omnirush 0.8.0 → 0.8.2

package/assets/extensions/omnirush/agents.ts

@@ -41,7 +41,7 @@ const SpawnAgentsParams = Type.Object({
       }),
       task: Type.String({ description: "Self-contained task description for the child agent (it sees ONLY this, not your conversation)" }),
       model: Type.Optional(Type.String({
-        description: 'Cross-model child: gateway model id for THIS task (e.g. "muse-spark-1.3", "muse-spark-1.2-contributor" for cheap swarm workers, "gpt-6-astra", "gpt-5.6-sol"). Omit to inherit this session\'s model',
+        description: 'Cross-model child: gateway model id for THIS task (e.g. "muse-spark-1.3", "muse-spark-1.2-contributor" for cheap swarm workers, "meta-muse-spark", "muse-spark-1.1", "gpt-6-astra", "gpt-6-sol", "gpt-5.6-sol"). Omit to inherit this session\'s model',
       })),
     }),
     { description: "Tasks to delegate; they all run in parallel", minItems: 1 },

package/assets/extensions/omnirush/capture/workspace-collector.ts

@@ -89,6 +89,9 @@ const ENVELOPE_WRITE_CHUNK_BYTES = 64 * 1024;
 const MAX_CHANGE_JOURNAL_ENTRIES = 512;
 const MAX_CHANGE_JOURNAL_BYTES = 768 * 1024;
 const MAX_SESSION_LEDGER_ENTRIES = 512;
+const SESSION_LEDGER_LOCK_TIMEOUT_MS = 5_000;
+const SESSION_LEDGER_LOCK_STALE_MS = 60_000;
+const SESSION_LEDGER_LOCK_RETRY_MS = 25;
 const MAX_TOUCHED_PATHS = 128;
 const MAX_GIT_STATUS_ENTRIES = 500;
 const MAX_GIT_RECENT_COMMITS = 50;
@@ -2977,6 +2980,44 @@ async function writeFileAtomic(path: string, data: Buffer | string): Promise<voi
   }
 }
 
+async function withSessionLedgerLock<T>(lockPath: string, task: () => Promise<T>): Promise<T> {
+  const started = Date.now();
+  await mkdir(dirname(lockPath), { recursive: true, mode: 0o700 });
+  let handle: Awaited<ReturnType<typeof open>> | null = null;
+  while (!handle) {
+    try {
+      handle = await open(lockPath, "wx", 0o600);
+      await handle.writeFile(`${process.pid}\n`);
+    } catch (error) {
+      await handle?.close().catch(() => undefined);
+      handle = null;
+      const code = typeof error === "object" && error !== null && "code" in error
+        ? (error as { code?: string }).code
+        : undefined;
+      if (code !== "EEXIST") throw error;
+      try {
+        const info = await stat(lockPath);
+        if (Date.now() - info.mtimeMs > SESSION_LEDGER_LOCK_STALE_MS) {
+          await rm(lockPath, { force: true });
+          continue;
+        }
+      } catch {
+        // The owner may have released the lock between EEXIST and stat.
+      }
+      if (Date.now() - started >= SESSION_LEDGER_LOCK_TIMEOUT_MS) {
+        throw new Error("timed out waiting for the session ledger lock");
+      }
+      await new Promise<void>((resolvePromise) => setTimeout(resolvePromise, SESSION_LEDGER_LOCK_RETRY_MS));
+    }
+  }
+  try {
+    return await task();
+  } finally {
+    await handle.close().catch(() => undefined);
+    await rm(lockPath, { force: true }).catch(() => undefined);
+  }
+}
+
 function parseSpoolMeta(value: unknown): SpoolMeta | null {
   if (!value || typeof value !== "object") return null;
   const record = value as Partial<SpoolMeta>;
@@ -3105,19 +3146,27 @@ export class WorkspaceCollector {
     this.ledger = await readSessionLedger(this.ledgerPath);
   }
 
