dsh-github-copilot 0.4.0-alpha.27 → 0.4.0-alpha.29

package/docs/official-first-016-alpha2.md

@@ -18,6 +18,12 @@ Prefer official implementations when they satisfy the requirement, including con
 | Lifecycle/Session seam: initialize policy before queued work; rebuild derived state safely | **Complete for serialized initialization:** official [Agent announcement](https://github.com/deepseek-ai/deepseek-harness/blob/ddefc45fbc7f8e46dd73185e68295696d1297887/packages/core/agent/src/index.ts#L524-L555) awaits `ctx.serial(..., 'agent/created', ...)`. | **Retain** awaited initialization and public projection integration; **retire** the old cache generation via `stateVersion: 2`. | Refold durable events, never add synchronous history reads or rewrite descriptors. Retire plugin lifecycle glue only if official dedicated-policy lifecycle covers creation, resume, cancellation, unload and recovery. Broad exact-source and live acceptance remain unverified. |
 | UI seam: integrated account controls, Models search/role cards and reversible cleanup | **Complete for extension slots:** official [Models section declaration](https://github.com/deepseek-ai/deepseek-harness/blob/ddefc45fbc7f8e46dd73185e68295696d1297887/packages/client/ui-settings-models/src/client/index.ts#L131-L141) exposes keyed/root `settings.models.provider-card` and list/root `settings.models.footer`. Full official parity for the companion workflows is **unverified**. | **Retain** additive contributions and old-Core fallback; preserve native Edit/Delete. | Retire each custom card only when official UI covers its account/discovery or search/role workflow with the same safety, accessibility and lifecycle behavior and passes actual Client/Desktop acceptance. Slot existence is not feature parity and does not authorize hiding or merging real routes. |
 
+## Compaction-budget follow-up (#146)
+
+Official alpha.2 support is **partial**: [combined model context and adapter purpose policy](https://github.com/deepseek-ai/deepseek-harness/blob/ddefc45fbc7f8e46dd73185e68295696d1297887/packages/llm/llm/src/types.ts) plus [transactional basic compaction](https://github.com/deepseek-ai/deepseek-harness/blob/ddefc45fbc7f8e46dd73185e68295696d1297887/packages/compaction/compaction-basic/src/index.ts) are reused unchanged. Independent Copilot prompt ceilings and full native-request admission remain companion-owned; stock summaries do not fit/chunk an already oversized prefix.
+
+**Retain** a metadata-driven estimated budget guard, optional exact-request pressure signalling through stock recovery, and capability-supported low summary effort only when no effort has been resolved. Preserve real catalog capacity, caller output cap, history, cancellation and native transport. No second compaction service, private mutation, automatic model switching or Core patch is added. Retire each companion component when official behavior covers its constraints and passes equivalent exact-runtime regression and migration qualification. [Detailed scope and recovery limitations](./copilot-compaction.md) distinguish prevention from already-oversized-history rescue; the historical alpha.25 evidence below is not qualification of this follow-up.
+
 ## Descriptor correction is not a history conversion
 
 Native `subagent/descriptor` was already **v3 in the retained rc.1 baseline**; the plugin's v1 expectation was a plugin/test bug. Alpha.25 admits the native continuable `spawn` descriptor with explicit `agentProvider`/`agentModel`, and validates its declared native fields. Native descriptor v3, plugin role-policy version, plugin projection cache version and whole-Session storage-format versions are separate concepts.

package/docs/session-search-routing.md

@@ -2,7 +2,7 @@
 
 ## Requested behavior
 
-Issue #135 separates the primary search provider from the final fallback. `github-copilot-search-routing.searchProvider` is `auto` or an exact registered search-provider ID; `defaultSearchProvider` is an independent ID or `none`. Auto follows the initiating Chat provider, never the global default. Copilot's owned aliases retain their existing account/model checks; other Chat IDs must exactly match an observed search registration, without name/suffix/model-family inference. This is a provider-level convention, not a promise of the same execution model or account across independent registries. GPT, Gemini and Grok models do not each become a separate Copilot search provider. Explicit/fallback Copilot uses its provider-owned `github-copilot.searchModel`.
+Issue #135 separates the primary search provider from the final fallback. `github-copilot-search-routing.searchProvider` is `auto` or an exact registered search-provider ID; `defaultSearchProvider` is an independent ID or `none`. Auto follows the initiating Chat provider, never the global default. Copilot's owned aliases retain their existing account/model checks; other Chat IDs must exactly match an observed search registration, without name/suffix/model-family inference. This is a provider-level convention, not a promise of the same execution model or account across independent registries. GPT, Gemini and Grok models do not each become a separate Copilot search provider. Issue #148 makes ordinary settings provider-only: explicit/fallback Copilot resolves account-owned Responses candidates internally unless a nonempty legacy `github-copilot.searchModel` override is present.
 
