@aragon-agent/cli 0.6.12 → 0.6.13

package/dist/config/model-profile-resolution.js

@@ -0,0 +1,81 @@
+import { DEFAULT_CONFIG } from './schema.js';
+import { emptyModelProfileState, normalizeModelProfiles, validateModelProfiles } from './model-profiles.js';
+/** Compare configured endpoint spelling strictly, with null and undefined equivalent. */
+export function normalizeProfileBaseUrl(value) {
+    return value?.trim() || null;
+}
+/** Project a valid library onto a copy without rewriting legacy preferences. */
+export function projectModelProfiles(file) {
+    const issues = validateModelProfiles(file.modelProfiles);
+    const state = emptyModelProfileState(issues.length > 0);
+    const projected = { ...file };
+    if (issues.length || !file.modelProfiles)
+        return { file: projected, state, issues };
+    const library = normalizeModelProfiles(file.modelProfiles);
+    projected.modelProfiles = library;
+    for (const role of ['main', 'fast']) {
+        const entry = library.entries.find((profile) => profile.id === library[`${role}Id`]);
+        if (!entry)
+            continue;
+        state[role] = { selectedId: entry.id, appliedId: entry.id,
+            overriddenFields: [], invalid: false };
+        const connection = { provider: entry.provider, model: entry.model, baseUrl: entry.baseUrl };
+        if (role === 'main')
+            Object.assign(projected, connection);
+        else
+            projected.fast = { ...DEFAULT_CONFIG.fast, ...file.fast, ...connection,
+                baseUrl: entry.baseUrl ?? '' };
+    }
+    return { file: projected, state, issues };
+}
+/** Derive binding status from current connections, including session/model overrides. */
+export function resolveModelProfileState(config, profiles = config.modelProfiles, invalid = false) {
+    const issues = validateModelProfiles(profiles);
+    const state = emptyModelProfileState(invalid || issues.length > 0);
+    if (issues.length || !profiles)
+        return state;
+    for (const role of ['main', 'fast']) {
+        const entry = profiles.entries.find((profile) => profile.id === profiles[`${role}Id`]);
+        if (!entry)
+            continue;
+        const connection = role === 'main' ? config : config.fast;
+        const changed = ['provider', 'model', 'baseUrl'].filter((field) => field === 'baseUrl'
+            ? normalizeProfileBaseUrl(connection[field]) !== normalizeProfileBaseUrl(entry[field])
+            : connection[field] !== entry[field]);
+        state[role] = { selectedId: entry.id,
+            appliedId: changed.some((field) => field !== 'model') ? null : entry.id,
+            overriddenFields: changed, invalid: false };
+    }
+    return state;
+}
+/** Resolve only credentials scoped to the requested role and actual connection target. */
+export function resolveModelRoleKey(input) {
+    const { config, role, providerId } = input;
+    const shared = config.apiKeys[providerId] || undefined;
+    const profiles = validateModelProfiles(config.modelProfiles).length
+        ? undefined : config.modelProfiles;
+    const profileMode = profiles && (profiles.mainId !== null || profiles.fastId !== null);
+    if (!profileMode) {
+        const target = config.apiKeyOverrideTarget;
+        if (target) {
+            return role === 'main' && providerId === config.provider
+                && target.provider === config.provider
+                && normalizeProfileBaseUrl(target.baseUrl) === normalizeProfileBaseUrl(config.baseUrl)
+                ? config.apiKeyOverride || shared : shared;
+        }
+        return config.apiKeyOverride && providerId === config.provider
+            ? config.apiKeyOverride : shared;
+    }
+    const actualProvider = role === 'main'
+        ? config.provider : config.fast.provider || config.provider;
+    if (providerId !== actualProvider)
+        return shared;
+    const target = config.apiKeyOverrideTarget;
+    if (role === 'main' && config.apiKeyOverride && target?.provider === config.provider
+        && normalizeProfileBaseUrl(target.baseUrl) === normalizeProfileBaseUrl(config.baseUrl)) {
+        return config.apiKeyOverride;
+    }
+    const state = resolveModelProfileState(config)[role];
+    const entry = profiles.entries.find((profile) => profile.id === state.appliedId);
+    return entry?.apiKey || shared;
+}

