mixdog 0.9.16 → 0.9.17

package/src/runtime/channels/lib/runtime-paths.mjs

@@ -38,17 +38,6 @@ function parsePositivePid(value) {
 function getTerminalLeadPid() {
   return parsePositivePid(process.env.MIXDOG_SUPERVISOR_PID) ?? process.pid;
 }
-// Pinned-owner default: ON. The first session to claim ownership auto-pins
-// itself and keeps the seat until its PID dies. Opt out per session with
-// MIXDOG_PIN_OWNER=0 (or false/no/off) when you want the legacy 10 s stale-
-// window takeover behavior — e.g. throwaway shells that should never become
-// the sticky main.
-function isOwnerPinEnabled() {
-  const v = process.env.MIXDOG_PIN_OWNER;
-  if (v === undefined || v === null || v === "") return true;
-  const low = String(v).toLowerCase();
-  return !(low === "0" || low === "false" || low === "no" || low === "off");
-}
 function getServerPid() {
   return parsePositivePid(process.env.MIXDOG_SERVER_PID) ?? (process.env.MIXDOG_WORKER_MODE === "1" ? null : process.pid);
 }
@@ -104,8 +93,10 @@ function touchUiHeartbeat(instanceId) {
       if (!curRaw) return undefined;
       if (instanceId && curRaw.instanceId !== instanceId) return undefined;
       return { ...curRaw, ui_heartbeat_at: Date.now(), updatedAt: Date.now() };
-    }, { compact: true, fsync: false, fsyncDir: false, renameFallback: 'truncate' });
-  } catch { /* best-effort; a missed tick just relies on the next one */ }
+    }, { compact: true, fsync: false, fsyncDir: false, renameFallback: 'truncate', timeoutMs: 0 });
+  } catch { /* best-effort try-once (timeoutMs:0): on lock contention we skip
+               this tick without ever blocking the render loop on Atomics.wait;
+               the next 30s tick catches up. */ }
 }
 function buildRuntimeIdentity() {
   const terminalLeadPid = getTerminalLeadPid();
@@ -294,12 +285,10 @@ function refreshActiveInstance(instanceId, meta, options) {
         if (outBase !== newBase) next.priorTranscriptPath = outgoing;
       }
     }
-    // Pinned ownership (default ON): each refresh reasserts the pinned flag
-    // from the current process's env. Other processes refreshing carry their
-    // own env, so the flag never outlives the pinned process. Set
-    // MIXDOG_PIN_OWNER=0 to opt out and revert to stale-window takeover.
-    if (isOwnerPinEnabled()) next.pinned = true;
-    else delete next.pinned;
+    // Ownership is strict last-wins (no pin): the newest claim always takes
+    // the seat. Drop any legacy `pinned` flag left by older versions — it was
+    // written but never consumed by any takeover check.
+    delete next.pinned;
     // I1: pg_* spreads FIRST so newFields above win on conflict.
     // prev.pg_port='A', meta.httpPort-adjacent pg_port='B' → result.pg_port='B'.
     // memory_port: preserve when the advertising memory worker is still alive

package/src/runtime/memory/index.mjs

@@ -10,6 +10,7 @@ process.on('warning', () => {})
 
 import http from 'node:http'
 import os from 'node:os'
+import { performance } from 'node:perf_hooks'
 import fs from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
@@ -102,6 +103,17 @@ if (!DATA_DIR) {
   process.exit(1)
 }
 __mixdogMemoryLog(`[memory-service] DATA_DIR=${DATA_DIR}\n`)
+const MEMORY_PROFILE_ENABLED = /^(1|true|yes|on)$/i.test(String(process.env.MIXDOG_MEMORY_PROFILE || process.env.MIXDOG_BOOT_PROFILE || ''))
+const MEMORY_PROFILE_START = performance.now()
+function memoryProfile(event, fields = {}) {
+  if (!MEMORY_PROFILE_ENABLED) return
+  const parts = [`[memory-profile] +${(performance.now() - MEMORY_PROFILE_START).toFixed(1)}ms`, event]
+  for (const [key, value] of Object.entries(fields || {})) {
+    if (value === undefined || value === null || value === '') continue
+    parts.push(`${key}=${String(value).replace(/\s+/g, '_')}`)
+  }
+  __mixdogMemoryLog(`${parts.join(' ')}\n`)
+}
 
