loki-mode 8.6.1 → 8.8.1

package/autonomy/run.sh

@@ -535,6 +535,43 @@ if [ -n "${LOKI_SESSION_ID:-}" ]; then
     unset _loki_sid_raw _loki_sid_safe
 fi
 
+# GENERIC TIER VOCABULARY (small|medium|high). A user should be able to ask for
+# a capability class without naming a vendor model, and get that provider's
+# latest model in the class. LOKI_SESSION_MODEL is the knob that already does
+# this -- it accepts the raw tier names planning|development|fast alongside the
+# Claude aliases -- so the generic words are normalized ONTO it here rather than
+# becoming a fourth spelling. LOKI_MAX_TIER (a cost CEILING) and LOKI_TIER (the
+# OSS/enterprise licensing seam) mean different things and are left alone.
+#
+# WHY NORMALIZE AT THE ENTRY POINT: the session-pin case block is byte-mirrored
+# in the estimator (autonomy/loki) and the dashboard (dashboard/server.py), and
+# every one of those mirrors is locked by a parity test. Translating here means
+# they keep seeing only the three canonical tier names and none of them change.
+#
+# The mapping is loki_tier_alias() in providers/models.sh -- the single source
+# of truth, not a second copy. Inlined as a case because run.sh must not source
+# a provider file this early in startup. Kept in lockstep by
+# tests/test-generic-tiers.sh.
+#
+# ONLY the three new words are translated. sonnet/haiku/opus/fable and the raw
+# tier names pass through untouched, so an unset LOKI_SESSION_MODEL still
+# defaults to sonnet and "medium" resolves to the same development-tier model
+# today's builds already use. This changes no existing run's model.
+# NORMALIZATION IS TRIM-ONLY + LOWERCASE, matching the estimator and dashboard
+# mirrors exactly. Interior whitespace is deliberately PRESERVED, so " med ium "
+# stays junk here just as it does there. Stripping interior spaces would make
+# this reader accept a value the other two reject, which is the precise kind of
+# divergence the session-pin parity tests exist to catch.
+_loki_generic_tier="${LOKI_SESSION_MODEL:-}"
+_loki_generic_tier="${_loki_generic_tier#"${_loki_generic_tier%%[![:space:]]*}"}"
+_loki_generic_tier="${_loki_generic_tier%"${_loki_generic_tier##*[![:space:]]}"}"
+case "$(printf '%s' "$_loki_generic_tier" | tr '[:upper:]' '[:lower:]')" in
+    small)  LOKI_SESSION_MODEL="fast"        ; export LOKI_SESSION_MODEL ;;
+    medium) LOKI_SESSION_MODEL="development" ; export LOKI_SESSION_MODEL ;;
+    high)   LOKI_SESSION_MODEL="planning"    ; export LOKI_SESSION_MODEL ;;
+esac
+unset _loki_generic_tier
+
 # Process Supervision (opt-in)
 WATCHDOG_ENABLED=${LOKI_WATCHDOG:-"false"}          # Enable process health monitoring
 WATCHDOG_INTERVAL=${LOKI_WATCHDOG_INTERVAL:-30}     # Check interval in seconds
@@ -736,6 +773,35 @@ print(catalog["providers"]["claude"]["cli_aliases"].get(os.environ["_LOKI_SELECT
 }
 loki_apply_build_profile
 
+# Default hang guard for EVERY build, not just simple-web.
+#
+# The two timeouts above are set inside loki_apply_build_profile(), which
+# returns immediately unless LOKI_BUILD_PROFILE=simple-web. So on a normal
+# build both resolved to 0, and 0 means no guard at all -- verified by running
+# the deadline helper directly: `deadline.py 0 0 3 -- sleep 5` runs to
+# completion unkilled. A provider that hung had nothing to stop it.
+#
+# IDLE only, and no retry. That is what keeps this compatible with the standing
+# objection recorded above (search: "former invoke_with_timeout"), whose two
+# reasons remain correct:
+#
+#   1. "No safe generous default" applies to a fixed TOTAL timeout, which
+#      cannot tell a long legitimate iteration from a hang. An idle timeout
+#      can: it measures silence, not duration. Verified both directions --
+#      `sleep 600` under a 120s idle cap dies, while a process emitting output
+#      every second survives indefinitely. A coding agent streams constantly;
+#      one silent for two minutes is not working.
+#   2. "Wrong retry semantics" stands, so nothing here retries. The call is
+#      killed, and the existing failure path handles it. Re-running an agent
+#      that may have already edited files remains off the table.
+#
+# 7200s hard ceiling is a backstop against a process that streams forever
+# without converging; the idle cap is the load-bearing guard. Both are
+# overridable, and setting either to 0 restores the old unguarded behaviour.
+: "${LOKI_PROVIDER_IDLE_TIMEOUT:=120}"
+: "${LOKI_PROVIDER_CALL_TIMEOUT:=7200}"
+export LOKI_PROVIDER_IDLE_TIMEOUT LOKI_PROVIDER_CALL_TIMEOUT
+
 loki_background_services_enabled() {
     ! loki_is_supervised_simple_web
 }
@@ -12951,6 +13017,67 @@ with open(os.environ["LOKI_DA_PROMPT_OUT"], "w", encoding="utf-8") as handle:
 BUILD_DA_PROMPT
 }
 
