fix(custom-model): unset injected env on clear, resume on restart, select the model for pi/omp/grok

Custom Model Endpoint Profiles (#393) let a session point its CLI at a
custom OpenAI-compatible endpoint by injecting env vars or a config file
and restarting the CLI in place. Review of the apply path found four
things, two of them destructive. This lands all four plus the smaller
items from the same review.

1. Clearing a selection did not clear it. The injected vars reach the CLI
   via `tmux setenv`, which persists at the tmux-session level and is
   inherited by `respawn-pane` (measured: `setenv FOO bar` survived two
   successive `respawn-pane -k`), so deleting the keys from the session's
   envOverrides relaunched the CLI still pointed at the old endpoint, and
   for the configDir kinds at a HOME/CODEX_HOME/GROK_HOME that had just
   been deleted. `Session.setCustomModel()` now reports the removed keys,
   queues them (`_pendingEnvUnsets`), and `RespawnPaneOptions.unsetEnvKeys`
   carries them into `applyEnvOverrides()`, which `setenv -u`s them before
   re-applying the live overrides, on the same path that already unsets
   the legacy CLAUDE_CODE_EFFORT_LEVEL. Verified on a private tmux socket
   that `setenv -u HOME` hands the next respawn the global HOME back.

2. Applying a model to a local claude session killed the pane. The
   relaunch was `claude --session-id <id>` and Claude refuses an id that
   already has a transcript, and unlike the dead-pane respawn this one
   kills a working pane first. `restartCli()` now pins the live
   conversation id as the resume id for that respawn when the CLI's launch
   declares a `fallback` chain, which renders the same
   `--resume <id> || --session-id <id>` shape the docker and remote pane
   commands use. Gated on the registry shape, not the CLI id: an entry
   whose resume id is minted by the CLI itself never declares that chain.

3. pi, omp and grok wrote their config file and then launched without the
   `--model` that selects it, so the file was ignored. The registry entry
   now declares `customModelInjection.launchModel` (`custom/{modelId}` for
   pi and omp, grok's `[model.codeman-custom]` block name), the builder
   renders it, and `_withCustomModelLaunchModel()` applies it onto the
   respawn options through `legacyConfigField`, leaving the stored
   <Mode>Config untouched so a clear falls back to the user's own model.
   A model id the CLI's `model` token pattern cannot carry is refused
   with a 400 rather than silently dropped by the argv engine.

4. Remote (SSH) and Docker sessions reported `restarted: true` and changed
   nothing: their `restartCli()` reattaches the durable tmux rather than
   relaunching the agent, and the env lands on the local pane. Both are
   refused with a 400 until those paths are plumbed.

Smaller items from the same review:

- The selection survives a Codeman restart as the disk-only `__customModel`
  bookkeeping (endpoint, model, injected key NAMES, config dir, launch
  model; never the values, which carry the API key). Recovery re-derives
  the values from the endpoint store through the same apply path the route
  uses and keeps the bookkeeping even when the endpoint is gone, so a
  later clear still has keys to unset.
- Discovery goes through `webviewFetch()`, so the RESOLVED address is
  judged by the same egress guard the web-tab proxy uses, and `baseUrl`
  reuses `webviewUrlSchema` (http(s) only, no embedded credentials,
  link-local and cloud-metadata addresses refused). undici's `fetch failed`
  wrapper is unwrapped so the user sees the ECONNREFUSED underneath.
- `custom-model-hosts.json` is written 0600 via tmp+rename, the per-session
  config dir 0700/0600 (pi and omp embed the key literally), and that dir
  is removed with the session.
- `PR.md` is gone from the repo root and the design doc moved to
  `docs/custom-model-endpoints-plan.md` with the LAN address and the
  personal name scrubbed; every reference follows. The guide's `authStyle`
  text matches the shipped schema (`bearer | api-key`, default `bearer`)
  and says that `customModelEndpointsEnabled` is read by nothing until
  the picker lands.
- `config/tsconfig.scripts.json` typechecks `scripts/test-local-llm-harnesses.ts`
  (four real type errors fixed). It is not yet wired into `npm run typecheck`
  because that line differs on master; adding `&& tsc -p config/tsconfig.scripts.json`
  there is the one-line follow-up.

Tests: `test/session-custom-model-restart.test.ts` drives a real Session and
fails on the unfixed code for items 1 to 3; the route suite covers item 4
and the pattern refusal; `test/tmux-manager.test.ts` pins that the unsets
run before the overrides and that a shell-metachar key never reaches tmux.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

src/config/cli-registry/schema.ts

@@ -261,6 +261,19 @@ const echoSchema = z
   })
   .strict();
 
+/**
+ * `capabilities.customModelInjection.launchModel`: the `model` launch-param value that
+ * selects the injected provider, with `{modelId}` standing for the chosen id. Bounded to
+ * the characters the `model`/`model-pi` token patterns accept plus the placeholder braces,
+ * so a template can never smuggle a token the argv engine would have to quote.
+ */
+const launchModelTemplate = z
+  .string()
+  .min(1)
+  .max(120)
+  .regex(/^[a-zA-Z0-9._\-/:{}]+$/)
+  .optional();
+
 const capabilitiesSchema = z
   .object({
     external: z.boolean(),
@@ -326,6 +339,7 @@ const capabilitiesSchema = z
           // Empty is valid: deepseek's model routing is a profile-composition concern, not
           // an env var, so it declares baseUrl/apiKey injection with no model var at all.
           modelVars: z.array(envName).max(8),
+          launchModel: launchModelTemplate,
         })
         .strict(),
       z
@@ -333,6 +347,7 @@ const capabilitiesSchema = z
           kind: z.literal('configContentEnv'),
           envVar: envName,
           template: z.literal('opencode-json'),
+          launchModel: launchModelTemplate,
         })
         .strict(),
       z
@@ -341,6 +356,7 @@ const capabilitiesSchema = z
           dirEnvVar: envName,
           fileName: z.string().min(1).max(80),
           template: z.enum(['codex-toml', 'pi-models-json', 'omp-models-yml', 'grok-toml']),
+          launchModel: launchModelTemplate,
         })
         .strict(),
       z.object({ kind: z.literal('unsupported') }).strict(),

