@aragon-agent/cli 0.6.22 → 0.6.24

package/dist/config/cli-commands.js

@@ -45,6 +45,8 @@ export const TEAM_CONFIG_SET_KEYS = [
     'team.maxTurnsPerSubagent',
     'team.overseer',
     'team.overseerIntervalMs',
+    'team.model',
+    'team.modelProfileId',
 ];
 /**
  * Config keys under `retry.` that `aragon config set` accepts
@@ -205,6 +207,16 @@ export function applyTeamConfigSet(key, value) {
             return patch({ overseer: isTrue(value) });
         case 'team.overseerIntervalMs':
             return patch(clampOne('overseerIntervalMs'));
+        // The subagent-model keys (subagent-model-and-question-controls V-3):
+        // without these two cases `aragon config set team.model fast` is refused
+        // with "Unknown config key" while `config list` shows the key one command
+        // over - the exact gap COMPACTION_CONFIG_SET_KEYS records at length.
+        // Both route through `clampTeamConfig` like every other key here: a typo'd
+        // mode resolves to 'main' and a bad id is nulled, never rejected.
+        case 'team.model':
+            return patch(clampOne('model'));
+        case 'team.modelProfileId':
+            return patch(clampOne('modelProfileId'));
         default:
             return null;
     }

package/dist/config/load.js

@@ -6,10 +6,10 @@
  * legitimately long single tool run can never be watchdog-killed.
  */
 import process from 'node:process';
-import { DEFAULT_CONFIG, IDLE_TIMEOUT_MARGIN_MS, clampAskRounds, clampDensity, clampHumanTimeout, clampCompactionConfig, clampLogConfig, clampFastConfig, clampRetryConfig, clampSkillsConfig, clampTeamConfig, clampTodoConfig, clampBashConfig, clampUpdateConfig, clampTheme, clampThinkingLevel, clampContextWindow, clampMaxTokens, clampMaxRenderInterval, clampScrollResumeMs, clampTranscriptRetain, clampTranscriptWindow, coercePositiveInt, isAutoToken, isSkillsToolPolicyMode, parseThresholdInput, } from './schema.js';
+import { DEFAULT_CONFIG, IDLE_TIMEOUT_MARGIN_MS, clampAskRounds, clampDensity, clampHumanTimeout, clampCompactionConfig, clampLogConfig, clampFastConfig, clampRetryConfig, clampSkillsConfig, clampTeamConfig, clampTodoConfig, clampBashConfig, clampUpdateConfig, clampTheme, clampThinkingLevel, clampContextWindow, clampMaxTokens, clampMaxRenderInterval, clampScrollResumeMs, clampTranscriptRetain, clampTranscriptWindow, coercePositiveInt, isAutoToken, isSkillsToolPolicyMode, legacyTeamCeilingPatch, parseThresholdInput, } from './schema.js';
 import { loadDotenv, readEnvConfig, readEnvDisabledSkills } from './env.js';
-import { readConfigFile } from './store.js';
-import { projectModelProfiles, resolveModelProfileState, resolveModelRoleKey } from './model-profile-resolution.js';
+import { readConfigFile, updatePersistedConfig } from './store.js';
+import { projectModelProfiles, resolveModelProfileState, resolveModelRoleKey, } from './model-profile-resolution.js';
 import { getConfigPath } from './app-paths.js';
 import { setHistoryEnabled } from './prompt-history.js';
 import { setEntryRetain } from '../agent/entry-limits.js';
@@ -411,33 +411,82 @@ function resolveMaxTokens(flags, env, file) {
  * `null`, and `null` is exactly the value being looked for. NO CLI FLAG feeds
  * this - it is a per-installation correction for a model table entry, not a
  * per-invocation choice, so `config set` and the environment variable are the
- * two surfaces the design names.
+ * two surfaces the design names. The model profile bound as Main is the third
+ * (profile-context-window): its window arrives already merged into the `file`
+ * layer by `projectModelProfiles`, and `profileOwned` names it.
+ *
+ * THE ORIGIN CONTRACT (profile-context-window §6.1, shared verbatim with the
+ * save transaction): `origin !== undefined` IF AND ONLY IF `value !== null`.
+ * An explicit AUTO - profile set to auto, `config set contextWindow auto`,
+ * `ARAGON_CONTEXT_WINDOW=auto` - returns `{ value: null }` and NO origin,
+ * because "the user asserted this denominator" and "the user declared AUTO"
+ * are different facts and the meter's override branch only sees the first.
  */
-function resolveContextWindow(env, file) {
+function resolveContextWindow(env, file, profileOwned) {
     const layers = [
         {
             name: 'ARAGON_CONTEXT_WINDOW',
             value: hasOwn(env, 'contextWindow') ? env.contextWindow : undefined,
+            origin: 'env',
         },
         {
             name: 'config.json contextWindow',