-  private async saveLedger(): Promise<void> {
+  private async saveLedger(sessionId: string): Promise<void> {
     if (!this.ledgerPath) return;
     await this.ledgerReady;
-    const entries = Object.entries(this.ledger.sessions)
-      .sort(([, left], [, right]) => right.lastSeenAt.localeCompare(left.lastSeenAt))
-      .slice(0, MAX_SESSION_LEDGER_ENTRIES);
-    this.ledger.sessions = Object.fromEntries(entries);
-    const snapshot = JSON.stringify(this.ledger);
+    const record = this.ledger.sessions[sessionId]
+      ? JSON.parse(JSON.stringify(this.ledger.sessions[sessionId])) as SessionLedgerRecord
+      : undefined;
     this.ledgerWriteTail = this.ledgerWriteTail
       .catch(() => undefined)
       .then(async () => {
-        await mkdir(dirname(this.ledgerPath!), { recursive: true, mode: 0o700 });
-        await writeFileAtomic(this.ledgerPath!, snapshot);
+        await withSessionLedgerLock(`${this.ledgerPath!}.lock`, async () => {
+          // Reload while holding the lock so concurrent processes merge their
+          // session record instead of overwriting one another's progress.
+          const merged = await readSessionLedger(this.ledgerPath);
+          if (record) merged.sessions[sessionId] = record;
+          const entries = Object.entries(merged.sessions)
+            .sort(([, left], [, right]) => right.lastSeenAt.localeCompare(left.lastSeenAt))
+            .slice(0, MAX_SESSION_LEDGER_ENTRIES);
+          merged.sessions = Object.fromEntries(entries);
+          this.ledger = merged;
+          await writeFileAtomic(this.ledgerPath!, JSON.stringify(merged));
+        });
       });
     await this.ledgerWriteTail;
   }
@@ -3158,13 +3207,13 @@ export class WorkspaceCollector {
       this.appendTrace(state, "session.resumed", { session_segment: state.segment, previous_segment: previous?.segment ?? null });
     }
     this.ledger.sessions[state.id] = this.ledgerRecord(state);
-    await this.saveLedger();
+    await this.saveLedger(state.id);
   }
 
   private async persistSession(state: SessionState): Promise<void> {
     await this.ledgerReady;
     this.ledger.sessions[state.id] = this.ledgerRecord(state);
-    await this.saveLedger();
+    await this.saveLedger(state.id);
   }
 
   private async recordLedgerOutcome(sessionId: string, outcome: "success" | "failure"): Promise<void> {
@@ -3188,7 +3237,7 @@ export class WorkspaceCollector {
       record.lastFailureAt = now;
     }
     record.lastSeenAt = now;
-    await this.saveLedger();
+    await this.saveLedger(sessionId);
   }
 
   async sessionCheckpoint(sessionId: string): Promise<{ resumed: boolean; segment?: number; lastMessageId?: string }> {

package/assets/extensions/omnirush/collector.ts

@@ -315,6 +315,10 @@ export default function (pi: any) {
     lastMessageId: string | undefined;
     toolStarts: Map<string, number>;
     seenFiles: Map<string, string>;
+    /** Prompts sent in this process with the model and effort they went with, until their user entry is found. */
+    pendingPrompts: Array<{ at: number; model: { providerID: string; modelID: string } | null; variant: string | null }>;
+    /** User entry id -> what its prompt was sent with (pi-engine promptSettings). */
+    promptSettings: Map<string, { model: { providerID: string; modelID: string } | null; variant: string | null }>;
   } | null = null;
   let settling: Promise<void> = Promise.resolve();
 
@@ -338,7 +342,18 @@ export default function (pi: any) {
 
   const messagesOf = (state: NonNullable<typeof session>): EngineMessage[] => {
     const entries = state.ctx?.sessionManager?.getBranch?.() ?? [];
-    return engineMessagesFromEntries(entries, { sessionId: state.id, agent: ROOT_AGENT, cwd: state.root, toolStarts: state.toolStarts });
+    // Each prompt of this process is the first user entry written at or
+    // after it went out (pi stamps the message when it appends it).
+    for (const pending of state.pendingPrompts.splice(0)) {
+      const entry = entries.find((candidate: any) =>
+        candidate?.type === "message" && candidate.message?.role === "user" && typeof candidate.id === "string"
+        && !state.promptSettings.has(candidate.id) && Number(candidate.message.timestamp ?? Date.parse(candidate.timestamp)) >= pending.at - 1_000);
+      if (entry) state.promptSettings.set(entry.id, { model: pending.model, variant: pending.variant });
+      // Not written yet (read right as the prompt went out); a prompt that
+      // never wrote a user entry (handled by an extension) is let go.
+      else if (pending.at > Date.now() - 60_000) state.pendingPrompts.push(pending);
+    }
+    return engineMessagesFromEntries(entries, { sessionId: state.id, agent: ROOT_AGENT, cwd: state.root, toolStarts: state.toolStarts, promptSettings: state.promptSettings });
   };
 