src/config/cli-registry/stock.ts

@@ -228,7 +228,7 @@ const CLAUDE: CliEntry = {
     privilegedParams: [],
     // ANTHROPIC_* is NOT in allowedPrefixes/allowedKeys above (deliberately — see the
     // allowedPrefixes comment nearby), so these are unreachable via plain envOverrides
-    // today; listed here only so the dedicated custom-model route (deployment_plan.md
+    // today; listed here only so the dedicated custom-model route (docs/custom-model-endpoints-plan.md
     // chunk 5) clamps them for a non-granted multi-user owner the same way every other
     // CLI's injection vars are clamped, the day that route widens who can set them.
     privilegedEnvKeys: [
@@ -239,7 +239,7 @@ const CLAUDE: CliEntry = {
       'ANTHROPIC_DEFAULT_OPUS_MODEL',
     ],
     gates: { nameFlag: { minVersion: '2.1.224', failClosed: true } },
-    // Custom Model Endpoint Profiles (deployment_plan.md) — verified by hand against a real
+    // Custom Model Endpoint Profiles (docs/custom-model-endpoints-plan.md) — verified by hand against a real
     // llama.cpp server. Claude reads these at process start only, so switching requires a
     // respawn, never a live hot-swap.
     customModelInjection: {
@@ -781,6 +781,10 @@ const PI: CliEntry = {
       dirEnvVar: 'HOME',
       fileName: '.pi/agent/models.json',
       template: 'pi-models-json',
+      // Writing models.json is not enough: without `--model custom/<id>` pi stays on its
+      // own default provider and fails with "No API key found for the selected model"
+      // (confirmed live). `custom` is the provider name pi-models-json declares.
+      launchModel: 'custom/{modelId}',
     },
     // HOME is not `PI_`-prefixed, so unlike the old (wrong) PI_CONFIG_DIR guess this was
     // never reachable via the generic envOverrides allowlist at all — listed here anyway,
@@ -895,6 +899,10 @@ const GROK: CliEntry = {
       dirEnvVar: 'GROK_HOME',
       fileName: 'config.toml',
       template: 'grok-toml',
+      // The `[model.<name>]` block the grok-toml template writes; `--model <name>` is what
+      // selects it (GROK_CUSTOM_MODEL_NAME in custom-model-injection.ts, pinned equal by
+      // test/custom-model-injection.test.ts so the two cannot drift).
+      launchModel: 'codeman-custom',
     },
     // GROK_HOME already matches the GROK_ allowedPrefix above, so it was ALREADY
     // reachable via plain envOverrides before this feature existed — same reasoning
@@ -1189,6 +1197,9 @@ const OMP: CliEntry = {
       dirEnvVar: 'HOME',
       fileName: '.omp/agent/models.yml',
       template: 'omp-models-yml',
+      // Same as pi: omp's own default model has no credential, so without an explicit
+      // `--model custom/<id>` it never reaches the injected provider at all.
+      launchModel: 'custom/{modelId}',
     },
   },
   overlays: {

src/config/cli-registry/types.ts

@@ -460,7 +460,7 @@ export interface CliCapabilities {
   /**
    * How this CLI is pointed at a user-supplied custom OpenAI-compatible
    * endpoint (local, e.g. llama.cpp, or cloud, e.g. Azure AI Foundry) — the
-   * Custom Model Endpoint Profiles feature (`deployment_plan.md`). Declared
+   * Custom Model Endpoint Profiles feature (`docs/custom-model-endpoints-plan.md`). Declared
    * per entry, never branched on id, same as every other capability here.
    *
    * `env`: plain env vars (claude's `ANTHROPIC_BASE_URL`/`ANTHROPIC_API_KEY`/
@@ -478,7 +478,7 @@ export interface CliCapabilities {
    * because those env vars are not grok's real custom-endpoint mechanism at
    * all. The real one is a `[model.<name>]` block in a `config.toml` under
    * `GROK_HOME` (verified against xAI's own docs), same shape as codex/pi/
-   * omp — this is why the confidence table in deployment_plan.md exists:
+   * omp — this is why the confidence table in docs/custom-model-endpoints-plan.md exists:
    * "researched" web docs can still be plausible-sounding and wrong.
    *
    * Every env var name this introduces that can redirect a session's
@@ -486,15 +486,26 @@ export interface CliCapabilities {
    * `DEEPSEEK_BASE_URL` — a non-granted multi-user owner redirecting a
    * session to their own endpoint is a credential-exfiltration path, not
    * just a mischief redirect.
+   *
+   * `launchModel` is the value the entry's own `model` launch param must carry
+   * for the CLI to SELECT the injected provider, as a template where
+   * `{modelId}` is the chosen model id. Writing the config file is not enough
+   * for pi and omp (`--model custom/<id>`, or the CLI stays on its own default
+   * provider and reports "No API key found for the selected model") or for
+   * grok (`--model codeman-custom`, the `[model.<name>]` block the config
+   * declares). Absent = the config alone selects the model (claude's env vars,
+   * opencode's blob, codex's top-level `model` key). Applied by the session's
+   * respawn options through the entry's `legacyConfigField`, never by id.
    */
   customModelInjection:
-    | { kind: 'env'; baseUrlVar: string; apiKeyVar: string; modelVars: string[] }
-    | { kind: 'configContentEnv'; envVar: string; template: 'opencode-json' }
+    | { kind: 'env'; baseUrlVar: string; apiKeyVar: string; modelVars: string[]; launchModel?: string }
+    | { kind: 'configContentEnv'; envVar: string; template: 'opencode-json'; launchModel?: string }
     | {
         kind: 'configDir';
         dirEnvVar: string;
         fileName: string;
         template: 'codex-toml' | 'pi-models-json' | 'omp-models-yml' | 'grok-toml';
+        launchModel?: string;
       }
     | { kind: 'unsupported' };
 }

src/custom-model-hosts.ts

@@ -1,8 +1,11 @@
 /**
  * @fileoverview Read/write-array store for user-configured custom OpenAI-compatible
- * model endpoints (local or cloud — deployment_plan.md). Same shape as
- * `remote-hosts.ts` / `webview-store.ts`: `~/.codeman/custom-model-hosts.json`
- * holding a plain array, read/written whole.
+ * model endpoints (local or cloud — docs/custom-model-endpoints-plan.md). Same
+ * shape as `remote-hosts.ts` / `webview-store.ts`: `~/.codeman/custom-model-hosts.json`
+ * holding a plain array, read/written whole. The file can hold API keys, so it is
+ * written 0600 via tmp+rename like `intents.json` (`mode` on `writeFile` applies only
+ * to a file being created; the rename is what keeps an existing file's bytes and
+ * mode from ever being observable half-written or world-readable).
  */
 
 import { existsSync, mkdirSync } from 'node:fs';
@@ -55,5 +58,8 @@ export async function readCustomModelHosts(configDir: string): Promise<CustomMod
 
 export async function writeCustomModelHosts(configDir: string, hosts: CustomModelHost[]): Promise<void> {
   if (!existsSync(configDir)) mkdirSync(configDir, { recursive: true });
-  await fs.writeFile(customModelHostsPath(configDir), JSON.stringify(hosts, null, 2));
+  const target = customModelHostsPath(configDir);
+  const tmp = `${target}.${process.pid}.tmp`;
+  await fs.writeFile(tmp, JSON.stringify(hosts, null, 2), { mode: 0o600 });
+  await fs.rename(tmp, target);
 }

src/custom-model-injection-apply.ts

@@ -6,13 +6,24 @@
  * Before this existed, the route and the standalone script each carried
  * their own copy of this logic, which is exactly the kind of drift the CLI
  * registry's "declare once, consume everywhere" design exists to prevent —
- * see deployment_plan.md and the "dynamic to support cli-registry changes"
- * requirement it was written against.
+ * see docs/custom-model-endpoints-plan.md and the "dynamic to support
+ * cli-registry changes" requirement it was written against.
  */
 
-import { mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { chmodSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
 import { join, dirname } from 'node:path';
-import type { ConfigDirInjection } from './custom-model-injection.js';
+import { dataPath } from './config/instance.js';
+import type { CliEntry } from './config/cli-registry/types.js';
+import {
+  buildCustomModelInjection,
+  type ConfigDirInjection,
+  type CustomModelEndpoint,
+} from './custom-model-injection.js';
+
+/** Where a session's isolated `configDir`-kind files live: never the user's real CLI config path. */
+export function customModelConfigDir(sessionId: string): string {
+  return join(dataPath('custom-model-configs'), sessionId);
+}
 
