mixdog 1.0.9 → 1.0.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "private": false,
   "type": "module",
   "description": "Open-source coding agent that matches Codex on Terminal-Bench 2.1 with 63% fewer tokens.",

package/src/runtime/agent/orchestrator/config-providers-merge.mjs

@@ -49,6 +49,14 @@ export function mergeStoredProviders({ raw, defaults, includeSecrets }) {
       }
     }
   }
+  // Custom providers: the keychain account is the generated custom-<uuid> id.
+  if (includeSecrets) {
+    for (const [name, val] of Object.entries(mergedProviders)) {
+      if (val?.type !== 'custom' || !name.startsWith('custom-')) continue;
+      const kc = getAgentApiKey(name);
+      if (kc) mergedProviders[name] = { ...val, apiKey: kc, enabled: raw.providers?.[name]?.enabled !== false };
+    }
+  }
   // Cursor account access is OAuth-only. The dashboard's "API"
   // meter is a quota bucket on that account, not a separate provider.
   delete mergedProviders['cursor-api'];

package/src/runtime/agent/orchestrator/providers/custom-provider.mjs

@@ -0,0 +1,163 @@
+// User-defined ("custom") providers. A custom provider is stored as a
+// secret-free config entry keyed by a generated `custom-<uuid>` id; the API key
+// lives in the keychain under that same id and is injected at load time. The
+// runtime reuses the existing OpenAI-compat / Anthropic engines, constructed
+// under the custom id so model routes and provider identity stay `custom-…`.
+
+import { ANTHROPIC_VERSION } from './lib/anthropic-models.mjs';
+import { assertSafeBaseURL } from './provider-base-url.mjs';
+import { listCompatModels } from './openai-compat-models.mjs';
+
+export const CUSTOM_PROVIDER_PROTOCOLS = Object.freeze(['openai-chat', 'openai-responses', 'anthropic']);
+
+function fail(message) {
+  throw new Error(`[custom-provider] ${message}`);
+}
+
+function text(value) {
+  return typeof value === 'string' ? value.trim() : '';
+}
+
+function positiveInt(value, label) {
+  if (value === undefined || value === null || value === '') return undefined;
+  const n = Number(value);
+  if (!Number.isInteger(n) || n <= 0) fail(`${label} must be a positive integer`);
+  return n;
+}
+
+function normalizeBaseURL(raw) {
+  const value = text(raw);
+  if (!value) fail('baseURL is required');
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    fail(`invalid baseURL: ${value}`);
+  }
+  if (url.protocol !== 'https:' && url.protocol !== 'http:') fail('baseURL must use http or https');
+  if (url.username || url.password) fail('baseURL must not embed credentials');
+  if (url.search || url.hash || /[?#]/.test(value)) fail('baseURL must not contain a query or hash');
+  return assertSafeBaseURL(value.replace(/\/+$/, ''), 'custom');
+}
+
+function normalizeModels(raw, requireModels) {
+  if (raw === undefined || raw === null) raw = [];
+  if (!Array.isArray(raw)) fail('models must be an array');
+  const seen = new Set();
+  const models = raw.map((entry) => {
+    const id = text(entry?.id);
+    if (!id) fail('every model needs an id');
+    if (seen.has(id)) fail(`duplicate model id: ${id}`);
+    seen.add(id);
+    const name = text(entry.name);
+    const contextWindow = positiveInt(entry.contextWindow, `model ${id} contextWindow`);
+    const maxOutputTokens = positiveInt(entry.maxOutputTokens, `model ${id} maxOutputTokens`);
+    return {
+      id,
+      ...(name ? { name } : {}),
+      ...(contextWindow ? { contextWindow } : {}),
+      ...(maxOutputTokens ? { maxOutputTokens } : {}),
+    };
+  });
+  if (requireModels && models.length === 0) fail('at least one model is required');
+  return models;
+}
+
+export function normalizeCustomProviderConfig(input, { requireModels = true } = {}) {
+  if (!input || typeof input !== 'object') fail('config must be an object');
+  const name = text(input.name);
+  if (!name) fail('name is required');
+  const protocol = text(input.protocol);
+  if (!protocol) fail('protocol is required');
+  if (!CUSTOM_PROVIDER_PROTOCOLS.includes(protocol)) fail(`unsupported protocol: ${protocol}`);
+  return {
+    type: 'custom',
+    name,
+    protocol,
+    baseURL: normalizeBaseURL(input.baseURL),
+    models: normalizeModels(input.models, requireModels),
+    enabled: true,
+  };
+}
+
+function modelRow(id, m) {
+  return {
+    id: m.id,
+    name: m.name || m.id,
+    provider: id,
+    contextWindow: m.contextWindow || 0,
+    outputTokens: m.maxOutputTokens || null,
+  };
+}
+
+// Configured models win; an empty list falls back to protocol discovery.
+function withConfiguredModels(Base, discover) {
+  return class extends Base {
+    _customModels = [];
+    async listModels() {
+      if (!this._customModels.length) return discover(this);
+      if ('_enrichedModels' in this) this._enrichedModels = this._customModels;
+      return this._customModels.map((m) => ({ ...m }));
+    }
+    async isAvailable() {
+      return this._customModels.length ? true : super.isAvailable();
+    }
+    getCachedModelInfo(model) {
+      return this._customModels.find((m) => m.id === model) || super.getCachedModelInfo?.(model) || null;
+    }
+  };
+}
+
+async function discoverAnthropicModels(provider) {
+  const res = await fetch(`${provider.config.baseURL}/v1/models`, {
+    method: 'GET',
+    signal: AbortSignal.timeout(10_000),
+    headers: { 'x-api-key': provider.apiKey || '', 'anthropic-version': ANTHROPIC_VERSION },
+  });
+  if (!res.ok) throw new Error(`${provider.name} models ${res.status}`);
+  const data = await res.json();
+  const items = Array.isArray(data?.data) ? data.data : [];
+  return items
+    .filter((m) => m?.id)
+    .map((m) => ({
+      id: m.id,
+      name: m.display_name || m.id,
+      provider: provider.name,
+      contextWindow: Number(m.max_input_tokens) > 0 ? Number(m.max_input_tokens) : 0,
+      outputTokens: Number(m.max_tokens) > 0 ? Number(m.max_tokens) : null,
+    }));
+}
+
+export async function createCustomProvider(id, config) {
+  const providerId = text(id);
+  if (!/^custom-.+/.test(providerId)) fail(`invalid custom provider id: ${id}`);
+  const cfg = normalizeCustomProviderConfig(config, { requireModels: false });
+  const engine = {
+    baseURL: cfg.baseURL,
+    apiKey: config.apiKey || undefined,
+    ...(config.preconnect === false ? { preconnect: false } : {}),
+  };
+  let provider;
+  if (cfg.protocol === 'anthropic') {
+    const { AnthropicProvider } = await import('./anthropic.mjs');
+    const Custom = withConfiguredModels(AnthropicProvider, discoverAnthropicModels);
+    // The Anthropic SDK appends /v1/messages itself; accept a /v1 base URL.
+    provider = new Custom({ ...engine, name: providerId, baseURL: cfg.baseURL.replace(/\/v1$/i, '') });
+  } else {
+    const { OpenAICompatProvider } = await import('./openai-compat.mjs');
+    const Base =
+      cfg.protocol === 'openai-responses'
+        ? class extends OpenAICompatProvider {
+            _doSend(messages, model, tools, sendOpts) {
+              return super._doSend(messages, model, tools, { ...(sendOpts || {}), compatWireApi: 'responses' });
+            }
+          }
+        : OpenAICompatProvider;
+    const Custom = withConfiguredModels(Base, (self) => listCompatModels(self, { throwOnError: true }));
+    provider = new Custom(providerId, engine);
+    if (cfg.models.length) provider.defaultModel = cfg.models[0].id;
+  }
+  provider._customModels = cfg.models.map((m) => modelRow(providerId, m));
+  provider.customConfig = cfg;
+  return provider;
+}

