create-workframe 0.1.18 → 0.1.20

package/workframe-api/provider_model_catalog.py

@@ -0,0 +1,261 @@
+"""Account-scoped live model discovery for Workframe's LLM providers."""
+
+from __future__ import annotations
+
+import concurrent.futures
+import hashlib
+import json
+import os
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+from typing import Any
+
+_TTL_SEC = int(os.environ.get("WORKFRAME_MODEL_CATALOG_TTL", "900"))
+_ERROR_TTL_SEC = int(os.environ.get("WORKFRAME_MODEL_CATALOG_ERROR_TTL", "30"))
+_CACHE: dict[tuple[str, str], dict[str, Any]] = {}
+
+
+def _request_json(url: str, *, headers: dict[str, str] | None = None, timeout: float = 8) -> dict[str, Any]:
+    request = urllib.request.Request(url, headers=headers or {}, method="GET")
+    with urllib.request.urlopen(request, timeout=timeout) as response:
+        payload = json.loads(response.read())
+    return payload if isinstance(payload, dict) else {}
+
+
+def _row(provider: str, model: str, label: str = "", description: str = "") -> dict[str, str]:
+    model_id = str(model or "").strip()
+    return {
+        "provider": provider,
+        "billing_provider": provider,
+        "model": model_id,
+        "label": str(label or model_id).strip() or model_id,
+        "description": str(description or model_id).strip() or model_id,
+        "catalog_source": "live",
+    }
+
+
+def _openrouter_models(api_key: str, timeout: float) -> list[dict[str, str]]:
+    payload = _request_json(
+        "https://openrouter.ai/api/v1/models?output_modalities=text",
+        headers={
+            "Authorization": f"Bearer {api_key}",
+            "HTTP-Referer": "https://workfra.me",
+            "X-Title": "Workframe",
+        },
+        timeout=timeout,
+    )
+    rows: list[dict[str, str]] = []
+    for item in payload.get("data") or []:
+        if not isinstance(item, dict):
+            continue
+        model_id = str(item.get("id") or "").strip()
+        if not model_id:
+            continue
+        name = str(item.get("name") or model_id.rsplit("/", 1)[-1]).strip()
+        rows.append(_row("openrouter", model_id, name, model_id))
+    return sorted(rows, key=lambda item: item["label"].lower())
+
+
+def _openai_models(api_key: str, timeout: float) -> list[dict[str, str]]:
+    payload = _request_json(
+        "https://api.openai.com/v1/models",
+        headers={"Authorization": f"Bearer {api_key}"},
+        timeout=timeout,
+    )
+    excluded = ("audio", "embedding", "image", "moderation", "realtime", "search", "transcribe", "tts", "whisper")
+    rows: list[dict[str, str]] = []
+    for item in payload.get("data") or []:
+        if not isinstance(item, dict):
+            continue
+        model_id = str(item.get("id") or "").strip()
+        lower = model_id.lower()
+        if not model_id or any(token in lower for token in excluded):
+            continue
+        if not lower.startswith(("gpt-", "chatgpt-", "o1", "o3", "o4")):
+            continue
+        rows.append(_row("openai", model_id))
+    return sorted(rows, key=lambda item: item["model"].lower())
+
+
+def _anthropic_models(api_key: str, timeout: float) -> list[dict[str, str]]:
+    payload = _request_json(
+        "https://api.anthropic.com/v1/models?limit=1000",
+        headers={"x-api-key": api_key, "anthropic-version": "2023-06-01"},
+        timeout=timeout,
+    )
+    rows: list[dict[str, str]] = []
+    for item in payload.get("data") or []:
+        if not isinstance(item, dict):
+            continue
+        model_id = str(item.get("id") or "").strip()
+        if model_id:
