thinkpool-pair 0.7.177 → 0.7.179

package/account.mjs

@@ -16,7 +16,7 @@ import os from 'node:os'
 import { saveAuth, loadAuth, loadDirs, bindDir, loadServed, rememberServed, loadDefaultDir, saveDefaultDir, claudeRecentProjectDir } from './auth-store.mjs'
 import { isSafeToRestart } from './update-gate.mjs'
 import { makeThrottledTrack, presenceSelfEchoVerdict } from './presence.mjs'
-import { publicKeyB64, announceProviders, listProviders, addProvider, removeProvider, unseal } from './providers.mjs'
+import { publicKeyB64, announceProviders, listProviders, addProvider, addProviderModel, removeProvider, unseal } from './providers.mjs'
 import { supervisorServes } from './serve-consent.mjs'
 import { resolveServeDir } from './serve-dir.mjs'
 import { pairKeyFor, pairTopic, CROSSROOM_BUS } from './cross-terminal.mjs'
@@ -579,6 +579,17 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     if (r.ok) { pushPresence(); process.stderr.write(`\n  ◆ provider added (${String(fields?.name || '').slice(0, 40)}) — re-announced.\n`) }
     provReply('provider-add-res', { nonce, ok: r.ok, error: r.ok ? undefined : r.error, id: r.ok ? r.id : undefined })
   })
+  // provider-add-model {id, model, name?, nonce, jwt} → clone the source row's
+  // baseUrl + key HOST-SIDE onto a new model, re-announce. Deliberately carries NO
+  // `sealed` envelope: the key never leaves the bridge for this op, so there is
+  // nothing to decrypt. Owner-authed exactly like its siblings.
+  acct.on('broadcast', { event: 'provider-add-model' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    if (!(await isOwner(payload?.jwt))) return provReply('provider-add-model-res', { nonce, ok: false, error: 'unauthorized' })
+    const r = addProviderModel({ id: payload?.id, model: payload?.model, name: payload?.name })
+    if (r.ok) { pushPresence(); process.stderr.write(`\n  ◆ model added to an existing provider (${String(payload?.model || '').slice(0, 40)}) — re-announced.\n`) }
+    provReply('provider-add-model-res', { nonce, ok: r.ok, error: r.ok ? undefined : r.error, id: r.ok ? r.id : undefined })
+  })
   // provider-remove {id, nonce, jwt} → remove (built-in refuses), re-announce.
   acct.on('broadcast', { event: 'provider-remove' }, async ({ payload }) => {
     const nonce = payload?.nonce