             value: hasOwn(file, 'contextWindow') ? file.contextWindow : undefined,
+            origin: profileOwned ? 'profile' : 'config',
         },
     ];
     for (const layer of layers) {
         if (layer.value === undefined)
             continue; // this layer said nothing
         if (layer.value === null || isAutoToken(layer.value))
-            return null; // AUTO
+            return { value: null }; // AUTO
         const n = clampContextWindow(layer.value, null);
         if (n !== null)
-            return n;
+            return { value: n, origin: layer.origin };
         getLogger().warn('config', 'context_window_unusable', {
             source: layer.name,
             value: String(layer.value),
         });
     }
-    return DEFAULT_CONFIG.contextWindow;
+    return { value: DEFAULT_CONFIG.contextWindow };
+}
+/**
+ * Rewrite the cli<=0.6.16 persisted team ceiling defaults to 0 and persist the
+ * change (F-8 A'4). ONE-SHOT and IDEMPOTENT: after the first rewrite the file
+ * carries 0, which matches nothing, so nothing is written again.
+ *
+ * THE FILE LAYER ONLY, deliberately: env and flags are this-launch intent and
+ * survive untouched, and with the D-4 semantics a positive surviving value is
+ * a supervisor cadence hint, never a kill. The raw file object is patched IN
+ * PLACE (the same precedent `readConfigFile` sets with `fullscreen`) so the
+ * `file` layer this function's caller resolves from already reads 0; the
+ * write goes through `updatePersistedConfig`, the one atomic write path every
+ * other settings change uses.
+ *
+ * A FAILED WRITE MUST NOT BLOCK STARTUP: the values are already neutralized
+ * in memory, and the next launch retries — which is why the catch is empty
+ * and the migration is logged instead of surfaced.
+ */
+function migrateLegacyTeamCeilings(raw) {
+    const patch = legacyTeamCeilingPatch(raw?.team);
+    if (patch === null)
+        return;
+    // THE FULL SECTION, not the bare patch: the write port types `team` as a
+    // whole `TeamConfig` (its merge then deep-merges over what is on disk), and
+    // the section the file already carries plus the zeroed keys IS the section
+    // we want on disk.
+    const migratedTeam = { ...raw.team, ...patch };
+    Object.assign(raw.team, patch);
+    try {
+        updatePersistedConfig({ team: migratedTeam });
+    }
+    catch {
+        // Unwritable config dir: in-memory values are already migrated; retry
+        // next launch (idempotent).
+    }
+    getLogger().warn('config', 'team_legacy_ceilings_migrated', {
+        keys: Object.keys(patch).join(','),
+    });
 }
 /**
  * Resolve the effective config by merging all layers, then derive the runtime
@@ -448,6 +497,7 @@ export function loadConfig(flags = {}, options = {}) {
     // `.env` must be loaded before reading env overrides.
     loadDotenv(cwd);
     const read = readConfigFile();
+    migrateLegacyTeamCeilings(read.config);
     const projection = projectModelProfiles(read.config ?? {});
     const file = projection.file;
     const env = readEnvConfig();
@@ -474,7 +524,8 @@ export function loadConfig(flags = {}, options = {}) {
     const liveToolOutput = pick(flags.liveToolOutput, env.partial.liveToolOutput, file.liveToolOutput) ??
         DEFAULT_CONFIG.liveToolOutput;
     const maxTokens = resolveMaxTokens(flags, env.partial, file);
-    const contextWindow = resolveContextWindow(env.partial, file);
+    const resolvedWindow = resolveContextWindow(env.partial, file, projection.mainOwnsContextWindow);
+    const contextWindow = resolvedWindow.value;
     // `clampTheme` is also where the v0.3.0 `dark` name is migrated to `cool`,
     // so reading a legacy config file needs no extra step here (§4.5 / R-4).
     const theme = clampTheme(pick(flags.theme, env.partial.theme, file.theme), DEFAULT_CONFIG.theme);
@@ -570,6 +621,12 @@ export function loadConfig(flags = {}, options = {}) {
         liveToolOutput,
         maxTokens,
         contextWindow,
+        // CONDITIONAL SPREAD so a feature-off config object stays byte-identical
+        // (invariant 6): with no override there is no origin KEY, not an undefined
+        // one, and every `toEqual` on a default config keeps passing untouched.
+        ...(resolvedWindow.origin !== undefined
+            ? { contextWindowOrigin: resolvedWindow.origin }
+            : {}),
         theme,
         reducedMotion,
         exitTranscript: flags.exitTranscript !== undefined

