@askdkc/dsh-cli 0.11.3

package/lib/types/migrationPrefs.js

@@ -0,0 +1,97 @@
+/**
+ * One-time local migrations (`~/.dsh-tui/migrations.json`), keyed by stable
+ * migration id → ISO timestamp. Named keys (not a bare flag) so later
+ * migrations can append entries without a format change. Best-effort like
+ * every prefs file: a missing/corrupt file reads as "nothing applied yet",
+ * and a failed write simply leaves the migration to retry on a later boot.
+ */
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { DATA_DIR } from './utils/paths.js';
+const PREFS_DIR = DATA_DIR;
+const MIGRATIONS_FILE = 'migrations.json';
+/**
+ * The fullscreen factory-default flip (schema + `cordis.patch.yml`, 0.9.x):
+ * a `fullscreen: false` pinned in the settings user layer BEFORE the flip
+ * keeps overriding the new default on every boot. The first boot past this
+ * migration clears that stale explicit choice once — see
+ * {@link planFullscreenFactoryMigration} for the decision table.
+ */
+export const FULLSCREEN_FACTORY_MIGRATION = 'fullscreen-factory-default';
+/**
+ * Read the applied-migration map.
+ * @param dir - Prefs directory (injectable for tests).
+ * @returns Parsed migration map; empty on any read/parse failure.
+ */
+export function readAppliedMigrations(dir = PREFS_DIR) {
+    try {
+        const parsed = JSON.parse(readFileSync(join(dir, MIGRATIONS_FILE), 'utf8'));
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return {};
+        return parsed;
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Record a migration as applied (merge write — other keys are never dropped).
+ * @param id - Migration id.
+ * @param dir - Prefs directory (injectable for tests).
+ * @returns True when the file was written, false on failure.
+ */
+export function markMigrationApplied(id, dir = PREFS_DIR) {
+    try {
+        const current = readAppliedMigrations(dir);
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(join(dir, MIGRATIONS_FILE), JSON.stringify({ ...current, [id]: new Date().toISOString() }, null, 2));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Decide the migration step from the settings scope's RESOLVED fullscreen
+ * value. The dsh-tui namespace declares no schema default and no `base`
+ * layer for `fullscreen`, so a resolved `false` can only come from the user
+ * layer — the pre-flip explicit choice this migration exists to clear:
+ *  - `done`  — marker present: never touch the user layer again, so a
+ *     `false` written AFTER the migration (a deliberate /settings choice)
+ *     always stands;
+ *  - `unset` — stale pre-flip explicit `false`: the caller clears it via a
+ *     settings `unset` op and boots fullscreen regardless — the doc write
+ *     is async and must not race the synchronous boot decision, so the
+ *     caller shadows the stale value out of its first settings apply;
+ *  - `mark`  — nothing to clear (unset or already `true`): record the
+ *     marker now so a `false` set later is never mistaken for a stale one.
+ */
+export function planFullscreenFactoryMigration(resolvedFullscreen, migrations) {
+    if (migrations[FULLSCREEN_FACTORY_MIGRATION] !== undefined)
+        return 'done';
+    return resolvedFullscreen === false ? 'unset' : 'mark';
+}
+/**
+ * Persist the plan's side effects. For `unset` the marker lands only after
+ * the doc write succeeds — a failed write stays unmarked and the next boot
+ * retries (that boot already ran fullscreen off the shadowed value).
+ * Never rejects.
+ * @param plan - Decision from {@link planFullscreenFactoryMigration}.
+ * @param options - `unset` thunk issuing the settings write; `dir` injects
+ *   the prefs directory for tests.
+ */
+export async function commitFullscreenFactoryMigration(plan, options) {
+    if (plan === 'done')
+        return;
+    if (plan === 'mark') {
+        markMigrationApplied(FULLSCREEN_FACTORY_MIGRATION, options.dir);
+        return;
+    }
+    try {
+        await options.unset();
+        markMigrationApplied(FULLSCREEN_FACTORY_MIGRATION, options.dir);
+    }
+    catch {
+        // Unmarked on purpose: retried next boot.
+    }
+}