package/bridge.mjs

@@ -45,8 +45,8 @@ import { createPermNotifier, shouldNotifyTurnDone, permissionSummary, clipSummar
 // resolveProviderEnv(id) → {ANTHROPIC_BASE_URL,ANTHROPIC_AUTH_TOKEN,ANTHROPIC_MODEL} for a
 // registered custom provider, or null for the built-in/unknown (leave the default env intact).
 // Multi-provider BYOK slice 1: a lane spawned with a `provider` id runs on that endpoint.
-import { resolveProviderEnv, providerNameMap, publicKeyB64, announceProviders, listProviders, addProvider, removeProvider, unseal } from './providers.mjs'
-import { validateProviderSwitch, BUILTIN_PROVIDER } from './switch-provider.mjs'
+import { resolveProviderEnv, providerNameMap, publicKeyB64, announceProviders, listProviders, addProvider, removeProvider, unseal, effectiveLaneModel, sameProviderEnv, providerModel } from './providers.mjs'
+import { validateProviderSwitch, providerSwitchPlan, BUILTIN_PROVIDER } from './switch-provider.mjs'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
 import { startClaudeSession } from './claude-session.mjs'
@@ -1568,18 +1568,28 @@ function worktreeSnapshot(cwd) {
 // rolling log replays to joiners and survives bridge restarts (session-store).
 function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rolePrompt, flowSessionId, flowTaskKey, cwd, reviewSliceRoots, openedAt, defer, provider, carryRecap }) {
   if (sessions.has(id)) return
+  // The lane's EFFECTIVE model — computed ONCE and used for BOTH the truthful display
+  // label (entry.model) and the SDK's `model` option below. These used to be computed
+  // separately: the label resolved the provider's configured model while the SDK got the
+  // RAW inherited `model`, which OVERRIDES ANTHROPIC_MODEL from resolveProviderEnv. A GLM
+  // lane opened while focused on Fable therefore showed `glm-4.6` and sent
+  // `claude-fable-5` → 400 [1211][Unknown Model]. One value, one truth.
+  // undefined → omit the SDK option entirely and let the provider env/endpoint default.
+  const laneModel = effectiveLaneModel({ provider, model, configuredModel: resolveProviderEnv(provider)?.ANTHROPIC_MODEL })
   // spawnedBy: set when this lane was Dispatched (spawn_terminal). Restored from the
   // session store so the Ensemble flag survives a bridge restart (else a respin
   // stripped it and the lane reverted to a plain tab — the t6 "no chip" bug).
   const entry = { cmd: 'claude', kind: 'structured', log: Array.isArray(log) ? log.slice(-STRUCTURED_LOG_MAX) : [], pending: new Map(), session: null, recovered: false, commands: Array.isArray(commands) ? commands : undefined, mode,
-    // model: truthful active-model label. When this lane runs on a custom (non-anthropic)
-    // registered provider the SDK id is impersonated (see the onEvent guard below), so seed
-    // from THAT provider's CONFIGURED model — glm-5.2, not a Claude label — before any turn.
-    // No configured model → the provider's name, never a false Claude id. Built-in Anthropic
-    // keeps the passed model. Keyed on the lane's own provider id, not the bridge default.
+    // model: truthful active-model label — now the SAME `laneModel` the SDK is given, so the
+    // chip cannot disagree with the wire. When this lane runs on a custom (non-anthropic)
+    // registered provider the SDK id is impersonated (see the onEvent guard below), so
+    // laneModel resolves from THAT provider's CONFIGURED model — glm-4.6, not a Claude label.
+    // No configured model → the provider's NAME, never a false Claude id (an inherited
+    // claudeish id was dropped upstream by effectiveLaneModel; it must not sneak back in as a
+    // label fallback here). Built-in Anthropic keeps the passed model.
     model: (!provider || provider === 'anthropic')
-      ? (model || null)
-      : (resolveProviderEnv(provider)?.ANTHROPIC_MODEL || providerNameMap()[provider] || model || provider),
+      ? (laneModel || null)
+      : (laneModel || providerNameMap()[provider] || provider),
     provider: provider || null, spawnedBy: spawnedBy || undefined, flowSessionId: flowSessionId || null, flowTaskKey: flowTaskKey || null, cwd: cwd || null,
     // Stable creation order — persisted so a bridge restart restores tabs in the SAME
     // order (not readdir/filesystem order). Legacy recs (no openedAt) derive it from the
@@ -2095,7 +2105,15 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
   // is silently lost (the 2026-07-02 auto-resume bug). Empty string → nothing to carry.
   entry.pendingRecap = (typeof carryRecap === 'string' && carryRecap.trim()) ? carryRecap : null
   entry.session = startClaudeSession({
-    cwd: cwd || process.cwd(), model, resume, mode, rolePrompt,
+    // laneModel, NOT the raw `model` param: the SDK's `model` option OVERRIDES the
+    // ANTHROPIC_MODEL supplied by resolveProviderEnv() in `env` below, so an inherited
+    // Claude id here defeats the whole per-provider env. undefined → option omitted.
+    cwd: cwd || process.cwd(), model: laneModel, resume, mode, rolePrompt,
+    // Haiku composer-prefill is an Anthropic-subscription freebie. This lane's env carries a
+    // CUSTOM provider's base URL + auth token, so on a non-anthropic lane that call would bill
+    // the user's own BYOK key for a feature they didn't ask for (and 400 on strict providers).
+    // Same lane-provider key as the model-truth guard in onEvent below.
+    suggest: !provider || provider === 'anthropic',
     // Live ROOM NOW tail appended to every turn's <system-reminder>: sibling lanes
     // (same registries the read_terminal roster uses) + active git worktrees (only
     // when >1 — a solo checkout has nothing to coordinate about). Keeps every lane
@@ -2455,7 +2473,16 @@ function respawnStructured(id, provider) {
   const s = sessions.get(id)
   if (!s) return false
   // Capture the lane's identity for re-open (NOT resume — fresh SDK session).
-  const { model, log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt } = s
+  // NOTE the deliberate absence of `model`: a respawn crosses a provider boundary,
+  // and the old lane's model id means nothing on the new backend. Carrying it sent
+  // `glm-4.6` to Anthropic on a GLM→Claude switch, and — once effectiveLaneModel
+  // started honouring explicit non-Claude ids — pinned a GLM→GLM-5.2 switch back to
+  // glm-4.6, so the lane truthfully labelled the model it was wrongly still running
+  // (Max, 2026-07-09: "selecting 5.2 still shows 4.6"). Omitting it lets
+  // openStructured seed from the TARGET provider's configured model, which is the
+  // only model this lane was ever asked for. A same-env model change never reaches
+  // here — that path is an in-place setModel (see provider-switch).
+  const { log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt } = s
   // Context-carry (2026-07-08): a provider switch is not an SDK resume — the new backend
   // starts blank mid-conversation. Synthesize a plain-text recap from the VISIBLE log NOW
   // (before teardown) and hand it to the fresh session as its first turn so the agent
@@ -2473,7 +2500,33 @@ function respawnStructured(id, provider) {
   // sessionData() (provider included) synchronously on open, so a bridge restart
   // restores the lane on its CURRENT provider, not the original — and its next
   // announce carries the new provider badge (additive {id,name} projection).
-  openStructured({ id, model, provider, log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt, carryRecap })
+  openStructured({ id, provider, log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt, carryRecap })
+  return true
+}
+
+/**
+ * Switch a lane between two providers that share an endpoint AND a key — i.e. two
+ * registry rows for the same z.ai/OpenRouter/proxy account, differing only in model.
+ *
+ * Nothing about the child's env changes except ANTHROPIC_MODEL, and the SDK's `model`
+ * option overrides that anyway, so there is no reason to tear the agent down. setModel()
+ * re-creates the query with `resume`, which keeps the SDK context (and defers a mid-turn
+ * switch to turn-end). The lane keeps its memory; only the model moves.
+ *
+ * Returns false when the lane is gone or the target has no configured model — the caller
+ * falls back to a full respawn rather than leaving the lane on a stale model.
+ */
+function switchModelInPlace(id, provider) {
+  const s = sessions.get(id)
+  if (!s?.session) return false
+  const nextModel = providerModel(provider)
+  if (!nextModel) return false            // no model to switch TO → let respawn seed the env
+  s.provider = provider || null
+  s.model = nextModel                     // truthful label; announce reads this
+  try { s.session.setModel(nextModel) } catch { return false }
+  // Persist through the entry's own closure (sessionData is private to openStructured),
+  // so a bridge restart restores the lane on the row it was switched TO, not the origin.
+  try { s.flush?.() } catch { /* disk full / racing close — the debounced save still runs */ }
   return true
 }
 
