mixdog 1.2.0 → 1.2.2

package/src/runtime/shared/llm/provider-catalog-registry.mjs

@@ -85,6 +85,12 @@ const PROVIDER_CATALOGS = Object.freeze({
   // Effort tiers live in the wire id; a row without levels has no effort
   // surface (resolveAntigravityWireModel drops the effort).
   'antigravity-oauth': { relay: true, rosterFiles: ['antigravity-oauth-models.json'], rosterLadderFinal: true },
+  // api.commandcode.ai/provider/v1 relays other vendors' models.
+  'command-code-oauth': {
+    relay: true,
+    rosterFiles: ['command-code-oauth-models.json'],
+    rosterLimitsAuthoritative: true,
+  },
   'cursor-oauth': { relay: true },
   'cursor-api': { relay: true },
   'opencode-go': { relay: true },
@@ -126,6 +132,17 @@ export function providerCatalogEntry(provider) {
   };
 }
 
+/** models.dev ids of the registered non-relay providers: vendors that serve their own models. */
+export function firstPartyModelsDevIds() {
+  return [
+    ...new Set(
+      Object.values(PROVIDER_CATALOGS)
+        .filter((entry) => entry.relay !== true && entry.modelsDev)
+        .map((entry) => entry.modelsDev)
+    ),
+  ].sort();
+}
+
 export function modelsDevProviderId(provider) {
   return providerCatalogEntry(provider)?.modelsDev || null;
 }

package/src/runtime/shared/llm/provider-model-identities.mjs

@@ -1,6 +1,7 @@
 // Model identities are shared by transport and pricing. Keep this module
 // independent of credentials, tracing and provider initialization.
-function fallbackModel(id, display, family, contextWindow, wire) {
+// `levels` names the thinkingLevel values a single-wire model takes.
+function fallbackModel(id, display, family, contextWindow, wire, levels = []) {
   const tiered = wire && typeof wire === 'object';
   return {
     id,
@@ -12,7 +13,7 @@ function fallbackModel(id, display, family, contextWindow, wire) {
     supportsVision: true,
     supportsReasoning: true,
     supportsFunctionCalling: true,
-    reasoningLevels: tiered ? Object.keys(wire) : [],
+    reasoningLevels: tiered ? Object.keys(wire) : [...levels],
     wire,
   };
 }
@@ -27,8 +28,16 @@ export const ANTIGRAVITY_MODELS = Object.freeze([
     low: 'gemini-3.1-pro-low',
     high: 'gemini-3.1-pro-high',
   }),
-  fallbackModel('claude-opus-4-6-thinking', 'Claude Opus 4.6 (Thinking)', null, 250000, 'claude-opus-4-6-thinking'),
-  fallbackModel('claude-sonnet-4-6', 'Claude Sonnet 4.6 (Thinking)', null, 250000, 'claude-sonnet-4-6'),
+  fallbackModel('claude-opus-4-6-thinking', 'Claude Opus 4.6 (Thinking)', null, 250000, 'claude-opus-4-6-thinking', [
+    'low',
+    'medium',
+    'high',
+  ]),
+  fallbackModel('claude-sonnet-4-6', 'Claude Sonnet 4.6 (Thinking)', null, 250000, 'claude-sonnet-4-6', [
+    'low',
+    'medium',
+    'high',
+  ]),
   fallbackModel('gpt-oss-120b-medium', 'GPT-OSS 120B (Medium)', 'gpt-oss', 131072, 'gpt-oss-120b-medium'),
 ]);
 

package/src/runtime/shared/llm/usage-rollup.mjs

@@ -59,7 +59,6 @@ const MAX_SESSION_TOKENS_PER_DAY = 400;
 const DAY_MS = 24 * 60 * 60 * 1000;
 const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
 
-// Shared with usage-session-history.mjs, which folds the same bucket shape.
 export function num(value) {
   const n = Number(value);
   return Number.isFinite(n) && n > 0 ? n : 0;

package/src/runtime/shared/model-display.mjs

@@ -3,6 +3,19 @@
  * No I/O, catalog, or gateway imports — safe for static TUI bundling.
  */
 
