@openchambery/web 1.19.22-beta.1 → 2.0.0-beta.3

package/server/lib/session-turn-pages/session-message-projection.js

@@ -0,0 +1,281 @@
+/**
+ * OpenCode v2 SessionMessageInfo → Host `{ info, parts }` projection.
+ *
+ * Shared by the web session-turn-pages routes and the VS Code turn-page
+ * bridge so both runtimes expose the same external record contract.
+ * Pure: no I/O, no logging.
+ */
+
+/**
+ * Native SessionMessageInfo carrier fields that become `parts`.
+ * Must not remain on `info` after normalize — otherwise
+ * includeReasoning=false can strip parts while leaking content/text.
+ */
+const MESSAGE_PART_CARRIER_KEYS = new Set(['content', 'text', 'files', 'parts', 'agents', 'skills']);
+
+/**
+ * v2 session-lifecycle / control rows. OpenCode lists them alongside chat
+ * turns; projecting `type`→`role` made cold reload paint empty Assistant
+ * headers (FINAL-GATE hard reload). Align with UI session-projection-api.
+ */
+const CONTROL_MESSAGE_TYPES = new Set([
+  'idle',
+  'model-switched',
+  'agent-selected',
+  'agent-switched',
+  'location-switched',
+]);
+
+const CHAT_MESSAGE_TYPES = new Set([
+  'user',
+  'assistant',
+  'system',
+  'synthetic',
+  'compaction',
+]);
+
+const asNonEmptyString = (value) => (
+  typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined
+);
+
+const stripMessagePartCarriers = (value) => {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return value;
+  let changed = false;
+  const next = {};
+  for (const [key, field] of Object.entries(value)) {
+    if (MESSAGE_PART_CARRIER_KEYS.has(key)) {
+      changed = true;
+      continue;
+    }
+    next[key] = field;
+  }
+  return changed ? next : value;
+};
+
+/**
+ * True for v2 control rows that must never reach ChatMessage props.
+ * Accepts raw SessionMessageInfo or already-projected `{ info, parts }`.
+ */
+const isControlSessionMessage = (entry) => {
+  if (!entry || typeof entry !== 'object') return false;
+  const info = entry.info && typeof entry.info === 'object' ? entry.info : entry;
+  const type = asNonEmptyString(info.type);
+  const role = asNonEmptyString(info.role) ?? asNonEmptyString(info.clientRole);
+  if (type && CONTROL_MESSAGE_TYPES.has(type)) return true;
+  if (role && CONTROL_MESSAGE_TYPES.has(role)) return true;
+  return false;
+};
+
+/**
+ * Project SessionMessageInfo body fields into host `parts`.
+ *
+ * v2 assistants put body in `content[]`. Users put body in top-level `text`.
+ * Never expand both: the same string in `text` and `content[].text` produced
+ * duplicate text parts (FINAL-GATE follow-up cold props).
+ */
+const projectV2Parts = (entry) => {
+  if (Array.isArray(entry?.parts)) return entry.parts;
+  const messageID = typeof entry?.id === 'string' ? entry.id : '';
+  const sessionID = typeof entry?.sessionID === 'string' ? entry.sessionID : '';
+  const parts = [];
+  const content = Array.isArray(entry?.content) ? entry.content : null;
+  const hasContent = Boolean(content && content.length > 0);
+
+  if (hasContent) {
+    let textOrdinal = 0;
+    let reasoningOrdinal = 0;
+    content.forEach((item, index) => {
+      if (!item || typeof item !== 'object') return;
+      if (item.type === 'text') {
+        const partID = asNonEmptyString(item.id) || `${messageID}:text:${textOrdinal}`;
+        textOrdinal += 1;
+        parts.push({
+          id: partID,
+          sessionID,
+          messageID,
+          type: 'text',
+          text: typeof item.text === 'string' ? item.text : '',
+        });
+        return;
+      }
+      if (item.type === 'reasoning') {
+        const partID = asNonEmptyString(item.id) || `${messageID}:reasoning:${reasoningOrdinal}`;
+        reasoningOrdinal += 1;
+        parts.push({
+          id: partID,
+          sessionID,
+          messageID,
+          type: 'reasoning',
+          text: typeof item.text === 'string' ? item.text : '',
+        });
+        return;
+      }
+      if (item.type === 'tool') {
+        const partID = asNonEmptyString(item.id) || `${messageID}:tool:${index}`;
+        parts.push({
+          id: partID,
+          sessionID,
+          messageID,
+          type: 'tool',
+          tool: item.name,
+          callID: item.id,
+          state: item.state ?? {},
+        });
+      }
+    });
+  } else if (typeof entry?.text === 'string' && entry.text) {
+    // User / synthetic body when content[] is absent.
+    parts.push({
+      id: `${messageID}:text:0`,
+      sessionID,
+      messageID,
+      type: 'text',
+      text: entry.text,
+    });
+  }
+
+  if (Array.isArray(entry?.files)) {
+    entry.files.forEach((file, index) => {
+      parts.push({
+        id: `${messageID}:file:${index}`,
+        sessionID,
+        messageID,
+        type: 'file',
+        mime: file?.mime || 'application/octet-stream',
+        url: file?.uri ?? file?.url,
+        ...(file?.name ? { filename: file.name } : {}),
+      });
+    });
+  }
+  return parts;
+};
+
+/**
+ * Build clean chat `info` from a native SessionMessageInfo row.
+ * Does not spread wire carriers (`type`, `rawFinish`, `outcome`, `content`).
+ */