+# Derive a review size cap (in bytes) from the active provider's context window.
+#
+# Args: $1 = env override (wins outright when set), $2 = historical default.
+# Echoes the effective cap.
+#
+# Why this exists: the caps were fixed byte counts sized for a ~200k-token model.
+# A local 12b/14b with an 8k-32k window would be handed a 425000-byte prompt and
+# fail in a way that reads as "the model is bad" rather than "we mis-sized it".
+#
+# Two stated assumptions, kept separate so they stay auditable:
+#   1. ~3 bytes per token. Real tokenizers land around 3-4 for code-heavy text;
+#      3 is the conservative end, and under-estimating capacity errs toward a
+#      smaller cap, which is the safe direction for a fail-closed gate.
+#   2. ~75% of the window is available for review INPUT. The remainder is the
+#      reviewer's own output and reasoning, which share the same window.
+# Neither is precise, and neither needs to be: the result is only ever used to
+# LOWER a cap below the shipped default.
+#
+# The min() is load-bearing. PROVIDER_CONTEXT_WINDOW is set on every current run
+# (LOKI_PROVIDER defaults to claude, whose window is 1000000), so deriving
+# upward would raise the cap 4-8x for every existing user. Taking the smaller of
+# derived-vs-default means a cap can only ever move DOWN. Concretely, a window
+# clamps to the shipped default whenever it is >= ~188889 tokens; every provider
+# that declares a window today (1M/400k/200k/200k) clears that, and a provider
+# declaring none takes the unset path, so no shipped provider changes behavior.
+# Only a genuinely small window (a local 12b/14b) shrinks anything.
+#
+# The shipped defaults are 425000 (prompt) and 400000 (diff). That 25000-byte gap
+# is the reviewer scaffolding wrapped around the diff, and the ordering is
+# load-bearing: if both caps derived to the SAME number, a diff sized just under
+# the diff gate would build a prompt exceeding the prompt gate, so every review
+# would block fail-closed with no operator-visible cause, on exactly the
+# small-window providers this derivation exists to support. Scaling by
+# _default/425000 preserves that gap at every window size. The 425000 denominator
+# must track the prompt-cap default passed by the caller below; if that default
+# changes, change the denominator with it or the diff-cap proportion breaks.
+review_effective_cap() {
+    local _override="$1" _default="$2"
+    # Operator wins outright, at any value, over both the default and the window.
+    if [ -n "$_override" ]; then
+        printf '%s' "$_override"
+        return 0
+    fi
+    # Fail safe to the historical default unless the window is a clean positive
+    # integer. A non-numeric result here would make the caller's `[ ... -gt ... ]`
+    # exit 2, which reads as false and would dispatch an oversized review.
+    case "${PROVIDER_CONTEXT_WINDOW:-}" in
