feat(providers,schema,engine,workbench): retire the default model — user-selected model sets from provider model lists

AGENTS.md

@@ -92,6 +92,7 @@ Large rewrites are encouraged when they're the right fix — replace subsystems
 - Keep table-definition / schema modules free of hooks and browser APIs so they stay importable anywhere.
 - Directory names must describe responsibility, not incidental data. For example, a sidebar footer belongs with sidebar/workbench presentation, not in a `host/` folder just because it displays host state; a layout adapter belongs under layout, not a one-file pseudo-subsystem.
 - Terminology: the product term **Thread** is the code/wire term **`session`** — the rename is UI/i18n-only. Never rename `session` in wire or code identifiers.
+- Terminology: **"provider" means the account/service** (DeepSeek, OpenRouter) — never the agent. The agent is a **Harness**, so client-side UI text and identifiers use that (`selectableHarnesses`, `onHarnessChange`, `lastHarness`); `AgentKind` and every wire/daemon term stay as they are. The two meanings used to collide in adjacent UI — the composer's "provider" picker chose the *agent* while the Providers settings page meant accounts. `groupModelsByProvider` is the genuine exception: it groups by *model* provider.
 
 ## Tooling And Aliases
 

apps/daemon/src/__tests__/config.test.ts

@@ -76,8 +76,9 @@ describe('loadConfig providers', () => {
 
     const config = loadConfig(vault);
 
+    // `defaultModel` carries over as the persisted pick; without that it would be silently stripped.
     expect(config.providers).toEqual({
-      'claude-code': { enabled: true, defaultModel: 'sonnet' },
+      'claude-code': { enabled: true, model: 'sonnet' },
     });
     expect(errorSpy).toHaveBeenCalled();
   });
@@ -236,6 +237,14 @@ describe('loadConfig accounts', () => {
     expect(errorSpy).toHaveBeenCalled();
   });
 
+  it("carries a pre-selection account's single model over as its picked set", () => {
+    writeAccountsConfig([{ ...validAccount, model: 'deepseek-v4-pro' }]);
+
+    expect(loadConfig(vault).accounts).toEqual([
+      { ...validAccount, models: [{ id: 'deepseek-v4-pro' }] },
+    ]);
+  });
+
   it('drops an account whose stored secret is gone, rather than half-loading it', () => {
     const errorSpy = vi.spyOn(logger, 'warn').mockImplementation(noop);
     // The post-migration on-disk shape: an api-key credential with no key. With an empty vault the

apps/daemon/src/config.ts

@@ -211,7 +211,7 @@ function parseAccounts(store: SecretStore, raw: unknown): Parsed<Accounts> {
     // secret that is gone fails the schema and lands in the same drop-and-log path as a malformed one.
     const attached = withAccountSecret(store, value);
     migrated ||= attached.migrated;
-    const account = AccountSchema.safeParse(attached.value);
+    const account = AccountSchema.safeParse(withPickedModels(attached.value));
     if (!account.success) {
       logger.warn({ operation: 'config.load' }, 'Dropping invalid account config');
       continue;
@@ -221,6 +221,25 @@ function parseAccounts(store: SecretStore, raw: unknown): Parsed<Accounts> {
   return { value: accounts, migrated };
 }
 
+/** Pre-selection configs stored one free-text model per account; carry it over as the picked set,
+ * or zod strips the unknown key and the user silently loses their model. Idempotent. */
+function withPickedModels(value: unknown): unknown {
+  if (typeof value !== 'object' || value === null) return value;
+  const { model, ...rest } = value as { model?: unknown; models?: unknown };
+  if (typeof model !== 'string' || model === '' || rest.models !== undefined) return rest;
+  return { ...rest, models: [{ id: model }] };
+}
+
+/** Same carry-over for the per-agent default, which is now the persisted pick. */
+function withPickedModel(value: unknown): unknown {
+  if (typeof value !== 'object' || value === null) return value;
+  const { defaultModel, ...rest } = value as { defaultModel?: unknown; model?: unknown };
+  if (typeof defaultModel !== 'string' || defaultModel === '' || rest.model !== undefined) {
+    return rest;
+  }
+  return { ...rest, model: defaultModel };
+}
+
 /**
  * Parse element by element like {@link parseAccounts}: one invalid server is dropped and logged,
  * never blanking the rest.
@@ -270,7 +289,7 @@ function parseProviders(store: SecretStore, raw: unknown): Parsed<ProvidersConfi
     }
     const attached = withProviderSecret(store, kind.data, value);
     migrated ||= attached.migrated;
-    const config = ProviderConfigSchema.safeParse(attached.value);
+    const config = ProviderConfigSchema.safeParse(withPickedModel(attached.value));
     if (!config.success) {
       logger.warn({ agentKind: key, operation: 'config.load' }, 'Dropping invalid provider config');
       continue;

