@hifullmoon/aicommit 1.4.0 → 2.0.0

package/.aicommit.config.example.json

@@ -1,40 +1,60 @@
 {
+  "schemaVersion": 1,
   "defaultProvider": "minimax",
   "providers": {
     "minimax": {
       "providerType": "minimax",
       "apiUrl": "https://api.minimaxi.com/v1/chat/completions",
       "apiKeyEnv": "MINIMAX_API_KEY",
-      "modelId": "MiniMax-M3",
-      "extraBody": {
-        "thinking": {
-          "type": "disabled"
-        },
-        "reasoning_split": true
+      "defaultModel": "default",
+      "models": {
+        "default": {
+          "modelId": "MiniMax-M3",
+          "extraBody": {
+            "thinking": {
+              "type": "disabled"
+            },
+            "reasoning_split": true
+          }
+        }
       }
     },
     "deepseek": {
       "providerType": "deepseek",
       "apiUrl": "https://api.deepseek.com/v1/chat/completions",
       "apiKeyEnv": "DEEPSEEK_API_KEY",
-      "modelId": "deepseek-v4-flash"
+      "defaultModel": "chat",
+      "models": {
+        "chat": { "modelId": "deepseek-v4-flash" }
+      }
     },
     "openrouter": {
       "providerType": "openrouter",
       "apiUrl": "https://openrouter.ai/api/v1/chat/completions",
       "apiKeyEnv": "OPENROUTER_API_KEY",
-      "modelId": "openai/gpt-4o-mini"
+      "defaultModel": "fast",
+      "models": {
+        "fast": { "modelId": "openai/gpt-4o-mini" },
+        "quality": { "modelId": "openai/gpt-4o" }
+      }
     },
     "kimi-code": {
       "providerType": "custom",
       "apiUrl": "https://api.kimi.com/coding/v1/chat/completions",
       "apiKeyEnv": "KIMI_API_KEY",
-      "modelId": "kimi-for-coding"
+      "defaultModel": "default",
+      "models": {
+        "default": { "modelId": "kimi-for-coding" }
+      }
     },
     "ollama": {
       "providerType": "ollama",
       "apiUrl": "http://127.0.0.1:11434/api/chat",
-      "modelId": "qwen3:8b"
+      "defaultModel": "qwen",
+      "models": {
+        "qwen": { "modelId": "qwen3:8b" },
+        "deepseek": { "modelId": "deepseek-r1:14b" }
+      }
     }
   },
   "language": "en",

package/CHANGELOG.md

@@ -1,131 +1,132 @@
 # Changelog
 
-All notable changes to this project are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow [Semantic Versioning](https://semver.org/).
+This file lists notable user-facing changes. Internal refactors, test-only changes, release mechanics, and documentation-only edits are omitted.
 
 ## [Unreleased]
 
+## [2.0.0] - 2026-08-27
+
 ### Added
 
-- Bundled Kimi Code setup preset and a copy-ready environment-variable configuration example using the OpenAI-compatible endpoint.
+- Added named model profiles per provider, with model selection available in setup and through `--model`.
 
 ### Changed
 
-- Publish the CLI as the public npm organization package `@hifullmoon/aicommit`, with guarded bootstrap and Trusted Publishing release paths.
-- Repository team policies now reject `-l`/`--lang` overrides, inherited policy languages are enforced during candidate validation, and split extension violations remain reviewable before commit.
-- Provider preset compatibility now accepts valid core prerelease/build versions and compares prereleases using SemVer precedence.
-- New committing split runs now detect unfinished checkpoints before provider access, report actionable resume/abort commands, and `aicommit split --abort` safely discards stale recovery metadata without changing commits, the index, or the worktree.
+- **Breaking:** user configuration now requires `schemaVersion: 1`, an explicit `defaultProvider`, and provider-level `defaultModel`/`models` maps; legacy flat and provider-level `modelId` configurations must be migrated with `aicommit setup`.
+- Provider preset manifests now use schema version 2 with named model maps and explicit default models.
+
+### Removed
+
+- Removed the Homebrew distribution channel; install and upgrade AICommit through npm.
+
+## [1.5.1] - 2026-08-27
+
+### Fixed
+
+- Normalized Windows 8.3 path aliases before validating split plan destinations, so repository-local output is rejected before any provider request.
+
+## [1.5.0] - 2026-08-27
+
+### Added
+
+- Added a built-in Kimi Code provider preset and an environment-variable configuration example.
+
+### Changed
+
+- `aicommit split` now starts the interactive split flow directly; `aicommit split run` remains available as an alias.
+- Repository policies can enforce their configured language without CLI overrides.
+- Provider preset compatibility now follows SemVer rules for prerelease and build versions.
+- Split commands detect unfinished checkpoints early and provide safe resume or abort actions.
 