package/dist/config/model-profile-resolution.d.ts

@@ -4,6 +4,14 @@ export interface ProfileProjection {
     file: Partial<PersistedConfig>;
     state: ModelProfilesRuntime;
     issues: ProfileValidationIssue[];
+    /**
+     * True when a valid library has Main bound, so the bound profile OWNS the
+     * context-window denominator (profile-context-window tradeoff B). THE ONE
+     * AUTHORITY for "does the profile decide the window" - load.ts and the save
+     * transaction both read it rather than comparing numbers, which would lie on
+     * a coincidental match.
+     */
+    mainOwnsContextWindow: boolean;
 }
 export interface RoleKeyInput {
     config: CliConfig;

package/dist/config/model-profile-resolution.js

@@ -9,8 +9,9 @@ export function projectModelProfiles(file) {
     const issues = validateModelProfiles(file.modelProfiles);
     const state = emptyModelProfileState(issues.length > 0);
     const projected = { ...file };
-    if (issues.length || !file.modelProfiles)
-        return { file: projected, state, issues };
+    if (issues.length || !file.modelProfiles) {
+        return { file: projected, state, issues, mainOwnsContextWindow: false };
+    }
     const library = normalizeModelProfiles(file.modelProfiles);
     projected.modelProfiles = library;
     for (const role of ['main', 'fast']) {
@@ -20,13 +21,19 @@ export function projectModelProfiles(file) {
         state[role] = { selectedId: entry.id, appliedId: entry.id,
             overriddenFields: [], invalid: false };
         const connection = { provider: entry.provider, model: entry.model, baseUrl: entry.baseUrl };
-        if (role === 'main')
-            Object.assign(projected, connection);
-        else
+        if (role === 'main') {
+            // The profile owns the denominator: project BOTH a number and null
+            // (null = AUTO), so "profile set auto" stays distinguishable from
+            // "no profile bound" (profile-context-window tradeoff B).
+            Object.assign(projected, connection, { contextWindow: entry.contextWindow });
+        }
+        else {
             projected.fast = { ...DEFAULT_CONFIG.fast, ...file.fast, ...connection,
                 baseUrl: entry.baseUrl ?? '' };
+        }
     }
-    return { file: projected, state, issues };
+    return { file: projected, state, issues,
+        mainOwnsContextWindow: state.main.appliedId !== null };
 }
 /** Derive binding status from current connections, including session/model overrides. */
 export function resolveModelProfileState(config, profiles = config.modelProfiles, invalid = false) {