+const titleCaseOption = (value) =>
+  String(value || '')
+    .split(/([\s_-]+)/)
+    .map((part) => (/^[\s_-]+$/.test(part) ? part : `${part.charAt(0).toUpperCase()}${part.slice(1).toLowerCase()}`))
+    .join('');
+
+export const effortDisplayLabel = (value) => {
+  const text = String(value || '').trim();
+  if (!text) return '';
+  if (text.toLowerCase() === 'xhigh') return 'XHigh';
+  return titleCaseOption(text);
+};
+
 export function titleModelPart(part) {
   const text = String(part || '').trim();
   if (!text) return '';

package/src/runtime/shared/plugin-manifest.mjs

@@ -7,10 +7,19 @@
 import { isAbsolute, join, relative, resolve } from 'node:path';
 import { readJsonSafe } from './json-file.mjs';
 
-/** `.codex-plugin/plugin.json` wins over a root-level `plugin.json`; a plugin
- *  without either is an empty manifest, never an error. */
+/** Manifest files in precedence order: `.codex-plugin/plugin.json`, a
+ *  root-level `plugin.json`, then Claude Code's `.claude-plugin/plugin.json`. */
+export const PLUGIN_MANIFEST_FILES = ['.codex-plugin/plugin.json', 'plugin.json', '.claude-plugin/plugin.json'];
+
+/** First readable manifest in `PLUGIN_MANIFEST_FILES` order; a plugin without
+ *  any is an empty manifest, never an error. A Claude Code manifest's `skills`
+ *  is a plugin-relative path (e.g. `./.claude/skills/`). */
 export function pluginManifest(root) {
-  return readJsonSafe(join(root, '.codex-plugin', 'plugin.json')) || readJsonSafe(join(root, 'plugin.json')) || {};
+  for (const rel of PLUGIN_MANIFEST_FILES) {
+    const manifest = readJsonSafe(join(root, ...rel.split('/')));
+    if (manifest) return manifest;
+  }
+  return {};
 }
 
 /** Resolve a manifest-relative path, refusing absolute paths and anything
@@ -21,22 +30,22 @@ export function resolveContainedPluginPath(root, rel) {
   const base = resolve(root);
   const abs = resolve(base, trimmed);
   const relToBase = relative(base, abs);
-  if (relToBase.startsWith('..') || isAbsolute(relToBase)) return null;
+  if (relToBase.split(/[\\/]/)[0] === '..' || isAbsolute(relToBase)) return null;
   return abs;
 }
 
-/** Skill roots a plugin contributes: the conventional `<root>/skills/` plus an
- *  optional manifest `skills` path. Deduplicated, absolute, root-contained. */
+/** Skill roots a plugin contributes: the conventional `<root>/skills/` plus the
+ *  manifest `skills` field, a path or a list of paths. Deduplicated, absolute,
+ *  root-contained. */
 export function pluginSkillsRoots(root) {
   const manifest = pluginManifest(root);
   const roots = new Set();
   const add = (rel) => {
+    if (typeof rel !== 'string' || !rel.trim()) return;
     const abs = resolveContainedPluginPath(root, rel);
     if (abs) roots.add(abs);
   };
   add('./skills/');
-  if (typeof manifest.skills === 'string' && manifest.skills.trim()) {
-    add(manifest.skills.trim());
-  }
+  for (const rel of Array.isArray(manifest.skills) ? manifest.skills : [manifest.skills]) add(rel);
   return [...roots];
 }