@@ -2935,7 +2988,9 @@ channel
   // projection the client already renders from #219). Spec: docs/specs/2026-07-05-provider-switch.md.
   .on('broadcast', { event: 'provider-switch' }, async ({ payload }) => {
     const nonce = payload?.nonce
-    const reply = (ok, error) => channel.send({ type: 'broadcast', event: 'provider-switch-res', payload: { nonce, ok, ...(error ? { error } : {}) } })
+    // `restarted` (0.7.179+): did the agent lose its context? false for a same-key model
+    // change, true for a real provider change. Older clients ignore the extra field.
+    const reply = (ok, error, restarted) => channel.send({ type: 'broadcast', event: 'provider-switch-res', payload: { nonce, ok, ...(error ? { error } : {}), ...(restarted === undefined ? {} : { restarted }) } })
     // AUTH first — anon / non-participant / bad jwt → ok:false 'unauthorized'. No lane
     // state is touched for a rejected sender (fail closed before any lookup).
     if (!(await isRoomParticipant(payload?.jwt))) return reply(false, 'unauthorized')
@@ -2950,12 +3005,32 @@ channel
       registeredIds: listProviders().map((p) => p.id),
     })
     if (!v.ok) return reply(false, v.error)
-    if (v.noop) return reply(true)   // nothing to do; idempotent ok (UI guarantees a change)
     const target = payload?.provider === BUILTIN_PROVIDER ? null : payload?.provider
+
+    // The three-way choice is pure + unit-tested (switch-provider.mjs). Two registry rows
+    // on ONE endpoint + key (Max's glm-4.6 and glm-5.2 on the same z.ai account) are the
+    // same provider asked for a different model: the child's env is identical, so tearing
+    // the agent down and recapping it is pure loss. Only a different endpoint/key earns a
+    // respawn. An in-place attempt that fails (lane raced closed, setModel threw) falls
+    // back to the respawn rather than leaving the lane on a stale model.
+    const plan = providerSwitchPlan({
+      provider: payload?.provider,
+      currentProvider: s.provider,
+      sameEnv: sameProviderEnv(s.provider, target),
+      targetModel: providerModel(target),
+    })
+    if (plan.action === 'noop') return reply(true, undefined, false)   // idempotent (UI guarantees a change)
+
+    if (plan.action === 'in-place' && switchModelInPlace(term, target)) {
+      process.stderr.write(`\n  ◆ lane ${String(term).slice(0, 8)} switched model → ${providerModel(target)} (same key, context kept).\n`)
+      announce()
+      return reply(true, undefined, false)
+    }
+
     const done = respawnStructured(term, target)
     if (!done) return reply(false, 'no such live lane')   // raced closed between the lookup + respawn
     process.stderr.write(`\n  ◆ lane ${String(term).slice(0, 8)} switched provider → ${target || 'anthropic'} (memory reset, transcript kept).\n`)
-    reply(true)
+    reply(true, undefined, true)
   })
   .subscribe(status => {
     if (status === 'SUBSCRIBED') {

