mixdog 1.0.12 → 1.1.1

package/src/session-runtime/goal-facade-api.mjs

@@ -44,6 +44,10 @@ export function createGoalFacadeApi({ agentStatusState, createCurrentSession, ge
       const sessionId = getSessionId();
       return sessionId ? goalRuntime.settleTurn(sessionId, detail) : null;
     },
+    reactivateUsageLimitedGoal(goalId) {
+      const sessionId = getSessionId();
+      return sessionId ? goalRuntime.reactivateUsageLimited(sessionId, goalId) : null;
+    },
     archiveCompletedGoalOnUserInput() {
       const sessionId = getSessionId();
       return sessionId ? goalRuntime.archiveCompletedOnUserInput(sessionId) : null;

package/src/session-runtime/lifecycle/inheritance.mjs

@@ -23,15 +23,23 @@ export function createInheritance(deps, { compactConversation, saveSession }) {
    * budget, and no mutation of either session. Returns the conversation to
    * carry, or null when the route has no boundary to compact toward.
    */
-  async function compactConversationForHeir(source, target) {
+  async function compactConversationForHeir(source, target, { summarize = false } = {}) {
     const plan = inheritanceCompactionPlan(target);
     if (!plan) return null;
     // The compactor sees the whole transcript — system blocks included — so it
     // preserves the protected head and the recent tail exactly as /compact
     // does. Only the conversation half of the result travels.
     const messages = structuredClone(Array.isArray(source.messages) ? source.messages : []);
+    // The compactor writes a model summary only once the conversation passes
+    // its size threshold; below it, it trims by rules and the transcript comes
+    // back nearly whole. An explicitly chosen compacted carry must summarize
+    // whatever its size, so the compactor gets a COPY of the source whose
+    // threshold is the floor — the source session itself is left untouched.
+    const compactSource = summarize
+      ? { ...source, compaction: { ...source.compaction, conversationThresholdTokens: 1 } }
+      : source;
     const result = await compactConversation({
-      session: source,
+      session: compactSource,
       messages,
       ...plan,
       // Memory ingest belongs to the session that HELD the conversation; the
@@ -46,17 +54,26 @@ export function createInheritance(deps, { compactConversation, saveSession }) {
   // instead of sending the user away to run /compact by hand. The compaction
   // is sized for the HEIR and runs on a copy, so the source session keeps
   // every message it has.
-  async function fitConversationForHeir(source, target, carried, fit) {
+  // `required`: the user explicitly chose a compacted carry. Then a compaction
+  // that cannot run (or yields nothing) is a refusal even when the original
+  // would fit — silently carrying the full conversation would answer a
+  // different request than the one made.
+  async function fitConversationForHeir(source, target, carried, fit, { required = false } = {}) {
     let compactionFault = null;
     let compacted = null;
     try {
-      compacted = await compactConversationForHeir(source, target);
+      compacted = await compactConversationForHeir(source, target, { summarize: required });
     } catch (reason) {
       // A compaction that cannot run is a refusal, not a half-carry: the
       // user reads the same measured sentence they would have read without
       // the attempt, and the engine fault travels along as its cause.
       compactionFault = reason;
     }
+    if (required && !compacted) {
+      const refusal = new Error('inheritFrom: the conversation could not be compacted for the new session');
+      if (compactionFault) refusal.cause = compactionFault;
+      throw refusal;
+    }
     let next = carried;
     let nextFit = fit;
     if (compacted) {
@@ -138,7 +155,8 @@ export function createInheritance(deps, { compactConversation, saveSession }) {
    * The target must still be empty: interleaving two transcripts would
    * produce a conversation neither model ever had.
    */
-  async function inheritFrom(sourceSessionId) {
+  async function inheritFrom(sourceSessionId, options = null) {
+    const compact = options?.compact === true;
     const id = clean(sourceSessionId);
     if (!id) throw new TypeError('inheritFrom: source session id is required');
     // A daemon-created heir is still only RESERVED when the desktop calls
@@ -168,7 +186,11 @@ export function createInheritance(deps, { compactConversation, saveSession }) {
     // offered the carry and the runtime that performs it cannot disagree —
     // and a refusal no longer has to unwind a half-filled transcript.
     const fit = inheritanceFit(carried, target);
-    if (fit.known && !fit.fits) carried = await fitConversationForHeir(source, target, carried, fit);
+    // compact:true summarizes even a conversation that fits; otherwise only
+    // one that cannot fit is compacted.
+    if (compact || (fit.known && !fit.fits)) {
+      carried = await fitConversationForHeir(source, target, carried, fit, { required: compact });
+    }
     target.messages.push(
       ...stripEffortConfiguration(inheritedCompatReplayMessages(structuredClone(carried), source.provider))
     );