apps/desktop/src/renderer/src/settings/history-import-tab.tsx

@@ -71,7 +71,7 @@ export function HistoryImportTab({ kind }: { kind: AgentKind }): React.ReactNode
     <>
       <DesktopChromePortal segment="main" position="left" className="gap-2 px-2">
         <span className="min-w-0 truncate font-semibold text-sm">
-          {t('panelTitle', { provider: AGENT_LABELS[kind] })}
+          {t('panelTitle', { harness: AGENT_LABELS[kind] })}
         </span>
         {surface.count > 0 && (
           <span className="shrink-0 text-muted-foreground text-xs">

apps/desktop/src/renderer/src/shell/desktop-shell.tsx

@@ -80,7 +80,7 @@ export function DesktopShell({
   attachmentSupport,
   agentCatalogs,
   newSessionDefaultModels,
-  newSessionPreferredModels,
+  accountModels,
   newSessionPreferredEfforts,
   newSessionPreferredBranches,
   NewSessionBranchPickerComponent,
@@ -429,7 +429,7 @@ export function DesktopShell({
           attachmentSupport={attachmentSupport}
           agentCatalogs={agentCatalogs}
           defaultModels={newSessionDefaultModels}
-          preferredModels={newSessionPreferredModels}
+          accountModels={accountModels}
           preferredEfforts={newSessionPreferredEfforts}
           preferredBranches={newSessionPreferredBranches}
           NewSessionBranchPickerComponent={NewSessionBranchPickerComponent}
@@ -453,6 +453,8 @@ export function DesktopShell({
           composer={conversationComposer}
           agentKind={active?.kind}
           agentLabel={agentLabel}
+          accountModels={active ? accountModels?.[active.kind] : undefined}
+          accountId={active?.accountId}
           attachmentsSupported={Boolean(active && attachmentSupport?.[active.kind])}
           cwd={active?.cwd}
           runtimeCues={runtimeCues}

apps/webview/e2e/browser-smoke.e2e.mts

@@ -15,6 +15,7 @@ import { chromium } from 'playwright-core';
 const webviewDir = fileURLToPath(new URL('..', import.meta.url));
 const daemonDir = fileURLToPath(new URL('../../daemon', import.meta.url));
 const viteCli = fileURLToPath(new URL('../../bin/vite.js', import.meta.resolve('vite')));
+const newSessionDefaultsKey = 'linkcode.workbench.new-session-defaults:v7';
 const mockThreadTitle = 'Wire the workbench to the daemon';
 const mockChatThreadTitle = 'Prototype without git';
 const longThreadTitle = 'Long thread · navigation testbed';
@@ -69,12 +70,11 @@ async function sendPrompt(page: Page, prompt: string, appErrors: string[]): Prom
 }
 