 All implementation belongs to this plugin. No Core source, deployed Core artifact, prototype, private registry, credential copy or global chat-model choice is modified. The original official WebRuntime configuration, including its selected search/fetch providers, is preserved. The routed facade mirrors public search-provider registrations so exact-id selection works for official and community providers without reading Core's private registry.
 
@@ -13,7 +13,7 @@ Modern Core may mount `tool-web` in agent presets while disabling its historical
 1. An id-and-name-guarded patch moves the existing `web` / `@deepseek-ai/dsh-web` row into the named `github-copilot-original-web` service realm without replacing its config.
 2. The plugin's `web-delegate` entry exposes that same official service through a public, Fiber-owned bridge. It does not read any provider registry internals.
 3. The plugin-owned `routed-web` service occupies the ordinary Host `web` scope. It forwards provider registration and fetch to the original service while retaining Fiber-scoped handles for exact-id search dispatch.
-4. Auto-mode Copilot searches use the captured initiating-session route. Fixed/default Copilot searches use the explicit provider-owned `searchModel`. Other provider ids dispatch through the mirrored public registration. A separate private official WebRuntime supplies native request validation and source capping on every routed branch.
+4. Auto-mode Copilot searches use the captured initiating-session route. Fixed/fallback Copilot searches preserve a nonempty explicit provider-owned `searchModel`, otherwise use bounded automatic selection from current account-owned Responses route facts. Other provider ids dispatch through the mirrored public registration. A separate private official WebRuntime supplies native request validation and source capping on every routed branch.
 5. Native `tool-web` consumers, including those in agent presets, retain their original schemas, configured query/source limits, batching, execution policies, timeout metadata, formatting and presentation.
 
 This is a plugin-owned subclass and explicit public service composition, not a replacement of Core prototypes or a mutation of a live registered service. It affects all `ctx.web.search` consumers with eligible Copilot context, not only one tool name. The bundle requires the standard enabled top-level official Host `web` row, static provider config and no prior isolation. The patch name guard does not make its separate inserted rows conditional: installing into a custom/missing/disabled/isolated web composition can prevent startup. Run the required read-only `scripts/check-search-composition.mjs` preflight over the existing profile before installing; it uses public readers and composition without calling write-capable `loadProfile` normalization. It compares a routing-free baseline with the actual post-install candidate at the existing bundle position (or the append position for first install), including profile, home and supplied launcher patches. Nonempty disposable `cordis.yml` roots are refused because normal CLI launch resets them; late isolation resets or an original web row inserted only after the routing guard are also refused. `dsh plugin add` does not automatically enforce this step. Unsupported shapes must be refused before mutation, not described as safe no-ops.
@@ -28,13 +28,19 @@ Fallback notices remain inside canonical `WebSearchResult.content`, so Core resu
 
 Legacy direct callers without the facade capture seam keep the historical `src/search-routing.ts` Copilot/DeepSeek path only for legacy policy. Its `src/deepseek-search-fallback.ts` constructs the unchanged public official adapter and retains its safe URL validation, exact option snapshot, credential ownership and post-auth/pre-fetch guard. The new catalog-based path instead calls the actual registered backend; an identical ID does not authorize replacing it with that factory. Generic `search()` exposes no internal authentication/pre-network hook, so do not claim the stronger legacy guard for arbitrary third-party implementations.
 
-`src/search-routing-policy.ts` normalizes settings without writes: a new explicit `searchProvider` wins; old auto remains Auto; old fixed preserves its default as primary; old fixed plus `none` stays disabled. Unknown saved IDs remain visible and fail closed at dispatch. Until an explicit UI save adopts the new fallback choice, legacy `searchFallback: none` preserves its failure-spending restriction. The save writes primary and default independently in the existing namespace with CAS. Copilot model configuration remains a separate namespace; a partial model save retains its new revision and reports the unconfirmed routing save. `routeWebSearch: false`, the master enable switch, Copilot allowlists and capability proof keep their existing responsibilities.
+`src/search-routing-policy.ts` normalizes settings without writes: a new explicit `searchProvider` wins; old auto remains Auto; old fixed preserves its default as primary; old fixed plus `none` stays disabled. Unknown saved IDs remain visible and fail closed at dispatch. Until an explicit UI save adopts the new fallback choice, legacy `searchFallback: none` preserves its failure-spending restriction. The ordinary save commits both primary and fallback leaves together in one CAS mutation of the routing namespace. It neither requires nor writes the Copilot settings namespace, and it performs no account-status/model-discovery RPC or capability probe. A nonempty legacy `searchModel` remains authoritative and visible read-only; only the separate explicit reset sets `searchModel: ''` with that namespace's own revision. A failed reset must not prevent an unrelated routing save. Missing namespaces, read-only deployments, stale revisions and uncertain responses must remain visible without exposing raw provider errors. `routeWebSearch: false`, the master enable switch, Copilot allowlists and capability proof keep their existing responsibilities.
 
