@xopcai/xopc 0.0.235 → 0.0.239

package/dist/gateway/static/root/index.html

@@ -11,7 +11,7 @@
     <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png?v=20260713-1" />
     <link rel="manifest" href="/site.webmanifest?v=20260713-1" />
     <title>XOPC — Keep what matters moving.</title>
-    <script type="module" crossorigin src="/assets/index-DFfvY8IN.js"></script>
+    <script type="module" crossorigin src="/assets/index-DKP23eMn.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-aKtaBQYM.js">
     <link rel="modulepreload" crossorigin href="/assets/preload-helper-zJ_50EbN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-BOUWij0V.js">
@@ -25,19 +25,20 @@
     <link rel="modulepreload" crossorigin href="/assets/download-Dk-ZjtO6.js">
     <link rel="modulepreload" crossorigin href="/assets/plus-Q2yW6OE7.js">
     <link rel="modulepreload" crossorigin href="/assets/x-B_N4OPjy.js">
-    <link rel="modulepreload" crossorigin href="/assets/messages-CoovNoMn.js">
-    <link rel="modulepreload" crossorigin href="/assets/locale-store-8k4mvYGL.js">
+    <link rel="modulepreload" crossorigin href="/assets/messages-B1HDp_j8.js">
+    <link rel="modulepreload" crossorigin href="/assets/locale-store-XDFAPNNu.js">
     <link rel="modulepreload" crossorigin href="/assets/cn-JdwAhgNB.js">
     <link rel="modulepreload" crossorigin href="/assets/schemas-zIBW3wiV.js">
-    <link rel="modulepreload" crossorigin href="/assets/product-delivery-tRr-7IxY.js">
+    <link rel="modulepreload" crossorigin href="/assets/product-delivery-dUJgmBQZ.js">
     <link rel="modulepreload" crossorigin href="/assets/copy-to-clipboard-HOJ79TWv.js">
-    <link rel="modulepreload" crossorigin href="/assets/markdown-view-D02mJdoU.js">
-    <link rel="modulepreload" crossorigin href="/assets/dist-DqPZM2MH2.js">
+    <link rel="modulepreload" crossorigin href="/assets/markdown-view-v-O3cOpk.js">
+    <link rel="modulepreload" crossorigin href="/assets/dist-DqPZM2MH.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-swr-BIWyz7Rc.js">
     <link rel="modulepreload" crossorigin href="/assets/check-DUBLcKHA.js">
+    <link rel="modulepreload" crossorigin href="/assets/skeleton-BwbyijEw.js">
     <link rel="modulepreload" crossorigin href="/assets/settings-shell-dialog-layer-BU3UuiJr.js">
     <link rel="modulepreload" crossorigin href="/assets/settings-shell-layer-context-DCp6ykjQ.js">
-    <link rel="modulepreload" crossorigin href="/assets/popover-select-3E24E65N.js">
+    <link rel="modulepreload" crossorigin href="/assets/popover-select-DBrVS3tZ.js">
     <link rel="modulepreload" crossorigin href="/assets/circle-check-C23XjkUj.js">
     <link rel="modulepreload" crossorigin href="/assets/cloud-C4-yfnnk.js">
     <link rel="modulepreload" crossorigin href="/assets/copy-Dv6d4Dvw.js">
@@ -46,7 +47,7 @@
     <link rel="modulepreload" crossorigin href="/assets/eye-off-DEAzt3g1.js">
     <link rel="modulepreload" crossorigin href="/assets/eye-CABVeTq0.js">
     <link rel="modulepreload" crossorigin href="/assets/globe-DSSGFWFn.js">
-    <link rel="modulepreload" crossorigin href="/assets/notes-api-p2Pncp2B.js">
+    <link rel="modulepreload" crossorigin href="/assets/notes-api-BMhFpRmW.js">
     <link rel="modulepreload" crossorigin href="/assets/loader-circle-CifKLtgG.js">
     <link rel="modulepreload" crossorigin href="/assets/rotate-cw-LIg3Am9S.js">
     <link rel="modulepreload" crossorigin href="/assets/search-DA7gz22f.js">
@@ -54,20 +55,20 @@
     <link rel="modulepreload" crossorigin href="/assets/files-DQjhZjr2.js">
     <link rel="modulepreload" crossorigin href="/assets/tool-activity-R8V9l6nk.js">
     <link rel="modulepreload" crossorigin href="/assets/button-CSEbl4zT.js">
-    <link rel="modulepreload" crossorigin href="/assets/gateway-startup-retry-2rVSUvyw.js">
-    <link rel="modulepreload" crossorigin href="/assets/registry-api-B7b0LJgI.js">
+    <link rel="modulepreload" crossorigin href="/assets/gateway-startup-retry-S6aB0hVI.js">
+    <link rel="modulepreload" crossorigin href="/assets/registry-api-DeVvBsl4.js">
     <link rel="modulepreload" crossorigin href="/assets/config-reload-event-Bjh2zoKp.js">
-    <link rel="modulepreload" crossorigin href="/assets/gateway-config-swr-R702lNJR.js">
-    <link rel="modulepreload" crossorigin href="/assets/models-hub-cache-CYr6LzvY.js">
+    <link rel="modulepreload" crossorigin href="/assets/gateway-config-swr-DfMY-MLf.js">
+    <link rel="modulepreload" crossorigin href="/assets/models-hub-cache-Bngs8o1m.js">
     <link rel="modulepreload" crossorigin href="/assets/electron-env-DH5wF8X8.js">
-    <link rel="modulepreload" crossorigin href="/assets/oauth-api-DpLONwfK.js">
+    <link rel="modulepreload" crossorigin href="/assets/oauth-api-B_pcOUfT.js">
     <link rel="modulepreload" crossorigin href="/assets/form-field-width-DJw_jULe.js">
     <link rel="modulepreload" crossorigin href="/assets/interaction-BmQogeqz.js">
     <link rel="modulepreload" crossorigin href="/assets/is-masked-secret-DOkL5b_X.js">
-    <link rel="modulepreload" crossorigin href="/assets/activity-store-BzswYHcj.js">
-    <link rel="modulepreload" crossorigin href="/assets/theme-store-CpcBI73Q.js">
-    <link rel="stylesheet" crossorigin href="/assets/markdown-view-B1bGSQqt.css">
-    <link rel="stylesheet" crossorigin href="/assets/index-BTUuTnc9.css">
+    <link rel="modulepreload" crossorigin href="/assets/activity-store-DLfkwJzZ.js">
+    <link rel="modulepreload" crossorigin href="/assets/theme-store-5-XHH7F0.js">
+    <link rel="stylesheet" crossorigin href="/assets/markdown-view-Y68dCxuc.css">
+    <link rel="stylesheet" crossorigin href="/assets/index-7GLgmvAm.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.0.235";
+var version = "0.0.239";
 //#endregion
 export { version };

