mixdog 1.2.1 → 1.2.3

package/src/session-runtime/services/provider-admin.mjs

@@ -94,6 +94,7 @@ import {
 } from '../../runtime/shared/provider-accounts.mjs';
 import { currentProviderAccountId, withProviderAccount } from '../../runtime/shared/provider-auth-binding.mjs';
 import {
+  CUSTOM_API_KEY_ENV_RE,
   effectiveCustomModelRows,
   normalizeCustomProviderConfig as normalizeStoredCustomConfig,
 } from '../../runtime/agent/orchestrator/providers/custom-provider-config.mjs';
@@ -439,14 +440,22 @@ function customProviderRow(id, entry, checkSecrets = true) {
   const { config, error: configError } = inspectStoredCustomConfig(entry);
   const configuredEnabled = entry.enabled !== false;
   const keyless = (config?.auth ?? entry.auth) === 'none';
+  const apiKeyEnv = keyless ? '' : config?.apiKeyEnv || '';
+  const envSet = Boolean(apiKeyEnv && process.env[apiKeyEnv]);
   const stored = checkSecrets ? hasStoredSecret(SECRET_ACCOUNTS.agentApiKey(id)) : false;
   const unstoredStatus = configuredEnabled ? 'No Key' : 'Off';
   let status = stored ? 'Set' : unstoredStatus;
   let detail = stored ? 'stored in keychain' : 'custom endpoint';
+  if (apiKeyEnv) {
+    status = envSet ? 'Env' : unstoredStatus;
+    detail = apiKeyEnv;
+  }
   if (keyless) {
     status = configuredEnabled ? 'Keyless' : 'Off';
     detail = 'no API key required';
   }
+  let keyAuthenticated = checkSecrets ? stored : configuredEnabled;
+  if (apiKeyEnv) keyAuthenticated = envSet;
   const row = {
     id,
     name: entry.name,
@@ -457,17 +466,20 @@ function customProviderRow(id, entry, checkSecrets = true) {
     group: 'api',
     type: 'api-key',
     enabled: configuredEnabled,
-    authenticated: keyless || (checkSecrets ? stored : configuredEnabled),
+    authenticated: keyless || keyAuthenticated,
     stored,
-    env: false,
-    envName: null,
+    env: envSet,
+    envName: apiKeyEnv || null,
     status,
     detail,
   };
+  if (apiKeyEnv) row.apiKeyEnv = apiKeyEnv;
   row.schemaVersion = config?.schemaVersion ?? entry.schemaVersion;
   row.auth = keyless ? 'none' : 'key';
   row.discovery = structuredClone(config?.discovery ?? entry.discovery ?? { newModelsHidden: false });
   row.modelOverrides = structuredClone(config?.modelOverrides ?? entry.modelOverrides ?? {});
+  if (config?.wires) row.wires = [...config.wires];
+  if (config?.modelWires) row.modelWires = { ...config.modelWires };
   // A stored config that does not normalize cannot run (the registry skips
   // it): say so explicitly instead of listing it as connected.
   // Every readiness flag consumers read says "not ready" (`stored` stays the
@@ -547,8 +559,8 @@ export function providerStatus(config = {}) {
       enabled: row.enabled,
       authenticated: row.authenticated,
       stored: row.stored,
-      env: false,
-      envName: null,
+      env: row.env,
+      envName: row.envName,
       label: row.name,
     })),
     ...availableOAuthProviders().map((p) => oauthProviderStatusRow(p, config)),
@@ -867,6 +879,20 @@ function validateCustomTransportFields(input) {
     throw new TypeError('custom provider id is invalid');
   if (input.apiKey !== undefined && (typeof input.apiKey !== 'string' || input.apiKey.length > CUSTOM_API_KEY_MAX))
     throw new TypeError('custom provider apiKey is invalid');
+  if (input.apiKeyEnv !== undefined && input.apiKeyEnv !== null) {
+    if (typeof input.apiKeyEnv !== 'string' || !CUSTOM_API_KEY_ENV_RE.test(input.apiKeyEnv))
+      throw new TypeError('custom provider apiKeyEnv is invalid');
+    if (input.auth === 'none') throw new TypeError('custom provider apiKeyEnv requires key auth');
+    if (typeof input.apiKey === 'string' && input.apiKey !== '')
+      throw new TypeError('custom provider apiKey and apiKeyEnv are mutually exclusive');
+  }
+}
+
+/** Whether the named environment variable is set to a non-empty value. */
+export function checkCustomProviderKeyEnv(name) {
+  if (typeof name !== 'string' || !CUSTOM_API_KEY_ENV_RE.test(name))
+    throw new TypeError('environment variable name is invalid');
+  return { found: Boolean(process.env[name]) };
 }
 