package/lib/types/minimalMode.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Minimal mode: one process-wide flag gating decorative UI (header splash,
+ * emoji status glyphs, non-tool text colors, status-bar extras). The flag is
+ * owned by the channel (settings `dsh-tui.minimal`, applied live through
+ * scope.watch); leaf components read it here instead of threading a prop
+ * through four render layers. Code highlighting and tool-name colors are
+ * deliberately NOT gated — minimal keeps those.
+ */
+/** True when minimal mode is active (settings `dsh-tui.minimal`). */
+export declare function isMinimalMode(): boolean;
+/** @internal channel-owned setter; also called once at boot. */
+export declare function setMinimalMode(enabled: boolean): void;
+//# sourceMappingURL=minimalMode.d.ts.map

package/lib/types/minimalMode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"minimalMode.d.ts","sourceRoot":"","sources":["../../src/minimalMode.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,qEAAqE;AACrE,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAErD"}

package/lib/types/minimalMode.js

@@ -0,0 +1,17 @@
+/**
+ * Minimal mode: one process-wide flag gating decorative UI (header splash,
+ * emoji status glyphs, non-tool text colors, status-bar extras). The flag is
+ * owned by the channel (settings `dsh-tui.minimal`, applied live through
+ * scope.watch); leaf components read it here instead of threading a prop
+ * through four render layers. Code highlighting and tool-name colors are
+ * deliberately NOT gated — minimal keeps those.
+ */
+let minimal = false;
+/** True when minimal mode is active (settings `dsh-tui.minimal`). */
+export function isMinimalMode() {
+    return minimal;
+}
+/** @internal channel-owned setter; also called once at boot. */
+export function setMinimalMode(enabled) {
+    minimal = enabled;
+}

package/lib/types/modelGroups.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Pure derivation for the two-level `/model` picker: providers as top-level
+ * groups, their models one level down, with a pinned "recently used"
+ * pseudo-group first. Kept free of React/channel/i18n state so
+ * `scripts/verify-model-picker-groups.mjs` can drive it headless; the
+ * recents row's localized label is resolved at render time (its `label`
+ * field is the {@link RECENTS_LABEL_PLACEHOLDER} sentinel).
+ *
+ * @module dsh-tui/modelGroups
+ */
+import type { LlmModelInfo, LlmProviderInfo } from './adapter/ports/channel-view.js';
+/**
+ * The pseudo provider key of the pinned "recently used" group. Provider
+ * route ids cannot contain underscores (`PROVIDER_ROUTE_ID`), so this can
+ * never collide with a real route.
+ */
+export declare const RECENTS_GROUP_PROVIDER = "__recents__";
+/** The recents row's raw label; renderers replace it with the localized one. */
+export declare const RECENTS_LABEL_PLACEHOLDER = "__recent__";
+/** One recent-model reference (same shape as modelRecents' persisted ref). */
+export interface ModelRef {
+    readonly provider: string;
+    readonly id: string;
+}
+/** One top-level row: a provider route with its picker-facing identity. */
+export interface ModelGroupRow {
+    /** Harness route key (also the grouping key over `LlmModelInfo.provider`). */
+    readonly provider: string;
+    /** Display label — the registry's provider name, falling back to the route key. */
+    readonly label: string;
+    /** How many of the listed models belong to this provider. */
+    readonly count: number;
+}
+/**
+ * The recent refs that the current catalog still lists, most-recent-first —
+ * the second level of the recents group. Refs whose model vanished from the
+ * catalog (provider removed, or an OAuth provider signed out and
+ * credential-gated away) drop out here, so the group never offers a row the
+ * picker could not switch to.
+ */
+export declare function recentCatalogModels(recents: readonly ModelRef[], models: readonly LlmModelInfo[]): readonly LlmModelInfo[];
+/**
+ * Group a flat model catalog into provider rows, first-appearance order
+ * (the registry's own listing order), labels resolved through
+ * `providerInfos` with a route-key fallback. Recent refs (when supplied and
+ * still catalogued) pin one extra pseudo-group at the top.
+ */
+export declare function deriveModelGroups(models: readonly LlmModelInfo[], providerInfos: readonly LlmProviderInfo[], recents?: readonly ModelRef[]): readonly ModelGroupRow[];
+/** Where `/model` should open (or re-land after the fresh catalog arrives). */
+export interface ModelPickerLanding {
+    /**
+     * The group to open *inside* — set only by the single-provider fast path,
+     * where a one-row top level would be pure friction (and there are no
+     * recents to pin). Multi-provider catalogs — and any catalog with recents
+     * — land at the top level (`undefined`).
+     */
+    readonly group: string | undefined;
+    /** Focus index within the landed level's rows. */
+    readonly index: number;
+}
+/**
+ * Compute the picker's landing: with a meaningful recents list pinned, focus
+ * the recents row itself (its first entry is the most recently used model —
+ * the likeliest destination); without recents, focus the current provider's
+ * group. The single-provider fast path applies while recents carry no
+ * navigation value — an empty list, or a lone entry that can only be the
+ * current model (the picker seeds it): drilling straight into the only
+ * provider's list beats a top level whose recents row duplicates it. Two or
+ * more recents (or any multi-provider catalog) land at the top level.
+ */
+export declare function modelPickerLanding(models: readonly LlmModelInfo[], currentProvider: string | undefined, currentModel: string | undefined, recents?: readonly ModelRef[]): ModelPickerLanding;
+//# sourceMappingURL=modelGroups.d.ts.map

