mixdog 1.2.5 → 1.3.0

package/src/session-runtime/services/provider-admin.mjs

@@ -64,6 +64,15 @@ import {
   beginOAuthLogin as beginCommandCodeOAuthLogin,
   loginOAuth as loginCommandCodeOAuth,
 } from '../../runtime/agent/orchestrator/providers/command-code-oauth-login.mjs';
+import {
+  describeOpenCodeGoOAuthCredentials,
+  forgetOpenCodeGoOAuthCredentials,
+  hasOpenCodeGoOAuthCredentials,
+} from '../../runtime/agent/orchestrator/providers/opencode-go-oauth-tokens.mjs';
+import {
+  beginOAuthLogin as beginOpenCodeGoOAuthLogin,
+  loginOAuth as loginOpenCodeGoOAuth,
+} from '../../runtime/agent/orchestrator/providers/opencode-go-oauth-login.mjs';
 import {
   beginCursorOAuthLogin,
   describeCursorOAuthCredentials,
@@ -101,7 +110,6 @@ import {
 } from '../../runtime/agent/orchestrator/providers/custom-provider-config.mjs';
 
 const API_PROVIDERS = Object.freeze([
-  Object.freeze({ id: 'opencode-go', name: 'OpenCode Go API', env: 'OPENCODE_API_KEY', url: 'https://opencode.ai' }),
   Object.freeze({ id: 'openrouter', name: 'OpenRouter', env: 'OPENROUTER_API_KEY', url: 'https://openrouter.ai/keys' }),
   Object.freeze({
     id: 'openai',
@@ -176,6 +184,16 @@ const OAUTH_PROVIDERS = Object.freeze([
     begin: beginCommandCodeOAuthLogin,
     login: loginCommandCodeOAuth,
   }),
+  Object.freeze({
+    id: 'opencode-go-oauth',
+    name: 'OpenCode Go OAuth',
+    desc: 'Sign in with your OpenCode account (OpenCode Go subscription)',
+    has: hasOpenCodeGoOAuthCredentials,
+    describe: describeOpenCodeGoOAuthCredentials,
+    forget: forgetOpenCodeGoOAuthCredentials,
+    begin: beginOpenCodeGoOAuthLogin,
+    login: loginOpenCodeGoOAuth,
+  }),
   Object.freeze({
     id: 'mimo-oauth',
     name: 'MiMo',
@@ -349,6 +367,7 @@ function oauthAuthFields(p, auth) {
     status: auth.status || (authenticated ? 'Set' : 'Not Set'),
     detail: auth.detail || p.desc,
     expiresAt: auth.expiresAt || null,
+    plan: auth.plan || null,
     usable: auth.usable === true || (auth.usable == null && authenticated),
     refreshable: auth.refreshable === true,
     reauthRequired: auth.reauthRequired === true,
@@ -381,7 +400,7 @@ export function isCustomProviderConfig(entry) {
   return Boolean(entry) && typeof entry === 'object' && entry.type === 'custom';
 }
 
-export function isCustomProviderId(id) {
+function isCustomProviderId(id) {
   return CUSTOM_ID_RE.test(String(id || ''));
 }
 
@@ -552,7 +571,11 @@ async function modelProxyProviderSetup(options) {
         // Signed in but switched off on the desktop.
         else if (!enabled && authState === 'present') status = 'Off';
         return {
-          id, name, group, type, enabled,
+          id,
+          name,
+          group,
+          type,
+          enabled,
           authenticated,
           usable,
           ...(group === 'local' ? { detected: enabled } : {}),
@@ -847,6 +870,10 @@ export function listProviderAccounts(provider) {
       let identity = null;
       if (typeof auth.email === 'string' && auth.email.trim()) identity = auth.email.trim();
       else if (typeof auth.accountId === 'string' && auth.accountId.trim()) identity = auth.accountId.trim();
+      // An organization-scoped login names the organization it acts for.
+      if (typeof auth.orgName === 'string' && auth.orgName.trim()) {
+        identity = identity ? `${identity} · ${auth.orgName.trim()}` : auth.orgName.trim();
+      }
       return {
         id: row.id,
         label: row.label,
@@ -932,8 +959,8 @@ async function withTimeout(run, ms, label) {
   }
 }
 