 async function verifyNewChatIsolation(page: Page, appErrors: string[]): Promise<void> {
-  await page.evaluate(() => {
-    localStorage.setItem(
-      'linkcode.workbench.new-session-defaults:v5',
-      JSON.stringify({ state: { lastProvider: 'pi' }, version: 0 }),
-    );
-  });
+  // Must track NEW_SESSION_DEFAULTS_STORAGE_KEY and its schema: a stale blob is discarded silently,
+  // the new chat falls back to claude-code, and its `missing` mock runtime blocks Send forever.
+  await page.evaluate((key) => {
+    localStorage.setItem(key, JSON.stringify({ state: { lastHarness: 'pi' }, version: 0 }));
+  }, newSessionDefaultsKey);
   await page.reload({ waitUntil: 'domcontentloaded' });
   await page.locator('[data-thread-title]', { hasText: mockChatThreadTitle }).waitFor();
   await page.locator('[data-thread-title]', { hasText: mockChatThreadTitle }).click();
@@ -101,7 +101,14 @@ async function verifyNewChatIsolation(page: Page, appErrors: string[]): Promise<
     });
   });
 
-  await page.getByRole('button', { name: 'Send' }).click();
+  const send = page.getByRole('button', { name: 'Send' });
+  if (await send.isDisabled()) {
+    throw new Error(
+      `New chat cannot send: the ${newSessionDefaultsKey} seed did not resolve a sendable harness. ` +
+        'Check the storage key version and the persisted field names against new-session-defaults-store.ts.',
+    );
+  }
+  await send.click();
   await page.getByText(`You said: ${prompt}`, { exact: false }).waitFor({ timeout: 15000 });
   const titles = await page.evaluate(() => {
     const finish = Reflect.get(window, '__newChatIsolationProbe') as

packages/client/core/src/client.ts

@@ -1,6 +1,5 @@
 import type {
   Account,
-  AccountEndpoint,
   AccountModel,
   AccountSecret,
   Accounts,
@@ -793,8 +792,8 @@ export class LinkCodeClient {
     return this.control.setSubscriptionMode(mode);
   }
 
-  setModel(sessionId: SessionId, model: string): Promise<RequestAck> {
-    return this.control.setModel(sessionId, model);
+  setModel(sessionId: SessionId, model: string, accountId?: string): Promise<RequestAck> {
+    return this.control.setModel(sessionId, model, accountId);
   }
 
   setEffort(sessionId: SessionId, effort: EffortLevel): Promise<RequestAck> {
@@ -841,9 +840,12 @@ export class LinkCodeClient {
     return this.control.getAccounts();
   }
 
-  /** Model list an endpoint serves, read daemon-side with a not-yet-saved secret. */
-  probeAccountModels(endpoint: AccountEndpoint, secret: AccountSecret): Promise<AccountModel[]> {
-    return this.control.probeAccountModels(endpoint, secret);
+  /** Models a service serves, read daemon-side with an unsaved secret or a saved account's own. */
+  probeAccountModels(
+    service: string,
+    credential: { type: 'inline'; secret: AccountSecret } | { type: 'account'; accountId: string },
+  ): Promise<AccountModel[]> {
+    return this.control.probeAccountModels(service, credential);
   }
 
   /** Masked custom MCP servers (env/header keys only — the daemon never returns values). */

packages/client/core/src/client/control-channel.ts

@@ -1,6 +1,5 @@
 import type {
   Account,
-  AccountEndpoint,
   AccountModel,
   AccountSecret,
   Accounts,
@@ -267,9 +266,15 @@ export class ControlChannel {
     }));
   }
 
-  /** Switch the session's model, going forward. Rejects if the adapter can't rebind a live session. */
-  setModel(sessionId: SessionId, model: string): Promise<RequestAck> {
-    return this.send(sessionId, { type: 'set-model', model });
+  /** Switch the session's model, going forward. Rejects if the adapter can't rebind a live session.
+   * `accountId` names the account the model came from: picking one the session isn't running on
+   * restarts it on that account and resumes the transcript. */
+  setModel(sessionId: SessionId, model: string, accountId?: string): Promise<RequestAck> {
+    return this.send(sessionId, {
+      type: 'set-model',
+      model,
+      ...(accountId !== undefined && { accountId }),
+    });
   }
 
   /** Switch the session's reasoning-effort level, going forward. Same acceptance rule as setModel. */
@@ -579,14 +584,19 @@ export class ControlChannel {
     }));
   }
 
