@vincemakes/kiso-code 0.30.0 → 0.31.1

package/dist/chat.js

@@ -11,7 +11,7 @@ import { canonicalTargetPath, shellProgressPath } from "@vincemakes/kiso-tools-n
 import { canonicalizeUsage } from "@vincemakes/kiso-runtime";
 import { canonicalizeUsageForModel, requestBudget } from "@vincemakes/kiso-runtime/internal";
 import { dispatch } from "./dispatch.js";
-import { agentModel, body, bodyLog, configuredWindow, dock } from "./state.js";
+import { agentBaseUrl, agentModel, body, bodyLog, configuredWindow, dock } from "./state.js";
 import { attachImages } from "./attachments.js";
 import { lookupModelMetadata } from "@vincemakes/kiso-runtime/internal";
 import { addDontAskAgainRule, askPanel, fixHintFor, pendingAsk, resolveUncertains } from "./trust-ui.js";
@@ -47,8 +47,10 @@ export function contextWindowTokens() {
     // window (and the microcompact threshold derived from it) without an
     // env var. agentModel is the same live binding the status row shows;
     // an unknown model keeps the 200k default — the registry never
-    // guesses, so neither do we.
-    const known = lookupModelMetadata(agentModel)?.capabilities.contextWindow;
+    // guesses, so neither do we. OR-1: the ENDPOINT narrows the row —
+    // gpt-5.5 is 1,050,000 at the first-party API and 272,000 at the
+    // subscription backend; the two are set together (setAgentModel).
+    const known = lookupModelMetadata(agentModel, agentBaseUrl)?.capabilities.contextWindow;
     if (known !== undefined && known !== null)
         return known;
     return DEFAULT_CONTEXT_WINDOW;
@@ -67,6 +69,14 @@ export function estimateCtxRatio(session) {
  *  their continuation envelopes, the output reserve when known) over the
  *  window. Still ~ (chars/4). The auto-compact policy does NOT read this
  *  (see autoCompactRatio) — moving the policy's number is A1b's. */
+/** OR-8 (owner, 2026-09-09): the status row names the effort next to the
+ *  model — `gpt-5.6-sol · xhigh` — whenever the live binding carries one;
+ *  the provider's default shows as the bare model, as before. The effort
+ *  is the session's own (the durable profile), never the CLI's memory. */
+export function statusModelLabel(session) {
+    const effort = session.reasoning?.effort;
+    return effort !== undefined && effort !== "default" ? `${agentModel} · ${effort}` : agentModel;
+}
 export function displayCtxRatio(session) {
     return requestBudget(session.requestParts(), contextWindowTokens()).ratio;
 }
@@ -110,8 +120,12 @@ export function usageFromEvent(route, ev, prevTotal,
 // metadata entry (an unpriced model shows null, never a route-table
 // guess); omitted, the legacy route-keyed path stands (old callers,
 // old tests, unchanged bytes).
-model) {
-    const c = model === undefined ? canonicalizeUsage(route ?? "adapter", ev) : canonicalizeUsageForModel(model, undefined, route ?? "adapter", ev);
+model, 
+// OR-1: the live ENDPOINT — the same model id is priced at the
+// first-party API and unpriced at the subscription backend; the
+// session hands it over next to `provider` (one binding, one row).
+endpoint) {
+    const c = model === undefined ? canonicalizeUsage(route ?? "adapter", ev) : canonicalizeUsageForModel(model, endpoint, route ?? "adapter", ev);
     const total = c.input + c.cacheRead + (c.cacheWrite ?? 0);
     let missed = null;
     // R-C item 4: min(prevTotal, total) is the part that could have been
@@ -121,7 +135,24 @@ model) {
         const m = Math.min(prevTotal, total) - c.cacheRead;
         missed = m > CACHE_MISS_FLOOR ? m : null;
     }
-    return { usage: { in: c.input, out: c.output, cache: c.cacheRead, known: ev.known }, total, missed, costUsd: c.costUsd };
+    // OR-10 (owner, 2026-09-09): a backend whose cache figure cannot be
+    // observed has no cache figure. The ChatGPT backend answers
+    // `cached_tokens` 0 to a third-party client on every request, so its 0
+    // and "not reported" are one value, and a CH 0% built on it claims a
+    // measurement that never happened. The registry ROW says which
+    // endpoints these are; the status row, the recap and the usage line
+    // already render a null cache as nothing ("an unmeasured cache is not
+    // a 0% cache"), so this is one decision at the one place the endpoint
+    // is known. The trace ledger is written by the runtime from the
+    // backend's own words and keeps its 0 — the display's rule, not the
+    // record's.