 ## Search directory and settings UI
 
-Both selectors use `githubCopilotSearchRouting.providers()`, a separate strict Remote exposed through the public `TypertRemoteService` binding. Its catalog contains only fresh IDs from registrations observed by this facade, not Core private registry objects or hidden/direct-original registrations. The read invokes no `available()`, auth, discovery or search: availability is contextual and checked on actual use. A missing facade yields `supported: false`, not a static example list. Newly registered IDs appear on reload; removed saved entries remain visibly unavailable. Primary adds Auto; default adds None. Models are provider-specific configuration, not additional search-provider entries.
+Both selectors use `githubCopilotSearchRouting.providers()`, a separate strict Remote exposed through the public `TypertRemoteService` binding. Its catalog contains only fresh IDs from registrations observed by this facade, not Core private registry objects or hidden/direct-original registrations. The read invokes no `available()`, auth, discovery or search: availability is contextual and checked on actual use. A missing facade yields `supported: false`, not a static example list. Newly registered IDs appear on reload; removed saved entries remain visibly unavailable. Primary adds Auto; **Fallback provider** adds None while retaining the stored `defaultSearchProvider` key. The ordinary card has no model selector. Settings and routing Remote faces are captured once at UI registration: real pinned Cordis/Client Gateway namespace reads return fresh traced proxies, so looking them up in each render would change effect dependencies and reload drafts. Models remain provider internals, not additional search-provider entries.
 
-Focused postbuild checks must run after `pnpm build`. `tests/search-provider-catalog.spec.ts` checks registration lifecycle, duplicate handling and read purity; `tests/scripts/search-provider-gateway.test.mjs` drives the real Connection Fetch/Gateway against the packaged facade and emitted Remote controller. `tests/web-search-routing-card.spec.ts` covers both selectors, unavailable catalogs, narrow CAS, legacy choices, stale generations and partial saves. These fixtures are not live account, installed Desktop or paid model evidence.
+Focused postbuild checks must run after `pnpm build`. `tests/search-provider-catalog.spec.ts` checks registration lifecycle, duplicate handling and read purity; `tests/scripts/search-provider-gateway.test.mjs` drives the real Connection Fetch/Gateway against the packaged search-catalog facade/controller. `tests/web-search-routing-card.spec.ts` covers both selectors, unavailable catalogs, one routing CAS without a model prerequisite, explicit separate override reset, safe conflict messages, legacy choices and stale generations. `tests/client-search-inject.spec.ts` mounts the actual Client callback with real React DOM and Cordis in jsdom, checking draft and pending-save continuity through parent rerenders for both footer and legacy section slots; its Remote transport remains synthetic. `tests/scripts/search-settings-contract.test.mjs` uses the real pinned Settings service with in-memory persistence and the unchanged generated Client codecs: two-leaf routing writes, stale CAS, writable hidden/empty legacy overrides and the flat returned namespace revision. It also mounts the real pinned Client Gateway/Remote descriptors to verify traced proxy identity, without RPC or streams. It does **not** execute the actual Host SettingsController write through Gateway. An isolated Edge reproduction with the old alpha.28 built card and actual registration callback, backed by synthetic fresh Remote getters, reproduced both a filled-model draft resetting on a parent render and a completed model write whose subsequent routing write was abandoned on a parent render. This establishes a reproducible plugin lifecycle defect, not a definitive diagnosis of the user's production runtime. The corrected built card passed the same isolated Edge rerender/save/reload flow without a model field or account-status RPC, plus explicit legacy override reset, safe CAS conflict recovery, read-only state, dark/light desktop and 375px mobile captures, and a 200% zoom overflow check. These fixtures are not live account, installed Desktop or paid model evidence. The final local `pnpm verify` passed with one test worker: 62 Vitest files, 1553 passing tests and 2 expected skips, 273 tooling tests, source/test typechecks, baseline checks, build and package smoke. An earlier unrestricted parallel run hit three import-time test timeouts; the unchanged tests passed with bounded concurrency, without extending timeouts or skipping assertions. Remote CI, release publication and loaded-runtime acceptance remain separate pending checks.
+
+## Provider-owned automatic Copilot selection (#148)
+
+For explicit/fallback Copilot without a nonempty `searchModel`, an actual search non-forcing ensures current account metadata under the existing ownership, TTL, cooldown and credential guards. Eligible account-owned Responses routes are considered in deterministic model-ID order, with at most three candidates. No static model-name table, another Session's model, global Chat default or UI model list supplies the selection. A nonempty override remains the sole candidate and is not silently replaced if unavailable.
+
+Metadata determines eligibility, not native-search support. With the default `probe: true`, bounded candidate proof must succeed before one final user-query request is sent. Candidate proof is not a loop replaying the user's query; a final request failure is not retried on another model. The explicit `probe: false` trust override retains its existing meaning and is not a recovery recommendation. Empty/incomplete account evidence, unsupported protocols and proof exhaustion fail closed; cancellation or captured account-proof invalidation terminates the operation. Auto following a Copilot Chat route continues to use the captured initiating model rather than this independent selection. Existing outer primary/final-fallback policy, no-repeat backend rule and charge disclosures remain unchanged. Reusable successful proofs retain only account/owner lifetime, not the creating request's deadline or cancellation. Concurrent configured callers own separate unfinished probes; canceling one must not abort another, and a canceled probe is never reused as negative capability evidence.
 
