mixdog 1.1.2 → 1.2.1

package/src/runtime/agent/orchestrator/providers/effort-rejection.mjs

@@ -0,0 +1,244 @@
+import { readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { parseJsonText, updateJsonAtomicSync } from '../../../shared/atomic-file.mjs';
+import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
+
+// An OpenAI-compatible endpoint that rejects the requested reasoning effort
+// (HTTP 400 naming the value) is replayed once at the nearest accepted level,
+// and the rejection is remembered per provider+model so the level stops being
+// sent (clamped before the request) and stops being offered (the sync reader).
+
+const EFFORT_ORDER = Object.freeze(['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'ultra']);
+const FILE_NAME = 'effort-rejections.json';
+// Per-provider request fields that can carry the effort next to `opts.effort`.
+const EFFORT_OPT_KEYS = ['xaiReasoningEffort', 'openRouterReasoningEffort', 'deepseekReasoningEffort'];
+const LEVEL_RE = new RegExp(`\\b(${EFFORT_ORDER.join('|')})\\b`, 'gi');
+const LIST_RE =
+  /\b(?:supported|allowed|valid|accepted|available)\s+(?:values?|levels?|options?|efforts?)|(?:must|should|expected to) be one of|expected one of|one of|choose from|input should be/i;
+const REJECT_RE =
+  /invalid|unsupported|not supported|does not support|doesn't support|not allowed|not a valid|unrecognized|must be one of|expected one of|supported values/i;
+// Anthropic's `invalid_request_error` words a bad enum value as "Input should be 'low', ...".
+const ANTHROPIC_REJECT_RE = /input should be|should be one of|not one of/i;
+const EFFORT_RE = /reasoning[._ ]?effort|\beffort\b/i;
+const REASONING_RE = /\breasoning\b/i;
+// A request field other than the effort: `reasoning.summary`, `reasoning_content`,
+// `thinking.type`, `budget_tokens`, ...
+const OTHER_FIELD_RE = /\breasoning[._[](?!effort)\w+|(?:^|[\s'"`(])(?:thinking\.\w+|budget_tokens)\b/i;
+// The mid-conversation effort update rejection belongs to effort-configuration.mjs.
+const EFFORT_CONFIGURATION_RE = /mid-conversation|configuration_update|reasoning_effort_update/i;
+/** The effort levels the Anthropic Messages wire accepts (`output_config.effort`). */
+export const ANTHROPIC_EFFORT_LEVELS = Object.freeze(['low', 'medium', 'high', 'xhigh', 'max']);
+
+const cache = new Map();
+
+const filePath = () => join(resolvePluginData(), FILE_NAME);
+const entryKey = (provider, model) =>
+  `${String(provider || '').trim()}:${String(model || '')
+    .trim()
+    .toLowerCase()}`;
+const levelOf = (value) => {
+  const level = String(value ?? '')
+    .trim()
+    .toLowerCase();
+  return EFFORT_ORDER.includes(level) ? level : null;
+};
+
+// A rejection persisted by another process changes the file; the cached copy is
+// only trusted while the file's mtime and size are unchanged.
+function signature(file) {
+  try {
+    const stat = statSync(file);
+    return `${stat.mtimeMs}:${stat.size}`;
+  } catch {
+    return null;
+  }
+}
+
+function load(file) {
+  const sig = signature(file);
+  const cached = cache.get(file);
+  if (cached && cached.sig === sig) return cached.data;
+  let data = null;
+  try {
+    data = parseJsonText(readFileSync(file, 'utf8'));
+  } catch {}
+  const valid =
+    data?.version === 1 && data.models && typeof data.models === 'object' ? data : { version: 1, models: {} };
+  cache.set(file, { sig, data: valid });
+  return valid;
+}
+
+function addRejection(data, key, level, allowed) {
+  const models = { ...data.models };
+  const prev = models[key] || {};
+  const rejected = new Set(prev.rejected || []);
+  if (level) rejected.add(level);
+  const nextAllowed = allowed?.length ? allowed : prev.allowed;
+  models[key] = { rejected: [...rejected], ...(nextAllowed?.length ? { allowed: nextAllowed } : {}) };