package/src/runtime/shared/pristine-execution-contract.json

@@ -66,11 +66,18 @@
     },
     "muse-code-oauth": {
       "credentialFile": "muse-code-oauth.json",
-      "credentialPathEnv": "MUSE_CODE_OAUTH_CREDENTIALS_PATH"
+      "credentialPathEnv": "MUSE_CODE_OAUTH_CREDENTIALS_PATH",
+      "modelCatalogFile": "muse-code-oauth-models.json"
+    },
+    "command-code-oauth": {
+      "credentialFile": "command-code-oauth.json",
+      "credentialPathEnv": "COMMAND_CODE_OAUTH_CREDENTIALS_PATH",
+      "modelCatalogFile": "command-code-oauth-models.json"
     },
     "mimo-oauth": {
       "credentialFile": "mimo-oauth.json",
-      "credentialPathEnv": "MIMO_OAUTH_CREDENTIALS_PATH"
+      "credentialPathEnv": "MIMO_OAUTH_CREDENTIALS_PATH",
+      "modelCatalogFile": "mimo-oauth-models.json"
     },
     "cursor-oauth": {
       "credentialFile": "cursor-oauth.json",

package/src/runtime/shared/pristine-execution.mjs

@@ -8,6 +8,12 @@ import { ACCOUNT_PROVIDERS, providerAccountPath, readProviderAccountPool } from
 import { AGENT_PROVIDER_ENV_ALIASES, getAgentApiKey } from './provider-api-key.mjs';
 import { platformEntryKey } from './native-asset.mjs';
 import { clean } from './clean.mjs';
+import { MODEL_PROXY_ENV, modelProxyClientMode } from './model-proxy-mode.mjs';
+import { installModelProxyChannel } from '../agent/orchestrator/providers/model-proxy-channel.mjs';
+import {
+  ModelProxyBridgeChannel,
+  readModelProxyBridgeDiscovery,
+} from '../agent/orchestrator/providers/model-proxy-bridge.mjs';
 
 const contractPath = fileURLToPath(new URL('./pristine-execution-contract.json', import.meta.url));
 
@@ -205,6 +211,12 @@ export function createPristineExecutionBoundary({
 
   const contract = PRISTINE_EXECUTION_CONTRACT;
   const hostEnv = { ...env };
+  // Remote (SSH) mode: this server holds no model credentials, so the child
+  // runtime's model calls go through the daemon's model proxy bridge. Its
+  // endpoint is read from the HOST runtime root, before it is retargeted
+  // below; a missing or stale one fails closed (never a local credential).
+  const proxyMode = modelProxyClientMode(hostEnv);
+  const bridgeEndpoint = proxyMode ? readModelProxyBridgeDiscovery(hostEnv.MIXDOG_RUNTIME_ROOT) : null;
   const originalEnv = new Map();
   const touchedKeys = new Set();
   const rememberEnv = (name) => {
@@ -227,6 +239,8 @@ export function createPristineExecutionBoundary({
   mkdirSync(runtimeRoot, { recursive: true, mode: 0o700 });
   let cleaned = false;
   let restoreAuthBindings = () => {};
+  let bridgeChannel = null;
+  let restoreModelProxyChannel = () => {};
   // rmSync backs off linearly (retryDelay × attempt), so 50 retries at 100ms
   // is a ≈128s budget per attempt. Callers whose result is already complete
   // (headless exec) pass a smaller budget and leave stragglers to the sweep.
@@ -238,6 +252,8 @@ export function createPristineExecutionBoundary({
       else env[name] = value;
     }
     restoreAuthBindings();
+    restoreModelProxyChannel();
+    bridgeChannel?.dispose('the headless run finished');
     const removal = { recursive: true, force: true, maxRetries: rootRemovalRetries, retryDelay: 100 };
     // Windows releases file handles (pg.log, sockets) a beat after the owning
     // process exits; rmSync retries absorb that EBUSY/EPERM window.
@@ -280,7 +296,7 @@ export function createPristineExecutionBoundary({
     const oauth = contract.oauthProviders[selectedProvider];
     const apiKeyEnv = contract.apiKeyProviders[selectedProvider];
     let selectedApiKey = null;
-    if (apiKeyEnv) {
+    if (apiKeyEnv && !proxyMode) {
       // Resolve before scrubbing so the selected provider may use its standard,
       // MIXDOG_AGENT_*, alias, or one provider-scoped keychain account. No
       // general config loader or all-provider credential scan is involved.
@@ -311,7 +327,15 @@ export function createPristineExecutionBoundary({
 