 function inputObject(input) {
@@ -886,9 +912,16 @@ function withStoredSettings(input, entry) {
   }
   const out = { ...input };
   if (out.auth === undefined) out.auth = stored.auth;
+  if (out.apiKeyEnv === undefined && stored.apiKeyEnv) out.apiKeyEnv = stored.apiKeyEnv;
   if (out.schemaVersion === stored.schemaVersion) {
     if (out.discovery === undefined) out.discovery = stored.discovery;
     if (out.modelOverrides === undefined) out.modelOverrides = stored.modelOverrides;
+    // Served wires and per-model wires have no setup field yet: an edit on
+    // the same protocol keeps them (another protocol serves other wires).
+    if ((out.protocol ?? stored.protocol) === stored.protocol) {
+      if (out.wires === undefined && stored.wires) out.wires = stored.wires;
+      if (out.modelWires === undefined && stored.modelWires) out.modelWires = stored.modelWires;
+    }
   }
   return out;
 }
@@ -904,9 +937,11 @@ async function resolveCustomInput(cfgMod, rawInput, options) {
   const config = normalizeCustomProviderConfig(input, options);
   const typed = typeof input.apiKey === 'string' ? input.apiKey.trim() : '';
   const keyless = config.auth === 'none';
+  const envName = keyless ? '' : config.apiKeyEnv || '';
   let apiKey = '';
-  if (!keyless) apiKey = typed || (id ? getAgentApiKey(id) || '' : '');
-  return { id, config, typed: keyless ? '' : typed, apiKey, keyless };
+  if (envName) apiKey = process.env[envName] || '';
+  else if (!keyless) apiKey = typed || (id ? getAgentApiKey(id) || '' : '');
+  return { id, config, typed: keyless || envName ? '' : typed, apiKey, keyless, envName };
 }
 
 export async function saveCustomProvider(cfgMod, rawInput) {
@@ -916,8 +951,9 @@ export async function saveCustomProvider(cfgMod, rawInput) {
     typed,
     apiKey,
     keyless,
+    envName,
   } = await resolveCustomInput(cfgMod, rawInput, { requireModels: false });
-  if (!keyless && !apiKey) throw new Error('API key is required');
+  if (!keyless && !envName && !apiKey) throw new Error('API key is required');
   const id = existingId || `custom-${randomUUID()}`;
   const entry = { ...config, type: 'custom', enabled: config.enabled !== false };
   const account = SECRET_ACCOUNTS.agentApiKey(id);
@@ -1021,13 +1057,37 @@ export async function updateCustomProviderModel(cfgMod, rawId, rawModelId, patch
   return customProviderRow(id, saved);
 }
 
+// Drops every stored model setting and route that names the provider.
+function withoutProviderReferences(config, id) {
+  const next = { ...config };
+  const names = (route) => route?.provider === id;
+  if (next.modelSettings) {
+    next.modelSettings = Object.fromEntries(
+      Object.entries(next.modelSettings).filter(([key]) => !key.startsWith(`${id}/`))
+    );
+  }
+  if (next.agents) {
+    next.agents = Object.fromEntries(Object.entries(next.agents).filter(([, route]) => !names(route)));
+  }
+  if (names(next.webSearchRoute)) delete next.webSearchRoute;
+  if (Array.isArray(next.presets)) {
+    const dropped = new Set(next.presets.filter(names).map((preset) => preset.id));
+    next.presets = next.presets.filter((preset) => !names(preset));
+    if (dropped.has(next.default)) delete next.default;
+  }
+  return next;
+}
+
 export async function removeCustomProvider(cfgMod, rawId) {
   const id = String(rawId || '').trim();
   existingCustomEntry(cfgMod, id);
+  // Secret first: a real keychain failure (locked, permission) leaves the
+  // provider registered so the removal can be retried. A missing secret
+  // (keyless provider) is not an error.
+  await deleteSecretAsync(SECRET_ACCOUNTS.agentApiKey(id));
   const current = cfgMod.loadConfig();
   const { [id]: _removed, ...providers } = current.providers || {};
-  cfgMod.saveConfig({ ...current, providers }, { baseConfig: current });
-  await deleteSecretAsync(SECRET_ACCOUNTS.agentApiKey(id));
+  cfgMod.saveConfig(withoutProviderReferences({ ...current, providers }, id), { baseConfig: current });
   return { provider: id, type: 'custom', removed: true };
 }
 