+  return { version: 1, models };
+}
+
+function entry(provider, model) {
+  return load(filePath()).models[entryKey(provider, model)] || null;
+}
+
+/** Levels this provider+model is known not to accept (rejected, or outside a
+ *  list the endpoint named). Sync, for the runtime effort catalog. */
+export function rejectedEffortLevelsSync(provider, model) {
+  const found = entry(provider, model);
+  const rejected = new Set(found?.rejected || []);
+  if (found?.allowed?.length) for (const level of EFFORT_ORDER) if (!found.allowed.includes(level)) rejected.add(level);
+  return rejected;
+}
+
+/** Remember a rejected level (and the allowed list the endpoint named, if any). */
+export function recordEffortRejection(provider, model, level, allowed = null) {
+  const file = filePath();
+  const key = entryKey(provider, model);
+  const normalized = levelOf(level);
+  try {
+    const data = updateJsonAtomicSync(
+      file,
+      (cur) =>
+        addRejection(cur?.version === 1 && cur.models ? cur : { version: 1, models: {} }, key, normalized, allowed),
+      { lock: true, timeoutMs: 1000 }
+    );
+    cache.set(file, { sig: signature(file), data });
+  } catch {
+    cache.set(file, { sig: signature(file), data: addRejection(load(file), key, normalized, allowed) });
+  }
+}
+
+/** Forget what was loaded from disk (a process restart, for tests). */
+export function resetEffortRejectionCache() {
+  cache.clear();
+}
+
+const collect = (error) => {
+  const nested = error?.error?.error && typeof error.error.error === 'object' ? error.error.error : null;
+  return [error, error?.error, nested].filter((part) => part && typeof part === 'object');
+};
+
+const hasLevel = (text) => new RegExp(LEVEL_RE.source, 'i').test(text);
+
+/**
+ * A 400-class provider error that rejects the reasoning effort, as
+ * `{ allowed }` (levels the message lists, or null), else null. It must be
+ * effort-specific: the `param` names the effort field, or the message names the
+ * effort field together with a level, or (given the `requested` level) the
+ * message calls that level invalid while talking about reasoning. A rejection
+ * of another reasoning field (`reasoning.summary`, `reasoning.include`) never matches.
+ */
+export function detectEffortRejection(error, requested = null) {
+  const status = [error?.status, error?.httpStatus, error?.response?.status].map(Number).find((value) => value > 0);
+  if (status !== 400 && status !== 422) return null;
+  const parts = collect(error);
+  const param = parts.map((part) => String(part.param ?? '')).join(' ');
+  const text = parts
+    .flatMap((part) => [part.message, part.code, part.param])
+    .filter(Boolean)
+    .join(' ');
+  if (EFFORT_CONFIGURATION_RE.test(text)) return null;
+  const anthropic = parts.some((part) => part.type === 'invalid_request_error') || /invalid_request_error/.test(text);
+  if (!REJECT_RE.test(text) && !(anthropic && ANTHROPIC_REJECT_RE.test(text))) return null;
+  const level = levelOf(requested);
+  const targeted =
+    /effort/i.test(param) ||
+    (!OTHER_FIELD_RE.test(`${param} ${text}`) &&
+      ((EFFORT_RE.test(text) && hasLevel(text)) ||
+        (level && REASONING_RE.test(text) && new RegExp(`\\b${level}\\b`, 'i').test(text))));
+  if (!targeted) return null;
+  const list = LIST_RE.exec(text);
+  const allowed = list
+    ? [...new Set([...text.slice(list.index + list[0].length).matchAll(LEVEL_RE)].map((m) => m[1].toLowerCase()))]
+    : [];
+  return { allowed: allowed.length ? allowed : null };
+}
+
+/**
+ * The nearest lower level not in `rejected`; with `allowHigher` (the accepted
+ * set is known) the nearest higher one when nothing lower is left.
+ */
+export function nearestAcceptedEffort(requested, rejected = new Set(), { allowHigher = false } = {}) {
