feat: read and write llm providers through the server (#2537)

* feat(app): read and write llm providers through the server

useLlmProviders keeps its exact interface so both consumers, AI settings
and chat target selection, are untouched. Underneath it is now a
react-query-kit query over Hono RPC instead of extension storage.

It gains an unavailable state. Previously an empty list meant the user
had no providers, and the hook seeded the built-in one in response. Over
HTTP a failed load looks the same as an empty one, so seeding moved into
the fetcher where it can only run on a confirmed empty response, and AI
settings now says the list could not be loaded rather than showing none.

Saving a single-instance provider used to collapse earlier copies as a
side effect of writing the whole list. That is now an explicit plan of
one PUT and the deletes it displaces.

The default provider id stays in extension storage. It is a per-profile
preference and every profile shares one database, so a column would make
them share a default too. A stale id costs nothing because it is
resolved on read.

Logout no longer deletes providers or scheduled jobs. That was right
while they were account data synced to the cloud; they are now local
data the account does not back.

* fix(app): do not substitute a provider the caller did not choose

An unreachable provider list returned an empty array, so a scheduled job
that named a provider found no match and fell through to the built-in
one. It ran on a different model with different credentials and was
recorded as completed. The list being unreachable says nothing about
whether that provider exists, so the two cases are now distinguished and
naming a provider that cannot be loaded fails the run instead. A
provider that was genuinely deleted still falls back, as before.

Deleting a provider also persisted the replacement default before
attempting the delete, so a failed delete left the provider configured
but no longer default with nothing to show for it. The delete goes
first; a default id left pointing at a deleted provider is repaired on
read.

* fix(app): never resolve a provider from a list that failed to load

The previous guard only covered a job that named a provider, which left
the same hole one step over. A job that names none still has a choice
behind it: the configured default, whose id lives in extension storage
but whose model and credentials live in the list. So an unreachable list
sent those runs to the built-in provider and recorded them completed,
which is the case this guard existed to prevent.

The condition drops to the list itself, which also states the invariant
plainly. An empty list keeps the fallback, because that is the server
answering that it genuinely has no providers rather than not answering.

* feat: move scheduled jobs and run history to the server (#2538)

* feat(server): add local storage for scheduled job runs

Job definitions had a table; their run history did not, so it was the
one part of the domain with nowhere to live on this side.

Runs cascade on job delete, unlike the job to provider reference which
is set null. A job whose provider was removed is a job needing
attention, whereas a run whose job was removed means nothing, and
deleting a job already removed its runs before this table existed.

The tool call log is a json column. Its input field is optional here
where the extension has it required: an unknown already admits
undefined, so the two describe the same values, and matching the
validator avoids asserting the difference away at the route boundary.

* feat(server): carry the per-job run cap across with the runs

The extension kept fifteen runs per job, trimming as it created each
one. Now that it no longer owns the history that policy has to live
here, or the table grows without bound.

It applies on every write rather than only on creation, which is bounded
and idempotent, so it holds however the run was written. The import path
does not prune, staying purely additive; the next real run trims.

* feat(app): read and write scheduled jobs and runs through the server

The hooks keep their shape, so the tasks page, the results view, the
card and the new tab panel are unchanged apart from where they import
from. Both gain an unavailable state, since an empty list and an
unreachable server are now the same shape without one.

The alarm runner distinguishes them everywhere it reads. Treating a
failed load as an empty list would read as nothing being scheduled:
alarms would not be rebuilt on startup and schedules would quietly stop
firing, with no failed run to show for it. It skips the pass instead and
retries on the next startup.

Extension storage no longer carries the data, but it still carries the
change signal. Runs are written by the background while the side panel
and new tab display them, and storage watch is what kept those in step.
A revision item is bumped after a write so every mounted view refetches.

Run history is imported once, under its own marker. It cannot share the
provider and job marker because that import must never run twice:
extension storage is frozen now, so a second pass would insert back
whatever the user has since deleted.

Also removes the scheduled job deletion queue, whose only reader went
when sync did, and the mount-time storage read that chose the opening
tab, which is now derived so it settles when the history arrives.

