feat(custom-model): launch directly on the endpoint, no restart, for 7 of 8 CLIs

Fixes the visible double-launch reported on Codex: picking a custom-model
Run-menu entry launched natively first, waited for it to settle, then
restarted it in place with the endpoint applied. Necessary for the design at
the time, but visibly a native boot immediately followed by a second one -
worst on a CLI whose TUI fully reinitializes on a restart, confirmed live on
Codex.

POST /api/quick-start gains an optional customModel field
({endpointId, modelId, confirmed?}). When present, the route mints the
session's id itself (crypto.randomUUID()) before constructing it, computes
the same injection the existing POST /api/sessions/:id/custom-model route
computes (including the llama-swap conflict check from the last commit -
same {requiresConfirmation, currentlyLoadedModel, affectedSessions} shape,
no session created until confirmed), and launches the session already
pointed at the endpoint: env vars via the constructor, and the launchModel
override merged onto piConfig/grokConfig/ompConfig using the registry's own
launch.legacyConfigField the same way session.ts's restart path already
does. No restart at all - setCustomModel() afterward is bookkeeping only.

Wired into 7 of 8 launch functions (session-ui.js): openCode, codex, gemini,
pi, grok, deepseek, omp. Claude stays on the original launch-then-restart
path for now: its own --resume-based restart is far less jarring than the
other seven's, and runClaude()'s multi-tab launch plus docker-config-drift
confirm/retry loop make folding it into the one-shot path separate,
higher-risk work than the other seven's each-a-single-simple-launch shape.

Also fixes a pre-existing 'mode === omp' branch flagged by the CLI-id
static guard (test/cli-registry-no-id-branching.test.ts) - the ompConfig
launchModel merge is the same 'legacy <Mode>Config plumbing' category as
the six sibling branches already allowlisted there, just newly literal
where it was previously only inside resolveOmpConfigForCreate's own check.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RqZeHrRS6DYcGcGX2p9EwG

