mixdog 1.2.5 → 1.2.6

package/src/session-runtime/services/agent-tool/restart-notify.mjs

@@ -0,0 +1,134 @@
+// agent-tool/restart-notify.mjs
+// Agent tasks live in process memory, so a daemon restart ends every in-flight
+// one without a word: the successor only sees worker rows left `failed`
+// (process-restart). This tells each task's owner, exactly once.
+//
+// Order is what makes it safe: the failure notification is enqueued in the
+// owner's persisted pending queue under a stable id (`restart:<taskId>`) and
+// flushed to the spool FIRST; only then is the row stamped `restartNotified`.
+// A crash or a throw before the stamp leaves the row retryable, and the retry
+// re-enqueues the same id — the queue is id-idempotent, so the owner still
+// sees it once.
+import {
+  acknowledgeBackgroundTaskCompletion,
+  completeBackgroundTask,
+  getBackgroundTask,
+  registerBackgroundTask,
+} from '../../../runtime/shared/background-tasks.mjs';
+import { renderAgentCompletionEnvelope } from '../../../runtime/shared/task-notification-envelope.mjs';
+import { modelVisibleToolCompletionMessage } from '../../../runtime/shared/tool-execution-contract.mjs';
+import { clean } from './helpers.mjs';
+
+const RESTART_FAILURE_ERROR = 'process restart: the daemon restarted while this agent task was running';
+const SETTLE_TIMEOUT_MS = 5000;
+
+/** Stable dedup id of one lost task's notification. A row that never recorded
+ *  a task id falls back to its session and settle time. */
+export function restartNotificationId(row) {
+  return `restart:${clean(row.task_id) || `${clean(row.sessionId)}:${clean(row.finishedAt)}`}`;
+}
+
+/** `pendingRestartFailures()` lists rows whose owner is not yet told;
+ *  `markRestartNotified(rows)` stamps them. `mgr` supplies the persisted
+ *  pending queue (enqueuePendingMessage / markCompletionEntry /
+ *  settlePendingMessageWrites). `notifySessionCompletion` is only the live,
+ *  best-effort emit to attached surfaces after the durable enqueue. */
+export function createRestartFailureNotifier({
+  pendingRestartFailures,
+  markRestartNotified,
+  mgr,
+  notifySessionCompletion,
+}) {
+  function enqueueDurably(row) {
+    const owner = clean(row.ownerSessionId);
+    const executionId = restartNotificationId(row);
+    const meta = {
+      type: 'agent_task_result',
+      execution_surface: 'agent',
+      execution_id: executionId,
+      status: 'failed',
+      caller_session_id: owner,
+    };
+    const text = renderAgentCompletionEnvelope({
+      id: clean(row.task_id) || executionId,
+      tag: row.tag,
+      status: 'failed',
+      error: RESTART_FAILURE_ERROR,
+    });
+    const entry = mgr.markCompletionEntry(modelVisibleToolCompletionMessage(text, meta), { executionId, meta });
+    return { owner, text, meta, entry };
+  }
+
+  // Lets `agent status <id>` resolve after the restart; best-effort.
+  function registerFailedTask(row) {
+    const taskId = clean(row.task_id);
+    if (!taskId || getBackgroundTask(taskId)) return;
+    const owner = clean(row.ownerSessionId);
+    registerBackgroundTask({
+      taskId,
+      surface: 'agent',
+      operation: 'restart',
+      label: row.tag,
+      input: { type: 'restart', tag: row.tag, sessionId: row.sessionId, agent: row.agent || null },
+      context: { callerSessionId: owner, ownerSessionId: owner, clientHostPid: row.clientHostPid || null },
+      meta: {
+        tag: row.tag,
+        sessionId: row.sessionId,
+        agent: row.agent || null,
+        provider: row.provider || null,
+        model: row.model || null,
+        preset: row.preset || null,
+        effort: row.effort || null,
+      },
+      resultType: 'agent_task_result',
+    });
+    completeBackgroundTask(taskId, {
+      status: 'failed',
+      error: RESTART_FAILURE_ERROR,
+      terminalReason: 'process-restart',
+      notify: false,
+    });
+    acknowledgeBackgroundTaskCompletion(taskId);
+  }
+
+  async function notifyRow(row) {
+    const { owner, text, meta, entry } = enqueueDurably(row);
+    if (!(mgr.enqueuePendingMessage(owner, entry) > 0)) throw new Error(`restart notification refused for ${owner}`);
+    if (!(await mgr.settlePendingMessageWrites({ timeoutMs: SETTLE_TIMEOUT_MS }))) {
+      throw new Error(`restart notification for ${owner} did not reach the spool`);
+    }
+    markRestartNotified([row]);
+    try {
+      registerFailedTask(row);
+    } catch {
+      /* status lookup only */
+    }
+    try {
+      // Same execution id as the queued entry: the queue dedups the mirror.
+      notifySessionCompletion?.(owner, text, meta);
+    } catch {
+      /* the durable queue is authoritative */
+    }
+  }
+
+  let inFlight = null;
+  async function run() {
+    for (const row of pendingRestartFailures()) {
+      try {
+        await notifyRow(row);
+      } catch (err) {
+        // Not stamped: the next pass or restart retries this row.
+        process.stderr.write(`[agent-tool] restart notification retry pending: ${err?.message || err}\n`);
+      }
+    }
+  }
+
+  return function notifyRestartFailures() {
+    inFlight ||= run()
+      .catch((err) => process.stderr.write(`[agent-tool] restart notification pass failed: ${err?.message || err}\n`))
+      .finally(() => {
+        inFlight = null;
+      });
+    return inFlight;
+  };
+}