package/src/session-runtime/lifecycle/session-switch/context-switch.mjs

@@ -21,6 +21,8 @@ export function createContextSwitch(deps, { ingestSessionIntoMemory, closeSurfac
   } = deps;
 
   async function switchContext({ cwd, desktopSession: nextDesktopSession, forResume = false } = {}) {
+    // Leaving the open conversation would re-key an addressed runtime.
+    deps.assertNotAddressed?.('switchContext');
     clearRoutePreparation?.();
     const session = getSession();
     if (session?.id) {
@@ -55,6 +57,7 @@ export function createContextSwitch(deps, { ingestSessionIntoMemory, closeSurfac
   }
 
   async function newSession() {
+    deps.assertNotAddressed?.('newSession');
     const session = getSession();
     if (session?.id) {
       void ingestSessionIntoMemory(session);

package/src/session-runtime/lifecycle/session-switch/resume.mjs

@@ -5,7 +5,10 @@
  */
 import { writeStatuslineRoute } from '../../statusline-route.mjs';
 import { clean, hasOwn } from '../../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
-import { toolSpecForMode, deferredSurfaceModeForLead } from '../../../runtime/agent/orchestrator/runtime-core/effort.mjs';
+import {
+  toolSpecForMode,
+  deferredSurfaceModeForLead,
+} from '../../../runtime/agent/orchestrator/runtime-core/effort.mjs';
 import { isScratchConversation } from '../shared.mjs';
 
 export function resolveResumeCwd(session, currentCwd) {
@@ -97,6 +100,9 @@ export function createSessionResume(deps, { ingestSessionIntoMemory, closeSurfac
   }
 
   async function resume(id) {
+    // An addressed runtime may only reopen its own conversation; checked
+    // before anything is retired or closed.
+    deps.assertResumeTarget?.(id);
     clearRoutePreparation?.();
     const prev = getSession();
     // Captured before the manager reopens anything: the scratch decision for

package/src/session-runtime/lifecycle/session-switch/session-delete.mjs

@@ -88,6 +88,12 @@ export function createSessionDelete(deps, { cancelBackgroundTasks }) {
     setSession(null);
     invalidateContextStatusCache();
     invalidatePreSessionToolSurface();
+    // An addressed runtime never mints a replacement under the deleted
+    // address: it becomes terminal and a new conversation needs a new entry.
+    if (deps.getAddressedSessionId?.()) {
+      deps.markAddressTerminal?.();
+      return true;
+    }
     await createCurrentSession();
     return true;
   }

package/src/session-runtime/lifecycle/teardown/session-close.mjs

@@ -63,10 +63,22 @@ export function closeOwnSession(deps, closeSurfaceSession, reason) {
 /** Plant the ordinary manager/store tombstone barrier for a canonical
  *  child session without running whole-process teardown. */
 export function closeCanonicalSession(deps, reason = 'canonical-session-close') {
-  const { getSession, setSession, mgr, invalidateContextStatusCache } = deps;
+  const { getSession, setSession, mgr, invalidateContextStatusCache, beginCanonicalClose, finishCanonicalClose } = deps;
+  // Already terminal: closing is idempotent and keeps the address.
+  if (deps.isCanonicallyClosed?.() === true) return true;
   const session = getSession?.();
   if (!session?.id || session.remoteAttached === true) return false;
-  const closed = mgr.closeSession(session.id, reason, { tombstone: true }) === true;
+  // Fence execution admission BEFORE the manager close: that close cancels the
+  // session's shells synchronously, and their completions must not be able to
+  // enqueue model work or create a conversation.
+  const fence = beginCanonicalClose?.(session.id);
+  let closed = false;
+  try {
+    closed = mgr.closeSession(session.id, reason, { tombstone: true }) === true;
+  } finally {
+    // Terminal after a durable close; admission restored when it failed.
+    finishCanonicalClose?.(fence, closed);
+  }
   if (!closed) return false;
   setSession?.(null);
   invalidateContextStatusCache?.();