 ### Security
 
-- Provider endpoint userinfo, credential-like query parameters, and fragments are redacted from config inspection, diagnostics, debug output, extension inputs, and credential-helper failures.
-- Extension provider adapters reject a broader set of credential-like request/configuration fields and fail closed when nested input exceeds the inspection depth.
+- Sensitive URL components are redacted from configuration, diagnostics, debug output, extension input, and credential-helper errors.
+- Provider extensions reject credential-like configuration fields and excessively deep nested input.
 
-## [1.4.0] - 2026-08-24
+## 1.4.0 - 2026-08-24
 
 ### Added
 
-- Credential-free `aicommit config show|validate|path` inspection and generated Bash, Zsh, and Fish completion.
-- Strict repository-owned team policy template plus deterministic local/CI `policy check` commands and bilingual migration examples.
-- Independently updateable, versioned provider preset manifests with core/adapter compatibility declarations, atomic install, repair, and rollback.
-- Credential-denied extension API v1 with isolated context-provider, message-validator, and provider-adapter interfaces, a strict manifest schema, and bilingual executable documentation.
-- Signed GitHub release assets with SHA-256 checksums, SPDX SBOM, GitHub OIDC/Sigstore attestations, npm Trusted Publishing provenance, and a generated Homebrew formula.
-- Automated npm/Homebrew installation smoke paths plus bilingual distribution, troubleshooting, privacy, and provider-compatibility guides.
+- Added credential-free `config show`, `config validate`, and `config path` commands.
+- Added generated shell completion for Bash, Zsh, and Fish.
+- Added repository-owned team policies with deterministic local and CI checks.
+- Added independently updateable provider presets with install, repair, and rollback support.
+- Added an isolated extension API for context providers, message validators, and provider adapters.
 
 ### Changed
 
-- Interactive setup now consumes the active provider preset manifest instead of a hard-coded provider list.
-- Provider request orchestration accepts asynchronous built-in or extension adapters without changing the Git and interaction flows.
+- Interactive setup now reads providers from the active preset manifest.
 
 ### Security
 
-- Third-party extension code runs in a permissioned child process with a sanitized environment and no credential value; project config cannot enable extensions, v1 rejects credential permission requests, and Node.js 18 never falls back to unsandboxed execution.
-- Team policy, config inspection, and preset management never resolve provider credentials; preset and extension manifests reject credential-bearing fields, unsafe paths, and incompatible contracts.
+- Extension processes run with explicit permissions, a sanitized environment, and no provider credentials.
+- Project configuration cannot enable extensions or weaken credential boundaries.
 
-## [1.3.0] - 2026-08-24
+## 1.3.0 - 2026-08-24
 
 ### Added
 
-- Explicit `--split=staged|all` scope selection plus versioned `aicommit split plan/apply` JSON artifacts with base-HEAD, change-set, and content-fingerprint validation.
-- Code-free, owner-only split checkpoints and `aicommit split --resume`, including reconciliation of the post-commit/pre-checkpoint crash window.
-- Strict split preflight checks for empty or duplicate groups, path coverage, rename/copy sides, conflicts, changed submodules, active hooks, and unborn branches.
-- Opt-in `--split-hunks` support for tracked multi-hunk text modifications, with hunk IDs/ranges/hashes in plans and machine output.
-- A shared end-to-end split fault matrix for SIGINT, process crashes, concurrent edits, hook failures, renames, deletions, binary files, and submodules.
+- Added explicit staged/all split scopes and reusable `split plan` / `split apply` artifacts.
+- Added resumable split checkpoints for interrupted or failed multi-commit operations.
+- Added optional same-file hunk splitting for tracked text files.
 
 ### Changed
 
-- Every split group is now created from an immutable captured object snapshot through a temporary index; later worktree edits cannot silently enter pending commits.
-- Hook and Git failures report checkpointed, in-flight, pending, and current worktree/index state without reordering or duplicating groups.
-- Split apply and resume run without loading provider configuration or credentials.
+- Split commits are built from captured snapshots so later worktree edits cannot enter pending commits.
+- Split apply and resume no longer require provider configuration or credentials.
 
 ### Security
 
-- Split plan and checkpoint readers reject unsafe paths, unknown fields, oversized artifacts, and symbolic links; artifacts never contain diffs, patch text, or file content.
-- Experimental hunk execution validates selected patches entirely in temporary indexes and requires the final tree to reproduce every captured target blob exactly; otherwise planning falls back to file-level groups before the first commit.
+- Split plans, checkpoints, paths, and hunk operations are validated before Git state is changed.
 
