@hifullmoon/aicommit 2.2.0 → 2.2.2

package/.aicommit.config.example.json

@@ -10,12 +10,7 @@
       "models": {
         "default": {
           "modelId": "MiniMax-M3",
-          "extraBody": {
-            "thinking": {
-              "type": "disabled"
-            },
-            "reasoning_split": true
-          }
+          "reasoning": { "mode": "on", "effort": "medium" }
         }
       }
     },
@@ -25,7 +20,10 @@
       "apiKeyEnv": "DEEPSEEK_API_KEY",
       "defaultModel": "chat",
       "models": {
-        "chat": { "modelId": "deepseek-v4-flash" }
+        "chat": {
+          "modelId": "deepseek-v4-flash",
+          "reasoning": { "mode": "on", "effort": "high" }
+        }
       }
     },
     "openrouter": {

package/CHANGELOG.md

@@ -4,6 +4,23 @@ This file lists notable user-facing changes. Internal refactors, test-only chang
 
 ## [Unreleased]
 
+## [2.2.2] - 2026-08-31
+
+### Added
+
+- Added per-model reasoning mode and effort selection to interactive setup, with a balanced `medium` default and model-aware OpenAI option filtering.
+
+## [2.2.1] - 2026-08-29
+
+### Fixed
+
+- Combined repository commit policies with commitlint constraints without allowing either source to relax the other, including correct `never` and complete-header length handling.
+- Hardened split transactions against changes during snapshot capture, restricted plan exports to safe locations, and prevented existing output files from being overwritten.
+
+### Security
+
+- Redacted credential assignments with quoted JSON or YAML keys before diffs and untracked previews are sent to a model.
+
 ## [2.2.0] - 2026-08-28
 
 ### Added
@@ -153,7 +170,9 @@ This file lists notable user-facing changes. Internal refactors, test-only chang
 - Added file-level split planning and execution with Git-state concurrency checks.
 - Added provider presets and user/project configuration boundaries.
 
-[Unreleased]: https://github.com/hi-fullmoon/AICommit/compare/v2.2.0...HEAD
+[Unreleased]: https://github.com/hi-fullmoon/AICommit/compare/v2.2.2...HEAD
+[2.2.2]: https://github.com/hi-fullmoon/AICommit/releases/tag/v2.2.2
+[2.2.1]: https://github.com/hi-fullmoon/AICommit/releases/tag/v2.2.1
 [2.2.0]: https://github.com/hi-fullmoon/AICommit/releases/tag/v2.2.0
 [2.1.0]: https://github.com/hi-fullmoon/AICommit/releases/tag/v2.1.0
 [2.0.1]: https://github.com/hi-fullmoon/AICommit/releases/tag/v2.0.1

package/README.md

@@ -46,6 +46,8 @@ aicommit setup
 
 It walks you through choosing built-in provider defaults (OpenAI, DeepSeek, OpenRouter, MiniMax, Kimi Code, and Ollama) or entering a custom OpenAI-compatible endpoint, then entering your API key and one or more models, choosing a default model and commit language, and optionally testing the connection. Configuration is written atomically to the user config (`~/.aicommit/config.json`); a malformed or old-format existing file is backed up before replacement. The legacy `~/.aicommit.config.json` path remains readable and `aicommit setup` migrates its settings to the canonical path when saving.
 
+The model step configures reasoning independently for each profile. `auto` sends no explicit reasoning switch and leaves the behavior to the provider, `on` requests reasoning and then prompts for its effort, and `off` explicitly disables reasoning when the model supports that switch. Effort defaults to `medium`. For known OpenAI models, setup removes unsupported mode and effort choices, including `off` when reasoning cannot be disabled. When editing an existing model, the wizard preselects valid saved values, falling back to the global reasoning settings when applicable; an unsupported saved mode falls back to `auto`.
+
 To configure by hand, start from [.aicommit.config.example.json](.aicommit.config.example.json). User config is loaded first, then allow-listed generation preferences from the project config at `./.aicommit.config.json` are deep-merged over it. Project config may set `language`, `commitPolicy`, `stripFiles`, `temperature`, and lower diff/token/timeout or repository-context ceilings. A project-owned `prompt` is ignored unless the user config explicitly sets `allowProjectPrompt: true`. Connection/provider fields (including `apiKeyEnv`), reasoning request controls, unknown keys, and attempts to raise a ceiling are ignored with a warning. This prevents a cloned repository from redirecting an authenticated request or silently increasing its cost/data scope.
 