package/src/session-runtime/services/agent-tool/send-flow.mjs

@@ -98,6 +98,8 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
     registry.upsertWorkerSessionDeferred(session, tag, {
       status: 'running',
       stage: 'running',
+      // The send's own task: a restart that ends this turn reports it by id.
+      task_id: job?.taskId,
       turnStartedAt: new Date().toISOString(),
     });
     let handoffMsgStart = 0;
@@ -224,5 +226,26 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
     return renderResult({ ...extras, ...views.renderJob(job, false) });
   }
 
-  return { prepareSend, dispatchToExistingSession };
+  // A background-task completion was queued for this worker. A busy worker
+  // takes it at its next tool boundary; an idle one runs a follow-up turn on
+  // an empty prompt, which drains the queued completion (never an empty user
+  // turn). Its answer reaches the owner like any send result.
+  function wakeIdleWorker(sessionId) {
+    const id = clean(sessionId);
+    if (!id || views.isSessionBusy(id)) return false;
+    const session = mgr.getSession(id);
+    if (!session || session.closed) return false;
+    const owner = clean(session.ownerSessionId || session.parentSessionId);
+    const notifyContext = owner
+      ? { callerSessionId: owner, ownerSessionId: owner, clientHostPid: session.clientHostPid || null }
+      : null;
+    void dispatchToExistingSession({ args: {}, session, sessionId: id, prompt: '' }, notifyContext).catch((error) => {
+      try {
+        process.stderr.write(`[agent] completion wake failed session=${id}: ${error?.message || error}\n`);
+      } catch {}
+    });
+    return true;
+  }
+
+  return { prepareSend, dispatchToExistingSession, wakeIdleWorker };
 }

package/src/session-runtime/services/agent-tool/spawn-flow/deferred-spawn.mjs

@@ -5,6 +5,7 @@
  * flip to running, and the cancellation checks around the turn.
  */
 import { nonNegativeInt, clearAgentStatuslineRoute } from '../helpers.mjs';
+import { closeManagedSession } from '../../../lifecycle/shared.mjs';
 
 export function createDeferredSpawn({
   mgr,
@@ -22,7 +23,7 @@ export function createDeferredSpawn({
   function closePreparedSpawn(prepared, reason = 'agent-task-cancel') {
     if (!prepared?.session?.id) return;
     try {
-      Promise.resolve(mgr.closeSession(prepared.session.id, reason)).catch(() => {});
+      Promise.resolve(closeManagedSession(mgr, prepared.session.id, reason)).catch(() => {});
     } catch {}
     try {
       clearAgentStatuslineRoute(prepared.session.id);

package/src/session-runtime/services/agent-tool/spawn-flow/job-start.mjs

@@ -7,6 +7,7 @@ import { sanitizeTaskMeta, startBackgroundTask } from '../../../../runtime/share
 import { resourceAdmission } from '../../../../runtime/shared/resource-admission.mjs';
 import { clean, terminalPidForContext } from '../helpers.mjs';
 import { renderResult } from '../render.mjs';
+import { closeManagedSession } from '../../../lifecycle/shared.mjs';
 
