mixdog 1.1.2 → 1.2.1

package/src/runtime/agent/orchestrator/providers/openai-compat.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from 'node:module';
 import { noteErrorUsage } from './lib/note-error-usage.mjs';
-import { getAgentApiKey } from '../../../shared/provider-api-key.mjs';
+import { reloadProviderApiKey, resolveProviderApiKey } from '../../../shared/provider-api-key.mjs';
 import { getLlmDispatcher, preconnect } from '../../../shared/llm/http-agent.mjs';
 import { appendAgentTrace } from '../agent-trace.mjs';
 import { OPENAI_COMPAT_PRESETS } from './openai-compat-presets.mjs';
@@ -12,6 +12,7 @@ import {
   useXaiResponsesWebSocket as preferXaiResponsesWebSocket,
   _shouldFallbackXaiWsToHttp,
 } from './openai-compat-xai.mjs';
+import { withEffortRejectionFallback } from './effort-rejection.mjs';
 import { sendCompatResponses } from './openai-compat-responses.mjs';
 import { sendCompatChat, recoverCompatNonStreaming } from './openai-compat-chat-send.mjs';
 import { sendXaiResponses, sendXaiResponsesWebSocket } from './openai-compat-xai-send.mjs';
@@ -68,7 +69,7 @@ export class OpenAICompatProvider {
   constructor(name, config) {
     const preset = PRESETS[name];
     const baseURL = assertSafeBaseURL(config.baseURL || preset?.baseURL || 'http://localhost:8080/v1', name);
-    const apiKey = config.apiKey || 'no-key';
+    const apiKey = resolveProviderApiKey(name, config) || 'no-key';
     this.name = name;
     this.config = config;
     this.baseURL = baseURL;
@@ -120,7 +121,7 @@ export class OpenAICompatProvider {
   reloadApiKey() {
     try {
       const preset = PRESETS[this.name];
-      const newKey = getAgentApiKey(this.name) || this.config.apiKey;
+      const newKey = reloadProviderApiKey(this.name, this.config);
       const baseURL = assertSafeBaseURL(
         this.config.baseURL || preset?.baseURL || 'http://localhost:8080/v1',
         this.name
@@ -137,6 +138,12 @@ export class OpenAICompatProvider {
     }
   }
   async send(messages, model, tools, sendOpts) {
+    // A keyless-constructed instance picks up the key once it is available.
+    const resolvedKey = resolveProviderApiKey(this.name, this.config) || 'no-key';
+    if (resolvedKey !== this.apiKey) {
+      this.apiKey = resolvedKey;
+      this.client = this._createClient(resolvedKey);
+    }
     try {
       return await this._doSend(messages, model, tools, sendOpts);
     } catch (err) {
@@ -161,7 +168,11 @@ export class OpenAICompatProvider {
   }
   async _doSend(messages, model, tools, sendOpts) {
     const useModel = model || this.defaultModel;
-    const opts = sendOpts || {};
+    return withEffortRejectionFallback(this.name, useModel, sendOpts || {}, this.config?.reasoningEffort, (opts) =>
+      this._sendWithOpts(messages, useModel, tools, opts)
+    );
+  }
+  async _sendWithOpts(messages, useModel, tools, opts) {
     // Re-warm a kept-alive socket to the provider origin before the turn so
     // the request hot path lands on a live socket instead of paying a cold
     // TLS handshake after an idle gap. Fire-and-forget; never awaited.

package/src/runtime/agent/orchestrator/providers/openai-oauth-catalog-store.mjs

@@ -13,7 +13,7 @@ import { formatScheduleModelRef, parseScheduleModelRef } from '../../../shared/s
 export const CODEX_MODEL_CACHE_OPTIONS = Object.freeze({
   fileName: 'openai-oauth-models.json',
   ttlMs: 24 * 60 * 60_000,
-  version: 6,
+  version: 7,
 });
 
 export const CODEX_PROVIDER_ID = 'openai-oauth';