+        ''|*[!0-9]*) printf '%s' "$_default"; return 0 ;;
+    esac
+    [ "$PROVIDER_CONTEXT_WINDOW" -gt 0 ] 2>/dev/null || { printf '%s' "$_default"; return 0; }
+    # Derive the INPUT budget, then scale it to this caller's cap so the
+    # prompt/diff proportion (and thus the scaffolding gap) is preserved.
+    local _budget=$(( PROVIDER_CONTEXT_WINDOW * 3 / 4 * 3 ))
+    local _derived=$(( _budget * _default / 425000 ))
+    if [ "$_derived" -lt "$_default" ]; then
+        printf '%s' "$_derived"
+    else
+        printf '%s' "$_default"
+    fi
+}
+
 run_code_review() {
     local loki_dir="${TARGET_DIR:-.}/.loki"
     local review_dir="$loki_dir/quality/reviews"
@@ -13311,11 +13438,12 @@ ${dependency_context}"
     # produces an opaque block. This remains fail-closed and never truncates.
     local _review_diff_bytes=0
     _review_diff_bytes=$(printf '%s' "$diff_content" | wc -c | tr -d ' ')
-    local _review_max_bytes="${LOKI_REVIEW_MAX_DIFF_BYTES:-400000}"
+    local _review_max_bytes
+    _review_max_bytes=$(review_effective_cap "${LOKI_REVIEW_MAX_DIFF_BYTES:-}" 400000)
     if [ "${_review_diff_bytes:-0}" -gt "$_review_max_bytes" ] 2>/dev/null; then
         local _big_dirs
         _big_dirs=$(printf '%s\n' "$changed_files" | sed 's#/.*##' | grep -v '^$' | sort | uniq -c | sort -rn | head -3 | awk '{print $2" ("$1" files)"}' | tr '\n' ' ')
-        log_error "Code review: context is ${_review_diff_bytes} bytes (limit ${_review_max_bytes}); refusing to truncate or dispatch a partial review. Biggest dirs: ${_big_dirs:-unknown}. Split the change or raise LOKI_REVIEW_MAX_DIFF_BYTES."
+        log_error "Code review: context is ${_review_diff_bytes} bytes (limit ${_review_max_bytes}, derived from PROVIDER_CONTEXT_WINDOW=${PROVIDER_CONTEXT_WINDOW:-unset}); refusing to truncate or dispatch a partial review. Biggest dirs: ${_big_dirs:-unknown}. Split the change or raise LOKI_REVIEW_MAX_DIFF_BYTES."
         emit_event_json "code_review_diff_oversized" \
             "review_id=$review_id" \
             "diff_bytes=$_review_diff_bytes" \
@@ -13847,7 +13975,8 @@ REVIEW_SELECTION_RECORD
     reviewer_count=$(echo "$selected_specialists" | python3 -c "import sys,json; print(len(json.load(sys.stdin)['reviewers']))")
     local dispatch_count
     dispatch_count=$(echo "$dispatch_specialists" | python3 -c "import sys,json; print(len(json.load(sys.stdin)['reviewers']))")
-    local _review_max_prompt_bytes="${LOKI_REVIEW_MAX_PROMPT_BYTES:-425000}"
+    local _review_max_prompt_bytes
+    _review_max_prompt_bytes=$(review_effective_cap "${LOKI_REVIEW_MAX_PROMPT_BYTES:-}" 425000)
     local _review_max_output_bytes="${LOKI_REVIEW_MAX_OUTPUT_BYTES:-1048576}"
     local review_pending_dir="$review_dir/$review_id/.pending"
     if ! mkdir -m 700 "$review_pending_dir" 2>/dev/null; then
@@ -15433,40 +15562,71 @@ start_dashboard() {
 