package/dist/packages/gateway-contract/src/device-pairing.js

@@ -0,0 +1,39 @@
+import { z } from "zod";
+//#region packages/gateway-contract/src/device-pairing.ts
+const devicePairingKeySchema = z.strictObject({
+	kty: z.literal("EC"),
+	crv: z.literal("P-256"),
+	x: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+	y: z.string().regex(/^[A-Za-z0-9_-]{43}$/)
+});
+const devicePairingDeviceSchema = z.strictObject({
+	displayName: z.string().trim().min(1).max(80),
+	platform: z.enum(["ios", "android"]),
+	publicKeyJwk: devicePairingKeySchema
+});
+const initialDeviceRefreshTokenSchema = z.string().regex(/^xopc_rt_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}_[A-Za-z0-9_-]{43}$/i);
+const devicePairingProofSchema = z.strictObject({
+	gatewayId: z.string().uuid(),
+	requestId: z.string().uuid(),
+	pairingToken: z.string().min(1).max(256),
+	timestamp: z.number().int().positive(),
+	nonce: z.string().regex(/^[A-Za-z0-9_-]{24,128}$/),
+	signature: z.string().regex(/^[A-Za-z0-9_-]{86}$/)
+});
+const devicePairingRequestSchema = devicePairingProofSchema.extend({ device: devicePairingDeviceSchema });
+const devicePairingCompleteSchema = devicePairingProofSchema.extend({
+	idempotencyKey: z.string().uuid(),
+	initialRefreshToken: initialDeviceRefreshTokenSchema
+});
+function canonical(value) {
+	if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+	if (value !== null && typeof value === "object") return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a.localeCompare(b, "en")).map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+/** Identical domain-separated proof input on the phone and Gateway. */
+function buildDevicePairingProof(action, body) {
+	const { signature: _signature, ...payload } = body;
+	return `xopc-device-pairing-v3\nPOST\n${action}\n${canonical(payload)}`;
+}
+//#endregion
+export { buildDevicePairingProof, devicePairingCompleteSchema, devicePairingDeviceSchema, devicePairingProofSchema, devicePairingRequestSchema, initialDeviceRefreshTokenSchema };

