dsh-code 1.0.2 → 1.0.4

package/src/mentions.ts

@@ -120,29 +120,54 @@ export function createMentions(ctx: Context, agent: Agent | undefined, cwd: stri
   const sessionCapable = agent !== undefined && resolver !== undefined
   // Pre-session fallback: one lazily built search over the launch cwd with
   // the official defaults — pure in-memory index, no handles to release.
+  // The mounted service invalidates its per-agent index after every tool
+  // result; nothing drives that for this bare instance, so a time window
+  // refreshes it instead — without it, files created or deleted before the
+  // first session never appear in (or never leave) the fuzzy @ menu.
+  const PRE_SESSION_INDEX_TTL_MS = 30_000
   let preSessionSearch: WorkspaceFileSearch | undefined
+  let preSessionIndexedAt = 0
   const preSessionFiles = (query: string, signal?: AbortSignal): Promise<readonly ServiceFileCandidate[]> => {
-    preSessionSearch ??= new WorkspaceFileSearch(cwd, {
-      maxResults: DEFAULT_FILE_SEARCH_MAX_RESULTS,
-      maxEntries: DEFAULT_FILE_SEARCH_MAX_ENTRIES,
-      excludedDirectories: [...DEFAULT_FILE_SEARCH_EXCLUDED_DIRECTORIES],
-    })
+    if (preSessionSearch === undefined || Date.now() - preSessionIndexedAt > PRE_SESSION_INDEX_TTL_MS) {
+      preSessionSearch?.invalidate()
+      preSessionSearch = new WorkspaceFileSearch(cwd, {
+        maxResults: DEFAULT_FILE_SEARCH_MAX_RESULTS,
+        maxEntries: DEFAULT_FILE_SEARCH_MAX_ENTRIES,
+        excludedDirectories: [...DEFAULT_FILE_SEARCH_EXCLUDED_DIRECTORIES],
+      })
+      preSessionIndexedAt = Date.now()
+    }
     return preSessionSearch.list(query, signal ?? new AbortController().signal)
   }
 
   return {
     async candidates(query: string, signal?: AbortSignal): Promise<readonly MentionCandidate[]> {
       const needle = query.trim()
+      // A failed discovery half is remembered, never masked: when NOTHING came
+      // back the rejection tells the menu "search unavailable" instead of a
+      // silent empty list that reads as "no matches". A half that still
+      // returned rows shows them — partial results beat an error wall.
+      let fileFailure: unknown
+      let sessionFailure: unknown
       const [files, sessions] = await Promise.all([
         agent !== undefined && fileReferences !== undefined
           ? fileReferences
             .list(agent, needle, signal ?? new AbortController().signal)
-            .catch(() => [] as readonly ServiceFileCandidate[])
+            .catch((error: unknown) => {
+              fileFailure = error
+              return [] as readonly ServiceFileCandidate[]
+            })
           : agent === undefined
-            ? preSessionFiles(needle, signal).catch(() => [] as readonly ServiceFileCandidate[])
+            ? preSessionFiles(needle, signal).catch((error: unknown) => {
+              fileFailure = error
+              return [] as readonly ServiceFileCandidate[]
+            })
             : Promise.resolve([] as readonly ServiceFileCandidate[]),
         sessionCapable && needle !== '' && !isPathLikeMentionQuery(needle) && agent !== undefined
-          ? resolver!.listCandidates(agent, needle, 10, signal).catch(() => [] as readonly SessionReferenceCandidate[])
+          ? resolver!.listCandidates(agent, needle, 10, signal).catch((error: unknown) => {
+            sessionFailure = error
+            return [] as readonly SessionReferenceCandidate[]
+          })
           : Promise.resolve([] as readonly SessionReferenceCandidate[]),
       ])
       // The service owns ranking (and the bare-@ default rows); the menu caps
@@ -161,7 +186,15 @@ export function createMentions(ctx: Context, agent: Agent | undefined, cwd: stri
         description: `Session · ${candidate.cwd ?? '(no cwd)'}`,
         kind: 'session',
       }))
-      return [...fileRows, ...sessionRows]
+      const rows = [...fileRows, ...sessionRows]
+      if (rows.length === 0 && (fileFailure !== undefined || sessionFailure !== undefined)) {
+        throw fileFailure instanceof Error
+          ? fileFailure
+          : sessionFailure instanceof Error
+            ? sessionFailure
+            : new Error(String(fileFailure ?? sessionFailure))
+      }
+      return rows
     },