 /** The completion callback that hands a worker's result back to its caller session; null without a handoff. */
 function handoffNotifier(handoffSessionId, notifySessionCompletion) {
@@ -53,9 +54,9 @@ export function createJobStarter({ mgr, notifyStatusChange, notifySessionComplet
         const currentMeta = task?.meta || jobMeta;
         if (currentMeta?.sessionId) {
           try {
-            Promise.resolve(mgr.closeSession(currentMeta.sessionId, 'agent-task-cancel', { tombstone: false })).catch(
-              () => {}
-            );
+            Promise.resolve(
+              closeManagedSession(mgr, currentMeta.sessionId, 'agent-task-cancel', { tombstone: false })
+            ).catch(() => {});
           } catch {}
         }
         setImmediate(notifyStatusChange);

package/src/session-runtime/services/agent-tool/spawn-flow/spawn-run.mjs

@@ -39,9 +39,13 @@ export function createSpawnRunner({
   emitSubagentEvent,
   sessionSurface = null,
   createTurnReviewCollector,
+  onWorkerCompletionQueued = null,
 }) {
   // Owner/worker completion notification lives in ../notify.mjs.
-  const { workerNotifyFn, notifyOwnerAgentCompletionEarly } = createNotify(mgr, { notifySessionCompletion });
+  const { workerNotifyFn, notifyOwnerAgentCompletionEarly } = createNotify(mgr, {
+    notifySessionCompletion,
+    onWorkerCompletionQueued,
+  });
 
   // Idle-progress watchdogs (shared sweep timer) live in
   // agent-watchdog-registry.mjs.

package/src/session-runtime/services/agent-tool/tag-registry/tag-lookup.mjs

@@ -32,14 +32,16 @@ export function createTagLookup({ tags, mgr, readWorkerRows, reaper, getLiveSess
     const rows = [];
     const seen = new Set();
     const tombstones = reaper.tagTombstoneIndex();
-    const add = (session, fallbackTag = '') => {
+    // `loaded`: `session` is getLiveSession's own answer (not a catalog
+    // summary), so consumers may reuse it instead of loading it again.
+    const add = (session, fallbackTag = '', loaded = false) => {
       const tag = agentTagOf(session) || clean(fallbackTag);
       if (!tag || !session?.id || session.closed === true) return;
       if (isLeadPoolAgent(session.agent)) return;
       if (!sessionMatchesContext(session, context)) return;
       if (seen.has(session.id)) return;
       seen.add(session.id);
-      rows.push({ tag, session });
+      rows.push(loaded ? { tag, session, loaded: true } : { tag, session });
     };
     const addIndexRow = (row) => {
       const tag = clean(row?.tag);
@@ -70,9 +72,12 @@ export function createTagLookup({ tags, mgr, readWorkerRows, reaper, getLiveSess
       }
     }
     for (const [tag, sessionId] of tags.entries()) {
+      // add() drops an id already listed; loading it first (a whole-session
+      // read for an idle worker) was pure cost on every status pulse.
+      if (seen.has(sessionId)) continue;
       const session = getLiveSession(sessionId);
       if (session && reaper.tombstoneBlocksScan(session, tag, tombstones)) continue;
-      add(session, tag);
+      add(session, tag, true);
     }
     return rows;
   }

package/src/session-runtime/services/agent-tool/tag-registry.mjs

@@ -112,6 +112,9 @@ export function createTagRegistry({ dataDir, cfgMod, mgr }) {
     readWorkerRows,
     writeWorkerRows: index.writeWorkerRows,
     flushWorkerIndexMutations: index.flushWorkerIndexMutations,
+    recoverStaleWorkerRows: index.recoverStaleWorkerRows,
+    pendingRestartFailures: index.pendingRestartFailures,
+    markRestartNotified: index.markRestartNotified,
     upsertWorkerSession: index.upsertWorkerSession,
     upsertWorkerSessionDeferred,
     upsertLeadSession,

