@circuitwall/jarela 2.2.0 → 2.2.1

package/lib/agents/run-thread.ts

@@ -22,7 +22,7 @@ import { startScheduler } from "@/lib/scheduler";
 import { recall, type RecalledMemory } from "@/lib/embeddings";
 import { getMemoryPolicy } from "@/lib/stores/app-settings";
 import { validateAssistantOutput } from "@/lib/agents/output-validator";
-import { getDefaultModelConfig, getModelConfig, getModelParams, listModelConfigs } from "@/lib/stores/model-config";
+import { getDefaultModelConfig, getModelConfig, getModelParams, isModelConfigEnabled, listEnabledModelConfigs } from "@/lib/stores/model-config";
 import {
   buildHistoryWindow,
   buildSystemPrompt,
@@ -425,9 +425,11 @@ export function snapshotThreadModelConfigName(thread_id: string): string | null
   const agentCfg = getAgentConfig(thread.agent_id);
   if (!agentCfg) return null;
 
-  if (agentCfg.model_config_name) return agentCfg.model_config_name;
+  if (agentCfg.model_config_name && isModelConfigEnabled(getModelConfig(agentCfg.model_config_name))) {
+    return agentCfg.model_config_name;
+  }
   if (getConfig().modelRouterMode !== "off") return null;
-  return agentCfg.model_config_name ?? getDefaultModelConfig()?.name ?? null;
+  return getDefaultModelConfig()?.name ?? null;
 }
 
 export function appendHistoryMessage(
@@ -578,7 +580,9 @@ export async function prepareThreadRun(req: ThreadRunRequest): Promise<PreparedT
   let modelConfigName = req._pinned_model_config_name
     ?? agentCfg.model_config_name
     ?? null;
-  if (modelConfigName && !getModelConfig(modelConfigName)) {
+  // Missing or disabled configs fall through to routing / the default; a
+  // disabled agent override is kept so re-enabling the model restores it.
+  if (modelConfigName && !isModelConfigEnabled(getModelConfig(modelConfigName))) {
     modelConfigName = null;
   }
   let routeDecision: RouteDecisionMetadata | null = null;
@@ -607,13 +611,14 @@ export async function prepareThreadRun(req: ThreadRunRequest): Promise<PreparedT
   if (!modelConfigName && useRouter) {
     const pricingTables = getPricingTables();
     const routed = routeTurnModel({
-      models: listModelConfigs().map((cfg) => ({
+      models: listEnabledModelConfigs().map((cfg) => ({
         name: cfg.name,
         provider: cfg.provider,
         model_id: cfg.model_id,
         params: getModelParams(cfg),
         credential_id: cfg.credential_id ?? null,
         is_default: cfg.is_default === 1,
+        enabled: true,
         created_at: cfg.created_at,
         updated_at: cfg.updated_at,
       })),

package/lib/agents/warm-summary-background.test.ts

@@ -71,8 +71,7 @@ vi.mock("@/lib/stores/agent-configs", () => ({
   getAgentTierProportions: () => null,
 }));
 vi.mock("@/lib/stores/model-config", () => ({
-  getDefaultModelConfig: () => ({ name: "model-1" }),
-  getModelConfig: () => ({ provider: "mock", model_id: "mock-1" }),
+  resolveRunnableModelConfig: () => ({ name: "model-1", provider: "mock", model_id: "mock-1" }),
   getModelParams: () => ({}),
 }));
 vi.mock("@/lib/providers", () => ({ getProvider: () => ({}) }));

