mixdog 1.2.2 → 1.2.4

package/src/session-runtime/model-route/set-route.mjs

@@ -1,6 +1,8 @@
 /**
- * set-route.mjs — select the main route: resolve and validate the request,
- * adopt it into config, then decide how the current session follows it
+ * set-route.mjs — select the runtime's route: resolve and validate the
+ * request, adopt it as the live route (its per-model settings saved; the main
+ * model only on an explicit main-model choice, keepMainModel: false), then
+ * decide when the current session follows it
  * (untouched, tuned, recreated, updated in place when empty, or switched in
  * place when the selection is addressed to an established conversation).
  */
@@ -20,7 +22,8 @@ import {
   sessionRouteCommitted,
   shouldRecreateEmptySessionForRouteChange,
 } from '../../runtime/agent/orchestrator/runtime-core/session-route-policy.mjs';
-import { rebuildDeferredToolSurfaceForProvider } from '../../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
+import { rebuildToolSurfaceForProviderWithMigration } from '../../runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs';
+import { UNOWNED_LEASE, openRouteLease } from './route-ownership.mjs';
 
 /** The request, completed from the live route where the caller left gaps. */
 function completeRequest(deps, next) {
@@ -80,20 +83,26 @@ async function resolveSelectedRoute(deps, next) {
 }
 
 /** Close the empty session and materialize a fresh one for the new provider. */
-async function recreateEmptySession(deps) {
+async function recreateEmptySession(deps, lease) {
   const { getSession, setSession, mgr, statusRoutes, createCurrentSession, invalidatePreSessionToolSurface } = deps;
   // If the boot create is still finishing SessionStart/deferred-surface
   // work, drain that promise first. Otherwise createCurrentSession()
   // would return the old in-flight promise after we tombstone/null the
   // session, racing the intended rebuild for the new provider.
   await createCurrentSession('model-switch-empty-drain');
-  const emptySession = getSession();
-  if (!emptySession?.id || sessionHasRouteHistory(emptySession)) return;
-  statusRoutes?.clearGatewaySessionRoute?.(emptySession.id);
-  mgr.closeSession?.(emptySession.id, 'cli-model-switch-empty', { tombstone: true });
-  setSession(null);
-  invalidatePreSessionToolSurface?.();
-  await createCurrentSession('model-switch-empty');
+  const closed = lease.run(
+    () => {
+      const emptySession = getSession();
+      if (!emptySession?.id || sessionHasRouteHistory(emptySession)) return false;
+      statusRoutes?.clearGatewaySessionRoute?.(emptySession.id);
+      mgr.closeSession?.(emptySession.id, 'cli-model-switch-empty', { tombstone: true });
+      setSession(null);
+      invalidatePreSessionToolSurface?.();
+      return true;
+    },
+    () => false
+  );
+  if (closed) await createCurrentSession('model-switch-empty');
 }
 
 /** Rewrite the addressed empty session to the route it was asked to run on. */
@@ -114,7 +123,7 @@ function updateSessionInPlace(deps, session, updateOptions) {
   const updated = mgr.updateSessionRoute?.(session.id, fields, updateOptions);
   if (updated) setSession(updated);
   else Object.assign(session, fields);
-  rebuildDeferredToolSurfaceForProvider(getSession(), route.provider);
+  rebuildToolSurfaceForProviderWithMigration(getSession(), route.provider);
   writeStatuslineRoute(statusRoutes, getSession(), route);
 }
 
