mixdog 1.1.2 → 1.2.0

package/src/runtime/agent/orchestrator/providers/model-proxy-provider.mjs

@@ -0,0 +1,251 @@
+// Daemon-side stand-in for a provider in remote mode (MIXDOG_MODEL_PROXY=client).
+// It holds no credentials and opens no model connection: every call is handed
+// to the desktop client through the model proxy channel and executed by the
+// PC's own provider of the same name. The registry still wraps it with
+// admission scheduling and usage accounting, which then see the PC's result.
+import {
+  getModelProxyChannel,
+  ModelProxyUnavailableError,
+  splitModelProxySendOptions,
+  stripModelProxySecrets,
+} from './model-proxy-channel.mjs';
+import {
+  isFinalizedProviderRequestTools,
+  providerNativeToolPrefixCount,
+} from '../runtime-core/provider-request-tools.mjs';
+import {
+  attachmentTextForPart,
+  isAttachmentReference,
+  isPermanentAttachmentError,
+  readAttachmentBuffer,
+} from '../../../attachments/store.mjs';
+import { MAX_ATTACHMENT_BLOB_BYTES } from '../../../attachments/limits.mjs';
+
+/** Stored-attachment bytes one proxied call may carry inline: the store's own
+ *  single-blob ceiling. Newer messages are inlined first; a reference past the
+ *  budget stays a reference, which the PC lowers to its "unavailable" text. */
+export const MODEL_PROXY_INLINE_MAX_BYTES = MAX_ATTACHMENT_BLOB_BYTES;
+
+// A stored reference names a blob in THIS daemon's attachment store, which the
+// PC running the call cannot read. Each one travels as the inline part it was
+// stored from (image/file → base64 `data`, text → its text), so the PC lowers
+// exactly what a local daemon would.
+function inlineReference(part, budget) {
+  let buffer;
+  try {
+    buffer = readAttachmentBuffer(part);
+  } catch (error) {
+    if (isPermanentAttachmentError(error)) return part;
+    throw error;
+  }
+  if (buffer.length > budget.remaining) return part;
+  budget.remaining -= buffer.length;
+  const { attachmentRef: _ref, sizeBytes: _size, ...rest } = part;
+  if (part.type === 'text') {
+    const { textKind: _kind, filename: _name, mimeType: _mime, ...textRest } = rest;
+    return { ...textRest, type: 'text', text: attachmentTextForPart(part) };
+  }
+  return { ...rest, data: buffer.toString('base64') };
+}
+
+function inlinePart(part, budget) {
+  if (!part || typeof part !== 'object' || Array.isArray(part)) return part;
+  if (isAttachmentReference(part)) return inlineReference(part, budget);
+  if (Array.isArray(part.content)) {
+    const content = inlineParts(part.content, budget);
+    return content === part.content ? part : { ...part, content };
+  }
+  return part;
+}
+
+/** Newest last in a content list, so it is walked backwards for the budget. */
+function inlineParts(parts, budget) {
+  let out = null;
+  for (let index = parts.length - 1; index >= 0; index -= 1) {
+    const next = inlinePart(parts[index], budget);
+    if (next === parts[index]) continue;
+    out ??= [...parts];
+    out[index] = next;
+  }
+  return out ?? parts;
+}
+
+/** `messages` with every stored attachment reference replaced by its bytes. */
+export function inlineModelProxyAttachments(messages, { maxBytes = MODEL_PROXY_INLINE_MAX_BYTES } = {}) {
+  if (!Array.isArray(messages)) return messages;
+  const budget = { remaining: maxBytes };
+  let out = null;
+  for (let index = messages.length - 1; index >= 0; index -= 1) {
+    const message = messages[index];
+    if (!message || typeof message !== 'object' || message.content == null || typeof message.content === 'string') {
+      continue;
+    }
+    const content = Array.isArray(message.content)
+      ? inlineParts(message.content, budget)
+      : inlinePart(message.content, budget);
+    if (content === message.content) continue;
+    out ??= [...messages];
+    out[index] = { ...message, content };
+  }
+  return out ?? messages;
+}
+
+export class ModelProxyProvider {
+  #channel;
+  #modelInfo = new Map();
+
+  constructor(name, config = {}, channel = getModelProxyChannel()) {
+    this.name = name;
+    this.config = config || {};
+    this.#channel = channel;
+    // Adapter traits are reported by the PC's real instance.
+    if (typeof this.config.modelProxy?.nativePdf === 'boolean') this.nativePdf = this.config.modelProxy.nativePdf;
+  }
+
+  #call(method, fields = {}, options = {}) {
+    return this.#channel.request({ provider: this.name, method, ...fields }, options);
+  }
+
+  async send(messages, model, tools, sendOpts) {
+    const { options, callbacks } = splitModelProxySendOptions(sendOpts);
+    const finalized = isFinalizedProviderRequestTools(tools);
+    return this.#call(
+      'send',
+      {
+        model: model ?? null,
+        messages: inlineModelProxyAttachments(messages),
+        tools: Array.isArray(tools) ? tools : null,
+        toolsFinalized: finalized,
+        nativePrefixCount: finalized ? providerNativeToolPrefixCount(tools) : 0,
+        options,
+      },
+      { signal: sendOpts?.signal || null, callbacks }
