mixdog 1.2.0 → 1.2.1

package/src/session-runtime/services/provider-admin.mjs

@@ -54,6 +54,15 @@ import {
   beginOAuthLogin as beginMuseCodeOAuthLogin,
   loginOAuth as loginMuseCodeOAuth,
 } from '../../runtime/agent/orchestrator/providers/muse-code-oauth-login.mjs';
+import {
+  describeCommandCodeOAuthCredentials,
+  forgetCommandCodeOAuthCredentials,
+  hasCommandCodeOAuthCredentials,
+} from '../../runtime/agent/orchestrator/providers/command-code-oauth-tokens.mjs';
+import {
+  beginOAuthLogin as beginCommandCodeOAuthLogin,
+  loginOAuth as loginCommandCodeOAuth,
+} from '../../runtime/agent/orchestrator/providers/command-code-oauth-login.mjs';
 import {
   beginCursorOAuthLogin,
   describeCursorOAuthCredentials,
@@ -80,6 +89,7 @@ import {
   changeProviderAccounts,
   removeProviderAccount,
   clearProviderAccountQuotaState,
+  providerAccountLimit,
   ACCOUNT_PROVIDERS,
 } from '../../runtime/shared/provider-accounts.mjs';
 import { currentProviderAccountId, withProviderAccount } from '../../runtime/shared/provider-auth-binding.mjs';
@@ -154,6 +164,16 @@ const OAUTH_PROVIDERS = Object.freeze([
     begin: beginMuseCodeOAuthLogin,
     login: loginMuseCodeOAuth,
   }),
+  Object.freeze({
+    id: 'command-code-oauth',
+    name: 'Command Code',
+    desc: 'Sign in with your Command Code account',
+    has: hasCommandCodeOAuthCredentials,
+    describe: describeCommandCodeOAuthCredentials,
+    forget: forgetCommandCodeOAuthCredentials,
+    begin: beginCommandCodeOAuthLogin,
+    login: loginCommandCodeOAuth,
+  }),
   Object.freeze({
     id: 'mimo-oauth',
     name: 'MiMo',
@@ -421,6 +441,12 @@ function customProviderRow(id, entry, checkSecrets = true) {
   const keyless = (config?.auth ?? entry.auth) === 'none';
   const stored = checkSecrets ? hasStoredSecret(SECRET_ACCOUNTS.agentApiKey(id)) : false;
   const unstoredStatus = configuredEnabled ? 'No Key' : 'Off';
+  let status = stored ? 'Set' : unstoredStatus;
+  let detail = stored ? 'stored in keychain' : 'custom endpoint';
+  if (keyless) {
+    status = configuredEnabled ? 'Keyless' : 'Off';
+    detail = 'no API key required';
+  }
   const row = {
     id,
     name: entry.name,
@@ -431,12 +457,12 @@ function customProviderRow(id, entry, checkSecrets = true) {
     group: 'api',
     type: 'api-key',
     enabled: configuredEnabled,
-    authenticated: keyless ? true : checkSecrets ? stored : configuredEnabled,
+    authenticated: keyless || (checkSecrets ? stored : configuredEnabled),
     stored,
     env: false,
     envName: null,
-    status: keyless ? (configuredEnabled ? 'Keyless' : 'Off') : stored ? 'Set' : unstoredStatus,
-    detail: keyless ? 'no API key required' : stored ? 'stored in keychain' : 'custom endpoint',
+    status,
+    detail,
   };
   row.schemaVersion = config?.schemaVersion ?? entry.schemaVersion;
   row.auth = keyless ? 'none' : 'key';
@@ -584,7 +610,7 @@ export async function loginOAuthProvider(cfgMod, provider) {
     updateConfigProvider(cfgMod, id, { enabled: true });
     // Same reason as the interactive add-account flow: a fresh credential says
     // nothing about the quota the previous one exhausted.
-    if (ACCOUNT_PROVIDERS.includes(id)) clearProviderAccountQuotaState(id, currentProviderAccountId(id));
+    if (ACCOUNT_PROVIDERS.includes(id)) await clearProviderAccountQuotaState(id, currentProviderAccountId(id));
   }
   return { provider: id, type: 'oauth', authenticated: Boolean(auth.authenticated), status: auth.status || null };
 }
@@ -621,7 +647,7 @@ function rosterAccountForIdentity(id, oauth, newAccountId, auth) {
   return match?.id || null;
 }
 