+  const from = EFFORT_ORDER.indexOf(requested);
+  if (from < 0) return null;
+  const open = EFFORT_ORDER.filter((level, index) => index !== from && !rejected.has(level));
+  const lower = open.filter((level) => EFFORT_ORDER.indexOf(level) < from).at(-1);
+  return lower ?? (allowHigher ? (open[0] ?? null) : null);
+}
+
+const requestedEffort = (opts, configEffort) => levelOf(opts?.effort ?? configEffort);
+
+function withEffort(opts, level) {
+  const next = { ...opts, effort: level };
+  for (const key of EFFORT_OPT_KEYS) if (opts?.[key] !== undefined) next[key] = level;
+  return next;
+}
+
+// The rejected set seen by a transport that only takes `levels` of the ladder.
+function rejectedWithin(provider, model, levels) {
+  const rejected = rejectedEffortLevelsSync(provider, model);
+  if (levels) for (const level of EFFORT_ORDER) if (!levels.includes(level)) rejected.add(level);
+  return rejected;
+}
+
+/** `opts` with a level already known to be rejected stepped down; unchanged otherwise. */
+export function clampEffortOpts(provider, model, opts, configEffort, levels = null) {
+  const requested = requestedEffort(opts, configEffort);
+  if (!requested || (levels && !levels.includes(requested))) return opts;
+  const rejected = rejectedWithin(provider, model, levels);
+  if (!rejected.has(requested)) return opts;
+  const level = nearestAcceptedEffort(requested, rejected, { allowHigher: Boolean(entry(provider, model)?.allowed) });
+  return level ? withEffort(opts, level) : opts;
+}
+
+const STREAM_CALLBACKS = ['onStreamDelta', 'onTextDelta', 'onToolCall'];
+
+/**
+ * Runs `send(opts)` with known-rejected levels clamped first; when the model
+ * rejects the effort, remembers it and replays the request once at the nearest
+ * accepted level. Never replays after output reached the caller, and never
+ * replays the replay. `levels` limits the ladder to what the transport's wire
+ * accepts. A send re-entered from inside a wrapped send (a transport's own
+ * replays call `send` again) passes straight through: the outer wrapper owns it.
+ */
+export async function withEffortRejectionFallback(provider, model, opts, configEffort, send, { levels = null } = {}) {
+  if (opts?._effortRejectionActive) return send(opts);
+  let streamed = false;
+  const tracked = { ...opts, _effortRejectionActive: true };
+  for (const name of STREAM_CALLBACKS) {
+    const callback = opts?.[name];
+    if (typeof callback === 'function') {
+      tracked[name] = (...args) => {
+        streamed = true;
+        return callback(...args);
+      };
+    }
+  }
+  const first = clampEffortOpts(provider, model, tracked, configEffort, levels);
+  try {
+    return await send(first);
+  } catch (error) {
+    const requested = requestedEffort(first, configEffort);
+    const rejection = detectEffortRejection(error, requested);
+    const emitted =
+      streamed || error?.liveTextEmitted === true || error?.emittedToolCall === true || error?.unsafeToRetry === true;
+    if (!rejection || !requested || (levels && !levels.includes(requested))) throw error;
+    recordEffortRejection(provider, model, requested, rejection.allowed);
+    if (emitted) throw error;
+    const level = nearestAcceptedEffort(requested, rejectedWithin(provider, model, levels), {
+      allowHigher: Boolean(entry(provider, model)?.allowed),
+    });
+    if (!level) throw error;
+    process.stderr.write(
+      `[${provider}] ${model} rejected reasoning effort '${requested}'; retrying once at '${level}'\n`
+    );
+    try {
+      return await send(withEffort(first, level));
+    } catch (retryError) {
+      const again = detectEffortRejection(retryError, level);
+      if (again) recordEffortRejection(provider, model, level, again.allowed);
+      throw retryError;
+    }
+  }
+}