-## [1.2.0] - 2026-08-24
+## 1.2.0 - 2026-08-24
 
 ### Added
 
-- Versioned `commitPolicy` rules for types, scopes, subject length, body, breaking changes, and language.
-- Strictly bounded repository context from recent commit subjects, package boundaries, user-trusted convention files, and statically recognized commitlint rules.
-- `aicommit stats` for local first-pass acceptance, edit/rewrite/failure rates, latency, token trends, and the 20% quality-improvement baseline; stats can be disabled or permanently cleared.
-- Anonymous local eval coverage for single/mixed changes, renames, generated files, long diffs, Chinese/English output, and malformed weak-model candidates, enforced in CI at 99% or better.
+- Added versioned commit policies for type, scope, subject, body, breaking changes, and language.
+- Added bounded repository context from recent commits, package boundaries, trusted convention files, and recognized commitlint rules.
+- Added local-only quality statistics with enable, disable, and clear controls.
 
 ### Changed
 
-- Replaced the default free-form prompt contract with an authoritative structured policy; user guidance is additive, and project-owned prompts now require the user-owned `allowProjectPrompt` opt-in.
-- Commit generation now shows a bounded context summary before the provider request and allows every repository-context category to be disabled independently.
-- Candidate responses are validated locally for policy compliance and diff/path alignment; hard policy failures receive at most one low-cost correction without re-sending the diff.
-- Automatic policy corrections now contribute to the anonymous local rewrite metric.
+- Commit generation now uses an authoritative structured policy and locally validates candidate messages.
+- Repository context categories and budgets can be configured without allowing project settings to expand user-owned limits.
 
 ### Security
 
-- Diff, file, path, history, and convention inputs now use explicit JSON envelopes marked as untrusted data, backed by a prompt-injection regression corpus.
-- Project config can only disable repository context or lower user-owned ceilings; it cannot add trusted convention files, re-enable sources, expand budgets, or alter endpoints and credentials.
-- Trusted convention reads reject paths outside the repository, symbolic links, and non-regular files; commitlint configuration is parsed as data and never executed.
+- Repository and diff inputs are isolated as untrusted structured data.
+- Trusted convention files cannot escape the repository or execute commitlint configuration code.
 
-## [1.1.0] - 2026-08-24
+## 1.1.0 - 2026-08-24
 
 ### Added
 
-- Linux, macOS, and Windows CI across Node.js 18, 20, 22, and 24.
-- ESLint, Prettier, c8 reporting, and a 70% minimum line-coverage gate.
-- Setup and terminal UI smoke coverage plus installed-tarball dry-run tests.
-- Release, security, contribution, privacy, and recovery documentation.
-- Unified provider generation adapters and contract fixtures for OpenAI, OpenRouter, DeepSeek, MiniMax, Ollama, and custom endpoints.
-- Bounded retries for rate limits, recoverable server failures, and interrupted network responses, including `Retry-After` support.
-- Stable error categories and process exit codes for config, Git state, network, provider, response-format, sensitive-data, and concurrent-modification failures.
-- `--output=text|json` with a published JSON schema and decoration-free stdout for automation.
-- `aicommit doctor` diagnostics for runtime, configuration, endpoint security, provider capabilities, credentials, and connectivity.
-- Optional Git credential-helper integration for OS-backed credential storage.
-- Minimal local-only metrics with status, clear, enable, and disable commands.
+- Added unified support for OpenAI, OpenRouter, DeepSeek, MiniMax, Ollama, and custom compatible endpoints.
+- Added bounded retries for rate limits, recoverable server failures, and interrupted responses.
+- Added stable error categories, process exit codes, and JSON output for automation.
+- Added `aicommit doctor` diagnostics.
+- Added optional Git credential-helper integration.
 
 ### Changed
 
-- Constrained interactive prompt dependencies to releases that support Node.js 18.
-- Normalized provider usage as input, output, and total tokens and exposed finish reasons through one internal response contract.
 - Environment credentials now take priority over credential helpers and legacy plaintext configuration.
-- Installed-package smoke tests now verify the machine interface and published schema.
+- Provider usage is normalized as input, output, and total tokens.
 
-### Fixed
+### Security
 
-- Split planning scans complete untracked regular files for common sensitive content while keeping model previews bounded.
-- Split planning no longer follows untracked symbolic links for previews or fingerprints.
-- Non-interactive split mode fails closed before auto-staging detected sensitive files.
-- Split-plan messages are sanitized before terminal display and commit execution.
+- Sensitive untracked files are detected before non-interactive staging.
+- Split previews avoid symbolic links and sanitize generated messages before display or commit.
 