 /**
  * Writes a `ConfigDirInjection`'s files under `baseDir` and returns the full
@@ -21,12 +32,18 @@ import type { ConfigDirInjection } from './custom-model-injection.js';
  * name). Never touches anything outside `baseDir` — the caller is
  * responsible for choosing an isolated directory (never the user's real
  * `~/.codex`, `~/.pi`, etc.).
+ *
+ * pi and omp embed the API key literally in the file, so the tree is written
+ * 0700/0600 like every other secret-bearing file under `~/.codeman`; the chmod
+ * covers a re-apply onto a file that already exists (`mode` only applies at
+ * creation).
  */
 export function applyConfigDirInjection(baseDir: string, injection: ConfigDirInjection): Record<string, string> {
   for (const file of injection.files) {
     const filePath = join(baseDir, file.relPath);
-    mkdirSync(dirname(filePath), { recursive: true });
-    writeFileSync(filePath, file.content, 'utf8');
+    mkdirSync(dirname(filePath), { recursive: true, mode: 0o700 });
+    writeFileSync(filePath, file.content, { encoding: 'utf8', mode: 0o600 });
+    chmodSync(filePath, 0o600);
   }
   return { [injection.dirEnvVar]: baseDir, ...injection.extraEnv };
 }
@@ -40,3 +57,40 @@ export function removeConfigDir(dir: string | undefined): void {
     // best-effort cleanup only
   }
 }
+
+/** What applying an endpoint to a session yields, ready for `Session.setCustomModel()`. */
+export interface AppliedCustomModel {
+  envOverrides: Record<string, string>;
+  envKeys: string[];
+  configDir?: string;
+  launchModel?: string;
+}
+
+/**
+ * Compute (and for the `configDir` kind, write) everything a session needs to run
+ * against `endpoint`/`modelId`. Returns undefined for a CLI with no mechanism.
+ *
+ * Idempotent on purpose: the boot-recovery path calls it again for a session that
+ * was already pointed at an endpoint, so the config files are rewritten in place
+ * (same content) and the env values, which are never persisted because they carry
+ * the API key, are re-derived from the endpoint store instead.
+ */
+export function applyCustomModelInjection(
+  entry: Pick<CliEntry, 'capabilities'>,
+  endpoint: CustomModelEndpoint,
+  modelId: string,
+  sessionId: string
+): AppliedCustomModel | undefined {
+  const injection = buildCustomModelInjection(entry, endpoint, modelId);
+  if (injection.kind === 'unsupported') return undefined;
+  if (injection.kind === 'env') {
+    return {
+      envOverrides: injection.envOverrides,
+      envKeys: Object.keys(injection.envOverrides),
+      launchModel: injection.launchModel,
+    };
+  }
+  const configDir = customModelConfigDir(sessionId);
+  const envOverrides = applyConfigDirInjection(configDir, injection);
+  return { envOverrides, envKeys: Object.keys(envOverrides), configDir, launchModel: injection.launchModel };
+}

src/custom-model-injection.ts

@@ -1,6 +1,6 @@
 /**
  * @fileoverview Pure builder for the Custom Model Endpoint Profiles feature
- * (deployment_plan.md): turns a CLI registry entry's
+ * (docs/custom-model-endpoints-plan.md): turns a CLI registry entry's
  * `capabilities.customModelInjection` declaration, a configured endpoint,
  * and a chosen model id into the concrete env vars / config-file content
  * that would redirect that CLI's session at the endpoint.
@@ -20,7 +20,7 @@
  * Chat-Completions server (llama.cpp, llama-swap, most local setups) does
  * NOT implement the Responses API — so codex may still fail at the
  * PROTOCOL level even with a correctly-shaped config file. That gap is
- * real and current, not a stale warning; see deployment_plan.md. The rest
+ * real and current, not a stale warning; see docs/custom-model-endpoints-plan.md. The rest
  * (gemini/pi/grok/deepseek/omp) have their ONE-SHOT INVOCATION flags
  * confirmed against real installed binaries' own `--help` output, but
  * their custom-endpoint env/config conventions remain web-researched,
@@ -42,6 +42,8 @@ export interface EnvInjection {
   kind: 'env';
   /** Ready to merge into a session's envOverrides. */
   envOverrides: Record<string, string>;
+  /** See {@link ConfigDirInjection.launchModel}. */
+  launchModel?: string;
 }
 
 export interface ConfigDirInjection {
@@ -57,6 +59,13 @@ export interface ConfigDirInjection {
    * or the config points at a credential that was never actually set.
    */
   extraEnv?: Record<string, string>;
+  /**
+   * The value the CLI's `model` launch param must carry for it to SELECT the injected
+   * provider (pi/omp: `custom/<modelId>`; grok: the `[model.<name>]` block name). Absent
+   * when the config alone selects the model. Rendered from the registry entry's
+   * `customModelInjection.launchModel` template, never hand-built per CLI.
+   */
+  launchModel?: string;
 }
 
 export interface UnsupportedInjection {
@@ -93,17 +102,21 @@ export function buildCustomModelInjection(
         [cap.apiKeyVar]: apiKey,
       };
       for (const modelVar of cap.modelVars) envOverrides[modelVar] = modelId;
-      return { kind: 'env', envOverrides };
+      return withLaunchModel({ kind: 'env', envOverrides }, cap.launchModel, modelId);
     }
 
     case 'configContentEnv': {
       const content = renderConfigContent(cap.template, endpoint, modelId, apiKey);
-      return { kind: 'env', envOverrides: { [cap.envVar]: content } };
+      return withLaunchModel({ kind: 'env', envOverrides: { [cap.envVar]: content } }, cap.launchModel, modelId);
     }
 
     case 'configDir': {
       const { content, extraEnv } = renderConfigFile(cap.template, endpoint, modelId, apiKey);
-      return { kind: 'configDir', dirEnvVar: cap.dirEnvVar, files: [{ relPath: cap.fileName, content }], extraEnv };
+      return withLaunchModel(
+        { kind: 'configDir', dirEnvVar: cap.dirEnvVar, files: [{ relPath: cap.fileName, content }], extraEnv },
+        cap.launchModel,
+        modelId
+      );
     }
 
     case 'unsupported':
@@ -111,6 +124,16 @@ export function buildCustomModelInjection(
   }
 }
 
+/** Render a `launchModel` template (`{modelId}` = the chosen id) onto an injection result. */
+function withLaunchModel<T extends EnvInjection | ConfigDirInjection>(
+  result: T,
+  template: string | undefined,
+  modelId: string
+): T {
+  if (!template) return result;
+  return { ...result, launchModel: template.split('{modelId}').join(modelId) };
+}
+
 function renderConfigContent(
   template: 'opencode-json',
   endpoint: CustomModelEndpoint,

src/mux-interface.ts

@@ -123,6 +123,13 @@ export interface RespawnPaneOptions {
   resumeSessionId?: string;
   /** Extra env vars exported before launching the CLI (preserved across respawns). */
   envOverrides?: Record<string, string>;
+  /**
+   * Env vars to REMOVE from the tmux session (`setenv -u`) before `envOverrides` is
+   * applied. `setenv` persists at the tmux-session level and is inherited by
+   * `respawn-pane`, so a key that merely disappears from `envOverrides` stays set
+   * for the relaunched CLI; clearing a custom-model selection has to name it.
+   */
+  unsetEnvKeys?: string[];
   /** Claude CLI effort level (preserved across respawns, injected via `--settings`) */
   effort?: EffortLevel;
   /** Original tmux history-limit retained for config parity; respawn cannot resize the existing pane. */