+const projectNativeSessionInfo = (entry, role) => {
+  const info = {
+    id: entry.id,
+    ...(asNonEmptyString(entry.sessionID) ? { sessionID: entry.sessionID } : {}),
+    role,
+    time: entry.time && typeof entry.time === 'object' ? entry.time : { created: 0 },
+  };
+
+  const agent = asNonEmptyString(entry.agent) ?? asNonEmptyString(entry.mode);
+  if (agent) info.agent = agent;
+  if (asNonEmptyString(entry.mode) && entry.mode !== agent) info.mode = entry.mode;
+
+  const model = entry.model && typeof entry.model === 'object' && !Array.isArray(entry.model)
+    ? entry.model
+    : null;
+  const modelID = asNonEmptyString(model?.id)
+    ?? asNonEmptyString(model?.modelID)
+    ?? asNonEmptyString(entry.modelID);
+  const providerID = asNonEmptyString(model?.providerID) ?? asNonEmptyString(entry.providerID);
+  const variant = asNonEmptyString(model?.variant) ?? asNonEmptyString(entry.variant);
+  if (modelID) info.modelID = modelID;
+  if (providerID) info.providerID = providerID;
+  if (variant) info.variant = variant;
+  if (modelID || providerID || variant) {
+    info.model = {
+      ...(providerID ? { providerID } : {}),
+      ...(modelID ? { modelID } : {}),
+      ...(variant ? { variant } : {}),
+    };
+  }
+
+  const finish = asNonEmptyString(entry.finish) ?? asNonEmptyString(entry.rawFinish);
+  if (finish) info.finish = finish;
+
+  if (entry.error && typeof entry.error === 'object' && !Array.isArray(entry.error)) {
+    info.error = {
+      type: asNonEmptyString(entry.error.type) ?? 'error',
+      message: typeof entry.error.message === 'string' ? entry.error.message : '',
+      ...(typeof entry.error.status === 'number' ? { status: entry.error.status } : {}),
+    };
+  }
+
+  if (typeof entry.cost === 'number' && Number.isFinite(entry.cost)) info.cost = entry.cost;
+  if (entry.tokens && typeof entry.tokens === 'object' && !Array.isArray(entry.tokens)) {
+    info.tokens = entry.tokens;
+  }
+  if (asNonEmptyString(entry.parentID)) info.parentID = entry.parentID;
+  if (entry.summary != null) info.summary = entry.summary;
+  if (role === 'compaction') info.clientRole = 'compaction';
+  if (role === 'system') info.clientRole = 'system';
+  if (role === 'synthetic') {
+    // Synthetic rows render as user-authored system injections in the UI.
+    info.role = 'user';
+    info.clientRole = 'system';
+  }
+
+  return info;
+};
+
+/**
+ * Project SessionMessageInfo (or an already-projected {info, parts} row)
+ * into the host HTTP DTO. External route contract stays {info, parts}.
+ * Returns `null` for v2 control rows (idle / model-switched / …).
+ */
+export const projectSessionMessage = (entry) => {
+  if (isControlSessionMessage(entry)) return null;
+
+  if (entry && typeof entry === 'object' && entry.info && typeof entry.info === 'object') {
+    if (isControlSessionMessage(entry.info)) return null;
+    const stripped = stripMessagePartCarriers(entry.info);
+    // Already-projected chat rows: keep shape, drop leftover wire carriers.
+    const info = { ...stripped };
+    delete info.type;
+    delete info.rawFinish;
+    delete info.outcome;
+    // Normalize nested model.id → modelID when a prior path left wire shape.
+    if (info.model && typeof info.model === 'object' && !Array.isArray(info.model)) {
+      const modelID = asNonEmptyString(info.model.modelID)
+        ?? asNonEmptyString(info.model.id)
+        ?? asNonEmptyString(info.modelID);
+      const providerID = asNonEmptyString(info.model.providerID) ?? asNonEmptyString(info.providerID);
+      const variant = asNonEmptyString(info.model.variant) ?? asNonEmptyString(info.variant);
+      if (modelID) info.modelID = modelID;
+      if (providerID) info.providerID = providerID;
+      info.model = {
+        ...(providerID ? { providerID } : {}),
+        ...(modelID ? { modelID } : {}),
+        ...(variant ? { variant } : {}),
+      };
+    }
+    const role = asNonEmptyString(info.role) ?? asNonEmptyString(info.clientRole);
+    if (!role || CONTROL_MESSAGE_TYPES.has(role)) return null;
+    return {
+      info,
+      parts: Array.isArray(entry.parts) ? entry.parts : [],
+    };
+  }
+
+  if (!entry || typeof entry !== 'object' || typeof entry.id !== 'string' || entry.id.length === 0) {
+    return entry == null ? null : entry;
+  }
+
+  const type = asNonEmptyString(entry.type);
+  if (type && CONTROL_MESSAGE_TYPES.has(type)) return null;
+  if (type && !CHAT_MESSAGE_TYPES.has(type)) return null;
+
+  let role;
+  if (type === 'user' || type === 'assistant' || type === 'system' || type === 'compaction' || type === 'synthetic') {
+    role = type;
+  } else if (asNonEmptyString(entry.role) === 'user' || asNonEmptyString(entry.role) === 'assistant') {
+    role = entry.role;
+  } else {
+    return null;
+  }
+
+  return {
+    info: projectNativeSessionInfo(entry, role),
+    parts: projectV2Parts(entry),
+  };
+};
+
+export const projectSessionMessageRecords = (records) =>
+  (Array.isArray(records) ? records : [])
+    .map(projectSessionMessage)
+    .filter((record) => record != null && typeof record === 'object' && record.info);