package/src/runtime/agent/orchestrator/providers/openai-oauth-catalog.mjs

@@ -13,7 +13,6 @@
 import { makeModelCache } from './model-cache.mjs';
 import { CODEX_MODEL_CACHE_OPTIONS } from './openai-oauth-catalog-store.mjs';
 import { enrichModels } from './model-catalog.mjs';
-import { sanitizeModelList } from './model-list-sanitize.mjs';
 import { modelSupportsServiceTier } from './model-service-tiers.mjs';
 import { codexClientVersionSync, warmCodexClientVersion } from './codex-client-meta.mjs';
 import { compareSemver, maxSemver } from './npm-cli-version.mjs';
@@ -131,7 +130,11 @@ async function fetchCodexCatalog(ensureAuth, label) {
   const items = Array.isArray(data?.models) ? data.models : [];
   const normalized = items.map((m) => _normalizeCodexModel(m));
   _markLatestCodex(normalized);
-  const enriched = sanitizeModelList((await enrichModels(normalized)).filter(Boolean), { provider: 'openai-oauth' });
+  // The backend curates this list per account and client version and marks
+  // each row's picker visibility itself, so every row is kept: generic list
+  // pruning (external release dates, id patterns) dropped models it still
+  // serves, along with their access programs.
+  const enriched = (await enrichModels(normalized)).filter(Boolean);
   _modelCache.save(enriched, { clientVersion });
   return enriched;
 }

package/src/runtime/agent/orchestrator/providers/openai-oauth-tokens.mjs

@@ -18,6 +18,7 @@ import { getPluginData } from '../config.mjs';
 import { writeJsonAtomicSync, withFileLock } from '../../../shared/atomic-file.mjs';
 import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
+import { modelProxyClientMode, serverModelCredentialsDisabledError } from '../../../shared/model-proxy-mode.mjs';
 import {
   accountIdentityFields,
   decodeJwtPayload,
@@ -101,6 +102,7 @@ export function tokensFileMtimeMs() {
 }
 
 export function loadTokens() {
+  if (modelProxyClientMode()) return null;
   const ownPath = getOwnTokenPath();
   if (!existsSync(ownPath)) return null;
   try {
@@ -322,6 +324,7 @@ async function refreshUnderLock({ currentToken, force, reason, startingTokens })
  * the provider can hold off re-attempting until the expiry skew.
  */
 export async function refreshStoredTokens({ current = null, force = false, reason = 'preemptive' } = {}) {
+  if (modelProxyClientMode()) throw serverModelCredentialsDisabledError('OpenAI OAuth credentials');
   const currentToken = current?.access_token || null;
   const disk = loadTokens();
   const adopted = adoptableDiskTokens(currentToken, disk, force);

package/src/runtime/agent/orchestrator/providers/openai-ws.mjs

@@ -23,7 +23,7 @@ import { resolveOpenAiTransportPolicy } from './openai-transport-policy.mjs';
 import { applyOpenAIDirectCachePolicy } from './openai-direct-request.mjs';
 import { streamCallbacks } from './lib/send-callbacks.mjs';
 import { noteErrorUsage } from './lib/note-error-usage.mjs';
-import { getAgentApiKey } from '../../../shared/provider-api-key.mjs';
+import { reloadProviderApiKey, resolveProviderApiKey } from '../../../shared/provider-api-key.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 import { noteRequestServiceTier } from '../../../shared/llm/usage-context.mjs';
 import { resolveProviderCacheKey, resolveProviderPromptCacheLane } from '../agent-runtime/cache-strategy.mjs';
@@ -86,7 +86,7 @@ export class OpenAIDirectProvider {
     this.config = config || {};
   }
   _ensureKey() {
-    const k = this.config.apiKey;
+    const k = resolveProviderApiKey('openai', this.config);
     if (!k) throw new Error('OPENAI_API_KEY not configured (providers.openai.apiKey)');
     return k;
   }
@@ -97,7 +97,7 @@ export class OpenAIDirectProvider {
   // the WS/HTTP transports take the key per-call via the `auth` object.
   reloadApiKey() {
     try {
-      const newKey = getAgentApiKey('openai') || this.config.apiKey;
+      const newKey = reloadProviderApiKey('openai', this.config);
       if (newKey) {
         this.config = { ...(this.config || {}), apiKey: newKey };
         return newKey;
@@ -295,6 +295,6 @@ export class OpenAIDirectProvider {
     }
   }
   async isAvailable() {
-    return !!this.config.apiKey;
+    return !!resolveProviderApiKey('openai', this.config);
   }
 }

package/src/runtime/agent/orchestrator/providers/registry.mjs

@@ -6,6 +6,8 @@ import { createAccountPoolProvider } from './account-pool.mjs';
 import { isInclusiveProvider } from '../../../shared/llm/cost.mjs';
 import { noEnabledProvidersError } from './registry-errors.mjs';
 import { providerTakesNativePdf } from '../../../attachments/store.mjs';
+import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
+import { getModelProxyChannel } from './model-proxy-channel.mjs';
 // OpenAI-compat provider names are self-declared by openai-compat-presets.mjs via
 // OPENAI_COMPAT_PRESETS. No parallel list maintained here.
 const providers = new Map();
@@ -27,6 +29,7 @@ const OAUTH_PROVIDER_NAMES = new Set([
   'openai-oauth',
   'grok-oauth',
   'muse-code-oauth',
+  'command-code-oauth',
   'mimo-oauth',
   'cursor-oauth',
   'antigravity-oauth',
@@ -95,6 +98,28 @@ function configSignature(cfg) {
   }
 }
 