+    );
+  }
+
+  #adoptCatalog(catalog) {
+    const models = Array.isArray(catalog?.models) ? catalog.models : [];
+    const info = catalog?.modelInfo && typeof catalog.modelInfo === 'object' ? catalog.modelInfo : {};
+    this.#modelInfo = new Map(Object.entries(info));
+    return models;
+  }
+
+  async listModels() {
+    return this.#adoptCatalog(await this.#call('listModels'));
+  }
+
+  async _refreshModelCache() {
+    return this.#adoptCatalog(await this.#call('refreshModels'));
+  }
+
+  async isAvailable() {
+    return (await this.#call('isAvailable')) === true;
+  }
+
+  getCachedModelInfo(model) {
+    return this.#modelInfo.get(String(model ?? '')) ?? null;
+  }
+}
+
+/** A proxy instance whose class carries the PC adapter's usage convention. */
+export function createModelProxyProvider(name, config = {}, channel = getModelProxyChannel()) {
+  const inputExcludesCache = config?.modelProxy?.inputExcludesCache;
+  if (typeof inputExcludesCache !== 'boolean') return new ModelProxyProvider(name, config, channel);
+  class BoundModelProxyProvider extends ModelProxyProvider {
+    static inputExcludesCache = inputExcludesCache;
+  }
+  return new BoundModelProxyProvider(name, config, channel);
+}
+
+// The PC's provider set (availability + non-secret config) changes only on a
+// PC-side sign-in or settings edit; a short cache keeps registry re-inits from
+// paying a client round trip each. The cache belongs to one client generation:
+// a reconnect (possibly from another PC) always asks again.
+const PROVIDER_CONFIG_TTL_MS = 15_000;
+/** How long a registry init waits for a client to connect and for its PC to
+ *  answer with a loaded provider registry. */
+export const MODEL_PROXY_CONFIG_WAIT_MS = 15_000;
+const CONFIG_RETRY_FIRST_MS = 250;
+const CONFIG_RETRY_MAX_MS = 2_000;
+let _providerConfigCache = null;
+let _providerConfigInFlight = null;
+
+/** A reply the registry may act on: the PC says its registry is loaded, or it
+ *  already names an enabled provider (a client that predates `ready`). An
+ *  empty or unready answer is never read as "everything disabled". */
+function providerConfigReady(reply, providers) {
+  // A loaded PC registry is authoritative, even when it has nothing enabled.
+  if (reply?.ready === true) return true;
+  if (reply?.ready === false) return false;
+  return Object.keys(providers).some((name) => providers[name]?.enabled === true);
+}
+
+const pause = (ms) =>
+  new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    timer.unref?.();
+  });
+
+export function loadModelProxyProviderConfig({
+  channel = getModelProxyChannel(),
+  now = Date.now,
+  waitMs = MODEL_PROXY_CONFIG_WAIT_MS,
+} = {}) {
+  const generation = channel.generation;
+  const cached = _providerConfigCache;
+  if (
+    cached &&
+    cached.channel === channel &&
+    cached.generation === generation &&
+    now() - cached.at < PROVIDER_CONFIG_TTL_MS
+  ) {
+    return Promise.resolve(cached.value);
+  }
+  const inFlight = _providerConfigInFlight;
+  if (inFlight && inFlight.channel === channel && inFlight.generation === generation) return inFlight.promise;
+  const promise = (async () => {
+    const deadline = Date.now() + waitMs;
+    let delay = CONFIG_RETRY_FIRST_MS;
+    let lastError = null;
+    for (;;) {
+      if (!channel.connected) {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0 || !(await channel.whenConnected(remaining))) {
+          throw lastError ?? new ModelProxyUnavailableError('no desktop client is connected to run model calls');
+        }
+      }
+      try {
+        const reply = await channel.request({ provider: '', method: 'providerConfig' });
+        const raw = reply?.providers && typeof reply.providers === 'object' ? reply.providers : {};
+        // Defense in depth: the PC already strips secrets before sending.
+        const value = stripModelProxySecrets(raw);
+        if (providerConfigReady(reply, value)) {
+          if (channel.generation === generation) {
+            _providerConfigCache = { at: now(), value, channel, generation };
+          }
+          return value;
+        }
+        lastError = new ModelProxyUnavailableError('the desktop client has not loaded its model providers yet');
+      } catch (error) {
+        // Only "no client / no answer yet" is worth waiting out.
+        if (error?.code !== 'MODEL_PROXY_UNAVAILABLE') throw error;
+        lastError = error;
+      }
+      if (Date.now() + delay > deadline) throw lastError;
+      await pause(delay);
+      delay = Math.min(delay * 2, CONFIG_RETRY_MAX_MS);
+    }
+  })();
+  const entry = { channel, generation, promise };
+  _providerConfigInFlight = entry;
+  const clear = () => {
+    if (_providerConfigInFlight === entry) _providerConfigInFlight = null;
+  };
+  promise.then(clear, clear);
+  return promise;
+}
+
+export function _resetModelProxyProviderConfigForTest() {
+  _providerConfigCache = null;
+  _providerConfigInFlight = null;
+}

