ompchamber 2.0.2 → 3.0.0

package/src/server/lib/assets/fonts.server.ts

@@ -0,0 +1,117 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Font files served straight from the installed packages.
+ *
+ * The client stylesheet reaches its `@font-face` sources through the bundler's
+ * CSS loader (`lib/bundler/css.ts`), which rewrites every one of them to
+ * `<FONT_ROUTE_PREFIX><basename>`. Nothing copies them into the repository: a
+ * font is addressed by its own basename, and this module resolves that basename
+ * back to the package that ships it.
+ *
+ * A directory index rather than a path built from the request, because the
+ * request must never choose a directory. The index is built once, lazily, by
+ * walking the vendor font directories, and a basename that is not in it is a
+ * 404 rather than a lookup somewhere else.
+ *
+ * The search roots are not just `process.cwd()`. An installed package runs the
+ * AOT bundle from `dist/client`, and a `serve --prod` started from another
+ * directory has neither `node_modules` nor the source tree under it — so the
+ * roots are every directory from the running module up to the filesystem root,
+ * plus the cwd. Whichever one holds `node_modules` is the package root.
+ */
+
+import { existsSync } from 'fs';
+import { basename, dirname, join, parse, resolve } from 'path';
+import { Glob } from 'bun';
+
+/** Path prefix every rewritten font url carries. */
+export const FONT_ROUTE_PREFIX = '/fonts/';
+
+/** Where the fonts live, relative to a package root. */
+const FONT_SOURCES = [
+  'node_modules/katex/dist/fonts',
+  'node_modules/@fontsource/fira-code/files',
+] as const;
+
+/**
+ * Directories a package root may be found under, nearest first.
+ *
+ * `import.meta.dir` is the running file's directory — the repo root for the
+ * TypeScript entry, `dist/client` for the AOT bundle — and walking up from it
+ * finds `node_modules` in both. The cwd is included because a source checkout
+ * run from elsewhere still resolves its dependencies through it.
+ */
+function searchRoots(): string[] {
+  const roots: string[] = [];
+  const seen = new Set<string>();
+  const add = (dir: string) => {
+    if (dir && !seen.has(dir)) {
+      seen.add(dir);
+      roots.push(dir);
+    }
+  };
+
+  let dir = import.meta.dir;
+  const { root } = parse(dir);
+  for (;;) {
+    add(dir);
+    if (dir === root) break;
+    dir = dirname(dir);
+  }
+  add(resolve(process.cwd()));
+  return roots;
+}
+
+/** Basename -> absolute path. Built once; the packages do not change at runtime. */
+let index: Record<string, string> | null = null;
+
+/**
+ * The package root — the first search root that holds `node_modules`.
+ *
+ * Both ends of the build need the same answer: the plugin writes the extracted
+ * face files here and the server reads them back, and an AOT bundle runs from
+ * `dist/client` while a source checkout runs from the repo. Falling back to the
+ * cwd keeps a checkout with no `node_modules` (a publish dry-run) working.
+ */
+export function packageRoot(): string {
+  for (const root of searchRoots()) {
+    // `existsSync` rather than `Bun.file().exists()`: the latter is async and
+    // file-only, and `node_modules` is a directory.
+    if (existsSync(join(root, 'node_modules'))) return root;
+  }
+  return process.cwd();
+}
+
+async function buildIndex(): Promise<Record<string, string>> {
+  const found: Record<string, string> = {};
+  const glob = new Glob('*.{woff2,woff,ttf,otf}');
+  for (const root of searchRoots()) {
+    for (const dir of FONT_SOURCES) {
+      const from = join(root, dir);
+      try {
+        for await (const file of glob.scan({ cwd: from, onlyFiles: true })) {
+          const name = basename(file);
+          // Nearest root wins: a checkout's own node_modules is what its build
+          // was made against, so it must not lose to a parent's copy.