+// Remote mode: a proxy provider sends through the channel it was built on. A
+// headless boundary installs a fresh channel per run (model-proxy-bridge.mjs)
+// and closes it afterwards, so the channel's identity is part of every reuse
+// signature — an identical PC config behind a new channel is a rebuild, never
+// a provider bound to a closed channel. Local mode: '' (signatures unchanged).
+const _proxyChannelIds = new WeakMap();
+let _proxyChannelSeq = 0;
+function proxyChannelTag(channel) {
+  if (!channel) return '';
+  let id = _proxyChannelIds.get(channel);
+  if (!id) {
+    _proxyChannelSeq += 1;
+    id = _proxyChannelSeq;
+    _proxyChannelIds.set(channel, id);
+  }
+  return `\u0000model-proxy-channel:${id}`;
+}
+function reuseSignature(cfg, proxyChannel) {
+  const sig = configSignature(cfg);
+  return sig === null ? null : sig + proxyChannelTag(proxyChannel);
+}
+
 function abortError(signal) {
   return signal?.reason instanceof Error
     ? signal.reason
@@ -146,6 +171,7 @@ const PROVIDER_MODULES = {
   'anthropic-oauth': ['./anthropic-oauth.mjs', 'AnthropicOAuthProvider'],
   'grok-oauth': ['./grok-oauth.mjs', 'GrokOAuthProvider'],
   'muse-code-oauth': ['./muse-code-oauth.mjs', 'MuseCodeOAuthProvider'],
+  'command-code-oauth': ['./command-code-oauth.mjs', 'CommandCodeOAuthProvider'],
   'mimo-oauth': ['./mimo-oauth.mjs', 'MimoOAuthProvider'],
   'cursor-oauth': ['./cursor.mjs', 'CursorOAuthProvider'],
   'antigravity-oauth': ['./antigravity-oauth.mjs', 'AntigravityOAuthProvider'],
@@ -175,7 +201,13 @@ async function loadProviderCtor(name, signal = null, cfg = null) {
   throw new Error(`unknown enabled provider: ${name}`);
 }
 
-async function instantiateProvider(name, Ctor, cfg) {
+async function instantiateProvider(name, Ctor, cfg, proxyChannel = null) {
+  // Remote mode: the client PC executes the call with its own credentials.
+  // Admission and usage accounting still wrap the daemon-side stand-in.
+  if (modelProxyClientMode()) {
+    const { createModelProxyProvider } = await import('./model-proxy-provider.mjs');
+    return wrapProviderAdmission(createModelProxyProvider(name, cfg, proxyChannel ?? getModelProxyChannel()), name);
+  }
   if (isCustomProviderConfig(name, cfg)) return wrapProviderAdmission(await Ctor(name, cfg), name);
   if (Object.hasOwn(OPENAI_COMPAT_PRESETS, name) && name !== 'opencode-go') {
     return wrapProviderAdmission(new Ctor(name, cfg), name);
@@ -185,7 +217,14 @@ async function instantiateProvider(name, Ctor, cfg) {
 
 export async function initProviders(config, { signal = null } = {}) {
   throwIfAborted(signal);
-  const sig = configSignature(config);
+  // Remote mode: provider availability and config are the PC's, never this
+  // server's credential probes. No connected client fails here, clearly.
+  const proxyChannel = modelProxyClientMode() ? getModelProxyChannel() : null;
+  if (proxyChannel) {
+    const { loadModelProxyProviderConfig } = await import('./model-proxy-provider.mjs');
+    config = await awaitWithAbort(loadModelProxyProviderConfig({ channel: proxyChannel }), signal);
+  }
+  const sig = reuseSignature(config, proxyChannel);
   // Coalesce: an identical config is already mid-init — attach to it.
   if (sig !== null && _inFlightPromise && _inFlightSig === sig) {
     return awaitWithAbort(_inFlightPromise, signal);
@@ -199,7 +238,7 @@ export async function initProviders(config, { signal = null } = {}) {
   // signatures can never run their clear()+rebuild concurrently, regardless
   // of caller-side gating (agent-tool gateOnPrior may release a queued init
   // before the prior one settled). Errors do not poison the chain.
-  const run = () => _initProvidersUnsynchronized(config, signal);
+  const run = () => _initProvidersUnsynchronized(config, signal, proxyChannel);
   const next = _initChain.then(run, run);
   _initChain = next.then(
     () => {},
@@ -228,7 +267,7 @@ export async function initProviders(config, { signal = null } = {}) {
   return awaitWithAbort(tracked, signal);
 }
 