 import {
   parsePositivePid,
@@ -283,6 +295,7 @@ function _ingestIdentityFields(m) {
   _ingestIdentityFieldsCache.set(m, fields)
   return fields
 }
+
 // Ingest now WAITS for its embedding flush (bounded) so freshly ingested rows
 // are dense-searchable the moment ingest_session returns. On a cold ONNX
 // model the flush can stall on warmup; the race below caps the wait and lets
@@ -339,6 +352,8 @@ function assertSecondaryPgAttachable() {
 }
 
 async function _initStore() {
+  const initStoreStartedAt = performance.now()
+  memoryProfile('init-store:start')
   mainConfig = readMainConfig()
   const embeddingConfig = mainConfig?.embedding
   if (embeddingConfig?.provider || embeddingConfig?.ollamaModel || embeddingConfig?.dtype) {
@@ -380,17 +395,24 @@ async function _initStore() {
   if (dimsResolved) {
     primeEmbeddingDims(dimsResolved)
     assertSecondaryPgAttachable()
+    const openStartedAt = performance.now()
     db = await openDatabase(DATA_DIR, dimsResolved)
+    memoryProfile('open-db:done', { ms: (performance.now() - openStartedAt).toFixed(1), dims: dimsResolved })
     _embeddingWarmup.schedule(EMBEDDING_META_PATH, metaKey)
   } else {
     if (!embeddingWarmupCanStart()) {
       throw new Error('memory-service: embedding dims unavailable while warmup is disabled')
     }
     // Cold path: meta missed AND model not registered. Sequential.
+    const warmupStartedAt = performance.now()
+    memoryProfile('embedding:cold-warmup:start')
     await warmupEmbeddingProvider()
+    memoryProfile('embedding:cold-warmup:done', { ms: (performance.now() - warmupStartedAt).toFixed(1) })
     dimsResolved = Number(getEmbeddingDims())
     assertSecondaryPgAttachable()
+    const openStartedAt = performance.now()
     db = await openDatabase(DATA_DIR, dimsResolved)
+    memoryProfile('open-db:done', { ms: (performance.now() - openStartedAt).toFixed(1), dims: dimsResolved })
     try {
       writeJsonAtomicSync(EMBEDDING_META_PATH, { ...metaKey, dims: dimsResolved }, { lock: true })
     } catch (e) {
@@ -429,13 +451,18 @@ async function _initStore() {
   if (cyclesCapable || memoryLlmWorkerEnabled()) {
     try {
       const agentCfg = loadAgentConfig()
+      const providersStartedAt = performance.now()
       await initProviders(agentCfg.providers || {})
+      memoryProfile('providers:init:done', { ms: (performance.now() - providersStartedAt).toFixed(1) })
     } catch (e) {
       process.stderr.write(`[memory-service] initProviders failed (non-fatal): ${e instanceof Error ? e.message : String(e)}\n`)
     }
   }
   _bootTimestamp = Date.now()
+  const offsetsStartedAt = performance.now()
   await loadTranscriptOffsets()
+  memoryProfile('transcript-offsets:loaded', { ms: (performance.now() - offsetsStartedAt).toFixed(1) })
+  memoryProfile('init-store:done', { ms: (performance.now() - initStoreStartedAt).toFixed(1) })
 }
 
 async function getCycleLastRun() {
@@ -679,11 +706,16 @@ function _stopCycles() {
 