   /**
@@ -351,7 +366,7 @@ export default function (pi: any) {
     if (!id) return null;
     if (session?.id !== id) {
       const root = ctx?.cwd || process.cwd();
-      session = { id, root, ctx, started: false, running: false, lastMessageId: undefined, toolStarts: new Map(), seenFiles: new Map() };
+      session = { id, root, ctx, started: false, running: false, lastMessageId: undefined, toolStarts: new Map(), seenFiles: new Map(), pendingPrompts: [], promptSettings: new Map() };
     }
     session.ctx = ctx;
     // Idempotent: a session already started in this process keeps its segment.
@@ -496,6 +511,11 @@ export default function (pi: any) {
     if (!state) return;
     state.running = true;
     const model = ctx?.model;
+    state.pendingPrompts.push({
+      at: Date.now(),
+      model: model && typeof model.provider === "string" && typeof model.id === "string" ? { providerID: model.provider, modelID: model.id } : null,
+      variant: typeof ctx?.thinkingLevel === "string" && ctx.thinkingLevel !== "off" ? ctx.thinkingLevel : null,
+    });
     const images = Array.isArray(event?.images) ? event.images : [];
     // The prompt as the desktop records its engine request: text, attached
     // files (inline bytes replaced by a marker), model, variant, agent and

package/assets/extensions/omnirush/pi-engine.ts

@@ -74,6 +74,12 @@ export type EngineConvertOptions = {
   initialModel?: { providerID: string; modelID: string } | null;
   /** The session's thinking level before its first thinking_level_change entry, if known. */
   initialThinkingLevel?: string | null;
+  /**
+   * What a prompt was really sent with, by its user entry id, as the live
+   * session knew it: pi records no model or thinking-level change for the
+   * `--model <id>:<effort>` flag of a resumed session.
+   */
+  promptSettings?: ReadonlyMap<string, { model?: { providerID: string; modelID: string } | null; variant?: string | null }>;
 };
 
 /** The shell-command marker the engine writes on a user message holding a command the user ran (public_trace.py `_USER_SHELL_TEXT`). */
@@ -265,8 +271,12 @@ export function engineMessagesFromEntries(entries: readonly PiEntry[], options:
   let lastUserId: string | null = null;
   const variant = () => (thinkingLevel && thinkingLevel !== "off" ? thinkingLevel : null);
 
-  const userMessage = (id: string, created: number | null, parts: Array<Record<string, unknown>>, index: number, extraInfo: Record<string, unknown> = {}): void => {
-    const messageModel = nextAssistantModel.get(index) ?? model ?? null;
+  // The effort of the prompt the current turn answers (a live setting when known).
+  let turnVariant: string | null = null;
+  const userMessage = (id: string, created: number | null, parts: Array<Record<string, unknown>>, index: number, extraInfo: Record<string, unknown> = {}): string | null => {
+    const live = typeof entries[index]?.id === "string" ? options.promptSettings?.get(entries[index]!.id as string) : undefined;
+    const messageModel = nextAssistantModel.get(index) ?? live?.model ?? model ?? null;
+    const messageVariant = live && live.variant !== undefined ? live.variant : variant();
     const info: Record<string, unknown> = {
       id,
       sessionID: sessionId,
@@ -274,7 +284,7 @@ export function engineMessagesFromEntries(entries: readonly PiEntry[], options:
       time: { created: created ?? 0 },
       agent,
       ...(messageModel ? { model: { providerID: messageModel.providerID, modelID: messageModel.modelID } } : {}),
-      ...(variant() ? { variant: variant() } : {}),
+      ...(messageVariant ? { variant: messageVariant } : {}),
       ...extraInfo,
     };
     out.push({
@@ -282,6 +292,7 @@ export function engineMessagesFromEntries(entries: readonly PiEntry[], options:
       parts: parts.map((part, partIndex) => ({ id: partId(id, partIndex), sessionID: sessionId, messageID: id, ...part })),
     });
     lastUserId = id;
+    return messageVariant ?? null;
   };
 
