mixdog 1.1.1 → 1.2.0

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-credentials.mjs

@@ -13,6 +13,7 @@ import { randomBytes } from 'node:crypto';
 import { updateJsonAtomicSync, writeJsonAtomicSync, withFileLock } from '../../../shared/atomic-file.mjs';
 import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
 import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
+import { modelProxyClientMode, serverModelCredentialsDisabledError } from '../../../shared/model-proxy-mode.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 import { claudeCliUserAgent, resolveCliVersion } from './anthropic-oauth-client-version.mjs';
 import {
@@ -148,6 +149,7 @@ export function _credentialsMaxMtime() {
 }
 
 export function loadCredentials() {
+  if (modelProxyClientMode()) return null;
   const loaded = credentialCandidates().map(_loadCredentialsFile).filter(Boolean);
   if (!loaded.length) return null;
   loaded.sort((a, b) => (Number(b.expiresAt) || 0) - (Number(a.expiresAt) || 0));
@@ -382,6 +384,7 @@ async function _refreshOAuthCredentialsUnlocked(creds) {
 }
 
 export async function refreshOAuthCredentials(creds) {
+  if (modelProxyClientMode()) throw serverModelCredentialsDisabledError('Anthropic OAuth credentials');
   if (isAnthropicOAuthRefreshDisabled()) {
     throw new Error(
       'Anthropic OAuth refresh is disabled in this process; ' +

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -48,6 +48,7 @@ import { createAnthropicOAuthRecovery } from './anthropic-oauth-recovery.mjs';
 import { createMidState, createMidstreamRecovery } from './anthropic-oauth-midstream.mjs';
 import { assertAnthropicStreamNotEmpty } from './anthropic-midstream-recovery.mjs';
 import { applyAnthropicEffortToBody, shouldIncludeEffortBeta } from './anthropic-effort.mjs';
+import { ANTHROPIC_EFFORT_LEVELS, withEffortRejectionFallback } from './effort-rejection.mjs';
 import { getLlmDispatcher, preconnect } from '../../../shared/llm/http-agent.mjs';
 import {
   applyAnthropicCacheMarkers,
@@ -408,6 +409,17 @@ export class AnthropicOAuthProvider {
   }
 
   async send(messages, model, tools, sendOpts) {
+    return withEffortRejectionFallback(
+      'anthropic-oauth',
+      model,
+      sendOpts || {},
+      undefined,
+      (opts) => this._sendOnce(messages, model, tools, opts),
+      { levels: ANTHROPIC_EFFORT_LEVELS }
+    );
+  }
+
+  async _sendOnce(messages, model, tools, sendOpts) {
     await warmCliVersion();
     // Re-warm the kept-alive socket before the turn. preconnect() is a
     // best-effort no-op while a socket is still hot (TTL gate), but after an
@@ -625,7 +637,9 @@ export class AnthropicOAuthProvider {
     // without them (the request keeps its turn effort).
     if (isEffortConfigurationRejection(response.status, scrubbedText) && !opts._effortConfigurationRetry) {
       markEffortConfigurationUnsupported('anthropic-oauth', useModel);
-      process.stderr.write(`[anthropic-oauth] ${useModel} rejected the mid-conversation effort update; retrying once without it\n`);
+      process.stderr.write(
+        `[anthropic-oauth] ${useModel} rejected the mid-conversation effort update; retrying once without it\n`
+      );
       return this.send(messages, useModel, tools, {
         ...opts,
         effortConfigurationEnabled: false,

