mixdog 1.4.0 → 1.4.2

package/src/session-runtime/internal-tool-executor/workspace-tools.mjs

@@ -17,6 +17,7 @@ import { scheduleCallerScope } from '../services/schedule-access.mjs';
 import { worktreeCallerScope } from '../services/worktree-access.mjs';
 import { resolveHandoffAttachments, sessionRoots } from '../handoff-attachments.mjs';
 import { delegationChainOf } from '../bot-chain.mjs';
+import { BOT_TARGET_ACTIONS, resolveBotTarget } from '../bot-target.mjs';
 
 const USER_TITLE_ERROR = 'session: the user already titled this session; the title was not changed';
 
@@ -41,6 +42,140 @@ function callerAttachmentParts(rt, args, callerCwd, surface) {
   }).parts;
 }
 
+/** `session` actions that act on another session through session control
+ *  (list, bots, read, send, cancel, delete, create, status of a target). */
+async function runSessionControl(
+  { rt, executeSessionControl, listBots, getSessionManager },
+  args,
+  { action, target, callerSessionId, callerCwd }
+) {
+  // `callerAgentId`: the bot whose conversation gets results reported
+  // back; `callerBotId`: the bot the caller acts as, attended or not,
+  // for what only a bot's own sessions allow (an effort change).
+  const callerAgentId = attendedAgentOf(rt.session);
+  const acting = resolveSessionMode({ session: rt.session });
+  const callerBotId = acting.mode === AGENT_MODE ? acting.agentId : '';
+  if (action === 'create' && !callerAgentId) {
+    throw new Error(
+      'session: create belongs to a bot conversation; delegated workers, agent task sessions and schedule/webhook runs cannot create agent task sessions'
+    );
+  }
+  // A bot id names that bot's home chat; every check below and in the
+  // control runs on the chat it resolves to.
+  const sessionTarget = BOT_TARGET_ACTIONS.has(action) && target ? await resolveBotTarget(target, listBots) : target;
+  // A task session reaches its agent only through its reported result.
+  const origin = rt.session?.taskOrigin;
+  if (
+    action === 'send' &&
+    origin &&
+    (sessionTarget === origin.sessionId || agentIdOfHomeSession(sessionTarget) === origin.agentId)
+  ) {
+    throw new Error('session: a task session reports to its agent only through its result');
+  }
+  if (typeof executeSessionControl !== 'function') {
+    throw new Error('session: cross-session control is unavailable in this runtime');
+  }
+  const { attachments, ...rest } = args || {};
+  if (attachments !== undefined && action !== 'send' && action !== 'create') {
+    throw new Error(`session: attachments apply to send and create, not action=${action}`);
+  }
+  const attachmentParts = callerAttachmentParts(rt, args, callerCwd, 'session');
+  return JSON.stringify(
+    await executeSessionControl(
+      { ...rest, action, ...(sessionTarget !== target ? { session_id: sessionTarget } : {}) },
+      {
+        callerSessionId,
+        callerAgentId,
+        callerBotId,
+        callerCwd,
+        ...(action === 'send' || action === 'create'
+          ? {
+              callerHop: turnHopOf(rt.session),
+              // The bot chain this turn acts in (bot-chain.mjs), checked
+              // against the target and carried to the turn it starts —
+              // only when the sender is a bot conversation (a bot's chat,
+              // room seat or run); any other session hands work to any
+              // bot as before, whatever started its turn (the hop limit
+              // still bounds a loop).
+              callerBotChain: callerBotId
+                ? delegationChainOf(callerSessionId, (id) =>
+                    id === rt.session?.id ? rt.session : getSessionManager()?.getSession?.(id) || null
+                  )
+                : [],
+            }
+          : {}),
+        // Whether a create may provision a worktree (worktree-access.mjs).
+        ...(action === 'create' ? { callerScope: worktreeCallerScope(rt.session) } : {}),
+        // Which bots and sessions it may see (bot-status.mjs).
+        ...(action === 'bots' || action === 'list' ? { callerScope: scheduleCallerScope(rt.session) } : {}),
+        ...(attachmentParts.length ? { attachmentParts } : {}),
+      }
+    )
+  );
+}
+
+/** `session action=rename`: the AI title of the Lead session, mirrored onto the live session. */
+async function renameSession({ rt, getSessionManager }, action, sessionId, args) {
+  if (rt.config?.aiSessionTitles === false) throw new Error('session: AI session titles are disabled in settings');
+  const title = clean(args?.title);
+  if (!title) throw new Error('session: title is required for action=rename');
+  const result = await getSessionManager()?.updateSessionAiTitle(sessionId, title);
+  if (!result?.ok) {