     # Check all required imports
     if ! "$python_cmd" -c "import fastapi; import sqlalchemy; import aiosqlite" 2>/dev/null; then
-        log_step "Setting up dashboard virtualenv..."
-        if ! [ -x "${dashboard_venv}/bin/python3" ]; then
-            # Remove broken venv if exists
-            [ -d "$dashboard_venv" ] && rm -rf "$dashboard_venv"
-            mkdir -p "$HOME/.loki"
-            python3 -m venv "$dashboard_venv" 2>/dev/null || python3.13 -m venv "$dashboard_venv" 2>/dev/null || {
-                log_warn "Failed to create virtualenv"
-                log_warn "You may need: sudo apt install python3-venv"
-            }
-        fi
-        if [ -x "${dashboard_venv}/bin/python3" ]; then
-            python_cmd="${dashboard_venv}/bin/python3"
-            log_step "Installing dashboard dependencies..."
-            if [ -f "$req_file" ]; then
-                "${dashboard_venv}/bin/pip" install -r "$req_file" 2>&1 | tail -1 || {
-                    log_warn "Pinned deps failed, trying unpinned..."
+        # The venv is HOST-GLOBAL, so concurrent runs must not rebuild it at
+        # once: one run's `rm -rf` would delete the tree another is importing
+        # from. Lock the venv path itself -- safe_acquire_lock appends
+        # ".lockdir", giving a SIBLING mutex the teardown below cannot destroy.
+        # Timeout must outlast a real cold venv create + pip install (not the 5s
+        # used by the JSON read-modify-write call sites). Mirrors the same guard
+        # in ensure_dashboard_venv (autonomy/loki) -- edit BOTH.
+        local _venv_locked=false
+        if type safe_acquire_lock >/dev/null 2>&1 \
+            && safe_acquire_lock "$dashboard_venv" "${LOKI_VENV_LOCK_TIMEOUT:-300}"; then
+            _venv_locked=true
+        fi
+        # Re-probe: the run we queued behind may have just built it for us.
+        [ -x "${dashboard_venv}/bin/python3" ] && python_cmd="${dashboard_venv}/bin/python3"
+        if "$python_cmd" -c "import fastapi; import sqlalchemy; import aiosqlite" 2>/dev/null; then
+            [ "$_venv_locked" = true ] && safe_release_lock "$dashboard_venv"
+            _venv_locked=false
+        elif [ "$_venv_locked" = false ] && type safe_acquire_lock >/dev/null 2>&1; then
+            # Lock timed out and the venv is still unusable. Do NOT rm -rf
+            # unlocked -- that is the exact race this lock exists to prevent.
+            #
+            # The re-probe above may have pointed python_cmd at the OTHER run's
+            # half-built venv (bin/python3 exists, pip install not finished).
+            # Reset to the system interpreter so the server launch below does not
+            # exec a knowingly-broken one.
+            python_cmd="python3"
+            log_warn "Timed out waiting for another run to build the dashboard venv"
+            log_warn "Dashboard will not be available (stale lock? rm -rf ${dashboard_venv}.lockdir)"
+        else
+            log_step "Setting up dashboard virtualenv..."
+            if ! [ -x "${dashboard_venv}/bin/python3" ]; then
+                # Remove broken venv if exists
+                [ -d "$dashboard_venv" ] && rm -rf "$dashboard_venv"
+                mkdir -p "$HOME/.loki"
+                python3 -m venv "$dashboard_venv" 2>/dev/null || python3.13 -m venv "$dashboard_venv" 2>/dev/null || {
+                    log_warn "Failed to create virtualenv"
+                    log_warn "You may need: sudo apt install python3-venv"
+                }
+            fi
+            if [ -x "${dashboard_venv}/bin/python3" ]; then
+                python_cmd="${dashboard_venv}/bin/python3"
+                log_step "Installing dashboard dependencies..."
+                if [ -f "$req_file" ]; then
+                    "${dashboard_venv}/bin/pip" install -r "$req_file" 2>&1 | tail -1 || {
+                        log_warn "Pinned deps failed, trying unpinned..."
+                        "${dashboard_venv}/bin/pip" install fastapi uvicorn pydantic websockets sqlalchemy aiosqlite 2>&1 | tail -1 || {
+                            log_warn "Failed to install dashboard dependencies"
+                            log_warn "Dashboard will not be available"
+                        }
+                        # greenlet is optional (needs C compiler on some platforms)
+                        "${dashboard_venv}/bin/pip" install greenlet 2>/dev/null || true
+                    }
+                else
                     "${dashboard_venv}/bin/pip" install fastapi uvicorn pydantic websockets sqlalchemy aiosqlite 2>&1 | tail -1 || {
                         log_warn "Failed to install dashboard dependencies"
                         log_warn "Dashboard will not be available"
                     }
-                    # greenlet is optional (needs C compiler on some platforms)
                     "${dashboard_venv}/bin/pip" install greenlet 2>/dev/null || true
-                }
+                fi
             else
-                "${dashboard_venv}/bin/pip" install fastapi uvicorn pydantic websockets sqlalchemy aiosqlite 2>&1 | tail -1 || {
-                    log_warn "Failed to install dashboard dependencies"
-                    log_warn "Dashboard will not be available"
-                }
-                "${dashboard_venv}/bin/pip" install greenlet 2>/dev/null || true
+                log_warn "Failed to install dashboard dependencies"
+                log_warn "Run manually: python3 -m venv ${dashboard_venv} && ${dashboard_venv}/bin/pip install fastapi uvicorn sqlalchemy aiosqlite"
             fi
-        else
-            log_warn "Failed to install dashboard dependencies"
-            log_warn "Run manually: python3 -m venv ${dashboard_venv} && ${dashboard_venv}/bin/pip install fastapi uvicorn sqlalchemy aiosqlite"
         fi
+        [ "$_venv_locked" = true ] && safe_release_lock "$dashboard_venv"
     fi
 