package/server/lib/small-model/DOCUMENTATION.md

@@ -1,142 +1,103 @@
 # Small Model
 
-Server-side LLM calls that reuse the user's existing OpenCode provider logins.
-Dedicated adapters still read `~/.local/share/opencode/auth.json`. Plugin and
-other non-dedicated providers are listed from OpenCode's connected catalog
-(`provider.list()` ∩ `config.providers`, same as `loadConnectedCatalog`).
-OpenCode uses a "small model" internally
+Server-side utility LLM calls (commit messages, session titles, goal audits,
+scheduled-task distill, TTS summaries, PR descriptions) routed through the
+user's connected OpenCode providers. OpenCode uses a "small model" internally
 (titles, summaries) but does not expose it through the SDK or plugins — this
-module replicates that mechanism as an OpenChamber runtime API.
+module replicates the selection as an OpenChamber runtime API and sends every
+OpenCode-backed call through the Assistant LLM gateway
+(`llm/completions.js` `createChatCompletion`).
 
 ## Security boundary
 
-Credentials never leave the server process. The client sends only a prompt;
-auth resolution, OAuth refresh, and provider dispatch all happen server-side
-(either in dedicated adapters or inside the OpenCode runtime for the session
-path). Routes live under `/api/*` and are gated by the ui-auth middleware like
-every other runtime API.
+Credentials never leave OpenCode. This module does not read `auth.json`, does
+not refresh OAuth tokens, and does not call provider APIs directly. The client
+sends only a prompt; model resolution happens server-side and generation runs
+inside the OpenCode runtime. The only direct HTTP call is the user-configured
+custom Summary AI endpoint, with the token the user saved for it. Routes live
+under `/api/*` and are gated by the ui-auth middleware like every other
+runtime API.
 