@@ -164,7 +173,7 @@ function switchSessionInPlace(deps, session) {
 }
 
 /** Validate, persist and adopt the requested route as the runtime's route. */
-async function adoptRoute(deps, persist, next, options) {
+async function adoptRoute(deps, persist, next, options, lease) {
   const {
     getConfig,
     getRoute,
@@ -175,15 +184,40 @@ async function adoptRoute(deps, persist, next, options) {
     scheduleStatuslineUsageRefresh,
   } = deps;
   const { selectedRoute, fastCapable, modelMeta } = await resolveSelectedRoute(deps, next);
-  persist.saveRouteModelSettings(selectedRoute, fastCapable);
-  // An heir opening on its source's model is not a main-model choice.
-  const leadRoute = persist.persistAdoptedModelSettings(selectedRoute, {
-    keepMainModel: options?.keepMainModel === true,
-  });
-  setRouteState(resolveRoute(getConfig(), leadRoute ? { model: workflowPresetId('lead') } : selectedRoute));
-  await refreshRouteEffort(modelMeta);
-  refreshStatuslineUsageSnapshot(getRoute());
-  scheduleStatuslineUsageRefresh();
+  // Provider readiness may outlast the session the selection was made for.
+  const adopted = lease.run(
+    () => {
+      if (options?.sessionOnly === true) {
+        // An agent child's route belongs to that session alone: the shared
+        // modelSettings bucket (saved effort/Fast per model) and the main
+        // model (lead preset / default model) are never written.
+        setRouteState(resolveRoute(getConfig(), selectedRoute));
+      } else {
+        persist.saveRouteModelSettings(selectedRoute, fastCapable);
+        // The main model changes only on an explicit main-model choice
+        // (keepMainModel: false, e.g. the setup tool); every other selection
+        // — the session surface's model pick, an heir — keeps it.
+        const leadRoute = persist.persistAdoptedModelSettings(selectedRoute, {
+          keepMainModel: options?.keepMainModel !== false,
+        });
+        setRouteState(resolveRoute(getConfig(), leadRoute ? { model: workflowPresetId('lead') } : selectedRoute));
+      }
+      return true;
+    },
+    () => false
+  );
+  if (!adopted) return false;
+  // The refresh completes against the route just adopted and only while the
+  // selection still owns it.
+  await refreshRouteEffort(modelMeta, getRoute(), null, lease);
+  return lease.run(
+    () => {
+      refreshStatuslineUsageSnapshot(getRoute());
+      scheduleStatuslineUsageRefresh();
+      return true;
+    },
+    () => false
+  );
 }
 
 /**
@@ -194,17 +228,25 @@ async function adoptRoute(deps, persist, next, options) {
  * `{ modelSwitch }` with the recorded boundary (as setRoute does) so the
  * session surface shows the same live divider, or true when nothing switched.
  */
-export function createContinueSessionInModel(deps, persist) {
-  const { getSession, invalidateContextStatusCache } = deps;
+export function createContinueSessionInModel(deps, persist, clearPendingRoute) {
+  const { getSession, getSessionGeneration, invalidateContextStatusCache } = deps;
   return async function continueSessionInModel(sessionId, next) {
     const session = getSession();
     if (!sessionId || !session?.id || session.id !== sessionId) {
       throw new Error(`session ${sessionId || ''} is not the active session`);
     }
-    await adoptRoute(deps, persist, next, {});
-    const modelSwitch = switchSessionInPlace(deps, session);
-    invalidateContextStatusCache();
-    return modelSwitch ? { modelSwitch } : true;
+    const lease = openRouteLease(getSessionGeneration);
+    const adopted = await adoptRoute(deps, persist, next, {}, lease);
+    return lease.run(
+      () => {
+        if (!adopted) return true;
+        const modelSwitch = switchSessionInPlace(deps, session);
+        invalidateContextStatusCache();
+        clearPendingRoute?.();
+        return modelSwitch ? { modelSwitch } : true;
+      },
+      () => true
+    );
   };
 }
 
@@ -215,9 +257,10 @@ async function validateSelectedRoute(deps, next) {
 }
 
 export function createSetRoute(deps, persist) {
-  const { getRoute, getSession, invalidateContextStatusCache, createCurrentSession } = deps;
+  const { getRoute, getSession, getSessionGeneration, invalidateContextStatusCache, createCurrentSession } = deps;
+  let pending = null;
 