     parse(text: string): ParsedSessionReferenceText {
       return parseSessionReferenceText(text)

package/src/model-capabilities.ts

@@ -0,0 +1,318 @@
+/**
+ * Same-id reasoning-capability inheritance for hand-declared pi-ai routes:
+ * the model catalog inherits capabilities by route key, not by model id, so a
+ * relay route listing `gpt-5.5` reads nothing from the installed `openai`
+ * catalog entry and materializes as `reasoning: false` until its settings
+ * entry declares `reasoningEfforts`. This adapter closes that gap without
+ * touching upstream: whenever a pi-ai profile's model entry carries no
+ * declaration and its live row advertises no efforts, but the same model id
+ * is declared (in a sibling settings entry) or advertised (on another route)
+ * elsewhere, the declaration is materialized into settings — verbatim from a
+ * sibling declaration when one exists, otherwise as an identity level map
+ * (`off` maps to null, every other level to its own name), which is the
+ * correct wire spelling for OpenAI-compatible relays. Writes ride the same
+ * `settings.mutate` path as the provider panel, so the upstream
+ * `assertServiceable` gate still rejects anything invalid atomically.
+ *
+ * @module @deepseek-ai/dsh-tui/model-capabilities
+ */
+
+import type { Context } from '@deepseek-ai/cordis'
+import { loadModelDirectory, type ModelRow } from './models.ts'
+
+/** The settings namespace the llm-pi-ai plugin owns (identity via `settingsNamespace`). */
+const PI_AI_SETTINGS_NS = 'llm-pi-ai'
+
+/** The effort level that means "send no reasoning parameter"; its wire value is always null. */
+const OFF_LEVEL = 'off'
+
+/* ------------------------------------------------------------------ *
+ * Structural service faces (same discipline as provider-settings: the
+ * settings package is never imported, only described structurally).
+ * ------------------------------------------------------------------ */
+
+/** One configurable-provider directory entry (subset of the `llm` service face). */
+interface ConfigurableEntryFace {
+  readonly provider: string
+  readonly settingsNs: string
+  readonly settingsPath: readonly string[]
+}
+
+/** One redacted settings descriptor (subset of `SettingsDescriptor`). */
+interface DescriptorFace {
+  readonly ns: string
+  readonly value: unknown
+  readonly revision: number
+}
+
+/** One path-addressed edit to a stored section (subset of `SettingsPathOp`). */
+interface PathOpFace {
+  readonly op: 'set' | 'unset'
+  readonly path: readonly string[]
+  readonly value?: unknown
+}
+
+/** The subset of the `settings` service this module reads and writes. */
+interface SettingsFace {
+  describe(options?: { readonly redactSecrets?: boolean }): readonly DescriptorFace[]
+  mutate(ns: string, ops: readonly PathOpFace[], expectedRevision?: number): Promise<void>
+}
+
+/** A notice sink structurally compatible with the app bridge's `notify`. */
+export type CapabilityNotice = (text: string, tone?: 'info' | 'warning' | 'error') => void
+
+/** Single-line a misbehaving error for the notice channel. */
+function singleLine(message: string): string {
+  const spaced = [...message].map(ch => { const code = ch.charCodeAt(0); return code < 32 || code === 127 ? ' ' : ch }).join('')
+  return spaced.split(' ').filter(part => part !== '').join(' ')
+}
+
+/** Human text for a rejection value. */
+function messageOf(error: unknown): string {
+  return error instanceof Error ? error.message : String(error)
+}
+
+/** Read the value at a path through plain objects; undefined when any segment misses. */
+function getPath(value: unknown, path: readonly string[]): unknown {
+  let current = value
+  for (const segment of path) {
+    if (typeof current !== 'object' || current === null) return undefined
+    current = (current as Record<string, unknown>)[segment]
+  }
+  return current
+}
+
+/** Whether a raw settings value is a usable `reasoningEfforts` dict (non-empty, non-false). */
+function isDeclaredEfforts(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value) && Object.keys(value).length > 0
+}
+
+/**
+ * The identity level map for an advertised effort list: `off` sends no
+ * parameter, every other level keeps its own name — the wire spelling
+ * OpenAI-compatible relays accept as-is.