src/web/public/session-ui.js

@@ -694,7 +694,96 @@ Object.assign(CodemanApp.prototype, {
    * default, which a one-off endpoint run must not do — and is restored in
    * `finally` even if run() throws.
    */
+  /**
+   * Dispatches to the ONE-SHOT launch path (below) for every custom-model-eligible CLI
+   * except claude, which still goes through the restart-after-native-boot path
+   * (`_runCustomModelEntryViaRestart`): claude's own `runClaude()` carries multi-tab
+   * launch and a docker-config-drift confirm/retry loop neither of the other seven
+   * functions has, and folding those into the one-shot flow is unstarted, separate work.
+   * The other seven (opencode/codex/gemini/pi/grok/deepseek/omp) are each a single,
+   * simple launch, so they get the one-shot path — the one visibly worth it, since a
+   * native-boot-then-restart is far more jarring on a CLI whose TUI fully reinitializes
+   * (Codex, confirmed live) than on claude's own `--resume`-based restart.
+   */
   async runCustomModelEntry(mode, endpointId, modelId) {
+    if (mode === 'claude') {
+      return this._runCustomModelEntryViaRestart(mode, endpointId, modelId);
+    }
+    return this._runCustomModelEntryOneShot(mode, endpointId, modelId);
+  },
+
+  /**
+   * Launches directly on the endpoint — no restart, so no visible relaunch. Stashes the
+   * pick on `_pendingCustomModelForLaunch` for the targeted run<Mode>() function to read
+   * and fold into its own /api/quick-start body (see `_quickStartWithCustomModelConfirm`);
+   * cleared in `finally` the same way `_runMode`'s temporary swap is, even if run() throws.
+   */
+  async _runCustomModelEntryOneShot(mode, endpointId, modelId) {
+    document.getElementById('runModeMenu')?.classList.remove('active');
+    const previousRunMode = this._runMode;
+    const tabCountEl = document.getElementById('tabCount');
+    const prevTabCount = tabCountEl?.value;
+    this._runMode = mode;
+    this._pendingCustomModelForLaunch = { endpointId, modelId };
+    if (tabCountEl) tabCountEl.value = '1';
+    try {
+      await this.run();
+    } finally {
+      this._runMode = previousRunMode;
+      this._pendingCustomModelForLaunch = undefined;
+      if (tabCountEl && prevTabCount !== undefined) tabCountEl.value = prevTabCount;
+    }
+
+    // run() (via _quickStartWithCustomModelConfirm) reports its own launch error or
+    // cancellation via toast and leaves this unset — nothing more to do here then.
+    const result = this._lastCustomModelLaunchResult;
+    this._lastCustomModelLaunchResult = undefined;
+    if (result?.modelSwapInProgress) {
+      void this._watchLlamaSwapLoading(endpointId, modelId);
+    }
+  },
+
+  /**
+   * POSTs a /api/quick-start body already carrying `customModel` (see the run<Mode>()
+   * call sites below), showing the same llama-swap "this will unload it for session X"
+   * warning the restart path's `_applyCustomModelToSession` shows when the route asks
+   * for confirmation, and retrying with `confirmed: true` on accept. Stashes the final
+   * response's payload on `_lastCustomModelLaunchResult` for
+   * `_runCustomModelEntryOneShot` to read `modelSwapInProgress` off afterward — run()'s
+   * eleven per-mode dispatch targets have no shared return-value contract of their own,
+   * so a side channel here is simpler than threading one through every one of them.
+   */
+  async _quickStartWithCustomModelConfirm(bodyObj) {
+    const post = async (body) => {
+      const res = await fetch('/api/quick-start', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      });
+      return res.json();
+    };
+    let data = await post(bodyObj);
+    if (data?.data?.requiresConfirmation) {
+      const { currentlyLoadedModel, affectedSessions } = data.data;
+      const names = affectedSessions.map((s) => s.name || s.id).join(', ');
+      const proceed = confirm(
+        `${names} ${affectedSessions.length === 1 ? 'is' : 'are'} currently using ` +
+          `${currentlyLoadedModel} on this endpoint. Switching will unload it for ` +
+          `${affectedSessions.length === 1 ? 'that session' : 'those sessions'} too. Continue?`
+      );
+      if (!proceed) {
+        this._lastCustomModelLaunchResult = undefined;
+        return { success: false, error: 'Model switch cancelled' };
+      }
+      data = await post({ ...bodyObj, customModel: { ...bodyObj.customModel, confirmed: true } });
+    }
+    this._lastCustomModelLaunchResult = data?.success !== false ? data?.data : undefined;
+    return data;
+  },
+
+  /** The restart-after-native-boot path — see `runCustomModelEntry`'s own comment for
+   *  which CLIs still use this one. */
+  async _runCustomModelEntryViaRestart(mode, endpointId, modelId) {
     document.getElementById('runModeMenu')?.classList.remove('active');
 
     const previousRunMode = this._runMode;
@@ -1583,20 +1672,16 @@ Object.assign(CodemanApp.prototype, {
       // Quick-start with opencode mode (auto-allow tools by default).
       // No `effort` field — it's Claude-specific (OpenCode has no /effort).
       const envOverrides = this.buildEnvOverrides(this.getCaseSettings(caseName), this.loadAppSettingsFromStorage());
-      const res = await fetch('/api/quick-start', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          caseName,
-          mode: 'opencode',
-          sessionName: `w${this._nextCaseSessionStartNumber(caseName)}-${caseName}`,
-          ...(isRemote ? {} : {
-            openCodeConfig: { autoAllowTools: true },
-            ...(Object.keys(envOverrides).length > 0 ? { envOverrides } : {}),
-          }),
-        })
+      const data = await this._quickStartWithCustomModelConfirm({
+        caseName,
+        mode: 'opencode',
+        sessionName: `w${this._nextCaseSessionStartNumber(caseName)}-${caseName}`,
+        ...(isRemote ? {} : {
+          openCodeConfig: { autoAllowTools: true },
+          ...(Object.keys(envOverrides).length > 0 ? { envOverrides } : {}),
+          ...(this._pendingCustomModelForLaunch ? { customModel: this._pendingCustomModelForLaunch } : {}),
+        }),
       });
-      const data = await res.json();
       if (!data.success) throw new Error(data.error || 'Failed to start OpenCode');
       await this._ensureCreatedSessionVisible(data.data.sessionId, data.data.session);
 
