mixdog 1.2.1 → 1.2.2

package/src/session-runtime/mcp-oauth-login.mjs

@@ -0,0 +1,174 @@
+// Explicit MCP OAuth sign-in flows: the only interactive MCP connect. A flow
+// reconnects one configured server with browser login allowed, hands the
+// authorization URL back to the caller (opening the host browser only when
+// asked), and is then polled until the reconnect settles.
+import { randomUUID } from 'node:crypto';
+import { openInBrowser } from '../runtime/shared/open-url.mjs';
+
+// Settled flows stay readable long enough for a poller to observe the result.
+const SETTLED_FLOW_TTL_MS = 10 * 60_000;
+const NOT_COMPLETED = 'MCP OAuth sign-in was not completed';
+
+const NOT_PENDING = 'MCP OAuth sign-in is no longer pending';
+
+// flowId -> flow, shared by every session runtime of this process. A caller
+// is not bound to the runtime that began a flow (the desktop's control
+// session is replaced after a failed call, and an idle one is evicted), so
+// status / complete / cancel reach the flow from any runtime; each flow keeps
+// the handlers of the runtime that began it (its MCP scope and connect).
+const flows = new Map();
+
+// A pending flow keeps its authorization URL readable: a client polling the
+// status (remote sign-in) still shows the page to open.
+const view = (flow) => ({
+  flowId: flow.flowId,
+  state: flow.state,
+  ...(flow.state === 'pending' && flow.url ? { url: flow.url } : {}),
+  ...(flow.error ? { error: flow.error } : {}),
+});
+function settle(flow, state, error = null) {
+  if (flow.state !== 'pending') return;
+  flow.state = state;
+  if (state === 'failed') flow.error = error || NOT_COMPLETED;
+  setTimeout(() => flows.delete(flow.flowId), SETTLED_FLOW_TTL_MS).unref?.();
+}
+function flowOf(flowId) {
+  const flow = flows.get(String(flowId || ''));
+  if (!flow) throw new Error('MCP OAuth login not found');
+  return flow;
+}
+async function cancelFlow(flow) {
+  if (flow.state === 'pending') {
+    flow.cancelled = true;
+    flow.owner.cancel(flow.name);
+    await flow.done;
+  }
+  return view(flow);
+}
+
+/**
+ * `connect(name, openBrowser)` reconnects the server interactively, calling
+ * `openBrowser(url)` when a login starts, and resolves `{ connected, error }`.
+ * `cancel(name)` aborts that server's pending login. `completeCallback(name,
+ * callbackUrl)` answers it with a pasted redirect URL (throws a fixed message
+ * for an invalid one). `onComplete(name)` runs after a successful sign-in,
+ * before the flow reports complete.
+ */
+export function createMcpOAuthLogins({
+  connect,
+  cancel,
+  completeCallback = () => {
+    throw new Error(NOT_PENDING);
+  },
+  onComplete = async () => {},
+  openBrowser = openInBrowser,
+}) {
+  // name -> tail of that server's serialized begin/cancel/sign-out steps, so
+  // replacing a pending flow is atomic and exactly one can be pending.
+  const lanes = new Map();
+  function exclusive(name, step) {
+    const run = (lanes.get(name) || Promise.resolve()).then(step);
+    const tail = run.then(
+      () => {},
+      () => {}
+    );
+    lanes.set(name, tail);
+    tail.then(() => {
+      if (lanes.get(name) === tail) lanes.delete(name);
+    });
+    return run;
+  }
+  // This runtime's handlers, kept on each flow it begins.
+  const owner = {
+    exclusive,
+    cancel,
+    completeCallback,
+  };
+  // One sign-in per server of this runtime (its MCP scope).
+  const cancelServerFlows = (name) =>
+    Promise.all([...flows.values()].filter((flow) => flow.owner === owner && flow.name === name).map(cancelFlow));
+
+  async function begin(name, options = {}) {
+    const { openBrowser: hostBrowser } = options || {};
+    if (hostBrowser !== undefined && typeof hostBrowser !== 'boolean') {
+      throw new TypeError('openBrowser must be a boolean');
+    }
+    let announceUrl;
+    const urlReady = new Promise((resolve) => {
+      announceUrl = resolve;
+    });
+    // One sign-in per server: a new one replaces the pending one, and the
+    // replacement is registered before the next queued step of this server.
+    const flow = await exclusive(name, async () => {
+      await cancelServerFlows(name);
+      const flow = {
+        flowId: `mcp_oauth_${randomUUID()}`,
+        name,
+        owner,
+        state: 'pending',
+        error: null,
+        cancelled: false,
+        url: null,
+      };
+      flows.set(flow.flowId, flow);
+      const launch = async (url) => {
+        // A login reached after its flow was cancelled (queued behind another
+        // connect of this server) never opens anything.
+        if (flow.cancelled) throw new Error('MCP OAuth login cancelled');
+        flow.awaitingCallback = true;
+        flow.url = url;
+        announceUrl(url);
+        if (hostBrowser !== false) openBrowser(url);
+      };
+      flow.done = (async () => {
+        try {
+          const outcome = await connect(name, launch);
+          if (flow.cancelled) settle(flow, 'cancelled');
+          else if (outcome?.connected) {
+            // The sign-in itself succeeded; a failed follow-up never undoes it.
+            await Promise.resolve()
+              .then(() => onComplete(name))
+              .catch(() => {});
+            settle(flow, 'complete');
+          } else settle(flow, 'failed', outcome?.error);
+        } catch (error) {
+          settle(flow, flow.cancelled ? 'cancelled' : 'failed', error?.message || String(error));
+        }
+      })();
+      return flow;
+    });
+    const url = await Promise.race([urlReady, flow.done.then(() => null)]);
+    if (url) return { flowId: flow.flowId, state: 'pending', url };
+    // Settled without a login: stored credentials (or no challenge) sufficed.
+    if (flow.state === 'complete') return view(flow);
+    // A superseded or failed begin stays readable (cancelled / failed).
+    throw new Error(flow.error || NOT_COMPLETED);
+  }
+
+  return {
+    begin,
+    status: (flowId) => view(flowOf(flowId)),
+    cancel(flowId) {
+      const flow = flowOf(flowId);
+      return flow.owner.exclusive(flow.name, () => cancelFlow(flow));
+    },
+    /** Answer the pending flow with the redirect URL pasted from the browser
+     *  and resolve once it settles: `{ flowId, state: 'complete' | 'failed',
+     *  error? }`. An invalid paste throws and leaves the flow pending. */
+    async complete(flowId, callbackUrl) {
+      const flow = flowOf(flowId);
+      if (flow.state !== 'pending' || flow.cancelled || !flow.awaitingCallback) throw new Error(NOT_PENDING);
+      flow.owner.completeCallback(flow.name, callbackUrl);
+      await flow.done;
+      return view(flow);
+    },
+    /** Cancel every pending sign-in of one server, then run `after` (sign-out)
+     *  before any later begin of that server starts; resolves its result. */
+    cancelServer(name, after = async () => {}) {
+      return exclusive(name, async () => {
+        await cancelServerFlows(name);
+        return after();
+      });
+    },
+  };
+}