package/src/session-runtime/media-api.mjs

@@ -4,33 +4,43 @@
  * The media graph (lane catalog, adapters, asset store) is imported on first
  * use: a session that never opens the Studio must not pay for it at boot.
  */
-let laneModule = null;
-let jobModule = null;
-let storeModule = null;
-
-async function lanes() {
-  laneModule ??= await import('../runtime/media/lanes.mjs');
-  return laneModule;
-}
-
-async function jobs() {
-  jobModule ??= await import('../runtime/media/jobs.mjs');
-  return jobModule;
-}
-
-async function store() {
-  storeModule ??= await import('../runtime/media/store.mjs');
-  return storeModule;
+// Each loader keeps its literal import() so bundlers can trace it; only a
+// resolved module is cached, so a failed import is retried on the next call.
+function lazy(load) {
+  let module = null;
+  return async () => {
+    module ??= await load();
+    return module;
+  };
 }
 
-let defaultsModule = null;
-async function defaults() {
-  defaultsModule ??= await import('../runtime/media/defaults.mjs');
-  return defaultsModule;
-}
+const lanes = lazy(() => import('../runtime/media/lanes.mjs'));
+const jobs = lazy(() => import('../runtime/media/jobs.mjs'));
+const store = lazy(() => import('../runtime/media/store.mjs'));
+const defaults = lazy(() => import('../runtime/media/defaults.mjs'));
+const voice = lazy(() => import('../runtime/channels/lib/voice-setup.mjs'));
 
 export function createMediaApi() {
   return {
+    /** Read-only voice state: `voice.enabled` plus the managed whisper/ffmpeg
+     *  runtime on disk. */
+    async getVoiceStatus() {
+      return (await voice()).getVoiceStatus();
+    },
+    /** Same toggle as the session `toggleVoice` action: enabling installs any
+     *  missing whisper/ffmpeg component first. `error` carries the last
+     *  warning or failure the toggle reported. */
+    async setVoiceEnabled(enabled) {
+      const module = await voice();
+      let error = null;
+      await module.toggleVoice({
+        enabled,
+        pushNotice: (text, level) => {
+          if (level === 'warn' || level === 'error') error = text;
+        },
+      });
+      return { status: await module.getVoiceStatus(), error };
+    },
     async listMediaLanes() {
       return (await lanes()).listMediaLanes();
     },

package/src/session-runtime/model-recency.mjs

@@ -3,6 +3,19 @@
 // injected route provider (for sort priority) and webSearchCapableFor predicate.
 import { clean } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { contextWindowRange } from '../runtime/shared/llm/default-context-window.mjs';
+import { isCustomProviderName } from '../runtime/agent/orchestrator/providers/custom-reasoning.mjs';
+
+// A custom provider's effective row fields, carried when the row states them
+// (explicit false included); first-party rows never carry them.
+function customRowFields(name, m) {
+  if (!isCustomProviderName(name)) return {};
+  return {
+    ...(typeof m.name === 'string' && m.name ? { name: m.name } : {}),
+    ...(typeof m.hidden === 'boolean' ? { hidden: m.hidden } : {}),
+    ...(typeof m.manual === 'boolean' ? { manual: m.manual } : {}),
+    ...(m.customReasoning && typeof m.customReasoning === 'object' ? { customReasoning: m.customReasoning } : {}),
+  };
+}
 