package/dist/packages/gateway-contract/src/model-selection.js

@@ -0,0 +1,7 @@
+//#region packages/gateway-contract/src/model-selection.ts
+function chooseModelThinking(capabilities, current, remembered) {
+	for (const value of [remembered, current]) if (capabilities.options.includes(value)) return value;
+	return capabilities.initialValue;
+}
+//#endregion
+export { chooseModelThinking };

package/dist/packages/gateway-contract/src/new-session.js

@@ -37,7 +37,8 @@ function parseModelPreferences(value) {
 		const thinkingLevel = typeof record.thinkingLevel === "string" ? normalized(record.thinkingLevel) : void 0;
 		result[agentId] = {
 			modelRef,
-			...thinkingLevel ? { thinkingLevel } : {}
+			...thinkingLevel ? { thinkingLevel } : {},
+			...record.thinkingByModel && typeof record.thinkingByModel === "object" ? { thinkingByModel: Object.fromEntries(Object.entries(record.thinkingByModel).filter((entry) => typeof entry[1] === "string")) } : {}
 		};
 	}
 	return result;
@@ -71,9 +72,15 @@ function withAgentModelPreference(preferences, agentId, preference) {
 	if (!preference || !modelRef) delete modelByAgent[normalizedId];
 	else {
 		const thinkingLevel = normalized(preference.thinkingLevel);
+		const thinkingByModel = {
+			...modelByAgent[normalizedId]?.thinkingByModel,
+			...modelByAgent[normalizedId]?.thinkingLevel ? { [modelByAgent[normalizedId].modelRef]: modelByAgent[normalizedId].thinkingLevel } : {},
+			...thinkingLevel ? { [modelRef]: thinkingLevel } : {}
+		};
 		modelByAgent[normalizedId] = {
 			modelRef,
-			...thinkingLevel ? { thinkingLevel } : {}
+			...thinkingLevel ? { thinkingLevel } : {},
+			...Object.keys(thinkingByModel).length ? { thinkingByModel } : {}
 		};
 	}
 	return {

package/dist/packages/gateway-contract/src/turn-outcome.js

@@ -35,6 +35,7 @@ const TurnOutcomeArtifactCapabilitySchema = z.enum([
 ]);
 const TurnOutcomeDeliverableSchema = z.object({
 	artifactId: z.string().min(1),
+	sourceFileId: z.string().min(1).optional(),
 	title: z.string().min(1),
 	kind: TurnOutcomeDeliverableKindSchema,
 	mimeType: z.string().optional(),
@@ -110,6 +111,14 @@ const FILE_RESOURCE_ARTIFACT_URI_PREFIX = "xopc-file:";
 function fileResourceArtifactUri(fileResourceId) {
 	return `${FILE_RESOURCE_ARTIFACT_URI_PREFIX}${encodeURIComponent(fileResourceId)}`;
 }
+function parseFileResourceArtifactUri(uri) {
+	if (!uri.startsWith(FILE_RESOURCE_ARTIFACT_URI_PREFIX)) return null;
+	try {
+		return decodeURIComponent(uri.slice(10)).trim() || null;
+	} catch {
+		return null;
+	}
+}
 function turnOutcomeKindFromFileName(fileName) {
 	const extension = fileName.toLowerCase().split(".").pop() ?? "";
 	if (extension === "xlsx" || extension === "xls" || extension === "csv" || extension === "tsv") return "spreadsheet";
@@ -182,9 +191,25 @@ function turnOutcomeMimeTypeFromFileName(fileName) {
 		zip: "application/zip"
 	}[fileName.toLowerCase().split(".").pop() ?? ""];
 }
+/** Merge file representations within one turn, preferring the latest available snapshot. */
+function mergeTurnOutcomeDeliverables(items) {
+	const byId = new Map(items.map((item) => [item.artifactId, item]));
+	const bySource = /* @__PURE__ */ new Map();
+	const priority = (item) => item.availability === "available" ? item.location === "artifact_store" ? 2 : 1 : 0;
+	for (const item of byId.values()) {
+		const sourceFileId = item.sourceFileId ?? parseFileResourceArtifactUri(item.uri ?? "");
+		const key = sourceFileId ? `source:${sourceFileId}` : `artifact:${item.artifactId}`;
+		const previous = bySource.get(key);
+		if (!previous || priority(item) >= priority(previous)) bySource.set(key, item);
+	}
+	return [...bySource.values()];
+}
 function parseTurnOutcome(value) {
 	const parsed = TurnOutcomeSchema.safeParse(value);
-	return parsed.success ? parsed.data : null;
+	return parsed.success ? {
+		...parsed.data,
+		deliverables: mergeTurnOutcomeDeliverables(parsed.data.deliverables)
+	} : null;
 }
 //#endregion
-export { TurnOutcomeDeliverableSchema, fileResourceArtifactUri, parseTurnOutcome, turnOutcomeKindFromFileName, turnOutcomeMimeTypeFromFileName };
+export { TurnOutcomeDeliverableSchema, fileResourceArtifactUri, mergeTurnOutcomeDeliverables, parseTurnOutcome, turnOutcomeKindFromFileName, turnOutcomeMimeTypeFromFileName };

