it from the session configuration.",
+      },
+    });
+  }
 
   private usageFrom(
     state: OmpSessionState | undefined,
@@ -1685,6 +1731,17 @@ export class OmpProviderSession {
       if (this.activeTurn || beforeState.isStreaming || beforeState.isCompacting) {
         throw new OmpPublicError("Cannot rewind the OMP conversation while a turn is active");
       }
+      const beforeAdvertisedModel = beforeState.model
+        ? this.nativeModelsByPublicId.get(ompModelId(beforeState.model))
+        : undefined;
+      if (beforeState.model && !beforeAdvertisedModel) {
+        throw new OmpPublicError("OMP runtime selected an unadvertised model");
+      }
+      const restorableThinkingLevel = thinkingForModel(beforeAdvertisedModel).some(
+        (option) => option.id === beforeState.thinkingLevel,
+      )
+        ? beforeState.thinkingLevel
+        : undefined;
       branchMutationPossible = true;
       let result: OmpBranchResult;
       try {
@@ -1727,13 +1784,10 @@ export class OmpProviderSession {
         }
         await runtime.setModel(beforeState.model.provider, beforeState.model.id);
       }
-      if (thinkingChanged) {
-        if (!beforeState.thinkingLevel) {
-          throw new OmpPublicError("OMP changed thinking level while rewinding the conversation");
-        }
-        await runtime.setThinkingLevel(beforeState.thinkingLevel);
+      if (thinkingChanged && restorableThinkingLevel) {
+        await runtime.setThinkingLevel(restorableThinkingLevel);
       }
-      if (modelChanged || thinkingChanged) {
+      if (modelChanged || (thinkingChanged && restorableThinkingLevel)) {
         state = await runtime.getState();
         this.requireCurrentRuntime(runtime, generation);
       }
@@ -1741,7 +1795,7 @@ export class OmpProviderSession {
         state.sessionId !== this.nativeSessionId ||
         state.model?.provider !== beforeState.model?.provider ||
         state.model?.id !== beforeState.model?.id ||
-        state.thinkingLevel !== beforeState.thinkingLevel
+        (restorableThinkingLevel !== undefined && state.thinkingLevel !== restorableThinkingLevel)
       ) {
         throw new OmpPublicError("OMP did not preserve session configuration while rewinding");
       }
@@ -2341,7 +2395,10 @@ export class OmpProviderSession {
       const targetModel = targetModelId
         ? this.nativeModelsByPublicId.get(targetModelId)
         : undefined;
-      if (input.changes.model !== undefined && !targetModel) {
+      const targetModelPublished = this.configState.models.some(
+        (model) => model.id === targetModelId,
+      );
+      if (input.changes.model !== undefined && (!targetModel || !targetModelPublished)) {
         throw new OmpPublicError("OMP model selection is unavailable");
       }
       if (
@@ -2588,13 +2645,18 @@ export class OmpProviderSession {
       throw new OmpCatalogEscape("OMP runtime selected an unadvertised model");
     }
     const thinkingOptions = thinkingForModel(advertisedModel);
-    const committedThinkingLevel = applicableThinkingLevel(advertisedModel, state.thinkingLevel);
-    if (
-      committedThinkingLevel &&
-      !thinkingOptions.some((option) => option.id === committedThinkingLevel)
-    ) {
-      throw new OmpCatalogEscape("OMP runtime selected an unsupported thinking level");
+    const applicableLevel = applicableThinkingLevel(advertisedModel, state.thinkingLevel);
+    const committedThinkingLevel = thinkingOptions.some((option) => option.id === applicableLevel)
+      ? applicableLevel
+      : undefined;
+    if (applicableLevel !== undefined && committedThinkingLevel === undefined) {
+      this.unsupportedThinkingNoticePending = true;
+      this.publishUnsupportedThinkingNotice();
     }
+    const models = mapOmpModels(
+      selectOmpModels([...this.nativeModelsByPublicId.values()], state.model),
+      this.dataFilter,
+    );
     this.configRefreshAttempts = 0;
     this.cancelConfigRefreshRetry();
     const nextConfig: ProviderConfigState = {
@@ -2603,12 +2665,15 @@ export class OmpProviderSession {
       ...(committedThinkingLevel
         ? { thinkingOption: committedThinkingLevel }
         : { thinkingOption: undefined }),
+      models,
       thinkingOptions,
     };
     const changed =
       force ||
       nextConfig.model !== this.configState.model ||
       nextConfig.thinkingOption !== this.configState.thinkingOption ||
+      nextConfig.models.some((model, index) => model.id !== this.configState.models[index]?.id) ||
+      this.configState.models.length !== nextConfig.models.length ||
       nextConfig.thinkingOptions.length !== this.configState.thinkingOptions.length ||
       nextConfig.thinkingOptions.some(
         (option, index) =>
@@ -2929,13 +2994,6 @@ export class OmpProviderSession {
       if (state.model && !advertisedModel) {
         throw new Error("OMP recovered with an unadvertised model");
       }
-      const recoveredThinkingLevel = applicableThinkingLevel(advertisedModel, state.thinkingLevel);
-      if (
-        recoveredThinkingLevel &&
-        !thinkingForModel(advertisedModel).some((option) => option.id === recoveredThinkingLevel)
-      ) {
-        throw new Error("OMP recovered with an unsupported thinking level");
-      }
       if (this.closed) throw new Error("OMP session closed while runtime recovery was pending");
       if (!this.hostTools.isBoundTo(recovered)) {
         throw new Error("OMP host tool bridge detached during recovery");