package/claude-session.mjs

@@ -176,6 +176,8 @@ const simplifyBlocks = (blocks = []) => blocks.map((b) => {
  * @param {(req)=>Promise<'allow'|'deny'>} o.requestPermission
  *        called for EVERY tool call with { id, toolName, input, risk };
  *        resolve 'allow'/'deny'. (Caller implements any auto-allow policy.)
+ * @param {boolean=} o.suggest          allow the Haiku composer-prefill fallback.
+ *        MUST be false on a lane running a custom provider — see haikuSuggest.
  * @returns {{ sendTurn(text), abort(), end(), readonly sessionId }}
  */
 const MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
@@ -203,7 +205,7 @@ const TP_ROOM_REMINDER = [
   'Verify before claiming done — show runtime evidence you produced, not "should work, go test it".',
 ].join(' ')
 
-export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, didSpawnTarget = null, rolePrompt, blockSubagents = false, onSubmitPlan = null, onLaneDone = null, onReviewVerdict = null, reviewGate = null, lazy = false, roomContext = null }) {
+export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, didSpawnTarget = null, rolePrompt, blockSubagents = false, onSubmitPlan = null, onLaneDone = null, onReviewVerdict = null, reviewGate = null, lazy = false, roomContext = null, suggest = true }) {
   // Per-turn reminder + live ROOM NOW tail. roomContext (bridge-supplied) returns the
   // room's CURRENT state — sibling lanes, active git worktrees — or null. The static
   // rules keep the agent aware of the room's FEATURES; the live tail keeps it aware of
@@ -746,7 +748,16 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   // (opts.env carries the OAuth — no API key needed), but as a BARE model call: no
   // settingSources, no MCP, no tools — so it's a fast cold call, not a full session boot.
   // Fed only `lastAssistantText` (trimmed). Never blocks a turn; any failure is silent.
+  //
+  // BUILT-IN ANTHROPIC PATH ONLY (`suggest`). On a lane running a registered custom
+  // provider, opts.env carries that provider's ANTHROPIC_BASE_URL + ANTHROPIC_AUTH_TOKEN —
+  // so this hardcoded `claude-haiku-4-5` call would spend the USER'S OWN BYOK credit on a
+  // composer prefill they never asked for, at whatever (wrong, flagship) model the endpoint
+  // maps the unknown id to. z.ai silently serves glm for any `claude-*` id, which is exactly
+  // why this went unnoticed; a stricter provider 400s. This is an Anthropic-subscription
+  // freebie — it does not get a per-provider small model, it gets switched off.
   const haikuSuggest = async () => {
+    if (!suggest) return
     const seed = (lastAssistantText || '').trim().slice(-1500)
     if (!seed || closed) return
     const ac2 = new AbortController()

package/event-id.mjs

@@ -215,6 +215,14 @@ export function summarizeUsage(logEvents) {
   return { turns: results.length, per: [...per.values()], totalIn, totalOut, totalCost, haveCost }
 }
 