package/src/runtime/agent/orchestrator/providers/muse-code-oauth-tokens.mjs

@@ -10,6 +10,7 @@ import { writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
 import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 import { accountIdentityFields, scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
+import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
 
 export const CLIENT_ID = '1031625952748946';
 export const DEVICE_AUTH_URL = 'https://auth.meta.com/oidc/device/authorization/';
@@ -44,6 +45,7 @@ const nonEmptyString = (value) => typeof value === 'string' && value.trim() !==
 export const isValidMuseCredentialDocument = (doc) => nonEmptyString(doc?.accessToken) && nonEmptyString(doc?.apiKey);
 
 export function loadTokens() {
+  if (modelProxyClientMode()) return null;
   const path = getOwnTokenPath();
   if (!existsSync(path)) return null;
   try {

package/src/runtime/agent/orchestrator/providers/muse-code-oauth.mjs

@@ -10,6 +10,15 @@ import { createHash } from 'node:crypto';
 import { noteErrorUsage } from './lib/note-error-usage.mjs';
 import { fileMtimeMs } from './lib/oauth-token-utils.mjs';
 import { OpenAICompatProvider, preloadOpenAICompatRuntime } from './openai-compat.mjs';
+import { getModelMetadataSync } from './model-catalog.mjs';
+import { makeModelCache } from './model-cache.mjs';
+import { PRICING_RATE_KEYS } from '../../../shared/llm/model-pricing-rates.mjs';
+import {
+  MUSE_DEFAULT_EFFORT_LEVELS as FIVE_LEVELS,
+  MUSE_SEED_IDS as SEED_MODELS,
+  MUSE_SPARK_MAX_OUTPUT as SPARK_MAX_OUTPUT,
+  museSeedRow,
+} from '../../../shared/llm/provider-seed-rosters.mjs';
 import {
   API_VERSION,
   MODEL_API_BASE_URL,
@@ -27,108 +36,63 @@ export {
 export { beginOAuthLogin, loginOAuth } from './muse-code-oauth-login.mjs';
 