package/src/session-runtime/model-route/model-switch-target.mjs

@@ -0,0 +1,34 @@
+/**
+ * model-switch-target.mjs — what a user's model selection names, and whether
+ * it switches an established conversation to another model. Shared by every
+ * surface that offers the choice (session API routes, plain REPL /model).
+ */
+
+/** The provider/model a selection names; a bare preset id or name names the
+ *  preset's model. */
+export function selectedModel(runtime, request, sessionProvider, sessionModel) {
+  const model = String(request?.model ?? '').trim();
+  if (!request?.provider && model) {
+    const wanted = model.toLowerCase();
+    const presets = runtime?.listPresets?.();
+    const preset = (Array.isArray(presets) ? presets : []).find((entry) =>
+      [entry?.id, entry?.name].some(
+        (key) =>
+          String(key ?? '')
+            .trim()
+            .toLowerCase() === wanted
+      )
+    );
+    if (preset?.provider && preset?.model) return { provider: String(preset.provider), model: String(preset.model) };
+  }
+  return { provider: String(request?.provider ?? sessionProvider), model: model || sessionModel };
+}
+
+/** A selection of another model than the established conversation's own. */
+export function switchesSessionModel(runtime, request) {
+  const sessionProvider = String(runtime?.sessionProvider ?? '');
+  const sessionModel = String(runtime?.sessionModel ?? '');
+  if (!sessionProvider || !sessionModel) return false;
+  const { provider, model } = selectedModel(runtime, request, sessionProvider, sessionModel);
+  return provider !== sessionProvider || model !== sessionModel;
+}