-## [1.0.0] - 2026-08-24
+## 1.0.0 - 2026-08-24
 
 ### Added
 
-- Conventional commit generation in Chinese or English through OpenAI-compatible providers.
-- Interactive staging, editing, regeneration, dry-run, reasoning display, and connection checks.
-- File-level split planning and execution with Git-state concurrency checks.
-- Provider presets and user/project configuration trust boundaries.
-
-[Unreleased]: https://github.com/hi-fullmoon/AICommit/compare/v1.4.0...HEAD
-[1.4.0]: https://github.com/hi-fullmoon/AICommit/compare/v1.3.0...v1.4.0
-[1.3.0]: https://github.com/hi-fullmoon/AICommit/compare/v1.2.0...v1.3.0
-[1.2.0]: https://github.com/hi-fullmoon/AICommit/compare/v1.1.0...v1.2.0
-[1.1.0]: https://github.com/hi-fullmoon/AICommit/compare/v1.0.0...v1.1.0
-[1.0.0]: https://github.com/hi-fullmoon/AICommit/releases/tag/v1.0.0
+- Added Conventional Commit generation in Chinese or English through OpenAI-compatible providers.
+- Added interactive staging, editing, regeneration, dry-run, reasoning display, and connection checks.
+- Added file-level split planning and execution with Git-state concurrency checks.
+- Added provider presets and user/project configuration boundaries.
+
+[Unreleased]: https://github.com/hi-fullmoon/AICommit/compare/v2.0.0...HEAD
+[2.0.0]: https://github.com/hi-fullmoon/AICommit/releases/tag/v2.0.0
+[1.5.1]: https://github.com/hi-fullmoon/AICommit/releases/tag/v1.5.1
+[1.5.0]: https://github.com/hi-fullmoon/AICommit/releases/tag/v1.5.0

package/README.md

@@ -4,22 +4,35 @@
 
 AI-powered git commit message generator: reads your diff, asks an AI model for a conventional commit message, and commits after your confirmation.
 
-## Install
+## Usage preview
 
-```bash
-npm install --global @hifullmoon/aicommit
-```
+These screenshots were captured from real interactive terminal sessions in this repository. Provider, model, paths, and timings reflect the environment at capture time.
+
+### Configure a provider interactively
+
+![AICommit setup prompting for an AI provider](https://raw.githubusercontent.com/hi-fullmoon/AICommit/main/docs/assets/readme/setup-provider.png)
+
+### Diagnose configuration and connectivity
+
+![AICommit doctor checking runtime, configuration, credentials, and provider connectivity](https://raw.githubusercontent.com/hi-fullmoon/AICommit/main/docs/assets/readme/doctor-diagnostics.png)
+
+### Generate a commit message
+
+![AICommit generating a commit message from staged changes](https://raw.githubusercontent.com/hi-fullmoon/AICommit/main/docs/assets/readme/generating-commit.png)
+
+### Review the generated commit message
+
+![AICommit presenting a generated conventional commit message for confirmation](https://raw.githubusercontent.com/hi-fullmoon/AICommit/main/docs/assets/readme/generate-commit.png)
 
-Or install with Homebrew:
+## Install
 
 ```bash
-brew tap hi-fullmoon/aicommit https://github.com/hi-fullmoon/AICommit.git
-brew install hi-fullmoon/aicommit/aicommit
+npm install --global @hifullmoon/aicommit
 ```
 
 Requires Node.js >= 18.
 
-See the bilingual [installation, upgrade, signature-verification, and rollback guide](docs/distribution.md). Both npm and Homebrew paths have automated install smoke tests.
+See the bilingual [installation, upgrade, signature-verification, and rollback guide](docs/distribution.md). The npm package has an automated installation smoke test.
 
 To install a source checkout instead, run `npm install --global .` from the repository root.
 