 ## Review hardening
 

package/lib/client.js

@@ -5927,7 +5927,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		//#region lib/types/web-search-routing-card.js
 		const GITHUB_COPILOT_SETTINGS_NAMESPACE = "github-copilot";
 		const WEB_SEARCH_ROUTING_SETTINGS_NAMESPACE = "github-copilot-search-routing";
-		const NO_DEFAULT_SEARCH_PROVIDER = "none";
 		const GITHUB_COPILOT_SEARCH_PROVIDER = "github-copilot-hosted";
 		const DEEPSEEK_SEARCH_PROVIDER = "deepseek-official";
 		const cardStyle$1 = {
@@ -5945,17 +5944,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			gap: "6px",
 			minWidth: 0
 		};
-		const controlStyle = {
-			width: "100%",
-			minWidth: 0,
-			boxSizing: "border-box",
-			padding: "9px 11px",
-			borderRadius: "9px",
-			color: "inherit",
-			border: "1px solid color-mix(in srgb, currentColor 24%, transparent)",
-			background: "color-mix(in srgb, currentColor 3%, transparent)",
-			font: "inherit"
-		};
 		const buttonStyle$1 = {
 			justifySelf: "start",
 			padding: "9px 16px",
@@ -5970,7 +5958,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			opacity: .8,
 			fontSize: "12px",
 			lineHeight: 1.5,
-			overflowWrap: "anywhere"
+			overflowWrap: "anywhere",
+			margin: 0
 		};
 		function record(value) {
 			return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
@@ -5978,22 +5967,29 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		function revisionOf(value) {
 			return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
 		}
-		/** Provider-level primary and final fallback; model choice stays with each provider. */
+		function providerLabel(id) {
+			return id === GITHUB_COPILOT_SEARCH_PROVIDER ? "GitHub Copilot" : id === DEEPSEEK_SEARCH_PROVIDER ? "DeepSeek" : id;
+		}
+		function saveFailure(error) {
+			const code = record(error).code;
+			if (code === "settings-conflict") return "Search settings changed since you opened this page. Reload settings, then review and save your choices again.";
+			if (code === "settings-rejected") return "The settings service rejected this change. Reload settings to check whether editing is available, then try again.";
+			return "Could not confirm the save. Reload settings to check saved values before retrying. Your current choices have been kept.";
+		}
+		/** Save provider routing independently of account discovery and provider-specific model settings. */
 		function WebSearchRoutingCard(props) {
 			const [draft, setDraft] = (0, react.useState)({
 				primary: "auto",
 				provider: DEEPSEEK_SEARCH_PROVIDER,
-				model: "",
 				legacy: true
 			});
-			const [models, setModels] = (0, react.useState)([]);
+			const [override, setOverride] = (0, react.useState)({ model: "" });
 			const [providers, setProviders] = (0, react.useState)([]);
 			const [catalogReady, setCatalogReady] = (0, react.useState)(false);
 			const [loading, setLoading] = (0, react.useState)(true);
-			const [saving, setSaving] = (0, react.useState)(false);
+			const [saving, setSaving] = (0, react.useState)();
 			const [writable, setWritable] = (0, react.useState)(false);
 			const [message, setMessage] = (0, react.useState)("");
-			const [modelNotice, setModelNotice] = (0, react.useState)("");
 			const lifecycle = (0, react.useRef)({
 				active: false,
 				generation: 0,
@@ -6006,29 +6002,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				const current = () => owner.active && owner.generation === generation;
 				owner.busy = true;
 				setLoading(true);
-				setSaving(false);
+				setSaving(void 0);
 				setWritable(false);
 				setCatalogReady(false);
 				setMessage("");
-				setModels([]);
 				setProviders([]);
-				setModelNotice("");
-				const loadModels = async () => {
-					try {
-						const result = await props.copilot.status();
-						if (!current()) return;
-						const parsed = result.ok ? GitHubCopilotAuthorizationViewSchema.safeParse(result.value) : void 0;
-						if (!parsed?.success) {
-							setModelNotice("Model suggestions are unavailable. Enter a model id or reload settings to retry.");
-							return;
-						}
-						const ids = parsed.data.accountModels?.models.filter((item) => item.api === "openai-responses").map((item) => item.id) ?? [];
-						setModels([...new Set(ids)].sort());
-					} catch {
-						if (current()) setModelNotice("Model suggestions are unavailable. Enter a model id or reload settings to retry.");
-					}