+    throw new Error(
+      result?.reason === 'user-title' ? USER_TITLE_ERROR : `session: rename failed (${result?.reason || 'unavailable'})`
+    );
+  }
+  // Mirror the store's truth onto the live session, never the AI title
+  // itself: a manual rename that landed while the save was awaited wins.
+  const stored = getSessionManager()?.getSession?.(sessionId);
+  if (stored && rt.session?.id === sessionId && stored !== rt.session) {
+    rt.session.title = stored.title;
+    rt.session.titleLocked = stored.titleLocked;
+    rt.session.titleSource = stored.titleSource;
+    rt.session.titleUpdatedAt = stored.titleUpdatedAt;
+  }
+  if (stored && stored.titleSource === 'user') throw new Error(USER_TITLE_ERROR);
+  return JSON.stringify({ action, sessionId, title: result.title }, null, 2);
+}
+
+/** `session action=fork`: inherit the Lead session into a new one. */
+async function forkSession(getLifecycleApi, action, sessionId, args) {
+  const lifecycle = getLifecycleApi();
+  if (typeof lifecycle?.inheritToNewSession !== 'function') {
+    throw new Error('session: fork is unavailable in this runtime');
+  }
+  const result = await lifecycle.inheritToNewSession(sessionId, {
+    compact: args?.compact === true,
+    titleSuffix: ' (Fork)',
+  });
+  return JSON.stringify(
+    { action, sourceSessionId: sessionId, sessionId: result.sessionId, compacted: result.compacted === true },
+    null,
+    2
+  );
+}
+
+/** `session action=status`: the current session's identity, folder and route. */
+function sessionStatusJson(rt, callerCtx, currentCwd) {
+  const current = rt.session;
+  return JSON.stringify(
+    {
+      sessionId: callerCtx?.callerSessionId || current?.id || null,
+      title: current?.title || null,
+      titleSource: current?.titleSource || null,
+      cwd: currentCwd,
+      project: current?.workspace?.projectPath || current?.desktopSession?.projectPath || currentCwd,
+      provider: current?.provider || null,
+      model: current?.model || null,
+      effort: current?.effort || null,
+      autoEffort: current?.autoEffort !== false,
+      fast: current?.fast === true,
+    },
+    null,
+    2
+  );
+}
+
 export function createWorkspaceToolHandlers({
   rt,
   goalRuntime,
@@ -50,6 +185,7 @@ export function createWorkspaceToolHandlers({
   getSessionManager = () => null,
   getLifecycleApi = () => null,
   executeSessionControl = null,
+  listBots,
 }) {
   const assertLead = (action, callerCtx) => {
     const callerSessionId = callerCtx?.callerSessionId || rt.session?.id || null;
@@ -99,66 +235,12 @@ export function createWorkspaceToolHandlers({
       (action === 'status' && target)
     ) {
       const callerSessionId = assertLead(action, callerCtx);
-      // `callerAgentId`: the bot whose conversation gets results reported
-      // back; `callerBotId`: the bot the caller acts as, attended or not,
-      // for what only a bot's own sessions allow (an effort change).
-      const callerAgentId = attendedAgentOf(rt.session);
-      const acting = resolveSessionMode({ session: rt.session });
-      const callerBotId = acting.mode === AGENT_MODE ? acting.agentId : '';
-      if (action === 'create' && !callerAgentId) {
-        throw new Error(
-          'session: create belongs to a bot conversation; delegated workers, agent task sessions and schedule/webhook runs cannot create agent task sessions'
-        );
-      }
-      // A task session reaches its agent only through its reported result.
-      const origin = rt.session?.taskOrigin;
-      if (
-        action === 'send' &&
-        origin &&
-        (target === origin.sessionId || agentIdOfHomeSession(target) === origin.agentId)
-      ) {
-        throw new Error('session: a task session reports to its agent only through its result');
-      }
-      if (typeof executeSessionControl !== 'function') {
-        throw new Error('session: cross-session control is unavailable in this runtime');
-      }
-      const { attachments, ...rest } = args || {};
-      if (attachments !== undefined && action !== 'send' && action !== 'create') {
-        throw new Error(`session: attachments apply to send and create, not action=${action}`);
-      }
-      const attachmentParts = callerAttachmentParts(rt, args, callerCwd, 'session');
-      return JSON.stringify(
-        await executeSessionControl(
-          { ...rest, action },
-          {
-            callerSessionId,
-            callerAgentId,
-            callerBotId,
-            callerCwd,
-            ...(action === 'send' || action === 'create'
-              ? {
-                  callerHop: turnHopOf(rt.session),
-                  // The bot chain this turn acts in (bot-chain.mjs), checked