     # Start the FastAPI dashboard server
@@ -20750,6 +20910,16 @@ except Exception as exc:
             # Trim to last 500KB
             tail -c 500000 "$agent_log" > "$agent_log.tmp" && mv "$agent_log.tmp" "$agent_log"
         fi
+
+        # Same cap on the daily log. agent.log has been trimmed since it was
+        # introduced; its sibling never was, and it receives the full raw
+        # stream-json of every iteration -- measured ~1.5MB per iteration, so a
+        # 500-iteration run leaves ~725MB per day per build, times however many
+        # builds share the machine. Same threshold, same trim, no new rotation
+        # scheme.
+        if [ -f "$log_file" ] && [ "$(stat -f%z "$log_file" 2>/dev/null || stat -c%s "$log_file" 2>/dev/null)" -gt 1000000 ]; then
+            tail -c 500000 "$log_file" > "$log_file.tmp" && mv "$log_file.tmp" "$log_file"
+        fi
         touch "$agent_log"
         echo "" >> "$agent_log"
         echo "════════════════════════════════════════════════════════════════" >> "$agent_log"

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "8.6.1"
+__version__ = "8.8.1"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -678,6 +678,37 @@ async def _push_loki_state_loop() -> None:
                             except (json.JSONDecodeError, KeyError):
                                 pass
 
+                        # Third source: the .loki/pids/ registry, which a
+                        # CLI-started background run DOES write. Without this
+                        # the dashboard reported STOPPED for a healthy build:
+                        # `loki start` writes neither loki.pid nor session.json
+                        # (run.sh only UPDATES session.json when it already
+                        # exists), so both checks above failed and every such
+                        # run fell through to "stopped" while it was actively
+                        # working. Confirmed against a live build: STATUS.txt
+                        # said BUILDING and iterations were advancing while the
+                        # dashboard showed STOPPED with 0 agents.
+                        #
+                        # Liveness is proven with os.kill(pid, 0), never by the
+                        # file's presence -- a stale entry from a crashed run
+                        # must NOT read as alive, which is the same
+                        # anti-stale rule BUG-NEW-006 established above.
+                        if not _pid_alive:
+                            try:
+                                _pid_dir = loki_dir / "pids"
+                                for _entry in _pid_dir.glob("*.json"):
+                                    _rec = _safe_json_read(_entry, {})
+                                    if _rec.get("kind") not in ("wrapper", "runner"):
+                                        continue
+                                    try:
+                                        os.kill(int(_rec.get("pid", 0)), 0)
+                                    except (ValueError, OSError, ProcessLookupError):
+                                        continue
+                                    _pid_alive = True
+                                    break
+                            except OSError:
+                                pass
+
                         status_str = raw.get("mode", "autonomous")
                         # Control files are the AUTHORITY, and they are checked
                         # first. dashboard-state.json's "mode" is written by the
@@ -2802,16 +2833,153 @@ _SESSION_MODEL_ALLOWLIST = ("haiku", "sonnet", "opus", "fable")
 # allowlist is unchanged) because it is an explicit live-run control.
 _START_MODEL_ALLOWLIST = ("haiku", "sonnet", "opus")
 
+# Provider-agnostic capability tiers. These are the vocabulary the picker offers
+# on a non-Claude provider, and they resolve per-provider through
+# providers/models.sh (loki_tier_alias): small -> fast, medium -> development,
+# high -> planning. Accepting them here is what makes the start-time picker work
+# on codex at all -- the Claude aliases above are meaningless there, so before
+# this every value a codex user could pick normalized to "" and was silently
+# dropped, and the run started on the provider default with no feedback.
+_START_MODEL_GENERIC_TIERS = ("small", "medium", "high")
+
 
 def _normalize_start_model(raw: str | None) -> str:
-    """Normalize a start-time model / advisor alias (haiku|sonnet|opus, no fable).
+    """Normalize a start-time model / advisor alias.
 