+            rows.append(_row("anthropic", model_id, str(item.get("display_name") or model_id)))
+    return rows
+
+
+def _google_models(api_key: str, timeout: float) -> list[dict[str, str]]:
+    query = urllib.parse.urlencode({"key": api_key, "pageSize": "1000"})
+    payload = _request_json(f"https://generativelanguage.googleapis.com/v1beta/models?{query}", timeout=timeout)
+    rows: list[dict[str, str]] = []
+    for item in payload.get("models") or []:
+        if not isinstance(item, dict) or "generateContent" not in (item.get("supportedGenerationMethods") or []):
+            continue
+        model_id = str(item.get("name") or "").removeprefix("models/").strip()
+        if model_id:
+            rows.append(_row(
+                "google", model_id, str(item.get("displayName") or model_id),
+                str(item.get("description") or model_id),
+            ))
+    return rows
+
+
+def _deepseek_models(api_key: str, timeout: float) -> list[dict[str, str]]:
+    payload = _request_json(
+        "https://api.deepseek.com/models",
+        headers={"Authorization": f"Bearer {api_key}"},
+        timeout=timeout,
+    )
+    return [
+        _row("deepseek", str(item.get("id") or ""))
+        for item in payload.get("data") or []
+        if isinstance(item, dict) and str(item.get("id") or "").strip()
+    ]
+
+
+def _codex_models(access_token: str, timeout: float) -> list[dict[str, str]]:
+    payload = _request_json(
+        "https://chatgpt.com/backend-api/codex/models?client_version=1.0.0",
+        headers={"Authorization": f"Bearer {access_token}"},
+        timeout=timeout,
+    )
+    sortable: list[tuple[int, dict[str, str]]] = []
+    for item in payload.get("models") or []:
+        if not isinstance(item, dict):
+            continue
+        model_id = str(item.get("slug") or "").strip()
+        visibility = str(item.get("visibility") or "").strip().lower()
+        if not model_id or visibility in {"hide", "hidden"}:
+            continue
+        priority = item.get("priority")
+        rank = int(priority) if isinstance(priority, (int, float)) else 10_000
+        display = str(item.get("display_name") or item.get("displayName") or model_id).strip()
+        sortable.append((rank, _row("codex", model_id, display)))
+    sortable.sort(key=lambda item: (item[0], item[1]["model"]))
+    return [item[1] for item in sortable]
+
+
+_FETCHERS = {
+    "openrouter": _openrouter_models,
+    "openai": _openai_models,
+    "anthropic": _anthropic_models,
+    "google": _google_models,
+    "deepseek": _deepseek_models,
+    "codex": _codex_models,
+}
+
+
+def _cache_key(provider: str, credential: str) -> tuple[str, str]:
+    digest = hashlib.sha256(credential.encode("utf-8")).hexdigest()[:20] if credential else ""
+    return provider, digest
+
+
+def discover(provider: str, credential: str, *, timeout: float = 8) -> tuple[list[dict[str, str]], dict[str, str]]:
+    provider_id = str(provider or "").strip().lower()
+    secret = str(credential or "").strip()
+    if provider_id not in _FETCHERS:
+        return [], {"status": "unsupported", "message": "Use a custom model id for this provider."}
+    if not secret:
+        return [], {"status": "unauthenticated", "message": "Reconnect this provider to refresh its models."}
+    key = _cache_key(provider_id, secret)
+    now = time.monotonic()
+    cached = _CACHE.get(key)
+    if cached:
+        ttl = _TTL_SEC if cached.get("status") == "live" else _ERROR_TTL_SEC
+        if now - float(cached.get("at") or 0) < ttl:
+            return list(cached.get("rows") or []), dict(cached.get("meta") or {})