 export const DEFAULT_MODEL = 'muse-spark-1.3';
-const FIVE_LEVELS = Object.freeze(['minimal', 'low', 'medium', 'high', 'xhigh']);
-const SIX_LEVELS = Object.freeze([...FIVE_LEVELS, 'max']);
 const effortOptions = (levels) => [{ type: 'effort', values: [...levels] }];
 // Image and voice generation ids are served by the same catalog but are not chat models.
 const NON_CHAT_MODEL_RE = /^muse-(image|voice)-/i;
-const SPARK_CONTEXT = 1_048_576;
-const SPARK_MAX_OUTPUT = 131_072;
-const STANDARD_COST = { inputCostPerM: 1.25, outputCostPerM: 4.25, cacheReadCostPerM: 0.15, cacheWriteCostPerM: 0 };
-const CONTRIBUTOR_COST = { inputCostPerM: 0.1, outputCostPerM: 0.2, cacheReadCostPerM: 0.002, cacheWriteCostPerM: 0 };
-
-// Seeded roster: the discovery endpoint lists bare ids, so limits, pricing and
-// the effort ladder come from here. Only the 1.3 revisions accept `max`.
-const SEEDS = Object.freeze({
-  'muse-spark-1.1': { name: 'Muse Spark 1.1', levels: FIVE_LEVELS, cost: STANDARD_COST },
-  'muse-spark-1.2': { name: 'Muse Spark 1.2', levels: FIVE_LEVELS, cost: STANDARD_COST },
-  'muse-spark-1.2-contributor': { name: 'Muse Spark 1.2 (C)', levels: FIVE_LEVELS, cost: CONTRIBUTOR_COST },
-  'muse-spark-1.3': { name: 'Muse Spark 1.3', levels: SIX_LEVELS, cost: STANDARD_COST },
-  'muse-spark-1.3-contributor': { name: 'Muse Spark 1.3 (C)', levels: SIX_LEVELS, cost: CONTRIBUTOR_COST },
-});
-const SEED_MODELS = Object.freeze(Object.keys(SEEDS));
-
-function seedRow(id) {
-  const seed = SEEDS[id];
-  return {
-    id,
-    name: seed.name,
-    provider: 'muse-code-oauth',
-    family: 'muse-spark',
-    contextWindow: SPARK_CONTEXT,
-    outputTokens: SPARK_MAX_OUTPUT,
-    supportsReasoning: true,
-    supportsVision: true,
-    supportsFunctionCalling: true,
-    reasoningLevels: [...seed.levels],
-    reasoningOptions: effortOptions(seed.levels),
-    ...seed.cost,
-  };
-}
-
-// Revisioned Spark ids the seed does not list inherit the newest seeded
-// revision of their tier (limits, vision, pricing) but take the five-level
-// ladder: only reviewed seeds advertise `max`.
-const SPARK_ID_RE = /^muse-spark-(\d+)\.(\d+)(?:\.(\d+))?(-contributor)?$/i;
 
-function revisionOf(id) {
-  const m = SPARK_ID_RE.exec(id);
-  return m ? [Number(m[1]), Number(m[2]), Number(m[3] || 0)] : null;
-}
+// The discovered roster (fields /models returned, never seed values) is
+// persisted so the shared sync lookup sees what listModels found.
+const museModelCache = makeModelCache({
+  fileName: 'muse-code-oauth-models.json',
+  ttlMs: 24 * 60 * 60 * 1000,
+  version: 1,
+});
 
-function compareRevision(a, b) {
-  for (let i = 0; i < 3; i += 1) if (a[i] !== b[i]) return a[i] - b[i];
-  return 0;
+// Row fields the shared metadata lookup resolves: live roster, models.dev
+// `meta`, verified corrections, then the offline seed (provider-seed-rosters).
+const LOOKUP_FIELDS = Object.freeze([
+  'contextWindow',
+  'outputTokens',
+  ...PRICING_RATE_KEYS,
+  'supportsReasoning',
+  'supportsVision',
+  'supportsFunctionCalling',
+  'reasoningOptions',
+]);
+
+// Labels compare without the trailing "(C)" tier marker, case or punctuation.
+const nameKey = (name) =>
+  String(name || '')
+    .replace(/\s*\(c\)\s*$/i, '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '');
+
+// A discovered or catalog label naming the seeded model keeps the seed's "(C)" marker.
+function tierName(candidate, seedName) {
+  if (!candidate) return '';
+  return seedName && nameKey(candidate) === nameKey(seedName) ? seedName : candidate;
 }
 