-async function _initProvidersUnsynchronized(config, signal = null) {
+async function _initProvidersUnsynchronized(config, signal = null, proxyChannel = null) {
   throwIfAborted(signal);
   // Invariant: never wipe the live registry based on an empty / all-disabled
   // config. Without this guard, a stale `loadAgentConfig()` (e.g. mid-reload
@@ -249,14 +288,15 @@ async function _initProvidersUnsynchronized(config, signal = null) {
       // Idempotent reuse: an enabled provider whose config signature is
       // unchanged from the live registry is carried forward as-is. Only
       // added or changed providers are (re)constructed below.
-      const sig = configSignature(cfg);
+      const sig = reuseSignature(cfg, proxyChannel);
       if (sig !== null && providers.has(name) && signatures.get(name) === sig) {
         return { name, inst: providers.get(name), sig };
       }
       try {
-        const Ctor = await loadProviderCtor(name, signal, cfg);
+        // A proxied provider never loads the real adapter module.
+        const Ctor = modelProxyClientMode() ? null : await loadProviderCtor(name, signal, cfg);
         throwIfAborted(signal);
-        const inst = await instantiateProvider(name, Ctor, cfg);
+        const inst = await instantiateProvider(name, Ctor, cfg, proxyChannel);
         return { name, inst, sig };
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);

package/src/runtime/agent/orchestrator/runtime-core/builtin-features.mjs

@@ -30,6 +30,7 @@ import { setBuiltinInstalledInConfig, withGrandfatheredBuiltins } from '../../..
 const BROWSER_BRIDGE_DISCOVERY_FILE = 'browser-bridge.json';
 const COMPUTER_BRIDGE_DISCOVERY_FILE = 'computer-bridge.json';
 const TERMINAL_BRIDGE_DISCOVERY_FILE = 'terminal-bridge.json';
+const VISUALIZE_BRIDGE_DISCOVERY_FILE = 'visualize-bridge.json';
 
 function bridgePresent(file) {
   try {
@@ -116,6 +117,14 @@ export function builtinFeatureActive(configLike, id) {
   if (id === 'terminal') {
     return featureEnvOverride('MIXDOG_FEATURE_TERMINAL') ?? bridgePresent(TERMINAL_BRIDGE_DISCOVERY_FILE);
   }
+  // Visualize shows artifacts in the desktop side panel: no install step, on
+  // unless the user turns it off, and only while the desktop bridge is up.
+  if (id === 'visualize') {
+    return (
+      featureEnvOverride('MIXDOG_FEATURE_VISUALIZE') ??
+      (moduleEnabled(configLike, 'visualize', true) && bridgePresent(VISUALIZE_BRIDGE_DISCOVERY_FILE))
+    );
+  }
   return false;
 }
 
@@ -148,6 +157,7 @@ export function featureDisallowedToolsFor(
     ...(builtinFeatureActive(configLike, 'office') ? [] : ['office']),
     ...(builtinFeatureActive(configLike, 'media') ? [] : ['media']),
     ...(builtinFeatureActive(configLike, 'tidy') ? [] : ['tidy']),
+    ...(builtinFeatureActive(configLike, 'visualize') ? [] : ['visualize']),
   ];
   // Headless exec uses the Lead surface and excludes Skill/MCP tools. When
   // only its eager defaults remain, neither schemas nor loader guidance help.

package/src/runtime/agent/orchestrator/runtime-core/config-helpers.mjs

@@ -3,6 +3,7 @@
 import { clean, hasOwn } from './session-text.mjs';
 import { normalizeEffortInput, normalizeSavedEffort } from './effort.mjs';
 import { routeFastKey, fastPreferenceFor } from './model-capabilities.mjs';
+import { normalizeContextTokens } from '../../../shared/llm/default-context-window.mjs';
 
 const DEFAULT_PROVIDER = 'anthropic-oauth';
 export const DEFAULT_MODEL = '';
@@ -53,6 +54,14 @@ function cleanContextPercent(value) {
   return Math.max(10, Math.min(100, Math.round(percent / 10) * 10));
 }
 