 ## Files
 
 - `index.js` — `createSmallModelService(dependencies)` factory. Production
   obtains a single lazy instance from `server/index.js` (`getSmallModelService`)
   and injects it into feature routes, session assist/title/goal, and scheduled
-  tasks. Tests may call the factory with a mock `getModelCatalog`. Returns
-  `stop()` to remove the lazy temp directory used by the session path (wired
-  from `server/index.js` `stop()`).
-- `opencode-session.js` — temporary OpenCode session path for non-dedicated
-  providers. Lazily creates `mkdtemp('openchamber-smallmodel-')` with a hidden
-  deny-all agent, then create → archive → `prompt_async` → poll idle → read
-  assistant text → best-effort `session.delete`.
-- `resolve.js` — model selection, mirroring OpenCode's `getSmallModel` chain:
+  tasks. Tests may inject `getModelCatalog`, `openCodeClientFactory`, and
+  `createChatCompletion`. The host also injects `persistSessionMetadata` /
+  `onSystemSessionPersisted` so gateway throwaway sessions stay out of the
+  sidebar index.
+- `resolve.js` — model selection over the connected catalog only, mirroring
+  OpenCode's `getSmallModel` chain:
   0. OpenChamber's own settings override (Settings → Sessions → Small Model):
      when `smallModelUseDefault` is `false`, `smallModelOverride`
      (`provider/model`) outranks everything below. Sanitized in
      `settings-helpers.js` (server), `persistence.ts` (client), and
      `bridge-settings-runtime.ts` (VS Code).
   1. `small_model` from the merged OpenCode config layers (`provider/model`).
-  2. Family-priority scan (`gemini-flash` → `gpt-nano` → `claude-haiku`)
-     **within the session's provider first** (`preferredProviderID`, like
-     OpenCode resolves within the current provider), then keyword tiers on that
-     provider's catalog, then the session model, then other authenticated
-     providers' catalog families, then keyword+cost default across providers,
-     then the four minimal hardcoded candidates.
-  3. GitHub Copilot hidden utility models (`gpt-*-nano/mini`) — these never
-     appear in the catalog, so they participate as the `gpt-nano` family entry
-     and as a final utility fallback.
-  4. Session model (`preferredModelID`) when the session provider has auth but
-     no small family/keyword match.
-  Auth-type constraints for the four dedicated providers: OpenAI OAuth →
-  hardcoded codex-small; OpenAI API key → catalog families; Anthropic/Google
-  require API keys; Copilot supports auth aliases (`copilot` / `github-copilot`).
-
-  **Default ranking (no explicit config):** candidates are catalog models from
-  usable auth entries. Keyword tiers (tokenized id / known family):
-  `flash` → `nano` → `haiku` → `mini` → `lite` → `turbo` → `instant` →
-  `small` → `chat`. Within a tier: `cost.input` ascending (missing cost last),
-  then newer `release_date`.
+  2. When the session's provider (`preferredProviderID`) is in the connected
+     catalog: family-priority scan (`gemini-flash` → `gpt-nano` →
+     `claude-haiku`), then keyword tiers on that provider, then the session
+     model itself.
+  3. Otherwise the other connected providers: family scan, then keyword+cost
+     default across providers.
+  4. Nothing connected → `null` (routes answer 404).
+
+  **Keyword ranking:** tokenized id / known family tiers `flash` → `nano` →
+  `haiku` → `mini` → `lite` → `turbo` → `instant` → `small` → `chat`. Within a
+  tier: `cost.input` ascending (missing cost last), then newer `release_date`.
 - Input clamp: the prompt is truncated to the resolved model's catalog
   `limit.context` (minus an output reserve, ~4 chars/token estimate;
-  conservative default when the model is not in the catalog). Truncation is
-  reported as `inputTruncated: true` in the response.
-- `call.js` — dedicated wire formats and per-provider auth for the four
-  adapters (replicating OpenCode plugin auth loaders):
-  - **GitHub Copilot**: OpenAI-compatible `/chat/completions` on
-    `https://api.githubcopilot.com` (or `copilot-api.<enterprise>`) with the