+    try:
+        rows = _FETCHERS[provider_id](secret, timeout)
+        meta = {
+            "status": "live" if rows else "empty",
+            "message": f"{len(rows)} models available now." if rows else "The provider returned no chat models.",
+        }
+    except (urllib.error.HTTPError, urllib.error.URLError, json.JSONDecodeError, OSError, ValueError):
+        rows = []
+        meta = {"status": "error", "message": "Live catalog unavailable. Retry or enter a custom model id."}
+    _CACHE[key] = {"at": now, "status": meta["status"], "rows": rows, "meta": meta}
+    return list(rows), dict(meta)
+
+
+def discover_many(credentials: dict[str, str], *, timeout: float = 8) -> tuple[list[dict[str, str]], dict[str, dict[str, str]]]:
+    rows: list[dict[str, str]] = []
+    statuses: dict[str, dict[str, str]] = {}
+    if not credentials:
+        return rows, statuses
+    with concurrent.futures.ThreadPoolExecutor(max_workers=min(5, len(credentials))) as pool:
+        pending = {
+            pool.submit(discover, provider, credential, timeout=timeout): provider
+            for provider, credential in credentials.items()
+        }
+        for future in concurrent.futures.as_completed(pending):
+            provider = pending[future]
+            try:
+                provider_rows, meta = future.result()
+            except Exception:
+                provider_rows, meta = [], {
+                    "status": "error",
+                    "message": "Live catalog unavailable. Retry or enter a custom model id.",
+                }
+            rows.extend(provider_rows)
+            statuses[provider] = meta
+    return rows, statuses
+
+
+def oauth_access_token(auth: dict[str, Any] | None, hermes_auth_id: str) -> str:
+    """Read an OAuth access token from Hermes provider or credential-pool layouts."""
+    if not isinstance(auth, dict):
+        return ""
+    raw = str(hermes_auth_id or "").strip().lower()
+    keys = {raw, raw.replace("-", ""), raw.replace("-", "_")}
+    if "-" in raw:
+        keys.add(raw.split("-")[-1])
+
+    def token_from(entry: Any) -> str:
+        if not isinstance(entry, dict):
+            return ""
+        tokens = entry.get("tokens") if isinstance(entry.get("tokens"), dict) else {}
+        for source in (tokens, entry):
+            for field in ("access_token", "accessToken", "token"):
+                value = str(source.get(field) or "").strip()
+                if value:
+                    return value
+        return ""
+
+    providers = auth.get("providers")
+    if isinstance(providers, dict):
+        for key, entry in providers.items():
+            if str(key).lower() in keys:
+                token = token_from(entry)
+                if token:
+                    return token
+    credentials = auth.get("credentials")
+    if isinstance(credentials, list):
+        for entry in credentials:
+            if not isinstance(entry, dict):
+                continue
+            provider = str(entry.get("provider") or entry.get("id") or "").lower()
+            if provider in keys:
+                token = token_from(entry)
+                if token:
+                    return token
+    pool = auth.get("credential_pool")
+    if isinstance(pool, dict):
+        for key, entries in pool.items():
+            if str(key).lower() not in keys or not isinstance(entries, list):
+                continue
+            for entry in entries:
+                token = token_from(entry)
+                if token:
+                    return token
+    return ""