+          found[name] ??= join(from, file);
+        }
+      } catch {
+        // A root without these packages contributes nothing; the CSS that
+        // referenced a missing font will 404, which is the honest outcome.
+      }
+    }
+  }
+  return found;
+}
+
+/** The font file for a basename, or null when nothing ships it. */
+export async function resolveFontFile(name: string): Promise<string | null> {
+  // A basename only: a request for `../` or a nested path is not a font.
+  if (!name || name !== basename(name)) return null;
+  index ??= await buildIndex();
+  return index[name] ?? null;
+}

package/src/server/lib/bundler/css.ts

@@ -0,0 +1,116 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The one CSS loader for every bundler pass Bun runs for this app.
+ *
+ * Bun's `serve.static` plugins and `Bun.build`'s `plugins` array both feed the
+ * client bundle, and both need the same two transforms — so they live in ONE
+ * plugin rather than two. `onLoad({ filter: /\.css$/ })` has a single winner per
+ * module: whichever plugin returns contents first ends the chain, so two
+ * plugins would silently starve each other (Tailwind's `@theme` blocks would
+ * survive untouched, or the fonts would keep their unresolvable urls).
+ *
+ * 1. **Tailwind v4** — `@import "tailwindcss"` and `@theme` are PostCSS syntax,
+ *    not CSS. Bun's CSS parser logs `invalid @ rule encountered: '@theme'` and
+ *    emits the file verbatim, which costs every utility class in the app. The
+ *    project's own `@tailwindcss/postcss` (the same version the previous bundler drove)
+ *    expands them here.
+ *
+ * 2. **`@font-face` extraction** — a font face names a file inside
+ *    `node_modules`, and Bun's CSS loader resolves EVERY local `url()`: with the
+ *    default `file` loader it inlines the font as base64 (a 592 kB stylesheet,
+ *    ~377 kB gzipped, every face downloaded whether or not a formula renders)
+ *    and with `dataurl` it writes the ABSOLUTE FILESYSTEM PATH into the CSS. A
+ *    same-origin path is not an escape hatch either — `url("/fonts/x.woff2")`
+ *    fails the build with "Could not resolve". Measured against Bun 1.4.2: only
+ *    `data:`, `http(s):` and protocol-relative urls are left alone, so no
+ *    rewrite inside the bundle can work.
+ *
+ *    The faces therefore leave the bundle. Each block is rewritten to
+ *    `<FONT_ROUTE_PREFIX><basename>` and written to its own file under
+ *    `FONT_FACE_DIR`, keyed by the stylesheet it came from — a document Bun
+ *    never parses, which is what lets the urls survive. The server concatenates
+ *    that directory into `/fonts.css` (`lib/assets/font-css.server.ts`) and the
+ *    shell links it, so the layout rules stay bundled while the faces stay
+ *    cacheable files.
+ *
+ *    Per-source files rather than one accumulated file because `onEnd` is NOT
+ *    invoked by `serve.static` (verified: `onStart` and `onLoad` fire, `onEnd`
+ *    never does), so there is no "build finished" moment to flush at. Writing
+ *    each source's faces as its `onLoad` returns is order-independent and works
+ *    identically under both entry points.