package/dist/src/agent/agent-manager.js

@@ -5,16 +5,16 @@ import { getSessionMetadata } from "../storage/sqlite/session-repository.js";
 import { getSessionConfig } from "../storage/sqlite/config-repository.js";
 import "../storage/sqlite/index.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
+import { applyConfigOverrides } from "../config/runtime-overrides.js";
 import { expandWorkspacePathString, init_workspace_path } from "../config/workspace-path.js";
 import { init_agent_scope, resolveAgentProfileDir } from "./agent-scope.js";
-import { init_paths, resolveBundledSkillsDir } from "../config/paths.js";
-import { CredentialResolver, init_credentials } from "../auth/credentials.js";
 import { init_session_key, parseSessionKey } from "../routing/session-key.js";
+import { resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
+import { init_paths, resolveBundledSkillsDir } from "../config/paths.js";
 import { init_sync_provider_auth, resolveProviderApiKeySync } from "../auth/sync-provider-auth.js";
+import { CredentialResolver, init_credentials } from "../auth/credentials.js";
 import { getApiKeySync, getDefaultModelSync, init_providers, resolveModel } from "../providers/index.js";
 import { createExtensionAwareStreamFn } from "../providers/extension-stream-bridge.js";
-import { applyConfigOverrides } from "../config/runtime-overrides.js";
-import { resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { extractTextContent } from "./context/workspace.js";
 import { buildExecutionScopeContextForPrompt } from "./context/execution-scope.js";
 import { clearBootstrapSnapshot } from "./bootstrap/bootstrap-cache.js";

package/dist/src/agent/background-review/run-background-review.js

@@ -4,10 +4,10 @@ import { finishContextExtractionRun } from "../../storage/sqlite/context-extract
 import { getTurnPersonalization } from "../../storage/sqlite/user-context-repository.js";
 import { loadCompactionSourceSnapshot } from "../../storage/sqlite/transcript-repository.js";
 import "../../storage/sqlite/index.js";
+import { extractProfileAgentId } from "../../config/agent-profile.js";
 import { init_sync_provider_auth, resolveProviderApiKeySync } from "../../auth/sync-provider-auth.js";
 import { getApiKeySync, init_providers, resolveModel } from "../../providers/index.js";
 import { createExtensionAwareStreamFn } from "../../providers/extension-stream-bridge.js";
-import { extractProfileAgentId } from "../../config/agent-profile.js";
 import { extractTextContent } from "../context/workspace.js";
 import { readAgentMessageContent } from "../memory/agent-message-access.js";
 import { resolveAgentTurnTimeoutMs, runAgentTurnWithTimeout } from "../orchestration/run-agent-turn-with-timeout.js";