@@ -31,7 +44,7 @@ The fastest way is the interactive wizard:
 aicommit setup
 ```
 
-It walks you through picking a provider from the active versioned preset manifest (bundled presets include OpenAI, DeepSeek, OpenRouter, MiniMax, Kimi Code, and Ollama) or entering a custom OpenAI-compatible endpoint, then entering your API key/model, choosing the commit language, and optionally testing the connection. Configuration is written atomically to the user config (`~/.aicommit.config.json`); a malformed existing file is backed up before replacement.
+It walks you through picking a provider from the active versioned preset manifest (bundled presets include OpenAI, DeepSeek, OpenRouter, MiniMax, Kimi Code, and Ollama) or entering a custom OpenAI-compatible endpoint, then entering your API key and one or more models, choosing a default model and commit language, and optionally testing the connection. Configuration is written atomically to the user config (`~/.aicommit.config.json`); a malformed or old-format existing file is backed up before replacement.
 
 To configure by hand, start from [.aicommit.config.example.json](.aicommit.config.example.json). User config is loaded first, then allow-listed generation preferences from `./.aicommit.config.json` are deep-merged over it. Project config may set `language`, `commitPolicy`, `stripFiles`, `temperature`, and lower diff/token/timeout or repository-context ceilings. A project-owned `prompt` is ignored unless the user config explicitly sets `allowProjectPrompt: true`. Connection/provider fields (including `apiKeyEnv`), reasoning request controls, unknown keys, and attempts to raise a ceiling are ignored with a warning. This prevents a cloned repository from redirecting an authenticated request or silently increasing its cost/data scope.
 
@@ -39,56 +52,59 @@ To keep a key out of the JSON file, set `"apiKeyEnv": "OPENAI_API_KEY"` (and lea
 
 AICommit can also read from the Git credential helper already configured on your OS. Enable `credentialHelper.enabled`, store the provider credential through your normal Git/OS credential workflow, and AICommit will call `git credential fill` without prompting. The lookup username defaults to `aicommit` and can be changed with `credentialHelper.username`. Credential resolution order is environment variable → Git credential helper → plaintext user config → keyless localhost. A project config cannot enable a helper or select a credential source.
 
-Multiple providers can be defined and switched at runtime with `-p` / `--provider`:
+Each provider owns one or more named model profiles. Switch providers with `-p` / `--provider` and models within that provider with `-m` / `--model`:
 