package/dist/config/model-profile-store.d.ts

@@ -1,9 +1,11 @@
 import { type ModelProfilesConfig, type ModelRole, type ProfileValidationIssue } from './model-profiles.js';
-import type { CliConfig, CompactionConfig, FastConfig, LogConfig, PersistedConfig } from './schema.js';
-export interface ModelSettingsPatch extends Partial<Omit<PersistedConfig, 'modelProfiles' | 'fast' | 'compaction' | 'log'>> {
+import type { CliConfig, CompactionConfig, FastConfig, LogConfig, PersistedConfig, TeamConfig } from './schema.js';
+export interface ModelSettingsPatch extends Partial<Omit<PersistedConfig, 'modelProfiles' | 'fast' | 'compaction' | 'log' | 'team'>> {
     fast?: Partial<FastConfig>;
     compaction?: Partial<CompactionConfig>;
     log?: Partial<LogConfig>;
+    /** The subagent-model picker writes here (subagent-model D-5/I-5): draft-only until Save. */
+    team?: Partial<TeamConfig>;
 }
 export interface ModelSettingsDraft {
     profiles?: ModelProfilesConfig;

package/dist/config/model-profiles.d.ts

@@ -6,6 +6,8 @@ export interface ModelProfile {
     model: string;
     baseUrl: string | null;
     apiKey: string | null;
+    /** The context window of this model+endpoint; null = AUTO (profile-context-window 5.1). */
+    contextWindow: number | null;
 }
 export interface ModelProfilesConfig {
     version: 1;
@@ -34,6 +36,17 @@ export declare function emptyModelProfiles(): ModelProfilesConfig;
 export declare function emptyModelProfileState(invalid?: boolean): ModelProfilesRuntime;
 /** Validate untrusted input; diagnostics never include supplied values. */
 export declare function validateModelProfiles(value: unknown): ProfileValidationIssue[];
+/**
+ * Disk-tolerance gate for a profile-level context window (profile-context-window 5.3).
+ *
+ * THE SAME TRI-STATE DISCIPLINE as store.ts normalizeContextWindow, kept out of
+ * store.ts on purpose: this file already imports schema.js and store's sibling
+ * model-profile-store.ts already imports this one, so placing it here avoids
+ * widening the existing store <-> model-profile-store cycle. A garbage value on
+ * a hand-edited file degrades to AUTO; it NEVER invalidates the whole library
+ * (invariant 4 - one bad number must not drop the user's credentials).
+ */
+export declare function normalizeProfileContextWindow(value: unknown): number | null;
 /** Normalize a valid library into a safe field whitelist; throws a fixed error if invalid. */
 export declare function normalizeModelProfiles(value: unknown): ModelProfilesConfig;
 /** Create an entry with a stable UUID and a frozen default name. */

package/dist/config/model-profiles.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { ADAPTER_PROVIDERS } from './schema.js';
+import { ADAPTER_PROVIDERS, clampContextWindow, isAutoToken } from './schema.js';
 const CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
 /** Return a fresh empty library without initiating a disk migration. */
 export function emptyModelProfiles() {
@@ -91,6 +91,21 @@ export function validateModelProfiles(value) {
     }
     return issues;
 }
+/**
+ * Disk-tolerance gate for a profile-level context window (profile-context-window 5.3).
+ *
+ * THE SAME TRI-STATE DISCIPLINE as store.ts normalizeContextWindow, kept out of
+ * store.ts on purpose: this file already imports schema.js and store's sibling
+ * model-profile-store.ts already imports this one, so placing it here avoids
+ * widening the existing store <-> model-profile-store cycle. A garbage value on
+ * a hand-edited file degrades to AUTO; it NEVER invalidates the whole library
+ * (invariant 4 - one bad number must not drop the user's credentials).
+ */
+export function normalizeProfileContextWindow(value) {
+    if (value === undefined || value === null || isAutoToken(value))
+        return null;
+    return clampContextWindow(value, null);
+}
 /** Normalize a valid library into a safe field whitelist; throws a fixed error if invalid. */
 export function normalizeModelProfiles(value) {
     if (validateModelProfiles(value).length)
@@ -102,7 +117,8 @@ export function normalizeModelProfiles(value) {
         entries: library.entries.map((entry) => ({ id: entry.id, name: entry.name.trim()
                 || [...entry.model.trim()].slice(0, 80).join(''), provider: entry.provider,
             model: entry.model.trim(), baseUrl: entry.baseUrl?.trim() || null,
-            apiKey: entry.apiKey?.trim() || null })) };
+            apiKey: entry.apiKey?.trim() || null,
+            contextWindow: normalizeProfileContextWindow(entry.contextWindow) })) };
 }
 /** Create an entry with a stable UUID and a frozen default name. */
 export function createModelProfile(input) {