+ */
+function identityEfforts(levels: readonly string[]): Record<string, string | null> {
+  const dict: Record<string, string | null> = {}
+  for (const level of levels) dict[level] = level === OFF_LEVEL ? null : level
+  return dict
+}
+
+/* ------------------------------------------------------------------ *
+ * Pure planning.
+ * ------------------------------------------------------------------ */
+
+/** One pi-ai provider profile as stored in settings, addressed for mutation. */
+export interface CapabilityProfileSource {
+  /** Settings namespace owning the profile (`llm-pi-ai`). */
+  readonly settingsNs: string
+  /** Path from the section root to this provider's profile. */
+  readonly settingsPath: readonly string[]
+  /** Revision of the owning section at read time. */
+  readonly revision: number
+  /** Raw model entries, exactly as stored (declaration fields included). */
+  readonly models: readonly Record<string, unknown>[]
+}
+
+/** One planned per-provider models rewrite. */
+export interface CapabilitySyncPlan {
+  /** Provider route the plan targets. */
+  readonly provider: string
+  /** Settings namespace owning the profile. */
+  readonly settingsNs: string
+  /** Path from the section root to the provider profile. */
+  readonly settingsPath: readonly string[]
+  /** Raw model entries, exactly as stored (declaration fields included). */
+  readonly models: readonly Record<string, unknown>[]
+  /** Fingerprint of the source models array this plan was derived from. */
+  readonly sourceFingerprint: string
+  /** Document revision of the owning section when the plan was derived. */
+  readonly sourceRevision: number
+  /** Model ids that gained a declaration, notice-facing. */
+  readonly inherited: readonly string[]
+  /** `provider/model` labels the declarations came from, notice-facing. */
+  readonly sources: readonly string[]
+}
+
+/**
+ * Plan the reasoning declarations to materialize. A model entry inherits
+ * when it declares nothing (`reasoningEfforts` absent — a dict or `false` is
+ * an explicit choice and is never touched) and its live row advertises no
+ * efforts; the donor is the first sibling settings declaration for the same
+ * id, copied verbatim so dialect wire spellings survive, otherwise the first
+ * other-route row advertising efforts for that id, mapped by identity.
+ * Entries never lose fields and keep their key order; a provider appears in
+ * the result only when at least one entry changes.
+ * @param input - the live model rows and the raw pi-ai profiles from settings.
+ * @returns one plan per provider with at least one inheritance.
+ */
+export function planCapabilitySync(input: {
+  readonly rows: readonly ModelRow[]
+  readonly profiles: ReadonlyMap<string, CapabilityProfileSource>
+}): readonly CapabilitySyncPlan[] {
+  // Sibling declarations, first profile order wins: { id -> { dict, provider } }.
+  const declared = new Map<string, { dict: Record<string, unknown>; provider: string }>()
+  for (const [provider, profile] of input.profiles) {
+    for (const entry of profile.models) {
+      const efforts = entry.reasoningEfforts
+      if (!isDeclaredEfforts(efforts)) continue
+      if (!declared.has(String(entry.id))) declared.set(String(entry.id), { dict: efforts, provider })
+    }
+  }
+  // Advertised donors, first row order wins: { id -> { levels, provider } }.