@@ -1637,24 +1722,20 @@ Object.assign(CodemanApp.prototype, {
 
       const globalSettings = this.loadAppSettingsFromStorage();
       const envOverrides = this.buildEnvOverrides(this.getCaseSettings(caseName), globalSettings);
-      const res = await fetch('/api/quick-start', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          caseName,
-          mode: 'codex',
-          sessionName: `w${this._nextCaseSessionStartNumber(caseName)}-${caseName}`,
-          ...(isRemote ? {} : {
-            codexConfig: {
-              dangerouslyBypassApprovals: globalSettings.codexDangerouslyBypassApprovals ?? false,
-              animations: globalSettings.codexAnimationsEnabled ?? false,
-              renderMode: 'hybrid',
-            },
-            ...(Object.keys(envOverrides).length > 0 ? { envOverrides } : {}),
-          }),
-        })
+      const data = await this._quickStartWithCustomModelConfirm({
+        caseName,
+        mode: 'codex',
+        sessionName: `w${this._nextCaseSessionStartNumber(caseName)}-${caseName}`,
+        ...(isRemote ? {} : {
+          codexConfig: {
+            dangerouslyBypassApprovals: globalSettings.codexDangerouslyBypassApprovals ?? false,
+            animations: globalSettings.codexAnimationsEnabled ?? false,
+            renderMode: 'hybrid',
+          },
+          ...(Object.keys(envOverrides).length > 0 ? { envOverrides } : {}),
+          ...(this._pendingCustomModelForLaunch ? { customModel: this._pendingCustomModelForLaunch } : {}),
+        }),
       });
-      const data = await res.json();
       if (!data.success) throw new Error(data.error || 'Failed to start Codex');
       await this._ensureCreatedSessionVisible(data.data.sessionId, data.data.session);
 
@@ -1694,20 +1775,16 @@ Object.assign(CodemanApp.prototype, {
       }
 
       const envOverrides = this.buildEnvOverrides(this.getCaseSettings(caseName), this.loadAppSettingsFromStorage());
-      const res = await fetch('/api/quick-start', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          caseName,
-          mode: 'gemini',
-          sessionName: `w${this._nextCaseSessionStartNumber(caseName)}-${caseName}`,
-          ...(isRemote ? {} : {
-            geminiConfig: { approvalMode: 'yolo' },
-            ...(Object.keys(envOverrides).length > 0 ? { envOverrides } : {}),
-          }),
-        })
+      const data = await this._quickStartWithCustomModelConfirm({
+        caseName,
+        mode: 'gemini',
+        sessionName: `w${this._nextCaseSessionStartNumber(caseName)}-${caseName}`,
+        ...(isRemote ? {} : {
+          geminiConfig: { approvalMode: 'yolo' },
+          ...(Object.keys(envOverrides).length > 0 ? { envOverrides } : {}),
+          ...(this._pendingCustomModelForLaunch ? { customModel: this._pendingCustomModelForLaunch } : {}),
+        }),
       });
-      const data = await res.json();
       if (!data.success) throw new Error(data.error || 'Failed to start Gemini');
       await this._ensureCreatedSessionVisible(data.data.sessionId, data.data.session);
 
@@ -1805,17 +1882,13 @@ Object.assign(CodemanApp.prototype, {
       }
 
       const envOverrides = this.buildEnvOverrides(this.getCaseSettings(caseName), this.loadAppSettingsFromStorage());
-      const res = await fetch('/api/quick-start', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          caseName,
-          mode: 'pi',
-          sessionName: `w${this._nextCaseSessionStartNumber(caseName)}-${caseName}`,
-          ...(isRemote || Object.keys(envOverrides).length === 0 ? {} : { envOverrides }),
-        })
+      const data = await this._quickStartWithCustomModelConfirm({
+        caseName,
+        mode: 'pi',
+        sessionName: `w${this._nextCaseSessionStartNumber(caseName)}-${caseName}`,
+        ...(isRemote || Object.keys(envOverrides).length === 0 ? {} : { envOverrides }),
+        ...(!isRemote && this._pendingCustomModelForLaunch ? { customModel: this._pendingCustomModelForLaunch } : {}),
       });
-      const data = await res.json();
       if (!data.success) throw new Error(data.error || 'Failed to start Pi');
       await this._ensureCreatedSessionVisible(data.data.sessionId, data.data.session);
 