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -8,6 +8,7 @@ import { ANTHROPIC_MAX_MIDSTREAM_RETRIES, parseSSEStream } from './anthropic-sse
 import { buildAnthropicBetaHeaders } from './anthropic-betas.mjs';
 import { buildAnthropicApiRequest } from './anthropic-api-request.mjs';
 import { isCustomProviderName } from './custom-reasoning.mjs';
+import { ANTHROPIC_EFFORT_LEVELS, withEffortRejectionFallback } from './effort-rejection.mjs';
 import { armFirstByteWatchdog, createAnthropicApiTransport } from './anthropic-api-transport.mjs';
 import { createAnthropicApiRecovery } from './anthropic-api-recovery.mjs';
 import { buildAnthropicTurnResult } from './anthropic-turn-result.mjs';
@@ -106,10 +107,21 @@ export class AnthropicProvider {
       throw err;
     }
   }
+  // The `anthropic` API-key provider and every custom `anthropic`-protocol
+  // provider (a subclass of this one) share this send path.
   async _doSend(messages, model, tools, sendOpts) {
+    return withEffortRejectionFallback(
+      this.name,
+      model,
+      sendOpts || {},
+      this.config?.reasoningEffort,
+      (opts) => this._sendOnce(messages, model, tools, opts),
+      { levels: ANTHROPIC_EFFORT_LEVELS }
+    );
+  }
+  async _sendOnce(messages, model, tools, opts) {
     if (!model) throw new Error(`[${this.name}] model is required — pass it from the caller preset`);
     const useModel = model;
-    const opts = sendOpts || {};
     // Wire request (system/cache layout, tools, effort, fast mode, images)
     // and the per-request beta headers derived from that final body —
     // anthropic-api-request.mjs. Fast mode latches on the provider instance.

package/src/runtime/agent/orchestrator/providers/antigravity-oauth-tokens.mjs

@@ -18,6 +18,7 @@ import { join, resolve } from 'node:path';
 import { getPluginData } from '../config.mjs';
 import { writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
 import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
+import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
 import {
   accountIdentityFields,
   normalizeExpiresAtMs as _normalizeExpiresAt,
@@ -192,6 +193,7 @@ function mtimeMs(path) {
 export { _normalizeExpiresAt };
 
 export function loadTokens() {
+  if (modelProxyClientMode()) return null;
   const path = getOwnTokenPath();
   if (!existsSync(path)) return null;
   try {

package/src/runtime/agent/orchestrator/providers/cursor-auth.mjs

@@ -4,6 +4,7 @@ import { join, resolve } from 'node:path';
 import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
 import { writeJsonAtomicSync, withFileLock } from '../../../shared/atomic-file.mjs';
 import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
+import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
 import { openInBrowser } from '../../../shared/open-url.mjs';
 import { createOAuthPkce } from './lib/oauth-pkce.mjs';
 import { accountIdentityFields, normalizeAccountIdentity } from './lib/oauth-token-utils.mjs';
@@ -75,6 +76,7 @@ export function cursorTokenIdentity(token) {
 }
 
 function loadStoredCredentials() {
+  if (modelProxyClientMode()) return null;
   if (process.env.CURSOR_ACCESS_TOKEN && !boundProviderAuthPath('cursor-oauth')) {
     return {
       access_token: process.env.CURSOR_ACCESS_TOKEN,

package/src/runtime/agent/orchestrator/providers/cursor-wire-normalization.mjs

@@ -83,8 +83,9 @@ export function normalizeModels(models) {
       name: isCursorAutoModelId(rawId)
         ? 'Auto'
         : model.displayName || model.displayNameShort || model.displayModelId || aliases[0] || id,
+      // GetUsableModels publishes no window; the provider default applies
+      // after any described window instead of a seeded constant.
       reasoning: Boolean(model.thinkingDetails),
-      contextWindow: 200_000,
     });
   }
   return [...byId.values()].sort((a, b) => a.id.localeCompare(b.id));

package/src/runtime/agent/orchestrator/providers/effort-configuration.mjs

@@ -43,10 +43,18 @@ export function markEffortConfigurationUnsupported(provider, model) {
 
 /** True for a provider error that names the mid-conversation effort update. */
 export function isEffortConfigurationRejection(status, text) {
-  return (
-    status === 400 &&
-    /output_config|mid-conversation|configuration_update|reasoning_effort_update/i.test(String(text || ''))
-  );
+  const message = String(text || '');
+  if (status !== 400) return false;
+  if (/mid-conversation|configuration_update|reasoning_effort_update/i.test(message)) return true;
+  // A rejected `output_config.effort` VALUE (the error quotes a level) belongs
+  // to the effort-rejection fallback (effort-rejection.mjs); a rejected field
+  // ("output_config.effort is not supported") is still the update case.
+  if (
+    /output_config\.effort\b(?!_)/i.test(message) &&
+    /['"`](?:none|minimal|low|medium|high|xhigh|max|ultra)['"`]/i.test(message)
+  )
+    return false;
+  return /output_config/i.test(message);
 }
 