package/src/runtime/agent/orchestrator/providers/model-list-sanitize.mjs

@@ -11,6 +11,7 @@
 // a filtered + deduped subset of the SAME row objects (never mutated).
 
 import { getModelsDevProviderModelsSync, getModelsDevRowSync } from './model-catalog.mjs';
+import { isRollingModelAlias } from '../../../shared/model-alias.mjs';
 
 // Id-level fallback for coding-unfit SKUs when the catalog row is missing.
 // search-preview (grounded-search) and audio/realtime preview SKUs are
@@ -213,6 +214,14 @@ function _stalenessFamily(row, id) {
   return family || null;
 }
 
+// Explicit preview/experimental markers in the id. A stable
+// model is not superseded by these; the catalog carries no structured status.
+const PREVIEW_VARIANT_RE = /(^|[-_.:/\s])(preview|exp|experimental)([-_.:/\s]|$)/i;
+
+function _isPreviewVariant(id) {
+  return PREVIEW_VARIANT_RE.test(String(id || ''));
+}
+
 function _staleMonths() {
   const raw = process.env.MIXDOG_MODEL_STALE_MONTHS;
   if (raw == null || raw === '') return 9;
@@ -246,19 +255,28 @@ function _applyAutoStaleness(kept, provider, testCatalog) {
   // ANY model (kept or not) in the same family with a strictly newer date.
   // Compute the newest release_date per family from the FULL catalog so a
   // superseding model that isn't in this list still counts.
+  // Rolling aliases never count. Preview/experimental entries count only
+  // against other preview/experimental rows, never against a stable one.
   const familyNewest = new Map();
+  const familyNewestStable = new Map();
+  const bump = (map, fam, ep) => {
+    const prev = map.get(fam);
+    if (prev == null || ep > prev) map.set(fam, ep);
+  };
   for (const [id, cr] of Object.entries(catModels)) {
     const fam = _stalenessFamily(cr, id);
     const ep = _releaseEpoch(cr);
-    if (!fam || ep == null) continue;
-    const prev = familyNewest.get(fam);
-    if (prev == null || ep > prev) familyNewest.set(fam, ep);
+    if (!fam || ep == null || isRollingModelAlias(id)) continue;
+    bump(familyNewest, fam, ep);
+    if (!_isPreviewVariant(id)) bump(familyNewestStable, fam, ep);
   }
 