package/src/runtime/agent/orchestrator/providers/gemini.mjs

@@ -1,5 +1,5 @@
 import { GoogleGenerativeAI } from '@google/generative-ai';
-import { getAgentApiKey } from '../../../shared/provider-api-key.mjs';
+import { reloadProviderApiKey, resolveProviderApiKey } from '../../../shared/provider-api-key.mjs';
 import { canFallbackNonStreaming, emitProviderRetryStage, withRetry } from './retry-classifier.mjs';
 import { noteErrorUsage } from './lib/note-error-usage.mjs';
 import { traceNonStreamingFallback } from './lib/transport-fallback-trace.mjs';
@@ -153,8 +153,9 @@ export class GeminiProvider {
     this._createGenAI =
       typeof config.createGenAI === 'function' ? config.createGenAI : (apiKey) => new GoogleGenerativeAI(apiKey);
     this._modelCache = config.modelCache || _modelCache;
-    const apiKey = config.apiKey || process.env.GEMINI_API_KEY || '';
-    this.genAI = config.genAI || this._createGenAI(apiKey);
+    this._injectedGenAI = Boolean(config.genAI);
+    this._genAIKey = resolveProviderApiKey('gemini', config);
+    this.genAI = config.genAI || this._createGenAI(this._genAIKey);
     // Warm a kept-alive socket to the Gemini REST API so the first cache/
     // generateContent request skips the cold TLS handshake. Best-effort.
     this._preconnect('https://generativelanguage.googleapis.com');
@@ -162,12 +163,13 @@ export class GeminiProvider {
 
   reloadApiKey() {
     try {
-      const newKey = getAgentApiKey('gemini') || this.config?.apiKey || process.env.GEMINI_API_KEY;
+      const newKey = reloadProviderApiKey('gemini', this.config);
       if (newKey) {
-        // Keep this.config in sync so REST/cache paths (which read the
-        // key via _getApiKey() → this.config.apiKey) don't keep using
-        // the stale key after a rotation; genAI alone is not enough.
+        // Keep this.config in sync so REST/cache paths don't keep using the
+        // stale key after a rotation; genAI alone is not enough.
         this.config = { ...(this.config || {}), apiKey: newKey };
+        this._injectedGenAI = false;
+        this._genAIKey = newKey;
         this.genAI = this._createGenAI(newKey);
       }
       return newKey || '';
@@ -178,7 +180,18 @@ export class GeminiProvider {
   }
 
   _getApiKey() {
-    return this.config?.apiKey || process.env.GEMINI_API_KEY || '';
+    return resolveProviderApiKey('gemini', this.config);
+  }
+
+  // SDK client for the currently resolved key; rebuilt when the key changed
+  // since construction (e.g. a keyless-constructed instance).
+  _currentGenAI() {
+    const key = this._getApiKey();
+    if (!this._injectedGenAI && key !== this._genAIKey) {
+      this._genAIKey = key;
+      this.genAI = this._createGenAI(key);
+    }
+    return this.genAI;
   }
 
   /**
@@ -673,7 +686,7 @@ export class GeminiProvider {
 
   async _streamViaSdk(stream) {
     const { opts, signal, useModel, systemInstruction, geminiTools, toolConfig, generationConfig, contents } = stream;
-    const genModel = this.genAI.getGenerativeModel({
+    const genModel = this._currentGenAI().getGenerativeModel({
       model: useModel,
       systemInstruction,
       tools: geminiTools,
@@ -714,7 +727,7 @@ export class GeminiProvider {
     const cached = this._modelCache.loadSync();
     if (cached) return cached;
     // Dynamic lookup via Gemini v1beta /models. Requires API key.
-    const apiKey = this.config.apiKey || process.env.GEMINI_API_KEY;
+    const apiKey = this._getApiKey();
     if (!apiKey) return MODELS; // no key — return minimal static list
     try {
       return await this._fetchAndCacheModels(apiKey);
@@ -738,26 +751,26 @@ export class GeminiProvider {
 