 /**

package/src/runtime/agent/orchestrator/providers/effort-rejection.mjs

@@ -0,0 +1,244 @@
+import { readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { parseJsonText, updateJsonAtomicSync } from '../../../shared/atomic-file.mjs';
+import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
+
+// An OpenAI-compatible endpoint that rejects the requested reasoning effort
+// (HTTP 400 naming the value) is replayed once at the nearest accepted level,
+// and the rejection is remembered per provider+model so the level stops being
+// sent (clamped before the request) and stops being offered (the sync reader).
+
+const EFFORT_ORDER = Object.freeze(['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'ultra']);
+const FILE_NAME = 'effort-rejections.json';
+// Per-provider request fields that can carry the effort next to `opts.effort`.
+const EFFORT_OPT_KEYS = ['xaiReasoningEffort', 'openRouterReasoningEffort', 'deepseekReasoningEffort'];
+const LEVEL_RE = new RegExp(`\\b(${EFFORT_ORDER.join('|')})\\b`, 'gi');
+const LIST_RE =
+  /\b(?:supported|allowed|valid|accepted|available)\s+(?:values?|levels?|options?|efforts?)|(?:must|should|expected to) be one of|expected one of|one of|choose from|input should be/i;
+const REJECT_RE =
+  /invalid|unsupported|not supported|does not support|doesn't support|not allowed|not a valid|unrecognized|must be one of|expected one of|supported values/i;
+// Anthropic's `invalid_request_error` words a bad enum value as "Input should be 'low', ...".
+const ANTHROPIC_REJECT_RE = /input should be|should be one of|not one of/i;
+const EFFORT_RE = /reasoning[._ ]?effort|\beffort\b/i;
+const REASONING_RE = /\breasoning\b/i;
+// A request field other than the effort: `reasoning.summary`, `reasoning_content`,
+// `thinking.type`, `budget_tokens`, ...
+const OTHER_FIELD_RE = /\breasoning[._[](?!effort)\w+|(?:^|[\s'"`(])(?:thinking\.\w+|budget_tokens)\b/i;
+// The mid-conversation effort update rejection belongs to effort-configuration.mjs.
+const EFFORT_CONFIGURATION_RE = /mid-conversation|configuration_update|reasoning_effort_update/i;
+/** The effort levels the Anthropic Messages wire accepts (`output_config.effort`). */
+export const ANTHROPIC_EFFORT_LEVELS = Object.freeze(['low', 'medium', 'high', 'xhigh', 'max']);
+
+const cache = new Map();
+
+const filePath = () => join(resolvePluginData(), FILE_NAME);
+const entryKey = (provider, model) =>
+  `${String(provider || '').trim()}:${String(model || '')
+    .trim()
+    .toLowerCase()}`;
+const levelOf = (value) => {
+  const level = String(value ?? '')
+    .trim()
+    .toLowerCase();
+  return EFFORT_ORDER.includes(level) ? level : null;
+};
+
+// A rejection persisted by another process changes the file; the cached copy is
+// only trusted while the file's mtime and size are unchanged.
+function signature(file) {
+  try {
+    const stat = statSync(file);
+    return `${stat.mtimeMs}:${stat.size}`;
+  } catch {
+    return null;
+  }
+}
+
+function load(file) {
+  const sig = signature(file);
+  const cached = cache.get(file);
+  if (cached && cached.sig === sig) return cached.data;
+  let data = null;
+  try {
+    data = parseJsonText(readFileSync(file, 'utf8'));
+  } catch {}
+  const valid =
+    data?.version === 1 && data.models && typeof data.models === 'object' ? data : { version: 1, models: {} };
+  cache.set(file, { sig, data: valid });
+  return valid;
+}
+
+function addRejection(data, key, level, allowed) {
+  const models = { ...data.models };
+  const prev = models[key] || {};
+  const rejected = new Set(prev.rejected || []);
+  if (level) rejected.add(level);
+  const nextAllowed = allowed?.length ? allowed : prev.allowed;
+  models[key] = { rejected: [...rejected], ...(nextAllowed?.length ? { allowed: nextAllowed } : {}) };