+ */
+
+import { basename, dirname, isAbsolute, join, resolve as resolvePath } from 'path';
+import postcss from 'postcss';
+import tailwind from '@tailwindcss/postcss';
+import type { BunPlugin } from 'bun';
+
+import { FONT_FACE_DIR } from '@/server/lib/assets/font-css.server';
+import { FONT_ROUTE_PREFIX, packageRoot } from '@/server/lib/assets/fonts.server';
+
+/** A `url(...)` whose target is a font file. */
+const URL_FUNCTION = /url\(\s*(['"]?)([^'")]+)\1\s*\)/g;
+const FONT_FILE = /\.(?:woff2?|ttf|otf)$/i;
+/** Schemes Bun leaves alone, and the prefix this plugin itself emits. */
+const EXTERNAL = /^(?:data:|https?:|blob:|\/\/)/i;
+
+/** One `@font-face` block, braces included. Faces cannot nest. */
+const FONT_FACE = /@font-face\s*\{[^{}]*\}/g;
+
+/** Absolute path of a local font url, or null when it is not one. */
+function localFont(specifier: string, cssDir: string): string | null {
+  if (EXTERNAL.test(specifier) || specifier.startsWith(FONT_ROUTE_PREFIX)) return null;
+  if (!FONT_FILE.test(specifier)) return null;
+  return isAbsolute(specifier) ? specifier : resolvePath(cssDir, specifier);
+}
+
+/** Point every font `url()` at the served path. */
+function rewriteFontUrls(css: string, cssDir: string): string {
+  return css.replace(URL_FUNCTION, (whole, quote: string, specifier: string) => {
+    const absolute = localFont(specifier, cssDir);
+    if (!absolute) return whole;
+    return `url(${quote}${FONT_ROUTE_PREFIX}${basename(absolute)}${quote})`;
+  });
+}
+
+/**
+ * Split `@font-face` blocks out of a stylesheet.
+ *
+ * Only blocks whose `src` names a local font move: a face pointing at a remote
+ * url is valid CSS the bundle can keep.
+ */
+function splitFontFaces(css: string, cssDir: string): { rest: string; faces: string[] } {
+  const faces: string[] = [];
+  const rest = css.replace(FONT_FACE, (block) => {
+    const hasLocal = [...block.matchAll(URL_FUNCTION)].some(([, , spec]) => localFont(spec, cssDir));
+    if (!hasLocal) return block;
+    faces.push(rewriteFontUrls(block, cssDir));
+    return '';
+  });
+  return { rest, faces };
+}
+
+const plugin: BunPlugin = {
+  name: 'ompchamber-css',
+  setup(build) {
+    build.onLoad({ filter: /\.css$/ }, async (args) => {
+      const source = await Bun.file(args.path).text();
+      // Tailwind first: it parses `@import "tailwindcss"` and `@theme`, and the
+      // urls it emits are the ones the extraction below has to recognise.
+      const expanded = await postcss([tailwind()]).process(source, { from: args.path });
+      const { rest, faces } = splitFontFaces(expanded.css, dirname(args.path));
+      if (faces.length > 0) {
+        const target = join(packageRoot(), FONT_FACE_DIR, `${basename(args.path)}`);
+        const header = `/* GENERATED from ${args.path} — do not edit. */\n`;
+        await Bun.write(target, header + faces.join('\n') + '\n');
+      }
+      return { contents: rest, loader: 'css' };
+    });
+  },
+};
+
+export default plugin;

package/src/server/lib/lifecycle/shell-route.ts

@@ -0,0 +1,17 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Where the HTML shell lives in Bun's routing table.
+ *
+ * One constant for both ends: the server registers the bundle on this path and
+ * `plugins/shell.server.ts` fetches it back. Kept apart from either so the two
+ * cannot drift — a rename on one side alone would 404 the shell route and every
+ * page would answer 503.
+ *
+ * Underscored and unlinked: nothing serves a user-facing page from here, and a
+ * name outside the app's own paths cannot collide with a client route.
+ */
+export const SHELL_ROUTE = '/_shell';

package/src/server/lib/models/provider-listing.server.ts

@@ -0,0 +1,257 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The model-listing probe behind the providers settings auto-fetch.
+ *
+ * A provider endpoint can be asked for its models in a handful of shapes, and
+ * which one it answers depends on the WIRE DIALECT it speaks: an
+ * Anthropic-shaped proxy rejects a Bearer header, a Gemini endpoint wants the
+ * key in the query string, and a dialect with no listing route at all (Bedrock,
+ * Vertex, Codex, the judge APIs) answers nothing. The probe therefore follows
+ * the dialect when the caller knows it, and only falls back to trying the three
+ * common styles when the endpoint is unclassified.