package/src/session-runtime/services/agent-tool/worker-index/row-shape.mjs

@@ -55,6 +55,9 @@ export function normalizeWorkerRows(value) {
       // Why a `failed` row failed (row-liveness, a watchdog stop). Always
       // present, so a later whole-row write clears a stale reason.
       failureReason: clean(row.failureReason) || null,
+      // When the owner was told this row's turn died with a process restart;
+      // always present, so new work on the row starts unnotified.
+      restartNotified: clean(row.restartNotified) || null,
       permission: clean(row.permission) || null,
       toolPermission: clean(row.toolPermission) || null,
       messages: positiveInt(row.messages) || 0,
@@ -112,6 +115,7 @@ export function workerRowFromSession(session, fallbackTag = '', extra = {}, getS
     task_id: clean(extra.task_id || extra.taskId) || null,
     error: clean(extra.error) || null,
     failureReason: clean(extra.failureReason) || null,
+    restartNotified: clean(extra.restartNotified) || null,
     permission: clean(session?.permission) || null,
     toolPermission: clean(session?.toolPermission) || null,
     messages: Array.isArray(session?.messages) ? session.messages.length : 0,

package/src/session-runtime/services/agent-tool/worker-index.mjs

@@ -161,14 +161,19 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
     });
   }
 
-  // Startup recovery: stale active rows settle — as failed when the process
-  // that ran their turn is gone (the turn never finished), otherwise to idle —
-  // and an approval wait left behind by a runtime that is gone (daemon
-  // restart) is cleared.
-  function recoverStaleWorkerRows() {
+  // Startup recovery: stale active rows settle — as failed when another
+  // process ran their turn (it is gone, or is the predecessor still shutting
+  // down: either way the turn never finished), otherwise to idle — and an
+  // approval wait left behind by a runtime that is gone (daemon restart) is
+  // cleared. `deadOnly` (later sweeps) settles only rows whose runtime is
+  // provably dead, never a live process's quiet turn.
+  function recoverStaleWorkerRows({ deadOnly = false } = {}) {
     const now = Date.now();
     const rows = store.readAll();
-    const staleActive = rows.filter((row) => liveness.isStaleActive(row, now));
+    const isStale = deadOnly
+      ? (row) => isActiveWorkerRow(row) && runtimeDied(row)
+      : (row) => liveness.isStaleActive(row, now);
+    const staleActive = rows.filter(isStale);
     const staleWaits = rows.some(isStaleApprovalWait);
     if (!staleActive.length && !staleWaits) return false;
     if (staleActive.length) {
@@ -176,12 +181,11 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
         for (const row of staleActive) {
           const key = workerRowKey(row);
           const current = byKey.get(key);
-          if (!current || !liveness.isStaleActive(current, now)) continue;
+          if (!current || !isStale(current)) continue;
+          const ranElsewhere = positiveInt(current.runtimePid) && positiveInt(current.runtimePid) !== process.pid;
           byKey.set(
             key,
-            runtimeDied(current)
-              ? liveness.failedRow(current, now, PROCESS_RESTART_FAILURE)
-              : liveness.idleRow(current, now)
+            ranElsewhere ? liveness.failedRow(current, now, PROCESS_RESTART_FAILURE) : liveness.idleRow(current, now)
           );
         }
       });
@@ -190,6 +194,34 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
     return true;
   }
 
+  const isUnnotifiedRestartFailure = (row) =>
+    row.status === 'failed' &&
+    row.failureReason === PROCESS_RESTART_FAILURE &&
+    Boolean(clean(row.ownerSessionId)) &&
+    !row.restartNotified;
+
+  /** Rows whose turn a process restart ended and whose owner has not been told
+   *  yet — whoever settled the row (this process at startup, or the
+   *  predecessor's exit flush). Read-only: the caller enqueues the owner's
+   *  notification durably, THEN calls `markRestartNotified`, so a crash in
+   *  between retries (the notification's stable id makes the retry exactly-once). */
+  function pendingRestartFailures() {
+    return store.readAll().filter(isUnnotifiedRestartFailure);
+  }
+
+  /** Stamp these rows as told, once their notification is durably queued. */
+  function markRestartNotified(rows) {
+    const stamp = new Date().toISOString();
+    store.write((byKey) => {
+      for (const row of rows) {
+        const key = workerRowKey(row);
+        const current = byKey.get(key);
+        if (!current || !isUnnotifiedRestartFailure(current)) continue;
+        byKey.set(key, { ...current, restartNotified: stamp });
+      }
+    });
+  }
+
   function flushWorkerIndexOnExit() {
     batch.flush();
     flushActiveWorkerRows();
@@ -285,5 +317,7 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
     flushActiveWorkerRows,
     flushWorkerIndexOnExit,
     recoverStaleWorkerRows,
+    pendingRestartFailures,
+    markRestartNotified,
   };
 }