@@ -1853,19 +1926,15 @@ Object.assign(CodemanApp.prototype, {
       }
 
       const envOverrides = this.buildEnvOverrides(this.getCaseSettings(caseName), this.loadAppSettingsFromStorage());
-      const res = await fetch('/api/quick-start', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          caseName,
-          mode: 'omp',
-          sessionName: `w${this._nextCaseSessionStartNumber(caseName)}-${caseName}`,
-          ...(isRemote ? {} : {
-            ...(Object.keys(envOverrides).length > 0 ? { envOverrides } : {}),
-          }),
-        })
+      const data = await this._quickStartWithCustomModelConfirm({
+        caseName,
+        mode: 'omp',
+        sessionName: `w${this._nextCaseSessionStartNumber(caseName)}-${caseName}`,
+        ...(isRemote ? {} : {
+          ...(Object.keys(envOverrides).length > 0 ? { envOverrides } : {}),
+          ...(this._pendingCustomModelForLaunch ? { customModel: this._pendingCustomModelForLaunch } : {}),
+        }),
       });
-      const data = await res.json();
       if (!data.success) throw new Error(data.error || 'Failed to start OMP');
       await this._ensureCreatedSessionVisible(data.data.sessionId, data.data.session);
 
@@ -1912,20 +1981,16 @@ Object.assign(CodemanApp.prototype, {
       }
 
       const envOverrides = this.buildEnvOverrides(this.getCaseSettings(caseName), this.loadAppSettingsFromStorage());
-      const res = await fetch('/api/quick-start', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          caseName,
-          mode: 'grok',
-          sessionName: `w${this._nextCaseSessionStartNumber(caseName)}-${caseName}`,
-          ...(isRemote ? {} : {
-            grokConfig: { alwaysApprove: true },
-            ...(Object.keys(envOverrides).length > 0 ? { envOverrides } : {}),
-          }),
-        })
+      const data = await this._quickStartWithCustomModelConfirm({
+        caseName,
+        mode: 'grok',
+        sessionName: `w${this._nextCaseSessionStartNumber(caseName)}-${caseName}`,
+        ...(isRemote ? {} : {
+          grokConfig: { alwaysApprove: true },
+          ...(Object.keys(envOverrides).length > 0 ? { envOverrides } : {}),
+          ...(this._pendingCustomModelForLaunch ? { customModel: this._pendingCustomModelForLaunch } : {}),
+        }),
       });
-      const data = await res.json();
       if (!data.success) throw new Error(data.error || 'Failed to start Grok');
       await this._ensureCreatedSessionVisible(data.data.sessionId, data.data.session);
 
@@ -1990,20 +2055,16 @@ Object.assign(CodemanApp.prototype, {
       }
 
       const envOverrides = this.buildEnvOverrides(this.getCaseSettings(caseName), this.loadAppSettingsFromStorage());
-      const res = await fetch('/api/quick-start', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          caseName,
-          mode: 'deepseek',
-          sessionName: `w${this._nextCaseSessionStartNumber(caseName)}-${caseName}`,
-          ...(isRemote ? {} : {
-            deepSeekConfig: { permissionMode: 'danger-full-access' },
-            ...(Object.keys(envOverrides).length > 0 ? { envOverrides } : {}),
-          }),
-        })
+      const data = await this._quickStartWithCustomModelConfirm({
+        caseName,
+        mode: 'deepseek',
+        sessionName: `w${this._nextCaseSessionStartNumber(caseName)}-${caseName}`,
+        ...(isRemote ? {} : {
+          deepSeekConfig: { permissionMode: 'danger-full-access' },
+          ...(Object.keys(envOverrides).length > 0 ? { envOverrides } : {}),
+          ...(this._pendingCustomModelForLaunch ? { customModel: this._pendingCustomModelForLaunch } : {}),
+        }),
       });
-      const data = await res.json();
       if (!data.success) throw new Error(data.error || 'Failed to start DeepSeek');
       await this._ensureCreatedSessionVisible(data.data.sessionId, data.data.session);
 