package/workframe-api/rooms.py

@@ -650,6 +650,7 @@ def _ensure_workspace_agent_profile_row(
     role: str = "",
     tagline: str = "",
     is_native: bool = False,
+    preserve_existing_identity: bool = False,
 ) -> str | None:
     """Ensure agent_profiles row exists for a workspace (default workspace when id omitted)."""
     slug = str(slug or "").strip()
@@ -686,11 +687,11 @@ def _ensure_workspace_agent_profile_row(
         if existing:
             agent_id = str(existing["id"])
             patches: dict[str, Any] = {}
-            if display_name.strip():
+            if display_name.strip() and not preserve_existing_identity:
                 patches["display_name"] = display_name.strip()
-            if tagline.strip():
+            if tagline.strip() and not preserve_existing_identity:
                 patches["tagline"] = tagline.strip()
-            if role.strip():
+            if role.strip() and not preserve_existing_identity:
                 patches["role"] = role.strip()
             if patches:
                 sets = [f"{col} = ?" for col in patches]

package/workframe-api/route_registry.py

@@ -81,6 +81,7 @@ ROUTES: tuple[Route, ...] = (
     Route("GET", "/api/me/credentials", AuthLevel.SESSION, "_route_get_me_credentials"),
     Route("GET", "/api/me/providers", AuthLevel.SESSION, "_route_get_me_providers"),
     Route("GET", "/api/me/cohort", AuthLevel.SESSION, "_route_get_me_cohort"),
+    Route("GET", "/api/message-reactions", AuthLevel.SESSION, "_route_get_message_reactions"),
     Route("GET", "/api/user/credentials", AuthLevel.SESSION, "_route_get_user_credentials"),
     Route("GET", "/api/hermes/profiles/status", AuthLevel.SESSION, "_route_get_hermes_profiles_status"),
     Route("GET", "/api/oauth/github/callback", AuthLevel.SESSION, "_route_get_oauth_github_callback"),
@@ -128,7 +129,10 @@ ROUTES: tuple[Route, ...] = (
     Route("POST", "/api/content/delete", AuthLevel.SESSION, "_route_post_content_delete"),
     Route("POST", "/api/files/write", AuthLevel.SESSION, "_route_post_files_write"),
     Route("POST", "/api/files/upload", AuthLevel.SESSION, "_route_post_files_upload"),
+    Route("POST", "/api/files/archive", AuthLevel.SESSION, "_route_post_files_archive"),
+    Route("POST", "/api/files/delete", AuthLevel.SESSION, "_route_post_files_delete"),
     Route("POST", "/api/chat/dispatch", AuthLevel.SESSION, "_route_post_chat_dispatch"),
+    Route("POST", "/api/message-reactions/toggle", AuthLevel.SESSION, "_route_post_message_reactions_toggle"),
     Route("POST", "/api/hermes/profiles/create", AuthLevel.SESSION, "_route_post_hermes_profiles_create"),
     Route("POST", "/api/hermes/profiles/start", AuthLevel.SESSION, "_route_post_hermes_profiles_start"),
     Route("POST", "/api/hermes/profiles/stop", AuthLevel.SESSION, "_route_post_hermes_profiles_stop"),

package/workframe-api/runtime_cohort.py

@@ -38,6 +38,8 @@ def _prepare_runtime_profile_credentials(
     runtime: str,
     user_id: str,
     workspace_id: str = "",
+    *,
+    wait_healthy: bool = True,
 ) -> bool:
     """Strip stale profile secrets, then overlay the runtime profile owner's keys.
 