package/lib/agents/warm-summary-background.ts

@@ -3,7 +3,7 @@ import type { ModelProvider, ProviderParams } from "@/lib/providers/types";
 import { summarizeTranscript, transcriptText, extractTopicSegments, validateTopicSegments, type SummaryTopicSegment } from "@/lib/agents/conversation-summary";
 import { takeRecentWarmMessages, warmSummaryMessageLimit, wrapWarmSummary, AUTOMATION_CHANNEL_ORDER } from "@/lib/agents/prepare/history-window";
 import { getAgentConfig, getAgentTierProportions } from "@/lib/stores/agent-configs";
-import { getDefaultModelConfig, getModelConfig, getModelParams } from "@/lib/stores/model-config";
+import { getModelParams, resolveRunnableModelConfig } from "@/lib/stores/model-config";
 import { putMemory } from "@/lib/stores/memory";
 import {
   commitThreadWarmContext,
@@ -168,8 +168,7 @@ export async function findTopicBoundary(threadId: string, boundarySeq: number):
   if (!thread) return null;
   const agent = getAgentConfig(thread.agent_id);
   if (!agent) return null;
-  const modelName = agent.model_config_name ?? getDefaultModelConfig()?.name ?? null;
-  const modelCfg = modelName ? getModelConfig(modelName) : null;
+  const modelCfg = resolveRunnableModelConfig(agent.model_config_name);
   if (!modelCfg?.provider || !modelCfg.model_id) return null;
 
   const rows = getRecentMessagesWindow(threadId, 0, undefined, "foreground")
@@ -339,8 +338,7 @@ async function buildSummaryBefore(
   const agent = getAgentConfig(thread.agent_id);
   if (!agent) return null;
 
-  const modelName = agent.model_config_name ?? getDefaultModelConfig()?.name ?? null;
-  const modelCfg = modelName ? getModelConfig(modelName) : null;
+  const modelCfg = resolveRunnableModelConfig(agent.model_config_name);
   if (!modelCfg?.provider || !modelCfg.model_id) return null;
 
   const baseParams = providerOverride?.params ?? getModelParams(modelCfg);
@@ -491,8 +489,7 @@ async function buildAutomationChannelSummaryBefore(
   const agent = getAgentConfig(thread.agent_id);
   if (!agent) return null;
 
-  const modelName = agent.model_config_name ?? getDefaultModelConfig()?.name ?? null;
-  const modelCfg = modelName ? getModelConfig(modelName) : null;
+  const modelCfg = resolveRunnableModelConfig(agent.model_config_name);
   if (!modelCfg?.provider || !modelCfg.model_id) return null;
 
   const baseParams = providerOverride?.params ?? getModelParams(modelCfg);

package/lib/db/migrations.ts

@@ -469,6 +469,7 @@ export function runMigrations(db: DatabaseSync): void {
   ensureCredentialsTable(db);
   ensureCredentialsLabelAndDefaultColumns(db);
   ensureModelConfigCredentialIdColumn(db);
+  ensureModelConfigEnabledColumn(db);
   ensureAgentConfigsToolCredentialsColumn(db);
   seedAgentConfigs(db);
   backfillDeveloperInteractiveTerminalTools(db);
@@ -1553,6 +1554,15 @@ function ensureModelConfigCredentialIdColumn(db: DatabaseSync): void {
   }
 }
 
+// ADR-0102: disabled model configs stay saved but are hidden from model
+// selection, routing, and default fallback. Existing rows default to enabled.
+function ensureModelConfigEnabledColumn(db: DatabaseSync): void {
+  const cols = db.prepare("PRAGMA table_info(model_configs)").all() as Array<{ name: string }>;
+  if (!cols.some((c) => c.name === "enabled")) {
+    db.exec("ALTER TABLE model_configs ADD COLUMN enabled INTEGER NOT NULL DEFAULT 1");
+  }
+}
+
 // Idempotent backfill: for each model_config still carrying an inline
 // `api_key` (and no `credential_id` yet), create a credential row and
 // link by id. Strips the api_key / base_url / extra_headers fields from