-				};
-				loadModels();
 				try {
 					const [result, catalog] = await Promise.all([props.settings.describe(), Promise.resolve().then(() => props.routing.providers()).catch(() => void 0)]);
 					if (!current()) return;
@@ -6048,9 +6026,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 						primary: normalized.primaryProvider,
 						provider: normalized.defaultProvider,
 						legacy: normalized.legacy,
-						model: typeof copilotValue.searchModel === "string" ? copilotValue.searchModel : "",
-						routingRevision: revisionOf(routing?.revision),
-						copilotRevision: revisionOf(copilot?.revision)
+						routingRevision: revisionOf(routing?.revision)
+					});
+					setOverride({
+						model: typeof copilotValue.searchModel === "string" ? copilotValue.searchModel.trim() : "",
+						revision: revisionOf(copilot?.revision)
 					});
 					const parsed = catalog?.ok ? SearchProviderCatalogSchema.safeParse(catalog.value) : void 0;
 					const ids = parsed?.success ? parsed.data.providers.map((entry) => entry.id) : [];
@@ -6064,21 +6044,14 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					if (!routing || revisionOf(routing.revision) === void 0) setMessage("Web search routing settings are unavailable. Reload after the routing namespace is registered.");
 					else if (!result.value.writable) setMessage("Search settings are read-only in this deployment.");
 				} catch {
-					setMessageIfCurrent("Could not load search settings. Reload settings to retry.");
+					if (current()) setMessage("Could not load search settings. Reload settings to retry.");
 				} finally {
 					if (current()) {
 						owner.busy = false;
 						setLoading(false);
 					}
 				}
-				function setMessageIfCurrent(value) {
-					if (current()) setMessage(value);
-				}
-			}, [
-				props.copilot,
-				props.settings,
-				props.routing
-			]);
+			}, [props.settings, props.routing]);
 			(0, react.useEffect)(() => {
 				const owner = lifecycle.current;
 				owner.active = true;
@@ -6090,55 +6063,25 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				};
 			}, [load]);
 			const usesCopilot = draft.primary === GITHUB_COPILOT_SEARCH_PROVIDER || draft.provider === GITHUB_COPILOT_SEARCH_PROVIDER;
-			const disabled = loading || saving || !writable || draft.routingRevision === void 0 || !catalogReady;
-			const missingCopilot = usesCopilot && draft.copilotRevision === void 0;
+			const disabled = loading || saving !== void 0 || !writable || draft.routingRevision === void 0 || !catalogReady;
 			const primaryKnown = draft.primary === "auto" || draft.primary === "none" || providers.includes(draft.primary);
 			const fallbackKnown = draft.provider === "none" || providers.includes(draft.provider);
 			const missingProvider = !primaryKnown || !fallbackKnown;
 			const save = (0, react.useCallback)(async () => {
 				const owner = lifecycle.current;
-				if (!owner.active || owner.busy || disabled || missingCopilot) return;
+				if (!owner.active || owner.busy || disabled) return;
 				if (missingProvider) {
 					setMessage("Choose a registered search provider, or disable the fallback with None.");
 					return;
 				}
 				const generation = owner.generation;
 				const current = () => owner.active && owner.generation === generation;
-				const provider = draft.provider, primary = draft.primary, model = draft.model.trim();
-				if (usesCopilot && model.length === 0) {
-					setMessage("Enter a Copilot Responses model before using GitHub Copilot search.");
-					return;
-				}
+				const provider = draft.provider, primary = draft.primary;
 				owner.busy = true;
-				setSaving(true);
+				setSaving("routing");
 				setMessage("");
-				let modelSaved = false;
-				const saveFailure = () => modelSaved ? "Copilot search model was saved, but routing was not confirmed. Retry Save, or reload settings to review current values. The two namespaces are not saved atomically." : "Search settings could not be saved or confirmed. Retry Save, or reload settings to review current values before retrying.";
 				try {
-					if (usesCopilot) {
-						const modelWrite = await props.settings.mutate(GITHUB_COPILOT_SETTINGS_NAMESPACE, [{
-							op: "set",
-							path: ["searchModel"],
-							value: model
-						}], draft.copilotRevision);
-						if (!current()) return;
-						if (!modelWrite.ok) {
-							setMessage(saveFailure());
-							return;