src/web/routes/session-routes.ts

@@ -11,7 +11,7 @@ import { homedir } from 'node:os';
 import { existsSync, statSync, mkdirSync, writeFileSync } from 'node:fs';
 import { execFile } from 'node:child_process';
 import fs from 'node:fs/promises';
-import { randomBytes } from 'node:crypto';
+import { randomBytes, randomUUID } from 'node:crypto';
 import { performance } from 'node:perf_hooks';
 import {
   ApiErrorCode,
@@ -3136,6 +3136,7 @@ export function registerSessionRoutes(
       effort,
       parentSessionId,
       agentOrigin,
+      customModel,
     } = parseBody(QuickStartSchema, req.body);
 
     // Resolved ONCE here: the same value labels a case directory this request creates
@@ -3188,11 +3189,12 @@ export function registerSessionRoutes(
         grokConfig ||
         deepSeekConfig ||
         ompConfig ||
-        openCodeConfig
+        openCodeConfig ||
+        customModel
       ) {
         return createErrorResponse(
           ApiErrorCode.INVALID_INPUT,
-          'envOverrides, effort, modelOverride, and per-CLI config are not supported for remote cases (they do not cross ssh). Configure the remote command via the host command override instead.'
+          'envOverrides, effort, modelOverride, per-CLI config, and custom model endpoints are not supported for remote cases (they do not cross ssh). Configure the remote command via the host command override instead.'
         );
       }
 
@@ -3223,11 +3225,12 @@ export function registerSessionRoutes(
         grokConfig ||
         deepSeekConfig ||
         ompConfig ||
-        openCodeConfig
+        openCodeConfig ||
+        customModel
       ) {
         return createErrorResponse(
           ApiErrorCode.INVALID_INPUT,
-          'envOverrides, effort, and per-CLI config are not supported for docker cases (they do not cross into the container). Configure the container via the docker host command override instead.'
+          'envOverrides, effort, per-CLI config, and custom model endpoints are not supported for docker cases (they do not cross into the container). Configure the container via the docker host command override instead.'
         );
       }
 