package/src/session-runtime/model-route/set-route.mjs

@@ -1,7 +1,8 @@
 /**
  * set-route.mjs — select the main route: resolve and validate the request,
  * adopt it into config, then decide how the current session follows it
- * (untouched, tuned, recreated, or updated in place when empty).
+ * (untouched, tuned, recreated, updated in place when empty, or switched in
+ * place when the selection is addressed to an established conversation).
  */
 import { clean, hasOwn } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import {
@@ -117,6 +118,51 @@ function updateSessionInPlace(deps, session, updateOptions) {
   writeStatuslineRoute(statusRoutes, getSession(), route);
 }
 
+/** Index of the message a model switch boundary is recorded on: the last one
+ *  before a trailing unanswered prompt, which a retry may rewind. */
+function modelSwitchAnchorIndex(messages) {
+  let index = messages.length - 1;
+  while (index >= 0 && (messages[index]?.role === 'user' || messages[index]?.role === 'system')) index -= 1;
+  if (index >= 0) return index;
+  return messages.findLastIndex((message) => message?.role !== 'system');
+}
+
+/** Display-only boundary of an in-place model switch, kept in message meta
+ *  (like an inheritance boundary): the transcript shows it live and after a
+ *  restore, and the model conversation gains no synthetic message. */
+export function recordModelSwitchBoundary(session, boundary) {
+  const messages = Array.isArray(session?.messages) ? session.messages : [];
+  const index = modelSwitchAnchorIndex(messages);
+  if (index < 0) return false;
+  const anchor = messages[index];
+  const switches = Array.isArray(anchor.meta?.modelSwitches) ? anchor.meta.modelSwitches : [];
+  if (switches.some((entry) => entry?.at === boundary.at && entry?.modelId === boundary.modelId)) return true;
+  // Replace the message object: the session save worker detects changed
+  // messages by reference identity, so an in-place meta edit is never saved.
+  messages[index] = { ...anchor, meta: { ...anchor.meta, modelSwitches: [...switches, boundary] } };
+  return true;
+}
+
+/** Move the addressed, established session onto the adopted route in place.
+ *  Its provider replay state and context readings are dropped, so the next
+ *  turn re-measures and auto-compacts against the new model's window. Returns
+ *  the recorded boundary, or null when the session has nothing to mark. */
+function switchSessionInPlace(deps, session) {
+  const { getRoute, getSession } = deps;
+  const route = getRoute();
+  if (route.provider === session.provider && route.model === session.model) {
+    updateSessionInPlace(deps, session);
+    return null;
+  }
+  const boundary = { provider: route.provider, modelId: route.model, at: Date.now() };
+  const recorded = recordModelSwitchBoundary(session, boundary);
+  updateSessionInPlace(deps, session, { crossProvider: true });
+  // A manager that answered with another copy of the session carries the
+  // boundary too; the next save persists it.
+  if (recorded && getSession() && getSession() !== session) recordModelSwitchBoundary(getSession(), boundary);
+  return recorded ? boundary : null;
+}
+
 /** Validate, persist and adopt the requested route as the runtime's route. */
 async function adoptRoute(deps, persist, next, options) {
   const {
@@ -144,7 +190,9 @@ async function adoptRoute(deps, persist, next, options) {
  * Quota-exhaustion escape hatch: apply `next` to the addressed, ESTABLISHED
  * session in place. The caller (session API) has already proven the latest
  * settled turn failed on quota and that nothing is running. Starts no turn;
- * the next turn's auto-compaction fits history to the new window.
+ * the next turn's auto-compaction fits history to the new window. Answers
+ * `{ modelSwitch }` with the recorded boundary (as setRoute does) so the
+ * session surface shows the same live divider, or true when nothing switched.
  */
 export function createContinueSessionInModel(deps, persist) {
   const { getSession, invalidateContextStatusCache } = deps;
@@ -154,33 +202,53 @@ export function createContinueSessionInModel(deps, persist) {
       throw new Error(`session ${sessionId || ''} is not the active session`);
     }
     await adoptRoute(deps, persist, next, {});
-    updateSessionInPlace(deps, session, { crossProvider: true });
+    const modelSwitch = switchSessionInPlace(deps, session);
     invalidateContextStatusCache();
-    return true;
+    return modelSwitch ? { modelSwitch } : true;
   };
 }
 