package/lib/types/modelGroups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modelGroups.d.ts","sourceRoot":"","sources":["../../src/modelGroups.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAEpF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAA;AAEnD,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,eAAe,CAAA;AAErD,8EAA8E;AAC9E,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CACpB;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,SAAS,QAAQ,EAAE,EAC5B,MAAM,EAAE,SAAS,YAAY,EAAE,GAC9B,SAAS,YAAY,EAAE,CAUzB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,aAAa,EAAE,SAAS,eAAe,EAAE,EACzC,OAAO,CAAC,EAAE,SAAS,QAAQ,EAAE,GAC5B,SAAS,aAAa,EAAE,CAsB1B;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,OAAO,CAAC,EAAE,SAAS,QAAQ,EAAE,GAC5B,kBAAkB,CAiBpB"}

package/lib/types/modelGroups.js

@@ -0,0 +1,97 @@
+/**
+ * Pure derivation for the two-level `/model` picker: providers as top-level
+ * groups, their models one level down, with a pinned "recently used"
+ * pseudo-group first. Kept free of React/channel/i18n state so
+ * `scripts/verify-model-picker-groups.mjs` can drive it headless; the
+ * recents row's localized label is resolved at render time (its `label`
+ * field is the {@link RECENTS_LABEL_PLACEHOLDER} sentinel).
+ *
+ * @module dsh-tui/modelGroups
+ */
+/**
+ * The pseudo provider key of the pinned "recently used" group. Provider
+ * route ids cannot contain underscores (`PROVIDER_ROUTE_ID`), so this can
+ * never collide with a real route.
+ */
+export const RECENTS_GROUP_PROVIDER = '__recents__';
+/** The recents row's raw label; renderers replace it with the localized one. */
+export const RECENTS_LABEL_PLACEHOLDER = '__recent__';
+/**
+ * The recent refs that the current catalog still lists, most-recent-first —
+ * the second level of the recents group. Refs whose model vanished from the
+ * catalog (provider removed, or an OAuth provider signed out and
+ * credential-gated away) drop out here, so the group never offers a row the
+ * picker could not switch to.
+ */
+export function recentCatalogModels(recents, models) {
+    const listed = [];
+    for (const ref of recents) {
+        const found = models.find(model => model.provider === ref.provider && model.id === ref.id);
+        if (found === undefined)
+            continue;
+        if (listed.some(seen => seen.provider === found.provider && seen.id === found.id))
+            continue;
+        listed.push(found);
+        if (listed.length >= 10)
+            break;
+    }
+    return listed;
+}
+/**
+ * Group a flat model catalog into provider rows, first-appearance order
+ * (the registry's own listing order), labels resolved through
+ * `providerInfos` with a route-key fallback. Recent refs (when supplied and
+ * still catalogued) pin one extra pseudo-group at the top.
+ */
+export function deriveModelGroups(models, providerInfos, recents) {
+    const order = [];
+    const counts = new Map();
+    for (const model of models) {
+        if (!counts.has(model.provider)) {
+            order.push(model.provider);
+            counts.set(model.provider, 0);
+        }
+        counts.set(model.provider, counts.get(model.provider) + 1);
+    }
+    const groups = order.map(provider => ({
+        provider,
+        label: providerInfos.find(info => info.id === provider)?.name ?? provider,
+        count: counts.get(provider),
+    }));
+    if (recents !== undefined) {
+        const recentCount = recentCatalogModels(recents, models).length;
+        if (recentCount > 0) {
+            groups.unshift({ provider: RECENTS_GROUP_PROVIDER, label: RECENTS_LABEL_PLACEHOLDER, count: recentCount });
+        }
+    }
+    return groups;
+}
+/**
+ * Compute the picker's landing: with a meaningful recents list pinned, focus
+ * the recents row itself (its first entry is the most recently used model —
+ * the likeliest destination); without recents, focus the current provider's
+ * group. The single-provider fast path applies while recents carry no
+ * navigation value — an empty list, or a lone entry that can only be the
+ * current model (the picker seeds it): drilling straight into the only
+ * provider's list beats a top level whose recents row duplicates it. Two or
+ * more recents (or any multi-provider catalog) land at the top level.
+ */
+export function modelPickerLanding(models, currentProvider, currentModel, recents) {
+    const providers = [];
+    for (const model of models) {
+        if (!providers.includes(model.provider))
+            providers.push(model.provider);
+    }
+    if (providers.length === 0)
+        return { group: undefined, index: 0 };
+    const recentCount = recents === undefined ? 0 : recentCatalogModels(recents, models).length;
+    if (providers.length === 1 && recentCount <= 1) {
+        const only = providers[0];
+        const index = models.findIndex(model => model.provider === currentProvider && model.id === currentModel);
+        return { group: only, index: index >= 0 ? index : 0 };
+    }
+    if (recentCount > 0)
+        return { group: undefined, index: 0 };
+    const groupIndex = providers.indexOf(currentProvider ?? '');
+    return { group: undefined, index: groupIndex >= 0 ? groupIndex : 0 };
+}