-  return async function setRoute(next, options = {}) {
+  async function setRoute(next, options = {}) {
     // Without an explicit durable address a selection is for a new/inherited
     // session and never rewrites an existing conversation's model, unless it
     // is the user's model choice for this conversation (`switchEstablished`,
@@ -225,11 +268,28 @@ export function createSetRoute(deps, persist) {
     // place while an empty one follows the unaddressed rules below.
     const applyToCurrentSession = options?.applyToCurrentSession === true;
     const switchEstablished = applyToCurrentSession || options?.switchEstablished === true;
-    // Lets a caller prove the selection is acceptable before it does
-    // irreversible work (compaction) ahead of the switch; changes nothing.
+    // Validate without persisting the selection or changing the session.
     if (options?.validateOnly === true) return validateSelectedRoute(deps, next);
-    await adoptRoute(deps, persist, next, options);
+    // A selection addressed to a conversation belongs to the session
+    // generation it was enqueued under (the surface's enqueue boundary names
+    // it; a direct call is enqueued now). Once that generation has moved, every
+    // route or session effect is skipped by the lease and the current route
+    // stands.
+    const addressed = switchEstablished || options?.deferUntilNextTurn === true;
+    const lease = addressed ? openRouteLease(getSessionGeneration, options?.originGeneration) : UNOWNED_LEASE;
+    const adopted = await adoptRoute(deps, persist, next, options, lease);
+    if (!adopted) return getRoute();
+    return lease.run(() => followSession(options, lease, { switchEstablished, applyToCurrentSession }), getRoute);
+  }
+
+  /** What the adopted route does to the session it was selected for. */
+  async function followSession(options, lease, { switchEstablished, applyToCurrentSession }) {
     const session = getSession();
+    if (options.deferUntilNextTurn === true) {
+      pending = session?.id ? { generation: lease.token } : null;
+      return getRoute();
+    }
+    pending = null;
     // A session the user has already talked in or compacted keeps its route
     // unless the selection was addressed to it. A current session with no
     // model reply, no compaction summary and no in-flight first turn — empty,
@@ -240,8 +300,8 @@ export function createSetRoute(deps, persist) {
       if (!switchEstablished) return getRoute();
       const route = getRoute();
       // An addressed selection of another model switches the conversation
-      // itself in place; the caller (session surface) refuses it while a
-      // turn runs. A same-model update (effort/Fast) only tunes the session
+      // itself in place; the session surface defers it to the next turn
+      // instead. A same-model update (effort/Fast) only tunes the session
       // from its next turn.
       if (session && (route.provider !== session.provider || route.model !== session.model)) {
         const modelSwitch = switchSessionInPlace(deps, session);
@@ -259,7 +319,9 @@ export function createSetRoute(deps, persist) {
       session?.id &&
       typeof createCurrentSession === 'function'
     ) {
-      await recreateEmptySession(deps);
+      // The recreation installs a new session itself, so nothing after it
+      // acts for the selection beyond dropping the stale gauge.
+      await recreateEmptySession(deps, lease);
       invalidateContextStatusCache();
       return getRoute();
     }
@@ -272,5 +334,23 @@ export function createSetRoute(deps, persist) {
       invalidateContextStatusCache();
     }
     return getRoute();
+  }
+  setRoute.applyPendingRoute = () => {
+    if (!pending) return null;
+    const selection = pending;
+    if (selection.generation !== getSessionGeneration()) {
+      pending = null;
+      return null;
+    }
+    // The live route is the latest selection: effort/Fast tuned after the
+    // deferred model choice replace it, so no snapshot is kept.
+    const modelSwitch = switchSessionInPlace(deps, getSession());
+    invalidateContextStatusCache();
+    pending = null;
+    return modelSwitch;
+  };
+  setRoute.clearPendingRoute = () => {
+    pending = null;
   };
+  return setRoute;
 }