@@ -1057,10 +1117,16 @@ export async function testCustomProvider(cfgMod, rawInput) {
     );
     return { ok: true };
   } catch (error) {
-    throw sanitizeCustomError(error, [apiKey]);
+    throw sanitizeCustomError(error, customSecrets(apiKey, config));
   }
 }
 
+// Every key the operation may have sent: env mode re-reads the variable on an
+// auth retry, so its current value is redacted alongside the initial key.
+function customSecrets(apiKey, config) {
+  return [apiKey, config.apiKeyEnv ? process.env[config.apiKeyEnv] : ''];
+}
+
 export async function discoverCustomProviderModels(cfgMod, rawInput) {
   const { id, config, apiKey } = await resolveCustomInput(cfgMod, rawInput, { requireModels: false });
   try {
@@ -1070,19 +1136,19 @@ export async function discoverCustomProviderModels(cfgMod, rawInput) {
     const models = publicCustomModelRows(listed);
     // A failed discovery that still left manual rows reports its error too.
     const failure = provider.customDiscoveryError;
-    return failure ? { models, error: discoveryErrorView(failure, apiKey) } : { models };
+    return failure ? { models, error: discoveryErrorView(failure, customSecrets(apiKey, config)) } : { models };
   } catch (error) {
-    return { models: [], error: discoveryErrorView(error, apiKey) };
+    return { models: [], error: discoveryErrorView(error, customSecrets(apiKey, config)) };
   }
 }
 
-function discoveryErrorView(error, apiKey) {
+function discoveryErrorView(error, secrets) {
   const status = Number.isInteger(error?.status) ? error.status : undefined;
   const authKind = status === 401 || status === 403 ? 'authentication' : 'request';
   return {
     kind: status === 404 || status === 405 ? 'unavailable' : authKind,
     ...(status === undefined ? {} : { status }),
-    message: sanitizeCustomError(error, [apiKey]).message,
+    message: sanitizeCustomError(error, secrets).message,
   };
 }
 

package/src/session-runtime/session-transcript-purge.mjs

@@ -0,0 +1,32 @@
+// A hard-deleted session takes its conversation transcript
+// (`<home>/projects/<slug>/<id>.jsonl`) and the memory ingest read positions
+// keyed by that file with it. Registered once per process as a store purge hook:
+// the file removal is synchronous under the delete's commit lock, the offset
+// removal is a best-effort request to the memory service.
+import { registerSessionPurgeHook } from '../runtime/agent/orchestrator/session/store.mjs';
+import { mixdogHome } from '../runtime/shared/plugin-paths.mjs';
+import { purgeSessionTranscripts } from '../runtime/shared/transcript-writer/purge.mjs';
+
+const logError = (message) => {
+  try {
+    process.stderr.write(`mixdog: transcript-purge: ${message}\n`);
+  } catch {
+    /* logging is best effort */
+  }
+};
+
+/** @param {{ forgetOffsets?: (transcriptPaths: string[]) => Promise<unknown> }} options */
+export function registerTranscriptPurgeHook({ forgetOffsets } = {}) {
+  return registerSessionPurgeHook((sessionId, context) => {
+    const transcriptPaths = purgeSessionTranscripts({
+      mixdogHome: mixdogHome(),
+      sessionId,
+      cwds: context?.cwds,
+      onError: (target, error) => logError(`could not remove ${target}: ${error?.message || error}`),
+    });
+    if (!transcriptPaths.length || typeof forgetOffsets !== 'function') return;
+    Promise.resolve()
+      .then(() => forgetOffsets(transcriptPaths))
+      .catch((error) => logError(`could not drop ingest offsets of ${sessionId}: ${error?.message || error}`));
+  });
+}