 To keep a key out of the JSON file, set `"apiKeyEnv": "OPENAI_API_KEY"` (and leave `apiKey` empty), or enter `env:OPENAI_API_KEY` in the setup wizard. Environment variables take priority over every other credential source and are recommended for CI and other stateless environments.
@@ -68,10 +70,7 @@ Each provider owns one or more named model profiles. Switch providers with `-p`
         "default": {
           "label": "MiniMax M3",
           "modelId": "MiniMax-M3",
-          "extraBody": {
-            "thinking": { "type": "disabled" },
-            "reasoning_split": true
-          }
+          "reasoning": { "mode": "on", "effort": "medium" }
         }
       }
     },
@@ -81,14 +80,85 @@ Each provider owns one or more named model profiles. Switch providers with `-p`
       "apiKeyEnv": "DEEPSEEK_API_KEY",
       "defaultModel": "chat",
       "models": {
-        "chat": { "modelId": "deepseek-v4-flash" },
-        "reasoner": { "modelId": "deepseek-v4-pro" }
+        "chat": {
+          "modelId": "deepseek-v4-flash",
+          "reasoning": { "mode": "on", "effort": "medium" }
+        },
+        "reasoner": {
+          "modelId": "deepseek-v4-pro",
+          "reasoning": { "mode": "on", "effort": "high" }
+        }
+      }
+    },
+    "openai": {
+      "providerType": "openai",
+      "apiUrl": "https://api.openai.com/v1/chat/completions",
+      "apiKeyEnv": "OPENAI_API_KEY",
+      "defaultModel": "fast",
+      "models": {
+        "fast": {
+          "modelId": "gpt-4o",
+          "reasoning": { "mode": "auto" }
+        },
+        "reasoner": {
+          "modelId": "gpt-5.6-sol",
+          "reasoning": { "mode": "on", "effort": "medium" }
+        }
+      }
+    },
+    "openrouter": {
+      "providerType": "openrouter",
+      "apiUrl": "https://openrouter.ai/api/v1/chat/completions",
+      "apiKeyEnv": "OPENROUTER_API_KEY",
+      "defaultModel": "auto",
+      "models": {
+        "auto": {
+          "modelId": "openrouter/auto",
+          "reasoning": { "mode": "auto" }
+        },
+        "quality": {
+          "modelId": "openai/gpt-5.6-terra",
+          "reasoning": { "mode": "on", "effort": "high" }
+        }
+      }
+    },
+    "ollama": {
+      "providerType": "ollama",
+      "apiUrl": "http://127.0.0.1:11434/api/chat",
+      "defaultModel": "qwen",
+      "models": {
+        "qwen": {
+          "modelId": "qwen3:8b",
+          "reasoning": { "mode": "on", "effort": "medium" }
+        },
+        "deepseek": {
+          "modelId": "deepseek-r1:8b",
+          "reasoning": { "mode": "on", "effort": "medium" }
+        }
       }
     }
   }
 }
 ```
 
+After exporting the API-key variables used by the providers you configured, validate each profile before its first real commit:
+
+```bash
+export MINIMAX_API_KEY='your-minimax-api-key'
+export DEEPSEEK_API_KEY='your-deepseek-api-key'
+export OPENAI_API_KEY='your-openai-api-key'
+export OPENROUTER_API_KEY='your-openrouter-api-key'
+
+aicommit doctor -p minimax -m default
+aicommit doctor -p deepseek -m reasoner
+aicommit doctor -p openai -m reasoner
+aicommit doctor -p openrouter -m quality
+aicommit doctor -p ollama -m qwen
+
+aicommit -p minimax
+aicommit -p deepseek -m reasoner
+```
+
 `schemaVersion`, `defaultProvider`, `providers`, and every provider's `providerType`, `apiUrl`, `defaultModel`, and non-empty `models` map are required. Without `-p`, AICommit selects `defaultProvider`; without `-m`, it selects that provider's `defaultModel`. Model profiles inherit global generation settings and provider connection settings, then may override `temperature`, `maxTokens`, `timeoutMs`, `reasoning`, and `extraBody`. Provider and model names are stable local aliases; `modelId` is the identifier sent to the API.
 