 function parsedProviderModelVersion(id) {
   const text = clean(id).toLowerCase();
@@ -138,6 +151,9 @@ export function providerModelCacheRow(name, m, webSearchCapableFor) {
     serviceTiers: Array.isArray(m.serviceTiers) ? m.serviceTiers : [],
     additionalSpeedTiers: Array.isArray(m.additionalSpeedTiers) ? m.additionalSpeedTiers : [],
     defaultServiceTier: m.defaultServiceTier || null,
+    ...(Array.isArray(m.accessPrograms) ? { accessPrograms: m.accessPrograms } : {}),
+    // A catalog-hidden model leaves the pickers; its metadata still resolves.
+    ...(m.hidden === true ? { hidden: true } : {}),
     fastCapable: m.fastCapable === true,
     fastEfforts: Array.isArray(m.fastEfforts) ? m.fastEfforts : undefined,
     modelParameterOptions: Array.isArray(m.modelParameterOptions) ? m.modelParameterOptions : [],
@@ -148,5 +164,6 @@ export function providerModelCacheRow(name, m, webSearchCapableFor) {
     defaultFast: m.defaultFast === true,
     supportsMaxMode: m.supportsMaxMode === true,
     mode: m.mode || null,
+    ...customRowFields(name, m),
   };
 }

package/src/session-runtime/model-route/route-tuning.mjs

@@ -29,11 +29,9 @@ export function createRouteTuning(deps, persist) {
       throw new Error(`ultrafast is not available for ${getRoute().provider}/${getRoute().model}`);
     }
     const { serviceTier: previousTier, ...otherParameters } = getRoute().modelParameters || {};
-    const modelParameters = ultra
-      ? { ...otherParameters, serviceTier: 'ultrafast' }
-      : previousTier === 'ultrafast'
-        ? otherParameters
-        : getRoute().modelParameters;
+    let modelParameters = getRoute().modelParameters;
+    if (ultra) modelParameters = { ...otherParameters, serviceTier: 'ultrafast' };
+    else if (previousTier === 'ultrafast') modelParameters = otherParameters;
     const fastCapable = selectionFastCapable(
       getRoute().provider,
       modelMeta,

package/src/session-runtime/model-route/set-route.mjs

@@ -16,6 +16,7 @@ import { resolveRouteContextState, selectionFastCapable } from '../route-state.m
 import { writeStatuslineRoute } from '../statusline-route.mjs';
 import {
   sessionHasRouteHistory,
+  sessionRouteCommitted,
   shouldRecreateEmptySessionForRouteChange,
 } from '../../runtime/agent/orchestrator/runtime-core/session-route-policy.mjs';
 import { rebuildDeferredToolSurfaceForProvider } from '../../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
@@ -84,7 +85,7 @@ async function recreateEmptySession(deps) {
 }
 
 /** Rewrite the addressed empty session to the route it was asked to run on. */
-function updateEmptySessionInPlace(deps, session) {
+function updateSessionInPlace(deps, session, updateOptions) {
   const { getRoute, getSession, setSession, mgr, statusRoutes } = deps;
   const route = getRoute();
   const fields = {
@@ -96,56 +97,83 @@ function updateEmptySessionInPlace(deps, session) {
     contextPercent: route.contextPercent,
     selectedContextWindow: route.selectedContextWindow || null,
   };
-  const updated = mgr.updateSessionRoute?.(session.id, fields);
+  const updated = mgr.updateSessionRoute?.(session.id, fields, updateOptions);
   if (updated) setSession(updated);
   else Object.assign(session, fields);
   rebuildDeferredToolSurfaceForProvider(getSession(), route.provider);
   writeStatuslineRoute(statusRoutes, getSession(), route);
 }
 