-                  // against the target and carried to the turn it starts —
-                  // only when the sender is a bot conversation (a bot's chat,
-                  // room seat or run); any other session hands work to any
-                  // bot as before, whatever started its turn (the hop limit
-                  // still bounds a loop).
-                  callerBotChain: callerBotId
-                    ? delegationChainOf(callerSessionId, (id) =>
-                        id === rt.session?.id ? rt.session : getSessionManager()?.getSession?.(id) || null
-                      )
-                    : [],
-                }
-              : {}),
-            // Whether a create may provision a worktree (worktree-access.mjs).
-            ...(action === 'create' ? { callerScope: worktreeCallerScope(rt.session) } : {}),
-            // Which bots and sessions it may see (bot-status.mjs).
-            ...(action === 'bots' || action === 'list' ? { callerScope: scheduleCallerScope(rt.session) } : {}),
-            ...(attachmentParts.length ? { attachmentParts } : {}),
-          }
-        )
-      );
+      return runSessionControl({ rt, executeSessionControl, listBots, getSessionManager }, args, {
+        action,
+        target,
+        callerSessionId,
+        callerCwd,
+      });
     }
     // Mixy's proposals to the user (mixy-heartbeat.mjs): kept so none repeats.
     if (action === 'suggest') {
@@ -178,28 +260,7 @@ export function createWorkspaceToolHandlers({
     if (action === 'status' || action === 'list-projects' || action === 'set-project') assertLead(action, callerCtx);
     if (action === 'rename') {
       const sessionId = assertLead(action, callerCtx);
-      if (rt.config?.aiSessionTitles === false) throw new Error('session: AI session titles are disabled in settings');
-      const title = clean(args?.title);
-      if (!title) throw new Error('session: title is required for action=rename');
-      const result = await getSessionManager()?.updateSessionAiTitle(sessionId, title);
-      if (!result?.ok) {
-        throw new Error(
-          result?.reason === 'user-title'
-            ? USER_TITLE_ERROR
-            : `session: rename failed (${result?.reason || 'unavailable'})`
-        );
-      }
-      // Mirror the store's truth onto the live session, never the AI title
-      // itself: a manual rename that landed while the save was awaited wins.
-      const stored = getSessionManager()?.getSession?.(sessionId);
-      if (stored && rt.session?.id === sessionId && stored !== rt.session) {
-        rt.session.title = stored.title;
-        rt.session.titleLocked = stored.titleLocked;
-        rt.session.titleSource = stored.titleSource;
-        rt.session.titleUpdatedAt = stored.titleUpdatedAt;
-      }
-      if (stored && stored.titleSource === 'user') throw new Error(USER_TITLE_ERROR);
-      return JSON.stringify({ action, sessionId, title: result.title }, null, 2);
+      return renameSession({ rt, getSessionManager }, action, sessionId, args);
     }
     if (action === 'compact') {
       const sessionId = assertLead(action, callerCtx);
@@ -213,38 +274,10 @@ export function createWorkspaceToolHandlers({
     }
     if (action === 'fork') {
       const sessionId = assertLead(action, callerCtx);
-      const lifecycle = getLifecycleApi();
-      if (typeof lifecycle?.inheritToNewSession !== 'function') {
-        throw new Error('session: fork is unavailable in this runtime');
-      }
-      const result = await lifecycle.inheritToNewSession(sessionId, {
-        compact: args?.compact === true,
-        titleSuffix: ' (Fork)',
-      });
-      return JSON.stringify(
-        { action, sourceSessionId: sessionId, sessionId: result.sessionId, compacted: result.compacted === true },
-        null,
-        2
-      );
+      return forkSession(getLifecycleApi, action, sessionId, args);
     }
     if (action === 'status') {
-      const current = rt.session;
-      return JSON.stringify(
-        {
-          sessionId: callerCtx?.callerSessionId || current?.id || null,
-          title: current?.title || null,
-          titleSource: current?.titleSource || null,
-          cwd: currentCwd,
-          project: current?.workspace?.projectPath || current?.desktopSession?.projectPath || currentCwd,
-          provider: current?.provider || null,
-          model: current?.model || null,
-          effort: current?.effort || null,
-          autoEffort: current?.autoEffort !== false,
-          fast: current?.fast === true,
-        },
-        null,
-        2
-      );
+      return sessionStatusJson(rt, callerCtx, currentCwd);
     }
     if (action === 'list-projects') {
       return JSON.stringify(