-function existingCustomEntry(cfgMod, id) {
-  const entry = cfgMod.loadConfig().providers?.[id];
+function existingCustomEntry(config, id) {
+  const entry = config.providers?.[id];
   if (!isCustomProviderId(id) || !isCustomProviderConfig(entry)) throw new Error(`unknown custom provider "${id}"`);
   return entry;
 }
@@ -995,16 +1022,15 @@ function withStoredSettings(input, entry) {
   return out;
 }
 
-// Validated, secret-free config for `input`; the key (typed, else stored for an
-// existing provider) is resolved separately and never enters the config.
-async function resolveCustomInput(cfgMod, rawInput, options) {
-  let input = inputObject(rawInput);
-  validateCustomTransportFields(input);
+// Validated, secret-free config for `input` over one config snapshot (the
+// stored entry supplies an edit's omitted settings); the key (typed, else
+// stored for an existing provider) is resolved separately and never enters
+// the config. Synchronous, so a caller can merge and commit one snapshot.
+function customInputAt(snapshot, input, normalizeCustomProviderConfig, options) {
   const id = input.id === undefined ? null : input.id;
-  if (id) input = withStoredSettings(input, existingCustomEntry(cfgMod, id));
-  const { normalizeCustomProviderConfig } = await loadCustomProviderModule();
-  const config = normalizeCustomProviderConfig(input, options);
-  const typed = typeof input.apiKey === 'string' ? input.apiKey.trim() : '';
+  const merged = id ? withStoredSettings(input, existingCustomEntry(snapshot, id)) : input;
+  const config = normalizeCustomProviderConfig(merged, options);
+  const typed = typeof merged.apiKey === 'string' ? merged.apiKey.trim() : '';
   const keyless = config.auth === 'none';
   const envName = keyless ? '' : config.apiKeyEnv || '';
   let apiKey = '';
@@ -1013,36 +1039,71 @@ async function resolveCustomInput(cfgMod, rawInput, options) {
   return { id, config, typed: keyless || envName ? '' : typed, apiKey, keyless, envName };
 }
 
+async function resolveCustomInput(cfgMod, rawInput, options) {
+  const input = inputObject(rawInput);
+  validateCustomTransportFields(input);
+  const { normalizeCustomProviderConfig } = await loadCustomProviderModule();
+  return customInputAt(cfgMod.loadConfig(), input, normalizeCustomProviderConfig, options);
+}
+
+function requireCustomKey({ apiKey, keyless, envName }) {
+  if (!keyless && !envName && !apiKey) throw new Error('API key is required');
+}
+
+// One key transaction per provider, from reading the rollback key to the
+// config commit or rollback: a failed save restores the key the preceding
+// save committed and never one a newer save wrote. Settings-only saves and
+// other providers never wait.
+const customKeySaves = new Map();
+
+function serializeCustomKeySave(id, run) {
+  const result = (customKeySaves.get(id) || Promise.resolve()).then(run);
+  const settled = result.then(
+    () => {},
+    () => {}
+  );
+  customKeySaves.set(id, settled);
+  settled.then(() => {
+    if (customKeySaves.get(id) === settled) customKeySaves.delete(id);
+  });
+  return result;
+}
+
 export async function saveCustomProvider(cfgMod, rawInput) {
   requireLocalProviderManagement();
-  const {
-    id: existingId,
-    config,
-    typed,
-    apiKey,
-    keyless,
-    envName,
-  } = await resolveCustomInput(cfgMod, rawInput, { requireModels: false });
-  if (!keyless && !envName && !apiKey) throw new Error('API key is required');
+  // Early verdict: an invalid save never touches the keychain.
+  const resolved = await resolveCustomInput(cfgMod, rawInput, { requireModels: false });
+  requireCustomKey(resolved);
+  const { id: existingId, typed } = resolved;
   const id = existingId || `custom-${randomUUID()}`;
-  const entry = { ...config, type: 'custom', enabled: config.enabled !== false };
-  const account = SECRET_ACCOUNTS.agentApiKey(id);
-  const previousKey = typed && existingId ? getAgentApiKey(id) : null;
-  if (typed) await saveSecretAsync(account, typed);
-  try {
-    const current = cfgMod.loadConfig();
-    cfgMod.saveConfig(
-      { ...current, providers: { ...(current.providers || {}), [id]: entry } },
-      { baseConfig: current }
-    );
-  } catch (error) {
-    if (typed) {
-      if (previousKey) await saveSecretAsync(account, previousKey);
-      else await deleteSecretAsync(account);
+  const { normalizeCustomProviderConfig } = await loadCustomProviderModule();
+  const commit = async () => {
+    const account = SECRET_ACCOUNTS.agentApiKey(id);
+    const previousKey = typed && existingId ? getAgentApiKey(id) : null;
+    if (typed) await saveSecretAsync(account, typed);
+    let entry;
+    try {
+      // Synchronous from here: omitted settings come from the config this
+      // save commits over, so an edit that landed during the awaits above (a
+      // model's visibility, a peer save, a removal) is never reverted.
+      const current = cfgMod.loadConfig();
+      const latest = customInputAt(current, rawInput, normalizeCustomProviderConfig, { requireModels: false });
+      requireCustomKey(latest);
+      entry = { ...latest.config, type: 'custom', enabled: latest.config.enabled !== false };
+      cfgMod.saveConfig(
+        { ...current, providers: { ...(current.providers || {}), [id]: entry } },
+        { baseConfig: current }
+      );
+    } catch (error) {
+      if (typed) {
+        if (previousKey) await saveSecretAsync(account, previousKey);
+        else await deleteSecretAsync(account);
+      }
+      throw error;
     }
-    throw error;
-  }
-  return customProviderRow(id, entry);
+    return customProviderRow(id, entry);
+  };
+  return typed ? serializeCustomKeySave(id, commit) : commit();
 }
 