+  // A row whose only level is `off` advertises nothing usable and is skipped.
+  const advertised = new Map<string, { levels: readonly string[]; provider: string }>()
+  for (const row of input.rows) {
+    const levels = row.reasoning?.efforts.map(effort => effort.id) ?? []
+    if (levels.filter(level => level !== OFF_LEVEL).length === 0) continue
+    if (!advertised.has(row.model)) advertised.set(row.model, { levels, provider: row.provider })
+  }
+  const plans: CapabilitySyncPlan[] = []
+  for (const [provider, profile] of input.profiles) {
+    const inherited: string[] = []
+    const sources: string[] = []
+    const models = profile.models.map((entry): Record<string, unknown> => {
+      if (entry.reasoningEfforts !== undefined) return entry
+      const id = String(entry.id)
+      const sibling = declared.get(id)
+      if (sibling !== undefined && sibling.provider !== provider) {
+        inherited.push(id)
+        if (!sources.includes(`${sibling.provider}/${id}`)) sources.push(`${sibling.provider}/${id}`)
+        return { ...entry, reasoningEfforts: sibling.dict }
+      }
+      const donor = advertised.get(id)
+      if (donor !== undefined && donor.provider !== provider) {
+        inherited.push(id)
+        if (!sources.includes(`${donor.provider}/${id}`)) sources.push(`${donor.provider}/${id}`)
+        return { ...entry, reasoningEfforts: identityEfforts(donor.levels) }
+      }
+      return entry
+    })
+    if (inherited.length > 0) {
+      plans.push({
+        provider,
+        settingsNs: profile.settingsNs,
+        settingsPath: profile.settingsPath,
+        models,
+        sourceFingerprint: JSON.stringify(profile.models),
+        sourceRevision: profile.revision,
+        inherited,
+        sources,
+      })
+    }
+  }
+  return plans
+}
+
+/* ------------------------------------------------------------------ *
+ * Application.
+ * ------------------------------------------------------------------ */
+
+/** Provider -> the source snapshot and document revision its last write landed against. */
+const lastApplied = new Map<string, { fingerprint: string; revision: number }>()
+
+/** Fresh revision of one namespace, or undefined when it does not resolve. */
+function revisionOf(settings: SettingsFace, ns: string): number | undefined {
+  try {
+    for (const descriptor of settings.describe({ redactSecrets: true })) {
+      if (descriptor.ns === ns) return descriptor.revision
+    }
+  } catch {
+    return undefined
+  }
+  return undefined
+}
+
+/**
+ * Materialize same-id reasoning declarations once per provider. Reads the
+ * configurable directory, the redacted settings document, and the live model
+ * rows; plans; then writes each provider's merged models array through
+ * `settings.mutate` under a fresh revision (writes bump the section
+ * revision, so per-plan revisions are re-read). Every failure converges to a
+ * single-line notice — the caller's promise never rejects and the session
+ * keeps running on the previous configuration.
+ * @param ctx - context carrying the `llm` and `settings` services (optional).
+ * @param notify - the app bridge's notice sink, when one is live.
+ */
+export async function syncModelCapabilities(ctx: Context, notify?: CapabilityNotice): Promise<void> {
+  try {
+    const llm = ctx.get('llm') as { listConfigurableProviders?: () => readonly ConfigurableEntryFace[] } | undefined
+    if (llm?.listConfigurableProviders === undefined) return
+    const settings = ctx.get('settings') as SettingsFace | undefined
+    if (settings === undefined) return
+    let entries: readonly ConfigurableEntryFace[]
+    try {
+      entries = llm.listConfigurableProviders()
+    } catch {
+      return
+    }
+    const routed = entries.filter(entry => entry.settingsNs === PI_AI_SETTINGS_NS)
+    if (routed.length === 0) return
+    let descriptors: readonly DescriptorFace[]
+    try {
+      descriptors = settings.describe({ redactSecrets: true })
+    } catch {
+      return
+    }
+    const namespaces = new Map(descriptors.map(descriptor => [descriptor.ns, descriptor] as const))
+    const profiles = new Map<string, CapabilityProfileSource>()
+    for (const entry of routed) {
+      const namespace = namespaces.get(entry.settingsNs)
+      if (namespace === undefined) continue
+      const profile = entry.settingsPath.length === 0
+        ? namespace.value
+        : getPath(namespace.value, entry.settingsPath)
+      const models = Array.isArray((profile as { models?: unknown } | null)?.models)
+        ? (profile as { models: unknown }).models as readonly Record<string, unknown>[]
+        : undefined
+      // An absent models list is a dormant or unconfigured route: nothing to
+      // inherit into (and the empty allow-list there is deliberate upstream).