-export function createSetRoute(deps, persist) {
+/** Validate, persist and adopt the requested route as the runtime's route. */
+async function adoptRoute(deps, persist, next, options) {
   const {
     getConfig,
     getRoute,
     setRouteState,
-    getSession,
     resolveRoute,
     refreshRouteEffort,
     refreshStatuslineUsageSnapshot,
     scheduleStatuslineUsageRefresh,
-    invalidateContextStatusCache,
-    createCurrentSession,
   } = deps;
+  const { selectedRoute, fastCapable, modelMeta } = await resolveSelectedRoute(deps, next);
+  persist.saveRouteModelSettings(selectedRoute, fastCapable);
+  // An heir opening on its source's model is not a main-model choice.
+  const leadRoute = persist.persistAdoptedModelSettings(selectedRoute, {
+    keepMainModel: options?.keepMainModel === true,
+  });
+  setRouteState(resolveRoute(getConfig(), leadRoute ? { model: workflowPresetId('lead') } : selectedRoute));
+  await refreshRouteEffort(modelMeta);
+  refreshStatuslineUsageSnapshot(getRoute());
+  scheduleStatuslineUsageRefresh();
+}
+
+/**
+ * Quota-exhaustion escape hatch: apply `next` to the addressed, ESTABLISHED
+ * session in place. The caller (session API) has already proven the latest
+ * settled turn failed on quota and that nothing is running. Starts no turn;
+ * the next turn's auto-compaction fits history to the new window.
+ */
+export function createContinueSessionInModel(deps, persist) {
+  const { getSession, invalidateContextStatusCache } = deps;
+  return async function continueSessionInModel(sessionId, next) {
+    const session = getSession();
+    if (!sessionId || !session?.id || session.id !== sessionId) {
+      throw new Error(`session ${sessionId || ''} is not the active session`);
+    }
+    await adoptRoute(deps, persist, next, {});
+    updateSessionInPlace(deps, session, { crossProvider: true });
+    invalidateContextStatusCache();
+    return true;
+  };
+}
+
+export function createSetRoute(deps, persist) {
+  const { getRoute, getSession, invalidateContextStatusCache, createCurrentSession } = deps;
 
   return async function setRoute(next, options = {}) {
     // Selection is for a new/inherited session. An explicit durable address
     // permits initializing an EMPTY session, never rewriting an existing
     // conversation's model, context boundary or provider cache.
     const applyToCurrentSession = options?.applyToCurrentSession === true;
-    const { selectedRoute, fastCapable, modelMeta } = await resolveSelectedRoute(deps, next);
-    persist.saveRouteModelSettings(selectedRoute, fastCapable);
-    // An heir opening on its source's model is not a main-model choice.
-    const leadRoute = persist.persistAdoptedModelSettings(selectedRoute, {
-      keepMainModel: options?.keepMainModel === true,
-    });
-    setRouteState(resolveRoute(getConfig(), leadRoute ? { model: workflowPresetId('lead') } : selectedRoute));
-    await refreshRouteEffort(modelMeta);
-    refreshStatuslineUsageSnapshot(getRoute());
-    scheduleStatuslineUsageRefresh();
+    await adoptRoute(deps, persist, next, options);
     const session = getSession();
     // Model/provider changes are next-session-only for a session the user
     // has already talked in or compacted (provider-keyed prompt cache). But
-    // an EMPTY current session — no committed route history and no in-flight
-    // first-turn prompt — has no cache to protect, so /model before the first
-    // chat takes effect live: route + statusline update immediately.
-    const currentSessionEmpty = !!session && !sessionHasRouteHistory(session);
+    // a current session with no model reply, no compaction summary and no
+    // in-flight first turn — empty, or holding only refused prompts — has no
+    // cache to protect, so /model takes effect live: route + statusline
+    // update immediately. Only a truly empty session is recreated below.
+    const currentSessionEmpty = !!session && !sessionRouteCommitted(session);
     if (!currentSessionEmpty) {
       // Some desktop effort changes travel as a same-model route update.
       // Only effort/Fast may affect the source, starting with its next turn.
       if (applyToCurrentSession) persist.applySessionTuning();
       return getRoute();
     }
+    // An addressed runtime keeps its durable id: the empty session is updated
+    // in place, never closed and replaced by a freshly minted one.
     if (
+      !deps.getAddressedSessionId?.() &&
       shouldRecreateEmptySessionForRouteChange(session, applyToCurrentSession) &&
       session?.id &&
       typeof createCurrentSession === 'function'
@@ -159,7 +187,7 @@ export function createSetRoute(deps, persist) {
       // durable address. The caller asked to apply this route to THIS empty
       // session, so update it in place instead of closing A and silently
       // materializing B before the first prompt.
-      updateEmptySessionInPlace(deps, session);
+      updateSessionInPlace(deps, session);
       invalidateContextStatusCache();
     }
     return getRoute();