 const MODEL_PATCH_KEYS = new Set(['manual', 'hidden', 'name', 'contextWindow', 'maxOutputTokens', 'reasoning']);
@@ -1078,7 +1139,7 @@ export async function updateCustomProviderModel(cfgMod, rawId, rawModelId, patch
   // Everything below is synchronous: the provider is read, patched and saved
   // without yielding, so a concurrent update can never be overwritten by a
   // provider object read before the await above.
-  const entry = existingCustomEntry(cfgMod, id);
+  const entry = existingCustomEntry(cfgMod.loadConfig(), id);
   const current = normalizeCustomProviderConfig(entry, { requireModels: false });
   const overrides = new Map(Object.entries(current.modelOverrides || {}));
   if (patch === null) {
@@ -1128,6 +1189,69 @@ export async function updateCustomProviderModel(cfgMod, rawId, rawModelId, patch
   return customProviderRow(id, saved);
 }
 
+const MODEL_PREFERENCE_KEYS = new Set(['model', 'hidden', 'favorite']);
+export const MODEL_PREFERENCE_CHANGES_MAX = 5_000;
+
+function modelPreferenceChanges(raw) {
+  if (!Array.isArray(raw) || raw.length > MODEL_PREFERENCE_CHANGES_MAX) {
+    throw new TypeError('model preference changes are invalid');
+  }
+  return raw.map((change) => {
+    plainPatch(change, MODEL_PREFERENCE_KEYS, 'model preference change');
+    const model = typeof change.model === 'string' ? change.model.trim() : '';
+    if (!model) throw new TypeError('model id is required');
+    for (const key of ['hidden', 'favorite']) {
+      if (change[key] !== undefined && typeof change[key] !== 'boolean') {
+        throw new TypeError(`model preference ${key} is invalid`);
+      }
+    }
+    return { model, hidden: change.hidden, favorite: change.favorite };
+  });
+}
+
+/**
+ * The model management card's save for one provider: whether each model is
+ * listed in /model (`hidden`) and whether it is a favorite. Both live in the
+ * shared per-model store `modelSettings["provider/model"]` — except a custom
+ * provider's visibility, which stays its own `modelOverrides[id].hidden`, the
+ * store its edit dialog, the runtime catalog and SSH servers already honor.
+ * `hidden: false` is an explicit choice (it also lists a model the family
+ * limit would leave out); an absent field keeps the stored value.
+ */
+export function saveModelPreferences(cfgMod, rawProvider, rawChanges) {
+  const provider = String(rawProvider || '').trim();
+  const changes = modelPreferenceChanges(rawChanges);
+  const full = cfgMod.loadConfig();
+  if (!isKnownProvider(provider, full)) throw new TypeError(`unknown provider "${provider}"`);
+  const custom = isCustomProviderId(provider);
+  const modelSettings = { ...(full.modelSettings || {}) };
+  for (const { model, hidden, favorite } of changes) {
+    const key = `${provider}/${model}`;
+    const setting = { ...(modelSettings[key] || {}) };
+    if (hidden !== undefined && !custom) setting.hidden = hidden;
+    if (favorite === true) setting.favorite = true;
+    else if (favorite === false) delete setting.favorite;
+    if (Object.keys(setting).length) modelSettings[key] = setting;