package/dist/config/model-profile-store.d.ts

@@ -0,0 +1,67 @@
+import { type ModelProfilesConfig, type ModelRole, type ProfileValidationIssue } from './model-profiles.js';
+import type { CliConfig, CompactionConfig, FastConfig, LogConfig, PersistedConfig } from './schema.js';
+export interface ModelSettingsPatch extends Partial<Omit<PersistedConfig, 'modelProfiles' | 'fast' | 'compaction' | 'log'>> {
+    fast?: Partial<FastConfig>;
+    compaction?: Partial<CompactionConfig>;
+    log?: Partial<LogConfig>;
+}
+export interface ModelSettingsDraft {
+    profiles?: ModelProfilesConfig;
+    patch: ModelSettingsPatch;
+    activateRoles: ModelRole[];
+    diskRevision: string;
+    liveRevision: number;
+    baseline: PersistedConfig;
+    liveBaseline: CliConfig;
+    readError?: string;
+}
+export interface ModelSettingsSaveResult {
+    ok: boolean;
+    persisted: boolean;
+    status: 'applied' | 'restart_required' | 'rejected' | 'saved_apply_failed';
+    code?: 'invalid' | 'busy' | 'conflict' | 'read_failed' | 'write_failed' | 'profile_key_required' | 'legacy_conversion_unsupported' | 'apply_failed';
+    issues?: ProfileValidationIssue[];
+    restartRequired?: boolean;
+}
+export type ConfigReadError = 'invalid_json' | 'invalid_root' | 'read_failed';
+export interface ModelSettingsDisk {
+    ok: boolean;
+    config: PersistedConfig;
+    parsed: Partial<PersistedConfig> | null;
+    raw: Buffer | null;
+    revision: string;
+    error?: ConfigReadError;
+}
+/** A stable, safe error for adapters; never includes caught exception messages. */
+export declare class ModelProfileConfigError extends Error {
+    readonly code: NonNullable<ModelSettingsSaveResult['code']>;
+    constructor(code: NonNullable<ModelSettingsSaveResult['code']>);
+}
+/** Read and hash exactly the same bytes; a missing file has its own revision sentinel. */
+export declare function readModelSettingsDisk(): ModelSettingsDisk;
+export interface ModelSettingsCommitInput {
+    candidate: PersistedConfig;
+    diskRevision: string;
+}
+export interface ModelSettingsStoreDependencies {
+    read: () => ModelSettingsDisk;
+    write: (candidate: PersistedConfig) => void;
+}
+/** Optimistically commit a prepared candidate using one atomic write; never applies live state. */
+export declare function commitModelSettings(input: ModelSettingsCommitInput, dependencies?: ModelSettingsStoreDependencies): ModelSettingsSaveResult;
+export interface LegacyPatchInput {
+    current: PersistedConfig;
+    patch: ModelSettingsPatch & {
+        modelProfiles?: ModelProfilesConfig;
+    };
+}
+/** Adapt legacy edits without mutating a shared profile or moving its dedicated key. */
+export declare function adaptLegacyConnectionPatch(input: LegacyPatchInput): LegacyPatchInput['patch'];
+/** A detached default endpoint must not acquire a gateway through legacy inheritance. */
+export declare function assertLegacyFastTarget(fast: {
+    provider: string;
+    baseUrl?: string | null;
+}, main: {
+    provider: string;
+    baseUrl?: string | null;
+}): void;