 async function _initRuntime() {
   if (_initialized) return
+  const runtimeStartedAt = performance.now()
+  memoryProfile('runtime-init:start')
   await _initStore()
+  memoryProfile('runtime-init:init-store-ready', { ms: (performance.now() - runtimeStartedAt).toFixed(1) })
   // Restore the core_entries.id == 1..N invariant once per boot: SERIAL only
   // increments, so deleted rows leave permanent gaps. Fast no-op when already
   // contiguous (or empty). Runs only here — never in cycle2/addCore/deleteCore.
+  const compactStartedAt = performance.now()
   await compactCoreIds(DATA_DIR)
+  memoryProfile('core-ids:compact:done', { ms: (performance.now() - compactStartedAt).toFixed(1) })
   // Memory module is always-on: the transcript watcher/ingest runs
   // unconditionally except in secondary mode (secondary attaches to a primary's
   // PG and must not double-ingest). The recap toggle only gates whether the
@@ -697,7 +729,9 @@ async function _initRuntime() {
     __mixdogMemoryLog('[memory-service] secondary mode; skipping transcript watcher\n')
   }
   if (!memorySecondaryMode() && !envFlagEnabled('MIXDOG_MEMORY_DISABLE_CYCLES')) {
+    const cyclesStartedAt = performance.now()
     _startCycles()
+    memoryProfile('cycles:start:done', { ms: (performance.now() - cyclesStartedAt).toFixed(1) })
   } else {
     __mixdogMemoryLog('[memory-service] background cycle tick loop not started (secondary/env-disabled)\n')
   }
@@ -705,6 +739,7 @@ async function _initRuntime() {
   // Boot complete — continue straight into the deferred embedding warmup.
   // Fire-and-forget on the embedding worker thread; never awaited so it does
   // not delay init() returning or the memory-ready signal.
+  memoryProfile('embedding:warmup:fire')
   _embeddingWarmup.fireDeferred()
   // Boot-edge Korean morph warmup. Same fire-and-forget style: lazy async init
   // downloads+caches the Kiwi model once under DATA_DIR/kiwi-model/<version>,
@@ -712,8 +747,10 @@ async function _initRuntime() {
   // buildFtsQuery keeps the websearch_to_tsquery fallback (never throws here).
   // Skipped in secondary mode (query path lives on the primary).
   if (!memorySecondaryMode()) {
+    memoryProfile('ko-morph:warmup:fire')
     initKoMorph(DATA_DIR, __mixdogMemoryLog).catch(() => {})
   }
+  memoryProfile('runtime-init:done', { ms: (performance.now() - runtimeStartedAt).toFixed(1) })
 }
 
 function _beginRuntimeInit() {

package/src/runtime/memory/lib/embedding-warmup.mjs

@@ -28,8 +28,11 @@ export function createEmbeddingWarmup({
       return
     }
     _pending = () => {
+      const startedAt = Date.now()
+      log('[memory-service] embedding warmup start\n')
       warmup()
         .then(() => {
+          log(`[memory-service] embedding warmup ready in ${Date.now() - startedAt}ms\n`)
           const measured = Number(getDims())
           try {
             persistMeta(metaPath, { ...metaKey, dims: measured })

package/src/runtime/memory/lib/ko-morph.mjs

@@ -130,6 +130,7 @@ export async function init(dataDir, log = () => {}) {
   _log = typeof log === 'function' ? log : (() => {})
   _state = 'loading'
   const t0 = Date.now()
+  _log(`[memory-service] kiwi morph init start (model ${KIWI_MODEL_VERSION})\n`)
   _initPromise = (async () => {
     // Resolve the WASM path from the installed package without hard-importing
     // (keeps the whole feature optional if kiwi-nlp isn't installed).