@@ -57,7 +59,86 @@ def _prepare_runtime_profile_credentials(
     _srv()._reconcile_profile_llm_for_user(runtime, user, workspace_id)
     prov = _srv()._llm_billing_provider(runtime, user_id=user, workspace_id=workspace_id)
     _srv()._ensure_profile_llm_proxy(runtime, prov)
-    return _srv()._user_can_use_llm(user, workspace_id, prov)
+    ready = _srv()._user_can_use_llm(user, workspace_id, prov)
+    if ready:
+        # Pre-bind the opaque runtime credential while provisioning/opening the
+        # agent. The first chat turn must never be responsible for restarting a
+        # credential-less Hermes gateway.
+        _srv()._try_overlay_turn_provider_env(
+            runtime,
+            user,
+            workspace_id,
+            prov,
+            f"runtime-bootstrap:{runtime}",
+            wait_healthy=wait_healthy,
+        )
+    return ready
+
+
+def _refresh_user_runtime_credentials(
+    user_id: str,
+    workspace_id: str = "",
+    *,
+    wait_healthy: bool = False,
+) -> int:
+    """Refresh all of a user's agent runtimes after a credential change."""
+    user = str(user_id or "").strip()
+    if not user:
+        return 0
+    user_part = re.sub(
+        r"[^a-z0-9]+",
+        "-",
+        _srv()._user_hermes_dir_slug(user).lower(),
+    ).strip("-")[:20] or "user"
+    prefix = f"u-{user_part}-"
+    profiles_dir = _srv().HERMES_DATA / "profiles"
+    if not profiles_dir.is_dir():
+        return 0
+    refreshed = 0
+    for path in profiles_dir.iterdir():
+        if not path.is_dir() or not path.name.startswith(prefix):
+            continue
+        try:
+            if _prepare_runtime_profile_credentials(
+                path.name,
+                user,
+                workspace_id,
+                wait_healthy=wait_healthy,
+            ):
+                refreshed += 1
+        except (OSError, RuntimeError, ValueError):
+            continue
+    return refreshed
+
+
+def _refresh_workspace_runtime_credentials(
+    workspace_id: str,
+    *,
+    wait_healthy: bool = False,
+) -> int:
+    """Refresh active member runtimes after a company credential changes."""
+    workspace = str(workspace_id or "").strip()
+    if not workspace:
+        return 0
+    conn = _srv()._workframe_db()
+    try:
+        rows = conn.execute(
+            """
+            SELECT DISTINCT user_id FROM workspace_memberships
+            WHERE workspace_id = ? AND status = 'active' AND deleted_at IS NULL
+            """,
+            (workspace,),
+        ).fetchall()
+    finally:
+        conn.close()
+    return sum(
+        _refresh_user_runtime_credentials(
+            str(row["user_id"]),
+            workspace,
+            wait_healthy=wait_healthy,
+        )
+        for row in rows
+    )
 
 
 def _resolve_runtime_owner(runtime: str) -> tuple[str, str] | None:
@@ -111,12 +192,9 @@ def _user_owner_name(user_id: str) -> str:
 
 def _runtime_display_label(user_id: str, template_slug: str, workspace_id: str = "") -> str:
     template = _srv().safe_profile_slug(str(template_slug or "").strip())
-    user_id = str(user_id or "").strip()
-    if user_id:
-        runtime = _runtime_profile_slug(user_id, template)
-        reg_runtime = _srv()._agent_registry_row(runtime)
-        if str(reg_runtime.get("display_name") or "").strip():
-            return str(reg_runtime["display_name"]).strip()
+    # Runtime profiles are credential/session proxies. Their registry rows may
+    # contain stale metadata from older builds, but can never rename the shared
+    # workspace agent.
     custom = _srv()._agent_db_display_name(template, workspace_id)
     if custom:
         return custom
@@ -124,11 +202,11 @@ def _runtime_display_label(user_id: str, template_slug: str, workspace_id: str =
     if reg.get("display_name"):
         return str(reg["display_name"])
     if _srv()._is_native_profile(template) or template.endswith("-agent"):
-        return f"{_user_owner_name(user_id)}'s {_srv()._native_display_name().replace(' Agent', '')} Agent"
+        return _srv()._native_display_name()
     role = _srv()._agent_db_display_name(template, workspace_id) or _srv()._agent_registry_row(template).get("display_name")
     if not role:
         role = template.replace("-", " ").title()
-    return f"{_user_owner_name(user_id)}'s {role}"
+    return str(role)
 
 
 def _cohort_alias(user_id: str, template_slug: str) -> str:
@@ -465,6 +543,8 @@ def _write_workframe_cohort_manifest(user_id: str, workspace_id: str, cohort: li
         path = _srv()._profile_dir(runtime) / "WORKFRAME_COHORT.md"
         try:
             path.parent.mkdir(parents=True, exist_ok=True)
+            if path.is_file() and path.read_text(encoding="utf-8") == body:
+                continue
             path.write_text(body, encoding="utf-8")
         except OSError:
             pass
@@ -616,6 +696,11 @@ def _copy_text_without_bom(src: Path, dst: Path) -> None:
     if raw.startswith(b"\xef\xbb\xbf"):
         raw = raw[3:]
     dst.parent.mkdir(parents=True, exist_ok=True)
+    try:
+        if dst.is_file() and dst.read_bytes() == raw:
+            return
+    except OSError:
+        pass
     dst.write_bytes(raw)
 