package/dist/config/model-profile-store.js

@@ -0,0 +1,153 @@
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { getConfigPath } from './app-paths.js';
+import { normalizePersistedConfig, writeConfigFile } from './store.js';
+import { registerProfileSecrets } from '../logging/secret-registry.js';
+import { normalizeModelProfiles, validateModelProfiles } from './model-profiles.js';
+import { normalizeProfileBaseUrl, projectModelProfiles } from './model-profile-resolution.js';
+/** A stable, safe error for adapters; never includes caught exception messages. */
+export class ModelProfileConfigError extends Error {
+    code;
+    constructor(code) {
+        super(code === 'profile_key_required' || code === 'legacy_conversion_unsupported'
+            ? `${code}: Use /settings to edit or copy this profile.`
+            : `${code}: Check the configuration with aragon config edit.`);
+        this.code = code;
+        this.name = 'ModelProfileConfigError';
+    }
+}
+/** Read and hash exactly the same bytes; a missing file has its own revision sentinel. */
+export function readModelSettingsDisk() {
+    let raw;
+    try {
+        raw = readFileSync(getConfigPath());
+    }
+    catch (error) {
+        const missing = error.code === 'ENOENT';
+        return { ok: missing, config: normalizePersistedConfig({}), parsed: null, raw: null,
+            revision: missing ? 'missing' : 'unreadable',
+            ...(missing ? {} : { error: 'read_failed' }) };
+    }
+    const revision = createHash('sha256').update(raw).digest('hex');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw.toString('utf8'));
+    }
+    catch {
+        return failedRead(raw, revision, 'invalid_json');
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return failedRead(raw, revision, 'invalid_root');
+    }
+    registerProfileSecrets(parsed);
+    return { ok: true, raw, revision, parsed: parsed,
+        config: normalizePersistedConfig(parsed) };
+}
+function failedRead(raw, revision, error) {
+    return { ok: false, raw, revision, error, config: normalizePersistedConfig({}), parsed: null };
+}
+/** Optimistically commit a prepared candidate using one atomic write; never applies live state. */
+export function commitModelSettings(input, dependencies = {
+    read: readModelSettingsDisk, write: writeConfigFile,
+}) {
+    const current = dependencies.read();
+    if (!current.ok)
+        return rejected('read_failed');
+    if (current.revision !== input.diskRevision)
+        return rejected('conflict');
+    if (validateModelProfiles(current.config.modelProfiles).length)
+        return rejected('invalid');
+    registerProfileSecrets(input.candidate);
+    const issues = validateModelProfiles(input.candidate.modelProfiles);
+    if (issues.length)
+        return { ...rejected('invalid'), issues };
+    try {
+        dependencies.write(input.candidate);
+    }
+    catch {
+        return rejected('write_failed');
+    }
+    return { ok: true, persisted: true, status: 'applied' };
+}
+function rejected(code) {
+    return { ok: false, persisted: false, status: 'rejected', code };
+}
+function touchesConnection(patch) {
+    return Boolean(patch && ['provider', 'model', 'baseUrl'].some((key) => Object.prototype.hasOwnProperty.call(patch, key)));
+}
+/** Adapt legacy edits without mutating a shared profile or moving its dedicated key. */
+export function adaptLegacyConnectionPatch(input) {
+    const { current, patch } = input;
+    if (Object.prototype.hasOwnProperty.call(patch, 'modelProfiles')) {
+        if (validateModelProfiles(current.modelProfiles).length
+            || validateModelProfiles(patch.modelProfiles).length) {
+            throw new ModelProfileConfigError('invalid');
+        }
+        let result = patch;
+        for (const role of ['main', 'fast']) {
+            if (!patch.modelProfiles?.[`${role}Id`]) {
+                result = adaptUnboundProviders(current, result, role);
+            }
+        }
+        return result;
+    }
+    const roles = ['main', 'fast'].filter((role) => touchesConnection(role === 'main' ? patch : patch.fast));
+    if (!roles.length)
+        return patch;
+    if (!current.modelProfiles)
+        return adaptUnboundProviders(current, patch);
+    if (validateModelProfiles(current.modelProfiles).length) {
+        throw new ModelProfileConfigError('invalid');
+    }
+    const profiles = normalizeModelProfiles(current.modelProfiles);
+    const result = { ...patch, modelProfiles: profiles };
+    for (const role of roles)
+        adaptRole(current, result, role);
+    return result;
+}
+function adaptUnboundProviders(current, patch, role) {
+    const result = { ...patch };
+    if (role !== 'fast' && patch.provider !== undefined && patch.provider !== current.provider
+        && !Object.prototype.hasOwnProperty.call(patch, 'baseUrl'))
+        result.baseUrl = null;
+    if (role !== 'main' && patch.fast?.provider !== undefined
+        && patch.fast.provider !== current.fast.provider
+        && !Object.prototype.hasOwnProperty.call(patch.fast, 'baseUrl')) {
+        result.fast = { ...patch.fast, baseUrl: '' };
+    }
+    return result;
+}
+function adaptRole(current, patch, role) {
+    const profiles = patch.modelProfiles;
+    const entry = profiles.entries.find((profile) => profile.id === profiles[`${role}Id`]);
+    if (!entry) {
+        Object.assign(patch, adaptUnboundProviders(current, patch, role));
+        return;
+    }
+    if (entry.apiKey)
+        throw new ModelProfileConfigError('profile_key_required');
+    const explicit = role === 'main' ? patch : patch.fast;
+    const provider = explicit.provider ?? entry.provider;
+    const changedProvider = provider !== entry.provider;
+    const baseUrl = Object.prototype.hasOwnProperty.call(explicit, 'baseUrl')
+        ? explicit.baseUrl ?? null : changedProvider ? null : entry.baseUrl;
+    const connection = { provider, model: explicit.model ?? entry.model, baseUrl };
+    if (role === 'fast') {
+        const main = projectModelProfiles(current).file;
+        const mainProvider = patch.provider ?? main.provider ?? current.provider;
+        const mainUrl = Object.prototype.hasOwnProperty.call(patch, 'baseUrl')
+            ? patch.baseUrl : main.baseUrl;
+        assertLegacyFastTarget(connection, { provider: mainProvider, baseUrl: mainUrl });
+        patch.fast = { ...connection, ...patch.fast, baseUrl: baseUrl ?? '' };
+    }
+    else
+        Object.assign(patch, connection);
+    profiles[`${role}Id`] = null;
+}
+/** A detached default endpoint must not acquire a gateway through legacy inheritance. */
+export function assertLegacyFastTarget(fast, main) {
+    if (!normalizeProfileBaseUrl(fast.baseUrl) && (fast.provider || main.provider) === main.provider
+        && normalizeProfileBaseUrl(main.baseUrl)) {
+        throw new ModelProfileConfigError('legacy_conversion_unsupported');
+    }
+}