   // Force a catalog refresh (ignores the 24h disk TTL). De-duped via
   // _modelRefreshInFlight so concurrent callers share one HTTP round-trip.
-  // Fire-and-forget context: failures are caught/logged, returning null.
+  // Resolves null when there is no key; fetch/normalize failures reject so
+  // callers (registry refresh) report them.
   async _refreshModelCache() {
     if (_modelRefreshInFlight) return _modelRefreshInFlight;
-    _modelRefreshInFlight = (async () => {
-      try {
-        const apiKey = this.config.apiKey || process.env.GEMINI_API_KEY;
-        if (!apiKey) return null; // no key — nothing to refresh
-        const enriched = await this._fetchAndCacheModels(apiKey);
-        if (!process.env.MIXDOG_QUIET_PROVIDER_LOG)
-          process.stderr.write(`[gemini] catalog refreshed (${enriched.length} models)\n`);
-        return enriched;
-      } catch (err) {
-        if (!process.env.MIXDOG_QUIET_PROVIDER_LOG)
-          process.stderr.write(`[gemini] catalog refresh failed (${err.message})\n`);
-        return null;
-      } finally {
-        _modelRefreshInFlight = null;
-      }
+    const refresh = (async () => {
+      const apiKey = this._getApiKey();
+      if (!apiKey) return null; // no key — nothing to refresh
+      const enriched = await this._fetchAndCacheModels(apiKey);
+      if (!process.env.MIXDOG_QUIET_PROVIDER_LOG)
+        process.stderr.write(`[gemini] catalog refreshed (${enriched.length} models)\n`);
+      return enriched;
     })();
-    return _modelRefreshInFlight;
+    // Clear only after the shared promise is published: a refresh that settles
+    // synchronously (no key) must not leave its settled promise memoized.
+    _modelRefreshInFlight = refresh;
+    try {
+      return await refresh;
+    } finally {
+      if (_modelRefreshInFlight === refresh) _modelRefreshInFlight = null;
+    }
   }
 
   async isAvailable() {
@@ -766,7 +779,7 @@ export class GeminiProvider {
       controller.abort(providerTimeoutError('Gemini availability probe', GEMINI_AVAILABILITY_TIMEOUT_MS));
     }, GEMINI_AVAILABILITY_TIMEOUT_MS);
     try {
-      const model = this.genAI.getGenerativeModel({ model: DEFAULT_MODEL });
+      const model = this._currentGenAI().getGenerativeModel({ model: DEFAULT_MODEL });
       const generation = Promise.resolve(model.generateContent('hi', { signal: controller.signal }));
       generation.catch(() => {});
       await Promise.race([

package/src/runtime/agent/orchestrator/providers/grok-client-version.mjs

@@ -3,7 +3,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // Grok CLI client version for the cli-chat-proxy version gate (HTTP 426).
 // Effective = env override, else max(floor, learned-from-426, live npm latest
 // of the official @xai-official/grok CLI).
-export const GROK_CLI_VERSION_FLOOR = '1.0.50';
+export const GROK_CLI_VERSION_FLOOR = '1.0.52';
 export const GROK_CLI_NPM_PACKAGE = '@xai-official/grok';
 
 const live = createNpmVersionSource(GROK_CLI_NPM_PACKAGE, { persistKey: 'grok-cli' });

package/src/runtime/agent/orchestrator/providers/grok-oauth-tokens.mjs

@@ -10,6 +10,7 @@ import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs
 import { createTimeoutSignal } from '../stall-policy.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
 import { grokClientVersionHeaders } from './grok-client-version.mjs';
+import { modelProxyClientMode, serverModelCredentialsDisabledError } from '../../../shared/model-proxy-mode.mjs';
 import {
   accountIdentityFields,
   decodeJwtPayload,
@@ -174,6 +175,7 @@ export function _mtimeMs(path) {
 // mixdog's own login store (grok-oauth.json). Single writer, accurate
 // numeric expires_at from refresh.
 export function _loadOwnTokens() {
+  if (modelProxyClientMode()) return null;
   const path = getOwnTokenPath();
   if (!existsSync(path)) return null;
   try {
@@ -375,6 +377,7 @@ async function _postRefreshWithRetry(tokens) {
 // single-use. Hold a cross-process lease across the re-read, exchange, and
 // atomic save so only one process can spend a generation.
 export async function refreshTokens(tokens, { force = false } = {}) {
+  if (modelProxyClientMode()) throw serverModelCredentialsDisabledError('Grok OAuth credentials');
   if (!tokens?.refresh_token) {
     throw new Error('[grok-oauth] refresh token not available — open /providers in mixdog to sign in again');
   }