package/lib/types/modelPrefs.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Persisted model-route preference (`/model` picker choice), kept at
+ * `~/.dsh-tui/model.json` (`provider` + `model` keys) so the choice survives
+ * restarts — same pattern as agent-preset.json. The file is best-effort: a
+ * missing/corrupt file or an incomplete route simply falls back to the
+ * harness default. Explicit `provider`/`model` keys in cordis.yml win over
+ * this preference (deployment choice over runtime preference, matching
+ * activityFrames and agent-preset) — but only as a COMPLETE pair; the
+ * atomic resolution itself lives in modelRoute.ts (issue #67).
+ */
+/** One persisted model route: the provider route plus its model id. */
+export interface ModelPref {
+    provider: string;
+    model: string;
+}
+/**
+ * Parse a persisted `{ provider, model }` value; anything else yields
+ * undefined.
+ * @param text - Raw file contents.
+ * @returns The route when both halves are non-empty strings, else undefined.
+ */
+export declare function parseModelPref(text: string): ModelPref | undefined;
+/**
+ * The persisted model route, or undefined when unset or invalid.
+ * @param dir - Prefs directory (injectable for tests).
+ * @returns The persisted route, if any.
+ */
+export declare function readModelPref(dir?: string): ModelPref | undefined;
+/**
+ * Persist the chosen model route (best effort).
+ * @param provider - Provider route to persist.
+ * @param model - Provider-owned model id to persist.
+ * @param dir - Prefs directory (injectable for tests).
+ * @returns True when the file was written, false on failure.
+ */
+export declare function writeModelPref(provider: string, model: string, dir?: string): boolean;
+//# sourceMappingURL=modelPrefs.d.ts.map

package/lib/types/modelPrefs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modelPrefs.d.ts","sourceRoot":"","sources":["../../src/modelPrefs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,uEAAuE;AACvE,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAWlE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAkB,GAAG,SAAS,GAAG,SAAS,CAM5E;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAkB,GAAG,OAAO,CAQhG"}