package/src/session-runtime/services/agent-tool.mjs

@@ -9,6 +9,7 @@ import { liveAgentStatusRow } from './agent-tool/job-views/session-progress.mjs'
 import { createSpawnFlow } from './agent-tool/spawn-flow.mjs';
 import { createSendFlow } from './agent-tool/send-flow.mjs';
 import { createCloseFlow } from './agent-tool/close-flow.mjs';
+import { createRestartFailureNotifier } from './agent-tool/restart-notify.mjs';
 import { createTerminalTrace } from './agent-tool/terminal-trace.mjs';
 import { createAgentExecute } from './agent-tool/execute.mjs';
 import { createTurnReviewCollector } from './agent-tool/turn-review.mjs';
@@ -70,8 +71,24 @@ export function createStandaloneAgent({
   }
 
   const registry = createTagRegistry({ dataDir, cfgMod, mgr });
+  // Tasks the previous process was running died with it: tell their owners.
+  // Later sweeps also catch rows the predecessor settled as it shut down.
+  const notifyRestartFailures = createRestartFailureNotifier({
+    pendingRestartFailures: registry.pendingRestartFailures,
+    markRestartNotified: registry.markRestartNotified,
+    mgr,
+    notifySessionCompletion,
+  });
+  const sweepRestartFailures = () => {
+    registry.recoverStaleWorkerRows({ deadOnly: true });
+    notifyRestartFailures();
+  };
+  notifyRestartFailures();
   const views = createJobViews({ ...registry, mgr, reg, cfgMod, DEFAULT_SPAWN_PREP_TIMEOUT_MS });
+  // Late-bound: the send flow that wakes an idle worker is built after spawn.
+  let wakeIdleWorker = null;
   const spawnFlow = createSpawnFlow({
+    onWorkerCompletionQueued: (sessionId) => wakeIdleWorker?.(sessionId),
     ...registry,
     ...views,
     mgr,
@@ -96,6 +113,7 @@ export function createStandaloneAgent({
     views,
     spawnFlow,
   });
+  wakeIdleWorker = sendFlow.wakeIdleWorker;
   const closeFlow = createCloseFlow({ mgr, registry, views });
   const terminalTrace = createTerminalTrace({ registry });
   const execute = createAgentExecute({
@@ -116,6 +134,7 @@ export function createStandaloneAgent({
       void awaitKeychainPrewarm();
       return { workers: [], jobs: [], scope: null };
     }
+    sweepRestartFailures();
     const scopedContext = agentScope({}, context);
     const ownerSession = callerSessionForContext(scopedContext);
     const pid = terminalPidForContext(scopedContext);
@@ -134,6 +153,7 @@ export function createStandaloneAgent({
       void awaitKeychainPrewarm();
       return [];
     }
+    sweepRestartFailures();
     const scopedContext = agentScope({ recover: true }, context);
     registry.refreshTagsFromSessions({ scanSessions: true, context: scopedContext });
     return views.list({ scanSessions: false, context: scopedContext });

package/src/session-runtime/services/provider-admin.mjs

@@ -64,6 +64,15 @@ import {
   beginOAuthLogin as beginCommandCodeOAuthLogin,
   loginOAuth as loginCommandCodeOAuth,
 } from '../../runtime/agent/orchestrator/providers/command-code-oauth-login.mjs';
+import {
+  describeOpenCodeGoOAuthCredentials,
+  forgetOpenCodeGoOAuthCredentials,
+  hasOpenCodeGoOAuthCredentials,
+} from '../../runtime/agent/orchestrator/providers/opencode-go-oauth-tokens.mjs';
+import {
+  beginOAuthLogin as beginOpenCodeGoOAuthLogin,
+  loginOAuth as loginOpenCodeGoOAuth,
+} from '../../runtime/agent/orchestrator/providers/opencode-go-oauth-login.mjs';
 import {
   beginCursorOAuthLogin,
   describeCursorOAuthCredentials,
@@ -101,7 +110,6 @@ import {
 } from '../../runtime/agent/orchestrator/providers/custom-provider-config.mjs';
 