src/session-manager.ts

@@ -254,7 +254,14 @@ export class SessionManager extends EventEmitter {
     // future reader of state.json.
     const state = session.toState();
     const envOverrides = session.getEnvOverridesForPersist();
-    const toStore = envOverrides ? { ...state, __envOverrides: envOverrides } : state;
+    // __customModel: same convention, the disk-only bookkeeping of a custom-model
+    // selection (env KEYS, config dir, launch model; never the injected values).
+    const customModel = session.getCustomModelForPersist();
+    const toStore = {
+      ...state,
+      ...(envOverrides ? { __envOverrides: envOverrides } : {}),
+      ...(customModel ? { __customModel: customModel } : {}),
+    };
     this.store.setSession(session.id, toStore as SessionState);
   }
 

src/session.ts

@@ -48,6 +48,8 @@ import {
   type OpenCodeConfig,
   type CodexConfig,
   type EffortLevel,
+  type CustomModelBookkeeping,
+  type CustomModelSelection,
   type GeminiConfig,
   type AntigravityConfig,
   type PiConfig,
@@ -577,13 +579,19 @@ export class Session extends EventEmitter {
   // the CLAUDE_CODE_EFFORT_LEVEL env var, which would hard-lock the session.
   private _effort: EffortLevel | undefined;
 
-  // Custom Model Endpoint Profiles (deployment_plan.md). `envKeys` and `configDir` are
-  // internal bookkeeping ONLY (never surfaced via toState()/customModel getter): they are
-  // what setCustomModel() needs to undo a previous injection (remove exactly the env keys
-  // it added, delete a previous isolated config dir) without guessing what it once wrote.
-  private _customModel:
-    | { endpointId: string; modelId: string; label?: string; envKeys: string[]; configDir?: string }
-    | undefined;
+  // Custom Model Endpoint Profiles (docs/custom-model-endpoints-plan.md). `envKeys`,
+  // `configDir` and `launchModel` are internal bookkeeping ONLY (never surfaced via
+  // toState()/the customModel getter): they are what setCustomModel() needs to undo a
+  // previous injection (remove exactly the env keys it added, delete a previous isolated
+  // config dir) without guessing what it once wrote. Persisted disk-only (`__customModel`).
+  private _customModel: CustomModelBookkeeping | undefined;
+
+  // Env keys a retired custom-model selection injected that the NEXT respawn must
+  // `tmux setenv -u`. Deleting a key from `_envOverrides` alone does nothing to the
+  // tmux session, which keeps every `setenv` and hands it to `respawn-pane`, so the
+  // relaunched CLI would come back still pointed at the old endpoint (measured, see
+  // TmuxManager.applyEnvOverrides). Drained after a successful respawn.
+  private _pendingEnvUnsets = new Set<string>();
 
   // tmux history-limit (scrollback lines) allocated when this session's pane is created.
   private readonly _tmuxHistoryLimit: number;
@@ -1246,38 +1254,63 @@ export class Session extends EventEmitter {
     }
   }
 
-  // Custom Model Endpoint Profiles (deployment_plan.md) — public-safe subset only
-  // (never envKeys/configDir, which are internal bookkeeping for setCustomModel below).
-  get customModel(): { endpointId: string; modelId: string; label?: string } | undefined {
+  // Custom Model Endpoint Profiles (docs/custom-model-endpoints-plan.md) — public-safe
+  // subset only (never envKeys/configDir/launchModel, the bookkeeping for setCustomModel).
+  get customModel(): CustomModelSelection | undefined {
     if (!this._customModel) return undefined;
     const { endpointId, modelId, label } = this._customModel;
     return { endpointId, modelId, label };
   }
 
+  /**
+   * The full selection incl. bookkeeping, for state.json ONLY (`__customModel`, the
+   * same disk-only convention as `getEnvOverridesForPersist()`). Carries no env values,
+   * so nothing secret lands on disk; recovery re-derives them from the endpoint store.
+   * Without this a Codeman restart left the pane on the custom endpoint (tmux keeps
+   * its `setenv`s) while `customModel` came back undefined, so the state was wrong and
+   * clearing had nothing to unset. Must NOT be included in any API-bound serializer.
+   */
+  getCustomModelForPersist(): CustomModelBookkeeping | undefined {
+    return this._customModel ? { ...this._customModel, envKeys: [...this._customModel.envKeys] } : undefined;
+  }
+
   /**
    * Update this session's custom-model selection and merge the endpoint's injected env
    * vars into `_envOverrides` — first UNDOING whatever the previous selection injected
    * (removing exactly those env keys), so switching endpoints, or clearing back to the
    * harness's native cloud default, never leaves a stale key behind. Synchronous and
    * side-effect-free beyond mutating state, matching `setNice`/`setColor` above — this
-   * class does no file IO, so it returns the PREVIOUS `configDir` (if any) for the
+   * class does no file IO, so it reports the PREVIOUS `configDir` (if any) for the
    * caller to clean up on disk (custom-model-injection.ts's configDir kind).
+   *
+   * Keys the previous selection injected that the new one does not re-set are queued
+   * for `tmux setenv -u` on the next respawn (`_pendingEnvUnsets`, threaded through
+   * `_buildRespawnPaneOptions().unsetEnvKeys`): the tmux session inherits every
+   * `setenv` into `respawn-pane`, so dropping them from the map alone would relaunch
+   * the CLI still pointed at the old endpoint — and for the `configDir` kinds, at a
+   * `HOME`/`CODEX_HOME`/`GROK_HOME` the caller has just deleted.
    */
   setCustomModel(
-    next: { endpointId: string; modelId: string; label?: string; envKeys: string[]; configDir?: string } | undefined,
+    next: CustomModelBookkeeping | undefined,
     envOverrides?: Record<string, string>
-  ): string | undefined {
+  ): { removedEnvKeys: string[]; previousConfigDir: string | undefined } {
     const previousConfigDir = this._customModel?.configDir;
+    const removedEnvKeys: string[] = [];
     if (this._customModel) {
       for (const key of this._customModel.envKeys) {
         if (this._envOverrides) delete this._envOverrides[key];
+        removedEnvKeys.push(key);
+        this._pendingEnvUnsets.add(key);
       }
     }
-    this._customModel = next;
+    this._customModel = next ? { ...next, envKeys: [...next.envKeys] } : undefined;
     if (envOverrides && Object.keys(envOverrides).length > 0) {
       this._envOverrides = { ...(this._envOverrides ?? {}), ...envOverrides };
+      // A key the new selection sets again does not need an unset (applyEnvOverrides
+      // would set it right back anyway); keep the list to what actually goes away.
+      for (const key of Object.keys(envOverrides)) this._pendingEnvUnsets.delete(key);
     }
-    return previousConfigDir;
+    return { removedEnvKeys, previousConfigDir };
   }
 