package/lib/health/probes.test.ts

@@ -562,17 +562,14 @@ describe("health probes", () => {
       expect(r.status).toBe("auth_failed");
       expect(String(r.error)).toMatch(/subscription/i);
     });
-    it("PAT fallback: ok against the Models API", async () => {
-      saveIntegration("github-copilot", { api_key: "ghp_xxx" });
-      mockFetch(() => jsonResponse({ models: [] }));
-      const r = await probeGithubCopilot();
-      expect(r.status).toBe("ok");
-      expect(r.detail?.auth).toBe("pat");
-    });
-    it("PAT fallback: 401 auth_failed", async () => {
-      saveIntegration("github-copilot", { api_key: "ghp_bad" });
-      mockFetch(() => new Response("", { status: 401 }));
-      expect((await probeGithubCopilot()).status).toBe("auth_failed");
+    it("rejects legacy PAT credentials without probing GitHub Models", async () => {
+      saveIntegration("github-copilot", { api_key: "ghp_synthetic" });
+      const fetch = vi.fn();
+      vi.stubGlobal("fetch", fetch);
+      const result = await probeGithubCopilot();
+      expect(result.status).toBe("auth_failed");
+      expect(result.error).toMatch(/device-flow sign-in/i);
+      expect(fetch).not.toHaveBeenCalled();
     });
     it("prefers OAuth token over PAT when both are present", async () => {
       storeOAuthToken("gho_xxx");

package/lib/health/probes.ts

@@ -410,13 +410,8 @@ export async function probeCohere(): Promise<HealthResult> {
 }
 
 export async function probeGithubCopilot(): Promise<HealthResult> {
-  // Two credential paths share this probe:
-  //   1. Device-flow OAuth token (stored under memory_store namespace
-  //      "github-copilot-auth" by the in-app sign-in). Verified by
-  //      exchanging it for a Copilot session token.
-  //   2. Personal Access Token saved via the Integrations panel.
-  //      PATs cannot be exchanged, so we check them against the GitHub
-  //      Models REST surface which Copilot PATs are routed to.
+  // Device-flow OAuth token stored under the github-copilot-auth namespace.
+  // Legacy PAT credentials used GitHub Models, which has been retired.
   const oauth = getStoredCopilotOAuthToken();
   if (oauth) {
     try {
@@ -441,30 +436,9 @@ export async function probeGithubCopilot(): Promise<HealthResult> {
       return transient(describeError(err));
     }
   }
-  const pat = getIntegrationRaw("github-copilot")?.api_key?.trim();
-  if (!pat) return unconfigured("Not signed in and no PAT configured");
-  try {
-    const res = await fetch("https://models.github.ai/catalog/models", {
-      headers: {
-        Authorization: `Bearer ${pat}`,
-        Accept: "application/vnd.github+json",
-        "X-GitHub-Api-Version": "2026-03-10",
-        "User-Agent": "Jarela",
-      },
-      signal: probeSignal(DEFAULT_PROBE_TIMEOUT_MS),
-    });
-    if (res.status === 401 || res.status === 403) {
-      return authFailed(`GitHub rejected the PAT (${res.status}). Confirm the token has the "copilot" scope and your subscription is active.`);
-    }
-    if (res.status === 429) return transient("GitHub rate-limited the probe (429).");
-    if (!res.ok) {
-      const body = await res.text().catch(() => "");
-      return probeError(`GitHub Models ${res.status}: ${body.slice(0, 200)}`);
-    }
-    return ok({ auth: "pat" });
-  } catch (err) {
-    return transient(describeError(err));
-  }
+  const legacyPat = getIntegrationRaw("github-copilot")?.api_key?.trim();
+  if (!legacyPat) return unconfigured("Not signed in. Use device-flow sign-in from the Models panel.");
+  return authFailed("GitHub PAT authentication is no longer supported. Use device-flow sign-in from the Models panel.");
 }
 
 export async function probeClaudeCode(): Promise<HealthResult> {

package/lib/models/editor-payload.ts

@@ -24,7 +24,7 @@ export interface ModelEditorFormInput {
   credential_id?: string | null;
 }
 
-export type ModelEditorPayload = Omit<ModelConfig, "name" | "created_at" | "updated_at">;
+export type ModelEditorPayload = Omit<ModelConfig, "name" | "enabled" | "created_at" | "updated_at">;
 
 export type BuildResult =
   | { ok: true; name: string; payload: ModelEditorPayload }

package/lib/providers/github-copilot-auth.ts

@@ -1,6 +1,5 @@
-// GitHub Copilot device-flow login. Lets users sign in with their Copilot
-// subscription instead of pasting a PAT (which can't be exchanged for a
-// Copilot session token and gets rate-limited on the Models REST API).
+// GitHub Copilot device-flow login. The legacy PAT path depended on GitHub
+// Models, which has been retired; use this flow for Copilot Chat access.
 //
 // Flow (RFC 8628):
 //   1. POST github.com/login/device/code with the VS Code Copilot client_id.