-    Same trim + lowercase + exact-match rule as _normalize_session_model, but on
-    the narrower _START_MODEL_ALLOWLIST. Returns "" for absent/invalid/fable so
+    Accepts the Claude aliases (haiku|sonnet|opus, no fable) and the generic
+    capability tiers (small|medium|high). Returns "" for absent/invalid/fable so
     callers can treat empty as "no selection" (engine uses its own default).
+
+    fable stays excluded: it is advisory-only and the runner collapses it to
+    opus, so offering it as a start-time execution model would be a cost
+    surprise. That reasoning is unchanged by adding the generic tiers.
     """
     val = (raw or "").strip().lower()
-    return val if val in _START_MODEL_ALLOWLIST else ""
+    if val in _START_MODEL_ALLOWLIST or val in _START_MODEL_GENERIC_TIERS:
+        return val
+    return ""
+
+
+# =============================================================================
+# Provider-aware model offer set
+# =============================================================================
+# The two allowlists above are WIRE values: what run.sh will actually honor in
+# .loki/state/model-override. They are Claude aliases because run.sh:20996 gates
+# the whole override block on PROVIDER_NAME=claude and feeds the file straight
+# into `claude --model`. They must not change.
+#
+# What the dashboard OFFERS is a separate question, and it was the bug: the
+# picker rendered those four Claude aliases on every run, so a codex session was
+# offered Haiku/Sonnet/Opus/Fable, none of which codex can dispatch. The offer
+# set below is derived from the RUNNING session's provider plus the canonical
+# providers/model_catalog.json, so the picker never names a model the active
+# provider cannot run.
+
+# Generic tier -> catalog key. These three tier names are provider-independent
+# (every catalog entry carries latest_fast/development/planning), which is what
+# makes the picker portable across providers.
+_TIER_LABELS = (
+    ("small", "fast"),
+    ("medium", "development"),
+    ("high", "planning"),
+)
+
+
+def _active_provider() -> str:
+    """The provider the CURRENT run is executing on.
+
+    Resolution order mirrors the CLI (autonomy/loki:5142): the per-project state
+    file run.sh writes at launch (run.sh:1458), then the environment, then the
+    stock default. The state file wins because it is the only source that
+    reflects the live run rather than the dashboard process's own environment.
+    """
+    try:
+        p = _get_loki_dir() / "state" / "provider"
+        if p.is_file():
+            val = p.read_text().strip().lower()
+            if val:
+                return val
+    except OSError:
+        pass
+    return (os.environ.get("LOKI_PROVIDER") or "claude").strip().lower() or "claude"
+
+
+def _load_model_catalog() -> dict:
+    """Read providers/model_catalog.json, the single source of truth for model ids.
+
+    Same candidate paths as GET /api/providers/models. Returns {} when the
+    catalog is unreadable; every caller degrades to "no model ids to show"
+    rather than inventing one.
+    """
+    for path in (
+        _Path(__file__).resolve().parent.parent / "providers" / "model_catalog.json",
+        _Path("providers/model_catalog.json"),
+    ):
+        try:
+            if path.exists():
+                with path.open("r", encoding="utf-8") as fh:
+                    return json.load(fh)
+        except (json.JSONDecodeError, OSError):
+            continue
+    return {}
+
+
+def _resolve_catalog_model(provider: str, catalog_tier: str) -> str:
+    """The model id `provider` dispatches for `catalog_tier` (fast/development/planning).
+
+    Python mirror of loki_latest_model (providers/models.sh:22), including its
+    env-override chain and its "generic" registry fallback for a provider the
+    catalog does not name. Kept in Python rather than shelling out to models.sh:
+    the dashboard answers this per request and a subprocess per tier per poll is
+    not worth it. Model IDS still come only from the catalog, never from here.
+    """
+    provider_env = re.sub(r"[^A-Z0-9_]", "_", provider.upper())
+    for var in (
+        f"LOKI_{provider_env}_MODEL_{catalog_tier.upper()}",
+        f"LOKI_{provider_env}_MODEL",
+    ):
+        val = (os.environ.get(var) or "").strip()
+        if val:
+            return val
+    providers = _load_model_catalog().get("providers", {})
+    entry = providers.get(provider) or providers.get("generic") or {}
+    return str(entry.get(f"latest_{catalog_tier}") or "")
+
+
+def _provider_model_offers(provider: str) -> list[dict]:
+    """The model choices to OFFER for `provider`, each with what it resolves to.
+
+    Claude keeps its established alias picker byte-for-byte: those aliases are
+    the values run.sh honors in the override file, so changing them would break
+    the one provider where mid-run switching actually works.
+
+    Every other provider is offered the generic tiers (small/medium/high), which
+    are provider-independent, each annotated with the concrete model id the
+    catalog says that provider dispatches. That is what makes the picker read
+    "medium -> gpt-5.6-terra" on codex and "medium -> claude-sonnet-5" on claude
+    without the frontend knowing a single model id.
+    """
+    if provider == "claude":
+        aliases = _load_model_catalog().get("providers", {}).get("claude", {}).get("cli_aliases", {})
+        return [
+            {"value": alias, "tier": None, "model": aliases.get(alias, "")}
+            for alias in _SESSION_MODEL_ALLOWLIST
+        ]
+    return [
+        {"value": tier, "tier": tier, "model": _resolve_catalog_model(provider, catalog_tier)}
+        for tier, catalog_tier in _TIER_LABELS
+    ]
+
+
+def _provider_supports_model_switch(provider: str) -> bool:
+    """Whether a live run on `provider` honors .loki/state/model-override.
+
+    Only claude does: run.sh:20996 gates the entire override-read block on
+    PROVIDER_NAME=claude. On any other provider the file is written and never
+    read, so the POST path rejects rather than reporting a switch that will not
+    happen.
+    """
+    return provider == "claude"
 