   const dropped = new Set();
   for (const m of meta) {
     if (!m.cat || m.family == null || m.epoch == null) continue; // fallback: keep
-    const newest = familyNewest.get(m.family);
+    if (isRollingModelAlias(m.row.id)) continue;
+    const newestByFamily = _isPreviewVariant(m.row.id) ? familyNewest : familyNewestStable;
+    const newest = newestByFamily.get(m.family);
     if (newest != null && newest > m.epoch) dropped.add(m.row);
   }
   // Never empty a family the user relies on: if supersession removed every
@@ -286,6 +304,7 @@ function _applyAutoStaleness(kept, provider, testCatalog) {
     for (const m of meta) {
       if (dropped.has(m.row)) continue;
       if (!m.cat || m.epoch == null) continue; // fallback: keep
+      if (isRollingModelAlias(m.row.id)) continue;
       if (m.epoch < cutoff) cutDropped.add(m.row);
     }
     // If applying the absolute cut would empty the entire provider list, skip

package/src/runtime/agent/orchestrator/providers/openai-compat-models.mjs

@@ -28,7 +28,7 @@ export async function fetchCompatModelItems(provider) {
   }
 }
 
-export async function listCompatModels(provider) {
+export async function listCompatModels(provider, { throwOnError = false } = {}) {
   try {
     const list = await provider._fetchModelItems();
     const models = [];
@@ -56,7 +56,8 @@ export async function listCompatModels(provider) {
     const enriched = sanitizeModelList(await enrichModels(filtered), { provider: provider.name });
     provider._enrichedModels = enriched;
     return enriched;
-  } catch {
+  } catch (error) {
+    if (throwOnError) throw error;
     return [];
   }
 }

package/src/runtime/agent/orchestrator/providers/openai-compat.mjs

@@ -4,6 +4,7 @@ import { getLlmDispatcher, preconnect } from '../../../shared/llm/http-agent.mjs
 import { _combineUsageWithWarmup } from './openai-ws-events.mjs';
 import { appendAgentTrace } from '../agent-trace.mjs';
 import { OPENAI_COMPAT_PRESETS } from './openai-compat-presets.mjs';
+import { assertSafeBaseURL } from './provider-base-url.mjs';
 import { resolveResponsesTransportPolicy, RESPONSES_TRANSPORT_CAPABILITIES } from './openai-transport-policy.mjs';
 import { toResponsesTools, toXaiResponsesInput } from './openai-compat-wire.mjs';
 import {
@@ -74,34 +75,6 @@ export { compatReportedCostUsd } from './openai-compat-response-normalization.mj
 
 const PRESETS = OPENAI_COMPAT_PRESETS;
 
-// SSRF guard for provider baseURL. config.baseURL comes from user JSON;
-// reject non-http(s) schemes (file:/data:/ftp:/etc.) and require https for
-// any non-localhost host. The managed Local Provider and other loopback hosts
-// may use http. Throws a clear config error — no silent
-// fallback — so misconfig surfaces immediately instead of leaking apiKey.
-function assertSafeBaseURL(rawURL, providerName) {
-  let parsed;
-  try {
-    parsed = new URL(String(rawURL));
-  } catch {
-    throw new Error(`[provider:${providerName}] invalid baseURL: ${rawURL}`);
-  }
-  const scheme = parsed.protocol.toLowerCase();
-  if (scheme !== 'https:' && scheme !== 'http:') {
-    throw new Error(`[provider:${providerName}] baseURL scheme not allowed: ${parsed.protocol} (only http/https)`);
-  }
-  if (scheme === 'http:') {
-    const host = parsed.hostname.toLowerCase();
-    const isLocal = host === 'localhost' || host === '127.0.0.1' || host === '::1';
-    if (!isLocal) {
-      throw new Error(
-        `[provider:${providerName}] baseURL must use https for non-localhost host (got ${parsed.protocol}//${parsed.hostname})`
-      );
-    }
-  }
-  return rawURL;
-}
-
 export class OpenAICompatProvider {
   // Chat Completions prompt_tokens is already the total (includes cached).
   // Covers grok-oauth and all OPENAI_COMPAT_PRESETS. See registry.mjs.