+/** The route's exact window in tokens: an explicit request, else none when a
+ *  percent is chosen instead, else the saved or preset selection. */
+function resolveContextTokens({ contextTokens, hasExplicitContextPercent, saved, preset = null }) {
+  if (contextTokens !== undefined) return normalizeContextTokens(contextTokens);
+  if (hasExplicitContextPercent) return undefined;
+  return normalizeContextTokens(saved.contextTokens ?? preset?.contextTokens);
+}
+
 /** The route's fast flag: an explicit request, else the saved choice, else the preset or the provider preference. */
 function resolveFast({ hasExplicitFast, explicitFast, saved, presetFast = false, preference }) {
   if (hasExplicitFast) return explicitFast;
@@ -60,8 +69,19 @@ function resolveFast({ hasExplicitFast, explicitFast, saved, presetFast = false,
   return presetFast || preference();
 }
 
+/** The route's Auto effort flag: an explicit request, else the saved choice,
+ *  else the preset. Absent means on; only `false` turns it off. */
+function resolveAutoEffort({ autoEffort, saved, preset = null }) {
+  if (autoEffort !== undefined) return autoEffort !== false;
+  if (hasOwn(saved, 'autoEffort')) return saved.autoEffort !== false;
+  return preset?.autoEffort !== false;
+}
+
 export function makeResolveRoute(resolveDefaultProvider) {
-  return function resolveRoute(config, { provider, model, effort, fast, modelParameters, contextPercent } = {}) {
+  return function resolveRoute(
+    config,
+    { provider, model, effort, fast, autoEffort, modelParameters, contextPercent, contextTokens } = {}
+  ) {
     const explicitProvider = clean(provider);
     const explicitModel = clean(model);
     const hasExplicitEffort = effort !== undefined;
@@ -70,6 +90,9 @@ export function makeResolveRoute(resolveDefaultProvider) {
     const explicitFast = fast === true;
     const hasExplicitModelParameters = modelParameters !== undefined;
     const hasExplicitContextPercent = contextPercent !== undefined;
+    // An exact token selection replaces a saved percent unless a percent is
+    // requested alongside it.
+    const keepsSavedPercent = contextTokens === undefined;
 
     if (!explicitProvider) {
       const preset = findPreset(config, explicitModel || config?.default);
@@ -78,6 +101,7 @@ export function makeResolveRoute(resolveDefaultProvider) {
         const m = clean(preset.model) || DEFAULT_MODEL;
         if (p && m) {
           const saved = modelSettingsFor(config, p, m);
+          const tokens = resolveContextTokens({ contextTokens, hasExplicitContextPercent, saved, preset });
           return {
             provider: p,
             model: m,
@@ -90,12 +114,16 @@ export function makeResolveRoute(resolveDefaultProvider) {
               presetFast: preset.fast === true,
               preference: () => fastPreferenceFor(config, p, m),
             }),
+            autoEffort: resolveAutoEffort({ autoEffort, saved, preset }),
             modelParameters: hasExplicitModelParameters
               ? cleanModelParameters(modelParameters)
               : cleanModelParameters(saved.modelParameters ?? preset.modelParameters),
             contextPercent: hasExplicitContextPercent
               ? cleanContextPercent(contextPercent)
-              : cleanContextPercent(saved.contextPercent ?? preset.contextPercent),
+              : keepsSavedPercent
+                ? cleanContextPercent(saved.contextPercent ?? preset.contextPercent)
+                : undefined,
+            ...(tokens ? { contextTokens: tokens } : {}),
           };
         }
       }
@@ -104,18 +132,23 @@ export function makeResolveRoute(resolveDefaultProvider) {
     const p = explicitProvider || resolveDefaultProvider(config);
     const m = explicitModel || DEFAULT_MODEL;
     const saved = modelSettingsFor(config, p, m);
+    const tokens = resolveContextTokens({ contextTokens, hasExplicitContextPercent, saved });
     return {
       provider: p,
       model: m,
       preset: null,
       effort: hasExplicitEffort ? explicitEffort : normalizeSavedEffort(saved.effort),
       fast: resolveFast({ hasExplicitFast, explicitFast, saved, preference: () => fastPreferenceFor(config, p, m) }),
+      autoEffort: resolveAutoEffort({ autoEffort, saved }),
       modelParameters: hasExplicitModelParameters
         ? cleanModelParameters(modelParameters)
         : cleanModelParameters(saved.modelParameters),
       contextPercent: hasExplicitContextPercent
         ? cleanContextPercent(contextPercent)
-        : cleanContextPercent(saved.contextPercent),
+        : keepsSavedPercent
+          ? cleanContextPercent(saved.contextPercent)
+          : undefined,
+      ...(tokens ? { contextTokens: tokens } : {}),
     };
   };
 }