-						}
-						modelSaved = true;
-						const revision = revisionOf(modelWrite.value.revision);
-						setDraft((value) => current() ? {
-							...value,
-							model,
-							copilotRevision: revision
-						} : value);
-						if (revision === void 0) {
-							setMessage(saveFailure());
-							return;
-						}
-					}
-					const routingWrite = await props.settings.mutate(WEB_SEARCH_ROUTING_SETTINGS_NAMESPACE, [{
+					const result = await props.settings.mutate(WEB_SEARCH_ROUTING_SETTINGS_NAMESPACE, [{
 						op: "set",
 						path: ["searchProvider"],
 						value: primary
@@ -6148,11 +6091,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 						value: provider
 					}], draft.routingRevision);
 					if (!current()) return;
-					if (!routingWrite.ok) {
-						setMessage(saveFailure());
+					if (!result.ok) {
+						setMessage(saveFailure(result.error));
 						return;
 					}
-					const revision = revisionOf(routingWrite.value.revision);
+					const revision = revisionOf(result.value.revision);
 					setDraft((value) => current() ? {
 						...value,
 						primary,
@@ -6160,28 +6103,72 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 						routingRevision: revision,
 						legacy: false
 					} : value);
-					setMessage(revision === void 0 ? "Save returned no revision. Reload settings before editing again." : "Saved. New searches use this routing immediately.");
-				} catch {
-					if (current()) setMessage(saveFailure());
+					setMessage(revision === void 0 ? "Save returned no revision. Reload settings before editing again." : "Saved. New searches use this routing. Search availability is checked when you search.");
+				} catch (error) {
+					if (current()) setMessage(saveFailure(error));
 				} finally {
 					if (current()) {
 						owner.busy = false;
-						setSaving(false);
+						setSaving(void 0);
 					}
 				}
 			}, [
 				disabled,
 				draft,
-				missingCopilot,
 				missingProvider,
-				props.settings,
-				usesCopilot
+				props.settings
+			]);
+			const clearOverride = (0, react.useCallback)(async () => {
+				const owner = lifecycle.current;
+				if (!owner.active || owner.busy || disabled || override.revision === void 0) return;
+				const generation = owner.generation;
+				const current = () => owner.active && owner.generation === generation;
+				owner.busy = true;
+				setSaving("override");
+				setMessage("");
+				try {
+					const result = await props.settings.mutate(GITHUB_COPILOT_SETTINGS_NAMESPACE, [{
+						op: "set",
+						path: ["searchModel"],
+						value: ""
+					}], override.revision);
+					if (!current()) return;
+					if (!result.ok) {
+						setMessage(saveFailure(result.error));
+						return;
+					}
+					const revision = revisionOf(result.value.revision);
+					if (revision === void 0) {
+						setOverride((value) => ({
+							...value,
+							revision: void 0
+						}));
+						setMessage("Save returned no revision. Reload settings before editing again.");
+						return;
+					}
+					setOverride({
+						model: "",
+						revision
+					});
+					setMessage("Copilot model selection is now automatic. Unsaved provider choices have not been applied.");
+				} catch (error) {
+					if (current()) setMessage(saveFailure(error));
+				} finally {
+					if (current()) {
+						owner.busy = false;
+						setSaving(void 0);
+					}
+				}
+			}, [
+				disabled,
+				override,
+				props.settings
 			]);
 			const providerOptions = () => providers.map((id) => (0, react.createElement)("option", {
 				key: id,
 				value: id,
 				style: nativeOptionStyle()
-			}, id));
+			}, providerLabel(id)));
 			const unavailableOption = (id, known) => known ? null : (0, react.createElement)("option", {
 				value: id,
 				disabled: true,
@@ -6189,7 +6176,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			}, `${id || "(empty)"} — unavailable`);
 			return (0, react.createElement)("section", {
 				style: cardStyle$1,
-				"data-dsh-web-search-routing": true
+				"data-dsh-web-search-routing": true,
+				"aria-busy": loading || saving !== void 0
 			}, (0, react.createElement)("div", null, (0, react.createElement)("h3", { style: {
 				margin: 0,
 				fontSize: "16px"
@@ -6198,7 +6186,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				opacity: .8,
 				fontSize: "13px",
 				lineHeight: 1.5