package/lib/providers/github-copilot.test.ts

@@ -1,5 +1,9 @@
 import { afterEach, describe, it, expect, vi } from "vitest";
 import type AnthropicNS from "@anthropic-ai/sdk";
+
+// Keep routing tests off the developer's real data directory: no stored OAuth token.
+vi.mock("./github-copilot-auth", () => ({ getStoredOAuthToken: () => null }));
+
 import { githubCopilotProvider, isCopilotClaudeModel } from "./github-copilot";
 
 afterEach(() => vi.unstubAllGlobals());
@@ -113,4 +117,27 @@ describe("Claude-via-Copilot routing", () => {
     }, [])).rejects.toMatchObject({ status: 429 });
     expect(fetch).toHaveBeenCalledTimes(1);
   });
+  it.each(["ghp_synthetic", "github_pat_synthetic"])("rejects PAT %s without network access", async (apiKey) => {
+    const fetch = vi.fn(async () => new Response("{}", { status: 503 }));
+    vi.stubGlobal("fetch", fetch);
+
+    await expect(githubCopilotProvider.invoke!("gpt-4o", [{ role: "user", content: "synthetic" }], {
+      api_key: apiKey,
+    }, [])).rejects.toThrow(/PAT route used GitHub Models.*retired/i);
+    expect(fetch).not.toHaveBeenCalled();
+  });
+
+  it("routes explicit session tokens through the Copilot Chat endpoint", async () => {
+    const urls: string[] = [];
+    const fetch = vi.fn(async (input: RequestInfo | URL) => {
+      urls.push(input instanceof Request ? input.url : input.toString());
+      return new Response("{}", { status: 503 });
+    });
+    vi.stubGlobal("fetch", fetch);
+
+    await expect(githubCopilotProvider.invoke!("gpt-4o", [{ role: "user", content: "synthetic" }], {
+      copilot_session_token: "synthetic-session-token",
+    }, [])).rejects.toThrow();
+    expect(urls).toEqual(["https://api.githubcopilot.com/chat/completions"]);
+  });
 });

package/lib/providers/github-copilot.ts

@@ -55,19 +55,19 @@ interface SessionToken {
 
 const tokenCache = new Map<string, SessionToken>();
 
-function isLikelyGitHubPat(token: string): boolean {
-  return token.startsWith("ghp_") || token.startsWith("github_pat_") || token.startsWith("gho_");
+function isGitHubPat(token: string): boolean {
+  return token.startsWith("ghp_") || token.startsWith("github_pat_");
 }
 
-async function getCopilotToken(pat: string): Promise<string> {
-  if (!pat) throw new Error("GitHub Copilot: no API key configured for token exchange.");
-  const cached = tokenCache.get(pat);
+async function exchangeCopilotSessionToken(githubToken: string): Promise<string> {
+  if (!githubToken) throw new Error("GitHub Copilot: no API key configured for token exchange.");
+  const cached = tokenCache.get(githubToken);
   if (cached && cached.expiresAt - Date.now() > 60_000) return cached.token;
-  tokenCache.delete(pat);
+  tokenCache.delete(githubToken);
 
   const res = await fetch("https://api.github.com/copilot_internal/v2/token", {
     headers: {
-      Authorization: `token ${pat}`,
+      Authorization: `token ${githubToken}`,
       "User-Agent": "Jarela/1.0",
     },
     signal: AbortSignal.timeout(30_000),
@@ -78,15 +78,14 @@ async function getCopilotToken(pat: string): Promise<string> {
     if (res.status === 401) {
       throw new Error(
         `GitHub Copilot: token exchange failed (401). ` +
-        `Ensure your PAT has the "copilot" scope and that you have an active Copilot subscription. ` +
+        `Check that this GitHub account has an active Copilot subscription and the credential is valid. ` +
         `Details: ${body}`,
       );
     }
     if (res.status === 404) {
       throw new Error(
-        "GitHub Copilot token exchange endpoint was not found for this credential. " +
-        "Personal Access Tokens are not accepted directly by Copilot chat. " +
-        "Use a Copilot session token in params.copilot_session_token, or a credential that supports token exchange.",
+        "GitHub Copilot could not exchange this credential for a session token. " +
+        "Use the in-app device-flow sign-in or set params.copilot_session_token.",
       );
     }
     throw new Error(`GitHub Copilot: token exchange failed (${res.status}): ${body}`);
@@ -96,7 +95,7 @@ async function getCopilotToken(pat: string): Promise<string> {
   if (!json.token) throw new Error("GitHub Copilot: token exchange returned no token");
 