package/src/runtime/agent/orchestrator/runtime-core/effort.mjs

@@ -1,6 +1,7 @@
 // Reasoning-effort catalogs and coercion. Pure helpers.
 import { clean } from './session-text.mjs';
 import { customEffortLevels, snapCustomEffort } from '../providers/custom-reasoning.mjs';
+import { rejectedEffortLevelsSync } from '../providers/effort-rejection.mjs';
 
 const TOOL_MODES = new Set(['full', 'readonly', 'lead']);
 const ALL_EFFORT_LEVELS = new Set(['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'ultra']);
@@ -15,22 +16,18 @@ const EFFORT_LABELS = {
   ultra: 'Ultra',
 };
 
+// Last-resort ladders for routes whose endpoints publish no effort metadata
+// (no per-model levels on /models, no same-endpoint catalog row). Every other
+// provider's ladder comes from its own catalog rows (live roster, models.dev
+// via provider-catalog-registry, seeds); a route with none offers no effort.
 const EFFORT_OPTIONS_BY_PROVIDER = {
   openai: ['none', 'low', 'medium', 'high', 'xhigh'],
-  // gpt-5.6+ catalogs declare max/ultra; the openai-oauth transport folds
-  // ultra -> max on the wire (openai-oauth.mjs _normalizeReasoningEffort).
-  'openai-oauth': ['none', 'low', 'medium', 'high', 'xhigh', 'max', 'ultra'],
-  anthropic: ['low', 'medium', 'high', 'xhigh', 'max'],
-  'anthropic-oauth': ['low', 'medium', 'high', 'xhigh', 'max'],
   // xAI Grok 4.6+: low/medium/high/xhigh. Reasoning cannot be disabled.
   xai: ['low', 'medium', 'high', 'xhigh'],
-  'grok-oauth': ['low', 'medium', 'high', 'xhigh'],
-  'muse-code-oauth': ['minimal', 'low', 'medium', 'high', 'xhigh'],
   'mimo-oauth': ['minimal', 'low', 'medium', 'high'],
-  // Antigravity carries the effort tier inside the wire model id
-  // (gemini-3-pro-high / -low, claude-*-thinking), so the route exposes none.
-  'antigravity-oauth': [],
-  'opencode-go': ['high', 'max'],
+  // Command Code relays several vendors over Chat Completions; the common
+  // `reasoning_effort` levels are the fallback when no catalog row declares any.
+  'command-code-oauth': ['low', 'medium', 'high'],
 };
 const EFFORT_BY_FAMILY = {
   opus: ['low', 'medium', 'high', 'xhigh', 'max'],
@@ -73,7 +70,14 @@ export function normalizeEffortInput(value) {
   return v;
 }
 
+// Levels the endpoint has rejected for this route stop being offered.
 export function effortOptionsFor(provider, model) {
+  const options = catalogEffortOptions(provider, model);
+  const rejected = model?.id ? rejectedEffortLevelsSync(provider, model.id) : null;
+  return rejected?.size ? options.filter((level) => !rejected.has(level)) : options;
+}
+
+function catalogEffortOptions(provider, model) {
   // Custom-provider rows declare their levels authoritatively: an explicit []
   // (or no declaration) means none, with no family/provider fallback.
   if (model?.customReasoning) return customEffortLevels(model) || [];

package/src/runtime/agent/orchestrator/runtime-core/extension-scopes.mjs

@@ -1,11 +1,8 @@
 // extension-scopes.mjs — plugin-aware layer over the shared scope model. A
 // plugin's scope cascades to the skills it owns and to the MCP server(s) it
-// installed, so limiting the plugin limits everything it brought along.
-import { readFileSync, statSync } from 'node:fs';
-import { join } from 'node:path';
-
-import { pluginMcpServerName, pluginServerMatcher } from './plugin-mcp.mjs';
-import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
+// declares, so limiting the plugin limits everything it brought along. MCP
+// ownership comes from the tool's `mcpPluginId`, set when the plugin's server
+// connected, never from the server name.
 import { loadConfig } from '../config.mjs';
 import {
   extensionAllowedForCwd,
@@ -28,66 +25,29 @@ export {
   withExtensionScope,
 } from '../../../shared/extension-scopes.mjs';
 