+  return { version: 1, models };
+}
+
+function entry(provider, model) {
+  return load(filePath()).models[entryKey(provider, model)] || null;
+}
+
+/** Levels this provider+model is known not to accept (rejected, or outside a
+ *  list the endpoint named). Sync, for the runtime effort catalog. */
+export function rejectedEffortLevelsSync(provider, model) {
+  const found = entry(provider, model);
+  const rejected = new Set(found?.rejected || []);
+  if (found?.allowed?.length) for (const level of EFFORT_ORDER) if (!found.allowed.includes(level)) rejected.add(level);
+  return rejected;
+}
+
+/** Remember a rejected level (and the allowed list the endpoint named, if any). */
+export function recordEffortRejection(provider, model, level, allowed = null) {
+  const file = filePath();
+  const key = entryKey(provider, model);
+  const normalized = levelOf(level);
+  try {
+    const data = updateJsonAtomicSync(
+      file,
+      (cur) =>
+        addRejection(cur?.version === 1 && cur.models ? cur : { version: 1, models: {} }, key, normalized, allowed),
+      { lock: true, timeoutMs: 1000 }
+    );
+    cache.set(file, { sig: signature(file), data });
+  } catch {
+    cache.set(file, { sig: signature(file), data: addRejection(load(file), key, normalized, allowed) });
+  }
+}
+
+/** Forget what was loaded from disk (a process restart, for tests). */
+export function resetEffortRejectionCache() {
+  cache.clear();
+}
+
+const collect = (error) => {
+  const nested = error?.error?.error && typeof error.error.error === 'object' ? error.error.error : null;
+  return [error, error?.error, nested].filter((part) => part && typeof part === 'object');
+};
+
+const hasLevel = (text) => new RegExp(LEVEL_RE.source, 'i').test(text);
+
+/**
+ * A 400-class provider error that rejects the reasoning effort, as
+ * `{ allowed }` (levels the message lists, or null), else null. It must be
+ * effort-specific: the `param` names the effort field, or the message names the
+ * effort field together with a level, or (given the `requested` level) the
+ * message calls that level invalid while talking about reasoning. A rejection
+ * of another reasoning field (`reasoning.summary`, `reasoning.include`) never matches.
+ */
+export function detectEffortRejection(error, requested = null) {
+  const status = [error?.status, error?.httpStatus, error?.response?.status].map(Number).find((value) => value > 0);
+  if (status !== 400 && status !== 422) return null;
+  const parts = collect(error);
+  const param = parts.map((part) => String(part.param ?? '')).join(' ');
+  const text = parts
+    .flatMap((part) => [part.message, part.code, part.param])
+    .filter(Boolean)
+    .join(' ');
+  if (EFFORT_CONFIGURATION_RE.test(text)) return null;
+  const anthropic = parts.some((part) => part.type === 'invalid_request_error') || /invalid_request_error/.test(text);
+  if (!REJECT_RE.test(text) && !(anthropic && ANTHROPIC_REJECT_RE.test(text))) return null;
+  const level = levelOf(requested);
+  const targeted =
+    /effort/i.test(param) ||
+    (!OTHER_FIELD_RE.test(`${param} ${text}`) &&
+      ((EFFORT_RE.test(text) && hasLevel(text)) ||
+        (level && REASONING_RE.test(text) && new RegExp(`\\b${level}\\b`, 'i').test(text))));
+  if (!targeted) return null;
+  const list = LIST_RE.exec(text);
+  const allowed = list
+    ? [...new Set([...text.slice(list.index + list[0].length).matchAll(LEVEL_RE)].map((m) => m[1].toLowerCase()))]
+    : [];
+  return { allowed: allowed.length ? allowed : null };
+}
+
+/**
+ * The nearest lower level not in `rejected`; with `allowHigher` (the accepted
+ * set is known) the nearest higher one when nothing lower is left.
+ */
+export function nearestAcceptedEffort(requested, rejected = new Set(), { allowHigher = false } = {}) {