-function settleOAuthLogin(
+async function settleOAuthLogin(
   { cfgMod, id, accountId: signedInId, addAccount, includeDefault, label, inAccount, oauth },
   result
 ) {
@@ -635,11 +661,11 @@ function settleOAuthLogin(
       renameSync(providerAccountPath(id, signedInId), providerAccountPath(id, existingId));
       accountId = existingId;
     }
-    registerProviderAccount(id, accountId, { includeDefault, label });
+    await registerProviderAccount(id, accountId, { includeDefault, label });
     // A re-connect can follow a re-created subscription under the same
     // account id: start it from no recorded quota rather than from the
     // exhausted window the previous credential earned.
-    clearProviderAccountQuotaState(id, accountId);
+    await clearProviderAccountQuotaState(id, accountId);
     updateConfigProvider(cfgMod, id, { enabled: true });
   }
   return {
@@ -688,12 +714,20 @@ export async function beginOAuthProviderLogin(cfgMod, provider, options = {}) {
   // The callback and a pasted code can both deliver the same sign-in; it must
   // settle once, because settling may move the credential to an existing id.
   let settled = null;
+  let settling = null;
   const finish = async (result) => {
     if (!result || cancelled) return null;
     if (settled) return settled;
-    const outcome = settleOAuthLogin(login, result);
-    if (outcome.authenticated) settled = outcome;
-    return outcome;
+    // Settling is async now: a second delivery arriving mid-write shares it.
+    if (settling) return settling;
+    settling = settleOAuthLogin(login, result);
+    try {
+      const outcome = await settling;
+      if (outcome.authenticated) settled = outcome;
+      return outcome;
+    } finally {
+      settling = null;
+    }
   };
   return {
     provider: id,
@@ -721,9 +755,11 @@ export function listProviderAccounts(provider) {
   if (!oauth) throw new TypeError('Unknown OAuth provider.');
   const pool = readProviderAccountPool(provider);
   const accounts = pool.accounts.length ? pool.accounts : defaultAccountRows(provider, oauth);
+  const now = Date.now();
   return {
     provider,
     auto: pool.auto !== false,
+    policy: pool.policy,
     useCredits: pool.useCredits === true,
     selectedId: pool.selectedId || accounts[0]?.id || null,
     accounts: accounts.map((row) => {
@@ -740,6 +776,9 @@ export function listProviderAccounts(provider) {
         reauthRequired: auth.reauthRequired === true,
         usage: row.usage || null,
         blockedUntil: row.blockedUntil || null,
+        // The limit holding the account now: account-wide, or only for one
+        // model family ("7D Fable") while other models still run.
+        limit: providerAccountLimit(row, now, { useCredits: pool.useCredits === true }),
         ...(identity ? { identity } : {}),
         ...(typeof auth.email === 'string' && auth.email.trim() ? { email: auth.email.trim() } : {}),
       };
@@ -753,17 +792,23 @@ function defaultAccountRows(provider, oauth) {
   return authenticated ? [{ id: 'default', label: 'Account 1' }] : [];
 }
 
-export function updateProviderAccounts(provider, change) {
+// Store the implicit signed-in `default` account in the roster, so a change or
+// a usage measurement has a row to land on. Returns the current roster view.
+export async function materializeProviderAccounts(provider) {
   const current = listProviderAccounts(provider);
-  if (!readProviderAccountPool(provider).accounts.length && current.accounts.length) {
-    registerProviderAccount(provider, 'default', { label: 'Account 1' });
-  }
-  changeProviderAccounts(provider, change);
+  if (readProviderAccountPool(provider).accounts.length || !current.accounts.length) return current;
+  await registerProviderAccount(provider, 'default', { label: 'Account 1' });
+  return listProviderAccounts(provider);
+}
+
+export async function updateProviderAccounts(provider, change) {
+  await materializeProviderAccounts(provider);
+  await changeProviderAccounts(provider, change);
   // Picking an account by hand is a decision to use it NOW, so the refusal
   // window and meter stored against it — both describing the state the user
   // just changed — are dropped here. Never in the pool's own fallback commit,
   // where clearing them would send the request back to a spent account.
-  if (change?.selectedId !== undefined) clearProviderAccountQuotaState(provider, change.selectedId);
+  if (change?.selectedId !== undefined) await clearProviderAccountQuotaState(provider, change.selectedId);
   return listProviderAccounts(provider);
 }
 