     let authMode = 'provider-managed';
     let catalogCount = 0;
-    if (oauth) {
+    if (proxyMode) {
+      // No API key, OAuth account or credential binding: the PC behind the
+      // daemon runs every call. The runtime root stays the pristine one, for
+      // the services this run owns; only model calls reach the daemon.
+      setEnv(MODEL_PROXY_ENV, 'client');
+      bridgeChannel = new ModelProxyBridgeChannel(bridgeEndpoint);
+      restoreModelProxyChannel = installModelProxyChannel(bridgeChannel);
+      authMode = 'model-proxy-bridge';
+    } else if (oauth) {
       // Sign-in writes the selected account of the host's provider-accounts
       // pool; the single legacy file remains for hosts that predate the pool.
       // An explicit credential path still overrides both. Read the pool from
@@ -340,8 +364,8 @@ export function createPristineExecutionBoundary({
         [selectedProvider]: sourceCredential,
       });
       authMode = 'in-process-host-oauth-binding';
-      const sourceCatalog = join(sourceDataDir, oauth.modelCatalogFile);
-      if (oauth.modelCatalogFile && existsSync(sourceCatalog)) {
+      const sourceCatalog = oauth.modelCatalogFile && join(sourceDataDir, oauth.modelCatalogFile);
+      if (sourceCatalog && existsSync(sourceCatalog)) {
         copyFileSync(sourceCatalog, join(dataDir, oauth.modelCatalogFile));
         catalogCount = 1;
       }

package/src/runtime/shared/provider-accounts.mjs

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { parseJsonText, updateJsonAtomicSync } from './atomic-file.mjs';
+import { parseJsonText, updateJsonAtomic } from './atomic-file.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
 
 export const ACCOUNT_PROVIDERS = Object.freeze([
@@ -9,6 +9,7 @@ export const ACCOUNT_PROVIDERS = Object.freeze([
   'anthropic-oauth',
   'grok-oauth',
   'muse-code-oauth',
+  'command-code-oauth',
   'mimo-oauth',
   'cursor-oauth',
   'antigravity-oauth',
@@ -74,16 +75,39 @@ function normalizeLabels(pool) {
   return { ...pool, accounts };
 }
 
+// How the roster picks an account. `manual` serves from the selected account
+// only; `limit` keeps the selected account until it reaches a limit and then
+// moves to the account with the most headroom; `headroom` starts every new
+// session on the account with the most headroom and keeps it for that session.
+export const ACCOUNT_POLICIES = Object.freeze(['manual', 'limit', 'headroom']);
+
+// `auto` predates `policy` and is still written beside it, so a build that
+// knows only `auto` reads the same switching on/off. Whenever the two
+// disagree (an older build toggled `auto`), `auto` decides whether switching
+// is on at all.
+export function providerAccountPolicy(pool) {
+  if (pool?.auto === false) return 'manual';
+  return pool?.policy === 'headroom' ? 'headroom' : 'limit';
+}
+
+function normalizePool(pool) {
+  if (!pool) return pool;
+  const policy = providerAccountPolicy(pool);
+  return { ...normalizeLabels(pool), policy, auto: policy !== 'manual' };
+}
+
 export function readProviderAccountPool(provider, dataDir = resolvePluginData()) {
   requireAccountProvider(provider);
-  return normalizeLabels(read(dataDir).providers[provider]) || { accounts: [], selectedId: null, auto: true };
+  return (
+    normalizePool(read(dataDir).providers[provider]) || { accounts: [], selectedId: null, auto: true, policy: 'limit' }
+  );
 }
 
-function update(provider, mutate) {
+async function update(provider, mutate) {
   requireAccountProvider(provider);
   // Read failures must not be interpreted as an empty account roster.
   read();
-  const result = updateJsonAtomicSync(
+  const result = await updateJsonAtomic(
     file(),
     (raw) => {
       const state = validate(raw);
@@ -94,7 +118,7 @@ function update(provider, mutate) {
     },
     { mode: 0o600, secret: true, fsyncDir: true }
   );
-  return normalizeLabels(result.providers[provider]);
+  return normalizePool(result.providers[provider]);
 }
 