package/dist/config/model-profiles.d.ts

@@ -0,0 +1,44 @@
+export type ModelRole = 'main' | 'fast';
+export interface ModelProfile {
+    id: string;
+    name: string;
+    provider: string;
+    model: string;
+    baseUrl: string | null;
+    apiKey: string | null;
+}
+export interface ModelProfilesConfig {
+    version: 1;
+    entries: ModelProfile[];
+    mainId: string | null;
+    fastId: string | null;
+}
+export interface ProfileBindingState {
+    selectedId: string | null;
+    appliedId: string | null;
+    overriddenFields: Array<'provider' | 'model' | 'baseUrl'>;
+    invalid: boolean;
+}
+export interface ModelProfilesRuntime {
+    main: ProfileBindingState;
+    fast: ProfileBindingState;
+}
+export interface ProfileValidationIssue {
+    path: string;
+    code: 'invalid' | 'duplicate_id' | 'missing_reference' | 'unsupported_version';
+    message: string;
+}
+/** Return a fresh empty library without initiating a disk migration. */
+export declare function emptyModelProfiles(): ModelProfilesConfig;
+/** Return independently mutable role state. */
+export declare function emptyModelProfileState(invalid?: boolean): ModelProfilesRuntime;
+/** Validate untrusted input; diagnostics never include supplied values. */
+export declare function validateModelProfiles(value: unknown): ProfileValidationIssue[];
+/** Normalize a valid library into a safe field whitelist; throws a fixed error if invalid. */
+export declare function normalizeModelProfiles(value: unknown): ModelProfilesConfig;
+/** Create an entry with a stable UUID and a frozen default name. */
+export declare function createModelProfile(input: Omit<ModelProfile, 'id'>): ModelProfile;
+/** Duplicate the current draft entry, including its explicitly edited credential. */
+export declare function duplicateModelProfile(entry: ModelProfile): ModelProfile;
+/** Remove an unused entry; binding references must be changed explicitly first. */
+export declare function removeModelProfile(library: ModelProfilesConfig, id: string): ModelProfilesConfig;