@@ -859,7 +904,8 @@ async function resolveCustomInput(cfgMod, rawInput, options) {
   const config = normalizeCustomProviderConfig(input, options);
   const typed = typeof input.apiKey === 'string' ? input.apiKey.trim() : '';
   const keyless = config.auth === 'none';
-  const apiKey = keyless ? '' : typed || (id ? getAgentApiKey(id) || '' : '');
+  let apiKey = '';
+  if (!keyless) apiKey = typed || (id ? getAgentApiKey(id) || '' : '');
   return { id, config, typed: keyless ? '' : typed, apiKey, keyless };
 }
 
@@ -1078,7 +1124,7 @@ export async function forgetProviderAuth(cfgModOrProvider, maybeProvider, reques
       throw new TypeError('Account is no longer connected.');
     }
     const result = withProviderAccount(id, accountId, () => oauth.forget());
-    const pool = removeProviderAccount(id, accountId);
+    const pool = await removeProviderAccount(id, accountId);
     if (cfgMod) updateConfigProvider(cfgMod, id, { enabled: pool.accounts.length > 0 });
     return { provider: id, type: 'oauth', forgotten: true, removed: Boolean(result?.removed) };
   }

package/src/session-runtime/services/usage-dashboard-model.mjs

@@ -236,6 +236,8 @@ function providerDescription(id, group) {
       return 'Grok Build subscription quota';
     case 'muse-code-oauth':
       return 'Muse Code subscription quota';
+    case 'command-code-oauth':
+      return 'Command Code subscription quota';
     case 'mimo-oauth':
       return 'MiMo Token Plan subscription quota';
     case 'antigravity-oauth':
@@ -343,6 +345,7 @@ const PROVIDER_RANKS = {
   'anthropic-oauth': 20,
   'grok-oauth': 30,
   'muse-code-oauth': 33,
+  'command-code-oauth': 33.5,
   'mimo-oauth': 34,
   'cursor-oauth': 35,
   'antigravity-oauth': 36,

package/src/session-runtime/setup-tool/executor.mjs

@@ -146,6 +146,7 @@ function publicAccounts(pool) {
   return {
     selectedId: pool.selectedId,
     auto: pool.auto,
+    ...(pool.policy ? { policy: pool.policy } : {}),
     useCredits: pool.useCredits === true,
     accounts: pool.accounts.map(({ id, label, authenticated, reauthRequired }) => ({
       id,
@@ -166,9 +167,15 @@ function mcpRows(status) {
       transport: server.transport || server.type || '',
       toolCount: Number(server.toolCount || 0),
       source: server.source || '',
+      ...(server.owner?.kind === 'plugin'
+        ? { plugin: server.owner.id, pluginServer: server.owner.key, disabledReason: server.disabledReason || null }
+        : {}),
       error: server.error || null,
+      ...(server.warnings?.length ? { warnings: server.warnings } : {}),
       scope: Array.isArray(server.scope) ? server.scope : null,
     })),
+    ...(status?.warnings?.length ? { warnings: status.warnings } : {}),
+    ...(status?.declarationErrors?.length ? { declarationErrors: status.declarationErrors } : {}),
   };
 }
 