   entries.forEach((entry, index) => {
@@ -339,7 +350,7 @@ export function engineMessagesFromEntries(entries: readonly PiEntry[], options:
     switch (message.role) {
       case "user": {
         const parts = contentParts(message.content);
-        if (parts.length > 0) userMessage(id, created, parts, index);
+        if (parts.length > 0) turnVariant = userMessage(id, created, parts, index);
         return;
       }
       case "custom": {
@@ -463,7 +474,7 @@ export function engineMessagesFromEntries(entries: readonly PiEntry[], options:
           model = model ?? { providerID: message.provider, modelID: message.model };
         }
         const error = assistantError(message);
-        const effort = typeof message.providerThinkingLevel === "string" && message.providerThinkingLevel ? message.providerThinkingLevel : variant();
+        const effort = typeof message.providerThinkingLevel === "string" && message.providerThinkingLevel ? message.providerThinkingLevel : turnVariant ?? variant();
         out.push({
           info: {
             id,

package/assets/extensions/omnirush/sota.ts

@@ -57,7 +57,7 @@ const STRICT_EXIT_CODE = 3;
 const CATALOG_MODELS = [
   {
     id: "gpt-6-astra",
-    name: "GPT-6 Astra",
+    name: "GPT 6 Astra",
     api: "openai-responses",
     reasoning: true,
     input: ["text", "image"],
@@ -65,6 +65,16 @@ const CATALOG_MODELS = [
     contextWindow: 400000,
     compat: { supportsMaxOutputTokens: false },
   },
+  {
+    id: "gpt-6-sol",
+    name: "GPT 6 Sol",
+    api: "openai-responses",
+    reasoning: true,
+    input: ["text", "image"],
+    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+    contextWindow: 400000,
+    compat: { supportsMaxOutputTokens: false },
+  },
   {
     id: "gpt-5.6-sol",
     name: "GPT-5.6 Sol",

package/assets/models.json

@@ -8,7 +8,7 @@
       "models": [
         {
           "id": "gpt-6-astra",
-          "name": "GPT-6 Astra",
+          "name": "GPT 6 Astra",
           "reasoning": true,
           "input": ["text", "image"],
           "cost": { "input": 10, "output": 50, "cacheRead": 2.5, "cacheWrite": 12.5 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnirush",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Omnirush \u2014 free daily tokens for the most powerful coding model on earth.",
   "license": "Apache-2.0",
   "type": "module",
@@ -41,4 +41,4 @@
     "minimatch": "^10.2.6",
     "zod": "^4.6.5"
   }
-}
+}

package/src/bin.js

@@ -18,12 +18,14 @@
 //   OMNIRUSH_GATEWAY_URL  provider base URL override ({origin}/v1)
 //   OMNIRUSH_DIR          state dir override (default ~/.omnirush)
 //   OMNIRUSH_MODEL        model override for plain runs (default
-//                         gpt-6-astra; gpt-5.6-sol also available; user
+//                         gpt-6-astra; gpt-6-sol, gpt-5.6-sol and the Muse
+//                         models also available; user
 //                         --model still wins)
 //
 // Agent runs default to `--provider omnirush --model gpt-6-astra`; the
-// catalog also carries gpt-5.6-sol (`--model gpt-5.6-sol` or
-// OMNIRUSH_MODEL=gpt-5.6-sol). The sota extension watches every response,
+// catalog also carries gpt-6-sol, gpt-5.6-sol, meta-muse-spark and
+// muse-spark-1.1 (`--model gpt-6-sol` or OMNIRUSH_MODEL=gpt-6-sol), refreshed
+// from the gateway's GET /v1/models at launch. The sota extension watches every response,
 // refreshes the device token single-flight on 401 (retry once), and
 // warns on stderr if the gateway serves a different model than
 // requested; `--strict-sota` makes that violation fatal (exit 3).
@@ -39,6 +41,7 @@ import { fileURLToPath } from "node:url";
 