+  const from = EFFORT_ORDER.indexOf(requested);
+  if (from < 0) return null;
+  const open = EFFORT_ORDER.filter((level, index) => index !== from && !rejected.has(level));
+  const lower = open.filter((level) => EFFORT_ORDER.indexOf(level) < from).at(-1);
+  return lower ?? (allowHigher ? (open[0] ?? null) : null);
+}
+
+const requestedEffort = (opts, configEffort) => levelOf(opts?.effort ?? configEffort);
+
+function withEffort(opts, level) {
+  const next = { ...opts, effort: level };
+  for (const key of EFFORT_OPT_KEYS) if (opts?.[key] !== undefined) next[key] = level;
+  return next;
+}
+
+// The rejected set seen by a transport that only takes `levels` of the ladder.
+function rejectedWithin(provider, model, levels) {
+  const rejected = rejectedEffortLevelsSync(provider, model);
+  if (levels) for (const level of EFFORT_ORDER) if (!levels.includes(level)) rejected.add(level);
+  return rejected;
+}
+
+/** `opts` with a level already known to be rejected stepped down; unchanged otherwise. */
+export function clampEffortOpts(provider, model, opts, configEffort, levels = null) {
+  const requested = requestedEffort(opts, configEffort);
+  if (!requested || (levels && !levels.includes(requested))) return opts;
+  const rejected = rejectedWithin(provider, model, levels);
+  if (!rejected.has(requested)) return opts;
+  const level = nearestAcceptedEffort(requested, rejected, { allowHigher: Boolean(entry(provider, model)?.allowed) });
+  return level ? withEffort(opts, level) : opts;
+}
+
+const STREAM_CALLBACKS = ['onStreamDelta', 'onTextDelta', 'onToolCall'];
+
+/**
+ * Runs `send(opts)` with known-rejected levels clamped first; when the model
+ * rejects the effort, remembers it and replays the request once at the nearest
+ * accepted level. Never replays after output reached the caller, and never
+ * replays the replay. `levels` limits the ladder to what the transport's wire
+ * accepts. A send re-entered from inside a wrapped send (a transport's own
+ * replays call `send` again) passes straight through: the outer wrapper owns it.
+ */
+export async function withEffortRejectionFallback(provider, model, opts, configEffort, send, { levels = null } = {}) {
+  if (opts?._effortRejectionActive) return send(opts);
+  let streamed = false;
+  const tracked = { ...opts, _effortRejectionActive: true };
+  for (const name of STREAM_CALLBACKS) {
+    const callback = opts?.[name];
+    if (typeof callback === 'function') {
+      tracked[name] = (...args) => {
+        streamed = true;
+        return callback(...args);
+      };
+    }
+  }
+  const first = clampEffortOpts(provider, model, tracked, configEffort, levels);
+  try {
+    return await send(first);
+  } catch (error) {
+    const requested = requestedEffort(first, configEffort);
+    const rejection = detectEffortRejection(error, requested);
+    const emitted =
+      streamed || error?.liveTextEmitted === true || error?.emittedToolCall === true || error?.unsafeToRetry === true;
+    if (!rejection || !requested || (levels && !levels.includes(requested))) throw error;
+    recordEffortRejection(provider, model, requested, rejection.allowed);
+    if (emitted) throw error;
+    const level = nearestAcceptedEffort(requested, rejectedWithin(provider, model, levels), {
+      allowHigher: Boolean(entry(provider, model)?.allowed),
+    });
+    if (!level) throw error;
+    process.stderr.write(
+      `[${provider}] ${model} rejected reasoning effort '${requested}'; retrying once at '${level}'\n`
+    );
+    try {
+      return await send(withEffort(first, level));
+    } catch (retryError) {
+      const again = detectEffortRejection(retryError, level);
+      if (again) recordEffortRejection(provider, model, level, again.allowed);
+      throw retryError;
+    }
+  }
+}