 ```json
 {
+  "schemaVersion": 1,
   "defaultProvider": "minimax",
-
   "providers": {
     "minimax": {
       "providerType": "minimax",
       "apiUrl": "https://api.minimaxi.com/v1/chat/completions",
       "apiKeyEnv": "MINIMAX_API_KEY",
-      "modelId": "MiniMax-M3",
-      "extraBody": {
-        "thinking": { "type": "disabled" },
-        "reasoning_split": true
+      "defaultModel": "default",
+      "models": {
+        "default": {
+          "label": "MiniMax M3",
+          "modelId": "MiniMax-M3",
+          "extraBody": {
+            "thinking": { "type": "disabled" },
+            "reasoning_split": true
+          }
+        }
       }
     },
     "deepseek": {
       "providerType": "deepseek",
       "apiUrl": "https://api.deepseek.com/v1/chat/completions",
       "apiKeyEnv": "DEEPSEEK_API_KEY",
-      "modelId": "deepseek-v4-flash"
-    },
-    "openrouter": {
-      "providerType": "openrouter",
-      "apiUrl": "https://openrouter.ai/api/v1/chat/completions",
-      "apiKeyEnv": "OPENROUTER_API_KEY",
-      "modelId": "openai/gpt-4o-mini"
-    },
-    "kimi-code": {
-      "providerType": "custom",
-      "apiUrl": "https://api.kimi.com/coding/v1/chat/completions",
-      "apiKeyEnv": "KIMI_API_KEY",
-      "modelId": "kimi-for-coding"
+      "defaultModel": "chat",
+      "models": {
+        "chat": { "modelId": "deepseek-v4-flash" },
+        "reasoner": { "modelId": "deepseek-v4-pro" }
+      }
     }
   }
 }
 ```
 
-The selected provider's values are deep-merged over the top-level keys, so shared settings (`language`, `commitPolicy`, `temperature`, `maxTokens`, ...) only need to be set once. Without `-p`, the `defaultProvider` is used (or the first entry in `providers` if `defaultProvider` is omitted). A flat single-model config (top-level `apiUrl`/`apiKey`/`modelId`, no `providers`) still works as before.
+`schemaVersion`, `defaultProvider`, `providers`, and every provider's `providerType`, `apiUrl`, `defaultModel`, and non-empty `models` map are required. Without `-p`, AICommit selects `defaultProvider`; without `-m`, it selects that provider's `defaultModel`. Model profiles inherit global generation settings and provider connection settings, then may override `temperature`, `maxTokens`, `timeoutMs`, `reasoning`, and `extraBody`. Provider and model names are stable local aliases; `modelId` is the identifier sent to the API.
+
+This is the only supported user-config shape. Earlier flat or provider-level `modelId` configurations are rejected; run `aicommit setup` or migrate them explicitly.
 
 | Key                  | Description                                                                                                                                                                                                                  |
 | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `providers`          | Named provider configs (`apiUrl`/`apiKey`/`modelId`/...)                                                                                                                                                                     |
-| `defaultProvider`    | Provider used when `-p` is not given (renamed from `default`)                                                                                                                                                                |
+| `schemaVersion`      | Required user-config schema version; currently `1`                                                                                                                                                                           |
+| `providers`          | Named provider configs; each contains connection settings, `defaultModel`, and a non-empty `models` map                                                                                                                      |
+| `defaultProvider`    | Required provider alias used when `-p` is not given                                                                                                                                                                          |
 | `apiUrl`             | OpenAI-compatible chat completions endpoint                                                                                                                                                                                  |
 | `apiKey`             | API key (empty string allowed for local models)                                                                                                                                                                              |
 | `apiKeyEnv`          | Environment variable containing the API key; takes precedence over `apiKey` (default: empty)                                                                                                                                 |
-| `modelId`            | Model identifier                                                                                                                                                                                                             |
-| `providerType`       | Optional adapter override: `openai`, `openrouter`, `deepseek`, `minimax`, `ollama`, `custom`, or a user-installed `extension:<id>`; otherwise inferred from the endpoint                                                     |
+| `providerType`       | Required adapter: `openai`, `openrouter`, `deepseek`, `minimax`, `ollama`, `custom`, or a user-installed `extension:<id>`                                                                                                    |
+| `defaultModel`       | Required model alias used when `-m` is not given                                                                                                                                                                             |
+| `models`             | Named model profiles under one provider                                                                                                                                                                                      |
+| `modelId`            | Required API model identifier inside each model profile                                                                                                                                                                      |
 | `commitPolicy`       | Versioned commit rules for types, scope, subject length, body, breaking changes, and language                                                                                                                                |
 | `prompt`             | Optional user-approved guidance appended to the authoritative structured policy (default: empty)                                                                                                                             |
 | `allowProjectPrompt` | User-owned opt-in for accepting `prompt` from project config (default: `false`)                                                                                                                                              |
@@ -108,8 +124,8 @@ The selected provider's values are deep-merged over the top-level keys, so share
 | `diffContextLines`   | Context lines around each diff hunk (`git diff --unified=<n>`); lower values mean fewer tokens (default: `1`)                                                                                                                |
 | `stripFiles`         | Extra files to stub out of the diff like lock files, matched by basename with `*`/`?` wildcards, e.g. `["*.min.js", "*.map", "*.snap"]` (default: `[]`; project-level entries are merged with user-level ones, not replaced) |
 | `regenerateWithDiff` | `true` re-sends the full diff on every regenerate for more varied rewrites; `false` (default) only asks the model to reword its previous message, which is far cheaper                                                       |
-| `extraBody`          | Extra provider-specific JSON fields merged into the request body, except `model`/`messages` (default: `{}`); standard requests send no vendor extensions unless explicitly configured                                        |
-| `reasoning`          | Reasoning controls: `mode`, `effort`, `maxTokens`, and `maxDisplayChars`; defaults to `mode: "on"` and streams reasoning automatically                                                                                       |
+| `extraBody`          | Model-profile JSON fields merged into the request body, except `model`/`messages` (default: `{}`)                                                                                                                            |
+| `reasoning`          | Global or model-profile reasoning controls: `mode`, `effort`, `maxTokens`, and `maxDisplayChars`; defaults to `mode: "on"` and streams reasoning automatically                                                               |
 
 Works with OpenAI, DeepSeek, [OpenRouter](https://openrouter.ai), MiniMax, [Kimi Code](https://www.kimi.com/code/docs/), Ollama (native `/api/chat` or OpenAI-compatible `/v1/chat/completions`), LiteLLM, and other compatible endpoints. HTTPS is required for remote endpoints; plaintext HTTP is accepted only for localhost/loopback.
 
@@ -123,13 +139,17 @@ export KIMI_API_KEY='your-kimi-code-api-key'
 