+    const unobservable = model !== undefined && lookupModelMetadata(model, endpoint)?.capabilities.promptCaching === "unobservable";
+    return {
+        usage: { in: c.input, out: c.output, cache: unobservable ? null : c.cacheRead, known: ev.known },
+        total,
+        missed: unobservable ? null : missed,
+        costUsd: c.costUsd,
+    };
 }
 /** v2b: the spinner merged into the STATUS BAR (the v2a standalone glyph
  *  is gone) — docked only, 200ms rotation between the request and the
@@ -636,7 +667,7 @@ submitTurn) {
                     body.notice("stream interrupted — the draft above is abandoned");
                     break;
                 case "usage": {
-                    const delta = usageFromEvent(session.provider, ev, prevTotal, agentModel);
+                    const delta = usageFromEvent(session.provider, ev, prevTotal, agentModel, session.baseUrl);
                     usage = delta.usage;
                     prevTotal = delta.total;
                     missed = delta.missed;
@@ -785,6 +816,17 @@ submitTurn) {
                         // is a sentence addressed to a human; it needs no edge.
                         body.notice('answer truncated at max_tokens — say "continue" to finish');
                     }
+                    // OR-5 (the ChatGPT real leg, 2026-09-09): a run that ended in an
+                    // ERROR terminal printed nothing but the recap — the vendor's 400
+                    // lived in the durable log alone and the turn read as "took 1s".
+                    // A failure that fires silently is indistinguishable from a
+                    // crash, the one thing this product must never be: the mapped
+                    // error is named here, before the recap, code and status and the
+                    // provider's own words.
+                    if (ev.outcome.kind === "error") {
+                        const e = ev.outcome.error;
+                        body.notice(`run failed — ${e.code}${e.status !== undefined ? ` ${e.status}` : ""}${e.retryable ? " (retryable)" : ""}: ${escapeTerminal(e.message)}`);
+                    }
                     bodyLog(renderRecap({
                         seconds: Math.round((Date.now() - turnStart) / 1000),
                         // R3g: the work terms are NOT passed — the fold line
@@ -1077,7 +1119,7 @@ export async function chat(session, faux, input, autoCompact, nav) {
         // TUI2-R1 (E): the meter rides the idle row — both fields omitted
         // when unknown, so a session that has not called the model paints
         // exactly the pre-round row.
-        dock.setStatus(idleStatus(getMode() === "plan" ? "plan (read-only)" : getMode(), agentModel, displayCtxRatio(session), {
+        dock.setStatus(idleStatus(getMode() === "plan" ? "plan (read-only)" : getMode(), statusModelLabel(session), displayCtxRatio(session), {
             cacheHitPct: cacheHitPct(runUsage),
             costUsd: spentUsd,
         }));

package/dist/config.d.ts

@@ -8,8 +8,9 @@
  *
  * Schema v1:
  *   model?: string   — a profile NAME (models.<name>) or "provider/model"
- *                      direct write (provider: "openai-compat" | "anthropic")
- *   models?: { [name]: { kind: "openai-compat"|"anthropic",
+ *                      direct write (provider: "openai-compat" |
+ *                      "anthropic" | "openai-responses")
+ *   models?: { [name]: { kind: "openai-compat"|"anthropic"|"openai-responses",
  *                        baseUrl?: string, model: string, apiKeyEnv: string } }
  *   mode?: "manual"|"default"|"accept-edits"|"plan"|"bypass"
  *   contextWindow?: number      — tokens
@@ -27,7 +28,11 @@
  * ignored (forward compatibility).