package/src/session-runtime/session-turn-api.mjs

@@ -7,21 +7,30 @@
  */
 import { createTurnRunner } from './turn/turn-run.mjs';
 import { createSessionOps } from './turn/session-ops.mjs';
+import { createCompactionGate } from './turn/compaction-gate.mjs';
 import { createShareOps } from './turn/share-ops.mjs';
 import { createAgentOps } from './turn/agent-ops.mjs';
+import { createSideQuestionOps } from './turn/side-question-ops.mjs';
 
 export function createSessionTurnApi(deps) {
-  const runner = createTurnRunner(deps);
+  // A model-scheduled compaction runs chained after its turn; the next turn
+  // and any manual compact/clear/rewind wait on it so nothing races it.
+  const gate = createCompactionGate({ getSessionId: () => deps.getSession()?.id, compact: () => session.compact() });
+  const afterCompaction = gate.after;
+  const runner = createTurnRunner({ ...deps, runPendingCompact: gate.run });
   const session = createSessionOps(deps);
   const share = createShareOps(deps);
   const agent = createAgentOps(deps);
+  const side = createSideQuestionOps(deps);
   return {
+    askSide: side.askSide,
+    cancelSide: side.cancelSide,
     enqueueRemoteAttachedPrompt: runner.enqueueRemoteAttachedPrompt,
     getTurnLiveness: runner.getTurnLiveness,
-    ask: runner.ask,
-    clear: session.clear,
-    rewindMessages: session.rewindMessages,
-    compact: session.compact,
+    ask: afterCompaction(runner.ask),
+    clear: afterCompaction(session.clear),
+    rewindMessages: afterCompaction(session.rewindMessages),
+    compact: afterCompaction(session.compact),
     setToolMode: session.setToolMode,
     agentStatus: session.agentStatus,
     interruptTaskWait: session.interruptTaskWait,

package/src/session-runtime/settings-builtin-tools-api.mjs

@@ -79,6 +79,15 @@ export function createBuiltinToolSettings(
       invalidateContextStatusCache();
       return this.getRecapSettings();
     },
+    // Whether the model may title the session (session tool, action=rename).
+    // Absent config means on; only the opt-out is stored.
+    getSessionTitleSettings() {
+      return { aiSessionTitles: getConfig()?.aiSessionTitles !== false };
+    },
+    setAiSessionTitles(enabled) {
+      saveConfigAndAdopt({ ...getConfig(), aiSessionTitles: enabled !== false });
+      return this.getSessionTitleSettings();
+    },
     getToolModuleSettings() {
       const config = getConfig();
       const localProvider = getLocalProviderStatus?.() || {};

package/src/session-runtime/settings-compaction-api.mjs

@@ -82,6 +82,7 @@ export function createCompactionSettings({
       const next = { ...current };
       if (hasOwn(input, 'auto')) next.auto = input.auto !== false;
       if (hasOwn(input, 'enabled')) next.auto = input.enabled !== false;
+      if (hasOwn(input, 'onModelChange')) next.onModelChange = input.onModelChange !== false;
       // Legacy Compact type fields are intentionally ignored. There is one
       // fresh-context Compact contract for every session.
       // A new budget representation replaces the previous one. Otherwise a

package/src/session-runtime/setup-tool/executor.mjs

@@ -92,6 +92,7 @@ function routeInput(source) {
   if (clean(source.model)) next.model = clean(source.model);
   if (clean(source.effort)) next.effort = clean(source.effort);
   if (typeof source.fast === 'boolean') next.fast = source.fast;
+  if (typeof source.autoEffort === 'boolean') next.autoEffort = source.autoEffort;
   if (Object.hasOwn(source, 'modelParameters')) next.modelParameters = { ...source.modelParameters };
   if (Object.hasOwn(source, 'contextPercent')) next.contextPercent = source.contextPercent;
   if (Object.hasOwn(source, 'contextTokens')) next.contextTokens = source.contextTokens;
@@ -141,6 +142,34 @@ function publicProviderRows(setup) {
   };
 }
 