package/src/runtime/shared/atomic-file.mjs

@@ -63,6 +63,16 @@ export function withFileLockSync(lockPath, fn, opts = {}) {
     } catch (err) {
       lastErr = err;
       if (!LOCK_WAIT_CODES.has(err?.code)) throw err;
+      // try-once semantics: timeoutMs:0 makes a single openSync attempt and
+      // never sleeps — on contention it throws ELOCKCONTENDED immediately so
+      // the main loop is never blocked by Atomics.wait. No stale-reclaim,
+      // since reclaim would require waiting on the guard.
+      if (timeoutMs <= 0) {
+        const contErr = new Error(`atomic lock contended (try-once): ${lockPath}`);
+        contErr.code = 'ELOCKCONTENDED';
+        contErr.cause = err;
+        throw contErr;
+      }
       try {
         const st = statSync(lockPath);
         if (Date.now() - st.mtimeMs > staleMs) {
@@ -246,6 +256,86 @@ function _releaseReclaimGuard(reclaim) {
   }
 }
 
+// ── Async lock variant (non-blocking wait) ──────────────────────────
+// Identical lock protocol to withFileLockSync (same lockPath, same pid
+// stamp, same stale/ownership/reclaim rules) so a sync holder and an
+// async holder are mutually exclusive against one another — they contend
+// for the SAME openSync('wx') on the SAME path. The ONLY difference is
+// the wait: instead of Atomics.wait blocking the event loop, we yield via
+// setTimeout backoff. Intended for UI-process consistency-required writes
+// that must not stall the render loop.
+function _asyncSleep(ms) {
+  return new Promise((resolve) => { setTimeout(resolve, Math.max(1, Number(ms) || 1)); });
+}
+
+export async function withFileLock(lockPath, fn, opts = {}) {
+  const timeoutMs = Number.isFinite(opts.timeoutMs) ? opts.timeoutMs : DEFAULT_LOCK_TIMEOUT_MS;
+  const staleMs = Number.isFinite(opts.staleMs) ? opts.staleMs : 30000;
+  const deadline = Date.now() + timeoutMs;
+  mkdirSync(dirname(lockPath), { recursive: true });
+  let attempt = 0;
+  let lastErr = null;
+  while (true) {
+    let fd;
+    try {
+      fd = openSync(lockPath, 'wx');
+    } catch (err) {
+      lastErr = err;
+      if (!LOCK_WAIT_CODES.has(err?.code)) throw err;
+      if (timeoutMs <= 0) {
+        const contErr = new Error(`atomic lock contended (try-once): ${lockPath}`);
+        contErr.code = 'ELOCKCONTENDED';
+        contErr.cause = err;
+        throw contErr;
+      }
+      try {
+        const st = statSync(lockPath);
+        if (Date.now() - st.mtimeMs > staleMs) {
+          const deadPid = _readLockOwnerPid(lockPath);
+          if (deadPid !== null && _pidIsDead(deadPid)) {
+            const reclaim = _tryAcquireReclaimGuard(lockPath, staleMs);
+            if (reclaim !== null) {
+              let reclaimed = false;
+              try {
+                const currentSt = statSync(lockPath);
+                if (Date.now() - currentSt.mtimeMs > staleMs) {
+                  const currentPid = _readLockOwnerPid(lockPath);
+                  if (currentPid === deadPid && _pidIsDead(currentPid)) {
+                    try { unlinkSync(lockPath); reclaimed = true; } catch {}
+                  }
+                }
+              } finally {
+                _releaseReclaimGuard(reclaim);
+              }
+              if (reclaimed) continue;
+            }
+          }
+        }
+      } catch {}
+      if (Date.now() >= deadline) break;
+      const base = DEFAULT_BACKOFFS_MS[Math.min(attempt, DEFAULT_BACKOFFS_MS.length - 1)];
+      const jitter = Math.floor(Math.random() * Math.min(75, Math.max(1, base)));
+      await _asyncSleep(Math.min(Math.max(1, deadline - Date.now()), base + jitter));
+      attempt += 1;
+      continue;
+    }
+    try { writeFileSync(fd, `${process.pid} ${Date.now()}\n`, 'utf8'); } catch {}
+    try {
+      if (opts.secret === true) _enforceOwnerOnlyAclWin32(lockPath);
+      return await fn();
+    } finally {
+      try { closeSync(fd); } catch {}
+      try {
+        if (_lockOwnedByPid(lockPath, process.pid)) unlinkSync(lockPath);
+      } catch {}
+    }
+  }
+  const timeoutErr = new Error(`atomic lock timeout after ${timeoutMs}ms: ${lockPath}`);
+  timeoutErr.code = 'ELOCKTIMEOUT';
+  timeoutErr.cause = lastErr;
+  throw timeoutErr;
+}
+
 // ── Windows owner-only ACL enforcement (fail-closed) ─────────────────
 // POSIX 0o600/0o700 mode bits are advisory-at-best on Windows: NTFS
 // ignores them and the file inherits the parent ACL, which in shared or
@@ -459,3 +549,23 @@ export function updateJsonAtomicSync(filePath, mutator, opts = {}) {
     return next;
   }, opts);
 }
+
+// Async read-modify-write. Same lock path (`${filePath}.lock`) and protocol
+// as updateJsonAtomicSync, so it is mutually exclusive with the sync variant.
+// The critical section itself is synchronous (readFileSync + writeJsonAtomicSync);
+// only the lock WAIT is async, so the event loop is never blocked on contention.
+export async function updateJsonAtomic(filePath, mutator, opts = {}) {
+  const { lock: _lock, ...writeOpts } = opts;
+  return withFileLock(`${filePath}.lock`, () => {
+    let cur = null;
+    try {
+      cur = JSON.parse(readFileSync(filePath, 'utf8'));
+    } catch {
+      cur = null;
+    }
+    const next = mutator(cur);
+    if (next === undefined) return cur;
+    writeJsonAtomicSync(filePath, next, { ...writeOpts, lock: false });
+    return next;
+  }, opts);
+}