  */
 import type { Mode } from "./mode.js";
-export type ProfileKind = "openai-compat" | "anthropic";
+/** OR-1: `openai-responses` is a DIALECT, not a vendor — the same kind
+ *  drives the first-party Responses API and the ChatGPT subscription
+ *  backend, and which one it is follows the profile's baseUrl (and so
+ *  the credential it resolves to). */
+export type ProfileKind = "openai-compat" | "anthropic" | "openai-responses";
 export interface ModelProfile {
     readonly kind: ProfileKind;
     readonly baseUrl?: string;
@@ -82,13 +87,44 @@ export declare function loadUserConfig(): KisoConfig | null;
 export declare function loadProjectConfig(cwd: string, trusted: boolean): KisoConfig | null;
 /** Merge: project wins over user (each layer's own keys only). */
 export declare function mergeConfigs(user: KisoConfig | null, project: KisoConfig | null): KisoConfig;
-/** A profile is available when its apiKeyEnv var is set (the key exists). */
+/** What a profile's sign-in actually IS. The two shapes are not
+ *  interchangeable: an API key is a string an adapter holds, an OAuth
+ *  sign-in is a token that expires and must be re-resolved per request. */
+export type ProfileAuth = {
+    readonly type: "api-key";
+    readonly apiKey: string;
+    readonly source: "store" | "env" | "none";
+} | {
+    readonly type: "oauth";
+    readonly providerId: string;
+};
+/** Where a profile's sign-in comes from, or why it has none. The sign-in
+ *  plan's resolve rule: a stored credential OWNS the provider (an
+ *  unusable stored one is an error, never a silent fall back to env);
+ *  with nothing stored, the profile's env var applies; a keyless profile
+ *  (no apiKeyEnv — PH-1c, finding PH-F19) is an unauthenticated endpoint.
+ *
+ *  OR-1: a stored OAuth credential is USABLE only by an adapter that can
+ *  drive one, which today is the Responses adapter's ChatGPT target. For
+ *  every other kind it stays the same loud refusal it has always been —
+ *  the caller is told which sign-in it has and which one it needs. */
+export declare function authForProfile(name: string, p: ModelProfile): ProfileAuth;
+/** The reason a profile is unavailable, for the surfaces that print it. */
+export declare function unavailableReason(name: string, p: ModelProfile): string;
+/** A profile is available when a sign-in resolves for it — of EITHER
+ *  shape: an OAuth-only profile is available, and calling the key-only
+ *  resolver here would have declared it broken. */
 export declare function profileAvailable(p: ModelProfile): boolean;
-/** The resolved runtime model — what the adapter is built from. */
+/** The resolved runtime model — what the adapter is built from. Exactly
+ *  one of the two sign-in fields is set: an OAuth profile has no key to
+ *  hand over, and the caller must build the adapter from the token thunk
+ *  instead (the compiler enforces the branch — `apiKey` is optional). */
 export interface ResolvedModel {
     readonly name: string;
     readonly profile: ModelProfile;
-    readonly apiKey: string;
+    readonly apiKey?: string;
+    /** OR-1: the provider whose stored OAuth sign-in this profile uses. */
+    readonly oauthProviderId?: string;
 }
 /** "provider/model" direct write → a profile. */
 export declare function directWriteProfile(value: string): ModelProfile | null;

package/dist/config.js

@@ -8,8 +8,9 @@
  *
  * Schema v1:
  *   model?: string   — a profile NAME (models.<name>) or "provider/model"
- *                      direct write (provider: "openai-compat" | "anthropic")
- *   models?: { [name]: { kind: "openai-compat"|"anthropic",
+ *                      direct write (provider: "openai-compat" |
+ *                      "anthropic" | "openai-responses")
+ *   models?: { [name]: { kind: "openai-compat"|"anthropic"|"openai-responses",
  *                        baseUrl?: string, model: string, apiKeyEnv: string } }
  *   mode?: "manual"|"default"|"accept-edits"|"plan"|"bypass"
  *   contextWindow?: number      — tokens
@@ -29,7 +30,9 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { kisoHome } from "./state.js";
-const KINDS = ["openai-compat", "anthropic"];
+import { AuthError, getCredential, providerIdOf } from "./auth/credentials.js";
+import { BUILTIN_MANIFESTS } from "@vincemakes/kiso-runtime/internal";
+const KINDS = ["openai-compat", "anthropic", "openai-responses"];
 const MODES_LIST = ["manual", "default", "accept-edits", "plan", "bypass"];
 export class ConfigError extends Error {
 }
@@ -177,11 +180,81 @@ export function mergeConfigs(user, project) {
         ...(u.checks !== undefined || p.checks !== undefined ? { checks: { ...(u.checks ?? {}), ...(p.checks ?? {}) } } : {}),
     };
 }
-/** A profile is available when its apiKeyEnv var is set (the key exists). */
+/** Where a profile's sign-in comes from, or why it has none. The sign-in
+ *  plan's resolve rule: a stored credential OWNS the provider (an
+ *  unusable stored one is an error, never a silent fall back to env);
+ *  with nothing stored, the profile's env var applies; a keyless profile
+ *  (no apiKeyEnv — PH-1c, finding PH-F19) is an unauthenticated endpoint.