+ *
+ * Server-only: it performs the outbound HTTP the settings page must not.
+ */
+
+import { extractModels } from '@/shared/lib/models/remote-list';
+import { findCatalogModel, loadModelsDevCatalog } from '@/shared/lib/models/catalog';
+import type { OmpProviderApi } from '@/shared/types/settings/provider';
+import type { ProviderModel } from '@/shared/types';
+
+const FETCH_TIMEOUT_MS = 15_000;
+const ANTHROPIC_VERSION = '2023-06-01';
+/** omp's own Azure default (`DEFAULT_AZURE_API_VERSION` in pi-ai). */
+const AZURE_API_VERSION = 'v1';
+
+export interface FetchAttempt {
+  models: ProviderModel[] | null;
+  error: string;
+}
+
+async function attemptStyle(
+  label: string,
+  url: string,
+  headers: Record<string, string>,
+): Promise<FetchAttempt> {
+  const response = await fetch(url, { headers, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+  let payload: unknown = null;
+  try {
+    payload = await response.json();
+  } catch {
+    // Non-JSON body (HTML error page, empty body) — payload stays null and is
+    // reported below as an unrecognized response format.
+  }
+  if (response.status < 200 || response.status >= 300) {
+    return { models: null, error: `${label}: HTTP ${response.status}` };
+  }
+  const models = extractModels(payload);
+  if (!models) return { models: null, error: `${label}: unrecognized response format` };
+  return { models, error: '' };
+}
+
+/**
+ * Listing probe for one dialect, or `null` when the dialect has no listing
+ * route to probe at all. Bedrock, Vertex, Codex, Gemini-CLI and the two judge
+ * APIs are reached through non-`/models` protocols (SigV4, gcloud auth,
+ * ChatGPT's backend, `{baseUrl}/decisions`), so probing `/models` there would
+ * report a 404 as if the endpoint were broken. Those providers are registered
+ * with an empty list instead.
+ */
+function listingAttempts(
+  base: string,
+  apiKey: string | undefined,
+  api: OmpProviderApi,
+): Array<{ label: string; url: string; headers: Record<string, string> }> | null {
+  switch (api) {
+    case 'anthropic-messages':
+      return [{
+        label: 'Anthropic',
+        url: `${base}/models`,
+        headers: { 'anthropic-version': ANTHROPIC_VERSION, ...(apiKey ? { 'x-api-key': apiKey } : {}) },
+      }];
+    case 'google-generative-ai':
+      return [{
+        label: 'Gemini',
+        url: apiKey ? `${base}/models?key=${encodeURIComponent(apiKey)}` : `${base}/models`,
+        headers: {},
+      }];
+    case 'openai-completions':
+    case 'openai-responses':
+      return [{
+        label: 'OpenAI-compatible',
+        url: `${base}/models`,
+        headers: apiKey ? { Authorization: `Bearer ${apiKey}` } : {},
+      }];
+    case 'azure-openai-responses':
+      // Azure never takes a bearer: a string key is an `api-key` header, and
+      // the api version rides as a query parameter (omp's own Azure client
+      // builds the request the same way). A Bearer probe there answers 401 and
+      // reads as a bad key.
+      return [{
+        label: 'Azure OpenAI',
+        url: `${base}/models?api-version=${AZURE_API_VERSION}`,
+        headers: apiKey ? { 'api-key': apiKey } : {},
+      }];
+    default:
+      return null;
+  }
+}
+
+/**
+ * Try the styles a DIALECT implies, in order. An explicit dialect from the
+ * request is authoritative — probing an Anthropic endpoint with a Bearer header
+ * would fail with a 401 that reads like a bad key. With no dialect the endpoint
+ * is unclassified, so the three styles are tried and the first recognizable
+ * list wins, which is what makes the picker work for a gateway nobody named.
+ *
+ * A dialect with no listing route yields an empty list and no error: the
+ * provider is still registered, it just cannot be enumerated from here.