-function lineageRow(id) {
-  if (SEEDS[id]) return null;
-  const match = SPARK_ID_RE.exec(id);
-  if (!match) return null;
-  const contributor = Boolean(match[4]);
-  let template = null;
-  let templateRevision = null;
-  for (const seedId of SEED_MODELS) {
-    if (SPARK_ID_RE.exec(seedId)[4] ? !contributor : contributor) continue;
-    const candidate = revisionOf(seedId);
-    if (!templateRevision || compareRevision(candidate, templateRevision) > 0) {
-      template = seedId;
-      templateRevision = candidate;
-    }
+// Discovered fields win, then the shared lookup (fetched catalogs before
+// seeds). Rows that report no effort ladder gain the default five levels
+// unless a source declares the model non-reasoning.
+function museRow(id, discovered = null) {
+  const meta = getModelMetadataSync(id, 'muse-code-oauth');
+  if (!meta && !discovered) return null;
+  const row = { id, provider: 'muse-code-oauth', family: 'muse-spark' };
+  for (const key of LOOKUP_FIELDS) {
+    const value = meta?.[key];
+    if (value != null && !(Array.isArray(value) && !value.length)) row[key] = value;
   }
-  if (!template) return null;
-  const revision =
-    match[3] && Number(match[3]) !== 0 ? `${match[1]}.${match[2]}.${match[3]}` : `${match[1]}.${match[2]}`;
-  return {
-    ...seedRow(template),
-    id,
-    name: `Muse Spark ${revision}${contributor ? ' (C)' : ''}`,
-    reasoningLevels: [...FIVE_LEVELS],
-    reasoningOptions: effortOptions(FIVE_LEVELS),
-  };
-}
-
-// Seeds win for the ids they cover; lineage rows yield to discovered metadata.
-// A name supplied by discovery is always kept. Other discovered rows keep
-// their own metadata and only gain the default effort ladder when they report none.
-function museRow(id, discovered) {
+  Object.assign(row, discovered || {});
   const discoveredName =
     typeof discovered?.name === 'string' && discovered.name && discovered.name !== id ? discovered.name : '';
-  if (SEEDS[id]) return { ...(discovered || {}), ...seedRow(id), ...(discoveredName ? { name: discoveredName } : {}) };
-  const lineage = lineageRow(id);
-  const row = {
-    id,
-    name: id,
-    provider: 'muse-code-oauth',
-    family: 'muse-spark',
-    ...(lineage || {}),
-    ...(discovered || {}),
-  };
-  if (discoveredName) row.name = discoveredName;
-  else if (lineage) row.name = lineage.name;
-  if (!row.reasoningOptions?.length) {
-    row.reasoningOptions = effortOptions(FIVE_LEVELS);
-    row.reasoningLevels = [...FIVE_LEVELS];
+  row.name = tierName(discoveredName || meta?.displayName, museSeedRow(id)?.name) || id;
+  // A model declared non-reasoning gets no default ladder.
+  if (!row.reasoningOptions?.length)
+    row.reasoningOptions = row.supportsReasoning === false ? [] : effortOptions(FIVE_LEVELS);
+  if (!row.reasoningLevels?.length) {
+    row.reasoningLevels = [...(row.reasoningOptions.find((o) => o?.type === 'effort')?.values || [])];
   }
   return row;
 }
@@ -414,12 +378,9 @@ export class MuseCodeOAuthProvider {
     });
     this._innerKey = apiKey;
     // The Responses builder reads limits and the effort ladder from the inner
-    // provider's cached model row; seeds fill in what discovery omits.
+    // provider's cached model row; the shared lookup fills what discovery omits.
     const innerRow = this._inner.getCachedModelInfo.bind(this._inner);
-    this._inner.getCachedModelInfo = (model) => {
-      const discovered = innerRow(model);
-      return discovered || SEEDS[model] || lineageRow(model) ? museRow(model, discovered) : null;
-    };
+    this._inner.getCachedModelInfo = (model) => museRow(model, innerRow(model));
     return this._inner;
   }
 