+// Does this model id name a Claude/Anthropic model? Used by two callers with the
+// same question and NO room for a second opinion:
+//   • usageReportLine — token/cost reporting is Claude-only.
+//   • providers.mjs/effectiveLaneModel — a lane on a CUSTOM (non-anthropic) provider
+//     must never be handed an inherited Claude id; the endpoint 400s on it.
+// Exported (not a local const) precisely so there is exactly one definition.
+export const claudeish = (m) => /claude|anthropic|opus|sonnet|haiku|fable/i.test(String(m || ''))
+
 // model id → friendly label for the /usage report: claude-opus-4-8 → "Opus 4.8".
 // Bridge-local twin of the web's prettyModel (structured.jsx); falls back to the raw id.
 export function prettyModelId (m) {
@@ -229,7 +237,6 @@ export function prettyModelId (m) {
 // handler is a thin wrapper: ctlLine(usageReportLine(s.model, s.log)). `sessionModel` is
 // the resolved model id the /model state tracks; `logEvents` the session's retained log.
 export function usageReportLine (sessionModel, logEvents) {
-  const claudeish = (m) => /claude|anthropic|opus|sonnet|haiku|fable/i.test(String(m || ''))
   const sum = summarizeUsage(logEvents)
   // Gate (Max's ask: "make /usage work if users bridge is on claude llms"). The Code bridge
   // runs the Claude Agent SDK, so a normal lane IS a Claude model — but a session pointed at a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.177",
+  "version": "0.7.179",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/providers.mjs

@@ -42,6 +42,7 @@ import os from 'node:os'
 import fs from 'node:fs'
 import path from 'node:path'
 import crypto from 'node:crypto'
+import { claudeish } from './event-id.mjs'
 
 const DIR       = path.join(os.homedir(), '.thinkpool-pair')
 const REG_FILE  = path.join(DIR, 'providers.json')
@@ -180,6 +181,59 @@ export function addProvider(fields) {
   return { ok: true, id }
 }
 
+/**
+ * Add ANOTHER model to an already-registered provider — without the user ever
+ * retyping the key (Max, 2026-07-09). The registry's unit is a {provider,model}
+ * pair, not a provider, and `buildSwitchMenu` already groups rows by brand
+ * ("Z.ai GLM 4.5" / "Z.ai GLM Air" collapse under one "z.ai" header) — so a new
+ * model is simply a CLONE of the source row with a fresh id and a new model.
+ * No schema change, no new menu shape.
+ *
+ * The clone copies `key` + `baseUrl` HOST-SIDE from the row that already holds
+ * them, so no key material crosses the wire for this operation — the caller's
+ * RPC carries no `sealed` envelope at all (see account.mjs `provider-add-model`).
+ *
+ * @param {{id:string, model:string, name?:string}} fields  id = the SOURCE provider
+ * @returns {{ok:true,id:string} | {ok:false,error:string}}
+ */
+export function addProviderModel({ id, model, name } = {}) {
+  if (!id || id === BUILTIN_ID) return { ok: false, error: 'the built-in Anthropic provider has no key to reuse' }
+  if (!model || typeof model !== 'string' || !model.trim()) return { ok: false, error: 'model is required' }
+  const arr = loadProviders()
+  const src = arr.find((p) => p.id === id)
+  if (!src) return { ok: false, error: 'no such provider' }
+
+  const nextModel = String(model).trim()
+  // An endpoint+model pair is the identity of a row — a second row for the same
+  // pair would render as a duplicate menu entry that switches to nothing new.
+  if (arr.some((p) => p.baseUrl === src.baseUrl && (p.model || '') === nextModel)) {
+    return { ok: false, error: `${nextModel} is already registered on this provider` }
+  }
+
+  const nextName = (name && String(name).trim()) || `${brandOf(src.name)} ${nextModel}`.trim()
+  const newId = crypto.randomUUID()
+  arr.push({
+    id: newId,
+    name: nextName,
+    baseUrl: src.baseUrl,   // copied host-side
+    model: nextModel,
+    key: src.key,           // copied host-side — never re-sent by the client
+    addedAt: Date.now(),
+  })
+  saveProviders(arr)
+  return { ok: true, id: newId }
+}
+
+/**
+ * First name token — the brand, matching code-constants.js `brandKey`. "Z.ai GLM
+ * 4.5" → "Z.ai". Used to derive a default name for a cloned row so the switch
+ * menu groups it under the SAME header as its source.
+ */
+function brandOf(name) {
+  const first = String(name || '').trim().split(/\s+/)[0]
+  return first || 'Provider'
+}
+
 /**
  * Remove a provider by id. The built-in `anthropic` refuses.
  * @returns {{ok:true} | {ok:false,error:string}}
@@ -193,6 +247,55 @@ export function removeProvider(id) {
   return { ok: true }
 }
 