+/** Rejects an unacceptable selection without applying it. */
+async function validateSelectedRoute(deps, next) {
+  await resolveSelectedRoute(deps, next);
+  return deps.getRoute();
+}
+
 export function createSetRoute(deps, persist) {
   const { getRoute, getSession, invalidateContextStatusCache, createCurrentSession } = deps;
 
   return async function setRoute(next, options = {}) {
-    // Selection is for a new/inherited session. An explicit durable address
-    // permits initializing an EMPTY session, never rewriting an existing
-    // conversation's model, context boundary or provider cache.
+    // Without an explicit durable address a selection is for a new/inherited
+    // session and never rewrites an existing conversation's model, unless it
+    // is the user's model choice for this conversation (`switchEstablished`,
+    // the session surface): that one switches an established conversation in
+    // place while an empty one follows the unaddressed rules below.
     const applyToCurrentSession = options?.applyToCurrentSession === true;
+    const switchEstablished = applyToCurrentSession || options?.switchEstablished === true;
+    // Lets a caller prove the selection is acceptable before it does
+    // irreversible work (compaction) ahead of the switch; changes nothing.
+    if (options?.validateOnly === true) return validateSelectedRoute(deps, next);
     await adoptRoute(deps, persist, next, options);
     const session = getSession();
-    // Model/provider changes are next-session-only for a session the user
-    // has already talked in or compacted (provider-keyed prompt cache). But
-    // a current session with no model reply, no compaction summary and no
-    // in-flight first turn — empty, or holding only refused prompts — has no
-    // cache to protect, so /model takes effect live: route + statusline
+    // A session the user has already talked in or compacted keeps its route
+    // unless the selection was addressed to it. A current session with no
+    // model reply, no compaction summary and no in-flight first turn — empty,
+    // or holding only refused prompts — takes effect live: route + statusline
     // update immediately. Only a truly empty session is recreated below.
     const currentSessionEmpty = !!session && !sessionRouteCommitted(session);
     if (!currentSessionEmpty) {
-      // Some desktop effort changes travel as a same-model route update.
-      // Only effort/Fast may affect the source, starting with its next turn.
-      if (applyToCurrentSession) persist.applySessionTuning();
+      if (!switchEstablished) return getRoute();
+      const route = getRoute();
+      // An addressed selection of another model switches the conversation
+      // itself in place; the caller (session surface) refuses it while a
+      // turn runs. A same-model update (effort/Fast) only tunes the session
+      // from its next turn.
+      if (session && (route.provider !== session.provider || route.model !== session.model)) {
+        const modelSwitch = switchSessionInPlace(deps, session);
+        invalidateContextStatusCache();
+        return modelSwitch ? { ...getRoute(), modelSwitch } : getRoute();
+      }
+      persist.applySessionTuning();
       return getRoute();
     }
     // An addressed runtime keeps its durable id: the empty session is updated

package/src/session-runtime/model-route/web-search-route.mjs

@@ -62,7 +62,7 @@ export function createWebSearchRouteApi(deps) {
     await awaitKeychainPrewarm();
     ensureFullConfig();
     await ensureProvidersReady(ensureProviderEnabled(getConfig(), selectedRoute.provider));
-    const modelMeta = await lookupModelMeta(selectedRoute.provider, selectedRoute.model);
+    const modelMeta = await lookupModelMeta(selectedRoute.provider, selectedRoute.model, { allowFetch: true });
     if (!webSearchCapableFor(selectedRoute.provider, modelMeta)) {
       throw new Error(`model "${selectedRoute.model}" is not marked as web-search capable`);
     }

package/src/session-runtime/native-web-search/routes.mjs

@@ -7,19 +7,37 @@ import { webSearchRouteOrDefault } from '../../runtime/agent/orchestrator/runtim
 