+    else delete modelSettings[key];
+  }
+  const next = { ...full, modelSettings };
+  const customHidden = custom ? changes.filter((change) => change.hidden !== undefined) : [];
+  if (customHidden.length) {
+    requireLocalProviderManagement();
+    const entry = full.providers[provider];
+    const current = normalizeStoredCustomConfig(entry);
+    const overrides = new Map(Object.entries(current.modelOverrides || {}));
+    for (const { model, hidden } of customHidden) overrides.set(model, { ...overrides.get(model), hidden });
+    const config = normalizeStoredCustomConfig({ ...current, modelOverrides: Object.fromEntries(overrides) });
+    next.providers = {
+      ...full.providers,
+      [provider]: { ...config, type: 'custom', enabled: entry.enabled !== false },
+    };
+  }
+  cfgMod.saveConfig(next, { baseConfig: full });
+  return { provider, changed: changes.length, customCatalogChanged: customHidden.length > 0 };
+}
+
 // Drops every stored model setting and route that names the provider.
 function withoutProviderReferences(config, id) {
   const next = { ...config };
@@ -1152,7 +1276,7 @@ function withoutProviderReferences(config, id) {
 export async function removeCustomProvider(cfgMod, rawId) {
   requireLocalProviderManagement();
   const id = String(rawId || '').trim();
-  existingCustomEntry(cfgMod, id);
+  existingCustomEntry(cfgMod.loadConfig(), id);
   // Secret first: a real keychain failure (locked, permission) leaves the
   // provider registered so the removal can be retried. A missing secret
   // (keyless provider) is not an error.
@@ -1235,23 +1359,6 @@ export async function saveOpenAIUsageSessionKey(cfgMod, secret) {
   return { provider: 'openai', type: 'usage-auth', authenticated: true };
 }
 
-export async function saveOpenCodeGoUsageAuth(cfgMod, { apiKey } = {}) {
-  requireLocalProviderManagement();
-  const secret = String(apiKey || '').trim();
-  if (!secret) throw new Error('OpenCode console API key is required for usage lookup');
-  // Subscription meters are read with a console service-account key holding the
-  // `all` permission. The console accepts no other credential for them, so
-  // rejecting anything else here keeps unusable auth out of the keychain.
-  if (!/^(?:oc_sk_|sk-)/.test(secret))
-    throw new Error('OpenCode usage auth must be a console API key (oc_sk_… or sk-…) with all permissions');
-  await saveSecretAsync(SECRET_ACCOUNTS.opencodeGoConsoleKey, secret);
-  // Usage auth may be a different key from the inference key. Only flip the
-  // model provider on when a model key actually exists; otherwise usage-only
-  // setups get routed to the provider with apiKey 'no-key' and fail with 401s.
-  if (getAgentApiKey('opencode-go')) updateConfigProvider(cfgMod, 'opencode-go', { enabled: true });
-  return { provider: 'opencode-go', type: 'usage-auth', authenticated: true };
-}
-
 export async function forgetProviderAuth(cfgModOrProvider, maybeProvider, requestedAccountId) {
   requireLocalProviderManagement();
   const cfgMod = maybeProvider === undefined ? null : cfgModOrProvider;