@@ -577,7 +584,11 @@ const SETUP_ACTION_HANDLERS = {
     const plugin = ((await rt.pluginsStatus())?.plugins || []).find((row) => row.name === name || row.id === name);
     if (!plugin) throw new Error(`plugin "${name}" not found`);
     const result = await rt.enablePluginMcp(plugin);
-    return { serverName: result.serverName, mcp: mcpRows(result.status) };
+    return {
+      serverName: result.serverName,
+      ...(result.serverNames ? { serverNames: result.serverNames } : {}),
+      mcp: mcpRows(result.status),
+    };
   },
 };
 

package/src/session-runtime/setup-tool/extended-actions.mjs

@@ -34,6 +34,7 @@ function publicMcpConfig(row) {
   return {
     name: row.name,
     source: row.source,
+    ...(row.owner?.kind === 'plugin' ? { plugin: row.owner.id, pluginServer: row.owner.key, readOnly: true } : {}),
     enabled: row.enabled !== false,
     type: config.type || 'stdio',
     cwd: config.cwd || '',

package/src/session-runtime/setup-tool/settings-contract.mjs

@@ -196,6 +196,7 @@ export const SETUP_EXTENDED_PROPERTIES = Object.freeze({
     runInBackground: boolean,
     turnNotifications: boolean,
     usagePinned: boolean,
+    usageRailShortLong: boolean,
     computerObserveOnly: boolean,
     notificationVolume: {
       type: 'integer',

package/src/session-runtime/setup-tool/tool-defs.mjs

@@ -227,7 +227,7 @@ export const SETUP_TOOL_DEFS = Object.freeze([
           type: 'string',
           enum: [...INSTRUCTION_FILES_MODES],
           description:
-            'set_instruction_files: which user instruction files new sessions load (global ~/.codex/AGENTS.md, ~/.claude/CLAUDE.md, then the Project root\'s AGENTS.md/CLAUDE.md).',
+            "set_instruction_files: which user instruction files new sessions load (global ~/.codex/AGENTS.md, ~/.claude/CLAUDE.md, then the Project root's AGENTS.md/CLAUDE.md).",
         },
         name: {
           type: 'string',
@@ -244,6 +244,12 @@ export const SETUP_TOOL_DEFS = Object.freeze([
           properties: {
             selectedId: { type: 'string', description: 'Account to use now.' },
             auto: { type: 'boolean', description: 'Automatic switching to another account when one is exhausted.' },
+            policy: {
+              type: 'string',
+              enum: ['manual', 'limit', 'headroom'],
+              description:
+                'Account switching: manual = selected account only; limit = switch when it reaches a limit; headroom = each new session starts on the account with the most headroom.',
+            },
             useCredits: { type: 'boolean', description: 'Allow paid credits once plan limits are reached.' },
             order: {
               type: 'array',

package/src/session-runtime/skills-api.mjs

@@ -24,8 +24,8 @@ const DEFAULT_SKILL_BODY = '# Instructions\n\nDescribe how to use this skill.';
 export function createSkillsApi({ contextMod, getCwd, getTools = () => [] }) {
   const globalSkillsRoot = () => resolve(resolvePluginData(), 'skills');
 
-  function skillsStatus() {
-    const cwd = getCwd();
+  /** `cwd` overrides the session's folder (already validated by the caller). */
+  function skillsStatus({ cwd = getCwd() } = {}) {
     const skills = typeof contextMod.collectSkillsCached === 'function' ? contextMod.collectSkillsCached(cwd) : [];
     const norm = (value) =>
       String(value || '')
@@ -54,7 +54,10 @@ export function createSkillsApi({ contextMod, getCwd, getTools = () => [] }) {
         const source = sourceForSkill(skill);
         return {
           name: skill.name,
-          enabled: !(contextMod.isSkillDisabled?.(skill.name) || contextMod.skillMissingFeature?.(skill.name)),
+          enabled: !(
+            contextMod.isSkillDisabled?.(skill.name, null, skills) ||
+            contextMod.skillMissingFeature?.(skill.name, null, skills)
+          ),
           description: skill.description || '',
           whenToUse: skill.whenToUse || '',
           filePath: skill.filePath || null,
@@ -90,6 +93,7 @@ export function createSkillsApi({ contextMod, getCwd, getTools = () => [] }) {
     if (typeof contextMod.isSkillDisabled === 'function' && contextMod.isSkillDisabled(skillName)) {
       return `Error: skill "${skillName}" is disabled`;
     }
+    if (contextMod.skillOutsideScope?.(skillName, getCwd())) return contextMod.skillOutsideScopeError(skillName);
     const skill = skillContent(skillName);
     // The general tool envelope keeps the main/Lead session identical to agent
     // loops: the model-visible tool_result is the short stub and the SKILL.md