@@ -3515,7 +3518,106 @@ export function registerSessionRoutes(
     );
     const qsTerminalHistoryConfig = await ctx.getTerminalHistoryConfig();
     const qsGatedEnvOverrides = await clampEnvOverridesForOwner(owner, envOverrides);
+    const qsResolvedOmpConfig = resolveOmpConfigForCreate(mode, resolvedCasePath, ompConfig);
+
+    // Custom Model Endpoint Profiles, applied AT CREATE TIME (docs/custom-model-endpoints-plan.md)
+    // rather than via the dedicated restart-in-place route (POST /api/sessions/:id/custom-
+    // model, still what an ALREADY-RUNNING session uses to switch later): computing the
+    // injection before the process exists and launching directly on it avoids the visible
+    // native-boot-then-restart the restart-after-launch design otherwise shows on every
+    // custom-model run — most jarring on a CLI like Codex whose TUI fully reinitializes.
+    // Mirrors the dedicated route's own checks (llama-swap conflict, unsupported CLI,
+    // unknown endpoint, a model id the CLI's argv pattern can't carry) rather than trusting
+    // a lighter version of them, since this is the same server-side authority reached a
+    // different way, not a separate, less-checked path.
+    let qsCustomModelEnvOverrides = qsGatedEnvOverrides;
+    let qsCustomModelLaunchModel: string | undefined;
+    let qsCustomModelSessionId: string | undefined;
+    let qsCustomModelBookkeeping:
+      | {
+          endpointId: string;
+          modelId: string;
+          label?: string;
+          envKeys: string[];
+          configDir?: string;
+          launchModel?: string;
+        }
+      | undefined;
+    if (customModel) {
+      const cmEntry = getCli(mode);
+      if (!cmEntry) return createErrorResponse(ApiErrorCode.INVALID_INPUT, `No CLI registry entry for mode ${mode}`);
+      if (cmEntry.capabilities.customModelInjection.kind === 'unsupported') {
+        return createErrorResponse(ApiErrorCode.OPERATION_FAILED, `${mode} has no known custom-model mechanism`);
+      }
+      const cmHosts = await readCustomModelHosts(CODEMAN_CONFIG_DIR);
+      const cmEndpoint = cmHosts.find((h) => h.id === customModel.endpointId);
+      if (!cmEndpoint) return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Model endpoint not found');
+
+      // See the dedicated route's own comment for the full reasoning: llama.cpp runs one
+      // model at a time, llama-swap swaps on demand, and switching away from what another
+      // live session is actively using deserves a warning, not a silent switch. There is no
+      // "self" to exclude from the affected-sessions scan here — this session doesn't exist
+      // yet.
+      const cmSwapStatus = await getLlamaSwapStatus(cmEndpoint);
+      const cmCurrentlyLoaded =
+        cmSwapStatus.running.find((r) => r.state === 'ready')?.model ?? cmSwapStatus.running[0]?.model;
+      const cmSwapNeeded = cmSwapStatus.isLlamaSwap && !!cmCurrentlyLoaded && cmCurrentlyLoaded !== customModel.modelId;
+      if (cmSwapNeeded && !customModel.confirmed) {
+        const cmAffectedSessions = [...ctx.sessions.values()]
+          .filter((s) => s.customModel?.endpointId === cmEndpoint.id && s.customModel?.modelId === cmCurrentlyLoaded)
+          .map((s) => ({ id: s.id, name: s.name }));
+        if (cmAffectedSessions.length > 0) {
+          return {
+            requiresConfirmation: true,
+            currentlyLoadedModel: cmCurrentlyLoaded,
+            affectedSessions: cmAffectedSessions,
+          };
+        }
+      }
+
+      // Minted ourselves (rather than left to Session's own default) so the injection
+      // below — and any configDir it writes — can target the REAL id the session launches
+      // with, not a placeholder: `new Session({ id: ... })` accepts an explicit id for
+      // exactly this reason.
+      qsCustomModelSessionId = randomUUID();
+      const cmContextLength = cmEndpoint.modelContextLengths?.[customModel.modelId];
+      const cmApplied = applyCustomModelInjection(
+        cmEntry,
+        cmEndpoint,
+        customModel.modelId,
+        qsCustomModelSessionId,
+        cmContextLength
+      );
+      if (!cmApplied) {
+        return createErrorResponse(ApiErrorCode.OPERATION_FAILED, `${mode} has no known custom-model mechanism`);
+      }
+      const cmModelSpec = cmEntry.launch.params.model;
+      if (
+        cmApplied.launchModel !== undefined &&
+        cmModelSpec?.type === 'token' &&
+        !matchesPattern(cmModelSpec.pattern, cmApplied.launchModel)
+      ) {
+        removeConfigDir(cmApplied.configDir);
+        return createErrorResponse(
+          ApiErrorCode.INVALID_INPUT,
+          `Model id ${JSON.stringify(customModel.modelId)} cannot be passed to ${mode} on its command line`
+        );
+      }
+
+      qsCustomModelEnvOverrides = { ...qsGatedEnvOverrides, ...cmApplied.envOverrides };
+      qsCustomModelLaunchModel = cmApplied.launchModel;
+      qsCustomModelBookkeeping = {
+        endpointId: cmEndpoint.id,
+        modelId: customModel.modelId,
+        label: cmEndpoint.label,
+        envKeys: cmApplied.envKeys,
+        configDir: cmApplied.configDir,
+        launchModel: cmApplied.launchModel,
+      };
+    }
+
     const session = new Session({
+      id: qsCustomModelSessionId,
       workingDir: resolvedCasePath,
       name: sessionName ? sessionName.slice(0, MAX_SESSION_NAME_LENGTH) : '',
       mux: ctx.mux,
@@ -3530,11 +3632,24 @@ export function registerSessionRoutes(
       codexConfig: mode === 'codex' ? qsGatedCodexConfig : undefined,
       geminiConfig: mode === 'gemini' ? qsGatedGeminiConfig : undefined,
       antigravityConfig: mode === 'antigravity' ? qsGatedAntigravityConfig : undefined,
-      piConfig: mode === 'pi' ? qsGatedPiConfig : undefined,
-      grokConfig: mode === 'grok' ? qsGatedGrokConfig : undefined,
+      piConfig:
+        mode === 'pi'
+          ? qsCustomModelLaunchModel !== undefined
+            ? { ...(qsGatedPiConfig ?? {}), model: qsCustomModelLaunchModel }
+            : qsGatedPiConfig
+          : undefined,
+      grokConfig:
+        mode === 'grok'
+          ? qsCustomModelLaunchModel !== undefined
+            ? { ...(qsGatedGrokConfig ?? {}), model: qsCustomModelLaunchModel }
+            : qsGatedGrokConfig
+          : undefined,
       deepSeekConfig: mode === 'deepseek' ? qsGatedDeepSeekConfig : undefined,
-      ompConfig: resolveOmpConfigForCreate(mode, resolvedCasePath, ompConfig),
-      envOverrides: qsGatedEnvOverrides,
+      ompConfig:
+        mode === 'omp' && qsCustomModelLaunchModel !== undefined
+          ? { ...(qsResolvedOmpConfig ?? {}), model: qsCustomModelLaunchModel }
+          : qsResolvedOmpConfig,
+      envOverrides: qsCustomModelEnvOverrides,
       effort,
       remote,
       docker,
@@ -3543,6 +3658,15 @@ export function registerSessionRoutes(
       parentSessionId: qsParentSessionId,
     });
 