package/src/session-runtime/model-route-api.mjs

@@ -12,7 +12,7 @@
  */
 import { createRoutePersistence } from './model-route/route-persist.mjs';
 import { createWebSearchRouteApi } from './model-route/web-search-route.mjs';
-import { createSetRoute } from './model-route/set-route.mjs';
+import { createSetRoute, createContinueSessionInModel } from './model-route/set-route.mjs';
 import { createRouteTuning } from './model-route/route-tuning.mjs';
 
 export { shouldRecreateEmptySessionForRouteChange } from '../runtime/agent/orchestrator/runtime-core/session-route-policy.mjs';
@@ -22,6 +22,7 @@ export function createModelRouteApi(deps) {
   return {
     ...createWebSearchRouteApi(deps),
     setRoute: createSetRoute(deps, persist),
+    continueSessionInModel: createContinueSessionInModel(deps, persist),
     ...createRouteTuning(deps, persist),
   };
 }

package/src/session-runtime/notification-bus.mjs

@@ -29,7 +29,13 @@ function cleanSessionId(value) {
 // the wake would leave its durable entry parked until the next user message.
 // A completion whose owner is no longer the live session is still dropped (the
 // durable queue carries it into that session's next turn).
-export function createCompletionWakeScheduler({ getCurrentSessionId, getTurnApi }) {
+export function createCompletionWakeScheduler({ getCurrentSessionId, getTurnApi, getOwnerLifecycle }) {
+  // A closing/terminal owner never starts inference from a completion; the
+  // check runs at request time and again inside the delayed callback.
+  const ownerOpen = (sessionId) => {
+    const life = getOwnerLifecycle?.(sessionId);
+    return !life || life.state === 'open';
+  };
   // sessionId -> the oldest request suppressed while this session's wake is in
   // flight, or null when nothing was suppressed. A present key means in flight.
   const inFlight = new Map();
@@ -41,6 +47,7 @@ export function createCompletionWakeScheduler({ getCurrentSessionId, getTurnApi
       try {
         const turnApi = getTurnApi();
         if (cleanSessionId(getCurrentSessionId()) !== ownerSessionId || !turnApi) return;
+        if (!ownerOpen(ownerSessionId)) return;
         const delayMs = Math.max(0, Date.now() - queuedAt);
         if (delayMs >= WAKE_DELAY_REPORT_MS) {
           process.stderr.write(
@@ -70,7 +77,7 @@ export function createCompletionWakeScheduler({ getCurrentSessionId, getTurnApi
 
   return function wakeQueuedCompletion({ sessionId, executionId, enqueuedAt } = {}) {
     const ownerSessionId = cleanSessionId(sessionId);
-    if (!ownerSessionId) return false;
+    if (!ownerSessionId || !ownerOpen(ownerSessionId)) return false;
     if (inFlight.has(ownerSessionId)) {
       const suppressed = inFlight.get(ownerSessionId);
       // Keep the oldest suppressed request so the replay reports the real wait.
@@ -99,10 +106,22 @@ function emitToListeners(source, content, meta = {}) {
   return { handled, modelVisibleDelivered: event.modelVisibleDelivered === true };
 }
 
-export function createNotificationBus({ listeners, mgr, onCompletionQueued }) {
+export function createNotificationBus({ listeners, mgr, onCompletionQueued, getOwnerLifecycle }) {
   const boundSessionListeners = new Map();
   const queuedCompletionIds = new Map();
 