package/src/session-runtime/lifecycle/cold-heir.mjs

@@ -150,14 +150,19 @@ export function buildColdHeir(source, now = Date.now()) {
   // earlier folder) is the source's own: the heir's prompt is built for the
   // folder it actually starts in. Project memory follows the Project, which a
   // worktree shares, so the source's current memory slice carries over.
+  // In the same folder only the environment facts are rebuilt: they name the
+  // heir's own scratch directory, never the source's, while the inherited
+  // instruction files and memory stay as the source presented them.
   const pending = source.workspaceReroot;
   delete heir.workspaceReroot;
-  if ((projectFolder || pending) && heir.cwd) {
-    refreshSessionWorkspaceContext(heir, {
-      cwd: heir.cwd,
-      ...buildWorkspacePromptContext(heir, heir.cwd),
-      coreMemoryContext: pending?.target?.coreMemoryContext,
-    });
+  if (heir.cwd) {
+    const context = buildWorkspacePromptContext(heir, heir.cwd);
+    refreshSessionWorkspaceContext(
+      heir,
+      projectFolder || pending
+        ? { cwd: heir.cwd, ...context, coreMemoryContext: pending?.target?.coreMemoryContext }
+        : { cwd: heir.cwd, environmentContext: context.environmentContext }
+    );
   }
   invalidateContextUsageSnapshot(heir);
   invalidateProviderContextBaseline(heir);

package/src/session-runtime/lifecycle/session-catalog.mjs

@@ -21,7 +21,11 @@ import {
   wantsIncomingTail,
 } from '../../runtime/agent/orchestrator/session/store-summary-last-message.mjs';
 import { isRealTurnMessage } from '../../runtime/agent/orchestrator/session/compact/user-message-kind.mjs';
-import { realTurnCount as realTurnCountOf } from '../../runtime/agent/orchestrator/session/store-summary-fields.mjs';
+import {
+  compactCount as compactCountOf,
+  compactCountField,
+  realTurnCount as realTurnCountOf,
+} from '../../runtime/agent/orchestrator/session/store-summary-fields.mjs';
 
 const VISIBLE_OWNERS = ['cli', 'user', 'mixdog'];
 