 This is the only supported user-config shape. Earlier flat or provider-level `modelId` configurations are rejected; run `aicommit setup` or migrate them explicitly.
@@ -123,44 +193,10 @@ This is the only supported user-config shape. Earlier flat or provider-level `mo
 | `stripFiles`         | Extra files to stub out of the diff like lock files, matched by basename with `*`/`?` wildcards, e.g. `["*.min.js", "*.map", "*.snap"]` (default: `[]`; project-level entries are merged with user-level ones, not replaced) |
 | `regenerateWithDiff` | `true` re-sends the full diff on every regenerate for more varied rewrites; `false` (default) only asks the model to reword its previous message, which is far cheaper                                                       |
 | `extraBody`          | Model-profile JSON fields merged into the request body, except `model`/`messages` (default: `{}`)                                                                                                                            |
-| `reasoning`          | Global or model-profile reasoning controls: `mode`, `effort`, `maxTokens`, and `maxDisplayChars`; defaults to `mode: "on"` and streams reasoning automatically                                                               |
+| `reasoning`          | Global or model-profile reasoning controls: `mode` / `effort` (default: `on` / `medium`), `maxTokens`, and `maxDisplayChars`                                                                                                 |
 
 Works with OpenAI, DeepSeek, [OpenRouter](https://openrouter.ai), MiniMax, [Kimi Code](https://www.kimi.com/code/docs/), Ollama (native `/api/chat` or OpenAI-compatible `/v1/chat/completions`), LiteLLM, and other compatible endpoints. HTTPS is required for remote endpoints; plaintext HTTP is accepted only for localhost/loopback.
 
-### Kimi Code example
-
-Create an API key in the Kimi Code console, export it without storing the secret in JSON, and select the bundled preset in `aicommit setup`. For a manual configuration, use the OpenAI-compatible full endpoint:
-
-```bash
-export KIMI_API_KEY='your-kimi-code-api-key'
-```
-
-```json
-{
-  "schemaVersion": 1,
-  "defaultProvider": "kimi-code",
-  "providers": {
-    "kimi-code": {
-      "providerType": "custom",
-      "apiUrl": "https://api.kimi.com/coding/v1/chat/completions",
-      "apiKeyEnv": "KIMI_API_KEY",
-      "defaultModel": "default",
-      "models": {
-        "default": { "modelId": "kimi-for-coding" }
-      }
-    }
-  }
-}
-```
-
-Verify the endpoint, key, and model before the first commit:
-
-```bash
-aicommit doctor -p kimi-code
-```
-
-`kimi-for-coding` is available to all Kimi Code membership tiers and follows the service's rolling model upgrades. Kimi Code membership keys use `api.kimi.com`; Kimi Platform pay-as-you-go keys use a different endpoint and are not interchangeable.
-
 See the bilingual [provider compatibility table](docs/provider-compatibility.md) for streaming, reasoning, token-budget, usage, and authentication boundaries.
 
 ### Repository policy and bounded context
@@ -415,7 +451,7 @@ When reasoning mode is `on` (including via `--reasoning=<level>`), aicommit requ
 
 `aicommit split` (also available as the explicit `aicommit split run`) asks whether to group the staged index snapshot or all staged, unstaged, and untracked changes into file-level logical commits. Use `--scope=staged` or `--scope=all` when the boundary must be explicit, including every non-interactive run. You can review the plan, regenerate messages for selected groups, or edit the plan as JSON before committing. Sensitive-content detection fails closed before a non-interactive provider request or automatic staging.
 
-For an auditable two-step flow, `aicommit split plan --scope=staged|all --file=<path>` exports a versioned JSON artifact, and `aicommit split apply --file=<path>` rechecks its base commit, change set, and content fingerprint before touching the index. Keep plan files outside the worktree or under `.git` so they cannot become part of their own plan.