@@ -452,6 +413,8 @@ export class MuseCodeOAuthProvider {
   async listModels() {
     const { apiKey } = await this.ensureAuth();
     const inner = this._ensureInner(apiKey);
+    // Only the latest request, fetched with the still-active key, publishes.
+    const publish = museModelCache.beginSave(() => loadTokens()?.apiKey === apiKey);
     let items;
     try {
       items = await inner._fetchModelItems();
@@ -460,25 +423,29 @@ export class MuseCodeOAuthProvider {
       return SEED_MODELS.map((id) => museRow(id));
     }
     // A successful roster is authoritative, even when it holds no chat models.
-    const rows = (Array.isArray(items) ? items : [])
+    const discovered = (Array.isArray(items) ? items : [])
       .filter((m) => typeof m?.id === 'string' && m.id && !NON_CHAT_MODEL_RE.test(m.id))
       .map((m) => {
         const contextWindow = Number(m.context_window ?? m.max_context_window ?? m.context_length ?? 0);
         const outputTokens = Number(m.max_output_tokens ?? m.output_tokens ?? 0);
         const name = [m.name, m.display_name].find((v) => typeof v === 'string' && v.trim());
-        return museRow(m.id, {
+        return {
+          id: m.id,
+          provider: 'muse-code-oauth',
           ...(name ? { name: name.trim() } : {}),
           ...(contextWindow > 0 ? { contextWindow } : {}),
           ...(outputTokens > 0 ? { outputTokens } : {}),
           ...(typeof m.created === 'number' ? { created: m.created } : {}),
-        });
+        };
       });
-    inner._enrichedModels = rows;
+    const rows = discovered.map((row) => museRow(row.id, row));
+    // A superseded or other-credential response never replaces the live roster either.
+    if (publish(discovered)) inner._enrichedModels = rows;
     return rows;
   }
 
   getCachedModelInfo(model) {
-    return this._inner?.getCachedModelInfo?.(model) || (SEEDS[model] || lineageRow(model) ? museRow(model) : null);
+    return this._inner?.getCachedModelInfo?.(model) || museRow(model);
   }
 
   /** Subscription window/weekly usage, read from the key endpoint without onboarding. */

package/src/runtime/agent/orchestrator/providers/oauth-credential-probes.mjs

@@ -6,6 +6,7 @@ import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs
 import { cursorTokenExpiry } from './cursor-auth.mjs';
 import { isValidMuseCredentialDocument } from './muse-code-oauth-tokens.mjs';
 import { developerOptionEnabled, developerOptionForProvider } from '../../../shared/developer-options.mjs';
+import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
 
 const ANTHROPIC_DEFAULT_CREDENTIALS_PATH = join(resolvePluginData(), 'anthropic-oauth-credentials.json');
 
@@ -100,6 +101,8 @@ function credentialPathsSignature(paths, extra = '') {
 }
 
 function memoProbe(key, paths, compute, extraSignature = '') {
+  // Remote mode: no credential file on this server is ever read.
+  if (modelProxyClientMode()) return 'absent';
   const signature = credentialPathsSignature(paths, extraSignature);
   const hit = _probeCache.get(key);
   const now = Date.now();

package/src/runtime/agent/orchestrator/providers/openai-compat.mjs

@@ -12,6 +12,7 @@ import {
   useXaiResponsesWebSocket as preferXaiResponsesWebSocket,
   _shouldFallbackXaiWsToHttp,
 } from './openai-compat-xai.mjs';
+import { withEffortRejectionFallback } from './effort-rejection.mjs';
 import { sendCompatResponses } from './openai-compat-responses.mjs';
 import { sendCompatChat, recoverCompatNonStreaming } from './openai-compat-chat-send.mjs';
 import { sendXaiResponses, sendXaiResponsesWebSocket } from './openai-compat-xai-send.mjs';
@@ -161,7 +162,11 @@ export class OpenAICompatProvider {
   }
   async _doSend(messages, model, tools, sendOpts) {
     const useModel = model || this.defaultModel;
-    const opts = sendOpts || {};
+    return withEffortRejectionFallback(this.name, useModel, sendOpts || {}, this.config?.reasoningEffort, (opts) =>
+      this._sendWithOpts(messages, useModel, tools, opts)
+    );
+  }
+  async _sendWithOpts(messages, useModel, tools, opts) {
     // Re-warm a kept-alive socket to the provider origin before the turn so
     // the request hot path lands on a live socket instead of paying a cold
     // TLS handshake after an idle gap. Fire-and-forget; never awaited.