   // Token tracking getters and setters
@@ -1660,6 +1693,7 @@ export class Session extends EventEmitter {
         console.error('[Session] Failed to respawn pane, will create new session');
         needsNewSession = true;
       } else {
+        this._pendingEnvUnsets.clear();
         // Wait a moment for the respawned process to fully start
         await new Promise((resolve) => setTimeout(resolve, MUX_STARTUP_DELAY_MS));
       }
@@ -1756,7 +1790,7 @@ export class Session extends EventEmitter {
   /**
    * Kill and relaunch this session's CLI process IN PLACE — same pane, same tmux
    * session, fresh env/args from current state. Custom Model Endpoint Profiles
-   * (deployment_plan.md) is the first caller: after `setCustomModel()` merges new
+   * (docs/custom-model-endpoints-plan.md) is the first caller: after `setCustomModel()` merges new
    * env vars into `_envOverrides`, the running CLI process still has the OLD env
    * (inherited at its own process start, not live-reloaded), so switching a
    * session's model/endpoint requires this restart to actually take effect.
@@ -1783,11 +1817,26 @@ export class Session extends EventEmitter {
     }
 
     this._pinOmpRespawnId();
-    const newPid = await mux.respawnPane(this._buildRespawnPaneOptions());
+    const options = this._buildRespawnPaneOptions();
+    // Unlike the dead-pane respawn, this one kills a WORKING pane whose conversation
+    // already has a transcript, and a CLI that launches with `--session-id <id>` refuses
+    // an id that is already in use (claude: `Error: Session ID ... is already in use.`),
+    // which turned an endpoint switch into a dead pane and a lost session. A launch that
+    // declares a `fallback` chain renders `resume || new` once a resume id is set, the
+    // same `--resume <id> || --session-id <id>` shape the docker and remote pane commands
+    // already use, so pin the live conversation id for THIS respawn only. The registry
+    // shape is the gate, not the CLI's name: an entry whose resume id is minted by the
+    // CLI itself (codex/pi/omp/grok) never declares that chain, and its resume field is
+    // read from its own `<Mode>Config` rather than this top-level one anyway.
+    if (!options.resumeSessionId && getCli(this.mode)?.launch.chain === 'fallback') {
+      options.resumeSessionId = this._claudeSessionId ?? this.id;
+    }
+    const newPid = await mux.respawnPane(options);
     if (!newPid) {
       console.error('[Session] restartCli: respawnPane failed for', this._muxSession.muxName);
       return false;
     }
+    this._pendingEnvUnsets.clear();
     console.log('[Session] restartCli: restarted CLI for', this._muxSession.muxName, 'pid', newPid);
     return true;
   }
@@ -1799,7 +1848,7 @@ export class Session extends EventEmitter {
    * the spawn path.
    */
   private _buildRespawnPaneOptions(): import('./mux-interface.js').RespawnPaneOptions {
-    return {
+    const options: import('./mux-interface.js').RespawnPaneOptions = {
       sessionId: this.id,
       workingDir: this.workingDir,
       mode: this.mode,
@@ -1827,12 +1876,37 @@ export class Session extends EventEmitter {
       ompConfig: this._ompConfig,
       resumeSessionId: this._resumeSessionId,
       envOverrides: this._envOverrides,
+      unsetEnvKeys: this._pendingEnvUnsets.size > 0 ? [...this._pendingEnvUnsets] : undefined,
       effort: this._effort,
       historyLimit: this._tmuxHistoryLimit,
       remote: this._remote,
       docker: this._docker,
       owner: this._owner,
     };
+    return this._withCustomModelLaunchModel(options);
+  }
+
+  /**
+   * Force the custom-model selection's `launchModel` (pi/omp `custom/<id>`, grok's
+   * `[model.<name>]` block name) onto the CLI's `model` launch param. Where that param
+   * lives is registry DATA — the entry's `legacyConfigField` (`piConfig`, `grokConfig`,
+   * ...) or the top-level `model` for an entry that declares none — so this stays a
+   * generic reader rather than a branch per CLI. Applied on the OPTIONS only: the stored
+   * `<Mode>Config` keeps whatever model the user chose at create, which is exactly what a
+   * later clear must fall back to.
+   */
+  private _withCustomModelLaunchModel(
+    options: import('./mux-interface.js').RespawnPaneOptions
+  ): import('./mux-interface.js').RespawnPaneOptions {
+    const launchModel = this._customModel?.launchModel;
+    if (!launchModel) return options;
+    const entry = getCli(this.mode);
+    if (!entry) return options;
+    const field = entry.launch.legacyConfigField;
+    if (!field) return { ...options, model: launchModel };
+    const bag = options as unknown as Record<string, unknown>;
+    const existing = (bag[field] ?? {}) as Record<string, unknown>;
+    return { ...options, [field]: { ...existing, model: launchModel } };
   }
 
   /**

src/tmux-manager.ts

@@ -1738,21 +1738,34 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
    * Key validation is strict (`/^[A-Z_][A-Z0-9_]*$/`) as defense-in-depth against
    * shell-metachar injection even if upstream schema check is bypassed.
    */
-  private applyEnvOverrides(muxName: string, envOverrides?: Record<string, string>): void {
+  private applyEnvOverrides(muxName: string, envOverrides?: Record<string, string>, unsetKeys?: string[]): void {
+    const VALID_KEY = /^[A-Z_][A-Z0-9_]*$/;
     // Legacy cleanup: pre-0.7.2 set CLAUDE_CODE_EFFORT_LEVEL via setenv, which persists
     // on the tmux session and hard-locks /effort switching in every respawned pane.
     // Effort now flows as a `--settings` soft default (see buildEffortSettingsFlag),
     // so unconditionally unset the stale var before applying current overrides.
-    try {
-      execSync(`${this.tmux()} setenv -t ${shellescape(muxName)} -u CLAUDE_CODE_EFFORT_LEVEL`, {
-        timeout: EXEC_TIMEOUT_MS,
-        stdio: ['pipe', 'pipe', 'pipe'],
-      });
-    } catch {
-      /* Non-critical — var may not exist */
+    //
+    // The caller's own unsets ride the same path, and run BEFORE the overrides are
+    // (re)applied: a key that is both unset and present in `envOverrides` ends up set,
+    // so a stale unset can never clobber a live value. Removing a key from the map is
+    // not enough on its own — `setenv` persists at the tmux-session level and is
+    // inherited by `respawn-pane`, measured: `setenv FOO bar` survived two successive
+    // `respawn-pane -k`. Clearing a custom-model selection is what needs this.
+    for (const key of ['CLAUDE_CODE_EFFORT_LEVEL', ...(unsetKeys ?? [])]) {
+      if (!VALID_KEY.test(key)) {
+        console.warn(`[TmuxManager] Skipping invalid env unset key: ${JSON.stringify(key)}`);
+        continue;
+      }
+      try {
+        execSync(`${this.tmux()} setenv -t ${shellescape(muxName)} -u ${key}`, {
+          timeout: EXEC_TIMEOUT_MS,
+          stdio: ['pipe', 'pipe', 'pipe'],
+        });
+      } catch {
+        /* Non-critical — var may not exist */
+      }
     }
     if (!envOverrides) return;
-    const VALID_KEY = /^[A-Z_][A-Z0-9_]*$/;
     for (const [key, value] of Object.entries(envOverrides)) {
       if (!value) continue; // Skip empty — nothing to set
       if (!VALID_KEY.test(key)) {
@@ -2208,6 +2221,7 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
       ompConfig,
       resumeSessionId,
       envOverrides,
+      unsetEnvKeys,
       effort,
       remote,
       docker,
@@ -2269,8 +2283,9 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
       );
       this._configureStatusLineUserCommand(muxName, userStatusLineCommand);
 
-      // Re-apply user env overrides before respawn so the new shell inherits them.
-      this.applyEnvOverrides(muxName, envOverrides);
+      // Re-apply user env overrides before respawn so the new shell inherits them,
+      // dropping the ones the caller retired first (see applyEnvOverrides).
+      this.applyEnvOverrides(muxName, envOverrides, unsetEnvKeys);
 