 
@@ -648,10 +733,7 @@ def _backfill_runtime_identity(runtime: str, template: str) -> None:
     for name in ("SOUL.md", "AGENTS.md", "SETUP.md"):
         src = tdir / name
         dst = rdir / name
-        if name == "SOUL.md":
-            if _srv()._write_profile_soul_if_stub(runtime, template):
-                continue
-        if src.is_file() and not dst.is_file():
+        if src.is_file():
             try:
                 _copy_text_without_bom(src, dst)
             except OSError:
@@ -680,13 +762,15 @@ def _profile_toolsets_ready(profile: str, want: tuple[str, ...] | list[str]) ->
     if not names:
         return True
     ts = cfg.get("toolsets") if isinstance(cfg.get("toolsets"), list) else []
-    if not all(name in ts for name in names):
-        return False
+    global_ready = all(name in ts for name in names)
     pts = cfg.get("platform_toolsets") if isinstance(cfg.get("platform_toolsets"), dict) else {}
+    platform_ready = True
     for platform in ("api_server", "cli"):
         plat = pts.get(platform) if isinstance(pts.get(platform), list) else []
         if not all(name in plat for name in names):
-            return False
+            platform_ready = False
+    if not global_ready and not platform_ready:
+        return False
     agent = cfg.get("agent") if isinstance(cfg.get("agent"), dict) else {}
     disabled = agent.get("disabled_toolsets") if isinstance(agent.get("disabled_toolsets"), list) else []
     return not any(name in disabled for name in names)
@@ -724,16 +808,20 @@ def ensure_runtime_profile(
             ok, out, _port = _srv()._configure_profile_api(runtime)
             if not ok:
                 raise ValueError(f"runtime profile api config failed: {out}")
-        skills_dir = _srv()._profile_dir(runtime) / "skills"
-        if not skills_dir.is_dir() or not any(skills_dir.iterdir()):
-            _backfill_runtime_identity(runtime, template)
+        _backfill_runtime_identity(runtime, template)
         if not _profile_toolsets_ready(runtime, _srv()._chat_toolsets_for_profile(runtime)):
             _srv()._ensure_profile_toolsets(runtime)
         _ensure_profile_terminal_cwd(runtime)
-        # Existing profiles still need invariant repair.  This deliberately does
-        # not copy template model preferences; reconciliation keeps the agent's
-        # model when the acting user can use it and falls back to that user's
-        # connected providers otherwise.
+        # A runtime isolates credentials/gateway state, not agent preferences.
+        # Repair model drift before credential preparation so DM, room mention,
+        # kanban, and cron all execute the model owned by the agent template.
+        ok_model, model_error = _srv()._sync_runtime_model_from_template(
+            runtime,
+            template,
+            user_id=user_id,
+        )
+        if not ok_model:
+            raise ValueError(f"runtime model sync failed: {model_error}")
         _prepare_runtime_profile_credentials(runtime, user_id, workspace_id)
         _srv()._ensure_profile_proxy_headers(runtime)
         return
@@ -759,4 +847,11 @@ def ensure_runtime_profile(
         raise ValueError(f"runtime profile api config failed: {out}")
     _srv()._ensure_profile_toolsets(runtime)
     _ensure_profile_terminal_cwd(runtime)
+    ok_model, model_error = _srv()._sync_runtime_model_from_template(
+        runtime,
+        template,
+        user_id=user_id,
+    )
+    if not ok_model:
+        raise ValueError(f"runtime model sync failed: {model_error}")
     _prepare_runtime_profile_credentials(runtime, user_id, workspace_id)