package/src/runtime/agent/orchestrator/providers/provider-base-url.mjs

@@ -0,0 +1,24 @@
+// Keep saved custom endpoints and OpenAI-compatible clients under the same
+// transport policy: credentials may travel over HTTP only on loopback.
+export function assertSafeBaseURL(rawURL, providerName) {
+  let parsed;
+  try {
+    parsed = new URL(String(rawURL));
+  } catch {
+    throw new Error(`[provider:${providerName}] invalid baseURL`);
+  }
+  const scheme = parsed.protocol.toLowerCase();
+  if (scheme !== 'https:' && scheme !== 'http:') {
+    throw new Error(`[provider:${providerName}] baseURL scheme not allowed: ${parsed.protocol} (only http/https)`);
+  }
+  if (scheme === 'http:') {
+    const host = parsed.hostname.toLowerCase();
+    const isLocal = host === 'localhost' || host === '127.0.0.1' || host === '[::1]';
+    if (!isLocal) {
+      throw new Error(
+        `[provider:${providerName}] baseURL must use https for non-localhost host (got ${parsed.protocol}//${parsed.hostname})`
+      );
+    }
+  }
+  return rawURL;
+}

package/src/runtime/agent/orchestrator/providers/registry.mjs

@@ -150,7 +150,16 @@ const PROVIDER_MODULES = {
   'opencode-go': ['./opencode-go.mjs', 'OpenCodeGoProvider'],
 };
 
-async function loadProviderCtor(name, signal = null) {
+// User-defined providers (cfg.type === 'custom') are keyed by a generated
+// `custom-<uuid>` id and never collide with the built-in names.
+function isCustomProviderConfig(name, cfg) {
+  return cfg?.type === 'custom' && String(name).startsWith('custom-');
+}
+
+async function loadProviderCtor(name, signal = null, cfg = null) {
+  if (isCustomProviderConfig(name, cfg)) {
+    return loadProviderExport('custom-provider', './custom-provider.mjs', 'createCustomProvider', signal);
+  }
   if (Object.hasOwn(PROVIDER_MODULES, name)) {
     const [spec, exportName] = PROVIDER_MODULES[name];
     return loadProviderExport(name, spec, exportName, signal);
@@ -161,7 +170,8 @@ async function loadProviderCtor(name, signal = null) {
   throw new Error(`unknown enabled provider: ${name}`);
 }
 
-function instantiateProvider(name, Ctor, cfg) {
+async function instantiateProvider(name, Ctor, cfg) {
+  if (isCustomProviderConfig(name, cfg)) return wrapProviderAdmission(await Ctor(name, cfg), name);
   if (Object.hasOwn(OPENAI_COMPAT_PRESETS, name) && name !== 'opencode-go') {
     return wrapProviderAdmission(new Ctor(name, cfg), name);
   }
@@ -239,9 +249,9 @@ async function _initProvidersUnsynchronized(config, signal = null) {
         return { name, inst: providers.get(name), sig };
       }
       try {
-        const Ctor = await loadProviderCtor(name, signal);
+        const Ctor = await loadProviderCtor(name, signal, cfg);
         throwIfAborted(signal);
-        const inst = instantiateProvider(name, Ctor, cfg);
+        const inst = await instantiateProvider(name, Ctor, cfg);
         return { name, inst, sig };
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);

package/src/runtime/agent/orchestrator/runtime-core/config-helpers.mjs

@@ -14,7 +14,7 @@ export function makeResolveDefaultProvider(isKnownProvider) {
   return function resolveDefaultProvider(config) {
     const selectedMain = findPreset(config, config?.default);
     const configured = clean(selectedMain?.provider);
-    if (configured && isKnownProvider(configured)) return configured;
+    if (configured && isKnownProvider(configured, config)) return configured;
     return DEFAULT_PROVIDER;
   };
 }
@@ -124,7 +124,8 @@ export function isLikelyRawModelId(value) {
   const model = clean(value);
   if (!model || model.length > 160) return false;
   if (/\s/.test(model)) return false;
-  return /^[A-Za-z0-9][A-Za-z0-9._:/@+-]*$/.test(model);
+  // OpenRouter's rolling model aliases start with a literal "~".
+  return /^~?[A-Za-z0-9][A-Za-z0-9._:/@+-]*$/.test(model);
 }
 
 export function validateRequestedModelSelector(config, requested = {}) {

package/src/runtime/agent/orchestrator/tools/patch/native-server.mjs

@@ -439,6 +439,8 @@ class NativePatchServer {
 
   #contractPromise = null;
 