+/** Minimal provider rows for the model: only providers with a credential (or
+ *  one needing re-authentication), counts instead of account rosters. */
+function configuredProviderRows(rows, accountCount) {
+  const providers = [];
+  let notConfigured = 0;
+  for (const [kind, list] of [
+    ['api', rows.api],
+    ['oauth', rows.oauth],
+    ['local', rows.local],
+  ]) {
+    for (const row of list) {
+      if (!row.authenticated && !row.reauthRequired) {
+        notConfigured += 1;
+        continue;
+      }
+      providers.push({
+        id: row.id,
+        kind,
+        authenticated: row.authenticated,
+        status: row.status,
+        ...(row.reauthRequired ? { reauthRequired: true } : {}),
+        ...(kind === 'oauth' ? { accounts: row.authenticated ? accountCount(row.id) : 0 } : {}),
+      });
+    }
+  }
+  return { ...(rows.pendingSecrets ? { pendingSecrets: true } : {}), providers, notConfigured };
+}
+
 /** OAuth account roster without usage meters or provider-side identities. */
 function publicAccounts(pool) {
   return {
@@ -300,8 +329,9 @@ const SETUP_STATUS_READERS = {
   'local-provider': (rt) => rt.getToolModuleSettings().localProvider,
   features: (rt, { getConfig }) => featureStatus(rt, getConfig),
   shell: (rt) => rt.getSystemShell?.() || {},
-  providers: async (rt) => {
+  providers: async (rt, { detail }) => {
     const rows = publicProviderRows(await rt.getProviderSetup?.({}));
+    if (!detail) return configuredProviderRows(rows, (id) => rt.getProviderAccounts(id).accounts.length);
     rows.oauth = rows.oauth.map((row) =>
       row.authenticated ? { ...row, accounts: publicAccounts(rt.getProviderAccounts(row.id)) } : row
     );
@@ -339,7 +369,7 @@ function validateSetupInput(args) {
     if (action !== 'set_agent_route' && Object.hasOwn(args.route, 'disabled')) {
       throw new Error('route.disabled is only accepted by set_agent_route');
     }
-    for (const field of ['contextPercent', 'contextTokens']) {
+    for (const field of ['contextPercent', 'contextTokens', 'autoEffort']) {
       if (action !== 'set_route' && action !== 'set_agent_route' && Object.hasOwn(args.route, field)) {
         throw new Error(`route.${field} is only accepted by set_route and set_agent_route`);
       }
@@ -401,7 +431,7 @@ const SETUP_ACTION_HANDLERS = {
   status: async (_rt, args, { readStatus, requestDesktop }) => {
     const domain = clean(args.domain) || 'summary';
     requireEnum(domain, SETUP_STATUS_DOMAINS, 'domain');
-    return { domain, ...(await readStatus(domain, requestDesktop)) };
+    return { domain, ...(await readStatus(domain, requestDesktop, args.detail === true)) };
   },
   open: (_rt, args, { openSurface }) => openSurface(args.target),
   set_route: async (rt, args) => {
@@ -631,11 +661,11 @@ export function createSetupToolExecutor({ getApi, getConfig, notifySessionUi, ge
     return facade;
   };
 
-  async function readStatus(domain, requestDesktop) {
+  async function readStatus(domain, requestDesktop, detail) {
     const rt = api();
     if (SETUP_DESKTOP_DOMAINS.includes(domain)) return requestDesktop({ action: 'status', domain });
     if (!Object.hasOwn(SETUP_STATUS_READERS, domain)) throw new Error(`setup: unknown status domain "${domain}"`);
-    return SETUP_STATUS_READERS[domain](rt, { domain, getConfig: () => getConfig?.() || {} });
+    return SETUP_STATUS_READERS[domain](rt, { domain, detail, getConfig: () => getConfig?.() || {} });
   }
 
   function openSurface(target) {
@@ -669,7 +699,7 @@ export function createSetupToolExecutor({ getApi, getConfig, notifySessionUi, ge
     dispose: desktop.dispose,
     async execute(args = {}, options = {}) {
       const result = await execute(args, options);
-      if (READ_ONLY_SETUP_ACTIONS.has(args.action)) return JSON.stringify(result ?? {}, null, 2);
+      if (READ_ONLY_SETUP_ACTIONS.has(args.action)) return JSON.stringify(result ?? {});
       await flushSettings?.();
       // Attached surfaces re-read what changed instead of waiting for their
       // next open or cache expiry.