package/src/runtime/agent/orchestrator/providers/grok-client-version.mjs

@@ -3,7 +3,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // Grok CLI client version for the cli-chat-proxy version gate (HTTP 426).
 // Effective = env override, else max(floor, learned-from-426, live npm latest
 // of the official @xai-official/grok CLI).
-export const GROK_CLI_VERSION_FLOOR = '1.0.50';
+export const GROK_CLI_VERSION_FLOOR = '1.0.52';
 export const GROK_CLI_NPM_PACKAGE = '@xai-official/grok';
 
 const live = createNpmVersionSource(GROK_CLI_NPM_PACKAGE, { persistKey: 'grok-cli' });

package/src/runtime/agent/orchestrator/providers/grok-oauth-tokens.mjs

@@ -10,6 +10,7 @@ import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs
 import { createTimeoutSignal } from '../stall-policy.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 import { grokClientVersionHeaders } from './grok-client-version.mjs';
+import { modelProxyClientMode, serverModelCredentialsDisabledError } from '../../../shared/model-proxy-mode.mjs';
 import {
   accountIdentityFields,
   decodeJwtPayload,
@@ -174,6 +175,7 @@ export function _mtimeMs(path) {
 // mixdog's own login store (grok-oauth.json). Single writer, accurate
 // numeric expires_at from refresh.
 export function _loadOwnTokens() {
+  if (modelProxyClientMode()) return null;
   const path = getOwnTokenPath();
   if (!existsSync(path)) return null;
   try {
@@ -375,6 +377,7 @@ async function _postRefreshWithRetry(tokens) {
 // single-use. Hold a cross-process lease across the re-read, exchange, and
 // atomic save so only one process can spend a generation.
 export async function refreshTokens(tokens, { force = false } = {}) {
+  if (modelProxyClientMode()) throw serverModelCredentialsDisabledError('Grok OAuth credentials');
   if (!tokens?.refresh_token) {
     throw new Error('[grok-oauth] refresh token not available — open /providers in mixdog to sign in again');
   }

package/src/runtime/agent/orchestrator/providers/mimo-oauth-profile.mjs

@@ -6,6 +6,7 @@ import { scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
 import { PROVIDER_MAX_BEFORE_WARN_MS, STALL_ABORT_S, STALL_TICK_MS } from '../stall-policy.mjs';
 import { PACKAGE_VERSION } from '../../../web-search/lib/package-version.mjs';
 import { DEFAULT_MODEL } from './mimo-oauth-tokens.mjs';
+import { MIMO_SEED_MODELS, mimoSeedRow as seedRow } from '../../../shared/llm/provider-seed-rosters.mjs';
 
 const MIMO_EFFORT_LEVELS = Object.freeze(['minimal', 'low', 'medium', 'high']);
 const MIMO_DEFAULT_TEMPERATURE = 1.0;
@@ -15,25 +16,12 @@ const MIMO_DEFAULT_MAX_OUTPUT_TOKENS = 128_000;
 export const MIMO_FIRST_BYTE_TIMEOUT_MS = Math.min(300_000, PROVIDER_MAX_BEFORE_WARN_MS);
 export const MIMO_SEMANTIC_IDLE_TIMEOUT_MS = Math.min(480_000, Math.max(10_000, STALL_ABORT_S * 1000 - STALL_TICK_MS));
 
-// Local roster used when /models fails or comes back empty.
-const SEED_CONTEXT = 1_048_576;
-const SEED_OUTPUT = 131_072;
-export const SEED_MODELS = Object.freeze(
-  [
-    ['mimo-v2.6-pro', 'MiMo-V2.6-Pro', SEED_CONTEXT],
-    ['mimo-v2.6-flash', 'MiMo-V2.6-Flash', SEED_CONTEXT],
-    ['mimo-v2.6-pro-ultraspeed', 'MiMo-V2.6-Pro-Ultraspeed', SEED_CONTEXT],
-    ['mimo-v2.5-pro', 'MiMo-V2.5-Pro', SEED_CONTEXT],
-    ['mimo-v2.5', 'MiMo-V2.5', SEED_CONTEXT],
-    ['mimo-v2-pro', 'MiMo-V2-Pro', SEED_CONTEXT],
-    ['mimo-v2-omni', 'MiMo-V2-Omni', 262_144],
-  ].map(([id, display_name, context_window]) =>
-    Object.freeze({ id, display_name, context_window, max_output_tokens: SEED_OUTPUT })
-  )
-);
+// Local roster used when /models fails or comes back empty. Its limits are not
+// discovered data: decorateModelRows applies them only where nothing fetched did.
+export const SEED_MODELS = MIMO_SEED_MODELS;
 
 export function seedModelItems() {
-  return SEED_MODELS.map((item) => ({ ...item }));
+  return SEED_MODELS.map(({ id, display_name }) => ({ id, display_name }));
 }
 