package/src/session-runtime/model-route/web-search-route.mjs

@@ -6,6 +6,7 @@ import { clean, hasOwn } from '../../runtime/agent/orchestrator/runtime-core/ses
 import { coerceEffortFor } from '../../runtime/agent/orchestrator/runtime-core/effort.mjs';
 import { ensureProviderEnabled } from '../../runtime/agent/orchestrator/runtime-core/config-helpers.mjs';
 import { selectionFastCapable } from '../route-state.mjs';
+import { routeChain } from '../../runtime/shared/model-route-chain.mjs';
 import {
   isDefaultWebSearchRouteConfig,
   isWebSearchCapableProvider,
@@ -93,9 +94,13 @@ export function createWebSearchRouteApi(deps) {
       if (isDefaultWebSearchRouteConfig(selectedRoute)) {
         await awaitKeychainPrewarm();
         ensureFullConfig();
-        return saveWebSearchRoute(defaultWebSearchRoute(selectedRoute.toolType));
       }
-      return saveWebSearchRoute(await resolveExplicitRoute(selectedRoute));
+      const resolved = [];
+      for (const entry of routeChain(selectedRoute)) {
+        resolved.push(isDefaultWebSearchRouteConfig(entry) ? entry : await resolveExplicitRoute(entry));
+      }
+      const [primary, ...fallbacks] = resolved;
+      return saveWebSearchRoute(normalizeWebSearchRouteConfig({ ...primary, fallbacks }));
     },
   };
 }

package/src/session-runtime/model-route-api.mjs

@@ -19,10 +19,12 @@ export { shouldRecreateEmptySessionForRouteChange } from '../runtime/agent/orche
 
 export function createModelRouteApi(deps) {
   const persist = createRoutePersistence(deps);
+  const setRoute = createSetRoute(deps, persist);
   return {
     ...createWebSearchRouteApi(deps),
-    setRoute: createSetRoute(deps, persist),
-    continueSessionInModel: createContinueSessionInModel(deps, persist),
+    setRoute,
+    applyPendingRoute: setRoute.applyPendingRoute,
+    continueSessionInModel: createContinueSessionInModel(deps, persist, setRoute.clearPendingRoute),
     ...createRouteTuning(deps, persist),
   };
 }

package/src/session-runtime/native-web-search/routes.mjs

@@ -4,6 +4,7 @@
  * follow-Main default.
  */
 import { webSearchRouteOrDefault } from '../../runtime/agent/orchestrator/runtime-core/workflow.mjs';
+import { routeChain, canonicalRouteProvider } from '../../runtime/shared/model-route-chain.mjs';
 