package/src/session-runtime/setup-tool/extended-actions.mjs

@@ -1,11 +1,81 @@
 import { SETUP_EXTENDED_PROPERTIES, SETUP_DESKTOP_ACTIONS } from './settings-contract.mjs';
 import { MEDIA_KINDS } from '../../runtime/media/tool-defs.mjs';
+import { OPENAI_COMPAT_PRESETS } from '../../runtime/agent/orchestrator/providers/openai-compat-presets.mjs';
 
 const own = (value, key) => Object.hasOwn(value || {}, key);
 const pick = (value, keys) => Object.fromEntries(keys.filter((key) => own(value, key)).map((key) => [key, value[key]]));
 const entryKeys = Object.keys(SETUP_EXTENDED_PROPERTIES.entry.properties);
 const definitionKeys = Object.keys(SETUP_EXTENDED_PROPERTIES.definition.properties);
 
+const MODEL_PAGE_DEFAULT = 25;
+
+function providerIndex(rows) {
+  const counts = new Map();
+  for (const row of rows) counts.set(row.provider, (counts.get(row.provider) || 0) + 1);
+  return [...counts].map(([provider, count]) => {
+    const defaultModel = OPENAI_COMPAT_PRESETS[provider]?.defaultModel;
+    return { provider, count, ...(defaultModel ? { defaultModel } : {}) };
+  });
+}
+
+function compactModelRow(row) {
+  const context = row.contextWindow || null;
+  const maxContext = Number(row.maxContextWindow) || 0;
+  return {
+    id: row.id,
+    display: row.display || row.id,
+    context,
+    ...(maxContext > (context || 0) ? { maxContext } : {}),
+    efforts: (row.effortOptions || []).map((option) => option.value),
+    ...(row.fastCapable === true ? { fast: true } : {}),
+    ...(row.supportsVision === true ? { vision: true } : {}),
+  };
+}
+
+const isPresent = (value) =>
+  value != null &&
+  value !== '' &&
+  value !== false &&
+  !(typeof value === 'object' && !Object.keys(value).length);
+
+/** Everything set_route can use for one model; empty and false fields omitted. */
+function modelDetail(row) {
+  const detail = {
+    provider: row.provider,
+    id: row.id,
+    display: row.display || row.id,
+    context: row.contextWindow,
+    maxContext: Number(row.maxContextWindow) > row.contextWindow ? row.maxContextWindow : null,
+    outputTokens: row.outputTokens,
+    vision: row.supportsVision,
+    webSearch: row.supportsWebSearch,
+    reasoning: row.supportsReasoning,
+    effortOptions: (row.effortOptions || []).map(({ value, label }) => ({ value, label })),
+    defaultEffort: row.defaultEffort,
+    fastCapable: row.fastCapable,
+    fastEfforts: row.fastEfforts,
+    defaultFast: row.defaultFast,
+    serviceTiers: row.serviceTiers,
+    defaultServiceTier: row.defaultServiceTier,
+    additionalSpeedTiers: row.additionalSpeedTiers,
+    modelParameterOptions: row.modelParameterOptions,
+    parameterVariants: row.parameterVariants,
+    defaultModelParameters: row.defaultModelParameters,
+    supportsMaxMode: row.supportsMaxMode,
+  };
+  return Object.fromEntries(Object.entries(detail).filter(([, value]) => isPresent(value)));
+}
+
+function findModel(rows, id, provider) {
+  const matches = rows.filter((row) => row.id === id && (!provider || row.provider === provider));
+  if (!matches.length) {
+    throw new Error(`model "${id}" not found${provider ? ` for provider "${provider}"` : ''}; list_models with catalog.provider returns its model ids`);
+  }
+  const providers = [...new Set(matches.map((row) => row.provider))];
+  if (providers.length > 1) throw new Error(`model "${id}" is offered by ${providers.join(', ')}; pass catalog.provider`);
+  return matches[0];
+}
+
 export function publicAutomation(row) {
   const result = {
     ...pick(row, entryKeys),
@@ -136,12 +206,22 @@ async function saveDefinition(rt, args) {
 export const EXTENDED_SETUP_HANDLERS = Object.freeze({
   set_local_context: (rt, args) => rt.setLocalProviderContext(args.modelId, args.localContextWindow),
   async list_models(rt, args) {
-    const options = args.catalog || {};
-    const refresh = options.refresh === true;
-    const models = options.webSearch
-      ? await rt.listWebSearchModels({ refresh })
-      : await rt.listProviderModels({ refresh });
-    return { models: options.provider ? models.filter((model) => model.provider === options.provider) : models };
+    const { provider, model, page = 1, limit = MODEL_PAGE_DEFAULT, webSearch, refresh } = args.catalog || {};
+    const rows = webSearch
+      ? await rt.listWebSearchModels({ refresh: refresh === true })
+      : await rt.listProviderModels({ refresh: refresh === true });
+    if (model) return { model: modelDetail(findModel(rows, model, provider)) };
+    if (!provider) return { providers: providerIndex(rows) };
+    const own = rows.filter((row) => row.provider === provider);
+    const pages = Math.max(1, Math.ceil(own.length / limit));
+    return {
+      provider,
+      total: own.length,
+      page,
+      pages,
+      ...(page < pages ? { nextPage: page + 1 } : {}),
+      models: own.slice((page - 1) * limit, page * limit).map(compactModelRow),
+    };
   },
   set_orchestration_mode: (rt, args) => rt.setOrchestrationMode(args.mode),
   get_mcp_server: async (rt, args) => publicMcpConfig(await rt.getMcpServerConfig(args.name)),