   const expiresAt = json.expires_at ? new Date(json.expires_at).getTime() : Date.now() + 28 * 60_000;
-  tokenCache.set(pat, { token: json.token, expiresAt });
+  tokenCache.set(githubToken, { token: json.token, expiresAt });
   return json.token;
 }
 
@@ -119,14 +118,8 @@ async function resolvedClient(params: ProviderParams): Promise<OpenAI> {
   });
 }
 
-// Returns the auth + transport details needed to talk to GitHub Copilot. The
-// session-token + native-Messages-API path is preferred because it preserves
-// Anthropic `cache_control` markers; the legacy PAT path falls back to
-// GitHub Models REST (OpenAI-shaped, no Claude Messages support, capped at
-// ~8K input tokens) and is incompatible with Anthropic routing.
-type CopilotAuth =
-  | { kind: "copilot-api"; baseURL: string; apiKey: string; headers: Record<string, string> }
-  | { kind: "models-rest"; baseURL: string; apiKey: string; headers: Record<string, string> };
+// Resolves credentials for Copilot's OpenAI-compatible and native Messages APIs.
+type CopilotAuth = { baseURL: string; apiKey: string; headers: Record<string, string> };
 
 async function resolveCopilotAuth(params: ProviderParams): Promise<CopilotAuth> {
   const apiKey = (params.api_key as string | undefined) ?? "";
@@ -134,7 +127,6 @@ async function resolveCopilotAuth(params: ProviderParams): Promise<CopilotAuth>
 
   if (explicitSessionToken && explicitSessionToken.length > 0) {
     return {
-      kind: "copilot-api",
       baseURL: params.base_url ?? "https://api.githubcopilot.com",
       apiKey: explicitSessionToken,
       headers: { ...FIXED_HEADERS },
@@ -143,25 +135,19 @@ async function resolveCopilotAuth(params: ProviderParams): Promise<CopilotAuth>
 
   const oauthToken = getStoredOAuthToken();
   if (oauthToken) {
-    const token = await getCopilotToken(oauthToken);
+    const token = await exchangeCopilotSessionToken(oauthToken);
     return {
-      kind: "copilot-api",
       baseURL: params.base_url ?? "https://api.githubcopilot.com",
       apiKey: token,
       headers: { ...FIXED_HEADERS },
     };
   }
 
-  if (apiKey && isLikelyGitHubPat(apiKey)) {
-    return {
-      kind: "models-rest",
-      baseURL: params.base_url ?? "https://models.github.ai/inference",
-      apiKey,
-      headers: {
-        Accept: "application/vnd.github+json",
-        "X-GitHub-Api-Version": "2026-03-10",
-      },
-    };
+  if (apiKey && isGitHubPat(apiKey)) {
+    throw new Error(
+      "GitHub Copilot: this provider's GitHub PAT route used GitHub Models, which has been retired. " +
+      "Use the in-app device-flow sign-in or set copilot_session_token.",
+    );
   }
 