package/dist/config/schema.d.ts

@@ -99,6 +99,35 @@ export declare const MAX_CONTEXT_WINDOW = 5000000;
  * this deliberately copies its shape rather than inventing a second convention.
  */
 export declare function clampContextWindow(v: unknown, fallback: number | null): number | null;
+/**
+ * Where the effective `contextWindow` override came from
+ * (profile-context-window §5.2).
+ *
+ * A CLI-LOCAL RUNTIME FACT: never persisted, never promoted into Core's event
+ * shapes. It exists so `/context` can name WHICH surface supplied a
+ * denominator the user asserted - the environment, the legacy top-level key,
+ * or the model profile bound as Main.
+ */
+export type ContextWindowOrigin = 'env' | 'config' | 'profile';
+/**
+ * Parse text typed into the settings screen or the profile editor for a
+ * context window (profile-context-window §5.3).
+ *
+ * THE MIRROR OF `parseMaxTokensInput` BELOW, down to the tri-state shape: it
+ * distinguishes AUTO from "the user typed nonsense", which `clampContextWindow`
+ * cannot - a typo must change NOTHING rather than silently discard the number
+ * the user meant to set. `''` / `'auto'` / `'0'` are AUTO (`isAutoToken`);
+ * a digit run is clamped through THE single gate; anything else is invalid.
+ */
+export declare function parseContextWindowInput(raw: string): {
+    kind: 'auto';
+} | {
+    kind: 'value';
+    value: number;
+    clamped: boolean;
+} | {
+    kind: 'invalid';
+};
 /**
  * Entries kept in `ViewState` at all (tui-render-performance L1 / R5).
  *
@@ -356,6 +385,26 @@ export interface TeamConfig {
      * meaningful while `team.overseer` is true.
      */
     overseerIntervalMs: number;
+    /**
+     * Which model a team child runs on (subagent-model-and-question-controls
+     * D-2). `'main'` = the lead's own connection - the default and the
+     * historical parity behavior; `'fast'` = the fast tier, resolved per
+     * dispatch through `resolveFastTier`; `'profile'` = the entry named by
+     * `team.modelProfileId`.
+     *
+     * A USER-OWNED SETTING, NEVER A TOOL PARAMETER (D-1): `normalizeSubagentSpecs`
+     * keeps silently dropping a stale `model` key, so the MODEL cannot downgrade
+     * its own delegation. This key is the one explicit, visible, reversible
+     * switch the human owns.
+     */
+    model: 'main' | 'fast' | 'profile';
+    /**
+     * The profile entry a `model: 'profile'` dispatch binds to; `null` = not
+     * bound. IGNORED by the other modes. Existence is NOT validated here - a
+     * dangling id degrades to the main model with a disclosed reason at
+     * resolution time (D-4), so deleting a profile can never break a dispatch.