+/* ── the provider GROUP token (Max, 2026-07-09) ──────────────────────────
+   Two registry rows are the SAME PROVIDER when they point at the same endpoint
+   with the same key — they differ only in which model they ask it for. That is
+   the identity that matters: it decides whether the switch menu unites them, and
+   whether switching between them needs a fresh agent (it doesn't — same env).
+
+   Before this, the clients grouped on `brandKey(name)`: the first whitespace token
+   of the user's DISPLAY NAME, lowercased. "GLM" → `glm`, "GLM-5.2" → `glm5.2`, so
+   Max's two models on one z.ai key rendered as two unrelated providers, each
+   threatening to restart his agent. Identity was being derived from a label.
+
+   `group` is a one-way digest of baseUrl + key, NOT either value. It is safe on
+   the announce (which deliberately carries neither): a 12-hex prefix reveals only
+   *sameness*, and preimaging it means preimaging the key. The built-in Anthropic
+   has no stored key, so it gets the literal 'anthropic' — it groups with nothing.
+
+   NUL-separated so ("https://a.io/x", "key") and ("https://a.io/xkey", "") can't
+   collide into one group. */
+export function providerGroup(p) {
+  if (!p || p.id === BUILTIN_ID) return BUILTIN_ID
+  return crypto.createHash('sha256')
+    .update(`${p.baseUrl || ''}\0${p.key || ''}`)
+    .digest('hex')
+    .slice(0, 12)
+}
+
+/**
+ * Do these two registered providers share an endpoint AND a key? Then a switch
+ * between them changes only ANTHROPIC_MODEL — the child's env is otherwise
+ * identical, so the live session can just setModel() and keep its context
+ * instead of being torn down and recapped. Built-in ↔ custom is never same-env.
+ */
+export function sameProviderEnv(idA, idB) {
+  const a = effectiveId(idA), b = effectiveId(idB)
+  if (a === BUILTIN_ID || b === BUILTIN_ID) return a === b   // both built-in, or one of them
+  const arr = loadProviders()
+  const pa = arr.find((x) => x.id === a), pb = arr.find((x) => x.id === b)
+  if (!pa || !pb) return false                                // unknown id → never same
+  return providerGroup(pa) === providerGroup(pb)
+}
+
+const effectiveId = (p) => (!p || p === BUILTIN_ID) ? BUILTIN_ID : String(p)
+
+/** The model a registered provider is configured to ask for (null for built-in/unknown). */
+export function providerModel(id) {
+  if (!id || id === BUILTIN_ID) return null
+  return loadProviders().find((x) => x.id === id)?.model || null
+}
+
 // ── read-only projections (never expose the raw key) ────────────────────
 /** Masked list for the dashboard: keyHint = last 4 chars only. Built-in first. */
 export function listProviders() {
@@ -200,15 +303,16 @@ export function listProviders() {
     id: p.id,
     name: p.name,
     model: p.model || null,
+    group: providerGroup(p),
     keyHint: keyHint(p.key),
   }))
-  return [{ id: BUILTIN_ID, name: 'Anthropic (Claude)', model: null, keyHint: null }, ...custom]
+  return [{ id: BUILTIN_ID, name: 'Anthropic (Claude)', model: null, group: BUILTIN_ID, keyHint: null }, ...custom]
 }
 