+  #contractPending = false;
+
   constructor(binPath) {
     this.binPath = binPath;
     // windowsHide: mixdog-patch.exe is a console binary; without this each spawn
@@ -544,15 +546,23 @@ class NativePatchServer {
   // the caller may respawn and retry without any risk of double-applying.
   // Contract handshake on THIS session, memoized per instance: N concurrent
   // callers await one exchange, and a respawned session proves itself again.
+  /** True while the handshake runs: between its exchanges no waiter is queued, yet the handles must stay referenced. */
+  get contractPending() {
+    return this.#contractPending;
+  }
+
   contract() {
     if (!this.#contractPromise) {
+      this.#contractPending = true;
       this.#contractPromise = verifyContractOverSession(this.#handshakeView()).then(
         (ok) => {
+          this.#contractPending = false;
           this.#contractVerified = ok === true;
           if (!ok) this.markContractFailed();
           return ok;
         },
         () => {
+          this.#contractPending = false;
           this.#contractVerified = false;
           this.markContractFailed();
           return false;
@@ -884,7 +894,11 @@ export function scheduleNativePatchPrewarm() {
           }
         }
         await getNativePatchServer().ping();
-        if (!nativePatchPersistent() && (_nativePatchServer?.waiters?.length || 0) === 0) {
+        if (
+          !nativePatchPersistent() &&
+          (_nativePatchServer?.waiters?.length || 0) === 0 &&
+          !_nativePatchServer?.contractPending
+        ) {
           _nativePatchServer?.unref();
         }
         if (nativePatchTraceEnabled()) {

package/src/runtime/shared/model-alias.mjs

@@ -0,0 +1,5 @@
+// Rolling aliases name the current model, not the version released on the
+// alias's creation date. Shared by catalog filtering and browser/TUI pickers.
+export function isRollingModelAlias(id) {
+  return /-latest$/i.test(String(id || '').trim());
+}

package/src/session-runtime/boot/apis.mjs

@@ -273,6 +273,12 @@ function providerAuthApiFor(boot) {
     getUsageDashboard: boot.getUsageDashboard,
     consumeCodexRateLimitResetCredit: boot.consumeCodexRateLimitResetCredit,
     collectProviderModels: boot.collectProviderModels,
+    // A deleted custom provider must not stay reachable through the live route
+    // or the registry; stored routes naming it are filtered by the picker.
+    onCustomProviderRemoved: (id) => {
+      reg.disableProvider?.(id);
+      if (rt.route?.provider === id) rt.route = { ...rt.route, provider: '', model: '', preset: null };
+    },
   });
 }
 

package/src/session-runtime/provider-auth/login.mjs

@@ -8,9 +8,13 @@ import {
   saveOpenAIUsageSessionKey,
   saveOpenCodeGoUsageAuth,
   saveProviderApiKey,
+  saveCustomProvider,
+  removeCustomProvider,
+  testCustomProvider,
+  discoverCustomProviderModels,
 } from '../services/provider-admin.mjs';
 
-export function createLoginApi({ cfgMod, awaitKeychainPrewarm, reloadFullConfig }, refresh) {
+export function createLoginApi({ cfgMod, awaitKeychainPrewarm, reloadFullConfig, onCustomProviderRemoved }, refresh) {
   async function completeOAuthLogin(login) {
     return {
       ...login,
@@ -69,6 +73,27 @@ export function createLoginApi({ cfgMod, awaitKeychainPrewarm, reloadFullConfig
       refresh.afterUsageAuthChange();
       return result;
     },
+    async saveCustomProvider(input) {
+      await awaitKeychainPrewarm();
+      const result = await saveCustomProvider(cfgMod, input);
+      refresh.afterCredentialChange();
+      return result;
+    },
+    async removeCustomProvider(providerId) {
+      await awaitKeychainPrewarm();
+      const result = removeCustomProvider(cfgMod, providerId);
+      onCustomProviderRemoved?.(result.provider);
+      refresh.afterCredentialChange();
+      return result;
+    },
+    async testCustomProvider(input) {
+      await awaitKeychainPrewarm();
+      return await testCustomProvider(cfgMod, input);
+    },
+    async discoverCustomProviderModels(input) {
+      await awaitKeychainPrewarm();
+      return await discoverCustomProviderModels(cfgMod, input);
+    },
     forgetProviderAuth(providerId, accountId) {
       const result = forgetProviderAuth(cfgMod, providerId, accountId);
       refresh.afterCredentialChange();

package/src/session-runtime/quick-model-rows/provider-rows.mjs

@@ -46,7 +46,7 @@ export function createQuickProviderRows({
     const addRoute = (routeLike = {}) => {
       const provider = clean(routeLike.provider);
       const model = clean(routeLike.model);
-      if (!provider || !model) return;
+      if (!provider || !model || isDeletedCustom(provider)) return;
       const meta = metadataFor(provider, model);
       addModel(provider, {
         id: model,
@@ -64,8 +64,23 @@ export function createQuickProviderRows({
       });
     };
 