@@ -107,6 +111,10 @@ export function leadSessionRow(s, working = false) {
     // sit among the counted ones: a bot row's unread pill counts those past
     // the read cursor. Absent when unknown; clients then show one.
     ...(incomingTail ? { incomingTail } : {}),
+    // The numbering epoch of messageCount: each compaction restarts it. A
+    // summary row carries it at the top; a stored session in its compaction
+    // record. Unknown stays absent.
+    ...compactCountField(compactCountOf(s) === null ? s.compaction : s),
     title: cleanSessionPreview(s.title || '', 100),
     preview,
     // The latest user or assistant line (an agent contact's row shows it).

package/src/session-runtime/lifecycle/teardown/session-close.mjs

@@ -4,6 +4,7 @@
  * tombstone barrier and the turn abort.
  */
 import { SessionClosedError } from '../../../runtime/agent/orchestrator/session/manager/session-errors.mjs';
+import { armTurnTimeout } from '../../../runtime/agent/orchestrator/session/manager/turn-reap.mjs';
 import { isScratchSession } from '../shared.mjs';
 
 // SessionEnd reason mapped to standard values ('clear'/'exit' where
@@ -88,11 +89,15 @@ export function closeCanonicalSession(deps, reason = 'canonical-session-close',
   return true;
 }
 
-export function abortRuntime(deps, reason = 'cli-abort') {
+/** `options.timeout` is the progress watchdog's explicit "this abort is a
+ *  timeout": the reap is armed before either abort runs, while the turn is
+ *  still un-aborted (the outer abort cascades into the manager's controller). */
+export function abortRuntime(deps, reason = 'cli-abort', { timeout = false } = {}) {
   const { getSession, getReservedSessionId, abortActiveTurns, mgr } = deps;
   const session = getSession();
   const sessionId = session?.id || getReservedSessionId?.() || 'pending';
   const abortError = new SessionClosedError(sessionId, `runtime abort (reason=${reason})`, reason);
+  if (timeout && session?.id) armTurnTimeout(session.id);
   let outerAborted = false;
   try {
     outerAborted = abortActiveTurns?.(abortError) === true;

package/src/session-runtime/lifecycle/teardown.mjs

@@ -281,6 +281,6 @@ export function createTeardown(deps, { ingestSessionIntoMemory, closeSurfaceSess
   return {
     closeCanonicalSession: (reason, options) => closeCanonicalSession(deps, reason, options),
     close,
-    abort: (reason) => abortRuntime(deps, reason),
+    abort: (reason, options) => abortRuntime(deps, reason, options),
   };
 }

package/src/session-runtime/mcp-glue/server-catalog.mjs

@@ -9,7 +9,7 @@ import {
   connectorOfServer,
   gmailAppPasswordAccount,
 } from '../../runtime/shared/connector-catalog.mjs';
-import { connectorAccountHealth } from '../../runtime/connectors/connector-accounts-mcp.mjs';
+import { connectorAccountHealth, connectorAccountInUse } from '../../runtime/connectors/connector-accounts-mcp.mjs';
 import { googleOAuthClient } from '../../runtime/shared/google-oauth-client.mjs';
 import { envFlag } from '../../runtime/shared/env.mjs';
 import { resolveMcpServerCatalog } from './plugin-servers.mjs';
@@ -119,10 +119,12 @@ export function createMcpServerCatalog({
     };
   }
 