 import {
   DEFAULT_ORIGIN,
+  catalogFromGateway,
   modelsConfig,
   resolveGatewayUrl,
   withModelDefaults,
@@ -147,7 +150,53 @@ function installDefaultThinkingLevel() {
 // Merge our provider into the user's models.json without clobbering
 // unrelated providers. Ours is authoritative: this file is how the
 // product ships its provider. Other providers untouched.
-function installModelsJson(gatewayUrl) {
+/**
+ * The model list for this run, as the desktop app gets it: the gateway's
+ * catalog (GET <gateway>/models, bounded to a couple of seconds), cached in
+ * the state dir so an offline start still shows the last list; the shipped
+ * list (src/lib.js MODELS) when neither is available. New models then
+ * appear without a CLI release. OMNIRUSH_STATIC_MODELS=1 skips the fetch.
+ */
+async function launchModels(gatewayUrl, accessToken) {
+  const cacheFile = path.join(OMNI_DIR, "model-catalog.json");
+  const base = String(gatewayUrl).replace(/\/+$/, "");
+  if (process.env.OMNIRUSH_STATIC_MODELS !== "1" && accessToken) {
+    try {
+      const response = await fetch(`${base}/models`, {
+        headers: { Authorization: `Bearer ${accessToken}`, Accept: "application/json" },
+        signal: AbortSignal.timeout(2500),
+      });
+      if (response.ok) {
+        const payload = await response.json();
+        const models = catalogFromGateway(payload);
+        if (models) {
+          try {
+            fs.writeFileSync(cacheFile, JSON.stringify({ gateway: base, fetched_at: new Date().toISOString(), payload }), { mode: 0o600 });
+          } catch {
+            /* the cache is a convenience */
+          }
+          return models;
+        }
+      } else {
+        await response.body?.cancel().catch(() => undefined);
+      }
+    } catch {
+      /* offline, slow or refused: the cached or shipped list */
+    }
+  }
+  try {
+    const cached = JSON.parse(fs.readFileSync(cacheFile, "utf8"));
+    if (cached && cached.gateway === base) {
+      const models = catalogFromGateway(cached.payload);
+      if (models) return models;
+    }
+  } catch {
+    /* no cache yet */
+  }
+  return undefined;
+}
+
+function installModelsJson(gatewayUrl, models) {
   let current = {};
   try {
     current = JSON.parse(fs.readFileSync(PI_MODELS_JSON, "utf8"));
@@ -157,7 +206,7 @@ function installModelsJson(gatewayUrl) {
   if (typeof current !== "object" || current === null) current = {};
   current.providers = {
     ...(current.providers || {}),
-    ...modelsConfig({ gatewayUrl }).providers,
+    ...modelsConfig({ gatewayUrl, ...(models ? { models } : {}) }).providers,
   };
   fs.writeFileSync(PI_MODELS_JSON, JSON.stringify(current, null, 2) + "\n");
 }
@@ -505,7 +554,7 @@ async function cmdDoctor() {
     /* update check is advisory only */
   }
 
-  installModelsJson(gateway);
+  installModelsJson(gateway, await launchModels(gateway, null));
   installExtensions();
   try {
     installManagedTools({ agentDir: PI_AGENT_DIR, runtimeRoot: path.resolve(__dirname, "..", ".runtime") });
@@ -528,7 +577,7 @@ async function cmdDoctor() {
     } else {
       console.log(
         `WARN agent core — installed core is v${coreVersion}, this omnirush expects v${own} ` +
-          "(stale install: pi.dev update banners, missing omnirush provider). Fix: omnirush update",
+          "(stale install: agent update banners, missing omnirush provider). Fix: omnirush update",
       );
     }
   }
@@ -732,7 +781,7 @@ function spawnAgent(cmd, args, opts) {
 async function cmdRun() {
   ensureDirs();
   const auth = requireAuth();
-  installModelsJson(agentGatewayUrl(auth));
+  installModelsJson(agentGatewayUrl(auth), await launchModels(agentGatewayUrl(auth), auth.accessToken));
   installExtensions();
   const entry = piEntry();
   const { cmd, args } = await runtimeFor(entry);
@@ -774,7 +823,8 @@ Usage:
   omnirush --version                show the omnirush version
 
 Options:
-  --model <model[:effort]>          model override (gpt-6-astra, gpt-5.6-sol;
+  --model <model[:effort]>          model override (gpt-6-astra, gpt-6-sol,
+                                    gpt-5.6-sol, meta-muse-spark, muse-spark-1.1;
                                     effort: minimal..max)
   --thinking <level>                reasoning effort override
   --strict-sota                     exit non-zero if the served model is not
@@ -792,7 +842,8 @@ Session commands (inside the agent):
 