+ *
+ *  OR-1: a stored OAuth credential is USABLE only by an adapter that can
+ *  drive one, which today is the Responses adapter's ChatGPT target. For
+ *  every other kind it stays the same loud refusal it has always been —
+ *  the caller is told which sign-in it has and which one it needs. */
+export function authForProfile(name, p) {
+    const providerId = providerIdOf(p.kind, p.baseUrl);
+    if (providerId !== null) {
+        let stored;
+        try {
+            stored = getCredential(providerId);
+        }
+        catch (err) {
+            if (err instanceof AuthError)
+                throw new ConfigError(`model ${name}: ${err.message}`);
+            throw err;
+        }
+        if (stored !== undefined) {
+            if (stored.type === "api-key")
+                return { type: "api-key", apiKey: stored.key, source: "store" };
+            if (p.kind === "openai-responses")
+                return { type: "oauth", providerId };
+            throw new ConfigError(`model ${name}: signed in to ${providerId} with OAuth, but this profile's adapter needs an API key — run \`kiso login ${providerId}\` with a key, or \`kiso logout ${providerId}\` to use the env var ${p.apiKeyEnv ?? "(none configured)"}`);
+        }
+    }
+    // OR-2 (2026-09-09): a provider whose manifest takes NO API key (the ChatGPT
+    // backend: authMethods ["oauth"]) is never an "unauthenticated endpoint" —
+    // with nothing stored it is a profile waiting for its sign-in. Without this
+    // the keyless rule below handed it a placeholder key, `/model` said
+    // "available", and the adapter (an apiKey selects the first-party target)
+    // would have sent an unauthenticated request to the wrong URL.
+    if (providerId !== null && !manifestTakesKey(providerId)) {
+        throw new ConfigError(`model ${name}: unavailable — not signed in: run \`kiso login ${providerId}\` (this provider takes no API key)`);
+    }
+    if (p.apiKeyEnv === undefined)
+        return { type: "api-key", apiKey: "none", source: "none" };
+    const fromEnv = process.env[p.apiKeyEnv];
+    if (fromEnv !== undefined)
+        return { type: "api-key", apiKey: fromEnv, source: "env" };
+    const hint = providerId !== null ? `run \`kiso login ${providerId}\` or set the env var ${p.apiKeyEnv}` : `set the env var ${p.apiKeyEnv}`;
+    throw new ConfigError(`model ${name}: unavailable — no credential: ${hint} (configs never store keys, only the env-var name)`);
+}
+/** OR-2: does the provider's manifest admit an API key (or no auth at all)?
+ *  An unknown id answers yes — the keyless-endpoint rule stays for custom
+ *  origins; only a manifest that says OAuth-only takes the sign-in path. */
+function manifestTakesKey(providerId) {
+    const m = BUILTIN_MANIFESTS.find((x) => x.id === providerId);
+    return m === undefined || m.authMethods.includes("api-key") || m.authMethods.includes("none");
+}
+/** The reason a profile is unavailable, for the surfaces that print it. */
+export function unavailableReason(name, p) {
+    try {
+        authForProfile(name, p);
+        return "";
+    }
+    catch (err) {
+        return err instanceof Error ? err.message : String(err);
+    }
+}
+/** A profile is available when a sign-in resolves for it — of EITHER
+ *  shape: an OAuth-only profile is available, and calling the key-only
+ *  resolver here would have declared it broken. */
 export function profileAvailable(p) {
-    // PH-1c (finding PH-F19): a keyless profile (no apiKeyEnv) is an
-    // unauthenticated endpoint — always available.
-    return p.apiKeyEnv === undefined || process.env[p.apiKeyEnv] !== undefined;
+    try {
+        authForProfile("?", p);
+        return true;
+    }
+    catch {
+        return false;
+    }
 }
 /** "provider/model" direct write → a profile. */
 export function directWriteProfile(value) {
@@ -189,11 +262,15 @@ export function directWriteProfile(value) {
     if (slash <= 0 || slash === value.length - 1)
         return null;
     const kind = value.slice(0, slash);
-    if (kind !== "openai-compat" && kind !== "anthropic")
+    if (kind !== "openai-compat" && kind !== "anthropic" && kind !== "openai-responses")
         return null;
     return {
         kind,
         model: value.slice(slash + 1),
+        // OR-1: a direct-write `openai-responses/…` names no baseUrl, so it
+        // is the FIRST-PARTY target and its env var is OpenAI's. The
+        // ChatGPT backend needs a baseUrl and a stored sign-in, which is a
+        // configured profile's job, not a one-line direct write.