-/** Plugin id that installed MCP server `serverName`, or ''. Plugin servers are
- *  named `plugin-<name>` or `plugin-<name>--<suffix>` (plugin-mcp.mjs). */
-export function pluginIdForMcpServer(serverName, plugins) {
-  const name = clean(serverName);
-  if (!name) return '';
-  for (const plugin of Array.isArray(plugins) ? plugins : []) {
-    if (pluginServerMatcher(pluginMcpServerName(plugin))(name)) return clean(plugin?.id || plugin?.name);
-  }
-  return '';
-}
-
-export function mcpServerAllowedForCwd(scopes, serverName, cwd, { plugins = [] } = {}) {
+/** Server scope ∩ owning plugin's scope (`pluginId` from owner metadata). */
+export function mcpServerAllowedForCwd(scopes, serverName, cwd, { pluginId = '' } = {}) {
   if (!extensionAllowedForCwd(scopes, 'mcp', serverName, cwd)) return false;
-  const pluginId = pluginIdForMcpServer(serverName, plugins);
-  if (pluginId && !extensionAllowedForCwd(scopes, 'plugins', pluginId, cwd)) return false;
+  const owner = clean(pluginId);
+  if (owner && !extensionAllowedForCwd(scopes, 'plugins', owner, cwd)) return false;
   return true;
 }
 
 /** Drop tools of MCP servers whose scope excludes cwd; non-MCP tools pass. */
-export function filterMcpToolsForCwd(tools, scopes, cwd, options = {}) {
+export function filterMcpToolsForCwd(tools, scopes, cwd) {
   const list = Array.isArray(tools) ? tools : [];
   const verdicts = new Map();
   return list.filter((tool) => {
-    const server = mcpServerNameOfTool(tool?.name);
+    // A name shortened for provider limits carries its server explicitly.
+    const server = mcpServerNameOfTool(tool);
     if (!server) return true;
-    if (!verdicts.has(server)) verdicts.set(server, mcpServerAllowedForCwd(scopes, server, cwd, options));
-    return verdicts.get(server);
+    const pluginId = clean(tool?.mcpPluginId);
+    const key = `${server}\0${pluginId}`;
+    if (!verdicts.has(key)) verdicts.set(key, mcpServerAllowedForCwd(scopes, server, cwd, { pluginId }));
+    return verdicts.get(key);
   });
 }
 
-// `{ id, name }` of every registered plugin, from <data>/plugins/registry.json.
-// mtime-cached: this runs on every session create and MCP catalog fold.
-let _registryCache = { path: '', mtime: -1, plugins: [] };
-export function registeredPluginIdentities(dataDir = null) {
-  let path = '';
-  try {
-    path = join(dataDir || resolvePluginData(), 'plugins', 'registry.json');
-  } catch {
-    return [];
-  }
-  let mtime = -1;
-  try {
-    mtime = statSync(path).mtimeMs;
-  } catch {
-    return [];
-  }
-  if (_registryCache.path === path && _registryCache.mtime === mtime) return _registryCache.plugins;
-  let plugins = [];
-  try {
-    const parsed = JSON.parse(readFileSync(path, 'utf8'));
-    plugins = (Array.isArray(parsed?.plugins) ? parsed.plugins : [])
-      .map((entry) => ({ id: clean(entry?.id || entry?.name), name: clean(entry?.name || entry?.id) }))
-      .filter((entry) => entry.id);
-  } catch {
-    plugins = [];
-  }
-  _registryCache = { path, mtime, plugins };
-  return plugins;
-}
-
 /** The MCP tools a session at `cwd` may see. No scopes configured → input
  *  returned as-is, so the global-only fast path costs one config read. */
 export function filterMcpToolsForSession(tools, cwd, config = null) {
@@ -95,5 +55,5 @@ export function filterMcpToolsForSession(tools, cwd, config = null) {
   if (!list.length) return list;
   const scopes = extensionScopesFromConfig(config || loadConfig({ secrets: false }));
   if (!hasExtensionScopes(scopes)) return list;
-  return filterMcpToolsForCwd(list, scopes, cwd, { plugins: registeredPluginIdentities() });
+  return filterMcpToolsForCwd(list, scopes, cwd);
 }

package/src/runtime/agent/orchestrator/runtime-core/goal-control.mjs

@@ -19,7 +19,7 @@ import {
   stopActiveClock,
   validateObjective,
 } from './goal-state.mjs';
-import { assertExpectedGoal } from './goal-mutations.mjs';
+import { assertExpectedGoal, goalFinished } from './goal-mutations.mjs';
 import { clean } from '../../../shared/clean.mjs';
 