package/src/session-runtime/turn/turn-run/ask-callbacks.mjs

@@ -91,6 +91,7 @@ export function createAskCallbacks({ transcript, notifyFnForSession, scheduleSea
       onStreamDelta: streamDelta(turn, options),
       drainSteering: options.drainSteering,
       onSteerMessage: options.onSteerMessage,
+      onSkillsApplied: options.onSkillsApplied,
       notifyFn: notifyFnForSession(session0.id),
       signal: turn.signal,
     };

package/src/session-runtime/webhook-session-run.mjs

@@ -35,6 +35,10 @@ export async function runWebhookSession({
   workflow = null,
   attachments = null,
   signal = null,
+  // Endpoint-authored instructions: the run's ONLY skill-selection input.
+  // `prompt` also carries the fenced external payload, which must never
+  // select a skill; absent means nothing selects.
+  skillSelection = '',
 }) {
   const endpoint = String(name || '').trim();
   const body = String(prompt || '').trim();
@@ -63,9 +67,17 @@ export async function runWebhookSession({
   // askOpts.signal is the parent-abort link: it is cascaded onto the turn
   // controller, so aborting it stops the in-flight provider/tool work instead
   // of leaving a timed-out delivery's session running with live side effects.
-  const ask = (turnContent) =>
-    askSession(session.id, turnContent, null, null, projectCwd || undefined, undefined, signal ? { signal } : {});
-  // Agents the run delegates to report back; each result is the next turn.
-  const result = await runAutomationTurns(session.id, () => ask(content), ask);
+  const ask = (turnContent, askOpts) =>
+    askSession(session.id, turnContent, null, null, projectCwd || undefined, undefined, {
+      ...askOpts,
+      ...(signal ? { signal } : {}),
+    });
+  // Agents the run delegates to report back; each result is the next turn
+  // (runAutomationTurns marks those turns as task notifications).
+  const result = await runAutomationTurns(
+    session.id,
+    () => ask(content, { skillSelection: String(skillSelection ?? '') }),
+    ask
+  );
   return { sessionId: session.id, result: String(result?.content || '') };
 }

package/src/skill-script-entry.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+// Entry the skill-script launcher runs (src/runtime/shared/skill-script-runtime.mjs):
+//   <runtime executable> skill-script-entry.mjs <script.mjs> [args...]
+// The script then sees itself as the main module, exactly as under
+// `node <script.mjs> [args...]`, and its exit code is the process's.
+
+// Before anything can import sharp: Electron on Linux must use its wasm build.
+await import('./runtime/shared/sharp-electron-linux.mjs');
+// Node mode belongs to this process only; whatever the script starts is a
+// normal child again.
+delete process.env.ELECTRON_RUN_AS_NODE;
+
+const { pathToFileURL } = await import('node:url');
+const { canonicalSkillScriptPath, decodeSkillArgv, SKILL_ARGV_ENV } = await import(
+  './runtime/shared/skill-script-runtime.mjs'
+);
+
+// The PowerShell `mixdog-skill-node` function passes its arguments in the
+// environment (see renderPowerShellSkillFunction); the script never sees them.
+const envArgv = process.argv.length === 2 ? decodeSkillArgv(process.env[SKILL_ARGV_ENV]) : null;
+delete process.env[SKILL_ARGV_ENV];
+const [execPath, , target, ...args] = envArgv ? [process.argv[0], process.argv[1], ...envArgv] : process.argv;
+if (!target) {
+  console.error('Usage: <skill launcher> <script.mjs> [args...]');
+  process.exitCode = 2;
+} else {
+  const script = canonicalSkillScriptPath(target);
+  // The scripts' main check compares import.meta.url with argv[1].
+  process.argv = [execPath, script, ...args];
+  try {
+    await import(pathToFileURL(script).href);
+  } catch (error) {
+    console.error(error?.stack || String(error));
+    process.exitCode = 1;
+  }
+}