package/src/session-runtime/services/schedule-access.mjs

@@ -0,0 +1,91 @@
+// Who may manage automations (schedules and webhooks) from a chat, by the
+// calling session's provenance. Enforced by every setup automation action
+// (setup-tool/extended-actions.mjs), the chat-facing door of channel-admin:
+// - the human's own sessions (an ordinary Lead session, Mixy's home) manage
+//   every automation and may move one to an agent that exists;
+// - another agent's home thread manages only the automations it owns and can
+//   never give one away;
+// - a headless run (schedule, webhook, delegated agent, or a session that
+//   cannot be resolved) manages none — nor does it change any other setting
+//   (setup-tool/executor.mjs refuses every mutating setup action for it).
+// - a group-room member session is no background run, but it speaks for the
+//   room, not for the user: it creates or changes no agent, automation or
+//   other setting either.
+// The app's own panels call channel-admin directly and act for the human.
+import { MIXY_AGENT_ID, agentIdOfHomeSession } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
+import { roomMemberOfSession } from '../../runtime/agent/orchestrator/session/agent-room.mjs';
+import { mixyDisplayName } from '../../runtime/agent/orchestrator/session/mixy-name.mjs';
+import { isAgentOwner } from '../../runtime/agent/orchestrator/agent-owner.mjs';
+
+const INTERACTIVE_SOURCE_TYPES = new Set(['', 'lead', 'cli']);
+
+/** `{ kind: 'human' | 'agent' | 'room-member' | 'headless', agentId? }` of a session record. */
+export function scheduleCallerScope(session) {
+  const id = String(session?.id || '');
+  const member = roomMemberOfSession(id);
+  if (member) return { kind: 'room-member', agentId: member.agentId };
+  const homeAgent = agentIdOfHomeSession(id);
+  if (homeAgent) return homeAgent === MIXY_AGENT_ID ? { kind: 'human' } : { kind: 'agent', agentId: homeAgent };
+  const headless =
+    !id ||
+    isAgentOwner(session) ||
+    Boolean(session.parentSessionId) ||
+    Boolean(session.ownerSessionId && session.ownerSessionId !== id) ||
+    !INTERACTIVE_SOURCE_TYPES.has(String(session.sourceType || '').toLowerCase());
+  return headless ? { kind: 'headless' } : { kind: 'human' };
+}
+
+/** Throws unless `scope` may `action` the `kind` ('schedule' | 'webhook')
+ *  automation `current` (null when creating) with `owner` the requested owner
+ *  ('' keeps the saved one). `agentIds` are the agents a transfer may name;
+ *  Mixy always counts. */
+export function assertAutomationAccess(
+  scope,
+  { kind = 'schedule', action, current = null, owner = '', agentIds = [] }
+) {
+  if (scope?.kind === 'room-member') throw new Error(`A group-room member cannot ${action} ${kind}s`);
+  if (scope?.kind !== 'human' && scope?.kind !== 'agent') {
+    throw new Error(`A background run cannot ${action} ${kind}s`);
+  }
+  const requested = String(owner ?? '').trim();
+  const saved = current ? current.owner || MIXY_AGENT_ID : '';
+  if (scope.kind === 'agent') {
+    if (current && saved !== scope.agentId) {
+      throw new Error(
+        `${kind === 'webhook' ? 'Webhook' : 'Schedule'} "${current.name}" belongs to another agent; this thread manages only its own ${kind}s`
+      );
+    }
+    if (requested && requested !== scope.agentId) throw new Error(`This thread cannot give a ${kind} to another agent`);
+    return;
+  }
+  if (requested && requested !== saved && requested !== MIXY_AGENT_ID && !agentIds.includes(requested)) {
+    throw new Error(`Agent "${requested}" does not exist`);
+  }
+}
+
+/** Throws unless `caller` (scope `scope`) is Mixy — its home thread or an
+ *  ordinary Lead session acting as 'lead': only Mixy creates, edits or
+ *  deletes agent definitions from a chat. The app's own panels call the agent
+ *  editor directly and act for the human. */
+export function assertAgentEditorAccess(scope, caller, action) {
+  const acting = String(caller?.agent || '').trim();
+  if (scope?.kind === 'human' && (!acting || acting === MIXY_AGENT_ID)) return;
+  const name = mixyDisplayName();
+  throw new Error(
+    `Only ${name} (the representative agent) can create, edit or delete agents (setup ${action}); ask the user to do it with ${name} or in the Agents settings`
+  );
+}
+
+/** Throws when an agent's home thread changes another agent's settings. */
+export function assertOwnAgentSettings(scope, agentId, action) {
+  if (scope?.kind === 'agent' && String(agentId || '').trim() !== scope.agentId) {
+    throw new Error(`This thread manages only its own agent's settings (setup ${action})`);
+  }
+}
+
+/** Throws when `scope` is a headless run: it reads settings, never changes them. */
+export function assertInteractiveCaller(scope, action) {
+  if (scope?.kind === 'human' || scope?.kind === 'agent') return;
+  if (scope?.kind === 'room-member') throw new Error(`A group-room member cannot change settings (setup ${action})`);
+  throw new Error(`A background run cannot change settings (setup ${action})`);
+}