         apiKeyEnv: kind === "anthropic" ? "ANTHROPIC_API_KEY" : "OPENAI_API_KEY",
     };
 }
@@ -256,12 +333,10 @@ export function resolveModel(modelFlag, merged) {
     return null;
 }
 function resolveProfile(name, p) {
-    if (!profileAvailable(p)) {
-        throw new ConfigError(`model ${name}: unavailable — the env var ${p.apiKeyEnv} is not set (configs never store keys, only the env-var name)`);
-    }
     // PH-1c (finding PH-F19): a keyless profile hands the adapter a
     // placeholder — the SDKs require SOME string; the endpoint ignores it.
-    return { name, profile: p, apiKey: p.apiKeyEnv === undefined ? "none" : process.env[p.apiKeyEnv] };
+    const auth = authForProfile(name, p);
+    return auth.type === "oauth" ? { name, profile: p, oauthProviderId: auth.providerId } : { name, profile: p, apiKey: auth.apiKey };
 }
 /** Mode: env (KISO_MODE) beats config.mode; the --mode flag is applied by
  *  main before this runs (flags are the top of the chain). */

package/dist/dispatch.js

@@ -5,11 +5,74 @@
  */
 import { contextRows, contextUnavailableRows, displayVerb, escapeTerminal, helpRows, kUnit, modePickView, modelPickView, palette } from "@vincemakes/kiso-tui";
 import { newSessionId } from "./session-id.js";
-import { buildAdapter, resolveContinuationScope, resolveReasoning } from "@vincemakes/kiso-runtime/internal";
+import { buildAdapter, lookupModelMetadata, resolveContinuationScope, resolveReasoning } from "@vincemakes/kiso-runtime/internal";
 import { MODES, MODE_NOTE, getMode, setMode } from "./mode.js";
 import { clipboardWrite, lastAnswer } from "./clipboard.js";
-import { agentModel, body, bodyLog, configModels, dock, readContextLedger, sessionsDir, setAgentModel, setCurrentModelName, setLastBinding } from "./state.js";
-import { directWriteProfile, profileAvailable } from "./config.js";
+import { agentModel, body, bodyLog, configModels, dock, lastBinding, readContextLedger, sessionsDir, setAgentModel, setCurrentModelName, setLastBinding } from "./state.js";
+import { authForProfile, directWriteProfile, profileAvailable, unavailableReason } from "./config.js";
+/** The picker's CLI half (owner 2026-09-08): a profile's LEGAL effort levels
+ *  and its default, from the registry, shown wherever the profile is listed
+ *  — kiso never silently drops a level, and now it shows the ones it takes.
+ *  A model the registry does not know shows `unknown` (nothing is guessed);
+ *  it must not read `none`, which is a REAL level since the Responses rows. */
+function effortNote(p) {
+    const reasoning = lookupModelMetadata(p.model, p.baseUrl)?.capabilities.reasoning ?? null;
+    const effort = reasoning?.effort ?? null;
+    if (effort === null)
+        return "effort: unknown";
+    return `effort: ${effort.levels.map((l) => (l === effort.default ? `[${l}]` : l)).join(" · ")}`;
+}
+/** OR-7 — the pick panel's second axis, as DATA. `effortNote` above stays
+ *  the PRINTED list's string (a machine-readable surface whose bytes do
+ *  not move); the panel gets the levels structured so its cursor can walk
+ *  them, and so the bracket can mean "the cursor is here" rather than
+ *  "the registry default".
+ *
+ *  Where the cursor starts: the session's CURRENT effort when this model
+ *  has that level, else the model's default, else nowhere — a row whose
+ *  registry default is null (the model page states none) marks nothing,
+ *  and enter on it applies the profile alone. Nothing is invented. */
+function effortAxis(p) {
+    const reasoning = lookupModelMetadata(p.model, p.baseUrl)?.capabilities.reasoning ?? null;
+    if (reasoning === null)
+        return {};
+    const effort = reasoning.effort;
+    if (effort === null)
+        return {};
+    const levels = effort.levels;
+    const carried = lastBinding()?.reasoning?.effort;
+    const carriedIdx = carried === undefined || carried === "default" ? -1 : levels.indexOf(carried);
+    const defaultIdx = effort.default === null ? -1 : levels.indexOf(effort.default);
+    const level = carriedIdx >= 0 ? carriedIdx : defaultIdx;
+    // the forbidden set is per THINKING mode, and the panel applies its
+    // pick as thinking "default" — the same setting `/model <p> <e>`
+    // builds — so only pairs forbidden at that mode are dimmed here.