package/src/runtime/agent/orchestrator/providers/openai-oauth-catalog-store.mjs

@@ -13,7 +13,7 @@ import { formatScheduleModelRef, parseScheduleModelRef } from '../../../shared/s
 export const CODEX_MODEL_CACHE_OPTIONS = Object.freeze({
   fileName: 'openai-oauth-models.json',
   ttlMs: 24 * 60 * 60_000,
-  version: 6,
+  version: 7,
 });
 
 export const CODEX_PROVIDER_ID = 'openai-oauth';

package/src/runtime/agent/orchestrator/providers/openai-oauth-catalog.mjs

@@ -13,7 +13,6 @@
 import { makeModelCache } from './model-cache.mjs';
 import { CODEX_MODEL_CACHE_OPTIONS } from './openai-oauth-catalog-store.mjs';
 import { enrichModels } from './model-catalog.mjs';
-import { sanitizeModelList } from './model-list-sanitize.mjs';
 import { modelSupportsServiceTier } from './model-service-tiers.mjs';
 import { codexClientVersionSync, warmCodexClientVersion } from './codex-client-meta.mjs';
 import { compareSemver, maxSemver } from './npm-cli-version.mjs';
@@ -131,7 +130,11 @@ async function fetchCodexCatalog(ensureAuth, label) {
   const items = Array.isArray(data?.models) ? data.models : [];
   const normalized = items.map((m) => _normalizeCodexModel(m));
   _markLatestCodex(normalized);
-  const enriched = sanitizeModelList((await enrichModels(normalized)).filter(Boolean), { provider: 'openai-oauth' });
+  // The backend curates this list per account and client version and marks
+  // each row's picker visibility itself, so every row is kept: generic list
+  // pruning (external release dates, id patterns) dropped models it still
+  // serves, along with their access programs.
+  const enriched = (await enrichModels(normalized)).filter(Boolean);
   _modelCache.save(enriched, { clientVersion });
   return enriched;
 }

package/src/runtime/agent/orchestrator/providers/openai-oauth-tokens.mjs

@@ -18,6 +18,7 @@ import { getPluginData } from '../config.mjs';
 import { writeJsonAtomicSync, withFileLock } from '../../../shared/atomic-file.mjs';
 import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
+import { modelProxyClientMode, serverModelCredentialsDisabledError } from '../../../shared/model-proxy-mode.mjs';
 import {
   accountIdentityFields,
   decodeJwtPayload,
@@ -101,6 +102,7 @@ export function tokensFileMtimeMs() {
 }
 
 export function loadTokens() {
+  if (modelProxyClientMode()) return null;
   const ownPath = getOwnTokenPath();
   if (!existsSync(ownPath)) return null;
   try {
@@ -322,6 +324,7 @@ async function refreshUnderLock({ currentToken, force, reason, startingTokens })
  * the provider can hold off re-attempting until the expiry skew.
  */
 export async function refreshStoredTokens({ current = null, force = false, reason = 'preemptive' } = {}) {
+  if (modelProxyClientMode()) throw serverModelCredentialsDisabledError('OpenAI OAuth credentials');
   const currentToken = current?.access_token || null;
   const disk = loadTokens();
   const adopted = adoptableDiskTokens(currentToken, disk, force);

package/src/runtime/agent/orchestrator/providers/registry.mjs

@@ -6,6 +6,7 @@ import { createAccountPoolProvider } from './account-pool.mjs';
 import { isInclusiveProvider } from '../../../shared/llm/cost.mjs';
 import { noEnabledProvidersError } from './registry-errors.mjs';
 import { providerTakesNativePdf } from '../../../attachments/store.mjs';
+import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
 // OpenAI-compat provider names are self-declared by openai-compat-presets.mjs via
 // OPENAI_COMPAT_PRESETS. No parallel list maintained here.
 const providers = new Map();
@@ -176,6 +177,12 @@ async function loadProviderCtor(name, signal = null, cfg = null) {
 }
 