       // -c /tmp + cd bounce — see createSession() for rationale (stale FUSE state).
       const launchCmd = remote || docker ? fullCmd : `cd ${JSON.stringify(workingDir)} && ${fullCmd}`;

src/types/session.ts

@@ -558,6 +558,29 @@ export interface SessionAttachmentHistoryItem {
 /**
  * Current state of a session
  */
+/** The public half of a session's custom-model selection (on the wire, in `SessionState`). */
+export interface CustomModelSelection {
+  endpointId: string;
+  modelId: string;
+  label?: string;
+}
+
+/**
+ * The full custom-model selection a session keeps: the public selection plus the
+ * bookkeeping `Session.setCustomModel()` needs to UNDO it later without guessing what
+ * it once wrote. Persisted to state.json only as the disk-only `__customModel` field
+ * (never broadcast); the injected env VALUES are not in here at all, since they carry
+ * the endpoint's API key, and are re-derived from the endpoint store on recovery.
+ */
+export interface CustomModelBookkeeping extends CustomModelSelection {
+  /** Env keys the selection injected into the session's envOverrides / tmux session. */
+  envKeys: string[];
+  /** Isolated per-session config directory written for a `configDir`-kind CLI. */
+  configDir?: string;
+  /** Value forced onto the CLI's `model` launch param (pi/omp `custom/<id>`, grok's block name). */
+  launchModel?: string;
+}
+
 export interface SessionState {
   /** Unique session identifier */
   id: string;
@@ -678,12 +701,14 @@ export interface SessionState {
   /** Claude CLI effort level (soft default via --settings, switchable in-session via /effort) */
   effort?: EffortLevel;
   /**
-   * Custom Model Endpoint Profiles (deployment_plan.md): the custom OpenAI-compatible
-   * endpoint (local or cloud) this session's CLI is currently pointed at, if any.
-   * Undefined = the harness's native cloud default. No secrets here — the endpoint's
-   * base URL/api key live only in Session._envOverrides, never in this public state.
+   * Custom Model Endpoint Profiles (docs/custom-model-endpoints-plan.md): the custom
+   * OpenAI-compatible endpoint (local or cloud) this session's CLI is currently pointed
+   * at, if any. Undefined = the harness's native cloud default. No secrets here — the
+   * endpoint's base URL/api key live only in Session._envOverrides, never in this public
+   * state. The internal half (which env keys were injected, which config dir was
+   * written) is {@link CustomModelBookkeeping}, persisted disk-only like `__envOverrides`.
    */
-  customModel?: { endpointId: string; modelId: string; label?: string };
+  customModel?: CustomModelSelection;
   /** Sanitized per-session attachment history. */
   attachmentHistory?: SessionAttachmentHistoryItem[];
   /**

src/web/routes/custom-model-routes.ts

@@ -1,16 +1,17 @@
 /**
  * @fileoverview Custom Model Endpoint Profiles CRUD + discovery
- * (deployment_plan.md). Endpoints are machine-level infra, like remote/docker
- * hosts, so writes are admin-only in multi-user mode
+ * (docs/custom-model-endpoints-plan.md). Endpoints are machine-level infra,
+ * like remote/docker hosts, so writes are admin-only in multi-user mode
  * (`case-routes.ts`'s `/api/remote-hosts` is the pattern this mirrors).
  *
- * Discovery (`POST /:id/discover-models`) fetches `${baseUrl}/v1/models`.
- * `isBlockedWebviewUrl()` is the same synchronous hostname/link-local/cloud-
- * metadata check `webview-egress-policy.ts` uses for saved dashboard URLs —
- * reused here as a save-time and discover-time guard. It does NOT re-check
- * the DNS-RESOLVED address the way `webviewFetch()`'s undici lookup hook
- * does; wiring that dispatcher-level guard here is a followup, not done in
- * this pass, since this route is already admin-only in multi-user mode.
+ * Discovery (`POST /:id/discover-models`) fetches `${baseUrl}/v1/models`
+ * through `webviewFetch()` (`webview-egress.ts`), the same guarded dispatcher
+ * the web-tab proxy uses: `baseUrl` is refused at save time by the schema's
+ * hostname check (link-local / cloud-metadata literals and names), and the
+ * undici lookup hook refuses a name that RESOLVES into one of those ranges at
+ * connect time, redirects included — a save-time hostname check alone would
+ * let `models.example` resolve to 169.254.169.254 later. The endpoint is
+ * admin-configured, so this is defence in depth rather than the only gate.
  */
 
 import type { FastifyInstance, FastifyRequest } from 'fastify';
@@ -19,6 +20,7 @@ import { isAdmin, parseBody } from '../route-helpers.js';
 import { isMultiUserMode } from '../../config/multiuser.js';
 import { getDataDir } from '../../config/instance.js';
 import { isBlockedWebviewUrl } from '../webview-egress-policy.js';
+import { egressBlockedReason, webviewFetch } from '../webview-egress.js';
 import { CustomModelHostSchema } from '../schemas.js';
 import { readCustomModelHosts, writeCustomModelHosts, type CustomModelHost } from '../../custom-model-hosts.js';
 
@@ -40,7 +42,7 @@ async function discoverModels(host: Pick<CustomModelHost, 'baseUrl' | 'apiKey' |
   if (apiKey && style === 'bearer') headers.Authorization = `Bearer ${apiKey}`;
   if (apiKey && style === 'api-key') headers['api-key'] = apiKey;
 
-  const res = await fetch(`${host.baseUrl.replace(/\/+$/, '')}/v1/models`, {
+  const res = await webviewFetch(new URL(`${host.baseUrl.replace(/\/+$/, '')}/v1/models`), {
     headers,
     signal: AbortSignal.timeout(DISCOVER_TIMEOUT_MS),
   });
@@ -49,6 +51,21 @@ async function discoverModels(host: Pick<CustomModelHost, 'baseUrl' | 'apiKey' |
   return (body.data ?? []).map((m) => m.id).filter((id): id is string => typeof id === 'string' && id.length > 0);
 }
 
+/**
+ * undici reports every network failure as `TypeError('fetch failed', { cause })`, with the
+ * useful part (`connect ECONNREFUSED 127.0.0.1:8080`) one level down; surface the deepest
+ * message so the user sees the refused connection, not the wrapper.
+ */
+function describeFetchError(err: unknown): string {
+  let message = err instanceof Error ? err.message : String(err);
+  let current: unknown = err;
+  for (let depth = 0; depth < 5 && current instanceof Error && current.cause !== undefined; depth++) {
+    current = current.cause;
+    if (current instanceof Error && current.message) message = current.message;
+  }
+  return message;
+}
+
 export function registerCustomModelRoutes(app: FastifyInstance): void {
   app.get('/api/model-endpoints', async (req) =>
     isMultiUserMode() && !isAdmin(req) ? [] : readCustomModelHosts(CODEMAN_CONFIG_DIR)
@@ -118,9 +135,10 @@ export function registerCustomModelRoutes(app: FastifyInstance): void {
         await writeCustomModelHosts(CODEMAN_CONFIG_DIR, next);
         return { success: true, data: { models } };
       } catch (err) {
+        const blocked = egressBlockedReason(err);
         return createErrorResponse(
           ApiErrorCode.OPERATION_FAILED,
-          `Could not reach endpoint: ${err instanceof Error ? err.message : String(err)}`
+          blocked ? `Endpoint refused: ${blocked}` : `Could not reach endpoint: ${describeFetchError(err)}`
         );
       }
     }

src/web/routes/session-routes.ts

@@ -54,8 +54,8 @@ import {
   CustomModelSelectionSchema,
 } from '../schemas.js';
 import { readCustomModelHosts } from '../../custom-model-hosts.js';
-import { buildCustomModelInjection } from '../../custom-model-injection.js';
-import { applyConfigDirInjection, removeConfigDir } from '../../custom-model-injection-apply.js';
+import { applyCustomModelInjection, removeConfigDir } from '../../custom-model-injection-apply.js';
+import { matchesPattern } from '../../config/cli-registry/patterns.js';
 import { ownerLayoutKey } from '../../tab-layout-persistence.js';
 import { TabLayoutValidationError } from '../../tab-layout.js';
 import {
@@ -1156,7 +1156,7 @@ export function registerSessionRoutes(
     return { color: session.color };
   });
 