-    stored device-OAuth token as the bearer — no token exchange, no expiry.
-  - **OpenAI OAuth (ChatGPT plan)**: streaming Responses API on
-    `https://chatgpt.com/backend-api/codex/responses` with
-    `ChatGPT-Account-Id`; expired tokens are refreshed against
-    `auth.openai.com` (single-flight) and written back to `auth.json`.
-  - **Anthropic** (`type: api`): `/v1/messages` with `x-api-key`.
-  - **Google** (`type: api`): `generateContent` with `x-goog-api-key`.
-  - Custom Summary AI mode: OpenAI-compatible `/chat/completions` against the
-    user-supplied base URL + token.
-  Generic `api.url` chat-completions for arbitrary providers is **not** used
-  for dispatch anymore (plugin providers need runtime rewrite); those providers
-  take the OpenCode session path instead. The helper remains in `call.js` for
-  the dedicated adapters and custom mode.
+  conservative default when the model has no limit or for the custom API).
+  Truncation is reported as `inputTruncated: true` in the response.
 - `catalog.js` — directory-scoped provider catalog via official
-  `@opencode-ai/sdk/v2` `client.config.providers()`. Base URL/auth come from
-  the composition root (`buildOpenCodeUrl` / `getOpenCodeAuthHeaders`).
-  Per-directory short TTL (~30s) with single-flight. OpenCode failure returns
-  an **explicit** minimal fallback catalog (OpenAI OAuth / GitHub Copilot /
-  Google API / Anthropic API candidates only) — never an authoritative empty
-  map. Raw small-model fields kept: `family`, `release_date`, `limit`,
+  `@opencode/client` `provider.list` + `model.list`. Model ids are `ModelInfo.id`
+  (external generate/session id). `ModelInfo.modelID` is internal and is not
+  preferred. v2 `cost` arrays keep the base tier's `input` / `output`. Base
+  URL/auth come from the composition root (`buildOpenCodeUrl` /
+  `getOpenCodeAuthHeaders`); the client's custom `fetch` must forward the
+  `init` argument (headers, method, body) or OpenCode answers 401.
+  Per-directory short TTL (~30s) with single-flight. OpenCode failure rejects
+  with `statusCode: 502` and is not cached — never a substitute or empty
+  catalog. Raw small-model fields kept: `family`, `release_date`, `limit`,
   `cost.input` / `cost.output`, `model.api.url`, provider `name`. Client-safe
   provider catalog projection remains in `opencode/provider-catalog.js` for
   `/api/config/catalog/providers`.
-- `routes.js` — `GET /api/small-model` (resolution preview),
+- `routes.js` — `GET /api/small-model` (resolution preview; query
+  `directory`, `providerID`, `modelID`),
   `POST /api/small-model/generate` (`{ prompt, system?, maxOutputTokens?,
-  model?, directory? }` → `{ text, providerID, modelID, source }`),
-  `POST /api/small-model/test` (custom OpenAI-compatible probe → `{ ok, code? }`),
-  and `POST /api/small-model/custom-models` (best-effort `{baseURL}/models`
-  suggestions → `{ models }`). The preview response includes `callableModels`,
-  the Provider/model allowlist consumed by Settings → Summary AI. Callable
-  lists receive the same `directory` as describe/generate so they share the
-  directory catalog.
-- `custom-api.js` — custom Summary AI probe and model listing. Failure codes
-  are `incomplete`, `token` (401/403), `model` (404 / `model_not_found`), or
-  `baseURL` (network / non-OpenAI-compatible). Tokens are never logged.
+  model?, directory?, preferredProviderID?, preferredModelID?,
+  restrictToPreferredProvider?, purpose? }` → `{ text, providerID, modelID,
+  source }`), `POST /api/small-model/test` (custom OpenAI-compatible probe →
+  `{ ok, code? }`), and `POST /api/small-model/custom-models` (best-effort
+  `{baseURL}/models` suggestions → `{ models }`).
+- `custom-api.js` — custom Summary AI generation
+  (`generateCustomSummaryText`: OpenAI-compatible `/chat/completions`), probe,
+  and model listing. Probe failure codes are `incomplete`, `token` (401/403),
+  `model` (404 / `model_not_found`), or `baseURL` (network /
+  non-OpenAI-compatible). Reasoning-only or empty replies are errors, never
+  blank success. Tokens are never logged.
 