package/src/runtime/shared/transcript-writer.mjs

@@ -15,6 +15,13 @@
  * cannot spam the terminal.
  */
 import { existsSync, mkdirSync, renameSync, statSync, writeFileSync } from 'node:fs';
+
+// After this many appended bytes since the last rotation stat, re-check
+// disk size via statSync. Bounds the sync-fs cost per append to roughly
+// once every ~64KB of transcript growth instead of on every single line,
+// while still catching rotation promptly (a JSONL line is typically well
+// under 1KB, so this is on the order of dozens of appends between stats).
+const ROTATE_CHECK_BYTE_STRIDE = 64 * 1024;
 import { dirname, join, resolve } from 'node:path';
 import { appendBuffered, drainPathSync, hasInFlightWrite } from './buffered-appender.mjs';
 
@@ -62,10 +69,28 @@ export function createTranscriptWriter({ mixdogHome, sessionId, cwd, pid } = {})
     }
   }
 
-  function rotateIfNeeded() {
+  // Local byte counter tracking growth since the last real statSync, so
+  // rotateIfNeeded's fs work is O(1) per append instead of an existsSync+
+  // statSync pair on every single JSONL line (this fires on every assistant
+  // chunk / tool call, i.e. per token-stream event, not per turn). We only
+  // hit disk again once the locally-tracked size estimate could plausibly
+  // have crossed the rotate threshold, or a full check hasn't happened yet.
+  let sizeChecked = false;
+  let lastKnownSize = 0;
+  let bytesSinceCheck = 0;
+
+  function statAndMaybeRotate() {
     try {
-      if (!existsSync(transcriptPath)) return;
+      if (!existsSync(transcriptPath)) {
+        sizeChecked = true;
+        lastKnownSize = 0;
+        bytesSinceCheck = 0;
+        return;
+      }
       const { size } = statSync(transcriptPath);
+      sizeChecked = true;
+      lastKnownSize = size;
+      bytesSinceCheck = 0;
       if (size < TRANSCRIPT_ROTATE_BYTES) return;
       // An async appendFile may be in flight for this path; renaming out
       // from under it races the write on Windows. Skip this round and
@@ -76,17 +101,34 @@ export function createTranscriptWriter({ mixdogHome, sessionId, cwd, pid } = {})
       // file post-rename doesn't inherit stale in-memory chunks.
       drainPathSync(transcriptPath);
       const rotatedPath = `${transcriptPath}.1`;
-      try { renameSync(transcriptPath, rotatedPath); } catch (err) { logOnce(err); }
+      try {
+        renameSync(transcriptPath, rotatedPath);
+        lastKnownSize = 0;
+      } catch (err) { logOnce(err); }
     } catch (err) {
       logOnce(err);
     }
   }
 