 
 class SessionModelRequest(BaseModel):
@@ -2890,17 +3058,28 @@ def _normalize_session_model(raw: str | None) -> str:
 # tier names ARE valid pins.
 _SESSION_PIN_ALLOWLIST = _SESSION_MODEL_ALLOWLIST + ("planning", "development", "fast")
 
+# Generic capability vocabulary. A user picks a CLASS of model (small/medium/
+# high) and each provider supplies its own latest model in that class, so nobody
+# has to know a vendor's model names. These are translated onto the canonical
+# tier names rather than added to the allowlist, keeping this mirror in step
+# with run.sh's entry-point case and the `loki plan` estimator without widening
+# what any of the three actually route on. Mirrors loki_tier_alias() in
+# providers/models.sh.
+_GENERIC_TIERS = {"small": "fast", "medium": "development", "high": "planning"}
+
 
 def _normalize_session_pin(raw: str | None) -> str:
     """Normalize a LOKI_SESSION_MODEL pin value (aliases + raw tier names).
 
     Mirrors run.sh's session-pin case: trim + lowercase, accept the four model
-    aliases and the three tier names. Interior whitespace is preserved (so
+    aliases and the three tier names, and translate the generic small/medium/
+    high vocabulary onto those tier names. Interior whitespace is preserved (so
     "fab le" stays junk and falls through to the default tier, exactly like the
     runner's "*" arm). Use this for the session-pin (no-override) derivation;
     use _normalize_session_model for the override-file / POST path.
     """
     val = (raw or "").strip().lower()
+    val = _GENERIC_TIERS.get(val, val)
     return val if val in _SESSION_PIN_ALLOWLIST else ""
 
 
@@ -3126,11 +3305,24 @@ async def get_session_model():
     # the reported effective model agrees with dispatch on BOTH routes (v7.39.1).
     if effective == "fable":
         effective = "opus"
+    provider = _active_provider()
+    offers = _provider_model_offers(provider)
+    if provider != "claude":
+        # Non-claude: the claude-alias default/effective computed above describe a
+        # dispatch that is not happening on this run. Report what the provider
+        # actually runs, from the catalog, and drop the stale override (run.sh
+        # never reads the file on this provider, so it cannot be in effect).
+        override = None
+        default = "medium"
+        effective = _resolve_catalog_model(provider, "development")
     return {
         "override": override,
         "default": default,
         "effective": effective,
-        "allowed": list(_SESSION_MODEL_ALLOWLIST),
+        "provider": provider,
+        "switchable": _provider_supports_model_switch(provider),
+        "offers": offers,
+        "allowed": [o["value"] for o in offers],
     }
 