+      if (models === undefined) continue
+      profiles.set(entry.provider, {
+        settingsNs: entry.settingsNs,
+        settingsPath: entry.settingsPath,
+        revision: namespace.revision,
+        models,
+      })
+    }
+    if (profiles.size === 0) return
+    const directory = await loadModelDirectory(ctx)
+    for (const plan of planCapabilitySync({ rows: directory.rows, profiles })) {
+      // Skip only a provable echo of our own write: the same source
+      // snapshot at the same document revision we already wrote against
+      // (our write re-triggers the document event before the re-read
+      // catches up). An external edit that removes a materialized
+      // declaration bumps the revision, so identical source content
+      // re-plans and re-writes instead of being skipped forever.
+      const applied = lastApplied.get(plan.provider)
+      if (applied !== undefined && applied.fingerprint === plan.sourceFingerprint && applied.revision === plan.sourceRevision) continue
+      // Writes bump the section revision; re-read per plan so the second
+      // provider's optimistic revision is not already stale.
+      const revision = revisionOf(settings, plan.settingsNs)
+      if (revision === undefined) continue
+      try {
+        await settings.mutate(
+          plan.settingsNs,
+          [{ op: 'set', path: [...plan.settingsPath, 'models'], value: plan.models }],
+          revision,
+        )
+        lastApplied.set(plan.provider, { fingerprint: plan.sourceFingerprint, revision: plan.sourceRevision })
+        const shown = plan.sources.slice(0, 3).join(', ')
+        const more = plan.sources.length > 3 ? `, +${plan.sources.length - 3}` : ''
+        notify?.(
+          `inherited reasoning levels for ${plan.inherited.length} model${plan.inherited.length === 1 ? '' : 's'} on ${plan.provider} (from ${shown}${more})`,
+          'info',
+        )
+      } catch (error) {
+        notify?.(`capability inheritance failed on ${plan.provider}: ${singleLine(messageOf(error))}`, 'warning')
+      }
+    }
+  } catch {
+    // A background sync must never surface as an unhandled rejection.
+  }
+}
+
+/** Test seam: forget the applied-write fingerprints. */
+export function resetCapabilitySyncState(): void {
+  lastApplied.clear()
+}

package/src/provider-settings.ts

@@ -34,6 +34,21 @@ interface LlmFace {
     readonly settingsPath: readonly string[]
     readonly declared?: boolean
   }[]
+  /**
+   * Registered endpoint model discovery; absent on an older service. The
+   * request is a draft (provider route and/or baseURL, optional one-shot
+   * key); the reply is candidate metadata for adoption, never a write.