 /**
@@ -117,7 +141,7 @@ export function newProviderAccountId() {
   return randomUUID();
 }
 
-export function registerProviderAccount(provider, id, { label = '', includeDefault = false } = {}) {
+export async function registerProviderAccount(provider, id, { label = '', includeDefault = false } = {}) {
   requireAccountId(id);
   return update(provider, (pool) => {
     if (includeDefault && !pool.accounts.some((row) => row.id === 'default')) {
@@ -131,12 +155,12 @@ export function registerProviderAccount(provider, id, { label = '', includeDefau
   });
 }
 
-export function changeProviderAccounts(provider, change) {
+export async function changeProviderAccounts(provider, change) {
   if (
     !change ||
     typeof change !== 'object' ||
     Array.isArray(change) ||
-    Object.keys(change).some((key) => !['selectedId', 'order', 'auto', 'useCredits', 'rename'].includes(key))
+    Object.keys(change).some((key) => !['selectedId', 'order', 'auto', 'policy', 'useCredits', 'rename'].includes(key))
   ) {
     throw new TypeError('Invalid provider account change.');
   }
@@ -175,8 +199,19 @@ export function changeProviderAccounts(provider, change) {
     }
     if (change.auto !== undefined) {
       if (typeof change.auto !== 'boolean') throw new TypeError('Automatic account switching must be boolean.');
+      // Turning switching on keeps a non-manual policy; on from manual is the
+      // classic switch-at-limit behaviour.
+      const current = providerAccountPolicy(pool);
+      if (!change.auto) pool.policy = 'manual';
+      else if (current === 'manual') pool.policy = 'limit';
+      else pool.policy = current;
       pool.auto = change.auto;
     }
+    if (change.policy !== undefined) {
+      if (!ACCOUNT_POLICIES.includes(change.policy)) throw new TypeError('Unknown account switching policy.');
+      pool.policy = change.policy;
+      pool.auto = change.policy !== 'manual';
+    }
     if (change.useCredits !== undefined) {
       if (typeof change.useCredits !== 'boolean') throw new TypeError('Credit use must be boolean.');
       pool.useCredits = change.useCredits;
@@ -184,7 +219,24 @@ export function changeProviderAccounts(provider, change) {
   });
 }
 
-export function removeProviderAccount(provider, id) {
+// Selects `id` only while the selection is still `expectedSelectedId`, checked
+// under the write's own lock, so a newer selection (a manual switch) wins. A
+// given `expectedPolicy` must also still hold: a policy change while the
+// request ran (e.g. to Manual) cancels the commit.
+// Returns the pool when the selection moved, otherwise null.
+export async function selectProviderAccountIf(provider, expectedSelectedId, id, expectedPolicy) {
+  requireAccountId(id);
+  let moved = false;
+  const pool = await update(provider, (pool) => {
+    if (pool.selectedId !== expectedSelectedId || !pool.accounts.some((row) => row.id === id)) return;
+    if (expectedPolicy && providerAccountPolicy(pool) !== expectedPolicy) return;
+    pool.selectedId = id;
+    moved = true;
+  });
+  return moved ? pool : null;
+}
+
+export async function removeProviderAccount(provider, id) {
   requireAccountId(id);
   return update(provider, (pool) => {
     pool.accounts = pool.accounts.filter((row) => row.id !== id);
@@ -192,7 +244,7 @@ export function removeProviderAccount(provider, id) {
   });
 }
 