package/dist/src/agent/embedded/model-runtime.js

@@ -1,6 +1,6 @@
 import { init_paths, resolveModelsJsonPath } from "../../config/paths.js";
-import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
 import { init_sync_provider_auth, resolveProviderApiKeySync } from "../../auth/sync-provider-auth.js";
+import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
 import { XopcModelCredentialStore, init_model_credential_store } from "../../auth/model-credential-store.js";
 import { init_register_bundled_oauth_flows, registerBundledOAuthFlows } from "../../providers/register-bundled-oauth-flows.js";
 import { init_register_runtime_providers, registerRuntimeProviders } from "../../providers/register-runtime-providers.js";

package/dist/src/agent/embedded/run-for-session.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_providers, resolveModel } from "../../providers/index.js";
 import { parseTurnOutcome } from "../../../packages/gateway-contract/src/turn-outcome.js";
 import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
+import { init_providers, resolveModel } from "../../providers/index.js";
 import { resolveAgentTurnTimeoutMs } from "../orchestration/run-agent-turn-with-timeout.js";
 import { resolvePromptCachePolicy } from "../../providers/prompt-cache-plan.js";
 import { evaluateContextBudget } from "../memory/context-budget.js";

package/dist/src/agent/embedded/run-turn.js

@@ -267,6 +267,11 @@ async function runXopcEmbeddedTurn(params) {
 				errorMessage: getAssistantTurnErrorMessage(session.agent) ?? "Assistant turn failed",
 				lastAssistantText: lastAssistantPlainText(session)
 			};
+			runner.piSm.appendCustomEntry("xopc.model-selection", {
+				runId,
+				model: `${session.agent.state.model?.provider ?? resolvedModel.provider}/${session.agent.state.model?.id ?? resolvedModel.id}`,
+				thinkingLevel: session.agent.state.thinkingLevel
+			});
 			return {
 				ok: true,
 				lastAssistantText: lastAssistantPlainText(session)

package/dist/src/agent/image/tool-model-config.js

@@ -1,7 +1,7 @@
 import { getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "../../config/schema.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
-import { getDefaultModelSync, getModelsByProvider, init_providers, isProviderConfiguredSync, resolveModel } from "../../providers/index.js";
 import { resolveEffectiveAgentConfigForAgent } from "../../config/agent-profile.js";
+import { getDefaultModelSync, getModelsByProvider, init_providers, isProviderConfiguredSync, resolveModel } from "../../providers/index.js";
 import { resolveAgentModelFallbackValues, resolveAgentModelPrimaryValue } from "../../config/model-input.js";
 import { buildCapabilityPlansForConfig } from "../../capabilities/readiness/from-config.js";
 import "../../capabilities/readiness/index.js";

package/dist/src/agent/ipc/inbox.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_write_file_atomic, writeTextAtomic } from "../../infra/write-file-atomic.js";
 import { init_paths, resolveAgentDir } from "../../config/paths.js";
+import { init_write_file_atomic, writeTextAtomic } from "../../infra/write-file-atomic.js";
 import { join } from "path";
 import { existsSync, watch } from "fs";
 import { mkdir, readFile, readdir, rename } from "fs/promises";

package/dist/src/agent/mcp/oauth/mcp-oauth-store.js

@@ -1,5 +1,5 @@
-import { init_write_file_atomic, writeTextAtomic } from "../../../infra/write-file-atomic.js";
 import { init_paths, resolveMcpOAuthPath } from "../../../config/paths.js";
+import { init_write_file_atomic, writeTextAtomic } from "../../../infra/write-file-atomic.js";
 import { createHash } from "node:crypto";
 import { readFile, rm } from "node:fs/promises";
 //#region src/agent/mcp/oauth/mcp-oauth-store.ts

package/dist/src/agent/models/manager.d.ts

@@ -18,6 +18,7 @@ export declare class ModelManager {
     private currentModelName;
     private currentProvider;
     private sessionModels;
+    private fixedSessionModels;
     /** Baseline model from `agents.list` / defaults merge when the session agent is created. */
     private sessionProfileDefaults;
     private sessionProfileFallbacks;
@@ -49,6 +50,8 @@ export declare class ModelManager {
      * Switch model for a specific session
      */
     switchModelForSession(sessionKey: string, modelId: string): Promise<boolean>;
+    /** Restore persisted identity even if its provider is temporarily unavailable. */
+    restoreSessionModel(sessionKey: string, modelRef: string, fixed: boolean): void;
     /** Drop in-memory session override so the global default is used again. */
     clearSessionModelOverride(sessionKey: string): void;
     /**