package/src/session-runtime/services/usage-dashboard-model.mjs

@@ -242,7 +242,7 @@ function providerDescription(id, group) {
       return 'MiMo Token Plan subscription quota';
     case 'antigravity-oauth':
       return 'Antigravity subscription quota';
-    case 'opencode-go':
+    case 'opencode-go-oauth':
       return 'OpenCode Go subscription quota';
     case 'openai':
       return 'OpenAI API billing';
@@ -349,7 +349,7 @@ const PROVIDER_RANKS = {
   'mimo-oauth': 34,
   'cursor-oauth': 35,
   'antigravity-oauth': 36,
-  'opencode-go': 40,
+  'opencode-go-oauth': 38,
   openai: 50,
   anthropic: 60,
   deepseek: 70,

package/src/session-runtime/services/usage-dashboard.mjs

@@ -2,11 +2,6 @@ import {
   fetchOAuthUsageSnapshot,
   readCachedOAuthUsageSnapshot,
 } from '../../runtime/agent/orchestrator/providers/oauth-usage.mjs';
-import {
-  fetchOpenCodeGoUsageSnapshot,
-  openCodeGoUsageConfigStatus,
-  readCachedOpenCodeGoUsageSnapshot,
-} from '../../runtime/agent/orchestrator/providers/opencode-go-usage.mjs';
 import {
   fetchApiUsageSnapshot,
   readCachedApiUsageSnapshot,
@@ -118,69 +113,32 @@ async function apiProviderRow(item, { config, providers, preview, refreshFor, sn
   if (row.authenticated) {
     let hasQuota = false;
     let apiUsageSnapshot = null;
-    if (item.id === 'opencode-go') {
-      const usageStatus = openCodeGoUsageConfigStatus(config);
-      try {
-        let snapshot = null;
-        if (refreshFor(item.id)) snapshot = await fetchOpenCodeGoUsageSnapshot(config, { force: true });
-        else snapshot = readCachedOpenCodeGoUsageSnapshot();
-        if (!snapshot && !refreshFor(item.id) && usageStatus.ready) {
-          snapshot = await fetchOpenCodeGoUsageSnapshot(config);
-        }
-        if (snapshot) {
-          hasQuota = applyWindowQuota(row, snapshot?.quotaWindows, {
-            source: 'opencode-go-console',
-            detail: 'subscription quota',
-          });
-          row.updatedAt = num(snapshot?.cachedAt, null);
-        } else {
-          row.status = 'missing';
-          row.source = 'usage-auth-missing';
-          row.sourceLabel = 'usage auth';
-          row.primary = '';
-          row.detail = usageStatus.ready
-            ? 'OpenCode Go usage not found'
-            : 'Set an OpenCode console API key (all permissions) for usage';
-        }
-      } catch (err) {
-        if (String(err?.code || '').startsWith('OPENCODE_GO_USAGE_')) {
-          row.status = 'missing';
-          row.source = 'usage-auth-missing';
-          row.sourceLabel = 'usage auth';
-          row.primary = '';
-          row.detail = usageStatus.ready
-            ? 'OpenCode Go usage not found'
-            : 'Set an OpenCode console API key (all permissions) for usage';
-        }
-      }
-    } else {
-      const snapshot = await apiSnapshot(item.id, snapshotOptions(item.id));
-      apiUsageSnapshot = snapshot;
-      const known = snapshotRemaining(snapshot);
-      const usage = snapshotUsage(snapshot);
-      const tokenUsage = snapshotTokenUsage(snapshot);
-      const windows = normaliseWindows(snapshot?.quotaWindows, clean(snapshot?.source) || 'provider-api');
-      const estimated = localBudget(providerCfg);
-      row.updatedAt = num(snapshot?.cachedAt, null);
-      if (known) {