* fix(app): record a finished run against the current job

Recording that a run finished wrote back the job as it was read before
the run started. A run can take minutes and the job stays editable
throughout, so a rename, a schedule change, a disable or a different
provider chosen while it was going would be silently reverted.

The old code merged into a freshly read list; passing the job object
instead was an attempt to save a read and is what lost the update. It
takes an id again, so a stale snapshot cannot be handed to it, and it
skips the write when the job was deleted mid-run rather than
resurrecting it.

Author: DaniAkash

packages/browseros-agent/apps/app/entrypoints/background/scheduledJobRuns.ts

@@ -1,45 +1,51 @@
 import { onScheduleMessage } from '@/lib/messaging/schedules/scheduleMessages'
 import { createAlarmFromJob } from '@/lib/schedules/createAlarmFromJob'
 import { getChatServerResponse } from '@/lib/schedules/getChatServerResponse'
-import {
-  scheduledJobRunStorage,
-  scheduledJobStorage,
-} from '@/lib/schedules/scheduleStorage'
 import type { ScheduledJobRun } from '@/lib/schedules/scheduleTypes'
+import {
+  listScheduledJobRunsOrNull,
+  listScheduledJobsOrNull,
+  putScheduledJob,
+  putScheduledJobRun,
+} from '@/modules/schedules/schedules.api'
+import { applyLastRunAt } from '@/modules/schedules/schedules.helpers'
 
-const MAX_RUNS_PER_JOB = 15
 const STALE_TIMEOUT_MS = 10 * 60 * 1000 // 10 minutes
 const TWENTY_FOUR_HOURS_MS = 24 * 60 * 60 * 1000
 
 const runAbortControllers = new Map<string, AbortController>()
 
 export const scheduledJobRuns = async () => {
+  // Every read below distinguishes an unreachable server from an empty list.
+  // Treating the two alike would look like "nothing is scheduled": alarms would
+  // not be rebuilt on startup and schedules would quietly stop firing, with no
+  // failed run to show for it. Skipping the pass instead leaves the next
+  // startup to retry.
   const cleanupStaleJobRuns = async () => {
-    const current = (await scheduledJobRunStorage.getValue()) ?? []
+    const current = await listScheduledJobRunsOrNull()
+    if (current === null) return
     const now = Date.now()
 
-    const updated = current.map((run) => {
-      if (run.status !== 'running') return run
-
-      const startedAt = new Date(run.startedAt).getTime()
-      if (now - startedAt > STALE_TIMEOUT_MS) {
-        return {
-          ...run,
-          status: 'failed' as const,
-          completedAt: new Date().toISOString(),
-          result: 'Job timed out!',
-        }
-      }
-      return run
-    })
+    const stale = current.filter(
+      (run) =>
+        run.status === 'running' &&
+        now - new Date(run.startedAt).getTime() > STALE_TIMEOUT_MS,
+    )
 
-    await scheduledJobRunStorage.setValue(updated)
+    for (const run of stale) {
+      await putScheduledJobRun({
+        ...run,
+        status: 'failed',
+        completedAt: new Date().toISOString(),
+        result: 'Job timed out!',
+      })
+    }
   }
 
   const syncAlarmState = async () => {
-    const jobs = (await scheduledJobStorage.getValue()).filter(
-      (each) => each.enabled,
-    )
+    const loaded = await listScheduledJobsOrNull()
+    if (loaded === null) return
+    const jobs = loaded.filter((each) => each.enabled)
 
     for (let i = 0; i < jobs.length; i++) {
       const job = jobs[i]
@@ -56,55 +62,46 @@ export const scheduledJobRuns = async () => {
     jobId: string,
     status: ScheduledJobRun['status'],
   ): Promise<ScheduledJobRun> => {
+    // Trimming to the per-job cap happens on the server now, so creating a run
+    // no longer has to rewrite the job's whole history to stay bounded.
     const jobRun: ScheduledJobRun = {
       id: crypto.randomUUID(),
       jobId,
       startedAt: new Date().toISOString(),
       status,
     }
 