package/lib/types/modelPrefs.js

@@ -0,0 +1,66 @@
+/**
+ * Persisted model-route preference (`/model` picker choice), kept at
+ * `~/.dsh-tui/model.json` (`provider` + `model` keys) so the choice survives
+ * restarts — same pattern as agent-preset.json. The file is best-effort: a
+ * missing/corrupt file or an incomplete route simply falls back to the
+ * harness default. Explicit `provider`/`model` keys in cordis.yml win over
+ * this preference (deployment choice over runtime preference, matching
+ * activityFrames and agent-preset) — but only as a COMPLETE pair; the
+ * atomic resolution itself lives in modelRoute.ts (issue #67).
+ */
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { DATA_DIR } from './utils/paths.js';
+const PREFS_DIR = DATA_DIR;
+/**
+ * Parse a persisted `{ provider, model }` value; anything else yields
+ * undefined.
+ * @param text - Raw file contents.
+ * @returns The route when both halves are non-empty strings, else undefined.
+ */
+export function parseModelPref(text) {
+    try {
+        const parsed = JSON.parse(text);
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return undefined;
+        const { provider, model } = parsed;
+        if (typeof provider !== 'string' || provider === '')
+            return undefined;
+        if (typeof model !== 'string' || model === '')
+            return undefined;
+        return { provider, model };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The persisted model route, or undefined when unset or invalid.
+ * @param dir - Prefs directory (injectable for tests).
+ * @returns The persisted route, if any.
+ */
+export function readModelPref(dir = PREFS_DIR) {
+    try {
+        return parseModelPref(readFileSync(join(dir, 'model.json'), 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Persist the chosen model route (best effort).
+ * @param provider - Provider route to persist.
+ * @param model - Provider-owned model id to persist.
+ * @param dir - Prefs directory (injectable for tests).
+ * @returns True when the file was written, false on failure.
+ */
+export function writeModelPref(provider, model, dir = PREFS_DIR) {
+    try {
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(join(dir, 'model.json'), JSON.stringify({ provider, model }, null, 2));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/lib/types/modelRecents.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Persisted recently-used models (`/model` picker's 最近使用 group), kept at
+ * `~/.dsh-tui/model-recents.json` so the list survives restarts — same
+ * best-effort pattern as agent-preset.json: a missing/corrupt file simply
+ * reads as empty, and a failed write never blocks the switch that caused it.
+ * Entries are `{ provider, id }` refs, most-recent-first, deduped, capped at
+ * {@link MODEL_RECENTS_LIMIT}.
+ *
+ * @module dsh-tui/modelRecents
+ */
+/** How many recent entries the file and the picker group keep. */
+export declare const MODEL_RECENTS_LIMIT = 10;
+/** One persisted recent-model reference. */
+export interface ModelRecentsRef {
+    readonly provider: string;
+    readonly id: string;
+}
+/**
+ * Parse a persisted `{ models: [...] }` document; invalid shapes yield an
+ * empty list (the file is rewritten on the next record).
+ * @param text - Raw file contents.
+ * @returns Valid refs in file order, deduped, capped.
+ */
+export declare function parseModelRecents(text: string): readonly ModelRecentsRef[];
+/**
+ * The persisted recent-model refs, most-recent-first.
+ * @param dir - Prefs directory (injectable for tests).
+ */
+export declare function readModelRecents(dir?: string): readonly ModelRecentsRef[];
+/**
+ * Record one use: move-to-front dedupe, cap at {@link MODEL_RECENTS_LIMIT},
+ * best-effort persist. Never throws — a failed write must not block the
+ * model switch that caused it.
+ * @param ref - The provider/model just switched to.
+ * @param dir - Prefs directory (injectable for tests).
+ * @returns The new list (also what a subsequent read returns on success).
+ */
+export declare function recordModelUse(ref: ModelRecentsRef, dir?: string): readonly ModelRecentsRef[];
+//# sourceMappingURL=modelRecents.d.ts.map

package/lib/types/modelRecents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modelRecents.d.ts","sourceRoot":"","sources":["../../src/modelRecents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,kEAAkE;AAClE,eAAO,MAAM,mBAAmB,KAAK,CAAA;AAErC,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CACpB;AAYD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,eAAe,EAAE,CAmB1E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAkB,GAAG,SAAS,eAAe,EAAE,CAMpF;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,GAAE,MAAkB,GAAG,SAAS,eAAe,EAAE,CAexG"}