package/dist/config/model-profiles.js

@@ -0,0 +1,121 @@
+import { randomUUID } from 'node:crypto';
+import { ADAPTER_PROVIDERS } from './schema.js';
+const CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
+/** Return a fresh empty library without initiating a disk migration. */
+export function emptyModelProfiles() {
+    return { version: 1, entries: [], mainId: null, fastId: null };
+}
+/** Return independently mutable role state. */
+export function emptyModelProfileState(invalid = false) {
+    const binding = () => ({ selectedId: null, appliedId: null,
+        overriddenFields: [], invalid });
+    return { main: binding(), fast: binding() };
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function validText(value, max, allowEmpty = false) {
+    return typeof value === 'string' && !CONTROL.test(value)
+        && (allowEmpty || value.trim().length > 0) && [...value.trim()].length <= max;
+}
+function validUrl(value) {
+    if (value === null || (typeof value === 'string' && !value.trim()))
+        return true;
+    if (typeof value !== 'string' || CONTROL.test(value))
+        return false;
+    try {
+        const url = new URL(value.trim());
+        return ['http:', 'https:'].includes(url.protocol) && Boolean(url.hostname)
+            && !url.username && !url.password && !value.includes('?') && !value.includes('#');
+    }
+    catch {
+        return false;
+    }
+}
+function validateEntry(value, index) {
+    const path = `modelProfiles.entries[${index}]`;
+    const invalid = (field, message) => ({
+        path: field ? `${path}.${field}` : path, code: 'invalid', message,
+    });
+    if (!isRecord(value))
+        return [invalid('', 'Profile must be an object.')];
+    const issues = [];
+    if (!validText(value.id, 128))
+        issues.push(invalid('id', 'ID must have 1-128 safe characters.'));
+    if (!validText(value.name, 80, true)) {
+        issues.push(invalid('name', 'Name must have at most 80 safe characters.'));
+    }
+    if (!ADAPTER_PROVIDERS.includes(value.provider)) {
+        issues.push(invalid('provider', 'Select a supported provider.'));
+    }
+    if (!validText(value.model, 256)) {
+        issues.push(invalid('model', 'Model must have 1-256 safe characters.'));
+    }
+    if (!validUrl(value.baseUrl)) {
+        issues.push(invalid('baseUrl', 'Use an HTTP(S) URL without credentials, query or fragment.'));
+    }
+    if (value.apiKey !== null && !validText(value.apiKey, 8192)) {
+        issues.push(invalid('apiKey', 'Enter a nonempty key up to 8192 safe characters.'));
+    }
+    return issues;
+}
+/** Validate untrusted input; diagnostics never include supplied values. */
+export function validateModelProfiles(value) {
+    if (value === undefined)
+        return [];
+    if (!isRecord(value))
+        return [{ path: 'modelProfiles', code: 'invalid',
+                message: 'Model profiles must be an object. Repair with aragon config edit.' }];
+    if (value.version !== 1)
+        return [{ path: 'modelProfiles.version',
+                code: 'unsupported_version', message: 'Unsupported model profiles version.' }];
+    if (!Array.isArray(value.entries) || value.entries.length > 200) {
+        return [{ path: 'modelProfiles.entries', code: 'invalid',
+                message: 'Use an array with at most 200 profiles; remove unused profiles to add more.' }];
+    }
+    const issues = value.entries.flatMap(validateEntry);
+    const ids = new Set();
+    value.entries.forEach((entry, index) => {
+        if (!isRecord(entry) || typeof entry.id !== 'string')
+            return;
+        if (ids.has(entry.id))
+            issues.push({ path: `modelProfiles.entries[${index}].id`,
+                code: 'duplicate_id', message: 'Profile IDs must be unique.' });
+        ids.add(entry.id);
+    });
+    for (const field of ['mainId', 'fastId']) {
+        if (value[field] !== null && (typeof value[field] !== 'string' || !ids.has(value[field]))) {
+            issues.push({ path: `modelProfiles.${field}`, code: 'missing_reference',
+                message: 'Select an existing profile or Current custom.' });
+        }
+    }
+    return issues;
+}
+/** Normalize a valid library into a safe field whitelist; throws a fixed error if invalid. */
+export function normalizeModelProfiles(value) {
+    if (validateModelProfiles(value).length)
+        throw new Error('Invalid model profiles.');
+    if (value === undefined)
+        return emptyModelProfiles();
+    const library = value;
+    return { version: 1, mainId: library.mainId, fastId: library.fastId,
+        entries: library.entries.map((entry) => ({ id: entry.id, name: entry.name.trim()
+                || [...entry.model.trim()].slice(0, 80).join(''), provider: entry.provider,
+            model: entry.model.trim(), baseUrl: entry.baseUrl?.trim() || null,
+            apiKey: entry.apiKey?.trim() || null })) };
+}
+/** Create an entry with a stable UUID and a frozen default name. */
+export function createModelProfile(input) {
+    const entry = { ...input, id: randomUUID() };
+    return normalizeModelProfiles({ ...emptyModelProfiles(), entries: [entry] }).entries[0];
+}
+/** Duplicate the current draft entry, including its explicitly edited credential. */
+export function duplicateModelProfile(entry) {
+    return { ...entry, id: randomUUID(), name: `${[...entry.name].slice(0, 73).join('')} (copy)` };
+}
+/** Remove an unused entry; binding references must be changed explicitly first. */
+export function removeModelProfile(library, id) {
+    if (library.mainId === id || library.fastId === id)
+        throw new Error('Profile is still in use.');
+    return { ...library, entries: library.entries.filter((entry) => entry.id !== id) };
+}