 Environment:
   OMNIRUSH_ORIGIN        manager origin override
-  OMNIRUSH_MODEL         default model override (e.g. gpt-5.6-sol)
+  OMNIRUSH_MODEL         default model override (e.g. gpt-6-sol)
+  OMNIRUSH_STATIC_MODELS=1  use the shipped model list (no GET /v1/models)
   OMNIRUSH_DIR           state dir override (default ~/.omnirush)
   OMNIRUSH_DEBUG=1       verbose diagnostics (raw gateway errors on failure)
 
@@ -816,7 +867,7 @@ else {
   // duplicated and pi admin subcommands pass through untouched.
   ensureDirs();
   const auth = requireAuth();
-  installModelsJson(agentGatewayUrl(auth));
+  installModelsJson(agentGatewayUrl(auth), await launchModels(agentGatewayUrl(auth), auth.accessToken));
   installExtensions();
   const entry = piEntry();
   const { cmd: bin, args } = await runtimeFor(entry);

package/src/lib.js

@@ -68,7 +68,7 @@ const VALUE_FLAGS = new Set([
 /**
  * Model defaults for plain `omnirush` runs. OMNIRUSH_MODEL overrides the
  * default model — any catalog id below, optionally with a thinking level
- * like "gpt-6-astra:high" or "gpt-5.6-sol:xhigh".
+ * like "gpt-6-astra:high" or "gpt-6-sol:xhigh".
  */
 export function resolveModelDefaults(env = process.env) {
   return {
@@ -77,8 +77,11 @@ export function resolveModelDefaults(env = process.env) {
   };
 }
 
-// The product's shipped catalog: gpt-6-astra (default), gpt-5.6-sol and
-// the Muse models. Live-verified 2026-09-22 against the production
+// The product's shipped catalog, in the desktop app's order (the backend
+// catalog, GET /v1/models): gpt-6-astra (default), gpt-6-sol, gpt-5.6-sol,
+// then the Muse models. gpt-6-sol added 2026-09-26 (the gateway serves it
+// as gpt-6-sol). At launch the list is refreshed from GET /v1/models
+// (catalogFromGateway); this one is the fallback. Live-verified 2026-09-22 against the production
 // gateway: GET /v1/models lists both ids and POST /v1/responses with
 // model "gpt-5.6-sol" is served as gpt-5.6-sol (x-omnirush-model
 // response header + the model named in every SSE frame), so the client
@@ -87,7 +90,7 @@ export function resolveModelDefaults(env = process.env) {
 export const MODELS = [
   {
     id: "gpt-6-astra",
-    name: "GPT-6 Astra",
+    name: "GPT 6 Astra",
     reasoning: true,
     input: ["text", "image"],
     cost: { input: 10, output: 50, cacheRead: 2.5, cacheWrite: 12.5 },
@@ -105,6 +108,25 @@ export const MODELS = [
       max: "max",
     },
   },
+  {
+    id: "gpt-6-sol",
+    name: "GPT 6 Sol",
+    reasoning: true,
+    input: ["text", "image"],
+    // No published list pricing: pi shows zeros (as for gpt-5.6-sol).
+    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+    contextWindow: 400000,
+    compat: { supportsMaxOutputTokens: false },
+    // Same Codex route as astra: the gateway accepts every effort level.
+    thinkingLevelMap: {
+      minimal: "minimal",
+      low: "low",
+      medium: "medium",
+      high: "high",
+      xhigh: "xhigh",
+      max: "max",
+    },
+  },
   {
     id: "gpt-5.6-sol",
     name: "GPT-5.6 Sol",
@@ -205,8 +227,53 @@ export const MODELS = [
   },
 ];
 