 export function createWebSearchRouteCandidates({
   getRoute,
@@ -50,35 +51,47 @@ export function createWebSearchRouteCandidates({
     // before the Main Model was ever consulted.
     const webSearchRoute = webSearchRouteOrDefault(cfg.webSearchRoute, getWebSearchRoute());
     setWebSearchRoute(webSearchRoute);
+    const candidates = [];
+    const seen = new Set();
+    for (const selected of routeChain(webSearchRoute)) {
+      const candidate = await resolveCandidate(selected, cfg, route);
+      if (!candidate) continue;
+      const provider = canonicalRouteProvider(candidate.provider);
+      if (seen.has(provider)) continue;
+      seen.add(provider);
+      candidates.push({ ...candidate, provider });
+    }
+    return candidates;
+  }
+
+  async function resolveCandidate(webSearchRoute, cfg, route) {
     if (isDefaultWebSearchRouteConfig(webSearchRoute)) {
       const loadedRow = route?.provider && route?.model ? await loadMainCatalogRow(cfg, route) : null;
       const mainModel = currentMainWebSearchModelMeta(loadedRow);
-      if (!mainModel || !webSearchCapableFor(route.provider, mainModel)) return [];
-      return [
-        {
-          key: `default\n${route.provider}\n${route.model}`,
-          provider: normalizeWebSearchProviderId(route.provider),
-          model: route.model,
-          source: 'default-web-search-route',
-          effort: route.effectiveEffort || route.effort || null,
-          fast: route.fast === true,
-          toolType: webSearchRoute.toolType || null,
-        },
-      ];
+      if (!mainModel || !webSearchCapableFor(route.provider, mainModel)) return null;
+      return {
+        key: `default\n${route.provider}\n${route.model}`,
+        provider: normalizeWebSearchProviderId(route.provider),
+        model: route.model,
+        source: 'default-web-search-route',
+        effort: route.effectiveEffort || route.effort || null,
+        fast: route.fast === true,
+        modelParameters: route.modelParameters || {},
+        toolType: webSearchRoute.toolType || null,
+      };
     }
     const providerName = normalizeWebSearchProviderId(webSearchRoute.provider);
-    if (!isWebSearchCapableProvider(providerName)) return [];
-    return [
-      {
-        key: `${providerName}\n${webSearchRoute.model}`,
-        provider: providerName,
-        model: webSearchRoute.model,
-        source: 'web-search-route',
-        effort: webSearchRoute.effort || null,
-        fast: webSearchRoute.fast === true,
-        toolType: webSearchRoute.toolType || null,
-      },
-    ];
+    if (!isWebSearchCapableProvider(providerName)) return null;
+    return {
+      key: `${providerName}\n${webSearchRoute.model}`,
+      provider: providerName,
+      model: webSearchRoute.model,
+      source: 'web-search-route',
+      effort: webSearchRoute.effort || null,
+      fast: webSearchRoute.fast === true,
+      modelParameters: webSearchRoute.modelParameters || {},
+      toolType: webSearchRoute.toolType || null,
+    };
   }
 
   return { currentMainWebSearchModelMeta, nativeWebSearchRoutes };

package/src/session-runtime/native-web-search-usage.mjs

@@ -0,0 +1,51 @@
+// Per-session sink for usage spent by native web-search sends. The search runs
+// as its own provider send under a derived session id, so the main stream
+// never reports it; a turn's caller opts in with `onNativeWebSearchUsage` and
+// receives the same delta shape `onUsageDelta` carries.
+//
+// Keyed by the owning session id, not async-local state: tools can execute
+// from stream callbacks whose async context belongs to a pooled transport
+// connection, not to the ask that is waiting on them.
+//
+// Each registration is its own entry that only its own release removes, so
+// overlapping turns on one session id never restore or drop each other. The
+// session lock serializes turns, so the most recent live entry belongs to the
+// turn that is running; callers register once their turn owns the session.
+import { usageDeltaEvent } from '../runtime/agent/orchestrator/session/loop/usage.mjs';
+
+const entriesBySession = new Map();
+
+/** Adds an owned sink entry for `sessionId`; the returned release removes exactly that entry. */
+export function registerNativeWebSearchUsageSink(sessionId, sink) {
+  if (typeof sink !== 'function' || !sessionId) return () => {};
+  const entry = { sink };
+  let entries = entriesBySession.get(sessionId);
+  if (!entries) {
+    entries = [];
+    entriesBySession.set(sessionId, entries);
+  }
+  entries.push(entry);
+  return () => {
+    const live = entriesBySession.get(sessionId);
+    const index = live ? live.indexOf(entry) : -1;
+    if (index === -1) return;
+    live.splice(index, 1);
+    if (live.length === 0) entriesBySession.delete(sessionId);
+  };
+}
+
+export function reportNativeWebSearchUsage({ ownerSessionId, sessionId, requestedModel, model, usage }) {
+  const entries = entriesBySession.get(ownerSessionId);
+  const sink = entries?.[entries.length - 1]?.sink;
+  if (!sink || !usage) return;
+  try {
+    const pending = sink({
+      ...usageDeltaEvent({ sessionId, iterationIndex: 0, requestedModel, model, usage }),
+      source: 'native_web_search',
+      agentRole: 'web-search',
+    });
+    if (typeof pending?.then === 'function') pending.then(undefined, () => {});
+  } catch {
+    /* telemetry must never fail the search */
+  }
+}