package/src/standalone/daemon-stored-session-views.mjs

@@ -78,9 +78,17 @@ export function createStoredSessionViews({ desktopRuntime, dataDir }) {
         });
       }
       const store = await desktopRuntime.loadSessionStore();
-      return store.listStoredSessionSummaries({
-        refreshFromStorage: options.refreshFromStorage === true,
-      });
+      const refreshFromStorage = options.refreshFromStorage === true;
+      // Paged ordinary catalog ({ sessions, nextCursor }) only on the explicit
+      // `page: { limit, cursor }` option (`limit` alone keeps its old meaning:
+      // ignored, full array). An authoritative refresh is never paged.
+      const page = options.page && typeof options.page === 'object' ? options.page : null;
+      if (page && !refreshFromStorage && store.listStoredSessionSummaryPage) {
+        return store.listStoredSessionSummaryPage({ limit: page.limit, cursor: page.cursor });
+      }
+      // The async listing may answer from the session catalog DB.
+      if (store.listStoredSessionSummariesAsync) return store.listStoredSessionSummariesAsync({ refreshFromStorage });
+      return store.listStoredSessionSummaries({ refreshFromStorage });
     },
   };
 }

package/src/standalone/daemon.mjs

@@ -49,6 +49,7 @@ import {
   startOwnerLivenessListener,
 } from './daemon-owner.mjs';
 import { remoteIntentPath } from '../runtime/shared/remote-intent.mjs';
+import { modelProxyClientMode } from '../runtime/shared/model-proxy-mode.mjs';
 import { setChannelNotifySink } from '../runtime/channels/lib/parent-bridge.mjs';
 import { setOwnerContext } from '../runtime/channels/lib/runtime-paths.mjs';
 import { safeIpcSend } from '../runtime/shared/safe-ipc-send.mjs';
@@ -144,6 +145,11 @@ let ownerLiveness = null;
 // The endpoints daemon.json carries once published; a heartbeat re-publishes
 // them when the file goes missing (TEMP cleanup).
 let publishedEndpoints = null;
+// Remote mode only: the loopback relay that lets headless runs started from
+// model shells (skill scripts) reach the PC behind this daemon's model proxy
+// channel (providers/model-proxy-bridge.mjs), and its running-call count.
+let modelProxyBridge = null;
+let modelProxyBridgeActive = 0;
 const eventLoopDelay = monitorEventLoopDelay({ resolution: 20 });
 eventLoopDelay.enable();
 let idleGc = null;
@@ -218,6 +224,13 @@ async function shutdown(reason, code = 0) {
   try {
     setChannelNotifySink(null);
   } catch {}
+  // Abort every relayed model call, close the bridge sockets and wait for the
+  // calls to settle before anything they depend on goes away.
+  try {
+    await modelProxyBridge?.close(`daemon shutdown: ${reason}`);
+  } catch (e) {
+    log(`model proxy bridge stop failed: ${e?.message || e}`);
+  }
   try {
     await sessionService?.stop?.(reason);
   } catch (e) {
@@ -292,7 +305,7 @@ async function shutdown(reason, code = 0) {
  *  asks whether this process may exit; idle GC asks whether a pause is safe. */
 function inFlightWork() {
   return {
-    activeCalls: (transport?.activeCount ?? 0) + (sessionTransport?.activeCount ?? 0),
+    activeCalls: (transport?.activeCount ?? 0) + (sessionTransport?.activeCount ?? 0) + modelProxyBridgeActive,
     queuedCalls: (transport?.queuedCount ?? 0) + (sessionTransport?.queuedCount ?? 0),
     busySessions: sessionService?.busyCount ?? 0,
     busyMemoryAgents: agentDispatchBroker?.snapshot?.().inFlight ?? 0,
@@ -562,9 +575,9 @@ function daemonStatusSnapshot() {
 