-  /** One account of a multi-account connector server, as its row lists it:
-   *  `{ name, email, enabled?, appPassword?, oauth?, ownClient?, error?, authRequired? }`
-   *  (`enabled: false` only for an account that is switched off). */
-  function accountRow(accountCfg, enabled) {
+  /** One account of a connector server, as its row lists it:
+   *  `{ name, email, enabled?, inUse?, appPassword?, oauth?, ownClient?, error?, authRequired? }`
+   *  (`enabled: false` only for an account that is switched off; `inUse:
+   *  true` only for the connector's last-used account, the one a call
+   *  without a conversation history uses). */
+  function accountRow(accountCfg, enabled, inUse) {
     const address = gmailAppPasswordAccount(accountCfg);
     const oauth = address ? null : mcpClient.getMcpServerOAuthState?.(accountCfg);
     const state = connectorAccountHealth(accountCfg.name);
@@ -130,6 +132,7 @@ export function createMcpServerCatalog({
     return {
       name: accountCfg.name,
       ...(enabled ? {} : { enabled: false }),
+      ...(inUse ? { inUse: true } : {}),
       email: address || oauth?.account || state?.email || '',
       ...(address ? { appPassword: { account: address } } : {}),
       ...(oauth ? { oauth } : {}),
@@ -152,11 +155,14 @@ export function createMcpServerCatalog({
         failures.get(name) || (dead ? { msg: live.error || live.lastError || 'MCP server is not alive' } : undefined);
       const entry = entries[name] || {};
       const loginPending = !(live && !dead) && mcpClient.isMcpLoginPending?.(name, getMcpScopeId()) === true;
-      const accounts = entry.owner
-        ? []
-        : connectorAccountsOf(cfg).map((account) =>
-            accountRow(connectorAccountServer(cfg, account), connectorAccountEnabled(account))
-          );
+      const stored = entry.owner ? [] : connectorAccountsOf(cfg);
+      // The connector's last-used account (none when that one was removed),
+      // else its topmost switched-on one.
+      const recorded = stored.length ? connectorAccountInUse(connectorOfServer(cfg)) : '';
+      const inUse = recorded || stored.find(connectorAccountEnabled)?.name;
+      const accounts = stored.map((account) =>
+        accountRow(connectorAccountServer(cfg, account), connectorAccountEnabled(account), account.name === inUse)
+      );
       // A connector server none of whose accounts is signed in needs a sign-in, not a repair.
       const accountsSignIn = accounts.length > 0 && accounts.every((account) => account.authRequired === true);
       const status = mcpServerStatus(

package/src/session-runtime/mcp-glue/server-input.mjs

@@ -79,8 +79,11 @@ export function createMcpServerInput({ mcpClient, getCurrentCwd }) {
     const type = clean(input.type).toLowerCase();
     if (url) {
       const kind = URL_TRANSPORT_TYPES.get(type) || (/^wss?:\/\//i.test(url) ? 'ws' : 'http');
-      const secureUrl =
+      const normalizedUrl =
         typeof mcpClient.normalizeMcpTransportUrl === 'function' ? mcpClient.normalizeMcpTransportUrl(url, kind) : url;
+      // URL parsing adds a "/" to a bare origin (`https://mcp.stripe.com`):
+      // keep the address as it was given, as the catalog and legacy entries do.
+      const secureUrl = normalizedUrl === `${url}/` ? url : normalizedUrl;
       return { name, config: withOptionalHeaders({ type: kind, url: secureUrl }) };
     }
     const command = clean(input.command);

package/src/session-runtime/mixy-heartbeat.mjs

@@ -635,7 +635,7 @@ export function createMixyHeartbeat({
   now = Date.now,
   path = defaultStatePath(),
   isEnabled = async () =>
-    (await import('../runtime/agent/orchestrator/config.mjs')).loadConfig({ secrets: false }).heartbeat !== false,
+    (await import('../runtime/agent/orchestrator/config.mjs')).loadConfig({ secrets: false }).heartbeat === true,
   // Whether the representative bot exists (mixy-presence.mjs, the rule the
   // desktop and her routines follow): without it no check runs at all.
   mixyExists = async () => (await import('./routine-owner.mjs')).readMixyExists(),

package/src/session-runtime/model-route/set-route.mjs

@@ -217,11 +217,20 @@ function switchSessionInPlace(deps, session) {
 
 /** The Lead's fallback models after this selection, checked like an agent's
  *  chain (leaf routes, distinct providers): an explicit list replaces the
- *  stored one ([] clears it), a selection without one keeps it. */
+ *  stored one ([] clears it), a selection without one keeps it as stored — a
+ *  fallback on the new main model's provider stays saved and is inactive
+ *  (executionFallbacks). */
 async function leadFallbackChain(deps, next, primary) {
   const storedPreset = findPreset(deps.getConfig(), workflowPresetId('lead'));
-  const requested = hasOwn(next || {}, 'fallbacks') ? next.fallbacks : storedPreset?.fallbacks;
+  const explicit = hasOwn(next || {}, 'fallbacks');
+  const requested = explicit ? next.fallbacks : storedPreset?.fallbacks;
   if (!Array.isArray(requested) || !requested.length) return [];
+  if (!explicit) {
+    return (
+      normalizeWorkflowRoute({ provider: primary.provider, model: primary.model, fallbacks: requested })?.fallbacks ||
+      []
+    );
+  }
   const chain = routeChain({ provider: primary.provider, model: primary.model, fallbacks: requested });
   validateRouteChainProviders(chain);
   const storedChain = routeChain(storedPreset || {});