package/dist/src/agent/models/manager.js

@@ -15,6 +15,7 @@ var ModelManager = class {
 	currentModelName;
 	currentProvider;
 	sessionModels = /* @__PURE__ */ new Map();
+	fixedSessionModels = /* @__PURE__ */ new Set();
 	/** Baseline model from `agents.list` / defaults merge when the session agent is created. */
 	sessionProfileDefaults = /* @__PURE__ */ new Map();
 	sessionProfileFallbacks = /* @__PURE__ */ new Map();
@@ -89,9 +90,16 @@ var ModelManager = class {
 			return false;
 		}
 	}
+	/** Restore persisted identity even if its provider is temporarily unavailable. */
+	restoreSessionModel(sessionKey, modelRef, fixed) {
+		this.sessionModels.set(sessionKey, modelRef);
+		if (fixed) this.fixedSessionModels.add(sessionKey);
+		else this.fixedSessionModels.delete(sessionKey);
+	}
 	/** Drop in-memory session override so the global default is used again. */
 	clearSessionModelOverride(sessionKey) {
 		this.sessionModels.delete(sessionKey);
+		this.fixedSessionModels.delete(sessionKey);
 	}
 	/**
 	* Resolved pi-ai model for session (for transcript policy, tools, etc.)
@@ -145,6 +153,7 @@ var ModelManager = class {
 	getFallbackCandidatesForSession(sessionKey) {
 		const parsed = parseModelRef(this.getModelForSession(sessionKey));
 		if (!parsed) return [];
+		if (this.fixedSessionModels.has(sessionKey)) return [parsed];
 		return resolveFallbackCandidates({
 			cfg: this.config,
 			provider: parsed.provider,

package/dist/src/agent/prompt/sections/tooling.js

@@ -127,6 +127,7 @@ function buildToolingSection(params) {
 		"## Tooling",
 		"Tool availability (filtered by policy):",
 		"Tool names are case-sensitive. Call tools exactly as listed.",
+		"When a tool returns an xopc product link, reuse its exact URL in a Markdown link with a short descriptive label in the user's language (for example, [打开会话](url)). Do not invent link parameters, escape the link brackets/parentheses, or wrap a navigation link in a code span. Avoid repeating raw URLs or internal object metadata unless requested.",
 		toolLines.length > 0 ? toolLines.join("\n") : "- No tools are registered for this session.",
 		`For long waits, avoid rapid poll loops: use \`${execToolName}\` with a sufficient timeout or poll in reasonable intervals.`,
 		hasRead ? `Use \`${readToolName}\` for targeted file inspection before editing; do not rely on filenames alone.` : "",

package/dist/src/agent/service.js

@@ -3,10 +3,10 @@ import { init_logger } from "../utils/logger.js";
 import { getUserProfile } from "../storage/sqlite/user-context-repository.js";
 import { parseNoteAttachmentTarget } from "../notes/attachment-ref.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
-import { init_agent_scope, resolveAgentHomeDir, resolveDefaultAgentId } from "./agent-scope.js";
-import { init_providers, resolveModel } from "../providers/index.js";
 import { applyConfigOverrides } from "../config/runtime-overrides.js";
+import { init_agent_scope, resolveAgentHomeDir, resolveDefaultAgentId } from "./agent-scope.js";
 import { extractProfileAgentId } from "../config/agent-profile.js";
+import { init_providers, resolveModel } from "../providers/index.js";
 import { extractTextContent } from "./context/workspace.js";
 import { effectiveWorkspacePathForSession } from "../session/session-workspace.js";
 import { getProjectForSession } from "../projects/workspace.js";