package/dist/config/schema.d.ts

@@ -671,6 +671,7 @@ export declare function clampBashConfig(raw: unknown): BashConfig;
  */
 export declare function parseThresholdInput(raw: string): number | null;
 export interface PersistedConfig {
+    modelProfiles?: import('./model-profiles.js').ModelProfilesConfig;
     version: number;
     provider: string;
     model: string;
@@ -838,6 +839,14 @@ export declare const LEGACY_STATE_KEYS: readonly ["promptHistory", "submitCount"
  */
 export declare function stripLegacyStateKeys<T extends object>(raw: T): T;
 export interface CliConfig {
+    /** A committed model snapshot failed to apply; no further requests may start. */
+    modelSettingsRestartRequired?: boolean;
+    modelProfiles?: import('./model-profiles.js').ModelProfilesConfig;
+    modelProfileState?: import('./model-profiles.js').ModelProfilesRuntime;
+    apiKeyOverrideTarget?: {
+        provider: string;
+        baseUrl: string | null;
+    };
     provider: string;
     model: string;
     baseUrl?: string;

package/dist/config/store.d.ts

@@ -10,6 +10,8 @@
  * the drift the header of that module warns about.
  */
 import { getConfigPath, getSessionsDir } from './app-paths.js';
+import { type ModelSettingsPatch } from './model-profile-store.js';
+import { type ModelProfilesConfig } from './model-profiles.js';
 import { type PersistedConfig } from './schema.js';
 export { getConfigPath, getSessionsDir };
 export interface ConfigFileRead {
@@ -40,6 +42,8 @@ export declare function writeConfigFile(config: PersistedConfig): void;
  * Unlike `readConfigFile`, this always returns a complete `PersistedConfig`.
  */
 export declare function loadPersistedConfig(): PersistedConfig;
+/** Fill legacy defaults without projecting bindings or discarding unknown profile data. */
+export declare function normalizePersistedConfig(input: Partial<PersistedConfig>): PersistedConfig;
 /**
  * Read the persisted config, apply a patch, write it back atomically, and
  * return the merged result. This is the single write path used by the settings
@@ -59,4 +63,10 @@ export declare function loadPersistedConfig(): PersistedConfig;
  * a third SECTION, but it is still one level deep (scalars only), so the same
  * hand-written merge covers it — and it must stay that way for that reason.
  */
-export declare function updatePersistedConfig(patch: Partial<PersistedConfig>): PersistedConfig;
+export declare function updatePersistedConfig(patch: ModelSettingsPatch & {
+    modelProfiles?: ModelProfilesConfig;
+}): PersistedConfig;
+/** Merge an already adapted patch, replacing profile arrays as one complete section. */
+export declare function mergePersistedConfig(current: PersistedConfig, patch: ModelSettingsPatch & {
+    modelProfiles?: ModelProfilesConfig;
+}): PersistedConfig;