package/src/session-runtime/provider-auth/login.mjs

@@ -61,8 +61,8 @@ export function createLoginApi({ cfgMod, awaitKeychainPrewarm, reloadFullConfig,
       reloadFullConfig();
       return completeOAuthLogin(result);
     },
-    async saveProviderApiKey(providerId, secret) {
-      const result = await saveProviderApiKey(cfgMod, providerId, secret);
+    async saveProviderApiKey(providerId, secret, options) {
+      const result = await saveProviderApiKey(cfgMod, providerId, secret, options);
       refresh.afterCredentialChange();
       return result;
     },

package/src/session-runtime/provider-catalog-cache.mjs

@@ -37,6 +37,19 @@ let sharedPartialEntries = null;
 let sharedCatalogPromise = null;
 let sharedCatalogPromiseKey = null;
 let sharedCatalogPromiseForced = false;
+// Every read that publishes to the shared state (a full load or a scoped
+// refresh) runs through this queue, one at a time, so the last write is always
+// the newest successful answer.
+// A catalog state that moved on (new revision or account epoch) starts a fresh
+// queue: reads of the old state never publish, so nothing waits for them.
+let publishing = { key: null, tail: Promise.resolve() };
+function serial(key, run) {
+  if (publishing.key !== key) publishing = { key, tail: Promise.resolve() };
+  const queue = publishing;
+  const result = queue.tail.then(run);
+  queue.tail = result.catch(() => {});
+  return result;
+}
 
 export function catalogRevision(registry) {
   const value = Number(registry?.providerCatalogRevision?.());
@@ -60,6 +73,24 @@ export function invalidateSharedProviderCatalog() {
 
 const answered = (entry) => !Object.hasOwn(entry, 'error');
 
+/** Folds a scoped refresh into the shared state of `key`: only the providers it
+ *  answered are replaced; a failed entry replaces nothing. */
+function mergeScopedEntries(key, scoped) {
+  const fresh = new Map(scoped.filter(answered).map((entry) => [entry.name, entry]));
+  const merge = (current) => current.map((entry) => fresh.get(entry.name) ?? entry);
+  if (sharedCatalogKey === key) {
+    sharedCatalogEntries = merge(sharedCatalogEntries);
+  } else if (sharedPartialKey === key) {
+    const merged = merge(sharedPartialEntries);
+    if (merged.every(answered)) {
+      // The refresh answered the last missing provider: the catalog is whole.
+      [sharedCatalogKey, sharedCatalogEntries, sharedPartialKey, sharedPartialEntries] = [key, merged, null, null];
+    } else {
+      sharedPartialEntries = merged;
+    }
+  }
+}
+
 async function providerEntry(name, provider, timeoutMs, epoch) {
   if (typeof provider?.listModels !== 'function') return { name, models: [], ms: 0 };
   const startedAt = performance.now();
@@ -78,6 +109,23 @@ async function providerEntry(name, provider, timeoutMs, epoch) {
   return { name, models: Array.isArray(outcome.value) ? outcome.value : [], ms };
 }
 
