Changelog, dev startup, README, AgentHub 0.4.0, model catalog, and landing site (#7)

Branch-length batch covering tooling, the model layer, the Web App and the public
surfaces. Highlights:

- Changelog: a per-release `changelog/<version>/` tree, grouped by the surface each
  change touches, with a root CHANGELOG.md holding one line per release.
- Dev startup: `scripts/dev-prebuild.mjs` serializes the skills+core prebuild behind a
  lock and keeps `pnpm install` current; `pnpm dev` runs server+web together.
- AgentHub 0.3.3 -> 0.4.0: OmniMessage complete payloads carry one opaque `fidelity`
  object in place of item-level `signature`/`phase`, threaded verbatim through Trace,
  replay and resume; malformed classification adapted to the new error types.
- Model layer: a model is always referenced by an explicit `(provider, model_id)` pair.
  The provider is never inferred, guessed or defaulted -- both the catalog inference and
  the unique-match config resolution are gone, and CLI, SDK, server routes and
  run_subagent all require the complete pair. Catalog gains the Qwen Token Plan, Qwen
  Pay-As-You-Go and Fireworks AI gateways, plus an expanded OpenRouter group.
- Web App: catalog preset sync and per-group speed test on the Models page, positional
  slash commands, a markdown renderer, skill-library update reminders, and a vertically
  centred draft page whose upward menus size themselves to the room available.
- Public surfaces: restructured READMEs, the penguin.ooo landing site and blog, refreshed
  benchmark results for both suites, and the demo videos playing on the landing page.

Includes the fixes from a full review of the branch: 23 confirmed findings, among them a
provider-inference bug that could send one vendor's API key to another vendor's endpoint,
and an Escape handler that destroyed the composer's contents unrecoverably.

Verified on the branch head: pnpm test (1127 passing, 7 packages), pnpm typecheck and
pnpm format:check clean, Playwright e2e 14/14.

packages/core/src/agent.ts

@@ -79,12 +79,14 @@ export interface CreateAgentOptions {
 export interface CreateSessionOptions {
   /** Workspace for this run; if unspecified, a temporary Workspace is created under the Agent directory. */
   workspaceDir?: string;
-  /** Model used for this Session (upstream model_id); if unspecified, uses the Project's default Model. */
+  /**
+   * Model used for this Session (upstream model_id); must be given together with `provider`.
+   * Omit both to use the Project's default Model.
+   */
   modelId?: string;
   /**
-   * Provider grouping for `modelId` (a paired reference); if omitted, resolved via
-   * `resolveModelRef` semantics — `model_id` only resolves if it is a globally unique
-   * exact match in the config; zero or multiple matches produce a clear error.
+   * Provider grouping for `modelId`: the two together form the paired reference. It is never
+   * inferred, so it's "both or neither" — either half alone is an error, not a lookup.
    */
   provider?: string;
   /** Explicit credentials; if unspecified, falls back to credentials in the Project config, then to AgentHub reading environment variables. */
@@ -134,18 +136,20 @@ export class Agent {
    */
   async createSession(opts: CreateSessionOptions = {}): Promise<Session> {
     // Model is validated first (before creating the Workspace, so failure leaves no
-    // temp directory behind): the reference must resolve to an entry in the Project
-    // config (the (provider, model_id) pair is the unique key); a reference
-    // outside the config throws immediately rather than passing silently — otherwise
-    // credentials, pricing, and the context window would all be unavailable.
-    if (opts.modelId === undefined && opts.provider !== undefined) {
+    // temp directory behind): the reference must be the complete (provider, model_id)
+    // pair — the config's unique key — and must name an entry in the Project config; a
+    // reference outside the config throws immediately rather than passing silently,
+    // otherwise credentials, pricing, and the context window would all be unavailable.
+    // Half a reference is always an error: the missing half is never inferred, since a
+    // guessed provider would send the entry's credential to a vendor nobody named.
+    if ((opts.modelId === undefined) !== (opts.provider === undefined)) {
       throw new Error(
-        "provider was specified without modelId: a model reference must be given as a pair (provider cannot be used alone).",
+        "A model reference must be given as a (provider, model_id) pair: both must be specified, or neither (to use the Project's default model).",
       );
     }
     let ref: ModelRef;
-    if (opts.modelId !== undefined) {
-      // The only entry point for resolving an "omitted provider" reference (resolveModelRef): three branches — unique match / zero matches / ambiguous.
+    if (opts.modelId !== undefined && opts.provider !== undefined) {
+      // Pair validation only (resolveModelRef): the pair either names a configured entry or errors.
       ref = resolveModelRef(this.projectConfig, opts.modelId, opts.provider);
     } else if (this.projectConfig.default_model) {
       ref = this.projectConfig.default_model;
@@ -211,6 +215,8 @@ export class Agent {
       sessionEnvironment(workspaceDir, sessionId, {
         agentId: this.state.agentId,
         projectDir: projectDir(this.state.root, this.state.projectId),
+        provider: modelEntry.provider,
+        modelId: modelEntry.model_id,
       }),
       Object.keys(vault),
       installedSkills,
@@ -445,9 +451,12 @@ export class Agent {
     const { workspaceDir, modelEntry, apiKey, baseUrl, systemPrompt, subagentDepth, vault } = args;
     // Child-Agent runner: injected into the run_subagent tool so it doesn't need to
     // depend on Agent/Session (breaking a circular dependency). The model can
-    // optionally choose agentId (omitted = call the current Agent) and modelId
-    // (omitted = Project default). Precheck errors (depth limit exceeded / agent
-    // doesn't exist) are expressed as throws, which the Environment collapses to failed.
+    // optionally choose agentId (omitted = call the current Agent) and the child
+    // Session's model (omitted = Project default); the model reference is forwarded to
+    // createSession as-is and must be a complete (provider, model_id) pair — half a
+    // reference is rejected there rather than being guessed here. Precheck errors (depth
+    // limit exceeded / agent doesn't exist) are expressed as throws, which the
+    // Environment collapses to failed.
     // Docs: /docs/interfaces § "Subagent interfaces"
     const parentAgent = this;
     const { root, projectId, agentId: parentAgentId } = this.state;
@@ -455,7 +464,7 @@ export class Agent {
       // Spawn and run are separate: the same child Session can run for multiple turns
       // (continuing via input_subagent appending a prompt); resource cleanup is
       // consolidated in handle.dispose (called by the managing ManagedSubagentSession).
-      async spawn({ agentId, modelId }) {
+      async spawn({ agentId, modelId, provider }) {
         if (subagentDepth >= MAX_SUBAGENT_DEPTH) {
           throw new Error(
             `subagent depth limit ${MAX_SUBAGENT_DEPTH} reached; not spawning another subagent`,
@@ -475,9 +484,12 @@ export class Agent {
           agentId !== undefined && agentId !== parentAgentId
             ? await createAgent({ root, projectId, agentId })
             : parentAgent;
+        // The model reference is forwarded as a whole: createSession rejects half a pair, so a
+        // caller that named only one side gets the same error the CLI and HTTP layers give.
         const childSession = await childAgent.createSession({
           workspaceDir,
           ...(modelId !== undefined ? { modelId } : {}),
+          ...(provider !== undefined ? { provider } : {}),
           subagentDepth: subagentDepth + 1,
         });
         // All child-session messages are tagged with an origin (the child Session id,