package/src/runtime/agent/orchestrator/providers/lib/gemini-model-catalog.mjs

@@ -79,7 +79,13 @@ function resolveLatestGeminiModel() {
 export async function ensureLatestGeminiModel(provider) {
   let model = resolveLatestGeminiModel();
   if (model) return model;
-  await provider._refreshModelCache();
+  try {
+    await provider._refreshModelCache();
+  } catch (err) {
+    throw new Error(`[gemini] model catalog refresh failed — cannot resolve default model (${err.message})`, {
+      cause: err,
+    });
+  }
   model = resolveLatestGeminiModel();
   if (model) return model;
   throw new Error('[gemini] model catalog unavailable after warmup — cannot resolve default model');

package/src/runtime/agent/orchestrator/providers/mimo-oauth-profile.mjs

@@ -6,6 +6,7 @@ import { scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
 import { PROVIDER_MAX_BEFORE_WARN_MS, STALL_ABORT_S, STALL_TICK_MS } from '../stall-policy.mjs';
 import { PACKAGE_VERSION } from '../../../web-search/lib/package-version.mjs';
 import { DEFAULT_MODEL } from './mimo-oauth-tokens.mjs';
+import { MIMO_SEED_MODELS, mimoSeedRow as seedRow } from '../../../shared/llm/provider-seed-rosters.mjs';
 
 const MIMO_EFFORT_LEVELS = Object.freeze(['minimal', 'low', 'medium', 'high']);
 const MIMO_DEFAULT_TEMPERATURE = 1.0;
@@ -15,25 +16,12 @@ const MIMO_DEFAULT_MAX_OUTPUT_TOKENS = 128_000;
 export const MIMO_FIRST_BYTE_TIMEOUT_MS = Math.min(300_000, PROVIDER_MAX_BEFORE_WARN_MS);
 export const MIMO_SEMANTIC_IDLE_TIMEOUT_MS = Math.min(480_000, Math.max(10_000, STALL_ABORT_S * 1000 - STALL_TICK_MS));
 
-// Local roster used when /models fails or comes back empty.
-const SEED_CONTEXT = 1_048_576;
-const SEED_OUTPUT = 131_072;
-export const SEED_MODELS = Object.freeze(
-  [
-    ['mimo-v2.6-pro', 'MiMo-V2.6-Pro', SEED_CONTEXT],
-    ['mimo-v2.6-flash', 'MiMo-V2.6-Flash', SEED_CONTEXT],
-    ['mimo-v2.6-pro-ultraspeed', 'MiMo-V2.6-Pro-Ultraspeed', SEED_CONTEXT],
-    ['mimo-v2.5-pro', 'MiMo-V2.5-Pro', SEED_CONTEXT],
-    ['mimo-v2.5', 'MiMo-V2.5', SEED_CONTEXT],
-    ['mimo-v2-pro', 'MiMo-V2-Pro', SEED_CONTEXT],
-    ['mimo-v2-omni', 'MiMo-V2-Omni', 262_144],
-  ].map(([id, display_name, context_window]) =>
-    Object.freeze({ id, display_name, context_window, max_output_tokens: SEED_OUTPUT })
-  )
-);
+// Local roster used when /models fails or comes back empty. Its limits are not
+// discovered data: decorateModelRows applies them only where nothing fetched did.
+export const SEED_MODELS = MIMO_SEED_MODELS;
 
 export function seedModelItems() {
-  return SEED_MODELS.map((item) => ({ ...item }));
+  return SEED_MODELS.map(({ id, display_name }) => ({ id, display_name }));
 }
 