+   */
+  discoverModels?(
+    settingsNs: string,
+    request: { readonly provider?: string; readonly baseURL?: string; readonly api?: string; readonly apiKey?: string },
+    signal?: AbortSignal,
+  ): Promise<readonly {
+    readonly id: string
+    readonly name?: string
+    readonly contextWindow?: number
+    readonly maxTokens?: number
+  }[]>
 }
 
 /** One redacted settings descriptor (subset of `SettingsDescriptor`). */
@@ -71,11 +86,19 @@ interface ProviderEventsFace {
   on(event: string, listener: (...args: unknown[]) => void): () => void
 }
 
+/** One resolved credential value; never rendered, never persisted by callers. */
+interface CredentialValueFace {
+  readonly value: string
+  readonly source: string
+}
+
 /** The subset of the `credentials` service this module reads and writes. */
 interface CredentialsFace {
   describe(ref: string): Promise<CredentialFactsFace>
   set(ref: string, value: string): Promise<void>
   unset(ref: string): Promise<void>
+  /** Same-process value resolution; absent on an older service. */
+  resolve?(ref: string): Promise<CredentialValueFace | undefined>
 }
 
 /* ------------------------------------------------------------------ *
@@ -138,15 +161,21 @@ function configurationOf(profile: unknown): ProviderConfiguration {
     if (typeof value !== 'object' || value === null) return []
     const entry = value as Record<string, unknown>
     if (typeof entry.id !== 'string' || entry.id.trim() === '') return []
+    // Fields the editor does not understand ride along untouched: dropping
+    // them here would let the next save strip hand-written reasoningEfforts
+    // or compat declarations out of the stored profile.
+    const { id: _id, name: _name, contextWindow: _contextWindow, maxTokens: _maxTokens, ...extras } = entry
     return [{
       id: entry.id,
       ...(typeof entry.name === 'string' && entry.name.trim() !== '' ? { name: entry.name } : {}),
       ...(typeof entry.contextWindow === 'number' && Number.isFinite(entry.contextWindow) ? { contextWindow: entry.contextWindow } : {}),
       ...(typeof entry.maxTokens === 'number' && Number.isFinite(entry.maxTokens) ? { maxTokens: entry.maxTokens } : {}),
+      ...Object.keys(extras).length > 0 ? { extras } : {},
     }]
   })
   return {
     ...(typeof record.baseURL === 'string' && record.baseURL.trim() !== '' ? { baseURL: record.baseURL } : {}),
+    ...(typeof record.api === 'string' && record.api.trim() !== '' ? { api: record.api } : {}),
     models,
   }
 }
@@ -194,14 +223,112 @@ export interface ProviderModelSettings {
   readonly name?: string
   readonly contextWindow?: number
   readonly maxTokens?: number
+  /**
+   * Remaining entry fields the editor does not model (`reasoningEfforts`,
+   * `compat`, `input`, …), carried verbatim so a save preserves them.
+   * Populated by {@link loadProviderSettings}; never contains the four
+   * modelled keys.
+   */
+  readonly extras?: Readonly<Record<string, unknown>>
 }
 
 /** The small, portable subset of a provider profile the terminal edits. */
 export interface ProviderConfiguration {
   readonly baseURL?: string
+  /**
+   * Wire protocol the stored profile names (e.g. `openai-responses`), when it
+   * names one. Load-only: the editor never writes it, but endpoint discovery
+   * passes it so the listing speaks the same protocol as real requests.
+   */
+  readonly api?: string
   readonly models: readonly ProviderModelSettings[]
 }
 
+/** One model an endpoint reported about itself (mirrors `LlmDiscoveredModel`). */
+export interface DiscoveredModelView {
+  /** Model id the endpoint accepts. */
+  readonly id: string
+  /** Human-readable name when the endpoint supplies one. */
+  readonly name?: string
+  /** Context window when disclosed; adoption still owes it if absent. */
+  readonly contextWindow?: number
+  /** Output cap when disclosed. */
+  readonly maxTokens?: number
+}
+
+/** One model an endpoint reported about itself (mirrors LlmDiscoveredModel). */
+export interface DiscoveredModelView {
+  /** Model id the endpoint accepts. */
+  readonly id: string
+  /** Human-readable name when the endpoint supplies one. */
+  readonly name?: string
+  /** Context window when disclosed; adoption still owes it if absent. */
+  readonly contextWindow?: number
+  /** Output cap when disclosed. */
+  readonly maxTokens?: number
+}
+
+/**
+ * The seven canonical reasoning levels a reasoningEfforts key may name -
+ * pi-ai's THINKING_LEVELS. A pi-ai upgrade that adds or removes one fails
+ * upstream's own drift gate; this mirror exists so the terminal editor can
+ * validate drafts without importing the pi-ai package.