package/dist/src/agent/session/session-config-service.d.ts

@@ -27,6 +27,8 @@ export interface SessionConfigServiceOptions {
 }
 export interface PatchSessionAgentConfigInput {
     thinkingLevel?: string;
+    fixedModel?: boolean;
+    configVersion?: number;
     model?: string | null;
     /** Preferred activity-detail field. `null` clears the session override. */
     activityDetailLevel?: string | null;
@@ -40,6 +42,7 @@ export interface PatchSessionAgentConfigInput {
 export interface PatchSessionAgentConfigResult {
     ok: boolean;
     error?: string;
+    code?: 'CONFIG_CHANGED' | 'INVALID_MODEL' | 'INVALID_THINKING';
 }
 export declare class SessionConfigService {
     private readonly opts;
@@ -47,10 +50,11 @@ export declare class SessionConfigService {
     /**
      * Apply a partial patch (model / thinking / reasoning / working directory) to
      * a session's persisted config. Returns `{ ok: false, error }` on the first
-     * invalid field — earlier fields that succeeded are NOT rolled back, matching
-     * the previous behaviour.
+     * invalid field. Model and thinking are validated together and committed in one write.
      */
     patch(sessionKey: string, partial: PatchSessionAgentConfigInput): Promise<PatchSessionAgentConfigResult>;
+    /** Materialize a restored/new chat choice; unavailable identities stay visible for repair. */
+    initializeModelSelection(sessionKey: string, modelRef: string, thinkingLevel?: string, configVersion?: number): Promise<PatchSessionAgentConfigResult>;
     /**
      * Sync persisted session working directory for an automation run. Runs may
      * change when the automation is edited; an empty/missing input clears the

package/dist/src/agent/session/session-config-service.js

@@ -1,10 +1,12 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { chooseModelThinking } from "../../../packages/gateway-contract/src/model-selection.js";
 import { ResponseLanguageSchema, init_response_language } from "../../i18n/response-language.js";
 import { normalizeWorkingDirectoryInput } from "../../session/session-workspace.js";
 import { getProjectWorkspacePathForSession } from "../../projects/workspace.js";
 import { normalizeReasoningLevel, normalizeThinkLevel, normalizeVerboseLevel } from "../transcript/thinking-types.js";
 import "../../session/index.js";
+import { getModelThinking } from "../../providers/model-thinking.js";
 import { mkdir } from "node:fs/promises";
 //#region src/agent/session/session-config-service.ts
 /**
@@ -33,27 +35,58 @@ var SessionConfigService = class {
 	/**
 	* Apply a partial patch (model / thinking / reasoning / working directory) to
 	* a session's persisted config. Returns `{ ok: false, error }` on the first
-	* invalid field — earlier fields that succeeded are NOT rolled back, matching
-	* the previous behaviour.
+	* invalid field. Model and thinking are validated together and committed in one write.
 	*/
 	async patch(sessionKey, partial) {
-		if (partial.model !== void 0) if (partial.model === null || partial.model === "") await this.clearModelOverride(sessionKey);
-		else {
-			if (!await this.opts.modelManager.switchModelForSession(sessionKey, partial.model)) return {
-				ok: false,
-				error: "Invalid model"
-			};
-			await this.opts.sessionConfigStore.update(sessionKey, { modelOverride: partial.model });
-			this.opts.agentManager.setModelForSession(sessionKey, partial.model);
-		}
-		if (partial.thinkingLevel !== void 0) {
-			const normalized = normalizeThinkLevel(partial.thinkingLevel);
-			if (!normalized) return {
+		if (partial.model !== void 0 || partial.thinkingLevel !== void 0 || partial.fixedModel) {
+			const existing = await this.opts.sessionConfigStore.get(sessionKey);
+			if (partial.configVersion !== void 0 && partial.configVersion !== (existing?.updatedAt ?? 0)) return {
 				ok: false,
-				error: "Invalid thinking level"
+				code: "CONFIG_CHANGED",
+				error: "Model configuration changed. Refresh and try again."
 			};
-			await this.opts.sessionConfigStore.update(sessionKey, { thinkingLevel: normalized });
-			this.opts.agentManager.setThinkingLevel(sessionKey, normalized);
+			if (partial.model === null || partial.model === "") {
+				if (partial.fixedModel || existing?.fixedModel) return {
+					ok: false,
+					code: "INVALID_MODEL",
+					error: "Select a specific model"
+				};
+				await this.clearModelOverride(sessionKey);
+			} else {
+				const ref = partial.model ?? existing?.modelOverride ?? this.opts.modelManager.getModelForSession(sessionKey);