 /** The file every attacher reads to find this daemon: wire identity plus both
  *  loopback endpoints and their privileged tokens. */
-function publishDaemonDiscovery({ channel, session }) {
+function publishDaemonDiscovery({ channel, session, modelProxy = null }) {
   // A re-publish keeps the first publication's startedAt.
-  publishedEndpoints = { channel, session, startedAt: publishedEndpoints?.startedAt ?? Date.now() };
+  publishedEndpoints = { channel, session, modelProxy, startedAt: publishedEndpoints?.startedAt ?? Date.now() };
   writeJsonAtomicSync(
     DAEMON_DISCOVERY_PATH,
     {
@@ -577,12 +590,34 @@ function publishDaemonDiscovery({ channel, session }) {
       endpoints: {
         channel: { port: channel.port, token: channel.token },
         session: { port: session.port, token: session.token },
+        ...(modelProxy ? { modelProxy: { port: modelProxy.port, token: modelProxy.token } } : {}),
       },
     },
     { compact: true, secret: true }
   );
 }
 
+/** Remote mode only: the model proxy bridge endpoint to publish, or null. */
+async function startModelProxyBridge(bootPhases) {
+  if (!modelProxyClientMode()) return null;
+  const [{ createModelProxyBridgeServer }, { getModelProxyChannel }] = await Promise.all([
+    import('../runtime/agent/orchestrator/providers/model-proxy-bridge.mjs'),
+    import('../runtime/agent/orchestrator/providers/model-proxy-channel.mjs'),
+  ]);
+  modelProxyBridge = createModelProxyBridgeServer({
+    channel: getModelProxyChannel(),
+    // Fenced or shutting down: no new relayed call.
+    admit: () => !shuttingDown && admitOwnerWork(),
+    trackWork: (active) => {
+      modelProxyBridgeActive = active;
+    },
+    log,
+  });
+  const endpoint = await bootPhases.measure('model-proxy-bridge-start', () => modelProxyBridge.start());
+  log(`model proxy bridge on 127.0.0.1:${endpoint.port}`);
+  return endpoint;
+}
+
 /** Asked by both front doors before every register/call: an expired lease
  *  fences here (answered 503), and after an event-loop stall nothing is
  *  served until the record is re-verified as ours. */
@@ -598,6 +633,7 @@ function fenceDaemon(reason) {
   log(`${reason} — refusing new work and stopping so only one daemon serves`);
   sessionTransport?.commitDrain?.(reason);
   transport?.commitDrain?.(reason);
+  modelProxyBridge?.abortAll(reason);
   try {
     if (discoveryPid(DAEMON_DISCOVERY_PATH) === process.pid) rmSync(DAEMON_DISCOVERY_PATH, { force: true });
   } catch (e) {
@@ -890,6 +926,7 @@ async function main() {
     admitWork: admitOwnerWork,
   });
   const sessionEndpoint = await bootPhases.measure('session-transport-start', () => sessionTransport.start());
+  const modelProxyEndpoint = await startModelProxyBridge(bootPhases);
   // A boot whose holder stopped answering may have been superseded by a
   // contender between beats; never publish over the winner's endpoint. An
   // unreadable record (an antivirus lock) is not a takeover.
@@ -900,7 +937,7 @@ async function main() {
     exitRecorder.setReason(`owner claim superseded by pid=${ownerPid} before publish`, 0);
     process.exit(0);
   }
-  publishDaemonDiscovery({ channel: { port, token }, session: sessionEndpoint });
+  publishDaemonDiscovery({ channel: { port, token }, session: sessionEndpoint, modelProxy: modelProxyEndpoint });
   bootPhases.mark('discovery-published');
   log(`session front door on 127.0.0.1:${sessionEndpoint.port}`);
 