-  // ========== Custom Model Endpoint Profiles (deployment_plan.md) ==========
+  // ========== Custom Model Endpoint Profiles (docs/custom-model-endpoints-plan.md) ==========
   //
   // Applies (or clears) a session's custom OpenAI-compatible endpoint selection and
   // RESTARTS the pane's CLI process — these harnesses read endpoint config at process
@@ -1165,17 +1165,30 @@ export function registerSessionRoutes(
   // (chunk 3's CRUD routes), never raw client-supplied env — that's what keeps this
   // route safe to let any session owner call for their own session, unlike the
   // generic envOverrides field the privilegedEnvKeys clamp exists to guard.
+  //
+  // ⚠️ Local sessions only for now. A remote session's `restartCli()` renders
+  // `ssh ... tmux new-session -A`, which reattaches the durable remote tmux rather than
+  // restarting the agent, and the env lands on the LOCAL pane running ssh, which
+  // forwards nothing; docker is the same attach-or-create shape. Both used to answer
+  // `restarted: true` and change nothing, so they are refused until those paths are
+  // plumbed (the env would have to ride the remote/in-container launch command).
   app.post('/api/sessions/:id/custom-model', async (req) => {
     const { id } = req.params as { id: string };
     const body = parseBody(CustomModelSelectionSchema, req.body, 'Invalid request body');
     const session = findSessionOrFail(ctx, id, req);
 
+    if (session.remote || session.docker) {
+      return createErrorResponse(
+        ApiErrorCode.INVALID_INPUT,
+        'Custom model endpoints are not supported for remote (SSH) or Docker sessions yet'
+      );
+    }
     if (session.isBusy()) {
       return createErrorResponse(ApiErrorCode.SESSION_BUSY, 'Session is busy');
     }
 
     if ('clear' in body) {
-      const previousConfigDir = session.setCustomModel(undefined);
+      const { previousConfigDir } = session.setCustomModel(undefined);
       removeConfigDir(previousConfigDir);
       const restarted = await session.restartCli();
       persistAndBroadcastSession(ctx, session);
@@ -1196,32 +1209,41 @@ export function registerSessionRoutes(
       return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Model endpoint not found');
     }
 
-    const injection = buildCustomModelInjection(entry, endpoint, body.modelId);
-
-    let envOverrides: Record<string, string>;
-    let envKeys: string[];
-    let configDir: string | undefined;
-
-    if (injection.kind === 'env') {
-      envOverrides = injection.envOverrides;
-      envKeys = Object.keys(injection.envOverrides);
-    } else if (injection.kind === 'configDir') {
-      // Isolated per-session dir — never the user's real CLI config path.
-      configDir = join(dataPath('custom-model-configs'), session.id);
-      envOverrides = applyConfigDirInjection(configDir, injection);
-      envKeys = Object.keys(envOverrides);
-    } else {
-      // 'unsupported' is already handled above; this keeps the switch exhaustive.
+    // A CLI whose config alone cannot select the model also gets its `model` launch param
+    // forced (pi/omp `custom/<id>`, grok's block name). The argv engine DROPS a token that
+    // fails its pattern rather than quoting it, which would silently launch the CLI on its
+    // own default provider again, so refuse an id the pattern cannot carry up front.
+    const modelSpec = entry.launch.params.model;
+    const applied = applyCustomModelInjection(entry, endpoint, body.modelId, session.id);
+    if (!applied) {
       return createErrorResponse(ApiErrorCode.OPERATION_FAILED, `${session.mode} has no known custom-model mechanism`);
     }
+    if (
+      applied.launchModel !== undefined &&
+      modelSpec?.type === 'token' &&
+      !matchesPattern(modelSpec.pattern, applied.launchModel)
+    ) {
+      removeConfigDir(applied.configDir);
+      return createErrorResponse(
+        ApiErrorCode.INVALID_INPUT,
+        `Model id ${JSON.stringify(body.modelId)} cannot be passed to ${session.mode} on its command line`
+      );
+    }
 
-    const previousConfigDir = session.setCustomModel(
-      { endpointId: endpoint.id, modelId: body.modelId, label: endpoint.label, envKeys, configDir },
-      envOverrides
+    const { previousConfigDir } = session.setCustomModel(
+      {
+        endpointId: endpoint.id,
+        modelId: body.modelId,
+        label: endpoint.label,
+        envKeys: applied.envKeys,
+        configDir: applied.configDir,
+        launchModel: applied.launchModel,
+      },
+      applied.envOverrides
     );
     // Clean up the OLD config dir on disk, unless the new one happens to reuse the same
     // path (same session, configDir kind again) — never delete the dir we just wrote.
-    if (previousConfigDir && previousConfigDir !== configDir) {
+    if (previousConfigDir && previousConfigDir !== applied.configDir) {
       removeConfigDir(previousConfigDir);
     }
 

src/web/schemas.ts

@@ -739,29 +739,6 @@ export const RemoteHostSchema = z.object({
   commands: RemoteCommandOverridesSchema,
 });
 
-// Custom Model Endpoint Profiles (deployment_plan.md) — a user-configured custom
-// OpenAI-compatible endpoint, local (llama.cpp) or cloud (Azure AI Foundry, etc.).
-export const CustomModelHostSchema = z.object({
-  id: z.string().regex(/^[a-zA-Z0-9_-]+$/, 'Invalid endpoint id'),
-  label: z.string().min(1).max(100),
-  baseUrl: z.string().url().max(2048),
-  apiKey: z.string().max(4096).optional(),
-  // No 'both': live-tested against a real server, sending both auth header
-  // conventions on one request reliably HANGS it — see custom-model-hosts.ts.
-  authStyle: z.enum(['bearer', 'api-key']).optional(),
-  models: z.array(z.string().max(200)).max(200).optional(),
-  lastDiscoveredAt: z.string().max(64).optional(),
-});
-
-/** POST /api/sessions/:id/custom-model — apply or clear a session's custom-model selection. */
-export const CustomModelSelectionSchema = z.union([
-  z.object({
-    endpointId: z.string().regex(/^[a-zA-Z0-9_-]+$/, 'Invalid endpoint id'),
-    modelId: z.string().min(1).max(200),
-  }),
-  z.object({ clear: z.literal(true) }),
-]);
-
 export const RemoteCaseLinkSchema = z.object({
   name: z.string().regex(/^[a-zA-Z0-9_-]+$/, 'Invalid case name format'),
   hostId: z.string().regex(/^[a-zA-Z0-9_-]+$/, 'Invalid remote host id'),
@@ -1261,7 +1238,7 @@ export const SettingsUpdateSchema = z
      */
     readMyMindEnabled: z.boolean().optional(),
     /**
-     * Custom Model Endpoint Profiles (deployment_plan.md): the toolbar picker that lets a
+     * Custom Model Endpoint Profiles (docs/custom-model-endpoints-plan.md): the toolbar picker that lets a
      * session point at a user-configured custom OpenAI-compatible endpoint (local or
      * cloud) instead of its native cloud backend. SYNCED, default OFF — endpoint entry,
      * discovery, and the extra toolbar surface are all opt-in.
@@ -1918,3 +1895,29 @@ export const WebviewUpdateSchema = WebviewBaseSchema.partial();
 