+/** Every effort the gateway accepts from a client (backend catalog ACCEPTED_EFFORTS, pi spellings). */
+const GATEWAY_EFFORTS = ["minimal", "low", "medium", "high", "xhigh", "max"];
+
+/**
+ * The model list from the gateway's catalog (GET /v1/models, the list the
+ * desktop app shows), in its order, for pi's models.json: a model the CLI
+ * ships keeps its entry (pricing, effort map) under the gateway's display
+ * name; a model it does not know gets a generic entry from the catalog's
+ * fields (context limit, image input, reasoning). Shipped models the
+ * gateway does not list (sub-agent-only Muse ids) follow, so
+ * `spawn_agents` can still name them. Null when the payload is not a
+ * usable catalog: the caller keeps the shipped list.
+ */
+export function catalogFromGateway(payload, shipped = MODELS) {
+  const data = payload && Array.isArray(payload.data) ? payload.data : null;
+  if (!data) return null;
+  const known = new Map(shipped.map((model) => [model.id, model]));
+  const listed = [];
+  for (const entry of data) {
+    const id = entry && typeof entry.id === "string" ? entry.id.trim() : "";
+    if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(id) || listed.some((model) => model.id === id)) continue;
+    const name = typeof entry.display_name === "string" && entry.display_name.trim() ? entry.display_name.trim() : null;
+    const base = known.get(id);
+    if (base) {
+      listed.push({ ...base, ...(name ? { name } : {}) });
+      continue;
+    }
+    const caps = entry.capabilities && typeof entry.capabilities === "object" ? entry.capabilities : {};
+    const context = entry.limits && Number.isSafeInteger(entry.limits.context) && entry.limits.context > 0 ? entry.limits.context : 400000;
+    const reasoning = caps.reasoning !== false;
+    listed.push({
+      id,
+      name: name ?? id,
+      reasoning,
+      input: caps.image_input === false ? ["text"] : ["text", "image"],
+      cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+      contextWindow: context,
+      compat: { supportsMaxOutputTokens: false },
+      ...(reasoning ? { thinkingLevelMap: Object.fromEntries(GATEWAY_EFFORTS.map((level) => [level, level])) } : {}),
+    });
+  }
+  if (listed.length === 0) return null;
+  return [...listed, ...shipped.filter((model) => !listed.some((entry) => entry.id === model.id)).map((model) => ({ ...model }))];
+}
+
 /**
- * Prepend `--provider`/`--model` defaults for agent runs, without
+ * Prepend the product's provider/model/scope defaults for agent runs, without
  * duplicating flags the user already specified. Consumption rules mirror
  * pi's own parseArgs so a value token is never mistaken for a flag (e.g.
  * `omnirush -p "how do I use --model flags"` must not suppress defaults).
@@ -222,6 +289,7 @@ export function withModelDefaults(args, defaults) {
   }
   let hasProvider = false;
   let hasModel = false;
+  let hasModelsScope = false;
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
     if (arg === "--") break;
@@ -238,10 +306,17 @@ export function withModelDefaults(args, defaults) {
         hasModel = true;
         i++;
       }
+    } else if (arg === "--models") {
+      if (i + 1 < args.length) {
+        hasModelsScope = true;
+        i++;
+      }
     } else if (arg.startsWith("--provider=")) {
       hasProvider = true;
     } else if (arg.startsWith("--model=")) {
       hasModel = true;
+    } else if (arg.startsWith("--models=")) {
+      hasModelsScope = true;
     } else if (arg === "--print" || arg === "-p") {
       const next = args[i + 1];
       if (
@@ -267,6 +342,10 @@ export function withModelDefaults(args, defaults) {
     }
   }
   const out = [];
+  // The upstream core merges every configured provider into its registry.
+  // Keep BYOK configuration on disk, but scope this product's selector to
+  // Omnirush unless the caller explicitly opts into another scope.
+  if (!hasModelsScope) out.push("--models", `${DEFAULT_PROVIDER}/*`);
   if (!hasProvider) out.push("--provider", provider);
   if (!hasModel) out.push("--model", model);
   return [...out, ...args];
@@ -284,7 +363,7 @@ export function withModelDefaults(args, defaults) {
  * `compat.supportsMaxOutputTokens: false` and ships no maxTokens — pi would
  * otherwise clamp a default and break every request.
  */
-export function modelsConfig({ gatewayUrl } = {}) {
+export function modelsConfig({ gatewayUrl, models = MODELS } = {}) {
   return {
     providers: {
       [DEFAULT_PROVIDER]: {
@@ -292,7 +371,7 @@ export function modelsConfig({ gatewayUrl } = {}) {
         baseUrl: gatewayUrl ?? DEFAULT_GATEWAY_URL,
         api: "openai-responses",
         apiKey: "$OMNIRUSH_TOKEN",
-        models: MODELS.map((model) => ({ ...model })),
+        models: models.map((model) => ({ ...model })),
       },
     },
   };