package/src/session-runtime/setup-tool/settings-contract.mjs

@@ -114,9 +114,19 @@ export const SETUP_MCP_SCHEMA = object({
 
 export const SETUP_EXTENDED_PROPERTIES = Object.freeze({
   catalog: object({
-    provider: text,
-    webSearch: boolean,
-    refresh: boolean,
+    provider: {
+      ...text,
+      description: 'list_models: omit for the provider index; set for that provider\'s compact model rows.',
+    },
+    model: {
+      ...text,
+      description:
+        'list_models: one model id; returns its full options (efforts, fast, service tiers, modelParameterOptions, parameterVariants) for set_route. Add provider when several offer the id.',
+    },
+    page: { type: 'integer', minimum: 1, description: 'list_models with provider: 1-based page; default 1.' },
+    limit: { type: 'integer', minimum: 1, maximum: 100, description: 'list_models with provider: rows per page; default 25.' },
+    webSearch: { ...boolean, description: 'list_models: native-search capable models only.' },
+    refresh: { ...boolean, description: 'list_models: refresh the catalog first.' },
   }),
   localContextWindow: {
     type: ['integer', 'null'],

package/src/session-runtime/setup-tool/tool-defs.mjs

@@ -68,7 +68,7 @@ export const SETUP_OPEN_TARGETS = Object.freeze([
 // Runtime dispatch contract. A trailing ? denotes an optional field. Keep
 // this out of the wire schema: field descriptions already name their actions.
 export const SETUP_ACTION_FIELDS = Object.freeze({
-  status: 'domain?',
+  status: 'domain? detail?',
   open: 'target',
   set_route: 'route',
   set_agent_route: 'agent route',
@@ -136,6 +136,10 @@ const ROUTE_SCHEMA = {
     model: { type: 'string' },
     effort: { type: 'string' },
     fast: { type: 'boolean' },
+    autoEffort: {
+      type: 'boolean',
+      description: 'Main and agent routes only: Auto reasoning for this route; omitted = preserved.',
+    },
     modelParameters: { type: 'object', additionalProperties: { type: 'string' } },
     // A typed enum is unrepresentable on Gemini; the bounds project everywhere
     // and the executor rejects values that are not a multiple of 10.
@@ -157,7 +161,7 @@ export const SETUP_TOOL_DEFS = Object.freeze([
     name: 'setup',
     title: 'Setup',
     description:
-      "Read or change this Mixdog installation's settings through the runtime. Load the setup skill first (local-provider for managed local-model installation). status reads one domain; open navigates the attached app to a settings surface. Secrets (API keys, OAuth) are never accepted. Changes apply to new sessions unless the result says otherwise.",
+      "Read or change this Mixdog installation's settings through the runtime. Load the setup skill first (local-provider for managed local-model installation). status reads one domain; open navigates the attached app to a settings surface; list_models returns a provider index, then one provider's paged compact rows, then one model's full options (catalog.model). Results are compact JSON. Secrets (API keys, OAuth) are never accepted. Changes apply to new sessions unless the result says otherwise.",
     annotations: {
       title: 'Setup',
       readOnlyHint: false,
@@ -177,6 +181,11 @@ export const SETUP_TOOL_DEFS = Object.freeze([
           enum: [...SETUP_STATUS_DOMAINS],
           description: 'status: which domain to read; default summary.',
         },
+        detail: {
+          type: 'boolean',
+          description:
+            'status providers: full rows for every provider (key URLs, expiry, account ids) instead of configured providers only.',
+        },
         target: {
           type: 'string',
           enum: [...SETUP_OPEN_TARGETS],
@@ -236,7 +245,7 @@ export const SETUP_TOOL_DEFS = Object.freeze([
         accountId: {
           type: 'string',
           description:
-            'forget_provider_auth: OAuth account id from status providers; required when the provider has several accounts.',
+            'forget_provider_auth: OAuth account id from status providers with detail:true; required when the provider has several accounts.',
         },
         providerAccount: {
           type: 'object',
@@ -263,7 +272,7 @@ export const SETUP_TOOL_DEFS = Object.freeze([
               properties: { id: { type: 'string' }, label: { type: 'string', maxLength: 80 } },
             },
           },
-          description: 'set_provider_account: OAuth account change; account ids from status providers.',
+          description: 'set_provider_account: OAuth account change; account ids from status providers with detail:true.',
         },
         modelId: {
           type: 'string',