-    const current = (await scheduledJobRunStorage.getValue()) ?? []
-    const otherJobRuns = current.filter((r) => r.jobId !== jobId)
-    const thisJobRuns = current
-      .filter((r) => r.jobId === jobId)
-      .sort(
-        (a, b) =>
-          new Date(b.startedAt).getTime() - new Date(a.startedAt).getTime(),
-      )
-      .slice(0, MAX_RUNS_PER_JOB - 1)
-
-    await scheduledJobRunStorage.setValue([
-      ...otherJobRuns,
-      ...thisJobRuns,
-      jobRun,
-    ])
+    await putScheduledJobRun(jobRun)
     return jobRun
   }
 
+  // Takes the run rather than its id: the caller already holds it, and merging
+  // locally avoids re-reading a list to update one row.
   const updateJobRun = async (
-    runId: string,
+    run: ScheduledJobRun,
     updates: Partial<Omit<ScheduledJobRun, 'id' | 'jobId' | 'startedAt'>>,
   ) => {
-    const current = (await scheduledJobRunStorage.getValue()) ?? []
-    await scheduledJobRunStorage.setValue(
-      current.map((r) => (r.id === runId ? { ...r, ...updates } : r)),
-    )
+    await putScheduledJobRun({ ...run, ...updates })
   }
 
+  // Takes an id, not the job: a snapshot captured before the run would be
+  // minutes stale by the time this writes, and putting it back would revert any
+  // edit made while the run was going.
   const updateJobLastRunAt = async (jobId: string) => {
-    const current = (await scheduledJobStorage.getValue()) ?? []
-    await scheduledJobStorage.setValue(
-      current.map((j) =>
-        j.id === jobId ? { ...j, lastRunAt: new Date().toISOString() } : j,
-      ),
-    )
+    const jobs = await listScheduledJobsOrNull()
+    if (jobs === null) return
+
+    const updated = applyLastRunAt(jobs, jobId, new Date().toISOString())
+    if (updated) await putScheduledJob(updated)
   }
 
   const executeScheduledJob = async (jobId: string): Promise<void> => {
-    const job = (await scheduledJobStorage.getValue()).find(
-      (each) => each.id === jobId,
-    )
+    const jobs = await listScheduledJobsOrNull()
+    if (jobs === null) {
+      throw new Error('Cannot reach the BrowserOS server to load the job')
+    }
 
+    const job = jobs.find((each) => each.id === jobId)
     if (!job) {
       throw new Error(`Job not found: ${jobId}`)
     }
@@ -120,7 +117,7 @@ export const scheduledJobRuns = async () => {
         providerId: job.providerId,
       })
 
-      await updateJobRun(jobRun.id, {
+      await updateJobRun(jobRun, {
         status: 'completed',
         completedAt: new Date().toISOString(),
         result: response.text,
@@ -135,7 +132,7 @@ export const scheduledJobRuns = async () => {
         : e instanceof Error
           ? e.message
           : String(e)
-      await updateJobRun(jobRun.id, {
+      await updateJobRun(jobRun, {
         status: 'failed',
         completedAt: new Date().toISOString(),
         result: errorMessage,
@@ -155,10 +152,11 @@ export const scheduledJobRuns = async () => {
     runningMissedJobs = true
 
     try {
-      const jobs = (await scheduledJobStorage.getValue()).filter(
-        (j) => j.enabled,
-      )
-      const runs = (await scheduledJobRunStorage.getValue()) ?? []
+      const loadedJobs = await listScheduledJobsOrNull()
+      const runs = await listScheduledJobRunsOrNull()
+      if (loadedJobs === null || runs === null) return
+
+      const jobs = loadedJobs.filter((j) => j.enabled)
       const now = Date.now()
       const cutoff = now - TWENTY_FOUR_HOURS_MS
 