-    for (const [provider, providerConfig] of Object.entries(pickerConfig.providers || {})) {
+    // A custom-* id with no live custom config entry was deleted: stale
+    // routes must not bring it back into the picker.
+    const customProviders = pickerConfig.providers || {};
+    const isDeletedCustom = (provider) =>
+      provider.startsWith('custom-') &&
+      !(customProviders[provider]?.type === 'custom' && customProviders[provider].enabled !== false);
+    for (const [provider, providerConfig] of Object.entries(customProviders)) {
       if (!providerConfig?.enabled) continue;
+      if (providerConfig.type === 'custom') {
+        // Configured models are listed at once, before any catalog refresh.
+        for (const model of providerConfig.models || []) {
+          addModel(provider, {
+            ...model,
+            outputTokens: model.maxOutputTokens || null,
+          });
+        }
+      }
       for (const model of providerCachedModelsSync(provider)) addModel(provider, model);
     }
     addRoute(route);

package/src/session-runtime/services/provider-admin.mjs

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto';
 import {
   AGENT_PROVIDER_ENV,
   SECRET_ACCOUNTS,
@@ -156,9 +157,14 @@ function availableOAuthProvider(id) {
   return oauth && isOAuthProviderAvailable(id) ? oauth : null;
 }
 
-export function isKnownProvider(provider) {
+export function isKnownProvider(provider, config = {}) {
   const id = String(provider || '').trim();
-  return id !== '' && (API_PROVIDER_IDS.has(id) || BUILTIN_PROVIDER_IDS.has(id) || !!availableOAuthProvider(id));
+  return id !== '' && (
+    API_PROVIDER_IDS.has(id) ||
+    BUILTIN_PROVIDER_IDS.has(id) ||
+    !!availableOAuthProvider(id) ||
+    (isCustomProviderId(id) && isCustomProviderConfig(config.providers?.[id]) && config.providers[id].enabled !== false)
+  );
 }
 
 function updateConfigProvider(cfgMod, providerId, patch) {
@@ -275,11 +281,57 @@ function oauthProviderSetup(p, providers, checkSecrets) {
   };
 }
 
+const CUSTOM_ID_RE = /^custom-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const CUSTOM_TEST_TIMEOUT_MS = 20_000;
+const CUSTOM_DISCOVERY_TIMEOUT_MS = 15_000;
+
+export function isCustomProviderConfig(entry) {
+  return Boolean(entry) && typeof entry === 'object' && entry.type === 'custom';
+}
+
+export function isCustomProviderId(id) {
+  return CUSTOM_ID_RE.test(String(id || ''));
+}
+
+const loadCustomProviderModule = () => import('../../runtime/agent/orchestrator/providers/custom-provider.mjs');
+
+// Secret-free public view of a custom provider. Never carries an API key.
+function customProviderRow(id, entry, checkSecrets = true) {
+  const configuredEnabled = entry.enabled !== false;
+  const stored = checkSecrets ? hasStoredSecret(SECRET_ACCOUNTS.agentApiKey(id)) : false;
+  return {
+    id,
+    name: entry.name,
+    protocol: entry.protocol,
+    baseURL: entry.baseURL,
+    models: Array.isArray(entry.models) ? entry.models.map((m) => ({ ...m })) : [],
+    custom: true,
+    group: 'api',
+    type: 'api-key',
+    enabled: configuredEnabled,
+    authenticated: checkSecrets ? stored : configuredEnabled,
+    stored,
+    env: false,
+    envName: null,
+    status: stored ? 'Set' : configuredEnabled ? 'No Key' : 'Off',
+    detail: stored ? 'stored in keychain' : 'custom endpoint',
+  };
+}
+
+function customProviderRows(providers, checkSecrets) {
+  return Object.entries(providers)
+    .filter(([id, entry]) => isCustomProviderId(id) && isCustomProviderConfig(entry))
+    .map(([id, entry]) => customProviderRow(id, entry, checkSecrets));
+}
+
 export async function providerSetup(config = {}, options = {}) {
   const providers = config.providers || {};
   const checkSecrets = options?.checkSecrets !== false;
   return {
-    api: API_PROVIDERS.map((p) => apiProviderSetup(p, providers, checkSecrets)),
+    api: [
+      ...API_PROVIDERS.map((p) => apiProviderSetup(p, providers, checkSecrets)),
+      ...customProviderRows(providers, checkSecrets),
+    ],
     oauth: availableOAuthProviders().map((p) => oauthProviderSetup(p, providers, checkSecrets)),
     local: [builtInLocalProviderSetup(config, options)],
   };
@@ -322,6 +374,16 @@ function oauthProviderStatusRow(p, config) {
 export function providerStatus(config = {}) {
   return [
     ...API_PROVIDERS.map((p) => apiProviderStatusRow(p, config)),
+    ...customProviderRows(config.providers || {}, true).map((row) => ({
+      id: row.id,
+      type: 'api-key',
+      enabled: row.enabled,
+      authenticated: row.authenticated,
+      stored: row.stored,
+      env: false,
+      envName: null,
+      label: row.name,
+    })),
     ...availableOAuthProviders().map((p) => oauthProviderStatusRow(p, config)),
   ];
 }
@@ -525,6 +587,142 @@ export function saveProviderApiKey(cfgMod, provider, secret) {
   return { provider: id, type: 'api-key', authenticated: true };
 }
 