-export function recordProviderAccountUsage(provider, id, snapshot) {
+export async function recordProviderAccountUsage(provider, id, snapshot) {
   if (!snapshot || !Array.isArray(snapshot.quotaWindows)) return;
   const windows = snapshot.quotaWindows.slice(0, 12).map((row) => ({
     label: String(row.label || '').slice(0, 40),
@@ -200,7 +252,7 @@ export function recordProviderAccountUsage(provider, id, snapshot) {
     resetAt: typeof row.resetAt === 'number' && Number.isFinite(row.resetAt) ? row.resetAt : null,
   }));
   if (!readProviderAccountPool(provider).accounts.some((row) => row.id === id)) return;
-  update(provider, (pool) => {
+  await update(provider, (pool) => {
     const row = pool.accounts.find((entry) => entry.id === id);
     if (!row) return;
     row.usage = { windows, checkedAt: Date.now() };
@@ -225,7 +277,7 @@ const MAX_BLOCK_MS = 6 * 60 * 60_000;
 // early can tell us anything.
 // `options.quota` records that the block came from a typed quota refusal or an
 // exhausted usage window, so later sends still count it as quota evidence.
-export function blockProviderAccount(provider, id, until, model = '', source = 'inferred', options = {}) {
+export async function blockProviderAccount(provider, id, until, model = '', source = 'inferred', options = {}) {
   return update(provider, (pool) => {
     const row = pool.accounts.find((entry) => entry.id === id);
     if (!row) return;
@@ -245,7 +297,7 @@ export function blockProviderAccount(provider, id, until, model = '', source = '
 // the refusal window and the meter recorded against the OLD subscription would
 // otherwise outlive it and refuse a request the provider would have served.
 // Both are dropped; the next usage reading refills them.
-export function clearProviderAccountQuotaState(provider, id) {
+export async function clearProviderAccountQuotaState(provider, id) {
   return update(provider, (pool) => {
     const row = pool.accounts.find((entry) => entry.id === id);
     if (!row) return;
@@ -318,14 +370,53 @@ export function providerAccountsResetAt(rows, now = Date.now(), model = '', opti
   return known.length ? Math.min(...known) : null;
 }
 
+function windowFull(row, window, now) {
+  return window.usedPct >= 100 && (window.resetAt ? window.resetAt > now : now - row.usage.checkedAt < 60_000);
+}
+
 export function providerAccountExhausted(row, now = Date.now(), model = '', options = {}) {
   if (row?.blockedUntil > now && blockAppliesToModel(row, model)) return true;
   if (options.useCredits === true) return false;
   return (row?.usage?.windows || []).some(
-    (window) =>
-      window.usedPct >= 100 &&
-      quotaWindowAppliesToModel(window, model) &&
-      (window.resetAt ? window.resetAt > now : now - row.usage.checkedAt < 60_000)
+    (window) => quotaWindowAppliesToModel(window, model) && windowFull(row, window, now)
+  );
+}
+
+function quotaWindowFamily(window) {
+  return FAMILY_QUOTA_WINDOW.exec(String(window?.label || '').trim())?.[1] || '';
+}
+
+// Which limit currently holds the account, independent of any one model:
+// `{ scope: 'account' }` when every request is refused (an unscoped window is
+// full, or a block with no narrower meter to attribute it to), `{ scope:
+// 'model', families }` when only model-family meters ("7D Fable") or a block
+// attributed to one are spent, so other models still run — else null.
+export function providerAccountLimit(row, now = Date.now(), options = {}) {
+  if (!row) return null;
+  const windows = row.usage?.windows || [];
+  const blocked = row.blockedUntil > now;
+  const scope = String(row.blockedModel || '').trim();
+  const scopedWindows = windows.filter((window) => quotaWindowFamily(window));
+  // A block counts as family-scoped only when a family meter covers the model
+  // that earned it; any other refusal is treated as the account's.
+  const covering = scope ? scopedWindows.filter((window) => quotaWindowAppliesToModel(window, scope)) : [];
+  if (blocked && !covering.length) return { scope: 'account' };
+  const credits = options.useCredits === true;
+  if (!credits && windows.some((window) => !quotaWindowFamily(window) && windowFull(row, window, now))) {
+    return { scope: 'account' };
+  }
+  const families = new Set(blocked ? covering.map(quotaWindowFamily) : []);
+  if (!credits) {
+    for (const window of scopedWindows) if (windowFull(row, window, now)) families.add(quotaWindowFamily(window));
+  }
+  return families.size ? { scope: 'model', families: [...families] } : null;
+}
+
+// The account refuses `model` only through a model-scoped limit: it still
+// serves other models, so it remains the provider's account of record.
+export function providerAccountExhaustedForModelOnly(row, now = Date.now(), model = '', options = {}) {
+  return (
+    providerAccountExhausted(row, now, model, options) && providerAccountLimit(row, now, options)?.scope === 'model'
   );
 }
 