 /** POST /api/webviews/probe: reachability + framing check for the editor's Test button. */
 export const WebviewProbeSchema = z.object({ url: webviewUrlSchema });
+
+// Custom Model Endpoint Profiles (docs/custom-model-endpoints-plan.md) — a
+// user-configured custom OpenAI-compatible endpoint, local (llama.cpp) or cloud
+// (Azure AI Foundry, etc.). Lives below `webviewUrlSchema` because `baseUrl` IS that
+// schema: http(s) only, a real hostname, no embedded credentials, and the link-local /
+// cloud-metadata refusal, the same bar a saved dashboard URL has to clear.
+export const CustomModelHostSchema = z.object({
+  id: z.string().regex(/^[a-zA-Z0-9_-]+$/, 'Invalid endpoint id'),
+  label: z.string().min(1).max(100),
+  baseUrl: webviewUrlSchema,
+  apiKey: z.string().max(4096).optional(),
+  // No 'both': live-tested against a real server, sending both auth header
+  // conventions on one request reliably HANGS it — see custom-model-hosts.ts.
+  authStyle: z.enum(['bearer', 'api-key']).optional(),
+  models: z.array(z.string().max(200)).max(200).optional(),
+  lastDiscoveredAt: z.string().max(64).optional(),
+});
+
+/** POST /api/sessions/:id/custom-model — apply or clear a session's custom-model selection. */
+export const CustomModelSelectionSchema = z.union([
+  z.object({
+    endpointId: z.string().regex(/^[a-zA-Z0-9_-]+$/, 'Invalid endpoint id'),
+    modelId: z.string().min(1).max(200),
+  }),
+  z.object({ clear: z.literal(true) }),
+]);

src/web/server.ts

@@ -67,6 +67,10 @@ import {
 import { imageWatcher } from '../image-watcher.js';
 import { workflowRunWatcher, summarizeRun } from '../workflow-run-watcher.js';
 import { attachmentRegistry, buildFileThumbnailRoute, registerExternalAttachment } from '../attachment-registry.js';
+import { getCli } from '../config/cli-registry/registry.js';
+import { readCustomModelHosts } from '../custom-model-hosts.js';
+import { applyCustomModelInjection, customModelConfigDir, removeConfigDir } from '../custom-model-injection-apply.js';
+import type { CustomModelBookkeeping } from '../types/session.js';
 import { registerGeneratedArtifactAttachment } from '../generated-artifact-attachments.js';
 import {
   buildDetectedAttachmentHistoryItem,
@@ -1181,6 +1185,34 @@ export class WebServer extends EventEmitter {
     });
   }
 
+  /**
+   * Recovery half of Custom Model Endpoint Profiles: the env values a selection injects
+   * are never persisted (they carry the API key), so they are computed again from the
+   * endpoint store, through the SAME apply path the route uses. Undefined when the
+   * endpoint is gone or the CLI is unregistered: the bookkeeping is still restored so
+   * the selection can be cleared, and the pane keeps running on tmux's retained env.
+   */
+  private async _rebuildCustomModelEnv(
+    session: Session,
+    saved: CustomModelBookkeeping
+  ): Promise<Record<string, string> | undefined> {
+    const entry = getCli(session.mode);
+    if (!entry) return undefined;
+    const endpoint = (await readCustomModelHosts(getDataDir())).find((h) => h.id === saved.endpointId);
+    if (!endpoint) {
+      console.warn(
+        `[WebServer] custom-model endpoint ${saved.endpointId} no longer exists; selection kept for clearing`
+      );
+      return undefined;
+    }
+    try {
+      return applyCustomModelInjection(entry, endpoint, saved.modelId, session.id)?.envOverrides;
+    } catch (err) {
+      console.warn('[WebServer] Failed to rebuild custom-model env on recovery:', err);
+      return undefined;
+    }
+  }
+
   /** Persists full session state including respawn config to state.json */
   private _persistSessionStateNow(session: Session): void {
     // See session-manager.updateSessionState: __envOverrides is an internal disk-only
@@ -1190,10 +1222,14 @@ export class WebServer extends EventEmitter {
     // __attachmentHistory keeps the private (externalPath-bearing) history on disk,
     // separate from the sanitized public attachmentHistory in toState().
     const attachmentHistory = session.getAttachmentHistoryForPersist();
+    // __customModel keeps the selection's bookkeeping (injected env KEYS, config dir,
+    // launch model; never the values) so recovery can restore and later clear it.
+    const customModel = session.getCustomModelForPersist();
     const state = {
       ...base,
       ...(envOverrides ? { __envOverrides: envOverrides } : {}),
       ...(attachmentHistory ? { __attachmentHistory: attachmentHistory } : {}),
+      ...(customModel ? { __customModel: customModel } : {}),
     } as SessionState;
     const controller = this.respawnControllers.get(session.id);
     if (controller) {
@@ -1396,6 +1432,9 @@ export class WebServer extends EventEmitter {
       // come back to a loader whose file we deleted.
       if (killMux) {
         void removeAgentSessionPreamble(sessionId);
+        // The per-session custom-model config dir carries the endpoint's API key (pi and
+        // omp embed it literally); it must not outlive the session it was written for.
+        removeConfigDir(customModelConfigDir(sessionId));
       }
       await session.stop(killMux);
       this.sessions.delete(sessionId);
@@ -2853,6 +2892,7 @@ export class WebServer extends EventEmitter {
             // Note: a legacy CLAUDE_CODE_EFFORT_LEVEL entry is auto-migrated to `effort`
             // by the Session constructor (env var would hard-lock /effort switching).
             const savedEnvOverrides = (savedState as { __envOverrides?: Record<string, string> })?.__envOverrides;
+            const savedCustomModel = (savedState as { __customModel?: CustomModelBookkeeping })?.__customModel;
             // Prefer the private (externalPath-bearing) history; fall back to the
             // sanitized public copy for sessions persisted before that split.
             const savedAttachmentHistory =
@@ -2915,6 +2955,16 @@ export class WebServer extends EventEmitter {
               parentSessionId: savedState?.parentSessionId,
             });
 
+            // Custom-model selection survives the restart. The tmux session still carries
+            // the injected `setenv`s (that is what kept the pane on the endpoint across the
+            // restart), but `_envOverrides` is rebuilt from a persist that deliberately
+            // excludes them, so re-derive the values from the endpoint store and re-write
+            // the isolated config dir; an endpoint that has since been deleted still gets
+            // the bookkeeping restored, which is what a later clear needs to unset.
+            if (savedCustomModel) {
+              session.setCustomModel(savedCustomModel, await this._rebuildCustomModelEnv(session, savedCustomModel));
+            }
+
             // Update session name if it was a "Restored:" placeholder or doesn't match saved name
             if (savedState?.name && muxSession.name !== savedState.name) {
               this.mux.updateSessionName(muxSession.sessionId, savedState.name);