 ```json
 {
+  "schemaVersion": 1,
   "defaultProvider": "kimi-code",
   "providers": {
     "kimi-code": {
       "providerType": "custom",
       "apiUrl": "https://api.kimi.com/coding/v1/chat/completions",
       "apiKeyEnv": "KIMI_API_KEY",
-      "modelId": "kimi-for-coding"
+      "defaultModel": "default",
+      "models": {
+        "default": { "modelId": "kimi-for-coding" }
+      }
     }
   }
 }
@@ -259,15 +279,15 @@ aicommit stats           # show local quality, latency, and token trends
 aicommit stats clear     # permanently clear local metric history
 aicommit                 # generate & commit in current directory
 aicommit /path/to/repo   # or a target directory
-aicommit split run       # choose staged/all scope, then split logical commits
-aicommit split run --scope=staged # split only the reviewed index snapshot
-aicommit split run --scope=all # split the complete working-tree snapshot
-aicommit split run --scope=staged --split-hunks # experimental same-file hunk splitting
+aicommit split           # choose staged/all scope, then split logical commits
+aicommit split --scope=staged # split only the reviewed index snapshot
+aicommit split --scope=all # split the complete working-tree snapshot
+aicommit split --scope=staged --split-hunks # experimental same-file hunk splitting
 aicommit --dry-run       # generate and review without creating a commit
-aicommit split run --dry-run # review a split plan without creating commits
+aicommit split --dry-run # review a split plan without creating commits
 aicommit --yes           # non-interactively commit already staged changes
 aicommit --yes --dry-run # non-interactively preview all changes; restores staging
-aicommit split run --scope=all --yes # non-interactively plan and commit all working-tree changes
+aicommit split --scope=all --yes # non-interactively plan and commit all working-tree changes
 aicommit split plan --scope=staged --file=/tmp/split-plan.json --yes
 aicommit split apply --file=/tmp/split-plan.json --yes
 aicommit split resume --yes # resume an interrupted split transaction
@@ -276,6 +296,7 @@ aicommit --reasoning=low # stream low-effort reasoning; Ctrl+O expands/collapses
 aicommit --no-reasoning # explicitly disable reasoning when supported
 aicommit -l zh           # commit message language
 aicommit -p deepseek     # switch to the "deepseek" provider
+aicommit -p deepseek -m reasoner # use its "reasoner" model profile
 aicommit --yes --output=json # emit one schema-validated JSON result on stdout
 aicommit -h              # help
 ```
@@ -284,8 +305,9 @@ aicommit -h              # help
 | ------------------ | ---------------------------------------------------------------------------- |
 | `-l`, `--lang`     | Commit message language (`zh` or `en`)                                       |
 | `-p`, `--provider` | Use the named provider from `providers`                                      |
+| `-m`, `--model`    | Use a named model profile from the selected provider                         |
 | `--split-hunks`    | Opt in to experimental same-file text-hunk planning; disabled by default     |
-| `--scope`          | `staged` or `all` scope for `aicommit split run` and `aicommit split plan`   |
+| `--scope`          | `staged` or `all` scope for `aicommit split` and `aicommit split plan`       |
 | `--file`           | JSON plan path for `aicommit split plan` and `aicommit split apply`          |
 | `--dry-run`        | Generate and review a message or split plan without creating commits         |
 | `-y`, `--yes`      | Accept without prompts; normal mode requires explicitly staged changes       |
@@ -297,7 +319,7 @@ aicommit -h              # help
 
 ### Configuration inspection
 
-`aicommit config show|validate|path` can run outside a repository and accepts an optional target directory. `show` applies the same user/project/team-policy trust filtering and provider selection as commit generation, but recursively masks secrets. `validate` parses, merges, and validates configuration without reading environment credentials or invoking Git credential helpers, making `aicommit config validate --output=json` safe for CI. `path` reports user config, project config, and team-policy locations even when a config file is malformed. `show` and `validate` accept `--provider=<name>`.
+`aicommit config show|validate|path` can run outside a repository and accepts an optional target directory. `show` applies the same user/project/team-policy trust filtering and provider/model selection as commit generation, but recursively masks secrets. `validate` parses, merges, and validates configuration without reading environment credentials or invoking Git credential helpers, making `aicommit config validate --output=json` safe for CI. `path` reports user config, project config, and team-policy locations even when a config file is malformed. `show` and `validate` accept `--provider=<name>` and `--model=<name>`.
 
 ### Shell completion
 
@@ -358,11 +380,11 @@ Stable process exits are shared by text and JSON modes:
 
 ### Diagnostics
 
-`aicommit doctor` checks the running Node.js and Git versions, loaded config sources, endpoint security, selected adapter capabilities, redacted credential source, and a live provider connection. It prints source labels such as `env:OPENAI_API_KEY`, `git credential helper`, or `keyless localhost`, never the credential value. Endpoint userinfo, credential-like query parameters, and fragments are also redacted from normal output and credential-resolution errors. Use `aicommit doctor -p <name>` to select a configured provider or `aicommit doctor --output=json` in automation.