+				const model = this.opts.modelManager.findByRef(ref);
+				if (!model) return {
+					ok: false,
+					code: "INVALID_MODEL",
+					error: `Model unavailable: ${ref}`
+				};
+				const capabilities = getModelThinking(model);
+				const requested = partial.thinkingLevel === void 0 ? void 0 : normalizeThinkLevel(partial.thinkingLevel);
+				if (partial.thinkingLevel !== void 0 && (!requested || !capabilities.options.includes(requested))) return {
+					ok: false,
+					code: "INVALID_THINKING",
+					error: "This thinking level is not supported by the selected model"
+				};
+				const thinkingLevel = requested ?? chooseModelThinking(capabilities, existing?.thinkingLevel);
+				const modelRef = `${model.provider}/${model.id}`;
+				const updated = await this.opts.sessionConfigStore.update(sessionKey, {
+					modelOverride: modelRef,
+					thinkingLevel,
+					fixedModel: partial.fixedModel ?? existing?.fixedModel ?? false
+				});
+				this.opts.modelManager.restoreSessionModel(sessionKey, modelRef, updated.fixedModel === true);
+				try {
+					this.opts.agentManager.setModelForSession(sessionKey, modelRef);
+					this.opts.agentManager.setThinkingLevel(sessionKey, thinkingLevel);
+				} catch (err) {
+					this.opts.agentManager.removeAgent(sessionKey);
+					log.warn({
+						err,
+						sessionKey,
+						modelRef
+					}, "Saved model configuration; runtime will reload before the next turn");
+				}
+			}
 		}
 		const activityDetailLevel = partial.activityDetailLevel !== void 0 ? partial.activityDetailLevel : partial.reasoningLevel;
 		if (activityDetailLevel !== void 0) if (activityDetailLevel === null) await this.opts.sessionConfigStore.update(sessionKey, { reasoningLevel: void 0 });
@@ -110,6 +143,34 @@ var SessionConfigService = class {
 		}
 		return { ok: true };
 	}
+	/** Materialize a restored/new chat choice; unavailable identities stay visible for repair. */
+	async initializeModelSelection(sessionKey, modelRef, thinkingLevel, configVersion) {
+		const existing = await this.opts.sessionConfigStore.get(sessionKey);
+		if (configVersion !== void 0 && configVersion !== (existing?.updatedAt ?? 0)) return {
+			ok: false,
+			code: "CONFIG_CHANGED",
+			error: "Model configuration changed. Refresh and try again."
+		};
+		const model = this.opts.modelManager.findByRef(modelRef);
+		if (model) return this.patch(sessionKey, {
+			model: `${model.provider}/${model.id}`,
+			thinkingLevel: chooseModelThinking(getModelThinking(model), thinkingLevel ?? existing?.thinkingLevel),
+			fixedModel: true,
+			configVersion
+		});
+		if (!modelRef.trim() || !modelRef.includes("/")) return {
+			ok: false,
+			code: "INVALID_MODEL",
+			error: "Select a specific model"
+		};
+		await this.opts.sessionConfigStore.update(sessionKey, {
+			modelOverride: modelRef,
+			fixedModel: true,
+			thinkingLevel: normalizeThinkLevel(thinkingLevel) ?? existing?.thinkingLevel ?? "off"
+		});
+		this.opts.modelManager.restoreSessionModel(sessionKey, modelRef, true);
+		return { ok: true };
+	}
 	/**
 	* Sync persisted session working directory for an automation run. Runs may
 	* change when the automation is edited; an empty/missing input clears the

package/dist/src/agent/session/session-hydrator.d.ts

@@ -7,8 +7,7 @@
  * {@link SessionConfigService} — the latter writes user choices into the
  * config store, this hydrator reads them back out before a turn runs.
  *
- *   - `workspace()`  — apply persisted `workingDirectoryOverride` to AgentManager
- *                       and ensure the directory exists on disk
+ *   - `workspace()`  — resolve the execution workspace and apply it to AgentManager
  *   - `model()`      — apply persisted `modelOverride` via ModelManager
  *   - `thinking()`   — resolve effective thinking level (request override >
  *                       per-session override > agent default) and apply
@@ -28,8 +27,8 @@ export declare class SessionHydrator {
     private readonly opts;
     constructor(opts: SessionHydratorOptions);
     /**
-     * Load persisted workingDirectory override into AgentManager and `mkdir -p`
-     * the effective workspace path. Safe to call before `getOrCreateAgent`.
+     * Load the effective workspace into AgentManager. Managed environment roots
+     * must already exist; ordinary project and agent workspaces may be created.
      */
     workspace(sessionKey: string): Promise<void>;
     /** Apply persisted `modelOverride` to ModelManager (no-op when none stored). */