package/workframe-api/scripts/run-python.mjs

@@ -0,0 +1,28 @@
+import { spawnSync } from 'node:child_process'
+
+const requestedArgs = process.argv.slice(2)
+const candidates = process.platform === 'win32'
+  ? [
+      { command: 'python', prefix: [] },
+      { command: 'py', prefix: ['-3'] },
+      { command: 'python3', prefix: [] },
+    ]
+  : [
+      { command: 'python3', prefix: [] },
+      { command: 'python', prefix: [] },
+    ]
+
+for (const candidate of candidates) {
+  const result = spawnSync(candidate.command, [...candidate.prefix, ...requestedArgs], {
+    stdio: 'inherit',
+  })
+  if (result.error?.code === 'ENOENT') continue
+  if (result.error) {
+    console.error(`Could not run ${candidate.command}: ${result.error.message}`)
+    process.exit(1)
+  }
+  process.exit(result.status ?? 1)
+}
+
+console.error('Python 3 was not found. Install Python 3 and ensure py, python, or python3 is available.')
+process.exit(1)

package/workframe-api/server.py

@@ -109,6 +109,8 @@ file_read = workspace_files.file_read
 file_write = workspace_files.file_write
 file_upload_binary = workspace_files.file_upload_binary
 file_raw = workspace_files.file_raw
+files_archive = workspace_files.files_archive
+files_delete = workspace_files.files_delete
 
 import activity_feed
 
@@ -162,6 +164,8 @@ _assign_agent_avatar = avatar_registry._assign_agent_avatar
 # WF-032: runtime_cohort re-exports
 _runtime_profile_slug = runtime_cohort._runtime_profile_slug
 _prepare_runtime_profile_credentials = runtime_cohort._prepare_runtime_profile_credentials
+_refresh_user_runtime_credentials = runtime_cohort._refresh_user_runtime_credentials
+_refresh_workspace_runtime_credentials = runtime_cohort._refresh_workspace_runtime_credentials
 _resolve_runtime_owner = runtime_cohort._resolve_runtime_owner
 _user_handle = runtime_cohort._user_handle
 _user_owner_name = runtime_cohort._user_owner_name
@@ -269,6 +273,7 @@ _resolve_models_profile = model_surface._resolve_models_profile
 _model_suggestion_row = model_surface._model_suggestion_row
 _augment_model_suggestions = model_surface._augment_model_suggestions
 _billing_provider_from_block = model_surface._billing_provider_from_block
+_normalized_profile_fallback_chain = model_surface._normalized_profile_fallback_chain
 _llm_billing_provider = model_surface._llm_billing_provider
 _profile_llm_proxy_matches_billing = model_surface._profile_llm_proxy_matches_billing
 _profile_routing_matches_billing = model_surface._profile_routing_matches_billing
@@ -278,6 +283,7 @@ _catalog_row_for_billing_provider = model_surface._catalog_row_for_billing_provi
 _provider_display_label = model_surface._provider_display_label
 _model_catalog_rows_for_provider = model_surface._model_catalog_rows_for_provider
 _suggestions_for_connected_llm_providers = model_surface._suggestions_for_connected_llm_providers
+_live_suggestions_for_connected_llm_providers = model_surface._live_suggestions_for_connected_llm_providers
 _model_id_vendor_and_bare = model_surface._model_id_vendor_and_bare
 _persisted_model_id = model_surface._persisted_model_id
 _apply_model_persisted = model_surface._apply_model_persisted
@@ -1382,6 +1388,7 @@ _user_action_env_specs = turn_overlay._user_action_env_specs
 _overlay_turn_user_env = turn_overlay._overlay_turn_user_env
 _apply_action_credential_lease = turn_overlay._apply_action_credential_lease
 _revoke_turn_credential_lease = turn_overlay._revoke_turn_credential_lease
+_revoke_runtime_llm_leases = turn_overlay._revoke_runtime_llm_leases
 _require_user_provider = turn_overlay._require_user_provider
 _require_runtime_owner_provider = turn_overlay._require_runtime_owner_provider
 _strip_profile_llm_env = turn_overlay._strip_profile_llm_env
@@ -1467,11 +1474,32 @@ def _enrich_room_messages(conn: sqlite3.Connection, messages: list[Any]) -> list
     enriched: list[dict[str, Any]] = []
     for row in messages:
         item = dict(row)
+        # Provider/model attribution is turn evidence, not mutable agent state.
+        # New agent messages persist it in messages.metadata.  Legacy messages
+        # without that evidence intentionally render without a model badge rather
+        # than being relabelled whenever the agent's current model changes.
+        metadata: dict[str, Any] = {}
+        raw_metadata = item.get("metadata")
+        if isinstance(raw_metadata, dict):
+            metadata = raw_metadata
+        elif isinstance(raw_metadata, str) and raw_metadata.strip():
+            try:
+                parsed = json.loads(raw_metadata)
+                if isinstance(parsed, dict):
+                    metadata = parsed
+            except (TypeError, ValueError, json.JSONDecodeError):
+                metadata = {}
+        turn_model = str(metadata.get("model") or "").strip()
+        turn_provider = str(metadata.get("llm_provider") or "").strip()
+        if turn_model:
+            item["model"] = turn_model
+        if turn_provider:
+            item["llm_provider"] = turn_provider
         agent_id = str(item.get("sender_agent_id") or "").strip()
         if agent_id:
             agent = conn.execute(
                 """
-                SELECT slug, display_name, model_name, model_provider
+                SELECT slug, display_name
                 FROM agent_profiles WHERE id = ? AND deleted_at IS NULL
                 """,
                 (agent_id,),
@@ -1479,17 +1507,6 @@ def _enrich_room_messages(conn: sqlite3.Connection, messages: list[Any]) -> list
             if agent:
                 item["sender_agent_slug"] = str(agent["slug"])
                 item["sender_agent_name"] = str(agent["display_name"] or agent["slug"])
-                model_name = str(agent["model_name"] or "").strip()
-                model_provider = str(agent["model_provider"] or "").strip()
-                slug = str(agent["slug"] or "").strip()
-                if not model_name and slug:
-                    model_name = str(_read_model_block(slug).get("default") or "").strip()
-                if not model_provider and slug:
-                    model_provider = _llm_billing_provider(slug)
-                if model_name:
-                    item["model"] = model_name
-                if model_provider:
-                    item["llm_provider"] = model_provider
         enriched.append(item)
     return enriched
 