+ */
+export const REASONING_EFFORT_LEVELS = ['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'] as const
+
+/**
+ * One stored reasoningEfforts declaration: a display-level to wire-value map
+ * (null sends no reasoning parameter), an explicit false disabling the
+ * picker, or undefined leaving the entry to inherit.
+ */
+export type ReasoningEffortsValue = Record<string, string | null> | false | undefined
+
+/** Whether a raw extras value is a declared efforts dict (non-empty, non-false). */
+export function isDeclaredReasoningEfforts(value: unknown): value is Record<string, string | null> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value) && Object.keys(value).length > 0
+}
+
+/**
+ * Parse the setup page's compact efforts draft into a storable declaration.
+ * Grammar: empty = clear back to inherit; the single token "false" = disable
+ * the picker; otherwise space-separated level:wire pairs where level is one
+ * of REASONING_EFFORT_LEVELS and wire is any non-empty string or the literal
+ * "null" (send no parameter).
+ */
+export function parseReasoningEffortsDraft(draft: string):
+  | { readonly ok: true; readonly value: ReasoningEffortsValue }
+  | { readonly ok: false; readonly error: string } {
+  const text = draft.trim()
+  if (text === '') return { ok: true, value: undefined }
+  if (text === 'false') return { ok: true, value: false }
+  const value: Record<string, string | null> = {}
+  for (const token of text.split(/\s+/u)) {
+    const split = token.indexOf(':')
+    if (split <= 0 || split === token.length - 1) {
+      return { ok: false, error: 'each entry needs level:wire, got "' + token + '"' }
+    }
+    const level = token.slice(0, split)
+    const wire = token.slice(split + 1)
+    if (!(REASONING_EFFORT_LEVELS as readonly string[]).includes(level)) {
+      return { ok: false, error: '"' + level + '" is not a level; use one of ' + REASONING_EFFORT_LEVELS.join('/') }
+    }
+    if (level in value) {
+      return { ok: false, error: 'level "' + level + '" appears twice' }
+    }
+    value[level] = wire === 'null' ? null : wire
+  }
+  return { ok: true, value }
+}
+
+/** Serialize a stored declaration back to the compact draft form (stored key order preserved). */
+export function serializeReasoningEfforts(value: unknown): string {
+  if (value === false) return 'false'
+  if (!isDeclaredReasoningEfforts(value)) return ''
+  return Object.entries(value)
+    .map(([level, wire]) => level + ':' + (wire === null ? 'null' : String(wire)))
+    .join(' ')
+}
+
 /**
  * One provider row in the TUI provider-management panel: the configurable
  * directory entry joined with its settings profile and credential facts.
@@ -514,6 +641,10 @@ export async function saveProviderConfiguration(
     }
     return {
       id,
+      // Editor-invisible fields ride along after the id; the modelled keys
+      // spread last so a panel edit (or clear) always wins over a carried
+      // value. extras never contains those keys — see configurationOf.
+      ...model.extras,
       ...(model.name === undefined || model.name.trim() === '' ? {} : { name: model.name.trim() }),
       ...(model.contextWindow === undefined ? {} : { contextWindow: model.contextWindow }),
       ...(model.maxTokens === undefined ? {} : { maxTokens: model.maxTokens }),
@@ -535,6 +666,95 @@ export async function saveProviderConfiguration(
   }
 }
 
+/**
+ * Interrogate a provider endpoint for the models it really serves, through
+ * the model-discovery capability the provider's settings namespace
+ * registered — the same pipe the official Web Models page uses. The request
+ * is a draft: a typed key forces direct endpoint interrogation (gateway
+ * truth), while an empty key lets the harness resolve the route's stored
+ * credential; with neither baseURL nor route the adapter answers from its
+ * own knowledge.