-        applyKnownRemaining(row, known, { estimated: false });
-        row.sourceLabel = 'API';
-        hasQuota = true;
-      } else if (windows.length) {
-        hasQuota = applyWindowQuota(row, windows, {
-          source: clean(snapshot?.source) || 'provider-api',
-          detail: 'provider quota',
-        });
-      } else if (estimated) {
-        applyKnownRemaining(row, estimated, { estimated: true });
-        hasQuota = true;
-      } else if (usage) {
-        applyKnownUsage(row, usage);
-        hasQuota = true;
-      } else if (tokenUsage) {
-        applyTokenUsage(row, tokenUsage);
-        hasQuota = true;
-      }
+    const snapshot = await apiSnapshot(item.id, snapshotOptions(item.id));
+    apiUsageSnapshot = snapshot;
+    const known = snapshotRemaining(snapshot);
+    const usage = snapshotUsage(snapshot);
+    const tokenUsage = snapshotTokenUsage(snapshot);
+    const windows = normaliseWindows(snapshot?.quotaWindows, clean(snapshot?.source) || 'provider-api');
+    const estimated = localBudget(providerCfg);
+    row.updatedAt = num(snapshot?.cachedAt, null);
+    if (known) {
+      applyKnownRemaining(row, known, { estimated: false });
+      row.sourceLabel = 'API';
+      hasQuota = true;
+    } else if (windows.length) {
+      hasQuota = applyWindowQuota(row, windows, {
+        source: clean(snapshot?.source) || 'provider-api',
+        detail: 'provider quota',
+      });
+    } else if (estimated) {
+      applyKnownRemaining(row, estimated, { estimated: true });
+      hasQuota = true;
+    } else if (usage) {
+      applyKnownUsage(row, usage);
+      hasQuota = true;
+    } else if (tokenUsage) {
+      applyTokenUsage(row, tokenUsage);
+      hasQuota = true;
     }
     if (!row.includeInTotal && !hasQuota) {
       const estimated = localBudget(providerCfg);
@@ -189,7 +147,7 @@ async function apiProviderRow(item, { config, providers, preview, refreshFor, sn
         hasQuota = true;
       }
     }
-    if (item.id !== 'opencode-go' && !row.includeInTotal && !hasQuota) {
+    if (!row.includeInTotal && !hasQuota) {
       applyApiUnavailable(row, item.id, apiUsageSnapshot);
     }
   }

package/src/session-runtime/session-create/session-options.mjs

@@ -2,11 +2,14 @@
 // the current runtime state: route, tool spec, ownership/lane, workflow pack,
 // memory context and compaction.
 import { normalizeCompactionConfig } from '../../runtime/agent/orchestrator/runtime-core/config-helpers.mjs';
-import { hasOwn } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
+import { clean, hasOwn } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { toolSpecForMode } from '../../runtime/agent/orchestrator/runtime-core/effort.mjs';
-import { pluginDataDir } from '../runtime-paths.mjs';
+import { STANDALONE_ROOT, pluginDataDir } from '../runtime-paths.mjs';
+import { readAgentFrontmatterPermission } from '../services/agent-tool/helpers.mjs';
 import { LEAD_DISALLOWED_TOOLS } from '../../runtime/agent/orchestrator/runtime-core/tool-defs.mjs';
 import { HEADLESS_TOOL_PROFILE } from '../../runtime/agent/orchestrator/runtime-core/tool-profile.mjs';
+import { AGENT_MODE, resolveSessionMode } from '../../runtime/agent/orchestrator/session/agent-mode.mjs';
+import { MIXY_AGENT_ID } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
 