 // Speech/transcription ids cannot serve a text chat turn.
@@ -50,28 +38,8 @@ export function chooseDefaultModel(ids) {
   return chat[0] || DEFAULT_MODEL;
 }
 
-// Exact seed id, else the longest seed whose id is a lineage prefix of the
-// model (dated or suffixed variants of a seeded model).
-function seedRow(model) {
-  const id = String(model || '').toLowerCase();
-  let seed = SEED_MODELS.find((item) => item.id === id) || null;
-  if (!seed) {
-    for (const item of SEED_MODELS) {
-      if (id.startsWith(`${item.id}-`) && (!seed || item.id.length > seed.id.length)) seed = item;
-    }
-  }
-  if (!seed) return null;
-  return {
-    id: String(model),
-    contextWindow: seed.context_window,
-    outputTokens: seed.max_output_tokens,
-    reasoning: true,
-    vision: true,
-    inputModalities: ['text', 'image'],
-  };
-}
-
-// Fill the gaps a /models row leaves (names, limits, effort levels).
+// Fill the gaps a /models row leaves (names, limits, effort levels); seeds
+// never replace a value the row already carries.
 export function decorateModelRows(rows, items) {
   const display = new Map();
   for (const item of items || []) {
@@ -89,7 +57,7 @@ export function decorateModelRows(rows, items) {
       ...(seed && row.reasoning === undefined ? { reasoning: seed.reasoning } : {}),
       ...(seed && row.vision === undefined ? { vision: seed.vision } : {}),
       ...(seed && row.inputModalities === undefined ? { inputModalities: seed.inputModalities } : {}),
-      reasoningLevels: [...MIMO_EFFORT_LEVELS],
+      reasoningLevels: row.reasoningLevels?.length ? row.reasoningLevels : [...MIMO_EFFORT_LEVELS],
       reasoningContentField: 'reasoning_content',
     };
   });

package/src/runtime/agent/orchestrator/providers/mimo-oauth-tokens.mjs

@@ -8,6 +8,7 @@ import { getPluginData } from '../config.mjs';
 import { writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
 import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
 import { accountIdentityFields, fileMtimeMs, scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
+import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
 
 const DEFAULT_PLATFORM_ORIGIN = 'https://platform.xiaomimimo.com';
 const DEFAULT_BASE_URL = 'https://api.xiaomimimo.com/v1';
@@ -98,6 +99,7 @@ export function getKeyName() {
 }
 
 export function loadTokens() {
+  if (modelProxyClientMode()) return null;
   const path = getOwnTokenPath();
   if (!existsSync(path)) return null;
   try {

package/src/runtime/agent/orchestrator/providers/mimo-oauth.mjs

@@ -10,6 +10,7 @@ import { noteErrorUsage } from './lib/note-error-usage.mjs';
 import { fileMtimeMs, scrubOAuthSecrets } from './lib/oauth-token-utils.mjs';
 import { OpenAICompatProvider, preloadOpenAICompatRuntime } from './openai-compat.mjs';
 import { fetchCompatModelItems, listCompatModels } from './openai-compat-models.mjs';
+import { makeModelCache } from './model-cache.mjs';
 import {
   SOURCE_HEADER,
   ensureTokenPlanBaseUrl,
@@ -29,6 +30,23 @@ import {
 
 const isUnauthorized = (err) => Number(err?.httpStatus || err?.status) === 401;
 
+// The discovered roster (what /models returned, never seed values) is
+// persisted so the shared sync lookup sees what listModels found.
+const mimoModelCache = makeModelCache({ fileName: 'mimo-oauth-models.json', ttlMs: 24 * 60 * 60 * 1000, version: 1 });
+
+function rosterRow(item) {
+  const contextWindow = Number(item.context_window ?? item.max_context_window ?? item.context_length ?? 0);
+  const outputTokens = Number(item.max_output_tokens ?? item.output_tokens ?? 0);
+  const name = typeof item.display_name === 'string' ? item.display_name.trim() : '';
+  return {
+    id: item.id,
+    provider: 'mimo-oauth',
+    ...(name ? { name } : {}),
+    ...(contextWindow > 0 ? { contextWindow } : {}),
+    ...(outputTokens > 0 ? { outputTokens } : {}),
+  };
+}
+
 // Strip the key from an error (message plus any echoed gateway body).
 function scrubErrorSecrets(err, apiKey) {
   if (!err || typeof err !== 'object' || !apiKey) return err;
@@ -101,6 +119,7 @@ export class MimoOAuthProvider {
   _inner = null;
   _innerKey = null;
   _rosterItems = [];
+  _rosterSeq = 0;
   _defaultModelKey = null;
   _defaultModel = null;
 