package/src/session-runtime/skills-api.mjs

@@ -46,18 +46,16 @@ export function createSkillsApi({ contextMod, getCwd, getTools = () => [] }) {
       }
       return { kind: 'user' };
     };
+    const enabledFlags = contextMod.skillEnabledFlags(skills);
     return {
       cwd,
       count: skills.length,
       tools: getTools().map(({ name }) => ({ name })),
-      skills: skills.map((skill) => {
+      skills: skills.map((skill, index) => {
         const source = sourceForSkill(skill);
         return {
           name: skill.name,
-          enabled: !(
-            contextMod.isSkillDisabled?.(skill.name, null, skills) ||
-            contextMod.skillMissingFeature?.(skill.name, null, skills)
-          ),
+          enabled: enabledFlags[index],
           description: skill.description || '',
           whenToUse: skill.whenToUse || '',
           filePath: skill.filePath || null,

package/src/session-runtime/tool-surface.mjs

@@ -6,6 +6,7 @@ import {
   filterDisallowedTools,
   selectDeferredTools,
 } from '../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
+import { AGENT_WORKER_DENIED_TOOLS } from '../runtime/agent/orchestrator/session/manager/tool-resolution.mjs';
 import { LEAD_DISALLOWED_TOOLS } from '../runtime/agent/orchestrator/runtime-core/tool-defs.mjs';
 import { deferredSurfaceModeForLead, toolSpecForMode } from '../runtime/agent/orchestrator/runtime-core/effort.mjs';
 import { loadSkillToolDependencies } from '../runtime/agent/orchestrator/runtime-core/skill-tool-loading.mjs';
@@ -52,8 +53,11 @@ export function createToolSurface({
     const workflowTools = hideAgentTool
       ? profileTools.filter((tool) => !agentToolNames.has(String(tool?.name || '')))
       : profileTools;
+    const visibleTools = agentOwned
+      ? workflowTools.filter((tool) => !AGENT_WORKER_DENIED_TOOLS.has(String(tool?.name || '').toLowerCase()))
+      : workflowTools;
     const denied = new Set(getFeatureDisallowedTools().map((name) => String(name || '')));
-    return denied.size ? workflowTools.filter((tool) => !denied.has(String(tool?.name || ''))) : workflowTools;
+    return denied.size ? visibleTools.filter((tool) => !denied.has(String(tool?.name || ''))) : visibleTools;
   }
 
   function disallowedTools() {

package/src/session-runtime/turn/compaction-gate.mjs

@@ -0,0 +1,25 @@
+/**
+ * src/session-runtime/turn/compaction-gate.mjs - serializes a model-scheduled
+ * compaction (session tool) with everything that follows its turn. The
+ * compaction is chained, never left dangling: `after(fn)` wraps a command so it
+ * waits for the compaction in flight, and the compaction itself only runs if
+ * the session it was scheduled for is still the live one.
+ */
+export function createCompactionGate({ getSessionId, compact }) {
+  let tail = Promise.resolve();
+  const run = (sessionId) => {
+    tail = tail
+      .then(() => (getSessionId() === sessionId ? compact() : null))
+      .catch(() => {
+        /* best-effort: a scheduled compaction must never break teardown */
+      });
+    return tail;
+  };
+  const after =
+    (fn) =>
+    async (...args) => {
+      await tail;
+      return fn(...args);
+    };
+  return { run, after };
+}