   if (!apiKey) {
@@ -169,9 +155,8 @@ async function resolveCopilotAuth(params: ProviderParams): Promise<CopilotAuth>
       "GitHub Copilot: not signed in. Use the in-app device-flow login, or set api_key / copilot_session_token.",
     );
   }
-  const token = await getCopilotToken(apiKey);
+  const token = await exchangeCopilotSessionToken(apiKey);
   return {
-    kind: "copilot-api",
     baseURL: params.base_url ?? "https://api.githubcopilot.com",
     apiKey: token,
     headers: { ...FIXED_HEADERS },
@@ -181,17 +166,9 @@ async function resolveCopilotAuth(params: ProviderParams): Promise<CopilotAuth>
 // Anthropic SDK client pointed at Copilot's native `/v1/messages` endpoint.
 // Copilot accepts the Anthropic request shape (including `cache_control`
 // ephemeral breakpoints) for Claude-family models when called with a
-// session token. The PAT-only `models.github.ai` fallback does NOT expose
-// this endpoint, so we surface a clear error there instead of silently
-// downgrading to a path that strips the cache markers.
+// Copilot session token.
 async function resolvedAnthropicClient(params: ProviderParams): Promise<Anthropic> {
   const auth = await resolveCopilotAuth(params);
-  if (auth.kind !== "copilot-api") {
-    throw new Error(
-      "GitHub Copilot: Claude models require a Copilot session token (OAuth or copilot_session_token). " +
-      "Personal Access Tokens route to GitHub Models REST, which does not expose the native Messages API.",
-    );
-  }
   return new Anthropic({
     // The SDK requires an apiKey field; we authenticate via authToken
     // (Authorization: Bearer ...) per Copilot's contract. The empty

package/lib/stores/integrations.test.ts

@@ -175,6 +175,13 @@ describe("integrations store (credentials-backed)", () => {
     // And no credential was created as a side effect of the failed write.
     expect(listCredentials({ type: "integration", provider: "anthropic" }).length).toBe(0);
   });
+
+  it("does not create a configured row from an empty optional credential field", () => {
+    const result = saveIntegration("github-copilot", { api_key: "" });
+    expect("error" in result).toBe(true);
+    expect(getIntegrationStatus("github-copilot")?.configured).toBe(false);
+    expect(listCredentials({ type: "integration", provider: "github-copilot" })).toHaveLength(0);
+  });
 });
 
 describe("integrations store: multi-instance + ALS routing", () => {

package/lib/stores/integrations.ts

@@ -176,11 +176,10 @@ export const INTEGRATIONS = {
     label: "GitHub Copilot",
     category: "llm" as IntegrationCategory,
     description:
-      "Routes chat-completion requests through your Copilot subscription. Paste a GitHub PAT " +
-      "with `copilot` scope from github.com/settings/tokens, or run the device-flow sign-in in " +
-      "the Models panel.",
+      "Routes chat-completion requests through your Copilot subscription. Use the device-flow " +
+      "sign-in in the Models panel; legacy GitHub PAT authentication is no longer supported.",
     fields: [
-      { key: "api_key", label: "GitHub PAT", placeholder: "ghp_… or github_pat_…", secret: true, required: true },
+      { key: "api_key", label: "Legacy GitHub PAT (unsupported)", placeholder: "Use Models panel sign-in", secret: true, required: false },
     ],
   },
   gmail: {
@@ -437,6 +436,7 @@ export function saveIntegration(name: string, incoming: Record<string, string>):
       else if (f.required) return { error: `missing required secret "${f.key}"` };
     } else {
       if (f.required && !v.trim()) return { error: `"${f.key}" cannot be empty` };
+      if (!v.trim()) continue;
       merged[f.key] = v;
       if (existing[f.key] !== v) touched.push(f.key);
     }