@@ -143,7 +162,7 @@ export class MimoOAuthProvider {
       clientOptions: { organization: null, project: null },
       extraHeaders: { ...SOURCE_HEADER, Accept: 'application/json' },
     });
-    inner._fetchModelItems = (args) => this._fetchRoster(inner, args);
+    inner._fetchModelItems = async (args) => (await this._fetchRoster(inner, args)).items;
     redactClientErrors(inner.client, apiKey);
     this._inner = inner;
     this._innerKey = key;
@@ -153,15 +172,28 @@ export class MimoOAuthProvider {
   // Chat models from /models; a failed or empty listing falls back to the local
   // seed roster. Only a rejected key is surfaced.
   async _fetchRoster(inner, args) {
+    // Only the latest request, fetched with the still-active key, publishes.
+    const apiKey = inner.apiKey;
+    const seq = ++this._rosterSeq;
+    const publish = mimoModelCache.beginSave(() => loadTokens()?.apiKey === apiKey);
     let items = [];
     try {
       items = (await fetchCompatModelItems(inner, args)).filter((item) => isChatModelId(item?.id));
     } catch (err) {
       if (isUnauthorized(err)) throw err;
     }
-    if (!items.length) items = seedModelItems();
-    this._rosterItems = items;
-    return items;
+    // `published` is false when disk kept a newer roster; the seed fallback
+    // publishes nothing. `_listRows` revalidates `seq` and the key before
+    // touching shared state, since enrichment runs after this returns.
+    let published = true;
+    if (items.length) published = publish(items.map(rosterRow));
+    else items = seedModelItems();
+    return { items, published, seq, apiKey };
+  }
+
+  // Still the latest request, fetched with the still-active key.
+  _isCurrentRoster({ published, seq, apiKey }) {
+    return published && seq === this._rosterSeq && loadTokens()?.apiKey === apiKey;
   }
 
   // Shared send/list error shaping, also applied to credential setup failures.
@@ -180,19 +212,26 @@ export class MimoOAuthProvider {
   // Configured model wins; otherwise pick from this credential's own roster.
   async _pickDefaultModel(inner) {
     if (this._defaultModel && this._defaultModelKey === this._innerKey) return this._defaultModel;
-    await this._listRows(inner);
-    this._defaultModel = chooseDefaultModel(this._enrichedIds(inner));
+    const rows = await this._listRows(inner);
+    this._defaultModel = chooseDefaultModel(rows.map((row) => row.id));
     this._defaultModelKey = this._innerKey;
     return this._defaultModel;
   }
 
-  _enrichedIds(inner) {
-    return (inner._enrichedModels || []).map((row) => row.id);
-  }
-
+  // The request keeps its own items and rows; only a request that is still
+  // current publishes them to the shared in-memory roster and metadata.
   async _listRows(inner) {
-    const rows = decorateModelRows(await listCompatModels(inner, { throwOnError: true }), this._rosterItems);
-    inner._enrichedModels = rows;
+    let fetched = null;
+    const request = Object.create(inner);
+    request._fetchModelItems = async (args) => {
+      fetched = await this._fetchRoster(inner, args);
+      return fetched.items;
+    };
+    const rows = decorateModelRows(await listCompatModels(request, { throwOnError: true }), fetched.items);
+    if (this._isCurrentRoster(fetched)) {
+      this._rosterItems = fetched.items;
+      inner._enrichedModels = rows;
+    }
     return rows;
   }