 ## Dispatch
 
-| Mode / provider | Path |
+| Mode / purpose | Path |
 |---|---|
-| Summary AI `custom` | Direct OpenAI-compatible call (`call.js`) |
-| `openai` / `anthropic` / `google` / `github-copilot` with usable dedicated auth | Direct dedicated adapter (`call.js`) |
-| Any other usable auth + catalog model (plugin providers, …) | Temporary OpenCode session (`opencode-session.js`) |
-
-Callable Settings lists:
-- Dedicated adapters (`openai`, `anthropic`, `google`, `github-copilot`) stay
-  gated by usable `auth.json` entries and the existing small-model whitelist
-  (OpenAI OAuth → `gpt-5.4-mini`; Copilot → `gpt-5.4-nano`).
-- Every other provider is taken from the connected catalog (plugin / env
-  credentials that OpenCode reports as connected), intersected with catalog
-  model ids. No `api.url` gate. If the connected catalog request fails, the
-  list falls back to usable `auth.json` plugin entries rather than pretending
-  none exist.
-Copilot auth aliases merge to `github-copilot`.
-
-## OpenCode session lifecycle
-
-1. Lazy singleton temp directory under `os.tmpdir()` /
-   `openchamber-smallmodel-*` with `.opencode/agent/openchamber-smallmodel.md`
-   (`hidden: true`, `permissions: [{ action: "*", resource: "*", effect: deny }]`).
-2. `session.create` with title `[small-model] <purpose>`, agent name, and
-   `metadata.openchamber.smallModel = { purpose }` (sidebar invisibility also
-   depends on a parallel filter lane for that marker).
-3. Immediate `session.update({ time: { archived } })` (same pattern as
-   assistants / scheduled tasks) so ordinary lists never flash the session.
-4. `session.promptAsync` with `{ model: { providerID, modelID }, agent, system?,
-   parts: [{ type: 'text', text, synthetic: false }] }`.
-5. Poll `session.status` + `session.messages` until idle assistant completed
-   (budget `SESSION_SETTLE_TIMEOUT_MS` = 60s). Network / timeout / empty text
-   all throw with context — never an empty success.
-6. `finally`: best-effort `session.delete`. Delete failure is logged and does
-   not erase a successful text result.
-7. Server `stop()` calls `smallModelServiceInstance.stop()` to `rm` the temp
-   directory.
+| Summary AI `custom` | User's OpenAI-compatible endpoint (`custom-api.js`) |
+| Summary AI provider mode (`commit` / `session-title`) | Saved model, else OpenCode `model.default` → LLM gateway |
+| Every other purpose | `resolve.js` over the connected catalog → LLM gateway |
+
+The LLM gateway checks the model against the connected catalog (`no_provider`
+otherwise) and runs `session.generate` in a throwaway session owned by the
+hidden deny-all `openchamber-text` agent in the shared LLM temp directory
+(see `llm/DOCUMENTATION.md`). One model call with the session's provider
+context, no tool loop, no messages written; the session is removed afterwards.
+`restrictToPreferredProvider` forbids resolution from switching away from the
+session's provider unless the model came from an explicit choice (settings
+override, OpenCode config, or request `model`).
+
+Summary AI provider mode never uses small-model resolution. A saved model that
+is not in the connected catalog fails with the gateway's `no_provider` error
+instead of silently switching models.
 
 ### Skills / clean context boundary
 
@@ -146,53 +107,47 @@ by `Permission.evaluate("skill", skill.id, agent.permissions)` — a deny-all
 `action: "*"` rule therefore excludes every skill from the available list, so
 the guidance renders as "No skills are currently available." Skill **body**
 content is only injected when the skill tool runs; deny-all also blocks that
-tool. There is no separate agent/directory flag to disable skill guidance
-beyond permissions. Global `~/.agents/skills` may still be *discovered* by the
-OpenCode instance, but they are not listed or loadable under this agent.
-Project-level skills are absent because the temp directory has none.
+tool. Global `~/.agents/skills` may still be *discovered* by the OpenCode
+instance, but they are not listed or loadable under this agent. Project-level
+skills are absent because the temp directory has none.
 