 export function createWebSearchRouteCandidates({
   getRoute,
+  getReg,
   getWebSearchRoute,
   setWebSearchRoute,
   ensureFullConfig,
   awaitKeychainPrewarm,
+  ensureProvidersReady,
+  ensureProviderEnabled,
   normalizeWebSearchProviderId,
   isDefaultWebSearchRouteConfig,
   isWebSearchCapableProvider,
   webSearchCapableFor,
 }) {
-  function currentMainWebSearchModelMeta() {
+  function currentMainWebSearchModelMeta(loadedRow = null) {
     const route = getRoute();
     if (!route?.provider || !route?.model) return null;
-    return { ...route, id: route.model, display: route.model, name: route.model };
+    // Capability comes from the provider's catalog row (supportedTools etc.),
+    // not from the bare model id.
+    const catalogRow = getReg()?.getProvider(route.provider)?.getCachedModelInfo?.(route.model) || loadedRow;
+    return { ...catalogRow, ...route, id: route.model, display: route.model, name: route.model };
+  }
+
+  /** A cold catalog (fresh or model-proxy provider instance) is loaded once
+   *  before the capability check, so it never falls back to the bare id.
+   *  Returns the listed row, which carries the catalog fields even when the
+   *  provider keeps no per-model cache. */
+  async function loadMainCatalogRow(cfg, route) {
+    await ensureProvidersReady(ensureProviderEnabled(cfg, route.provider));
+    const provider = getReg().getProvider(route.provider);
+    if (provider?.getCachedModelInfo?.(route.model) || typeof provider?.listModels !== 'function') return null;
+    const models = await provider.listModels();
+    return (Array.isArray(models) ? models.find((m) => m?.id === route.model) : null) || null;
   }
 
   async function nativeWebSearchRoutes() {
@@ -33,7 +51,8 @@ export function createWebSearchRouteCandidates({
     const webSearchRoute = webSearchRouteOrDefault(cfg.webSearchRoute, getWebSearchRoute());
     setWebSearchRoute(webSearchRoute);
     if (isDefaultWebSearchRouteConfig(webSearchRoute)) {
-      const mainModel = currentMainWebSearchModelMeta();
+      const loadedRow = route?.provider && route?.model ? await loadMainCatalogRow(cfg, route) : null;
+      const mainModel = currentMainWebSearchModelMeta(loadedRow);
       if (!mainModel || !webSearchCapableFor(route.provider, mainModel)) return [];
       return [
         {

package/src/session-runtime/provider-models/model-meta.mjs

@@ -10,6 +10,8 @@ export function modelMetaKey(providerId, modelId) {
 
 export function createModelMetaIndex({ caches, modelMetaByRoute, reg, scheduleProviderModelWarmup }) {
   let observedCatalogRevision = catalogRevision(reg());
+  // Keys holding only the bare-id placeholder: a fetching lookup replaces them.
+  const placeholderKeys = new Set();
 
   /** Invalidates the provider caches when the registry's catalog moved on;
    *  returns the current revision either way. */
@@ -22,6 +24,7 @@ export function createModelMetaIndex({ caches, modelMetaByRoute, reg, schedulePr
     caches.providerModelsPromise = null;
     caches.webSearchProviderModelsCache = { models: null, at: 0, revision };
     modelMetaByRoute.clear();
+    placeholderKeys.clear();
     return revision;
   }
 
@@ -32,14 +35,16 @@ export function createModelMetaIndex({ caches, modelMetaByRoute, reg, schedulePr
   }
 
   function remember(providerId, modelId, meta) {
-    modelMetaByRoute.set(modelMetaKey(providerId, modelId), meta);
+    const key = modelMetaKey(providerId, modelId);
+    modelMetaByRoute.set(key, meta);
+    placeholderKeys.delete(key);
   }
 