package/dist/config/store.js

@@ -9,11 +9,14 @@
  * a second name for `skills/paths.ts::getUserSkillsDir()`, which is precisely
  * the drift the header of that module warns about.
  */
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, chmodSync } from 'node:fs';
+import { existsSync, mkdirSync, renameSync, writeFileSync, chmodSync, rmSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
 import { dirname } from 'node:path';
 import process from 'node:process';
 import { getConfigPath, getSessionsDir } from './app-paths.js';
-import { registerSecretsFrom } from '../logging/secret-registry.js';
+import { registerProfileSecrets, registerSecretsFrom } from '../logging/secret-registry.js';
+import { adaptLegacyConnectionPatch, ModelProfileConfigError, readModelSettingsDisk } from './model-profile-store.js';
+import { normalizeModelProfiles } from './model-profiles.js';
 import { clampBashConfig, CONFIG_VERSION, DEFAULT_CONFIG, clampCompactionConfig, clampFastConfig, clampLogConfig, clampMaxTokens, clampRetryConfig, clampSkillsConfig, clampTeamConfig, clampTodoConfig, clampContextWindow, clampUpdateConfig, isAutoToken, stripLegacyStateKeys, } from './schema.js';
 /**
  * Normalize `maxTokens` for both directions of the config file.
@@ -62,25 +65,12 @@ export { getConfigPath, getSessionsDir };
  * workflow, so the failure mode had to become visible.
  */
 export function readConfigFile() {
-    const file = getConfigPath();
-    if (!existsSync(file))
-        return { config: null };
-    try {
-        const raw = readFileSync(file, 'utf-8');
-        const parsed = JSON.parse(raw);
-        if (parsed && typeof parsed === 'object') {
-            // Retired layout preference: tolerate old files without restoring a UI mode.
-            delete parsed.fullscreen;
-            return { config: parsed };
-        }
-        return { config: null, parseError: `${file} does not contain a JSON object` };
-    }
-    catch (err) {
-        return {
-            config: null,
-            parseError: `${file}: ${err instanceof Error ? err.message : String(err)}`,
-        };
-    }
+    const read = readModelSettingsDisk();
+    if (!read.ok)
+        return { config: null, parseError: `${getConfigPath()}: ${read.error}` };
+    if (read.parsed)
+        delete read.parsed.fullscreen;
+    return { config: read.parsed };
 }
 // ---------------------------------------------------------------------------
 // Write (atomic + 0600)
@@ -97,10 +87,19 @@ function ensureDir(dir) {
 export function writeConfigFile(config) {
     const file = getConfigPath();
     ensureDir(dirname(file));
-    const tmp = `${file}.${process.pid}.tmp`;
+    const tmp = `${file}.${process.pid}.${randomUUID()}.tmp`;
     const json = `${JSON.stringify(config, null, 2)}\n`;
-    writeFileSync(tmp, json, { encoding: 'utf-8', mode: 0o600 });
-    renameSync(tmp, file);
+    try {
+        writeFileSync(tmp, json, { encoding: 'utf-8', mode: 0o600, flag: 'wx' });
+        renameSync(tmp, file);
+    }
+    catch {
+        try {
+            rmSync(tmp, { force: true });
+        }
+        catch { /* Only our temporary path is eligible. */ }
+        throw new ModelProfileConfigError('write_failed');
+    }
     // rename may not preserve mode on every platform; re-chmod on POSIX.
     if (process.platform !== 'win32') {
         try {
@@ -116,12 +115,17 @@ export function writeConfigFile(config) {
  * Unlike `readConfigFile`, this always returns a complete `PersistedConfig`.
  */