-			} }, "Auto follows the Chat provider when a matching search provider exists. Choose a provider to keep search fixed, independently of Chat.")), (0, react.createElement)("label", { style: fieldStyle$1 }, (0, react.createElement)("span", { style: {
+			} }, "Choose who runs web searches. This does not change your Chat model.")), (0, react.createElement)("label", { style: fieldStyle$1 }, (0, react.createElement)("span", { style: {
 				fontSize: "13px",
 				fontWeight: 600
 			} }, "Search provider"), (0, react.createElement)("select", {
@@ -6208,6 +6196,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				"data-dsh-web-search-mode": true,
 				onChange: (event) => {
 					const primary = event.currentTarget.value;
+					setMessage("");
 					setDraft((current) => ({
 						...current,
 						primary
@@ -6219,54 +6208,46 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			}, "Auto — follow Chat"), draft.primary === "none" ? (0, react.createElement)("option", {
 				value: "none",
 				style: nativeOptionStyle()
-			}, "Disabled — saved configuration") : null, ...providerOptions(), unavailableOption(draft.primary, primaryKnown))), (0, react.createElement)("label", { style: fieldStyle$1 }, (0, react.createElement)("span", { style: {
+			}, "Disabled — saved configuration") : null, ...providerOptions(), unavailableOption(draft.primary, primaryKnown)), (0, react.createElement)("span", { style: hintStyle }, "Auto follows the Chat provider when it supports search. A selected provider stays fixed when you switch Chat models.")), (0, react.createElement)("label", { style: fieldStyle$1 }, (0, react.createElement)("span", { style: {
 				fontSize: "13px",
 				fontWeight: 600
-			} }, "Default search provider"), (0, react.createElement)("select", {
+			} }, "Fallback provider"), (0, react.createElement)("select", {
 				style: nativeSelectStyle(disabled),
 				disabled,
 				value: draft.provider,
 				"data-dsh-web-search-provider": true,
 				onChange: (event) => {
 					const provider = event.currentTarget.value;
+					setMessage("");
 					setDraft((current) => ({
 						...current,
 						provider
 					}));
 				}
 			}, (0, react.createElement)("option", {
-				value: NO_DEFAULT_SEARCH_PROVIDER,
+				value: "none",
 				style: nativeOptionStyle()
-			}, "None — no fallback"), ...providerOptions(), unavailableOption(draft.provider, fallbackKnown)), (0, react.createElement)("span", { style: hintStyle }, "Final fallback only: used when Auto has no matching provider or the primary search fails. The same provider is never retried as its own fallback.")), catalogReady && providers.length === 0 ? (0, react.createElement)("p", {
+			}, "None — no fallback"), ...providerOptions(), unavailableOption(draft.provider, fallbackKnown)), (0, react.createElement)("span", { style: hintStyle }, "Used if Auto has no matching provider or the primary search fails. May incur the fallback provider’s charges. The same provider is not tried twice.")), catalogReady && providers.length === 0 ? (0, react.createElement)("p", {
 				role: "status",
 				style: hintStyle
 			}, "No search providers are registered. Enable a search provider, then reload settings.") : null, catalogReady && missingProvider ? (0, react.createElement)("p", {
 				role: "status",
 				style: hintStyle
-			}, "A saved provider is no longer registered. Choose an available entry; it has not been replaced automatically.") : null, draft.legacy && catalogReady ? (0, react.createElement)("p", { style: hintStyle }, "Your existing choices are preserved. Saving adopts the selected Default as the final fallback, which may incur that provider’s API charges. Cancellation and captured account-proof invalidation never trigger fallback.") : null, !usesCopilot ? null : (0, react.createElement)("label", { style: fieldStyle$1 }, (0, react.createElement)("span", { style: {
-				fontSize: "13px",
-				fontWeight: 600
-			} }, "Copilot search model"), (0, react.createElement)("input", {
-				style: controlStyle,
-				list: "dsh-copilot-search-models",
-				disabled: disabled || missingCopilot,
-				value: draft.model,
-				placeholder: "account-authorized Responses model id",
-				"data-dsh-copilot-search-model": true,
-				onChange: (event) => {
-					const model = event.currentTarget.value;
-					setDraft((current) => ({
-						...current,
-						model
-					}));