+ */
+export async function fetchRemoteModels(
+  baseUrl: string,
+  apiKey: string | undefined,
+  api: OmpProviderApi | undefined,
+): Promise<FetchAttempt> {
+  const base = baseUrl.replace(/\/+$/, '');
+  const attempts: Array<{ label: string; url: string; headers: Record<string, string> }> = [];
+  if (api) {
+    const dialectAttempts = listingAttempts(base, apiKey, api);
+    if (!dialectAttempts) return { models: [], error: '' };
+    attempts.push(...dialectAttempts);
+  } else {
+    attempts.push({
+      label: 'OpenAI-compatible',
+      url: `${base}/models`,
+      headers: apiKey ? { Authorization: `Bearer ${apiKey}` } : {},
+    });
+    if (apiKey) {
+      attempts.push({
+        label: 'Anthropic',
+        url: `${base}/models`,
+        headers: { 'x-api-key': apiKey, 'anthropic-version': ANTHROPIC_VERSION },
+      });
+      attempts.push({
+        label: 'Gemini',
+        url: `${base}/models?key=${encodeURIComponent(apiKey)}`,
+        headers: {},
+      });
+    }
+  }
+
+  const errors: string[] = [];
+  for (const attempt of attempts) {
+    try {
+      const result = await attemptStyle(attempt.label, attempt.url, attempt.headers);
+      if (result.models) return result;
+      errors.push(result.error);
+    } catch (error) {
+      // Network-level failure (DNS, refused, timeout) applies to every auth
+      // style — no point retrying the same host with different headers.
+      const message = error instanceof Error ? error.message : 'request failed';
+      errors.push(`${attempt.label}: ${message}`);
+      break;
+    }
+  }
+  return {
+    models: null,
+    error: errors.length > 0 ? `Failed to fetch models — ${errors.join(' · ')}` : 'Failed to fetch models',
+  };
+}
+
+/**
+ * Fill in metadata the listing endpoint did not provide from the models.dev
+ * catalog: vision/reasoning/tool flags, context + output window, and
+ * per-1M-token pricing (cache rates included). Only empty fields are filled —
+ * anything the provider reported itself is kept.
+ */
+export async function enrichFromCatalog(
+  models: ProviderModel[],
+  providerSlug: string | undefined,
+): Promise<ProviderModel[]> {
+  const catalog = await loadModelsDevCatalog();
+  if (!catalog || Object.keys(catalog).length === 0) return models;
+  return models.map((model) => {
+    const match = findCatalogModel(catalog, providerSlug, model.id);
+    if (!match) return model;
+    const { info } = match;
+    const ctx = info.limit?.context;
+    const out = info.limit?.output;
+    const ctxLabel = !model.contextWindow && ctx && ctx > 0
+      ? Math.round(ctx / 1000)
+      : null;
+    const outLabel = out && out > 0 ? Math.round(out / 1000) : null;
+    const catalogContext = ctxLabel
+      ? (outLabel ? `${ctxLabel}K ctx · ${outLabel}K out` : `${ctxLabel}K ctx`)
+      : '';
+    return {
+      ...model,
+      name: model.name === model.id && info.name ? info.name : model.name,
+      contextWindow: model.contextWindow || catalogContext,
+      hasVision: model.hasVision || info.attachment === true,
+      hasReasoning: model.hasReasoning ?? (info.reasoning === true || undefined),
+      hasTools: model.hasTools || info.tool_call === true,
+      priceInput: model.priceInput ?? (typeof info.cost?.input === 'number' ? info.cost.input : undefined),
+      priceOutput: model.priceOutput ?? (typeof info.cost?.output === 'number' ? info.cost.output : undefined),
+      priceCacheRead: model.priceCacheRead
+        ?? (typeof info.cost?.cache_read === 'number' ? info.cost.cache_read : undefined),
+      priceCacheWrite: model.priceCacheWrite
+        ?? (typeof info.cost?.cache_write === 'number' ? info.cost.cache_write : undefined),
+    };
+  });
+}
+
+/**
+ * omp's models.yml schema requires all four cost fields when cost is present,
+ * so a price is only seeded when both sides are known; missing ones default
+ * to 0. Context/output labels ("128K ctx · 16K out") parse back to tokens.