   async function lookupModelMeta(providerId, modelId, { allowFetch = false } = {}) {
     const revision = syncCatalogRevision();
     const seq = caches.providerModelsLoadSeq;
     const key = modelMetaKey(providerId, modelId);
-    if (modelMetaByRoute.has(key)) return modelMetaByRoute.get(key);
+    if (modelMetaByRoute.has(key) && !(allowFetch && placeholderKeys.has(key))) return modelMetaByRoute.get(key);
     const fallback = () => ({ id: modelId, provider: providerId });
     const providerImpl = reg().getProvider(providerId);
     if (!providerImpl || typeof providerImpl.listModels !== 'function') {
@@ -58,6 +63,7 @@ export function createModelMetaIndex({ caches, modelMetaByRoute, reg, schedulePr
     if (!allowFetch) {
       const meta = fallback();
       modelMetaByRoute.set(key, meta);
+      placeholderKeys.add(key);
       scheduleProviderModelWarmup();
       return meta;
     }
@@ -65,7 +71,10 @@ export function createModelMetaIndex({ caches, modelMetaByRoute, reg, schedulePr
       const models = await providerImpl.listModels();
       const found = Array.isArray(models) ? models.find((m) => m?.id === modelId) : null;
       const meta = found || fallback();
-      if (snapshotIsCurrent(revision, seq)) modelMetaByRoute.set(key, meta);
+      if (snapshotIsCurrent(revision, seq)) {
+        modelMetaByRoute.set(key, meta);
+        placeholderKeys.delete(key);
+      }
       return meta;
     } catch {
       // A failed fetch is not authoritative: nothing is pinned.

package/src/session-runtime/quick-model-rows/web-search-rows.mjs

@@ -2,8 +2,11 @@
 // main model, cached or built-in quick models per capable provider, and the
 // configured/current routes, deduplicated per provider:model.
 import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
-import { QUICK_WEB_SEARCH_MODELS } from '../quick-web-search-models.mjs';
-import { WEB_SEARCH_DEFAULT_PROVIDER, WEB_SEARCH_DEFAULT_MODEL } from '../../runtime/agent/orchestrator/runtime-core/workflow.mjs';
+import { quickWebSearchModels } from '../quick-web-search-models.mjs';
+import {
+  WEB_SEARCH_DEFAULT_PROVIDER,
+  WEB_SEARCH_DEFAULT_MODEL,
+} from '../../runtime/agent/orchestrator/runtime-core/workflow.mjs';
 import { providerCachedModelsSync } from '../../runtime/agent/orchestrator/providers/provider-catalog-cache.mjs';
 import { hydratedModel } from './model-meta.mjs';
 
@@ -33,7 +36,12 @@ export function createQuickWebSearchRows({
       contextWindow: resolved?.contextWindow || null,
       outputTokens: resolved?.outputTokens || null,
       latest: resolved?.latest === true,
-      supportsWebSearch: true,
+      // Only what the source row itself declares; webSearchCapableFor adds the
+      // provider catalog's row and the id fallback. Never forced on.
+      ...(typeof model?.supportsWebSearch === 'boolean' ? { supportsWebSearch: model.supportsWebSearch } : {}),
+      ...(Array.isArray(model?.supportedTools) ? { supportedTools: model.supportedTools } : {}),
+      ...(Array.isArray(model?.tools) ? { tools: model.tools } : {}),
+      ...(model?.capabilities && typeof model.capabilities === 'object' ? { capabilities: model.capabilities } : {}),
       supportsFunctionCalling: resolved?.supportsFunctionCalling === true,
       supportsPromptCaching: resolved?.supportsPromptCaching === true,
       supportsReasoning: resolved?.supportsReasoning === true,
@@ -95,7 +103,7 @@ export function createQuickWebSearchRows({
       const providerName = normalizeWebSearchProviderId(name);
       if (!providerConfig?.enabled || !isWebSearchCapableProvider(providerName)) continue;
       const cachedModels = providerCachedModelsSync(providerName);
-      const quickModels = cachedModels.length ? cachedModels : QUICK_WEB_SEARCH_MODELS[providerName] || [];
+      const quickModels = cachedModels.length ? cachedModels : quickWebSearchModels(providerName);
       for (const model of quickModels) {
         addQuickWebSearchModel(rows, seen, providerName, model);
       }
@@ -110,10 +118,7 @@ export function createQuickWebSearchRows({
     }
     const mainModel = currentMainWebSearchModelMeta();
     if (mainModel && webSearchCapableFor(route.provider, mainModel)) {
-      addQuickWebSearchModel(rows, seen, route.provider, {
-        id: route.model,
-        display: route.model,
-      });
+      addQuickWebSearchModel(rows, seen, route.provider, mainModel);
     }
     return webSearchModelsFromRows(rows);
   }

package/src/session-runtime/quick-web-search-models.mjs

@@ -1,41 +1,16 @@
-// Static quick-pick model ids surfaced during onboarding / web-search setup.
-// Limits are intentionally not hardcoded here: rows are hydrated from live
-// provider caches and provider-scoped metadata during catalog construction.
+// Offline quick-pick model rows for onboarding / web-search setup. No model id
+// is listed here: when a provider has no live roster yet, its newest rows come
+// from the provider-scoped public catalog, so a new release appears without a
+// code change. Rows are hydrated further during catalog construction.
+import { getModelsDevProviderModelsSync } from '../runtime/shared/llm/model-catalog.mjs';
 
 export const ONBOARDING_VERSION = 1;
 