+/** Fresh entries for just the named providers (an account-pool provider is one
+ *  entry, however many accounts it holds), merged into the shared catalog. */
+export function scopedProviderCatalog(registry, names, { timeoutMs = PROVIDER_CATALOG_TIMEOUT_MS } = {}) {
+  const key = catalogKey(registry);
+  const wanted = new Set(names);
+  return serial(key, async () => {
+    const entries = await Promise.all(
+      [...registry.getAllProviders()]
+        .filter(([name]) => wanted.has(name))
+        .map(([name, provider]) => providerEntry(name, provider, timeoutMs, key))
+    );
+    // A catalog state that moved on while this read ran is not written to.
+    if (catalogKey(registry) === key) mergeScopedEntries(key, entries);
+    return entries;
+  });
+}
+
 export async function sharedProviderCatalog(registry, { force = false, timeoutMs = PROVIDER_CATALOG_TIMEOUT_MS } = {}) {
   const key = catalogKey(registry);
   if (!force && sharedCatalogKey === key && Array.isArray(sharedCatalogEntries)) {
@@ -86,45 +134,43 @@ export async function sharedProviderCatalog(registry, { force = false, timeoutMs
   if (sharedCatalogPromise && sharedCatalogPromiseKey === key && (sharedCatalogPromiseForced || !force)) {
     return await sharedCatalogPromise;
   }
-  const kept = new Map();
-  if (!force && sharedPartialKey === key) {
-    const now = Date.now();
-    for (const entry of sharedPartialEntries) {
-      if (answered(entry) || now < entry.retryAt) kept.set(entry.name, entry);
-    }
-  }
-  const providers = [...registry.getAllProviders()];
-  // Every missing provider is still inside its backoff: the partial answer is
-  // the answer, without asking anyone.
-  if (providers.length > 0 && providers.every(([name]) => kept.has(name))) {
-    return providers.map(([name]) => kept.get(name));
-  }
-  // A pending list from an older catalog state (revision or account epoch) is
-  // not joined: its answer may describe the previous catalog.
-  const epoch = key;
   sharedCatalogPromiseKey = key;
   sharedCatalogPromiseForced = force;
-  const request = Promise.all(
-    providers.map(([name, provider]) => kept.get(name) || providerEntry(name, provider, timeoutMs, epoch))
-  )
-    .then((entries) => {
-      if (sharedCatalogPromise === request && catalogKey(registry) === key) {
-        const complete = entries.every(answered);
-        const partial = !complete && entries.some(answered);
-        sharedCatalogKey = complete ? key : null;
-        sharedCatalogEntries = complete ? entries : null;
-        sharedPartialKey = partial ? key : null;
-        sharedPartialEntries = partial ? entries : null;
+  const request = serial(key, async () => {
+    const kept = new Map();
+    if (!force && sharedPartialKey === key) {
+      const now = Date.now();
+      for (const entry of sharedPartialEntries) {
+        if (answered(entry) || now < entry.retryAt) kept.set(entry.name, entry);
       }
-      return entries;
-    })
-    .finally(() => {
-      if (sharedCatalogPromise === request) {
-        sharedCatalogPromise = null;
-        sharedCatalogPromiseKey = null;
-        sharedCatalogPromiseForced = false;
-      }
-    });
+    }
+    const providers = [...registry.getAllProviders()];
+    // Every missing provider is still inside its backoff: the partial answer is
+    // the answer, without asking anyone.
+    if (providers.length > 0 && providers.every(([name]) => kept.has(name))) {
+      return providers.map(([name]) => kept.get(name));
+    }
+    // A pending list from an older catalog state (revision or account epoch) is
+    // not joined: its answer may describe the previous catalog.
+    const entries = await Promise.all(
+      providers.map(([name, provider]) => kept.get(name) || providerEntry(name, provider, timeoutMs, key))
+    );
+    if (sharedCatalogPromise === request && catalogKey(registry) === key) {
+      const complete = entries.every(answered);
+      const partial = !complete && entries.some(answered);
+      sharedCatalogKey = complete ? key : null;
+      sharedCatalogEntries = complete ? entries : null;
+      sharedPartialKey = partial ? key : null;
+      sharedPartialEntries = partial ? entries : null;
+    }
+    return entries;
+  }).finally(() => {
+    if (sharedCatalogPromise === request) {
+      sharedCatalogPromise = null;
+      sharedCatalogPromiseKey = null;
+      sharedCatalogPromiseForced = false;
+    }
+  });
   sharedCatalogPromise = request;
   return await request;
 }