@@ -347,15 +438,28 @@ function accountHeadroom(row, now, model) {
   return used.length ? 100 - Math.max(...used) : null;
 }
 
-export function chooseProviderAccount(pool, excluded = new Set(), now = Date.now(), model = '') {
+// `sessionAccountId` is the account the requesting session already runs on
+// (headroom policy only): kept while usable, so a session switches only on a
+// limit. Without one, the session's first request takes the account with the
+// most headroom.
+export function chooseProviderAccount(
+  pool,
+  excluded = new Set(),
+  now = Date.now(),
+  model = '',
+  { sessionAccountId } = {}
+) {
   const options = { useCredits: pool.useCredits === true };
   const usable = (row) => row && !excluded.has(row.id) && !providerAccountExhausted(row, now, model, options);
   const selected = pool.accounts.find((row) => row.id === pool.selectedId);
-  if (pool.auto === false) {
+  const policy = providerAccountPolicy(pool);
+  if (policy === 'manual') {
     if (excluded.has(selected?.id)) return null;
     return options.useCredits || usable(selected) ? selected || null : null;
   }
-  if (usable(selected)) return selected;
+  const preferred =
+    policy === 'headroom' ? pool.accounts.find((row) => sessionAccountId && row.id === sessionAccountId) : selected;
+  if (usable(preferred)) return preferred;
   // Falling back in roster order is blind: the account after the one that just
   // refused may itself be nearly spent, so the request pays a second switch to
   // learn what a recorded meter already knew. Ranking needs evidence for EVERY

package/src/runtime/shared/provider-api-key.mjs

@@ -69,6 +69,18 @@ export function getAgentApiKey(provider) {
   return null;
 }
 
+/** The one API-key resolver for key-based providers: an explicit config key
+ *  wins, otherwise the environment/keychain (getAgentApiKey). */
+export function resolveProviderApiKey(provider, config) {
+  return config?.apiKey || getAgentApiKey(provider) || '';
+}
+
+/** Auth-error reload: the stored/environment key is re-read first so a
+ *  rotated key beats the stale one captured in config. */
+export function reloadProviderApiKey(provider, config) {
+  return getAgentApiKey(provider) || config?.apiKey || '';
+}
+
 /** One provider's key read on demand, warming no other account: the
  *  environment first (getAgentApiKey's precedence), then only this provider's
  *  keychain entry through the async path (no whole-keyring snapshot). */

package/src/runtime/shared/quota-resume-store.mjs

@@ -236,6 +236,17 @@ export function forgetQuotaSuspendedGoal(sessionId) {
   return true;
 }
 
+/** Whether a session record belongs to a delegated agent child (declared
+ *  agent-only visibility, or a legacy non-Lead agent-owned child with a distinct
+ *  parent). Such a session never owns a quota resume: the Lead decides retries. */
+export function isAgentOnlySession(session) {
+  if (!session || typeof session !== 'object') return false;
+  const lower = (value) => text(value).toLowerCase();
+  if (lower(session.visibility) === 'agent-only') return true;
+  const parentId = text(session.parentSessionId || session.ownerSessionId);
+  return lower(session.owner) === 'agent' && lower(session.agent) !== 'lead' && parentId !== '' && parentId !== text(session.id);
+}
+
 /** Global setting, default on. */
 export function quotaAutoResumeEnabled() {
   return readSection(SETTING_SECTION)?.autoResume !== false;