 ## Registration
 
 `server/index.js` creates one lazy `getSmallModelService` and injects
-`{ buildOpenCodeUrl, getOpenCodeAuthHeaders }` into the factory (and into
-session assist/title/goal, scheduled tasks, and `createFeatureRoutesRuntime`).
-Feature routes no longer import `small-model/index.js` top-level exports
-directly.
+`{ buildOpenCodeUrl, getOpenCodeAuthHeaders, persistSessionMetadata,
+onSystemSessionPersisted }` into the factory (and the service into session
+assist/title/goal, scheduled tasks, and `createFeatureRoutesRuntime`). Server
+`stop()` calls `stopLlmTempDirectory()` to remove the shared LLM temp root.
 
 ## Summary AI settings
 
 Commit-message generation and session-title refresh pass `purpose: 'commit'`
 or `purpose: 'session-title'` to `generateSmallModelText`. Settings → Summary
-AI can select an authenticated OpenCode provider/model or a custom
-OpenAI-compatible `baseURL`, model ID, and API token. Custom mode stores the
-model id in `summaryCustomModelID` (legacy `summaryModelID` is still read when
-that field is absent). Custom mode is enabled only when base URL, model ID,
-and API token are all present. A custom token stays in the server settings
-file; settings read responses expose only `hasSummaryCustomAPIToken`. Settings
-can probe the custom API (`POST /api/small-model/test`) and load model
-suggestions from `{baseURL}/models` without blocking free-form entry.
+AI selects an OpenCode provider/model with the shared `ModelSelector` and the
+same connected provider list as the chat model picker and Settings → Defaults
+(`useConfigStore` providers; no allowlist), or a custom OpenAI-compatible
+`baseURL`, model ID, and API token. Custom mode stores the model id in
+`summaryCustomModelID` (legacy `summaryModelID` is still read when that field
+is absent). Custom mode is enabled only when base URL, model ID, and API token
+are all present. A custom token stays in the server settings file; settings
+read responses expose only `hasSummaryCustomAPIToken`. Settings can probe the
+custom API (`POST /api/small-model/test`) and load model suggestions from
+`{baseURL}/models` without blocking free-form entry.
 
 `summaryCommitPrompt` and `summarySessionTitlePrompt` replace the respective
-call's system prompt when non-empty. With no persisted provider choice, summary
-calls use the same effective default shown by Settings: authenticated OpenAI
-when available, otherwise the first callable provider/model. This effective
-default remains authoritative when the active session uses another provider.
+call's system prompt when non-empty. With no persisted provider choice (the
+picker shows "OpenCode default model"), summary calls use OpenCode's
+`model.default`. No default model is an explicit 404, not a fallback guess.
+The chosen or default model stays authoritative when the active session uses
+another provider.
 
 ## Known limitations
 
-- OpenCode's free models (`opencode/big-pickle`, `*-free`) work without a
-  token only through OpenCode's own server — direct calls are rejected, and
-  piggybacking on their subsidized infra is out of bounds by design. Every
-  resolution step therefore requires a usable auth entry for the provider:
-  a session on an unauthenticated `opencode` provider falls through to the
-  global scan (or a clean 404 on a vanilla setup with no logins).
-
-- Anthropic OAuth (Claude Pro/Max) entries are not supported on the dedicated
-  adapter — OpenCode itself keeps those outside `auth.json` in this generation;
-  only `type: api` keys work for Anthropic direct calls. Plugin / other auth
-  shapes that OpenCode can already run may still succeed via the session path.
-- Responses from the codex backend are collected from the SSE stream; the
-  endpoint itself is non-streaming by design (small utility calls).
-- The server never requests models.dev. When OpenCode is down, only the four
-  minimal hardcoded candidates remain available for resolution; session-path
-  generation still requires a live OpenCode runtime.
+- Provider behavior is OpenCode's: whatever fails in a normal OpenCode session
+  fails here with the same upstream error (for example OpenCode's free
+  `opencode` tier rejecting non-session utility use, a plugin provider
+  returning an unexpected status, or an invalid provider key).
+- The first call after server start (or after the temp root is recreated)
+  waits for OpenCode to load the fresh location's config; agent verification
+  polls up to 5s, so cold calls take noticeably longer than warm ones.
+- `session.generate` returns a full reply; utility calls have no streaming.