+    const disabled = (reasoning.forbidden ?? []).filter((f) => f.thinking === "default").map((f) => levels.indexOf(f.effort)).filter((i) => i >= 0);
+    return {
+        levels,
+        ...(level >= 0 ? { level } : {}),
+        ...(disabled.length > 0 ? { disabled } : {}),
+        // the sentence the coordination note asked for: said only when the
+        // cursor could NOT land where the previous selection asked.
+        ...(carried !== undefined && carried !== "default" && carriedIdx < 0 && defaultIdx >= 0
+            ? { levelNote: `effort ${carried} \u2192 ${levels[defaultIdx]}: the nearest this model supports` }
+            : {}),
+    };
+}
+/** What signs a profile in, for the listing: the env var's name, `oauth`
+ *  for a subscription sign-in, or `no key` for an unauthenticated endpoint. */
+function signInNote(p) {
+    try {
+        const auth = authForProfile("?", p);
+        if (auth.type === "oauth")
+            return "oauth";
+    }
+    catch {
+        // unavailable — the availability mark says so; the env name still names what would sign it in
+    }
+    return p.apiKeyEnv ?? "no key";
+}
+import { oauthTokenThunk } from "./auth/token.js";
 /** The ONE dispatcher — slash commands, exit, and turns. The recovery
  *  replay routes through it too — a queued "/last" must never become a
  *  user turn (v2c: the rl lives in main, so lines arrive earlier and the
@@ -290,13 +353,17 @@ export function dispatch(line, ctx) {
             // surface and this round moves no bytes on one.
             if (arg === "" && dock.active && ctx.input.panelAsk !== undefined) {
                 const names = Object.keys(configModels);
+                let pickedLevel;
                 const picked = await new Promise((resolve) => {
                     ctx.input.panelAsk(modelPickView({
                         header: `model — current: ${agentModel}`,
                         options: names.map((name) => {
                             const profile = configModels[name];
+                            // the note keeps what tells two rows apart; the levels
+                            // left it for the axis below (they were being cut off
+                            // the end of the note column at 100 columns).
                             const marks = [`profile: ${name}`, ...(profileAvailable(profile) ? [] : ["unavailable"]), ...(profile.model === agentModel ? ["current"] : [])];
-                            return { label: `${profile.kind}/${profile.model}`, note: marks.join(" · ") };
+                            return { label: `${profile.kind}/${profile.model}`, note: marks.join(" · "), ...effortAxis(profile) };
                         }),
                         // PH-1a (finding PH-F4): the example must be a syntax
                         // directWriteProfile actually ACCEPTS — the old
@@ -311,14 +378,30 @@ export function dispatch(line, ctx) {
                     // DC-12 (design §4): a panel WAITING ON A HUMAN says ❯. The
                     // else-branch keeps ▸ — it names the current tier, which is
                     // what ▸ means everywhere else.
-                    ctx.isRunning() ? "❯ run paused" : `▸ ${getMode()}`), (v) => resolve(v.action === "picked" ? v.result : null));
+                    ctx.isRunning() ? "❯ run paused" : `▸ ${getMode()}`), (v) => {
+                        // OR-7: the level rides beside the result, so a pick
+                        // with no second axis is byte-for-byte the old one.
+                        if (v.action === "picked")
+                            pickedLevel = v.level;
+                        resolve(v.action === "picked" ? v.result : null);
+                    });
                 });
                 ctx.paintIdle();
                 if (picked === null) {
                     ctx.input.prompt();
                     return; // esc — nothing switched, nothing said
                 }
-                arg = "index" in picked ? names[picked.index] : picked.custom;
+                if ("index" in picked) {
+                    // OR-7: the panel hands back both axes and the command
+                    // string is where they meet — everything below is the
+                    // typed `/model <profile> <effort>` path, unchanged, so
+                    // the refusal wording and the durable revision are its.