+     */
+    modelProfileId: string | null;
 }
 /**
  * The requirement's ceiling on the fan-out (R-g).
@@ -380,6 +429,31 @@ export declare const DEFAULT_TEAM_CONFIG: TeamConfig;
  * the two disagree would make the panel's `n/m` readout confusing for no gain.
  */
 export declare function clampTeamConfig(raw: unknown): TeamConfig;
+/**
+ * The team ceilings cli <= 0.6.16 (7a6bf5630) persisted as its OWN defaults:
+ * every user who touched team mode back then still carries this exact triple
+ * in config.json, because `resolveTeamConfig` merges file values verbatim and
+ * no migration ever rewrote them. They are the kill ceilings behind F-8's
+ * "first block all failed" dispatches, so loading rewrites them to 0 (= no
+ * ceiling, the shipped default since 2ff15a9c3).
+ *
+ * EXACT-EQUALITY ONLY: a value that differs was a deliberate user choice and
+ * survives untouched. The price of that test is that a user who hand-types
+ * 300000 today is migrated to 0 too - the accepted trade, and the safe
+ * direction (no ceiling, not a cliff).
+ */
+export declare const LEGACY_TEAM_CEILING_DEFAULTS: Readonly<{
+    subagentTimeoutMs: number;
+    dispatchTimeoutMs: number;
+    maxTurnsPerSubagent: number;
+}>;
+/**
+ * The `{ key: 0 }` patch for legacy-default-equal ceilings, or `null` when
+ * nothing matches. Pure on purpose: `loadConfig` decides WHERE the patch is
+ * applied and persisted; this function only answers WHICH keys match, so the
+ * equality test lives beside the constants it reads.
+ */
+export declare function legacyTeamCeilingPatch(raw: unknown): Partial<TeamConfig> | null;
 export interface TodoConfig {
     /** Register `todo_write` at all. Default TRUE. */
     enabled: boolean;
@@ -942,6 +1016,18 @@ export interface CliConfig {
      * would parse and be discarded, with nothing failing.
      */
     contextWindow: number | null;
+    /**
+     * WHERE the override above came from, or `undefined` when there is none
+     * (profile-context-window §5.2). RUNTIME-ONLY, never persisted.
+     *
+     * THE CONTRACT IS AN IFF: `contextWindowOrigin !== undefined` exactly when
+     * `contextWindow !== null`. An explicit AUTO (profile set to auto,
+     * `config set contextWindow auto`, `ARAGON_CONTEXT_WINDOW=auto`) has value
+     * null, so its origin is undefined - "the user asserted this denominator"
+     * and "the user declared AUTO" are different facts, and the meter's
+     * override branch only ever sees the first.
+     */
+    contextWindowOrigin?: ContextWindowOrigin;
     theme: ThemeName;
     reducedMotion: boolean;
     /** Replay a plain-text summary on exit (full-screen only — see §4.4). */