 /** Name-only projection for the announce/presence payload — NO key, NO baseUrl. */
 export function announceProviders() {
-  const custom = loadProviders().map((p) => ({ id: p.id, name: p.name, model: p.model || null }))
-  return [{ id: BUILTIN_ID, name: 'Anthropic (Claude)', model: null }, ...custom]
+  const custom = loadProviders().map((p) => ({ id: p.id, name: p.name, model: p.model || null, group: providerGroup(p) }))
+  return [{ id: BUILTIN_ID, name: 'Anthropic (Claude)', model: null, group: BUILTIN_ID }, ...custom]
 }
 
 /**
@@ -244,3 +348,35 @@ export function resolveProviderEnv(id) {
   if (p.model) env.ANTHROPIC_MODEL = p.model
   return env
 }
+
+/**
+ * The ONE model id a lane actually runs on — used for BOTH the display label and the
+ * SDK's `model` option, which is the whole point: they drifted, and the SDK option
+ * silently OVERRIDES the ANTHROPIC_MODEL env resolveProviderEnv() supplies.
+ *
+ * The bug this closes: a new lane inherits the focused lane's model (client-side), so
+ * opening a GLM lane while on Fable sent `model: 'claude-fable-5'` to
+ * https://api.z.ai/api/anthropic → `API Error: 400 [1211][Unknown Model]`, while the
+ * chip truthfully read `glm-4.6`. Label and wire disagreed; the wire lost.
+ *
+ * Rules (custom = any registered, non-built-in provider):
+ *   • built-in anthropic / no provider → passthrough, unchanged. Default path is sacred.
+ *   • custom + model equals the configured model  → honour it.
+ *   • custom + model is a Claude id (claudeish)   → DROP it. It leaked across a provider
+ *       boundary and the endpoint cannot serve it. Fall back to the configured model, or
+ *       to undefined (no `model` option → the env / endpoint default decides).
+ *   • custom + explicit non-Claude model (glm-4.5, deepseek-…) → honour it. This is a
+ *       deliberate pick (/model, spawn_terminal({provider, model})), not an inheritance leak.
+ *
+ * NEVER returns an inherited Claude id on a custom provider — that is the invariant.
+ * Pure: `configuredModel` is passed in (not read from disk) so it is directly testable.
+ *
+ * @param {{provider?:string|null, model?:string|null, configuredModel?:string|null}} a
+ * @returns {string|undefined}  the model to send; undefined → omit the SDK `model` option
+ */
+export function effectiveLaneModel({ provider, model, configuredModel } = {}) {
+  if (!provider || provider === BUILTIN_ID) return model || undefined
+  if (model && model === configuredModel) return model
+  if (model && !claudeish(model)) return model
+  return configuredModel || undefined
+}

package/switch-provider.mjs

@@ -55,3 +55,30 @@ export function validateProviderSwitch({ provider, currentProvider, registeredId
   const noop = effectiveProvider(id) === effectiveProvider(currentProvider)
   return { ok: true, noop }
 }
+
+/**
+ * WHAT KIND of switch is this? The pure half of the provider-switch handler, so the
+ * three-way choice is testable without booting a bridge (Max, 2026-07-09).
+ *
+ *   'noop'     — same provider; nothing to do.
+ *   'in-place' — a different registry row on the SAME endpoint + key (two models on
+ *                one z.ai account). Only ANTHROPIC_MODEL differs, so the live session
+ *                just setModel()s and KEEPS ITS CONTEXT. Requires a model to switch to.
+ *   'respawn'  — a genuinely different endpoint or key. Fresh agent, transcript kept,
+ *                recap carried. This is the only case that costs the user their context.
+ *
+ * `sameEnv` is supplied by the caller (providers.mjs `sameProviderEnv`) rather than
+ * imported, so this module stays free of registry/disk state — the whole point of it.
+ * A same-env target with NO configured model falls back to 'respawn': openStructured
+ * would then seed the model from the target's env, which an in-place setModel cannot do.
+ *
+ * @param {{provider:string, currentProvider?:string|null, sameEnv:boolean, targetModel?:string|null}} input
+ * @returns {{action:'noop'|'in-place'|'respawn', restarted:boolean}}
+ */
+export function providerSwitchPlan({ provider, currentProvider, sameEnv, targetModel }) {
+  if (effectiveProvider(provider) === effectiveProvider(currentProvider)) {
+    return { action: 'noop', restarted: false }
+  }
+  if (sameEnv && targetModel) return { action: 'in-place', restarted: false }
+  return { action: 'respawn', restarted: true }
+}