@@ -1542,10 +1559,13 @@ def _sync_agent_profile_db(profile: str, fields: dict[str, Any]) -> None:
         "tagline": "tagline",
         "role": "role",
         "avatar_url": "avatar_url",
+        "model_provider": "model_provider",
+        "model_name": "model_name",
     }
     updates = {column: fields[key] for key, column in column_map.items() if key in fields}
     if not updates:
         return
+    _ensure_workframe_db_schema()
     conn = _workframe_db()
     try:
         now_ts = str(int(time.time()))
@@ -1555,6 +1575,18 @@ def _sync_agent_profile_db(profile: str, fields: dict[str, Any]) -> None:
             f"UPDATE agent_profiles SET {', '.join(sets)}, updated_at = ? WHERE slug = ? AND deleted_at IS NULL",
             vals,
         )
+        if "display_name" in updates and str(updates["display_name"] or "").strip():
+            conn.execute(
+                """
+                UPDATE rooms
+                SET name = ?, updated_at = ?
+                WHERE room_type = 'direct' AND deleted_at IS NULL
+                  AND agent_profile_id IN (
+                    SELECT id FROM agent_profiles WHERE slug = ? AND deleted_at IS NULL
+                  )
+                """,
+                (str(updates["display_name"]).strip(), now_ts, slug),
+            )
         conn.commit()
     finally:
         conn.close()