package/lib/types/modelRecents.js

@@ -0,0 +1,97 @@
+/**
+ * Persisted recently-used models (`/model` picker's 最近使用 group), kept at
+ * `~/.dsh-tui/model-recents.json` so the list survives restarts — same
+ * best-effort pattern as agent-preset.json: a missing/corrupt file simply
+ * reads as empty, and a failed write never blocks the switch that caused it.
+ * Entries are `{ provider, id }` refs, most-recent-first, deduped, capped at
+ * {@link MODEL_RECENTS_LIMIT}.
+ *
+ * @module dsh-tui/modelRecents
+ */
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { DATA_DIR } from './utils/paths.js';
+const PREFS_DIR = DATA_DIR;
+/** How many recent entries the file and the picker group keep. */
+export const MODEL_RECENTS_LIMIT = 10;
+/** Narrow one parsed array element, or reject the whole file entry. */
+function asRef(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const record = value;
+    return typeof record['provider'] === 'string' && record['provider'] !== ''
+        && typeof record['id'] === 'string' && record['id'] !== ''
+        ? { provider: record['provider'], id: record['id'] }
+        : undefined;
+}
+/**
+ * Parse a persisted `{ models: [...] }` document; invalid shapes yield an
+ * empty list (the file is rewritten on the next record).
+ * @param text - Raw file contents.
+ * @returns Valid refs in file order, deduped, capped.
+ */
+export function parseModelRecents(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return [];
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+        return [];
+    const models = parsed.models;
+    if (!Array.isArray(models))
+        return [];
+    const refs = [];
+    for (const entry of models) {
+        const ref = asRef(entry);
+        if (ref === undefined)
+            continue;
+        if (refs.some(seen => seen.provider === ref.provider && seen.id === ref.id))
+            continue;
+        refs.push(ref);
+        if (refs.length >= MODEL_RECENTS_LIMIT)
+            break;
+    }
+    return refs;
+}
+/**
+ * The persisted recent-model refs, most-recent-first.
+ * @param dir - Prefs directory (injectable for tests).
+ */
+export function readModelRecents(dir = PREFS_DIR) {
+    try {
+        return parseModelRecents(readFileSync(join(dir, 'model-recents.json'), 'utf8'));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Record one use: move-to-front dedupe, cap at {@link MODEL_RECENTS_LIMIT},
+ * best-effort persist. Never throws — a failed write must not block the
+ * model switch that caused it.
+ * @param ref - The provider/model just switched to.
+ * @param dir - Prefs directory (injectable for tests).
+ * @returns The new list (also what a subsequent read returns on success).
+ */
+export function recordModelUse(ref, dir = PREFS_DIR) {
+    const next = [ref];
+    for (const seen of readModelRecents(dir)) {
+        if (seen.provider === ref.provider && seen.id === ref.id)
+            continue;
+        next.push(seen);
+        if (next.length >= MODEL_RECENTS_LIMIT)
+            break;
+    }
+    try {
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(join(dir, 'model-recents.json'), `${JSON.stringify({ models: next }, null, 2)}\n`);
+    }
+    catch {
+        // Best-effort like every other pref: the in-memory list still serves
+        // this session; the next successful write re-persists.
+    }
+    return next;
+}