 /** "12m remaining" for a budgeted Goal, "3m elapsed" for an open-ended one. */
@@ -109,6 +109,17 @@ const GOAL_CONTROL_ACTIONS = {
     const goal = await ctx.updateGoal(id, { status: 'complete' }, { user: true });
     return reply(action, goal, `Goal complete · ${goal.objective} · ${durationLabel(goal.timeUsedMs)} elapsed`);
   },
+  async dismiss(ctx, { id, goal, at, action }) {
+    // The user's acknowledgement of finished work: the same archive a new
+    // prompt applies, so the chrome lets go while the record stays.
+    if (!goalFinished(goal)) throw new Error('only a finished Goal can be dismissed; stop or complete it first');
+    if (!goal.archivedAt) {
+      goal.archivedAt = at;
+      goal.updatedAt = at;
+      await ctx.commit(id, goal);
+    }
+    return reply(action, null, `Goal dismissed · ${goal.objective}`);
+  },
 };
 
 export async function runGoalControl(ctx, sessionId, rawArgs = {}) {
@@ -146,7 +157,9 @@ export async function runGoalControl(ctx, sessionId, rawArgs = {}) {
     throw new Error('Goal changed while editing; reopen the editor before saving');
   }
   const at = ctx.now();
-  if (goal.status === 'stopped') throw new Error('a stopped Goal cannot be changed; create a new Goal');
+  if (goal.status === 'stopped' && action !== 'dismiss') {
+    throw new Error('a stopped Goal cannot be changed; create a new Goal');
+  }
   const handler = GOAL_CONTROL_ACTIONS[action];
   if (!handler) throw new Error(`unknown Goal action: ${action}`);
   return handler(ctx, { id, goal, args, at, expectedGoalId, action });

package/src/runtime/agent/orchestrator/runtime-core/model-capabilities.mjs

@@ -6,6 +6,7 @@ import { clean, hasOwn } from './session-text.mjs';
 import { modelSupportsServiceTier } from '../providers/model-service-tiers.mjs';
 import { openAiDirectSupportsFast, openAiDirectSupportsUltrafast } from '../providers/openai-direct-request.mjs';
 import { supportsAnthropicFastMode } from '../../../shared/llm/anthropic-betas.mjs';
+import { normalizeContextTokens } from '../../../shared/llm/default-context-window.mjs';
 
 const FAST_CAPABLE_PROVIDERS = new Set([
   'anthropic',
@@ -123,6 +124,11 @@ export function saveModelSettings(cfgMod, route, { fastCapable = true, baseConfi
   else delete nextSetting.effort;
   if (fastCapable) nextSetting.fast = route.fast === true;
   else nextSetting.fast = false;
+  // Auto effort is on unless turned off: only the off state is stored.
+  if (hasOwn(route, 'autoEffort')) {
+    if (route.autoEffort === false) nextSetting.autoEffort = false;
+    else delete nextSetting.autoEffort;
+  }
   if (route.modelParameters && typeof route.modelParameters === 'object') {
     nextSetting.modelParameters = Object.fromEntries(
       Object.entries(route.modelParameters)
@@ -136,13 +142,22 @@ export function saveModelSettings(cfgMod, route, { fastCapable = true, baseConfi
   // pickers send the default stop with every selection; storing it froze each
   // model at whatever its default was that day, so a later default never
   // reached anyone who had already selected the model.
+  // An exact window in tokens replaces the percentage, and a percentage
+  // replaces it. A token selection at the default window reaches here already
+  // dropped (resolveRouteContextState answers no contextTokens for it).
+  const contextTokens = normalizeContextTokens(route.contextTokens);
   const requestedPercent = Number(route.contextPercent);
   const contextPercent = Math.round(requestedPercent / 10) * 10;
   const isDefault = contextPercent === Number(route.contextDefaultPercent);
-  if (requestedPercent >= 10 && requestedPercent <= 100 && !isDefault) {
+  if (contextTokens) {
+    nextSetting.contextTokens = contextTokens;
+    delete nextSetting.contextPercent;
+  } else if (requestedPercent >= 10 && requestedPercent <= 100 && !isDefault) {
     nextSetting.contextPercent = contextPercent;
+    delete nextSetting.contextTokens;
   } else {
     delete nextSetting.contextPercent;
+    delete nextSetting.contextTokens;
   }
   modelSettings[key] = nextSetting;