 // Speech/transcription ids cannot serve a text chat turn.
@@ -50,28 +38,8 @@ export function chooseDefaultModel(ids) {
   return chat[0] || DEFAULT_MODEL;
 }
 
-// Exact seed id, else the longest seed whose id is a lineage prefix of the
-// model (dated or suffixed variants of a seeded model).
-function seedRow(model) {
-  const id = String(model || '').toLowerCase();
-  let seed = SEED_MODELS.find((item) => item.id === id) || null;
-  if (!seed) {
-    for (const item of SEED_MODELS) {
-      if (id.startsWith(`${item.id}-`) && (!seed || item.id.length > seed.id.length)) seed = item;
-    }
-  }
-  if (!seed) return null;
-  return {
-    id: String(model),
-    contextWindow: seed.context_window,
-    outputTokens: seed.max_output_tokens,
-    reasoning: true,
-    vision: true,
-    inputModalities: ['text', 'image'],
-  };
-}
-
-// Fill the gaps a /models row leaves (names, limits, effort levels).
+// Fill the gaps a /models row leaves (names, limits, effort levels); seeds
+// never replace a value the row already carries.
 export function decorateModelRows(rows, items) {
   const display = new Map();
   for (const item of items || []) {
@@ -89,7 +57,7 @@ export function decorateModelRows(rows, items) {
       ...(seed && row.reasoning === undefined ? { reasoning: seed.reasoning } : {}),
       ...(seed && row.vision === undefined ? { vision: seed.vision } : {}),
       ...(seed && row.inputModalities === undefined ? { inputModalities: seed.inputModalities } : {}),
-      reasoningLevels: [...MIMO_EFFORT_LEVELS],
+      reasoningLevels: row.reasoningLevels?.length ? row.reasoningLevels : [...MIMO_EFFORT_LEVELS],
       reasoningContentField: 'reasoning_content',
     };
   });

package/src/runtime/agent/orchestrator/providers/mimo-oauth-tokens.mjs

@@ -8,6 +8,7 @@ import { getPluginData } from '../config.mjs';
 import { writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
 import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
 import { accountIdentityFields, fileMtimeMs, scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
+import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
 
 const DEFAULT_PLATFORM_ORIGIN = 'https://platform.xiaomimimo.com';
 const DEFAULT_BASE_URL = 'https://api.xiaomimimo.com/v1';
@@ -98,6 +99,7 @@ export function getKeyName() {
 }
 
 export function loadTokens() {
+  if (modelProxyClientMode()) return null;
   const path = getOwnTokenPath();
   if (!existsSync(path)) return null;
   try {

package/src/runtime/agent/orchestrator/providers/mimo-oauth.mjs

@@ -10,6 +10,7 @@ import { noteErrorUsage } from './lib/note-error-usage.mjs';
 import { fileMtimeMs, scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
 import { OpenAICompatProvider, preloadOpenAICompatRuntime } from './openai-compat.mjs';
 import { fetchCompatModelItems, listCompatModels } from './openai-compat-models.mjs';
+import { makeModelCache } from './model-cache.mjs';
 import {
   SOURCE_HEADER,
   ensureTokenPlanBaseUrl,
@@ -29,6 +30,23 @@ import {
 
 const isUnauthorized = (err) => Number(err?.httpStatus || err?.status) === 401;
 