+  function rotateIfNeeded() {
+    // Real stat only when: no check has happened yet, the locally-tracked
+    // growth alone could have crossed the rotate threshold, or the last
+    // known size plus tracked growth is already at/over the threshold
+    // (catches a file that was already large when this process attached).
+    if (!sizeChecked
+      || bytesSinceCheck >= ROTATE_CHECK_BYTE_STRIDE
+      || lastKnownSize + bytesSinceCheck >= TRANSCRIPT_ROTATE_BYTES) {
+      statAndMaybeRotate();
+    }
+  }
+
   function appendLine(entry) {
     ensureProjectDir();
     rotateIfNeeded();
     try {
-      appendBuffered(transcriptPath, `${JSON.stringify(entry)}\n`);
+      const line = `${JSON.stringify(entry)}\n`;
+      appendBuffered(transcriptPath, line);
+      bytesSinceCheck += Buffer.byteLength(line);
     } catch (err) {
       logOnce(err);
     }

package/src/session-runtime/provider-models.mjs

@@ -11,6 +11,10 @@ import { fastCapableFor, fastPreferenceFor } from './model-capabilities.mjs';
 import { modelSettingsFor } from './config-helpers.mjs';
 import { isSelectableLlmModel } from './model-recency.mjs';
 
+const PROVIDER_MODELS_PROFILE_ENABLED = /^(1|true|yes|on)$/i.test(String(
+  process.env.MIXDOG_PROVIDER_MODELS_PROFILE || process.env.MIXDOG_BOOT_PROFILE || '',
+));
+
 export function createProviderModels({
   caches,
   modelMetaByRoute,
@@ -32,6 +36,10 @@ export function createProviderModels({
   const config = () => getConfig();
   const route = () => getRoute();
   const reg = () => getReg();
+  function profile(event, fields = {}) {
+    if (!PROVIDER_MODELS_PROFILE_ENABLED) return;
+    bootProfile(`provider-models:${event}`, fields);
+  }
 
   function modelMetaKey(providerId, modelId) {
     return `${clean(providerId)}\n${clean(modelId)}`;
@@ -152,12 +160,17 @@ export function createProviderModels({
     return results;
   }
 