+                    const name = names[picked.index];
+                    const level = pickedLevel === undefined ? undefined : effortAxis(configModels[name]).levels?.[pickedLevel];
+                    arg = level === undefined ? name : `${name} ${level}`;
+                }
+                else
+                    arg = picked.custom;
             }
             if (arg === "") {
                 bodyLog(`model: ${agentModel}`);
@@ -329,7 +412,7 @@ export function dispatch(line, ctx) {
                 else {
                     for (const name of names) {
                         const p = configModels[name];
-                        bodyLog(`  ${name} → ${p.kind}/${p.model} · ${p.apiKeyEnv} ${profileAvailable(p) ? "(available)" : "(unavailable)"}`);
+                        bodyLog(`  ${name} → ${p.kind}/${p.model} · ${signInNote(p)} ${profileAvailable(p) ? "(available)" : "(unavailable)"} · ${effortNote(p)}`);
                     }
                 }
                 bodyLog("switch with /model <profile-name|provider/model>");
@@ -347,13 +430,25 @@ export function dispatch(line, ctx) {
                         bodyLog(`no such model profile: ${profName}`);
                     }
                     else if (!profileAvailable(profile)) {
-                        bodyLog(`model ${arg}: unavailable — the env var ${profile.apiKeyEnv} is not set (configs never store keys, only the env-var name)`);
+                        // the PROFILE name, not the whole argument: what is
+                        // unavailable is the credential, and an effort token
+                        // riding along ("claude high: unavailable") reads as
+                        // though the level were part of the problem. The panel
+                        // began producing that token in OR-7; the typed path
+                        // could always produce it too.
+                        bodyLog(unavailableReason(profName, profile));
                     }
                     else {
+                        const auth = authForProfile(profName, profile);
                         const adapter = await buildAdapter(profile.kind, {
                             // PH-1c (PH-F19): a keyless profile = an unauthenticated
                             // endpoint — the placeholder satisfies the SDK's ctor.
-                            apiKey: profile.apiKeyEnv === undefined ? "none" : process.env[profile.apiKeyEnv],
+                            // OR-1: an OAuth profile passes a token thunk instead
+                            // — there is no key, and the adapter re-resolves the
+                            // token per request.
+                            ...(auth.type === "oauth"
+                                ? { oauth: oauthTokenThunk(auth.providerId), ...(ctx.session.id !== undefined ? { promptCacheKey: ctx.session.id } : {}) }
+                                : { apiKey: auth.apiKey }),
                             ...(profile.baseUrl !== undefined ? { baseUrl: profile.baseUrl } : {}),
                             ...(profile.promptCaching !== undefined ? { promptCaching: profile.promptCaching } : {}),
                         });
@@ -370,7 +465,9 @@ export function dispatch(line, ctx) {
                         let refused = null;
                         if (effortTok !== undefined) {
                             const candidate = { thinking: "default", effort: effortTok };
-                            const resolved = resolveReasoning(profile.model, candidate);
+                            // OR-1: the endpoint narrows the row — the same model id answers
+                            // differently at the first-party API and at the subscription backend
+                            const resolved = resolveReasoning(profile.model, candidate, profile.baseUrl);
                             if (resolved.ok)
                                 reasoning = candidate;
                             else
@@ -386,13 +483,22 @@ export function dispatch(line, ctx) {
                                 adapter,
                                 model: profile.model,
                                 provider: profile.kind,
+                                // OR-1: the endpoint is the fourth passenger — the cost
+                                // path and the window lookup key on (model, endpoint).
+                                ...(profile.baseUrl !== undefined ? { baseUrl: profile.baseUrl } : {}),
                                 ...(scope !== undefined ? { scope } : {}),
                                 ...(reasoning !== undefined ? { reasoning } : {}),
                             };
                             ctx.session.setModelBinding(binding);
                             setLastBinding(binding);
-                            setAgentModel(profile.model);
+                            setAgentModel(profile.model, profile.baseUrl);
                             setCurrentModelName(arg);
+                            // OR-7 (owner, 2026-09-09): the status row is repainted BY the
+                            // switch — it used to keep the old model until the next
+                            // recap repainted it, so "takes effect on the next turn"
+                            // read as "did not take". Painted BEFORE the notice so the
+                            // frame that carries the notice already carries the row.
+                            ctx.paintIdle();
                             body.notice(`model → ${profName} (${profile.model}${effortTok !== undefined ? ` · ${effortTok}` : ""}) — takes effect on the next turn`);
                         }
                     }