package/dist/config/schema.js

@@ -148,6 +148,27 @@ export function clampContextWindow(v, fallback) {
         return fallback;
     return Math.min(MAX_CONTEXT_WINDOW, Math.max(MIN_CONTEXT_WINDOW, Math.floor(n)));
 }
+/**
+ * Parse text typed into the settings screen or the profile editor for a
+ * context window (profile-context-window §5.3).
+ *
+ * THE MIRROR OF `parseMaxTokensInput` BELOW, down to the tri-state shape: it
+ * distinguishes AUTO from "the user typed nonsense", which `clampContextWindow`
+ * cannot - a typo must change NOTHING rather than silently discard the number
+ * the user meant to set. `''` / `'auto'` / `'0'` are AUTO (`isAutoToken`);
+ * a digit run is clamped through THE single gate; anything else is invalid.
+ */
+export function parseContextWindowInput(raw) {
+    const trimmed = String(raw ?? '').trim();
+    if (isAutoToken(trimmed))
+        return { kind: 'auto' };
+    if (!/^\d+$/.test(trimmed))
+        return { kind: 'invalid' };
+    const value = clampContextWindow(trimmed, null);
+    if (value === null)
+        return { kind: 'invalid' };
+    return { kind: 'value', value, clamped: value !== Number.parseInt(trimmed, 10) };
+}
 /**
  * Entries kept in `ViewState` at all (tui-render-performance L1 / R5).
  *
@@ -457,6 +478,10 @@ export const DEFAULT_TEAM_CONFIG = {
     overseer: true,
     // 0 = the structural cadence default (300 s). See the field docstring.
     overseerIntervalMs: 0,
+    // The parity default: children run the lead's own model until the user
+    // says otherwise (AC-1 - an upgraded config behaves exactly as before).
+    model: 'main',
+    modelProfileId: null,
 };
 const SUBAGENTS_RANGE = { min: 1, max: HARD_MAX_SUBAGENTS };
 const CONCURRENT_RANGE = { min: 1, max: HARD_MAX_SUBAGENTS };
@@ -490,8 +515,57 @@ export function clampTeamConfig(raw) {
         maxTurnsPerSubagent: clampIntAllowingZero(src.maxTurnsPerSubagent, DEFAULT_TEAM_CONFIG.maxTurnsPerSubagent, TURNS_RANGE),
         overseer: bool(src.overseer, DEFAULT_TEAM_CONFIG.overseer),
         overseerIntervalMs: clampIntAllowingZero(src.overseerIntervalMs, DEFAULT_TEAM_CONFIG.overseerIntervalMs, OVERSEER_INTERVAL_RANGE),
+        // typo-changes-nothing, the discipline every enum clamp here follows: a
+        // hand-edited `model: 'fats'` resolves to 'main' (the parity default)
+        // rather than invalidating the file or refusing to launch. A bad
+        // `modelProfileId` (wrong type, or over the 128-codepoint budget
+        // `model-profiles.ts::validText` defines) is nulled the same way;
+        // reference EXISTENCE stays a resolution-time concern (D-4).
+        model: src.model === 'fast' || src.model === 'profile' ? src.model : 'main',
+        modelProfileId: typeof src.modelProfileId === 'string' && src.modelProfileId.length > 0
+            && [...src.modelProfileId].length <= 128
+            ? src.modelProfileId
+            : null,
     };
 }
+/**
+ * The team ceilings cli <= 0.6.16 (7a6bf5630) persisted as its OWN defaults:
+ * every user who touched team mode back then still carries this exact triple
+ * in config.json, because `resolveTeamConfig` merges file values verbatim and
+ * no migration ever rewrote them. They are the kill ceilings behind F-8's
+ * "first block all failed" dispatches, so loading rewrites them to 0 (= no
+ * ceiling, the shipped default since 2ff15a9c3).
+ *
+ * EXACT-EQUALITY ONLY: a value that differs was a deliberate user choice and
+ * survives untouched. The price of that test is that a user who hand-types
+ * 300000 today is migrated to 0 too - the accepted trade, and the safe
+ * direction (no ceiling, not a cliff).
+ */
+export const LEGACY_TEAM_CEILING_DEFAULTS = {
+    subagentTimeoutMs: 300_000,
+    dispatchTimeoutMs: 900_000,
+    maxTurnsPerSubagent: 24,
+};
+/**
+ * The `{ key: 0 }` patch for legacy-default-equal ceilings, or `null` when
+ * nothing matches. Pure on purpose: `loadConfig` decides WHERE the patch is
+ * applied and persisted; this function only answers WHICH keys match, so the
+ * equality test lives beside the constants it reads.
+ */
+export function legacyTeamCeilingPatch(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const src = raw;
+    const patch = {};
+    let matched = false;
+    for (const key of Object.keys(LEGACY_TEAM_CEILING_DEFAULTS)) {
+        if (src[key] === LEGACY_TEAM_CEILING_DEFAULTS[key]) {
+            patch[key] = 0;
+            matched = true;
+        }
+    }
+    return matched ? patch : null;
+}
 export const DEFAULT_TODO_CONFIG = {
     enabled: true,
     panel: true,