package/src/standalone/session-protocol.mjs

@@ -13,6 +13,7 @@ export const SESSION_READ_ACTIONS = Object.freeze([
   'getChannelSetup',
   'getChannelWorkerStatus',
   'getCompactionSettings',
+  'getConversationImportJobs',
   'getDeveloperSettings',
   'getDisabledSkills',
   'getMediaDefault',
@@ -57,6 +58,7 @@ export const SESSION_READ_ACTIONS = Object.freeze([
   'hooksStatus',
   'inheritancePreflight',
   'listAgents',
+  'listImportableConversations',
   'listMediaAssets',
   'listMediaLanes',
   'listOutputStyles',
@@ -87,6 +89,7 @@ export const SESSION_CONFIGURE_ACTIONS = Object.freeze([
   'cacheMediaThumbnail',
   'cancelMediaJob',
   'cancelOAuthProviderLogin',
+  'cancelConversationImport',
   'checkForUpdate',
   'clear',
   'compact',
@@ -118,6 +121,7 @@ export const SESSION_CONFIGURE_ACTIONS = Object.freeze([
   'pushNotice',
   'recall',
   'reconnectMcp',
+  'registerConversationImportFile',
   'reloadPlugins',
   'reloadSkills',
   'rememberPromptHistory',
@@ -198,6 +202,7 @@ export const SESSION_CONFIGURE_ACTIONS = Object.freeze([
   'setOrchestrationMode',
   'saveStarterGuideState',
   'skipOnboarding',
+  'startConversationImport',
   'startMediaJob',
   'stopShellJob',
   'switchContext',

package/src/standalone/session-service/session-calls/session-action.mjs

@@ -101,15 +101,20 @@ export function createSessionActionCalls(ctx) {
     if (typeof listSessions !== 'function') {
       throw new Error('session catalog is unavailable');
     }
-    const sessions = await listSessions({
+    const listed = await listSessions({
       ...(options || {}),
       // Agent-only records are an internal ancestry/reuse source, never part
       // of the ordinary session catalog returned over the public transport.
       includeAgentOnly: false,
     });
+    // A `page: { limit, cursor }` request answers one page: { sessions, nextCursor }.
+    const page = listed && !Array.isArray(listed) && Array.isArray(listed.sessions) ? listed : null;
+    const sessions = page ? page.sessions : listed;
     const remoteSession = typeof getRemoteSessionState === 'function' ? await getRemoteSessionState() : null;
+    const nextCursor = typeof page?.nextCursor === 'string' ? page.nextCursor : null;
     return {
       sessions: sanitizeForWire(Array.isArray(sessions) ? sessions : []),
+      ...(page ? { nextCursor } : {}),
       remoteSession: sanitizeForWire(remoteSession) ?? null,
     };
   }

package/src/tui/App.jsx

@@ -21,6 +21,7 @@ import { useApp, useStdin, useStdout } from 'ink';
 import { useSession } from './hooks/useSession.mjs';
 import { pickFolder } from '../standalone/folder-dialog.mjs';
 import { deriveSlashPalette } from './app/slash-palette.mjs';
+import { skillMentionQuery, useSkillMentionSkills } from './app/skill-mention-palette.mjs';
 import { shouldSupersedePanelEpoch, supersedePanelEpoch } from './app/panel-epoch.mjs';
 import { createPanelSurface } from './app/panel-surface.mjs';
 import { resolvePickerState } from './app/picker-index-mode.mjs';
@@ -215,6 +216,8 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
     setPromptDraft,
     promptDraftOverride,
     setPromptDraftOverride,
+    promptCaret,
+    setPromptCaret,
     promptLayoutValueRef,
     setPromptLayoutRows,
     textEntryLayoutRows,
@@ -625,7 +628,8 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
     pastedTextsRef,
   });
 
-  const { activeSlashQuery, slashCommands, slashPaletteOpen } = deriveSlashPalette({
+  const mentionSkills = useSkillMentionSkills(store, skillMentionQuery(promptDraft, promptCaret) !== null);
+  const { activeSlashQuery, slashCommands, slashPaletteOpen, paletteKind } = deriveSlashPalette({
     providerPrompt,
     settingsPrompt,
     toolApproval,
@@ -636,6 +640,8 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
     commandBusy: state.commandBusy,
     promptDraft,
     slashDismissedFor,
+    skills: mentionSkills,
+    promptCaret,
   });
   slashPaletteRef.current = { open: slashPaletteOpen, count: slashCommands.length };
   scrollFocusRef.current = {
@@ -833,10 +839,12 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
     hasUserMessages,
     initialStatusLine,
     onPromptDraftChange,
+    onPromptCaretChange: setPromptCaret,
     onSubmit,
     overlayHintAttachItemIndex,
     overlayHintFallbackRow,
     overlayHintOnLastItem,
+    paletteKind,
     panelInkMaskEpoch,
     panelTransitionEpoch,
     picker,