 
@@ -3156,6 +3348,22 @@ async def set_session_model(request: SessionModelRequest):
     """
     requested_raw = (request.model or "").strip().lower()
     override_path = _model_override_path()
+    # Mid-run switching is a claude-only runtime capability: run.sh:20996 gates the
+    # override-read block on PROVIDER_NAME=claude, so on any other provider this
+    # file would be written and never read. Reject instead of writing a file that
+    # does nothing and reporting success (a false affordance is worse than no
+    # control). Clearing is still allowed everywhere: removing a stale file is
+    # always safe and never claims a switch.
+    provider = _active_provider()
+    if requested_raw != "" and not _provider_supports_model_switch(provider):
+        raise HTTPException(
+            status_code=409,
+            detail=(
+                f"Mid-run model switching is not supported on provider '{provider}'. "
+                f"The run dispatches {_resolve_catalog_model(provider, 'development') or 'its configured model'}; "
+                "restart the run with a different model to change it."
+            ),
+        )
     if requested_raw == "":
         # Clear the override; revert to tier mapping.
         try:
@@ -3965,19 +4173,30 @@ async def start_build(request: Request, body: StartBuildRequest):
         popen_env["LOKI_TARGET_DIR"] = str(workspace_dir)
         popen_env["LOKI_DIR"] = str(loki_dir)
     if start_model:
-        # EXACT-model pin (not the session-pin tier route): set all three tier
-        # models to the chosen alias so resolve_model_for_tier returns the alias
-        # for every tier and every iteration dispatches exactly the picked model.
-        # This is the honest start-time equivalent of the mid-flight override
-        # file, which run.sh clears at iteration 0. LOKI_SESSION_MODEL is set too
-        # for internal coherence (the run's own tier accounting/logging), but the
-        # env triple is the load-bearing dispatch-honesty mechanism: on the
-        # v7.104.0 stock config the session pin alone would remap opus->planning->
-        # sonnet and haiku->fast->sonnet, dispatching sonnet for both.
-        popen_env["LOKI_CLAUDE_MODEL_PLANNING"] = start_model
-        popen_env["LOKI_CLAUDE_MODEL_DEVELOPMENT"] = start_model
-        popen_env["LOKI_CLAUDE_MODEL_FAST"] = start_model
-        popen_env["LOKI_SESSION_MODEL"] = start_model
+        if start_model in _START_MODEL_GENERIC_TIERS:
+            # A generic capability tier is provider-agnostic BY CONSTRUCTION --
+            # it names a capability class, not a model, and each provider
+            # resolves its own latest model for that class via
+            # providers/models.sh. Pinning the LOKI_CLAUDE_MODEL_* triple here
+            # would be actively wrong: those variables are inert on codex and
+            # every other non-Claude provider, so the pin would silently do
+            # nothing. LOKI_SESSION_MODEL is the correct and only lever.
+            popen_env["LOKI_SESSION_MODEL"] = start_model
+        else:
+            # EXACT-model pin (not the session-pin tier route): set all three tier
+            # models to the chosen alias so resolve_model_for_tier returns the alias
+            # for every tier and every iteration dispatches exactly the picked model.
+            # This is the honest start-time equivalent of the mid-flight override
+            # file, which run.sh clears at iteration 0. LOKI_SESSION_MODEL is set too
+            # for internal coherence (the run's own tier accounting/logging), but the
+            # env triple is the load-bearing dispatch-honesty mechanism: on the
+            # v7.104.0 stock config the session pin alone would remap
+            # opus->planning->sonnet and haiku->fast->sonnet, dispatching sonnet
+            # for both.
+            popen_env["LOKI_CLAUDE_MODEL_PLANNING"] = start_model
+            popen_env["LOKI_CLAUDE_MODEL_DEVELOPMENT"] = start_model
+            popen_env["LOKI_CLAUDE_MODEL_FAST"] = start_model
+            popen_env["LOKI_SESSION_MODEL"] = start_model
     if advisor_model:
         # Opt-in Opus (or other) judge for code review; execution model unchanged.
         popen_env["LOKI_ADVISOR_MODEL"] = advisor_model
@@ -7079,6 +7298,15 @@ _DEFAULT_PRICING = {
     "haiku":  {"input": 1.00, "output": 5.00},
     # OpenAI Codex
     "gpt-5.3-codex": {"input": 1.50, "output": 12.00},
+    # gpt-5.6 line: sol (high) / terra (medium, default) / luna (small).
+    # UNVERIFIED RATES. The model IDs are confirmed against
+    # developers.openai.com/api/docs/models, but OpenAI's published per-token
+    # prices for this line were not, so these are placeholders scaled from the
+    # gpt-5.3 rate. They drive a display estimate only, never a gate. Replace
+    # from the pricing page; tools/probe-model-catalog.py is the refresh path.
+    "gpt-5.6-sol":   {"input": 2.50, "output": 20.00},
+    "gpt-5.6-terra": {"input": 1.50, "output": 12.00},
+    "gpt-5.6-luna":  {"input": 0.50, "output": 4.00},
 }
 
 # Active pricing - starts with defaults, updated from .loki/pricing.json
@@ -7655,6 +7883,9 @@ _PROVIDER_LABELS = {
     "sonnet": "Sonnet 5",
     "haiku": "Haiku 4.5",
     "gpt-5.3-codex": "GPT-5.3 Codex",
+    "gpt-5.6-sol": "GPT-5.6 Sol",
+    "gpt-5.6-terra": "GPT-5.6 Terra",
+    "gpt-5.6-luna": "GPT-5.6 Luna",
 }
 
 # Display-only pricing notes, keyed by model. These annotate the pricing table in