 const API_PROVIDERS = Object.freeze([
-  Object.freeze({ id: 'opencode-go', name: 'OpenCode Go API', env: 'OPENCODE_API_KEY', url: 'https://opencode.ai' }),
   Object.freeze({ id: 'openrouter', name: 'OpenRouter', env: 'OPENROUTER_API_KEY', url: 'https://openrouter.ai/keys' }),
   Object.freeze({
     id: 'openai',
@@ -176,6 +184,16 @@ const OAUTH_PROVIDERS = Object.freeze([
     begin: beginCommandCodeOAuthLogin,
     login: loginCommandCodeOAuth,
   }),
+  Object.freeze({
+    id: 'opencode-go-oauth',
+    name: 'OpenCode Go OAuth',
+    desc: 'Sign in with your OpenCode account (OpenCode Go subscription)',
+    has: hasOpenCodeGoOAuthCredentials,
+    describe: describeOpenCodeGoOAuthCredentials,
+    forget: forgetOpenCodeGoOAuthCredentials,
+    begin: beginOpenCodeGoOAuthLogin,
+    login: loginOpenCodeGoOAuth,
+  }),
   Object.freeze({
     id: 'mimo-oauth',
     name: 'MiMo',
@@ -381,7 +399,7 @@ export function isCustomProviderConfig(entry) {
   return Boolean(entry) && typeof entry === 'object' && entry.type === 'custom';
 }
 
-export function isCustomProviderId(id) {
+function isCustomProviderId(id) {
   return CUSTOM_ID_RE.test(String(id || ''));
 }
 
@@ -552,7 +570,11 @@ async function modelProxyProviderSetup(options) {
         // Signed in but switched off on the desktop.
         else if (!enabled && authState === 'present') status = 'Off';
         return {
-          id, name, group, type, enabled,
+          id,
+          name,
+          group,
+          type,
+          enabled,
           authenticated,
           usable,
           ...(group === 'local' ? { detected: enabled } : {}),
@@ -847,6 +869,10 @@ export function listProviderAccounts(provider) {
       let identity = null;
       if (typeof auth.email === 'string' && auth.email.trim()) identity = auth.email.trim();
       else if (typeof auth.accountId === 'string' && auth.accountId.trim()) identity = auth.accountId.trim();
+      // An organization-scoped login names the organization it acts for.
+      if (typeof auth.orgName === 'string' && auth.orgName.trim()) {
+        identity = identity ? `${identity} · ${auth.orgName.trim()}` : auth.orgName.trim();
+      }
       return {
         id: row.id,
         label: row.label,
@@ -1128,6 +1154,69 @@ export async function updateCustomProviderModel(cfgMod, rawId, rawModelId, patch
   return customProviderRow(id, saved);
 }
 