+// The discovered roster (what /models returned, never seed values) is
+// persisted so the shared sync lookup sees what listModels found.
+const mimoModelCache = makeModelCache({ fileName: 'mimo-oauth-models.json', ttlMs: 24 * 60 * 60 * 1000, version: 1 });
+
+function rosterRow(item) {
+  const contextWindow = Number(item.context_window ?? item.max_context_window ?? item.context_length ?? 0);
+  const outputTokens = Number(item.max_output_tokens ?? item.output_tokens ?? 0);
+  const name = typeof item.display_name === 'string' ? item.display_name.trim() : '';
+  return {
+    id: item.id,
+    provider: 'mimo-oauth',
+    ...(name ? { name } : {}),
+    ...(contextWindow > 0 ? { contextWindow } : {}),
+    ...(outputTokens > 0 ? { outputTokens } : {}),
+  };
+}
+
 // Strip the key from an error (message plus any echoed gateway body).
 function scrubErrorSecrets(err, apiKey) {
   if (!err || typeof err !== 'object' || !apiKey) return err;
@@ -101,6 +119,7 @@ export class MimoOAuthProvider {
   _inner = null;
   _innerKey = null;
   _rosterItems = [];
+  _rosterSeq = 0;
   _defaultModelKey = null;
   _defaultModel = null;
 
@@ -143,7 +162,7 @@ export class MimoOAuthProvider {
       clientOptions: { organization: null, project: null },
       extraHeaders: { ...SOURCE_HEADER, Accept: 'application/json' },
     });
-    inner._fetchModelItems = (args) => this._fetchRoster(inner, args);
+    inner._fetchModelItems = async (args) => (await this._fetchRoster(inner, args)).items;
     redactClientErrors(inner.client, apiKey);
     this._inner = inner;
     this._innerKey = key;
@@ -153,15 +172,28 @@ export class MimoOAuthProvider {
   // Chat models from /models; a failed or empty listing falls back to the local
   // seed roster. Only a rejected key is surfaced.
   async _fetchRoster(inner, args) {
+    // Only the latest request, fetched with the still-active key, publishes.
+    const apiKey = inner.apiKey;
+    const seq = ++this._rosterSeq;
+    const publish = mimoModelCache.beginSave(() => loadTokens()?.apiKey === apiKey);
     let items = [];
     try {
       items = (await fetchCompatModelItems(inner, args)).filter((item) => isChatModelId(item?.id));
     } catch (err) {
       if (isUnauthorized(err)) throw err;
     }
-    if (!items.length) items = seedModelItems();
-    this._rosterItems = items;
-    return items;
+    // `published` is false when disk kept a newer roster; the seed fallback
+    // publishes nothing. `_listRows` revalidates `seq` and the key before
+    // touching shared state, since enrichment runs after this returns.
+    let published = true;
+    if (items.length) published = publish(items.map(rosterRow));
+    else items = seedModelItems();
+    return { items, published, seq, apiKey };
+  }
+
+  // Still the latest request, fetched with the still-active key.
+  _isCurrentRoster({ published, seq, apiKey }) {
+    return published && seq === this._rosterSeq && loadTokens()?.apiKey === apiKey;
   }
 
   // Shared send/list error shaping, also applied to credential setup failures.
@@ -180,19 +212,26 @@ export class MimoOAuthProvider {
   // Configured model wins; otherwise pick from this credential's own roster.
   async _pickDefaultModel(inner) {
     if (this._defaultModel && this._defaultModelKey === this._innerKey) return this._defaultModel;
-    await this._listRows(inner);
-    this._defaultModel = chooseDefaultModel(this._enrichedIds(inner));
+    const rows = await this._listRows(inner);
+    this._defaultModel = chooseDefaultModel(rows.map((row) => row.id));
     this._defaultModelKey = this._innerKey;
     return this._defaultModel;
   }
 
-  _enrichedIds(inner) {
-    return (inner._enrichedModels || []).map((row) => row.id);
-  }
-
+  // The request keeps its own items and rows; only a request that is still
+  // current publishes them to the shared in-memory roster and metadata.
   async _listRows(inner) {
-    const rows = decorateModelRows(await listCompatModels(inner, { throwOnError: true }), this._rosterItems);
-    inner._enrichedModels = rows;
+    let fetched = null;
+    const request = Object.create(inner);
+    request._fetchModelItems = async (args) => {
+      fetched = await this._fetchRoster(inner, args);
+      return fetched.items;
+    };
+    const rows = decorateModelRows(await listCompatModels(request, { throwOnError: true }), fetched.items);
+    if (this._isCurrentRoster(fetched)) {
+      this._rosterItems = fetched.items;
+      inner._enrichedModels = rows;
+    }
     return rows;
   }