package/lib/stores/model-config.test.ts

@@ -118,3 +118,91 @@ describe("deleteModelConfig auto-promotes default", () => {
     deleteModelConfig("keep-default");
   });
 });
+
+describe("model config enable/disable and atomic default", () => {
+  async function load() {
+    return import("./model-config");
+  }
+
+  function reset(names: string[]) {
+    for (const n of names) deleteModelConfig(n);
+  }
+
+  it("new rows are enabled and upsert without is_default preserves the default flag", async () => {
+    const { isModelConfigEnabled } = await load();
+    upsertModelConfig("ena-a", "anthropic", "claude-x", {}, true);
+    const saved = upsertModelConfig("ena-a", "anthropic", "claude-x", { temperature: 0.2 }, undefined);
+    expect(saved.is_default).toBe(1);
+    expect(isModelConfigEnabled(saved)).toBe(true);
+    reset(["ena-a"]);
+  });
+
+  it("setDefaultModelConfig leaves exactly one default", async () => {
+    const { setDefaultModelConfig, listModelConfigs } = await load();
+    upsertModelConfig("def-a", "anthropic", "claude-x", {}, true);
+    upsertModelConfig("def-b", "anthropic", "claude-y", {}, false);
+    const row = setDefaultModelConfig("def-b");
+    expect(row.is_default).toBe(1);
+    expect(listModelConfigs().filter((r) => r.is_default === 1).map((r) => r.name)).toEqual(["def-b"]);
+    // Params are untouched by a default switch.
+    expect(getModelConfig("def-a")?.params).toBe(JSON.stringify({}));
+    reset(["def-a", "def-b"]);
+  });
+
+  it("setDefaultModelConfig rejects unknown and disabled configs without changing the default", async () => {
+    const { setDefaultModelConfig, setModelConfigEnabled, ModelConfigStateError } = await load();
+    upsertModelConfig("rej-a", "anthropic", "claude-x", {}, true);
+    upsertModelConfig("rej-b", "anthropic", "claude-y", {}, false);
+    setModelConfigEnabled("rej-b", false);
+    expect(() => setDefaultModelConfig("missing-model")).toThrow(ModelConfigStateError);
+    expect(() => setDefaultModelConfig("rej-b")).toThrow(/disabled/);
+    expect(getDefaultModelConfig()?.name).toBe("rej-a");
+    reset(["rej-a", "rej-b"]);
+  });
+
+  it("disabling the default promotes another enabled config in the same step", async () => {
+    const { setModelConfigEnabled, listModelConfigs } = await load();
+    upsertModelConfig("dis-a", "anthropic", "claude-x", {}, true);
+    upsertModelConfig("dis-b", "anthropic", "claude-y", {}, false);
+    const disabled = setModelConfigEnabled("dis-a", false);
+    expect(disabled.enabled).toBe(0);
+    expect(disabled.is_default).toBe(0);
+    const defaults = listModelConfigs().filter((r) => r.is_default === 1);
+    expect(defaults).toHaveLength(1);
+    expect(defaults[0].enabled).toBe(1);
+    expect(getDefaultModelConfig()?.name).not.toBe("dis-a");
+    reset(["dis-a", "dis-b"]);
+  });
+
+  it("refuses to disable the last enabled config", async () => {
+    const { setModelConfigEnabled, listModelConfigs } = await load();
+    for (const r of listModelConfigs()) deleteModelConfig(r.name);
+    upsertModelConfig("only-one", "anthropic", "claude-x", {}, true);
+    expect(() => setModelConfigEnabled("only-one", false)).toThrow(/at least one/i);
+    expect(getModelConfig("only-one")?.enabled).toBe(1);
+    reset(["only-one"]);
+  });
+
+  it("disabled configs are skipped by default fallback and runnable resolution", async () => {
+    const { setModelConfigEnabled, resolveRunnableModelConfig, listEnabledModelConfigs } = await load();
+    upsertModelConfig("run-a", "anthropic", "claude-x", {}, true);
+    upsertModelConfig("run-b", "anthropic", "claude-y", {}, false);
+    setModelConfigEnabled("run-b", false);
+    expect(listEnabledModelConfigs().map((r) => r.name)).not.toContain("run-b");
+    expect(resolveRunnableModelConfig("run-b")?.name).toBe("run-a");
+    setModelConfigEnabled("run-b", true);
+    expect(resolveRunnableModelConfig("run-b")?.name).toBe("run-b");
+    reset(["run-a", "run-b"]);
+  });
+
+  it("making a disabled config the default via upsert re-enables it", async () => {
+    const { setModelConfigEnabled } = await load();
+    upsertModelConfig("up-a", "anthropic", "claude-x", {}, true);
+    upsertModelConfig("up-b", "anthropic", "claude-y", {}, false);
+    setModelConfigEnabled("up-b", false);
+    const row = upsertModelConfig("up-b", "anthropic", "claude-y", {}, true);
+    expect(row.enabled).toBe(1);
+    expect(getDefaultModelConfig()?.name).toBe("up-b");
+    reset(["up-a", "up-b"]);
+  });
+});