-  async function loadProviderModelsFresh({ forceRefresh = false } = {}) {
-    ensureFullConfig();
+  async function loadProviderModelsFresh({ forceRefresh = false, loadSecrets = true } = {}) {
+    const startedAt = performance.now();
+    profile('load:start', { forceRefresh, loadSecrets });
+    if (loadSecrets) ensureFullConfig();
+    const providersStartedAt = performance.now();
     await ensureProvidersReady(config().providers || {});
+    profile('providers-ready', { ms: (performance.now() - providersStartedAt).toFixed(1) });
     const allProviders = [...reg().getAllProviders()];
     const providerResults = await Promise.all(allProviders.map(async ([name, provider]) => {
       if (typeof provider?.listModels !== 'function') return [];
+      const providerStartedAt = performance.now();
       try {
         let models = null;
         if (forceRefresh && typeof provider._refreshModelCache === 'function') {
@@ -173,8 +186,19 @@ export function createProviderModels({
           if (!isSelectableLlmModel(m)) continue;
           rows.push(providerModelCacheRow(name, m));
         }
+        profile('provider:done', {
+          provider: name,
+          ms: (performance.now() - providerStartedAt).toFixed(1),
+          models: models.length,
+          rows: rows.length,
+        });
         return rows;
-      } catch {
+      } catch (error) {
+        profile('provider:failed', {
+          provider: name,
+          ms: (performance.now() - providerStartedAt).toFixed(1),
+          error: error?.message || String(error),
+        });
         // Ignore per-provider catalog failures so one bad credential or
         // transient /models error does not hide other authenticated models.
         return [];
@@ -189,9 +213,21 @@ export function createProviderModels({
       results.push(row);
       modelMetaByRoute.set(modelMetaKey(row.provider, row.id), row);
     }
+    profile('load:done', { ms: (performance.now() - startedAt).toFixed(1), providers: allProviders.length, rows: results.length });
     return results;
   }
 
+  function shouldAdoptProviderModelCache(models, { loadSecrets = true } = {}) {
+    // Background warmup deliberately avoids ensureFullConfig() so it cannot
+    // block the TUI on keychain/config reload. That no-secrets path is only a
+    // best-effort provider-internal prefetch. Its result may be a partial
+    // catalog (for example local/env providers listed while keychain-backed
+    // providers failed), so never let it become the authoritative picker cache.
+    // Foreground/forced loads still adopt empty lists because they loaded the
+    // authoritative config.
+    return loadSecrets;
+  }
+
   async function collectSearchProviderModels({ force = false } = {}) {
     if (!force && Array.isArray(caches.searchProviderModelsCache.models)) {
       return providerModelsFromCacheRows(quickHelpers.searchRowsWithDefault(caches.searchProviderModelsCache.models));
@@ -223,15 +259,15 @@ export function createProviderModels({
     }
     if (force) {
       const seq = ++caches.providerModelsLoadSeq;
-      const models = await loadProviderModelsFresh({ forceRefresh: true });
+      const models = await loadProviderModelsFresh({ forceRefresh: true, loadSecrets: true });
       if (seq === caches.providerModelsLoadSeq) caches.providerModelsCache = { models, at: Date.now() };
       return providerModelsFromCacheRows(models);
     }
     if (!caches.providerModelsPromise) {
       const seq = ++caches.providerModelsLoadSeq;
-      caches.providerModelsPromise = loadProviderModelsFresh()
+      caches.providerModelsPromise = loadProviderModelsFresh({ loadSecrets: true })
         .then((models) => {
-          if (seq === caches.providerModelsLoadSeq) caches.providerModelsCache = { models, at: Date.now() };
+          if (seq === caches.providerModelsLoadSeq && shouldAdoptProviderModelCache(models, { loadSecrets: true })) caches.providerModelsCache = { models, at: Date.now() };
           return models;
         })
         .finally(() => {
@@ -243,10 +279,13 @@ export function createProviderModels({
 
   function warmProviderModelCache() {
     if (Array.isArray(caches.providerModelsCache.models) || caches.providerModelsPromise) return caches.providerModelsPromise;
+    profile('warm:start');
     const seq = ++caches.providerModelsLoadSeq;
-    caches.providerModelsPromise = loadProviderModelsFresh()
+    caches.providerModelsPromise = loadProviderModelsFresh({ loadSecrets: false })
       .then((models) => {
-        if (seq === caches.providerModelsLoadSeq) caches.providerModelsCache = { models, at: Date.now() };
+        if (seq === caches.providerModelsLoadSeq && shouldAdoptProviderModelCache(models, { loadSecrets: false })) {
+          caches.providerModelsCache = { models, at: Date.now() };
+        }
         bootProfile('provider-models:warm-ready', { count: models.length });
         return models;
       })