+`aicommit doctor` checks the running Node.js and Git versions, loaded config sources, endpoint security, selected adapter capabilities, redacted credential source, and a live provider connection. It prints source labels such as `env:OPENAI_API_KEY`, `git credential helper`, or `keyless localhost`, never the credential value. Endpoint userinfo, credential-like query parameters, and fragments are also redacted from normal output and credential-resolution errors. Use `aicommit doctor -p <provider> -m <model>` to select a configured provider/model pair or `aicommit doctor --output=json` in automation.
 
-For stable error categories, Homebrew/npm verification failures, split recovery, preset compatibility, and extension isolation failures, use the bilingual [troubleshooting matrix](docs/troubleshooting.md).
+For stable error categories, npm verification failures, split recovery, preset compatibility, and extension isolation failures, use the bilingual [troubleshooting matrix](docs/troubleshooting.md).
 
-Flow: reads the staged diff, sends it to the AI, then lets you **accept** (Enter), **edit** (`e`), or **cancel** (`n`). If nothing is staged but the working tree has unstaged or untracked changes, aicommit offers to stage them for you — all at once (`git add -A`) or file by file — before continuing. Once anything is staged, that index snapshot is authoritative; other working-tree changes are left untouched.
+Flow: reads the staged diff, sends it to the AI, then lets you **accept** (Enter), **edit** (`e`), or **cancel** (`n`). In interactive selection prompts, `q` exits immediately. If nothing is staged but the working tree has unstaged or untracked changes, aicommit offers to stage them for you — all at once (`git add -A`) or file by file — before continuing. Once anything is staged, that index snapshot is authoritative; other working-tree changes are left untouched.
 
 `--dry-run` follows the same review flow but stops before `git commit`. Any staging performed by aicommit is restored before it exits. Cancellation and failures use the same index transaction; if another process changed the index concurrently, aicommit leaves it untouched instead of overwriting that work.
 
@@ -389,7 +411,7 @@ When reasoning mode is `on` (including via `--reasoning=<level>`), aicommit requ
 
 ### Split mode
 
-`aicommit split run` asks whether to group the staged index snapshot or all staged, unstaged, and untracked changes into logical commits. Use `--scope=staged` or `--scope=all` when the boundary must be explicit, including every non-interactive run. You can review the plan, regenerate messages for selected groups, or edit the plan as JSON before committing. Extension validation errors are shown with the plan and must be corrected by editing or regenerating before commit. Sensitive-content detection fails closed before a non-interactive provider request or automatic staging.
+`aicommit split` (also available as the explicit `aicommit split run`) asks whether to group the staged index snapshot or all staged, unstaged, and untracked changes into logical commits. Use `--scope=staged` or `--scope=all` when the boundary must be explicit, including every non-interactive run. You can review the plan, regenerate messages for selected groups, or edit the plan as JSON before committing. Extension validation errors are shown with the plan and must be corrected by editing or regenerating before commit. Sensitive-content detection fails closed before a non-interactive provider request or automatic staging.
 
 For an auditable two-step flow, `aicommit split plan --scope=staged|all --file=<path>` exports a versioned JSON artifact, and `aicommit split apply --file=<path>` rechecks its base commit, change set, and content fingerprint before touching the index. Keep plan files outside the worktree or under `.git` so they cannot become part of their own plan.
 
@@ -399,7 +421,7 @@ Split remains file-level by default. `--split-hunks` opts in to experimental sam
 
 ## Development and releases
 
-See [CONTRIBUTING.md](CONTRIBUTING.md) for local development and pull-request checks, [SECURITY.md](SECURITY.md) for private vulnerability reporting, [RELEASING.md](RELEASING.md) for the executable maintainer process, and the bilingual [distribution guide](docs/distribution.md) for npm/Homebrew install, verification, and user rollback. Releases require a GitHub-verified signed tag, Sigstore/GitHub attestations for the exact npm tarball and SPDX SBOM, npm Trusted Publishing provenance, SHA-256-pinned Homebrew formula, and post-publish smoke tests. `npm run eval` runs the anonymous local quality corpus covering single and mixed changes, renames, generated files, long diffs, Chinese/English output, and malformed weak-model candidates; it is also part of `npm run ci`.
+See [CONTRIBUTING.md](CONTRIBUTING.md) for local development and pull-request checks, [SECURITY.md](SECURITY.md) for private vulnerability reporting, [RELEASING.md](RELEASING.md) for the maintainer process, and the bilingual [distribution guide](docs/distribution.md) for npm installation and rollback. Releases use npm Trusted Publishing with provenance and publish the exact verified package tarball. `npm run eval` runs the anonymous local quality corpus covering single and mixed changes, renames, generated files, long diffs, Chinese/English output, and malformed weak-model candidates; it is also part of `npm run ci`.
 
 ## License