-export const QUICK_WEB_SEARCH_MODELS = Object.freeze({
-  'openai-oauth': [
-    { id: 'gpt-6-sol', display: 'GPT-6 Sol', latest: true },
-    { id: 'gpt-6-luna', display: 'GPT-6 Luna', latest: true },
-    { id: 'gpt-5.6-sol', display: 'GPT-5.6 Sol' },
-    { id: 'gpt-5.6-terra', display: 'GPT-5.6 Terra' },
-    { id: 'gpt-5.6-luna', display: 'GPT-5.6 Luna' },
-  ],
-  openai: [
-    { id: 'gpt-5.5', display: 'GPT-5.5', latest: true },
-    { id: 'gpt-5.4', display: 'GPT-5.4', latest: true },
-    { id: 'gpt-5', display: 'GPT-5' },
-    { id: 'gpt-4.1', display: 'GPT-4.1' },
-    { id: 'gpt-4o', display: 'GPT-4o' },
-  ],
-  'grok-oauth': [{ id: 'grok-4.5', display: 'Grok 4.5', latest: true }],
-  xai: [{ id: 'grok-4.5', display: 'Grok 4.5', latest: true }],
-  gemini: [
-    { id: 'gemini-3.6-flash', display: 'Gemini 3.6 Flash', latest: true },
-    { id: 'gemini-3.5-flash-lite', display: 'Gemini 3.5 Flash Lite', latest: true },
-    { id: 'gemini-3.1-pro-preview', display: 'Gemini 3.1 Pro Preview' },
-  ],
-  'anthropic-oauth': [
-    { id: 'claude-opus-5-5', display: 'Claude Opus 5.5', latest: true },
-    { id: 'claude-sonnet-5', display: 'Claude Sonnet 5', latest: true },
-    { id: 'claude-fable-5', display: 'Claude Fable 5', latest: true },
-    { id: 'claude-haiku-4-5-20251001', display: 'Claude Haiku 4.5' },
-  ],
-  anthropic: [
-    { id: 'claude-opus-5-5', display: 'Claude Opus 5.5', latest: true },
-    { id: 'claude-sonnet-5', display: 'Claude Sonnet 5', latest: true },
-    { id: 'claude-fable-5', display: 'Claude Fable 5', latest: true },
-    { id: 'claude-haiku-4-5-20251001', display: 'Claude Haiku 4.5' },
-  ],
-});
+const QUICK_ROWS_PER_PROVIDER = 5;
+
+export function quickWebSearchModels(provider, models = getModelsDevProviderModelsSync(provider)) {
+  return Object.entries(models || {})
+    .map(([id, row]) => ({ id, display: row?.name || id, releaseDate: row?.release_date || null }))
+    .sort((a, b) => (Date.parse(b.releaseDate) || 0) - (Date.parse(a.releaseDate) || 0))
+    .slice(0, QUICK_ROWS_PER_PROVIDER);
+}

package/src/session-runtime/resource-extension-sync.mjs

@@ -5,6 +5,7 @@ import { publishGlobalExtensionChange, subscribeGlobalExtensionChanges } from '.
 
 export function createExtensionSync({
   connectConfiguredMcp,
+  cancelMcpLogin,
   invalidatePreSessionToolSurface,
   refreshEmptySessionToolPolicy,
   reloadFullConfig,
@@ -60,6 +61,9 @@ export function createExtensionSync({
     const chain = mcpToggleChains.get(serverName) || { desired: enabled, running: null };
     chain.desired = enabled;
     mcpToggleChains.set(serverName, chain);
+    // A disable riding the chain would otherwise wait out an explicit sign-in
+    // (beginMcpOAuthLogin) of this server still in flight.
+    if (enabled === false) cancelMcpLogin?.(serverName);
     if (!chain.running) {
       chain.running = (async () => {
         let status;