-  /** Ask the daemon what an endpoint serves, using a not-yet-saved secret: the account forms offer
-   * the answer as the model picker. The daemon must do it — the renderer's CSP blocks the fetch. */
-  probeAccountModels(endpoint: AccountEndpoint, secret: AccountSecret): Promise<AccountModel[]> {
+  /** Ask the daemon which models a service serves, so the account forms can offer a real list to
+   * pick from. The daemon must do it — the renderer's CSP blocks the fetch, and it resolves the list
+   * URL from the service catalog itself. Pass a secret the add form has not saved yet, or the id of
+   * a saved account so its stored secret never leaves the daemon. */
+  probeAccountModels(
+    service: string,
+    credential: { type: 'inline'; secret: AccountSecret } | { type: 'account'; accountId: string },
+  ): Promise<AccountModel[]> {
     return this.sendCorrelated('accountModels', (clientReqId) => ({
       kind: 'config.probe-models',
       clientReqId,
-      endpoint,
-      secret,
+      service,
+      credential,
     }));
   }
 

packages/client/sdk/src/client.ts

@@ -10,7 +10,6 @@ import type {
 import { LinkCodeClient } from '@linkcode/client-core';
 import type {
   Account,
-  AccountEndpoint,
   AccountModel,
   AccountSecret,
   Accounts,
@@ -243,8 +242,8 @@ export class LinkCodeSdkClient {
     return toResult(this.raw.cancel(sessionId));
   }
 
-  setModel(sessionId: SessionId, model: string): RequestResult<{ ok: true }> {
-    return toResult(this.raw.setModel(sessionId, model));
+  setModel(sessionId: SessionId, model: string, accountId?: string): RequestResult<{ ok: true }> {
+    return toResult(this.raw.setModel(sessionId, model, accountId));
   }
 
   setEffort(sessionId: SessionId, effort: EffortLevel): RequestResult<{ ok: true }> {
@@ -291,12 +290,12 @@ export class LinkCodeSdkClient {
     return toResult(this.raw.setAccounts(accounts));
   }
 
-  /** Enumerate what an endpoint serves, using a secret that is not saved yet. */
+  /** Enumerate the models a service serves, with an unsaved secret or a saved account's own. */
   probeAccountModels(
-    endpoint: AccountEndpoint,
-    secret: AccountSecret,
+    service: string,
+    credential: { type: 'inline'; secret: AccountSecret } | { type: 'account'; accountId: string },
   ): RequestResult<AccountModel[]> {
-    return toResult(this.raw.probeAccountModels(endpoint, secret));
+    return toResult(this.raw.probeAccountModels(service, credential));
   }
 
   /** Masked custom MCP servers (data plane) — env/header keys only, never a secret value. */

packages/client/sdk/src/operations.ts

@@ -7,7 +7,6 @@ import type {
 } from '@linkcode/client-core';
 import type {
   Account,
-  AccountEndpoint,
   AccountModel,
   AccountSecret,
   Accounts,
@@ -222,9 +221,9 @@ export function cancelTurn(
 }
 
 export function setModel(
-  options: Options<{ sessionId: SessionId; model: string }>,
+  options: Options<{ sessionId: SessionId; model: string; accountId?: string }>,
 ): RequestResult<{ ok: true }> {
-  return resolveClient(options).setModel(options.sessionId, options.model);
+  return resolveClient(options).setModel(options.sessionId, options.model, options.accountId);
 }
 
 export function setEffort(
@@ -278,9 +277,12 @@ export function setAccounts(options: Options<{ accounts: Accounts }>): RequestRe
 }
 
 export function probeAccountModels(
-  options: Options<{ endpoint: AccountEndpoint; secret: AccountSecret }>,
+  options: Options<{
+    service: string;
+    credential: { type: 'inline'; secret: AccountSecret } | { type: 'account'; accountId: string };
+  }>,
 ): RequestResult<AccountModel[]> {
-  return resolveClient(options).probeAccountModels(options.endpoint, options.secret);
+  return resolveClient(options).probeAccountModels(options.service, options.credential);
 }
 
 /** Masked custom MCP servers — env/header keys only, never a secret value. */