+  // Owner identity + lifecycle generation. A closing/terminal owner (or a
+  // callback captured under an earlier generation) keeps its result for
+  // UI/history only: it is flagged `owner_closed`, never queued for the model
+  // and never wakes inference.
+  function ownerOpen(sessionId, capturedGeneration) {
+    const life = getOwnerLifecycle?.(sessionId);
+    if (!life) return true;
+    if (life.state !== 'open') return false;
+    return capturedGeneration === undefined || capturedGeneration === life.generation;
+  }
+  const closedMeta = (meta) => ({ ...(meta && typeof meta === 'object' ? meta : {}), owner_closed: true });
+
   function emitRuntimeNotification(content, meta = {}) {
     return emitToListeners(listeners, content, meta);
   }
@@ -111,8 +130,10 @@ export function createNotificationBus({ listeners, mgr, onCompletionQueued }) {
     const targetSessionId = cleanSessionId(sessionId);
     if (!targetSessionId) return false;
     const targetListeners = sessionNotificationListeners.get(targetSessionId) || [];
-    const { handled } = emitToListeners(targetListeners, content, meta);
+    const open = ownerOpen(targetSessionId);
+    const { handled } = emitToListeners(targetListeners, content, open ? meta : closedMeta(meta));
     if (handled) return true;
+    if (!open) return false;
     if (typeof mgr.enqueuePendingMessage !== 'function') return false;
     try {
       return mgr.enqueuePendingMessage(targetSessionId, content) > 0;
@@ -168,13 +189,15 @@ export function createNotificationBus({ listeners, mgr, onCompletionQueued }) {
     return true;
   }
 
-  function notifySessionCompletion(sessionId, text, meta = {}) {
+  function notifySessionCompletion(sessionId, text, meta = {}, capturedGeneration = undefined) {
     const targetSessionId = cleanSessionId(sessionId);
     if (!targetSessionId) return false;
     const targetListeners = sessionNotificationListeners.get(targetSessionId) || [];
+    const open = ownerOpen(targetSessionId, capturedGeneration);
     const ownerMeta = {
       ...(meta && typeof meta === 'object' ? meta : {}),
       caller_session_id: targetSessionId,
+      ...(open ? {} : { owner_closed: true }),
     };
     delete ownerMeta.routing_session_id;
     const { handled, modelVisibleDelivered } = emitToListeners(targetListeners, text, ownerMeta);
@@ -187,6 +210,7 @@ export function createNotificationBus({ listeners, mgr, onCompletionQueued }) {
       handled,
       mvd: modelVisibleDelivered,
     });
+    if (!open) return handled;
     if (modelVisibleDelivered) {
       try {
         recordDeliveredCompletion({
@@ -219,7 +243,8 @@ export function createNotificationBus({ listeners, mgr, onCompletionQueued }) {
 
   function notifyFnForSession(callerSessionId) {
     const ownerSessionId = cleanSessionId(callerSessionId);
-    return (text, meta = {}) => notifySessionCompletion(ownerSessionId, text, meta);
+    const generation = getOwnerLifecycle?.(ownerSessionId)?.generation;
+    return (text, meta = {}) => notifySessionCompletion(ownerSessionId, text, meta, generation);
   }
 