packages/browseros-agent/apps/app/lib/llm-providers/providerTemplates.ts

@@ -199,6 +199,19 @@ const DEFAULT_BASE_URLS: Record<ProviderType, string> = {
  * Get default base URL for a provider type
  * @public
  */
+/**
+ * Whether a stored type string is one this build understands.
+ *
+ * Keyed off DEFAULT_BASE_URLS because it is a `Record<ProviderType, string>`,
+ * so the compiler keeps it exhaustive as the union changes. Used to filter
+ * rows written by a newer build after a downgrade: icons, templates and base
+ * URLs are all keyed by this union, so an unknown type would read as
+ * undefined through every one of them.
+ */
+export function isProviderType(value: string): value is ProviderType {
+  return Object.hasOwn(DEFAULT_BASE_URLS, value)
+}
+
 export const getDefaultBaseUrlForProviders = (type: ProviderType): string => {
   return DEFAULT_BASE_URLS[type] || ''
 }

packages/browseros-agent/apps/app/lib/schedules/getChatServerResponse.ts

@@ -4,12 +4,12 @@ import { getAgentServerUrl } from '@/lib/browseros/helpers'
 import {
   createDefaultBrowserOSProvider,
   defaultProviderIdStorage,
-  providersStorage,
 } from '@/lib/llm-providers/storage'
 import type { LlmProviderConfig } from '@/lib/llm-providers/types'
 import { mcpServerStorage } from '@/lib/mcp/mcpServerStorage'
 import { buildChatRequestBody } from '@/lib/messaging/server/buildChatRequestBody'
 import type { ChatMode } from '@/modules/chat/chat-types'
+import { listProvidersOrNull } from '@/modules/llm-providers/llm-providers.api'
 import {
   findChatProviderById,
   resolveChatProvider,
@@ -73,23 +73,42 @@ interface StreamParseState {
   receivedFinish: boolean
 }
 
-const getDefaultProvider = async (): Promise<LlmProviderConfig | null> => {
-  const providers = await providersStorage.getValue()
-  if (!providers?.length) return null
-
-  const defaultProviderId = await defaultProviderIdStorage.getValue()
-  return resolveChatProvider(providers, defaultProviderId)
-}
-
 const resolveProvider = async (
   providerId?: string,
 ): Promise<LlmProviderConfig> => {
+  // One read for both branches: the list is now a request rather than a local
+  // storage lookup, and the explicit-provider path used to fetch it twice.
+  const loaded = await listProvidersOrNull()
+
+  // Never resolve a provider from a list that failed to load. A job that named
+  // one must not quietly run on a different one, and a job that named none
+  // still has a choice behind it: the configured default, whose id lives in
+  // extension storage but whose credentials and model live in that list. Either
+  // way, substituting the built-in would spend the wrong credentials on the
+  // wrong model and still record the run as completed.
+  //
+  // An empty list is a different answer and keeps the fallback: the server
+  // answered, and it really has no providers.
+  if (loaded === null) {
+    throw new Error(
+      'Cannot reach the BrowserOS server to load the selected provider',
+    )
+  }
+
+  const providers = loaded
+
   if (providerId) {
-    const providers = await providersStorage.getValue()
-    const match = findChatProviderById(providers ?? [], providerId)
+    const match = findChatProviderById(providers, providerId)
     if (match) return match
   }
-  return (await getDefaultProvider()) ?? createDefaultBrowserOSProvider()
+
+  if (providers.length > 0) {
+    const defaultProviderId = await defaultProviderIdStorage.getValue()
+    const provider = resolveChatProvider(providers, defaultProviderId)
+    if (provider) return provider
+  }
+
+  return createDefaultBrowserOSProvider()
 }
 
 export async function getChatServerResponse(

packages/browseros-agent/apps/app/lib/schedules/provider-resolution.test.ts

@@ -46,6 +46,15 @@ mock.module('@/lib/llm-providers/storage', () => ({
   },
 }))
 