+			}, "A saved provider is no longer registered. Choose an available entry; it has not been replaced automatically.") : null, draft.legacy && catalogReady ? (0, react.createElement)("p", { style: hintStyle }, "Saving adopts the selected fallback for new searches. Cancellation and account-proof invalidation never trigger fallback.") : null, usesCopilot ? (0, react.createElement)("p", { style: hintStyle }, "Copilot handles search model selection. No model setup is needed here. A signed-in account and a model with verified search support are required when searching.") : null, usesCopilot && override.model ? (0, react.createElement)("details", { "data-dsh-copilot-search-override": true }, (0, react.createElement)("summary", { style: {
+				cursor: "pointer",
+				fontSize: "13px"
+			} }, "Existing Copilot model override"), (0, react.createElement)("div", { style: {
+				...fieldStyle$1,
+				marginTop: "8px"
+			} }, (0, react.createElement)("p", { style: hintStyle }, "Your saved override ", (0, react.createElement)("code", null, override.model), " is preserved. Saving providers does not change it."), (0, react.createElement)("button", {
+				type: "button",
+				style: buttonStyle$1,
+				disabled: disabled || override.revision === void 0,
+				"data-dsh-copilot-search-reset": true,
+				onClick: () => {
+					clearOverride();
 				}
-			}), (0, react.createElement)("datalist", { id: "dsh-copilot-search-models" }, ...models.map((id) => (0, react.createElement)("option", {
-				key: id,
-				value: id
-			}))), (0, react.createElement)("span", { style: hintStyle }, "Used when Copilot is selected explicitly or as the fallback. Account Responses models are suggestions, not hosted-search capability proof. This does not change the Chat model."), missingCopilot ? (0, react.createElement)("span", { role: "status" }, "Copilot search settings are unavailable. Reload after the github-copilot namespace is registered, or choose another provider.") : null, modelNotice ? (0, react.createElement)("span", {
-				role: "status",
-				style: hintStyle
-			}, modelNotice) : null), (0, react.createElement)("div", { style: {
+			}, saving === "override" ? "Updating…" : "Use automatic model selection"))) : null, (0, react.createElement)("div", { style: {
 				display: "flex",
 				alignItems: "center",
 				gap: "12px",
@@ -6274,24 +6255,29 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			} }, (0, react.createElement)("button", {
 				type: "button",
 				style: buttonStyle$1,
-				disabled: disabled || missingCopilot || missingProvider,
+				disabled: disabled || missingProvider,
 				"data-dsh-web-search-save": true,
 				onClick: () => {
 					save();
 				}
-			}, loading ? "Loading…" : saving ? "Saving…" : "Save search routing"), (0, react.createElement)("button", {
+			}, loading ? "Loading…" : saving === "routing" ? "Saving…" : "Save search routing"), (0, react.createElement)("button", {
 				type: "button",
 				style: buttonStyle$1,
-				disabled: loading || saving,
+				disabled: loading || saving !== void 0,
 				title: "Reload saved values and discard unsaved edits",
 				"data-dsh-web-search-reload": true,
 				onClick: () => {
 					load();
 				}
-			}, "Reload settings"), message.length === 0 ? null : (0, react.createElement)("span", {
+			}, "Reload settings")), (0, react.createElement)("p", {
 				role: "status",
-				style: hintStyle
-			}, message)));
+				"aria-live": "polite",
+				"aria-atomic": true,
+				style: {
+					...hintStyle,
+					...message ? {} : { display: "none" }
+				}
+			}, message));
 		}
 		//#endregion
 		//#region lib/types/dual-model-card.js
@@ -7898,10 +7884,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			let footerActive = false;
 			let sectionActive = false;
 			let fallback;
+			const settings = ctx.remote.settings;
+			const routing = ctx.remote.githubCopilotSearchRouting;
 			const render = () => (0, react.createElement)(WebSearchRoutingCard, {
-				settings: ctx.remote.settings,
-				copilot: ctx.remote.githubCopilot,
-				routing: ctx.remote.githubCopilotSearchRouting
+				settings,
+				routing
 			});
 			const syncFallback = () => {
 				if (active && sectionActive && !footerActive) fallback ??= ctx.slots.register({
@@ -7972,7 +7959,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				throw error;
 			}
 			const searchUi = ctx.inject([
-				"remote.githubCopilot",
 				"remote.settings",
 				"remote.githubCopilotSearchRouting",
 				"slots"