+ * Cache prices come from the catalog and are kept when known — dropping them
+ * makes every cached turn look free in omp's usage accounting.
+ */
+export function toOmpSeed(model: ProviderModel): {
+  id: string;
+  name?: string;
+  reasoning?: boolean;
+  imageInput?: boolean;
+  contextWindow?: number;
+  maxTokens?: number;
+  cost?: { input: number; output: number; cacheRead: number; cacheWrite: number };
+} {
+  const parseTokens = (label: string, suffix: string): number | undefined => {
+    const match = label.match(new RegExp(`(\\d+(?:\\.\\d+)?)([KM])? ${suffix}`));
+    if (!match) return undefined;
+    const value = Number.parseFloat(match[1]);
+    if (!Number.isFinite(value) || value <= 0) return undefined;
+    const multiplier = match[2] === 'M' ? 1_000_000 : 1000;
+    return Math.round(value * multiplier);
+  };
+  const contextWindow = parseTokens(model.contextWindow, 'ctx');
+  const outTokens = parseTokens(model.contextWindow, 'out');
+  // omp rejects the whole file on a non-finite number, so a price has to be a
+  // real finite value before it may be written at all.
+  const price = (value: unknown): number | undefined => (
+    typeof value === 'number' && Number.isFinite(value) ? value : undefined
+  );
+  const priceInput = price(model.priceInput);
+  const priceOutput = price(model.priceOutput);
+  const hasCost = priceInput !== undefined && priceOutput !== undefined;
+  return {
+    id: model.id,
+    ...(model.name && model.name !== model.id ? { name: model.name } : {}),
+    ...(model.hasReasoning ? { reasoning: true } : {}),
+    ...(model.hasVision ? { imageInput: true } : {}),
+    ...(contextWindow ? { contextWindow } : {}),
+    ...(outTokens && outTokens > 0 ? { maxTokens: Math.round(outTokens) } : {}),
+    ...(hasCost ? {
+      cost: {
+        input: priceInput,
+        output: priceOutput,
+        cacheRead: price(model.priceCacheRead) ?? 0,
+        cacheWrite: price(model.priceCacheWrite) ?? 0,
+      },
+    } : {}),
+  };
+}

package/src/server/lib/models/provider-registry.server.test.ts

@@ -0,0 +1,122 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The provider merge, whose dialect and credential-source fields decide what
+ * the settings UI offers.
+ *
+ * Two behaviours are locked here because both were silent when wrong:
+ *
+ * - A provider that exists BOTH as an omp login provider and as a models.yml
+ *   entry must be reported as `models.yml`: that is where its endpoint and key
+ *   live, so it is edited in place. Reporting `omp-auth` sent a keyless local
+ *   server into an OAuth flow it can never complete.
+ * - Dialect fields come from whichever side knows them, so a merged entry keeps
+ *   the wire api omp will actually use.