+ * @param ctx - context carrying the `llm` service (optional discovery).
+ * @param target - provider row whose settings namespace serves the draft.
+ * @param request - typed key and/or endpoint override for this one probe.
+ * @param signal - caller cancellation (panel navigation aborts the probe).
+ * @returns the advertised models in endpoint order, deduplicated.
+ */
+export async function discoverProviderModels(
+  ctx: Context,
+  target: ProviderTargetView,
+  request: { readonly apiKey?: string; readonly baseURL?: string },
+  signal?: AbortSignal,
+): Promise<readonly DiscoveredModelView[]> {
+  if (target.settingsNs.length === 0) {
+    throw new ProviderSettingsError(`provider "${target.provider}" has no managed settings namespace; its models cannot be discovered here`)
+  }
+  const llm = ctx.get('llm') as LlmFace | undefined
+  if (llm?.discoverModels === undefined) {
+    throw new ProviderSettingsError('model discovery is unavailable in this profile; enter models by hand')
+  }
+  const typedKey = request.apiKey?.trim()
+  const baseURL = request.baseURL?.trim()
+  const hasUrl = baseURL !== undefined && baseURL !== ''
+  let oneShotKey = typedKey
+  // A filled endpoint means the user wants THAT endpoint's real list: sending
+  // the route id alongside would make the adapter short-circuit to its
+  // installed catalog (official providers) and ignore the URL entirely. The
+  // probe therefore goes out as a draft — with the typed key, or with the
+  // stored credential resolved once for this request (never displayed,
+  // never persisted; exactly what provider-mode resolution does internally).
+  if (hasUrl && (oneShotKey === undefined || oneShotKey === '')) {
+    const credentialsService = ctx.get('credentials') as CredentialsFace | undefined
+    const ref = target.credentialRef ?? target.suggestedRef
+    if (credentialsService?.resolve !== undefined && ref !== undefined) {
+      try {
+        // Call resolve AS A METHOD on the service: destructured off it the
+        // call loses `this` and throws on the provider's first field read
+        // (the same lesson loadProviderSettings documents for listProviders).
+        const resolved = await credentialsService.resolve(ref)
+        oneShotKey = resolved?.value
+      } catch {
+        // A failed resolution degrades to an unauthenticated probe; the
+        // endpoint's own 401 names the problem better than we can.
+      }
+    }
+  }
+  const draft = hasUrl
+    ? {
+      ...(oneShotKey !== undefined && oneShotKey !== '' ? { apiKey: oneShotKey } : {}),
+      baseURL: baseURL!,
+      ...target.configuration.api === undefined ? {} : { api: target.configuration.api },
+    }
+    : {
+      // No endpoint override: the route's own knowledge answers (the official
+      // catalog for builtin providers — richer than any listing).
+      provider: target.provider,
+    }
+  try {
+    const discovered = signal === undefined
+      ? await llm.discoverModels(target.settingsNs, draft)
+      : await llm.discoverModels(target.settingsNs, draft, signal)
+    // Defensive dedupe in endpoint order (the service dedupes too; an older
+    // one must not leak duplicate rows into the checkable list).
+    const seen = new Set<string>()
+    const rows: DiscoveredModelView[] = []
+    for (const model of discovered) {
+      if (typeof model.id !== 'string' || model.id.trim() === '' || seen.has(model.id)) continue
+      seen.add(model.id)
+      rows.push({
+        id: model.id,
+        ...model.name === undefined ? {} : { name: model.name },
+        ...model.contextWindow === undefined ? {} : { contextWindow: model.contextWindow },
+        ...model.maxTokens === undefined ? {} : { maxTokens: model.maxTokens },
+      })
+    }
+    return rows
+  } catch (error) {
+    if (signal?.aborted === true) throw error
+    throw new ProviderSettingsError(singleLine(messageOf(error)))
+  }
+}
+
 /**
  * Remove the currently named credential without touching the provider
  * profile. Only the resolved profile's own reference is unset; a dormant or