+function sanitizeCustomError(error, secrets = []) {
+  let text = String(error?.message || error || 'request failed');
+  for (const secret of secrets) if (secret) text = text.split(secret).join('[redacted]');
+  text = text
+    .replace(/Bearer\s+[A-Za-z0-9._~+/=-]+/gi, 'Bearer [redacted]')
+    .replace(/\b(?:sk|key|tok)[-_][A-Za-z0-9_-]{8,}/gi, '[redacted]')
+    .replace(/(api[-_]?key|authorization|token)(["']?\s*[:=]\s*["']?)[^\s"',}]+/gi, '$1$2[redacted]')
+    .replace(/[\r\n]+/g, ' ')
+    .trim();
+  if (text.length > 300) text = `${text.slice(0, 300)}…`;
+  return new Error(text || 'request failed');
+}
+
+async function withTimeout(run, ms, label) {
+  const controller = new AbortController();
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      reject(new Error(`${label} timed out after ${Math.round(ms / 1000)}s`));
+    }, ms);
+  });
+  try {
+    return await Promise.race([run(controller.signal), timeout]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function existingCustomEntry(cfgMod, id) {
+  const entry = cfgMod.loadConfig().providers?.[id];
+  if (!isCustomProviderId(id) || !isCustomProviderConfig(entry)) throw new Error(`unknown custom provider "${id}"`);
+  return entry;
+}
+
+function inputObject(input) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new TypeError('custom provider is invalid');
+  return input;
+}
+
+// Validated, secret-free config for `input`; the key (typed, else stored for an
+// existing provider) is resolved separately and never enters the config.
+async function resolveCustomInput(cfgMod, rawInput, options) {
+  const input = inputObject(rawInput);
+  const id = input.id === undefined || input.id === null || input.id === '' ? null : String(input.id);
+  if (id) existingCustomEntry(cfgMod, id);
+  const { normalizeCustomProviderConfig } = await loadCustomProviderModule();
+  const config = normalizeCustomProviderConfig(input, options);
+  const typed = typeof input.apiKey === 'string' ? input.apiKey.trim() : '';
+  const apiKey = typed || (id ? getAgentApiKey(id) || '' : '');
+  return { id, config, typed, apiKey };
+}
+
+export async function saveCustomProvider(cfgMod, rawInput) {
+  const { id: existingId, config, typed, apiKey } = await resolveCustomInput(cfgMod, rawInput, { requireModels: false });
+  if (!apiKey) throw new Error('API key is required');
+  const id = existingId || `custom-${randomUUID()}`;
+  const entry = {
+    type: 'custom',
+    name: config.name,
+    protocol: config.protocol,
+    baseURL: config.baseURL,
+    models: config.models,
+    enabled: true,
+  };
+  const account = SECRET_ACCOUNTS.agentApiKey(id);
+  const previousKey = typed && existingId ? getAgentApiKey(id) : null;
+  if (typed) saveSecret(account, typed);
+  try {
+    const current = cfgMod.loadConfig();
+    cfgMod.saveConfig({ ...current, providers: { ...(current.providers || {}), [id]: entry } }, { baseConfig: current });
+  } catch (error) {
+    if (typed) {
+      if (previousKey) saveSecret(account, previousKey);
+      else deleteSecret(account);
+    }
+    throw error;
+  }
+  return customProviderRow(id, entry);
+}
+
+export function removeCustomProvider(cfgMod, rawId) {
+  const id = String(rawId || '').trim();
+  existingCustomEntry(cfgMod, id);
+  const current = cfgMod.loadConfig();
+  const { [id]: _removed, ...providers } = current.providers || {};
+  cfgMod.saveConfig({ ...current, providers }, { baseConfig: current });
+  deleteSecret(SECRET_ACCOUNTS.agentApiKey(id));
+  return { provider: id, type: 'custom', removed: true };
+}
+
+export async function testCustomProvider(cfgMod, rawInput) {
+  const { id, config, apiKey } = await resolveCustomInput(cfgMod, rawInput, { requireModels: false });
+  try {
+    const models = config.models.length ? config.models : (await discoverCustomProviderModels(cfgMod, rawInput)).models;
+    const model = models[0]?.id;
+    if (!model) throw new Error('No models were found for this provider');
+    const { createCustomProvider } = await loadCustomProviderModule();
+    const provider = await createCustomProvider(id || 'custom-test', { ...config, apiKey });
+    await withTimeout(
+      (signal) => provider.send([{ role: 'user', content: 'Reply with OK.' }], model, [], { signal, maxTokens: 16 }),
+      CUSTOM_TEST_TIMEOUT_MS,
+      'connection test'
+    );
+    return { ok: true };
+  } catch (error) {
+    throw sanitizeCustomError(error, [apiKey]);
+  }
+}
+
+export async function discoverCustomProviderModels(cfgMod, rawInput) {
+  const { id, config, apiKey } = await resolveCustomInput(cfgMod, rawInput, { requireModels: false });
+  try {
+    const { createCustomProvider } = await loadCustomProviderModule();
+    const provider = await createCustomProvider(id || 'custom-discovery', { ...config, models: [], apiKey });
+    const listed = await withTimeout(() => provider.listModels(), CUSTOM_DISCOVERY_TIMEOUT_MS, 'model discovery');
+    const seen = new Set();
+    const models = [];
+    for (const item of Array.isArray(listed) ? listed : []) {
+      const modelId = String(item?.id || '').trim();
+      if (!modelId || seen.has(modelId)) continue;
+      seen.add(modelId);
+      const model = { id: modelId };
+      const name = String(item.name || item.display || '').trim();
+      if (name && name !== modelId) model.name = name;
+      if (Number(item.contextWindow) > 0) model.contextWindow = Math.floor(Number(item.contextWindow));
+      const out = Number(item.maxOutputTokens ?? item.outputTokens);
+      if (out > 0) model.maxOutputTokens = Math.floor(out);
+      models.push(model);
+    }
+    return { models };
+  } catch (error) {
+    throw sanitizeCustomError(error, [apiKey]);
+  }
+}
+
 export function saveOpenAIUsageSessionKey(cfgMod, secret) {
   const value = String(secret || '').trim();
   if (!value) throw new Error('OpenAI usage session key is required for credit lookup');