   function bindListenerToSession(sessionId, listener) {

package/src/session-runtime/provider-auth/login.mjs

@@ -10,6 +10,7 @@ import {
   saveProviderApiKey,
   saveCustomProvider,
   removeCustomProvider,
+  updateCustomProviderModel,
   testCustomProvider,
   discoverCustomProviderModels,
 } from '../services/provider-admin.mjs';
@@ -41,7 +42,7 @@ export function createLoginApi({ cfgMod, awaitKeychainPrewarm, reloadFullConfig,
     async authenticateProvider(providerId, secret) {
       await awaitKeychainPrewarm();
       const result = String(secret || '').trim()
-        ? saveProviderApiKey(cfgMod, providerId, secret)
+        ? await saveProviderApiKey(cfgMod, providerId, secret)
         : await loginOAuthProvider(cfgMod, providerId);
       refresh.afterCredentialChange();
       return result;
@@ -58,18 +59,18 @@ export function createLoginApi({ cfgMod, awaitKeychainPrewarm, reloadFullConfig,
       reloadFullConfig();
       return completeOAuthLogin(result);
     },
-    saveProviderApiKey(providerId, secret) {
-      const result = saveProviderApiKey(cfgMod, providerId, secret);
+    async saveProviderApiKey(providerId, secret) {
+      const result = await saveProviderApiKey(cfgMod, providerId, secret);
       refresh.afterCredentialChange();
       return result;
     },
-    saveOpenAIUsageSessionKey(secret) {
-      const result = saveOpenAIUsageSessionKey(cfgMod, secret);
+    async saveOpenAIUsageSessionKey(secret) {
+      const result = await saveOpenAIUsageSessionKey(cfgMod, secret);
       refresh.afterUsageAuthChange();
       return result;
     },
-    saveOpenCodeGoUsageAuth(opts) {
-      const result = saveOpenCodeGoUsageAuth(cfgMod, opts);
+    async saveOpenCodeGoUsageAuth(opts) {
+      const result = await saveOpenCodeGoUsageAuth(cfgMod, opts);
       refresh.afterUsageAuthChange();
       return result;
     },
@@ -79,9 +80,14 @@ export function createLoginApi({ cfgMod, awaitKeychainPrewarm, reloadFullConfig,
       refresh.afterCredentialChange();
       return result;
     },
+    async updateCustomProviderModel(providerId, modelId, patch) {
+      const result = await updateCustomProviderModel(cfgMod, providerId, modelId, patch);
+      refresh.afterCredentialChange();
+      return result;
+    },
     async removeCustomProvider(providerId) {
       await awaitKeychainPrewarm();
-      const result = removeCustomProvider(cfgMod, providerId);
+      const result = await removeCustomProvider(cfgMod, providerId);
       onCustomProviderRemoved?.(result.provider);
       refresh.afterCredentialChange();
       return result;
@@ -94,8 +100,8 @@ export function createLoginApi({ cfgMod, awaitKeychainPrewarm, reloadFullConfig,
       await awaitKeychainPrewarm();
       return await discoverCustomProviderModels(cfgMod, input);
     },
-    forgetProviderAuth(providerId, accountId) {
-      const result = forgetProviderAuth(cfgMod, providerId, accountId);
+    async forgetProviderAuth(providerId, accountId) {
+      const result = await forgetProviderAuth(cfgMod, providerId, accountId);
       refresh.afterCredentialChange();
       return result;
     },

package/src/session-runtime/provider-auth/setup.mjs

@@ -1,6 +1,18 @@
 // provider-auth/setup.mjs — read-side provider surfaces: the setup snapshot
 // (quick until the keychain is ready), usage dashboard, Codex reset credit and
 // the model catalog.
+import { refreshKeychainStatus, retryKeychain } from '../../runtime/shared/config.mjs';
+import { keychainIssueFor } from '../services/provider-admin.mjs';
+
+// The keyring alert must reflect the live state (it can lock or unlock while a
+// cached setup is served), so overlay it on every ready read.
+function withLiveKeychain(setup) {
+  if (!setup || typeof setup !== 'object') return setup;
+  const { keychain: _stale, ...rest } = setup;
+  const keychain = keychainIssueFor(true);
+  return keychain ? { ...rest, keychain } : rest;
+}
+
 export function createSetupApi({
   awaitKeychainPrewarm,
   isKeychainPrewarmReady,
@@ -28,8 +40,16 @@ export function createSetupApi({
         return { ...quick, pendingSecrets: !isKeychainPrewarmReady() };
       }
       await awaitKeychainPrewarm();
-      if (force) reloadFullConfig();
-      return await cachedProviderSetup({ force });
+      // A keyring the user has since unlocked: rebuild the setup that was cached
+      // while every stored key read as absent.
+      const recovered = await retryKeychain({ interactive: options?.unlockKeychain === true });
+      if (force || recovered) reloadFullConfig();
+      // Passive: detects a re-locked keyring and re-snapshots a stale cache so
+      // external (CLI / other process) changes show up.
+      // `recheckKeychain` (window focus) skips the snapshot TTL.
+      const changed = await refreshKeychainStatus({ force: options?.recheckKeychain === true });
+      if (changed) reloadFullConfig();
+      return withLiveKeychain(await cachedProviderSetup({ force: force || recovered || changed }));
     },
     async getUsageDashboard(options = {}) {
       return await getUsageDashboard(options);