+const MODEL_PREFERENCE_KEYS = new Set(['model', 'hidden', 'favorite']);
+export const MODEL_PREFERENCE_CHANGES_MAX = 5_000;
+
+function modelPreferenceChanges(raw) {
+  if (!Array.isArray(raw) || raw.length > MODEL_PREFERENCE_CHANGES_MAX) {
+    throw new TypeError('model preference changes are invalid');
+  }
+  return raw.map((change) => {
+    plainPatch(change, MODEL_PREFERENCE_KEYS, 'model preference change');
+    const model = typeof change.model === 'string' ? change.model.trim() : '';
+    if (!model) throw new TypeError('model id is required');
+    for (const key of ['hidden', 'favorite']) {
+      if (change[key] !== undefined && typeof change[key] !== 'boolean') {
+        throw new TypeError(`model preference ${key} is invalid`);
+      }
+    }
+    return { model, hidden: change.hidden, favorite: change.favorite };
+  });
+}
+
+/**
+ * The model management card's save for one provider: whether each model is
+ * listed in /model (`hidden`) and whether it is a favorite. Both live in the
+ * shared per-model store `modelSettings["provider/model"]` — except a custom
+ * provider's visibility, which stays its own `modelOverrides[id].hidden`, the
+ * store its edit dialog, the runtime catalog and SSH servers already honor.
+ * `hidden: false` is an explicit choice (it also lists a model the family
+ * limit would leave out); an absent field keeps the stored value.
+ */
+export function saveModelPreferences(cfgMod, rawProvider, rawChanges) {
+  const provider = String(rawProvider || '').trim();
+  const changes = modelPreferenceChanges(rawChanges);
+  const full = cfgMod.loadConfig();
+  if (!isKnownProvider(provider, full)) throw new TypeError(`unknown provider "${provider}"`);
+  const custom = isCustomProviderId(provider);
+  const modelSettings = { ...(full.modelSettings || {}) };
+  for (const { model, hidden, favorite } of changes) {
+    const key = `${provider}/${model}`;
+    const setting = { ...(modelSettings[key] || {}) };
+    if (hidden !== undefined && !custom) setting.hidden = hidden;
+    if (favorite === true) setting.favorite = true;
+    else if (favorite === false) delete setting.favorite;
+    if (Object.keys(setting).length) modelSettings[key] = setting;
+    else delete modelSettings[key];
+  }
+  const next = { ...full, modelSettings };
+  const customHidden = custom ? changes.filter((change) => change.hidden !== undefined) : [];
+  if (customHidden.length) {
+    requireLocalProviderManagement();
+    const entry = full.providers[provider];
+    const current = normalizeStoredCustomConfig(entry);
+    const overrides = new Map(Object.entries(current.modelOverrides || {}));
+    for (const { model, hidden } of customHidden) overrides.set(model, { ...overrides.get(model), hidden });
+    const config = normalizeStoredCustomConfig({ ...current, modelOverrides: Object.fromEntries(overrides) });
+    next.providers = {
+      ...full.providers,
+      [provider]: { ...config, type: 'custom', enabled: entry.enabled !== false },
+    };
+  }
+  cfgMod.saveConfig(next, { baseConfig: full });
+  return { provider, changed: changes.length, customCatalogChanged: customHidden.length > 0 };
+}
+
 // Drops every stored model setting and route that names the provider.
 function withoutProviderReferences(config, id) {
   const next = { ...config };
@@ -1235,23 +1324,6 @@ export async function saveOpenAIUsageSessionKey(cfgMod, secret) {
   return { provider: 'openai', type: 'usage-auth', authenticated: true };
 }
 
-export async function saveOpenCodeGoUsageAuth(cfgMod, { apiKey } = {}) {
-  requireLocalProviderManagement();
-  const secret = String(apiKey || '').trim();
-  if (!secret) throw new Error('OpenCode console API key is required for usage lookup');
-  // Subscription meters are read with a console service-account key holding the
-  // `all` permission. The console accepts no other credential for them, so
-  // rejecting anything else here keeps unusable auth out of the keychain.
-  if (!/^(?:oc_sk_|sk-)/.test(secret))
-    throw new Error('OpenCode usage auth must be a console API key (oc_sk_… or sk-…) with all permissions');
-  await saveSecretAsync(SECRET_ACCOUNTS.opencodeGoConsoleKey, secret);
-  // Usage auth may be a different key from the inference key. Only flip the
-  // model provider on when a model key actually exists; otherwise usage-only
-  // setups get routed to the provider with apiKey 'no-key' and fail with 401s.
-  if (getAgentApiKey('opencode-go')) updateConfigProvider(cfgMod, 'opencode-go', { enabled: true });
-  return { provider: 'opencode-go', type: 'usage-auth', authenticated: true };
-}
-
 export async function forgetProviderAuth(cfgModOrProvider, maybeProvider, requestedAccountId) {
   requireLocalProviderManagement();
   const cfgMod = maybeProvider === undefined ? null : cfgModOrProvider;

package/src/session-runtime/services/usage-dashboard-model.mjs

@@ -242,7 +242,7 @@ function providerDescription(id, group) {
       return 'MiMo Token Plan subscription quota';
     case 'antigravity-oauth':
       return 'Antigravity subscription quota';
-    case 'opencode-go':
+    case 'opencode-go-oauth':
       return 'OpenCode Go subscription quota';
     case 'openai':
       return 'OpenAI API billing';
@@ -349,7 +349,7 @@ const PROVIDER_RANKS = {
   'mimo-oauth': 34,
   'cursor-oauth': 35,
   'antigravity-oauth': 36,
-  'opencode-go': 40,
+  'opencode-go-oauth': 38,
   openai: 50,
   anthropic: 60,
   deepseek: 70,