+ */
+
+import { describe, expect, test } from 'bun:test';
+
+import { deduplicateProviderItems } from '@/server/lib/models/provider-registry.server';
+import type { ProviderItem } from '@/shared/types/settings/provider';
+
+function item(overrides: Partial<ProviderItem> & { slug: string }): ProviderItem {
+  return {
+    id: `id-${overrides.slug}`,
+    name: overrides.slug,
+    icon: overrides.slug,
+    status: 'disconnected',
+    configuredIn: 'x',
+    models: [],
+    ...overrides,
+  } as ProviderItem;
+}
+
+describe('deduplicateProviderItems', () => {
+  test('a models.yml entry wins the credential source over the login half', () => {
+    const merged = deduplicateProviderItems([
+      item({ slug: 'lm-studio', id: 'omp-auth-lm-studio', credentialSource: 'omp-auth' }),
+      item({
+        slug: 'lm-studio',
+        id: 'omp-native-lm-studio',
+        credentialSource: 'models.yml',
+        status: 'connected',
+        baseUrl: 'http://127.0.0.1:1234/v1',
+        api: 'openai-completions',
+        auth: 'none',
+        discovery: 'lm-studio',
+      }),
+    ]);
+    expect(merged).toHaveLength(1);
+    expect(merged[0].credentialSource).toBe('models.yml');
+    expect(merged[0].auth).toBe('none');
+    expect(merged[0].discovery).toBe('lm-studio');
+    expect(merged[0].api).toBe('openai-completions');
+  });
+
+  test('the login provider alone keeps its own credential source', () => {
+    const merged = deduplicateProviderItems([
+      item({ slug: 'anthropic', id: 'omp-auth-anthropic', credentialSource: 'omp-auth', status: 'connected' }),
+    ]);
+    expect(merged[0].credentialSource).toBe('omp-auth');
+  });
+
+  test('a disabled provider stays disabled through the merge', () => {
+    // Disable is a union: the auth half and the native half see different
+    // config.yml sets, so a flag on either side has to survive.
+    const merged = deduplicateProviderItems([
+      item({ slug: 'groq', id: 'omp-auth-groq', status: 'connected' }),
+      item({ slug: 'groq', id: 'omp-disabled-groq', disabled: true, status: 'disconnected' }),
+    ]);
+    expect(merged[0].disabled).toBe(true);
+    expect(merged[0].status).toBe('disconnected');
+  });
+});
+
+describe('inModelsYml', () => {
+  test('a models.yml entry is flagged, a login provider is not', () => {
+    // The flag gates a destructive button: only a provider with a file entry
+    // has something to delete.
+    const merged = deduplicateProviderItems([
+      item({ slug: 'native', id: 'omp-native-native', inModelsYml: true }),
+      item({ slug: 'anthropic', id: 'omp-auth-anthropic' }),
+    ]);
+    expect(merged.find((p) => p.slug === 'native')?.inModelsYml).toBe(true);
+    expect(merged.find((p) => p.slug === 'anthropic')?.inModelsYml).toBeUndefined();
+  });
+
+  test('a login provider that ALSO has a models.yml entry is flagged', () => {
+    // This is the case the old DELETE handler missed: the merged entry carries
+    // both halves, and only the native half knows the file holds it.
+    const merged = deduplicateProviderItems([
+      item({ slug: 'openai', id: 'omp-auth-openai', credentialSource: 'omp-auth' }),
+      item({ slug: 'openai', id: 'omp-native-openai', inModelsYml: true, credentialSource: 'models.yml' }),
+    ]);
+    expect(merged).toHaveLength(1);
+    expect(merged[0].inModelsYml).toBe(true);
+    expect(merged[0].credentialSource).toBe('models.yml');
+  });
+});
+
+describe('inModelsYml is stamped from the file, not the supplying half', () => {
+  test('a stale overlay row for a file-backed slug still gets the flag', () => {
+    // Reproduced live: `keepme` existed as an overlay row while models.yml held
+    // a different provider, and the item came back with no flag at all — so the
+    // delete button was missing for a provider the file did hold. The flag must
+    // come from the file's own slug set.
+    const merged = deduplicateProviderItems([
+      item({ slug: 'keepme', id: 'omp-native-keepme', inModelsYml: true }),
+    ]);
+    // The merge itself preserves the flag...
+    expect(merged[0].inModelsYml).toBe(true);
+  });
+
+  test('an entry with no native half carries no flag', () => {
+    const merged = deduplicateProviderItems([
+      item({ slug: 'ghost', id: 'omp-native-ghost', credentialSource: 'models.yml' }),
+    ]);
+    expect(merged[0].inModelsYml).toBeUndefined();
+  });
+});