package/dist/team/model.d.ts

@@ -0,0 +1,88 @@
+/**
+ * `resolveSubagentModel` — THE single authority on which model a team child
+ * runs (subagent-model-and-question-controls §3.3).
+ *
+ * ASCII ONLY: `src/team/**` is inside the glyph scanner's scope.
+ *
+ * EVERY CONSUMER READS THE CHILD'S MODEL THROUGH THIS FUNCTION AND NOWHERE
+ * ELSE — `createSubagent`, the `task` report header, the settings root row and
+ * `/team model` — following the `resolveFastTier` precedent one directory over:
+ * four call sites each recomputing "which model do children run on?" from raw
+ * config keys is exactly how the report ends up naming a model the children
+ * silently fell back from.
+ *
+ * IT IS RE-RUN ON EVERY DISPATCH AND EVERY RENDER, NOT ONCE (rule 8 / RV-3 of
+ * the fast tier, inherited here): `team.model`, the fast tier and the profile
+ * library are all LIVE keys a settings save, `/fast off` or `/team model` can
+ * rewrite mid-session. A resolution captured at construction would be a
+ * resolution describing a session that no longer exists.
+ *
+ * A CHILD IS NEVER LEFT WITHOUT A MODEL (D-4). Every failure mode — fast tier
+ * off, profile deleted, profile key missing — degrades to the MAIN connection
+ * with a `fallbackReason`, so a dispatch cannot fail because its model setting
+ * went stale. The reason is disclosed, never swallowed: the report header and
+ * the settings summary line both render it.
+ */
+import type { ModelRef, ThinkingLevel } from '@aragon-agent/core';
+import type { ModelProfile, ModelRole } from '../config/model-profiles.js';
+import type { CliConfig } from '../config/schema.js';
+/** Which model children run on. `main` is the default and the historical behavior. */
+export type SubagentModelMode = 'main' | 'fast' | 'profile';
+/** Why a non-main request degraded to the main model (D-4 disclosure). */
+export type SubagentFallbackReason = 
+/** `team.model='fast'` but `resolveFastTier` is not ok (off, unconfigured, no key). */
+'fast_unavailable'
+/** `modelProfileId` is absent from the library (deleted, or never existed). */
+ | 'profile_missing'
+/** The entry exists but carries no key of its own and the shared layer has none. */
+ | 'profile_no_key';
+/** In-memory resolution; recomputed per dispatch/render, never persisted (§6.3). */
+export interface SubagentModelResolution {
+    /** The user's requested mode, verbatim from config (UI highlight reads this). */
+    mode: SubagentModelMode;
+    /** The mode actually in effect; `'main'` whenever a fallback fired. */
+    effective: SubagentModelMode;
+    /** The connection children will use. On fallback, exactly the main connection. */
+    ref: ModelRef;
+    /** main/profile take `config.thinkingLevel`; fast takes `config.fast.thinkingLevel`. */
+    thinkingLevel: ThinkingLevel;
+    /** The role controller key resolution uses: main/profile `'main'`, fast `'fast'`. */
+    keyRole: ModelRole;
+    /** The profile entry a `profile` request hit, dedicated key included; else null. */
+    profile: ModelProfile | null;
+    /** Present only when `effective !== mode`. */
+    fallbackReason?: SubagentFallbackReason;
+}
+/** The `AgentController.hasApiKey` shape, injected so there is one key resolver. */
+export type HasApiKey = (providerId: string, role?: ModelRole) => boolean;
+/** The lead-layer key resolver `resolveSubagentKey` falls back to. */
+export type SharedKeyResolver = (providerId: string, role: ModelRole) => string | undefined;
+/**
+ * Resolve the model every child of the NEXT dispatch will run on.
+ *
+ * Pure, synchronous, no IO — testable as a matrix over config fixtures.
+ *
+ * @param config The live effective config. Read fresh; never snapshot it.
+ * @param hasKey `AgentController.hasApiKey`, which already resolves the
+ *   config-file key, the provider environment variable and the one-shot
+ *   `--api-key` override. Injected rather than reimplemented for the reason
+ *   `resolveFastTier` records: a second key resolver is a second answer to
+ *   "why does it say no key?".
+ */
+export declare function resolveSubagentModel(config: CliConfig, hasKey: HasApiKey): SubagentModelResolution;
+/**
+ * The key a CHILD resolves for a provider, profile-aware (§3.3 / I-4).
+ *
+ * A profile's dedicated key is visible ONLY here: it never reaches env,
+ * `config.apiKeys` or a log line. While the resolution's profile is bound and
+ * the provider matches it, the entry key takes priority over the shared layer;
+ * every other provider (and every non-profile mode) resolves through the
+ * lead's own resolver at `resolution.keyRole` — which is what keeps a `fast`
+ * child entitled to the fast-role key and a `main` child to the main one.
+ *
+ * @param config The live config (carried for parity with the resolver pair).
+ * @param resolution A fresh `resolveSubagentModel` output.
+ * @param providerId The provider the child needs a key for.
+ * @param shared The lead-layer resolver (`controller.resolveKey`).
+ */
+export declare function resolveSubagentKey(config: CliConfig, resolution: SubagentModelResolution, providerId: string, shared: SharedKeyResolver): string | undefined;