 export function loadPersistedConfig() {
+    return normalizePersistedConfig(readConfigFile().config ?? {});
+}
+/** Fill legacy defaults without projecting bindings or discarding unknown profile data. */
+export function normalizePersistedConfig(input) {
     // STRIP BEFORE THE SPREAD, not after. `partial` is the raw file, so any
     // `promptHistory` / `submitCount` / `mouseNoticeSeen` / `recentModels` left
     // on disk would otherwise ride the spread into `merged` and be written back
     // out by `updatePersistedConfig` — the "I deleted it and it grew back" bug
     // that `stripLegacyStateKeys` exists to make impossible (§4.5).
-    const partial = stripLegacyStateKeys(readConfigFile().config ?? {});
+    const partial = stripLegacyStateKeys(input);
+    delete partial.fullscreen;
     return {
         ...DEFAULT_CONFIG,
         ...partial,
@@ -207,14 +211,27 @@ export function loadPersistedConfig() {
  * hand-written merge covers it — and it must stay that way for that reason.
  */
 export function updatePersistedConfig(patch) {
+    const read = readModelSettingsDisk();
+    if (!read.ok)
+        throw new ModelProfileConfigError('read_failed');
+    const adapted = adaptLegacyConnectionPatch({ current: read.config, patch });
+    const merged = mergePersistedConfig(read.config, adapted);
+    writeConfigFile(merged);
+    return merged;
+}
+/** Merge an already adapted patch, replacing profile arrays as one complete section. */
+export function mergePersistedConfig(current, patch) {
     // Registration site 5. Whatever route a key took to get here, this is the one
     // function that writes it to disk, so this is the last place it can be added
     // to the redactor's backstop before it also starts appearing in log records.
     registerSecretsFrom(patch.apiKeys);
-    const current = loadPersistedConfig();
+    registerProfileSecrets(patch);
+    const submittedProfiles = patch.modelProfiles === undefined
+        ? {} : { modelProfiles: normalizeModelProfiles(patch.modelProfiles) };
     const merged = {
         ...current,
         ...patch,
+        ...submittedProfiles,
         version: CONFIG_VERSION,
         // The write half of the gate: without it `config set maxTokens 900000` puts
         // a number on disk that the read path silently rewrites on every launch.
@@ -273,6 +290,5 @@ export function updatePersistedConfig(patch) {
         // `bash_output` / `bash_kill` from the next launch onward.
         bash: clampBashConfig({ ...current.bash, ...(patch.bash ?? {}) }),
     };
-    writeConfigFile(merged);
     return merged;
 }

package/dist/fast/resolve.d.ts

@@ -18,6 +18,7 @@
  * at construction is a tier that can be describing a provider the session no
  * longer uses.
  */
+import type { ModelRole } from '../config/model-profiles.js';
 import { type CliConfig } from '../config/schema.js';
 import type { FastTier } from './types.js';
 /**
@@ -29,7 +30,7 @@ import type { FastTier } from './types.js';
  *   `--api-key` override. Injected rather than reimplemented, because a second
  *   key resolver is a second answer to "why does it say no key?".
  */
-export declare function resolveFastTier(config: CliConfig, hasKey: (providerId: string) => boolean): FastTier;
+export declare function resolveFastTier(config: CliConfig, hasKey: (providerId: string, role?: ModelRole) => boolean): FastTier;
 /**
  * The one-line notice for a tier the user switched on that cannot resolve, or
  * `null` when there is nothing worth saying.