package/src/session-runtime/native-web-search.mjs

@@ -13,6 +13,8 @@ import {
   normalizeWebSearchAllowedDomain,
 } from './native-web-search/tool-shape.mjs';
 import { createWebSearchRouteCandidates } from './native-web-search/routes.mjs';
+import { reportNativeWebSearchUsage } from './native-web-search-usage.mjs';
+import { canFallbackRoute } from '../runtime/shared/model-route-fallback.mjs';
 
 export function createNativeWebSearch(deps) {
   const {
@@ -58,10 +60,11 @@ export function createNativeWebSearch(deps) {
     }
     const family = webSearchProviderFamily(candidate.provider);
     const startedAt = Date.now();
+    const sendSessionId = `${getSession()?.id || 'web_search'}:native-web-search:${Date.now().toString(36)}`;
     const result = await providerImpl.send(nativeWebSearchMessages(webSearchArgs), candidate.model, undefined, {
       signal,
       role: 'web-search',
-      sessionId: `${getSession()?.id || 'web_search'}:native-web-search:${Date.now().toString(36)}`,
+      sessionId: sendSessionId,
       sourceType: 'native-web-search',
       sourceName: 'web_search',
       nativeTools: [toolFor(webSearchArgs, toolType, candidate.provider)],
@@ -73,6 +76,13 @@ export function createNativeWebSearch(deps) {
       onStageChange: () => {},
       onStreamDelta: () => {},
     });
+    reportNativeWebSearchUsage({
+      ownerSessionId: getSession()?.id,
+      sessionId: sendSessionId,
+      requestedModel: candidate.model,
+      model: result?.model || candidate.model,
+      usage: result?.usage,
+    });
     return {
       content: String(result?.content || '').trim(),
       provider: candidate.provider,
@@ -89,14 +99,14 @@ export function createNativeWebSearch(deps) {
     if (!candidates.length) throw noCandidateError();
     const errors = [];
     for (const candidate of candidates) {
-      for (const toolType of toolTypesFor(candidate)) {
-        try {
-          return await sendCandidate(candidate, toolType, webSearchArgs, signal);
-        } catch (err) {
-          errors.push(
-            `${candidate.provider}${candidate.model ? `/${candidate.model}` : ''}/${toolType}: ${err?.message || String(err)}`
-          );
-        }
+      const [toolType] = toolTypesFor(candidate);
+      try {
+        return await sendCandidate(candidate, toolType, webSearchArgs, signal);
+      } catch (err) {
+        if (!canFallbackRoute(err, { signal })) throw err;
+        errors.push(
+          `${candidate.provider}${candidate.model ? `/${candidate.model}` : ''}/${toolType}: ${err?.message || String(err)}`
+        );
       }
     }
     throw new Error(`native web search failed: ${errors.join(' | ')}`);

package/src/session-runtime/new-session-config.mjs

@@ -12,7 +12,6 @@ export function createNewSessionConfig({
   initialRouteExplicit = false,
   invalidatePreSessionToolSurface,
   invalidateOutputStyleStatusCache,
-  invalidateSkills,
   connectConfiguredMcp,
   configureEmbedding,
 }) {
@@ -33,7 +32,10 @@ export function createNewSessionConfig({
     }
     invalidateOutputStyleStatusCache();
     invalidatePreSessionToolSurface();
-    invalidateSkills();
+    // The installed-skill list is NOT dropped here: its cache is change-gated
+    // (every skill root's mtime signature, kept by change watchers), so a new
+    // session already sees any skill edit. Clearing it made every session
+    // creation re-read and re-parse every SKILL.md on the event loop.
     await configureEmbedding(sharedCfgMod.readSection('memory')?.embedding || {});
     if (!firstSession || !isDeepStrictEqual(previousMcp, mcpSettings())) {
       // Reused runtimes may still own old connections. This reset is scoped to