package/src/standalone/session-protocol.mjs

@@ -93,6 +93,10 @@ export const SESSION_CONFIGURE_ACTIONS = Object.freeze([
   'deleteMediaAsset',
   'deleteMediaAssets',
   'deleteSchedule',
+  'saveCustomProvider',
+  'removeCustomProvider',
+  'testCustomProvider',
+  'discoverCustomProviderModels',
   'deleteSession',
   'deleteWebhook',
   'deleteWorkflow',

package/src/tui/app/model-options.mjs

@@ -7,6 +7,7 @@
  */
 import { theme } from '../theme.mjs';
 import { displayModelName } from '../../runtime/shared/model-display.mjs';
+import { isRollingModelAlias } from '../../runtime/shared/model-alias.mjs';
 
 export const parsedModelVersion = (id) => {
   const text = String(id || '').toLowerCase();
@@ -147,7 +148,15 @@ export const normalizeModelOptions = (models) => {
     const providerModels = [];
     for (const [family, group] of families.entries()) {
       const limit = modelFamilyLimit(provider, family);
-      providerModels.push(...group.slice().sort(compareModelRecency).slice(0, limit));
+      // Version limits must not hide rolling routes, even when several
+      // vendors' "~..." IDs share the fallback family.
+      let versions = 0;
+      providerModels.push(
+        ...group
+          .slice()
+          .sort(compareModelRecency)
+          .filter((model) => isRollingModelAlias(model.id) || versions++ < limit)
+      );
     }
     normalized.push(...providerModels.sort(compareModelRecency));
   }

package/src/tui/dist/index.mjs

@@ -55203,6 +55203,11 @@ function createMaintenancePickers({
   };
 }
 
+// src/runtime/shared/model-alias.mjs
+function isRollingModelAlias(id) {
+  return /-latest$/i.test(String(id || "").trim());
+}
+
 // src/tui/app/model-options.mjs
 var parsedModelVersion = (id) => {
   const text = String(id || "").toLowerCase();
@@ -55322,7 +55327,10 @@ var normalizeModelOptions = (models) => {
     const providerModels = [];
     for (const [family, group] of families.entries()) {
       const limit = modelFamilyLimit(provider, family);
-      providerModels.push(...group.slice().sort(compareModelRecency).slice(0, limit));
+      let versions = 0;
+      providerModels.push(
+        ...group.slice().sort(compareModelRecency).filter((model) => isRollingModelAlias(model.id) || versions++ < limit)
+      );
     }
     normalized.push(...providerModels.sort(compareModelRecency));
   }

package/src/tui/session/session-api/integrations.mjs

@@ -159,6 +159,18 @@ export function createSessionIntegrationsApi(bag, { oauthFlows }) {
       pushNotice(`provider api key saved: ${result.provider}`, 'info');
       return true;
     },
+    saveCustomProvider: announced(
+      (input) => runtime.saveCustomProvider(input),
+      (result) => `custom provider saved: ${result.id}`
+    ),
+    removeCustomProvider: async (id) => {
+      const result = await runtime.removeCustomProvider(id);
+      refreshRouteStats();
+      pushNotice(`custom provider removed: ${result.provider}`, 'info');
+      return result;
+    },
+    testCustomProvider: (input) => runtime.testCustomProvider(input),
+    discoverCustomProviderModels: (input) => runtime.discoverCustomProviderModels(input),
     saveOpenCodeGoUsageAuth: (opts) => {
       runtime.saveOpenCodeGoUsageAuth(opts);
       pushNotice('OpenCode Go usage auth saved', 'info');