package/lib/types/modelRoute.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Model route resolution (issue #67). The `(provider, model)` pair is a
+ * single value: every source either supplies the WHOLE route or is skipped,
+ * so a cordis.yml `provider`-only pin (the bundle ships
+ * `provider: deepseek-official` without `model`) can never merge with the
+ * model half of the persisted `/model` choice into a route no adapter
+ * recognizes. Startup, `/new`, resume and the status line all resolve through
+ * these helpers so the displayed route is the route requests actually take.
+ */
+import type { ModelPref } from './modelPrefs.js';
+/** One complete model route. */
+export interface ModelRoute {
+    provider: string;
+    model: string;
+}
+/** Harness default route: the final fallback when neither cordis.yml nor the persisted `/model` choice supplies one. */
+export declare const DEFAULT_MODEL_ROUTE: ModelRoute;
+/**
+ * The route cordis.yml pins explicitly — only when it names BOTH halves. A
+ * half-pinned config counts as unset here so it cannot override half of the
+ * persisted preference (issue #67).
+ * @param configured - Raw `provider`/`model` keys from cordis.yml.
+ * @returns The configured route, or undefined when either half is missing.
+ */
+export declare function explicitModelRoute(configured: {
+    provider?: string;
+    model?: string;
+}): ModelRoute | undefined;
+/**
+ * Resolve the effective route atomically: a complete cordis.yml route wins
+ * whole; otherwise the persisted `/model` choice wins whole; otherwise the
+ * defaults win whole — a half-pinned config is IGNORED rather than merged
+ * with the defaults' other half, so no source ever contributes just one
+ * half of the final route.
+ * @param configured - Raw `provider`/`model` keys from cordis.yml.
+ * @param pref - The persisted `/model` choice, if any.
+ * @param defaults - Final fallback route (the channel's startup route for
+ *   `/new`, the harness default at boot).
+ * @returns The resolved route.
+ */
+export declare function resolveModelRoute(configured: {
+    provider?: string;
+    model?: string;
+}, pref: ModelPref | undefined, defaults?: ModelRoute): ModelRoute;
+/**
+ * The route a persisted session's own log records (issues #30/#67): the last
+ * `request/header` snapshot carries the call config the agent loop builds its
+ * requests from, so it IS the route a resume continues on when cordis.yml
+ * does not pin a complete override. The status line derives the resumed
+ * session's route from this so the display follows the session, not the
+ * startup resolution. A log without any header (a session that never started
+ * a turn) records no route.
+ * @param events - The session's durable event log.
+ * @returns The last recorded route, or undefined when the log has none.
+ */
+export declare function recordedModelRoute(events: readonly {
+    type: string;
+    data?: unknown;
+}[]): ModelRoute | undefined;
+/**
+ * Best-effort combination check (issue #67): when the llm runtime advertises
+ * a non-empty catalog for the route's provider and the model is not in it,
+ * reject the whole route in favor of `fallback` so a stale persisted choice
+ * surfaces at startup instead of as a server-side model-name error.
+ *
+ * Uncertainty trusts the route — no llm service, an empty catalog, a catalog
+ * read that failed for transport or adapter-internal reasons. An unregistered
+ * PROVIDER is not uncertainty: no adapter owns the name, so the route is
+ * proven unusable and falls back exactly like an unknown model does. Trusting
+ * it does not keep startup alive either — agent creation dies a few frames
+ * later inside the preset setup hook, reported as `refusing to compose an
+ * unscoped context`, which names neither the provider nor the stale
+ * preference that chose it.
+ * @param llm - The llm runtime seam, when mounted.
+ * @param route - The resolved route to check.
+ * @param fallback - Route to adopt when the check rejects.
+ * @returns The adopted route plus the rejected one (for a warning), if any.
+ */
+export declare function validateModelRoute(llm: {
+    listModels(provider: string): Promise<readonly {
+        id: string;
+    }[]>;
+} | undefined, route: ModelRoute, fallback?: ModelRoute): Promise<{
+    route: ModelRoute;
+    rejected?: ModelRoute;
+}>;
+//# sourceMappingURL=modelRoute.d.ts.map

package/lib/types/modelRoute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modelRoute.d.ts","sourceRoot":"","sources":["../../src/modelRoute.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,gCAAgC;AAChC,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,wHAAwH;AACxH,eAAO,MAAM,mBAAmB,EAAE,UAGjC,CAAA;AAID;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,GAAG,SAAS,CAI5G;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EACjD,IAAI,EAAE,SAAS,GAAG,SAAS,EAC3B,QAAQ,GAAE,UAAgC,GACzC,UAAU,CAKZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,GAClD,UAAU,GAAG,SAAS,CAWxB;AAyBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE;IAAE,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAA;CAAE,GAAG,SAAS,EACrF,KAAK,EAAE,UAAU,EACjB,QAAQ,GAAE,UAAgC,GACzC,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,EAAE,UAAU,CAAA;CAAE,CAAC,CAWvD"}