package/src/session-runtime/provider-auth/login.mjs

@@ -12,6 +12,7 @@ import {
   removeCustomProvider,
   updateCustomProviderModel,
   testCustomProvider,
+  checkCustomProviderKeyEnv,
   discoverCustomProviderModels,
 } from '../services/provider-admin.mjs';
 
@@ -96,6 +97,9 @@ export function createLoginApi({ cfgMod, awaitKeychainPrewarm, reloadFullConfig,
       await awaitKeychainPrewarm();
       return await testCustomProvider(cfgMod, input);
     },
+    checkCustomProviderKeyEnv(name) {
+      return checkCustomProviderKeyEnv(name);
+    },
     async discoverCustomProviderModels(input) {
       await awaitKeychainPrewarm();
       return await discoverCustomProviderModels(cfgMod, input);

package/src/session-runtime/provider-auth/setup.mjs

@@ -3,6 +3,7 @@
 // the model catalog.
 import { refreshKeychainStatus, retryKeychain } from '../../runtime/shared/config.mjs';
 import { keychainIssueFor } from '../services/provider-admin.mjs';
+import { modelProxyClientMode } from '../../runtime/shared/model-proxy-mode.mjs';
 
 // The keyring alert must reflect the live state (it can lock or unlock while a
 // cached setup is served), so overlay it on every ready read.
@@ -26,6 +27,9 @@ export function createSetupApi({
   return {
     async getProviderSetup(options = {}) {
       const force = options?.force === true || options?.refresh === true;
+      if (modelProxyClientMode()) {
+        return cachedProviderSetup({ force: force || options?.recheckKeychain === true });
+      }
       // An unforced read never blocks: the authoritative setup waits on the OS
       // keychain, which can take seconds on a cold start and used to stall the
       // whole settings sweep behind it. Serve

package/src/session-runtime/provider-models/catalog-load.mjs

@@ -2,6 +2,7 @@
 // One authoritative provider catalog load: secrets and providers ready, the
 // daemon-wide startup refresh joined (or a forced refresh run), then the shared
 // catalog flattened into deduplicated rows with per-provider profiling.
+import { modelProxyClientMode } from '../../runtime/shared/model-proxy-mode.mjs';
 import { isSelectableLlmModel } from '../model-recency.mjs';
 import { sharedProviderCatalog } from '../provider-catalog-cache.mjs';
 import { NO_ENABLED_PROVIDERS } from '../../runtime/agent/orchestrator/providers/registry-errors.mjs';
@@ -49,6 +50,14 @@ export function createCatalogLoader({
     }
     const providersStartedAt = performance.now();
     try {
+      if (forceRefresh && modelProxyClientMode()) {
+        const { loadModelProxyProviderConfig } = await import(
+          '../../runtime/agent/orchestrator/providers/model-proxy-provider.mjs'
+        );
+        await loadModelProxyProviderConfig({ force: true });
+        // Rebuild even when daemon readiness already settled on the old PC set.
+        await reg().initProviders({});
+      }
       await ensureProvidersReady(config().providers || {});
     } catch (error) {
       if (error?.code === NO_ENABLED_PROVIDERS) return false;

package/src/session-runtime/provider-models/web-search-catalog.mjs

@@ -4,6 +4,8 @@
 // the already-loaded provider rows over a provider round-trip.
 import { isSelectableLlmModel } from '../model-recency.mjs';
 import { catalogRevision } from '../provider-catalog-cache.mjs';
+import { modelProxyClientMode } from '../../runtime/shared/model-proxy-mode.mjs';
+import { loadModelProxyProviderConfig } from '../../runtime/agent/orchestrator/providers/model-proxy-provider.mjs';
 