+// The provider list is a request now, not a storage read. Mocked here so the
+// fetch stub below still sees only the chat call it is asserting on.
+mock.module('@/modules/llm-providers/llm-providers.api', () => ({
+  listProvidersOrNull: async () =>
+    storageValues.has('unreachable')
+      ? null
+      : ((storageValues.get('providers') as LlmProviderConfig[]) ?? []),
+}))
+
 mock.module('@/lib/browseros/helpers', () => ({
   getAgentServerUrl: async () => 'http://127.0.0.1:9105',
   getMcpServerUrl: async () => 'http://127.0.0.1:9106/mcp',
@@ -160,3 +169,73 @@ const providers: LlmProviderConfig[] = [
     updatedAt: timestamp,
   },
 ]
+
+describe('provider resolution when the server is unreachable', () => {
+  // The list being unreachable says nothing about whether the chosen provider
+  // exists, so running anyway would spend the wrong credentials on the wrong
+  // model. The job runner turns this into a failed run the user can see.
+  it('fails a scheduled job that named a provider', async () => {
+    storageValues.set('unreachable', true)
+    const { getChatServerResponse } = await import('./getChatServerResponse')
+
+    await expect(
+      getChatServerResponse({
+        message: 'Run my schedule',
+        providerId: 'anthropic-sonnet',
+      }),
+    ).rejects.toThrow('Cannot reach the BrowserOS server')
+
+    expect(fetchBodies).toHaveLength(0)
+  })
+
+  it('fails a refine that named a provider', async () => {
+    storageValues.set('unreachable', true)
+    const { refinePrompt } = await import('./refine-prompt')
+
+    await expect(
+      refinePrompt({
+        prompt: 'Check mail',
+        name: 'Morning brief',
+        providerId: 'anthropic-sonnet',
+      }),
+    ).rejects.toThrow('Cannot reach the BrowserOS server')
+  })
+
+  // A job that named nothing still has a choice behind it: the configured
+  // default. Its id is in extension storage but its model and credentials are
+  // in the list that failed to load, so the built-in is not a safe stand-in.
+  it('fails a scheduled job that relies on the configured default', async () => {
+    storageValues.set('unreachable', true)
+    const { getChatServerResponse } = await import('./getChatServerResponse')
+
+    await expect(
+      getChatServerResponse({ message: 'Run my schedule' }),
+    ).rejects.toThrow('Cannot reach the BrowserOS server')
+
+    expect(fetchBodies).toHaveLength(0)
+  })
+
+  // An empty list is a different answer from an unreachable one: the server
+  // replied and really has no providers, so the built-in is correct.
+  it('still falls back to the built-in provider when the server has none', async () => {
+    storageValues.set('providers', [])
+    const { getChatServerResponse } = await import('./getChatServerResponse')
+
+    await getChatServerResponse({ message: 'Run my schedule' })
+
+    expect(fetchBodies[0]).toMatchObject({ provider: 'browseros' })
+  })
+
+  // A provider that was genuinely deleted still falls back, as before. Only
+  // the unreachable case is treated as unsafe.
+  it('falls back when the named provider no longer exists', async () => {
+    const { getChatServerResponse } = await import('./getChatServerResponse')
+
+    await getChatServerResponse({
+      message: 'Run my schedule',
+      providerId: 'deleted-provider',
+    })
+
+    expect(fetchBodies[0]).toMatchObject({ provider: 'anthropic' })
+  })
+})

packages/browseros-agent/apps/app/lib/schedules/refine-prompt.ts

@@ -2,9 +2,9 @@ import { getAgentServerUrl } from '@/lib/browseros/helpers'
 import {
   createDefaultBrowserOSProvider,
   defaultProviderIdStorage,
-  providersStorage,
 } from '@/lib/llm-providers/storage'
 import type { LlmProviderConfig } from '@/lib/llm-providers/types'
+import { listProvidersOrNull } from '@/modules/llm-providers/llm-providers.api'
 import {
   findChatProviderById,
   resolveChatProvider,
@@ -13,8 +13,18 @@ import {
 const resolveProvider = async (
   providerId?: string,
 ): Promise<LlmProviderConfig> => {
-  const providers = await providersStorage.getValue()
-  if (providers?.length) {
+  const loaded = await listProvidersOrNull()
+  // Same rule as the scheduled run: the configured default is a choice too, and
+  // its model and credentials are in the list that failed to load. Callers here
+  // already catch and surface this.
+  if (loaded === null) {
+    throw new Error(
+      'Cannot reach the BrowserOS server to load the selected provider',
+    )
+  }
+
+  const providers = loaded
+  if (providers.length) {
     const explicitProvider = findChatProviderById(providers, providerId)
     if (explicitProvider) return explicitProvider