 // Ownership and permission fields an agent-owned session inherits from its profile.
 function agentOwnedSessionFields(sessionProfile) {
@@ -31,14 +34,30 @@ export function sessionOptions(deps, coreMemoryContext) {
   // Load the active WORKFLOW.md pack once for both summary + context block.
   const {
     summary: workflow,
-    context: leadWorkflowContext,
+    leadPromptParts,
     packContext,
     orchestrationMode,
   } = activeWorkflowContext(rt.config, dataDir);
   const sessionProfile = rt.sessionProfile && typeof rt.sessionProfile === 'object' ? rt.sessionProfile : null;
   const agentOwned = sessionProfile?.owner === 'agent' || sessionProfile?.visibility === 'agent-only';
-  // Agent-owned sessions keep the Active Workflow block only.
-  const workflowContext = agentOwned ? packContext : leadWorkflowContext;
+  // Agent or coding mode, from the one resolver (agent-mode.mjs).
+  const { mode: sessionMode, agentId: actingAgent } = resolveSessionMode({
+    sessionId: rt.reservedSessionId,
+    profile: sessionProfile,
+  });
+  // An agent's home thread: a user conversation that runs AS that agent (its
+  // AGENT.md role and permission); route comes with the create call.
+  const homeAgent = agentOwned ? '' : clean(sessionProfile?.homeAgent);
+  const homePermission = homeAgent ? readAgentFrontmatterPermission(homeAgent, dataDir, STANDALONE_ROOT) : null;
+  // A coding task session an agent created (session create): the user's own
+  // Lead, tagged with its origin; `sourceName` lets the Agents list file it.
+  const taskOrigin = agentOwned ? null : sessionProfile?.taskOrigin || null;
+  // Every session leads BP3 with the Active Workflow block; a Lead adds its
+  // orchestration and catalog slices (coding, agent mode or Mixy's).
+  const workflowContext = packContext;
+  const leadWorkflowParts = agentOwned
+    ? undefined
+    : leadPromptParts({ agentMode: sessionMode === AGENT_MODE, mixy: actingAgent === MIXY_AGENT_ID });
   const callerDisallowedTools = [
     ...(agentOwned ? [] : LEAD_DISALLOWED_TOOLS),
     ...(!agentOwned && rt.disallowDelegation ? ['agent'] : []),
@@ -51,7 +70,8 @@ export function sessionOptions(deps, coreMemoryContext) {
     tools: toolSpecForMode(rt.mode),
     ...(Array.isArray(schemaAllowedTools) ? { schemaAllowedTools } : {}),
     owner: agentOwned ? 'agent' : 'cli',
-    agent: agentOwned ? sessionProfile?.agent || 'worker' : 'lead',
+    agent: agentOwned ? sessionProfile?.agent || 'worker' : homeAgent || 'lead',
+    ...(homePermission ? { permission: homePermission } : {}),
     lane: agentOwned ? 'agent' : 'cli',
     // One-shot `mixdog exec` runs carry their own source so session catalogs
     // can keep them out of the user's resumable list.
@@ -60,7 +80,12 @@ export function sessionOptions(deps, coreMemoryContext) {
       : rt.toolProfile === HEADLESS_TOOL_PROFILE
         ? 'exec'
         : 'lead',
-    sourceName: agentOwned ? sessionProfile?.sourceName || sessionProfile?.agent || 'agent' : 'main',
+    sourceName: agentOwned
+      ? sessionProfile?.sourceName || sessionProfile?.agent || 'agent'
+      : taskOrigin
+        ? `agent:${taskOrigin.agentId}`
+        : 'main',
+    ...(taskOrigin ? { taskOrigin } : {}),
     ...(rt.approvalMode ? { approvalMode: rt.approvalMode } : {}),
     clientHostPid: sessionProfile?.clientHostPid || process.pid,
     mcpScopeId: rt.mcpScopeId,
@@ -71,6 +96,8 @@ export function sessionOptions(deps, coreMemoryContext) {
     coreMemoryContext,
     workflow,
     workflowContext,
+    ...(leadWorkflowParts ? { leadWorkflowParts } : {}),
+    sessionMode,
     orchestrationMode,
     fast: rt.route.fast === true,
     autoEffort: rt.route.autoEffort !== false,