+    // Records the selection for session.customModel/getCustomModelForPersist() and future
+    // clear/switch calls — the actual env vars and launch-model config are already part of
+    // the launch above (constructor envOverrides, piConfig/grokConfig/ompConfig.model), so
+    // this is bookkeeping only, never a restart: setCustomModel() is synchronous state, no
+    // tmux IO of its own (see its own doc comment in session.ts).
+    if (qsCustomModelBookkeeping) {
+      session.setCustomModel(qsCustomModelBookkeeping, qsCustomModelEnvOverrides);
+    }
+
     // Auto-detect completion phrase from CLAUDE.md BEFORE broadcasting
     // so the initial state already has the phrase configured (only if globally enabled)
     if (getCli(mode)?.capabilities.ralph && !remote && !docker && ctx.store.getConfig().ralphEnabled) {

src/web/schemas.ts

@@ -1033,6 +1033,25 @@ export const QuickStartSchema = z.object({
    * because it takes an existing `workingDir` and so never creates a directory to label.
    */
   agentOrigin: z.string().max(64).optional(),
+  /**
+   * Custom Model Endpoint Profiles (docs/custom-model-endpoints-plan.md): launches directly
+   * on this saved endpoint/model instead of the mode's native backend, computed server-side
+   * from the admin-configured endpoint store the same way `POST /api/sessions/:id/custom-
+   * model` does — never trusting raw env values from the client. One-shot, launch-time
+   * equivalent of that route: no restart, so no visible relaunch (that route's restart-in-
+   * place is still what an ALREADY-RUNNING session uses to switch later). Rejected for
+   * remote/docker cases, same reasoning as `envOverrides` above. `confirmed` mirrors that
+   * route's field: skips the llama-swap "this will unload it for another session" check on
+   * a deliberate retry.
+   */
+  customModel: z
+    .object({
+      endpointId: z.string().regex(/^[a-zA-Z0-9_-]+$/, 'Invalid endpoint id'),
+      modelId: z.string().min(1).max(200),
+      confirmed: z.boolean().optional(),
+    })
+    .strict()
+    .optional(),
 });
 
 // ========== Hook Events ==========