 export function createWebSearchCatalog({
   caches,
@@ -14,15 +16,22 @@ export function createWebSearchCatalog({
   quickHelpers,
   normalizeWebSearchProviderId,
   isWebSearchCapableProvider,
+  collectProviderModels,
   ensureFullConfig,
   awaitKeychainPrewarm,
   ensureProvidersReady,
 }) {
   async function enabledWebSearchProviderConfig() {
-    await awaitKeychainPrewarm();
-    ensureFullConfig();
+    let providers;
+    if (modelProxyClientMode()) {
+      providers = await loadModelProxyProviderConfig();
+    } else {
+      await awaitKeychainPrewarm();
+      ensureFullConfig();
+      providers = config().providers;
+    }
     const out = {};
-    for (const [name, providerConfig] of Object.entries(config().providers || {})) {
+    for (const [name, providerConfig] of Object.entries(providers || {})) {
       const providerName = normalizeWebSearchProviderId(name);
       if (!providerConfig?.enabled || !isWebSearchCapableProvider(providerName)) continue;
       out[providerName] = { ...providerConfig, enabled: true };
@@ -66,6 +75,12 @@ export function createWebSearchCatalog({
   }
 
   async function loadWebSearchProviderModelsFresh({ forceRefresh = false } = {}) {
+    if (modelProxyClientMode()) {
+      // Share the desktop-backed catalog's readiness, force refresh and retry
+      // semantics. Server-local quick rows cannot describe desktop accounts.
+      const models = await collectProviderModels({ force: forceRefresh });
+      return quickHelpers.webSearchRowsWithDefault(quickHelpers.webSearchModelsFromRows(models));
+    }
     const webSearchProviders = await enabledWebSearchProviderConfig();
     const providerNames = Object.keys(webSearchProviders);
     if (!providerNames.length) return [];
@@ -89,6 +104,11 @@ export function createWebSearchCatalog({
   }
 
   async function collectWebSearchProviderModels({ force = false } = {}) {
+    if (modelProxyClientMode()) {
+      // The main catalog owns caching in client mode, including incomplete
+      // loads; do not pin an empty/offline projection in a second cache.
+      return rows.providerModelsFromCacheRows(await loadWebSearchProviderModelsFresh({ forceRefresh: force }));
+    }
     const revision = meta.syncCatalogRevision();
     if (force) {
       const models = await loadWebSearchProviderModelsFresh({ forceRefresh: true });

package/src/session-runtime/provider-models.mjs

@@ -63,6 +63,7 @@ export function createProviderModels({
     quickHelpers,
     normalizeWebSearchProviderId,
     isWebSearchCapableProvider,
+    collectProviderModels,
     ...readiness,
   });
   const loadProviderModelsFresh = createCatalogLoader({ caches, config, reg, meta, rows, profile, ...readiness });

package/src/session-runtime/provider-usage.mjs

@@ -5,6 +5,7 @@
 // references) and all config/registry reads flow through supplied accessors so
 // live-binding is preserved.
 import { clean } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
+import { modelProxyClientMode } from '../runtime/shared/model-proxy-mode.mjs';
 
 // A post-redeem dashboard rebuild is best effort: past this budget the caller
 // gets its confirmed outcome and the surface revalidates on its own cadence.
@@ -70,6 +71,9 @@ export function createProviderUsage({
   }
 
   async function cachedProviderSetup({ force = false, quick = false } = {}) {
+    // The proxy owns a short, connection-generation-aware cache. A session's
+    // indefinite local cache would hide PC sign-ins, sign-outs and reconnects.
+    if (modelProxyClientMode()) return providerSetup(displayConfig(), { force });
     if (!force && caches.providerSetupCache.setup) {
       return caches.providerSetupCache.setup;
     }