 async function instantiateProvider(name, Ctor, cfg) {
+  // Remote mode: the client PC executes the call with its own credentials.
+  // Admission and usage accounting still wrap the daemon-side stand-in.
+  if (modelProxyClientMode()) {
+    const { createModelProxyProvider } = await import('./model-proxy-provider.mjs');
+    return wrapProviderAdmission(createModelProxyProvider(name, cfg), name);
+  }
   if (isCustomProviderConfig(name, cfg)) return wrapProviderAdmission(await Ctor(name, cfg), name);
   if (Object.hasOwn(OPENAI_COMPAT_PRESETS, name) && name !== 'opencode-go') {
     return wrapProviderAdmission(new Ctor(name, cfg), name);
@@ -185,6 +192,12 @@ async function instantiateProvider(name, Ctor, cfg) {
 
 export async function initProviders(config, { signal = null } = {}) {
   throwIfAborted(signal);
+  // Remote mode: provider availability and config are the PC's, never this
+  // server's credential probes. No connected client fails here, clearly.
+  if (modelProxyClientMode()) {
+    const { loadModelProxyProviderConfig } = await import('./model-proxy-provider.mjs');
+    config = await awaitWithAbort(loadModelProxyProviderConfig(), signal);
+  }
   const sig = configSignature(config);
   // Coalesce: an identical config is already mid-init — attach to it.
   if (sig !== null && _inFlightPromise && _inFlightSig === sig) {
@@ -254,7 +267,8 @@ async function _initProvidersUnsynchronized(config, signal = null) {
         return { name, inst: providers.get(name), sig };
       }
       try {
-        const Ctor = await loadProviderCtor(name, signal, cfg);
+        // A proxied provider never loads the real adapter module.
+        const Ctor = modelProxyClientMode() ? null : await loadProviderCtor(name, signal, cfg);
         throwIfAborted(signal);
         const inst = await instantiateProvider(name, Ctor, cfg);
         return { name, inst, sig };

package/src/runtime/agent/orchestrator/runtime-core/builtin-features.mjs

@@ -30,6 +30,7 @@ import { setBuiltinInstalledInConfig, withGrandfatheredBuiltins } from '../../..
 const BROWSER_BRIDGE_DISCOVERY_FILE = 'browser-bridge.json';
 const COMPUTER_BRIDGE_DISCOVERY_FILE = 'computer-bridge.json';
 const TERMINAL_BRIDGE_DISCOVERY_FILE = 'terminal-bridge.json';
+const VISUALIZE_BRIDGE_DISCOVERY_FILE = 'visualize-bridge.json';
 
 function bridgePresent(file) {
   try {
@@ -116,6 +117,14 @@ export function builtinFeatureActive(configLike, id) {
   if (id === 'terminal') {
     return featureEnvOverride('MIXDOG_FEATURE_TERMINAL') ?? bridgePresent(TERMINAL_BRIDGE_DISCOVERY_FILE);
   }
+  // Visualize shows artifacts in the desktop side panel: no install step, on
+  // unless the user turns it off, and only while the desktop bridge is up.
+  if (id === 'visualize') {
+    return (
+      featureEnvOverride('MIXDOG_FEATURE_VISUALIZE') ??
+      (moduleEnabled(configLike, 'visualize', true) && bridgePresent(VISUALIZE_BRIDGE_DISCOVERY_FILE))
+    );
+  }
   return false;
 }
 
@@ -148,6 +157,7 @@ export function featureDisallowedToolsFor(
     ...(builtinFeatureActive(configLike, 'office') ? [] : ['office']),
     ...(builtinFeatureActive(configLike, 'media') ? [] : ['media']),
     ...(builtinFeatureActive(configLike, 'tidy') ? [] : ['tidy']),
+    ...(builtinFeatureActive(configLike, 'visualize') ? [] : ['visualize']),
   ];
   // Headless exec uses the Lead surface and excludes Skill/MCP tools. When
   // only its eager defaults remain, neither schemas nor loader guidance help.