+For an auditable two-step flow, `aicommit split plan --scope=staged|all --file=<path>` exports a versioned JSON artifact, and `aicommit split apply --file=<path>` rechecks its base commit, change set, and content fingerprint before touching the index. Keep plan files outside the worktree or under the dedicated `.git/aicommit/` directory so they cannot become part of their own plan. Export never overwrites an existing destination.
 
 Execution uses temporary indexes and a code-free checkpoint under `.git/aicommit`. A hook, Git error, interruption, or crash leaves completed commits in history and preserves the pending snapshot; the failure report shows checkpointed, in-flight, pending, and current worktree/index state. Resolve the cause and run `aicommit split resume`. Resume reconciles the possible post-commit crash window before creating anything else, so a completed group is neither duplicated nor omitted. If you intentionally finished or replaced the interrupted work through another Git workflow, run `aicommit split abort`; it removes only the stale checkpoint and never rewrites HEAD, the index, or the worktree. New committing split runs detect a checkpoint before contacting the provider. If planning or preflight fails before the first group, no split commit is created and the real index remains unchanged.
 

package/README.zh-CN.md

@@ -48,6 +48,8 @@ aicommit setup
 
 向导会引导你选择内置 Provider 默认值（OpenAI、DeepSeek、OpenRouter、MiniMax、Kimi Code 和 Ollama），或填写自定义 OpenAI 兼容端点；随后输入 API Key 和一个或多个模型、选择默认模型和提交信息语言，并可选测试连接。配置会原子写入用户配置文件 `~/.aicommit/config.json`；如果已有文件格式错误或属于旧格式，替换前会先备份。旧路径 `~/.aicommit.config.json` 仍可读取，运行 `aicommit setup` 并保存时会把其中设置迁移到规范路径。
 
+模型步骤会为每个配置单独设置推理。`auto` 不发送显式推理开关，交给 Provider 使用默认行为；`on` 请求推理并继续选择强度；`off` 在模型支持该开关时显式关闭推理。强度默认为 `medium`。对于已知的 OpenAI 模型，setup 会过滤不支持的模式和强度选项；无法关闭推理时也不会列出 `off`。编辑已有模型时，向导会回填其中仍有效的保存值；模型级未配置时，则在适用情况下回填全局推理设置，不再受支持的旧模式会回退到 `auto`。
+
 如需手动配置，请从 [.aicommit.config.example.json](.aicommit.config.example.json) 开始。AICommit 先加载用户配置，再将项目配置 `./.aicommit.config.json` 中白名单内的生成偏好深度合并到用户配置之上。项目配置可以设置 `language`、`commitPolicy`、`stripFiles`、`temperature`，也可以降低 diff、token、timeout 或仓库上下文上限。项目拥有的 `prompt` 默认会被忽略，除非用户配置明确设置 `allowProjectPrompt: true`。连接或 Provider 字段（包括 `apiKeyEnv`）、推理请求控制、未知字段，以及任何试图提高上限的配置，都会被忽略并给出警告。这样可以防止克隆的仓库重定向已鉴权请求，或在不知情的情况下扩大成本和数据范围。
 
 如需避免把密钥写入 JSON，请设置 `"apiKeyEnv": "OPENAI_API_KEY"`（并将 `apiKey` 留空），或在 setup 向导中输入 `env:OPENAI_API_KEY`。环境变量优先于所有其他凭据来源，推荐用于 CI 和其他无状态环境。
@@ -70,10 +72,7 @@ AICommit 也可以读取操作系统上已经配置的 Git credential helper。
         "default": {
           "label": "MiniMax M3",
           "modelId": "MiniMax-M3",
-          "extraBody": {
-            "thinking": { "type": "disabled" },
-            "reasoning_split": true
-          }
+          "reasoning": { "mode": "on", "effort": "medium" }
         }
       }
     },
@@ -83,14 +82,85 @@ AICommit 也可以读取操作系统上已经配置的 Git credential helper。
       "apiKeyEnv": "DEEPSEEK_API_KEY",
       "defaultModel": "chat",
       "models": {
-        "chat": { "modelId": "deepseek-v4-flash" },
-        "reasoner": { "modelId": "deepseek-v4-pro" }
+        "chat": {
+          "modelId": "deepseek-v4-flash",
+          "reasoning": { "mode": "on", "effort": "medium" }
+        },
+        "reasoner": {
+          "modelId": "deepseek-v4-pro",
+          "reasoning": { "mode": "on", "effort": "high" }
+        }
+      }
+    },
+    "openai": {
+      "providerType": "openai",
+      "apiUrl": "https://api.openai.com/v1/chat/completions",
+      "apiKeyEnv": "OPENAI_API_KEY",
+      "defaultModel": "fast",
+      "models": {
+        "fast": {
+          "modelId": "gpt-4o",
+          "reasoning": { "mode": "auto" }
+        },
+        "reasoner": {
+          "modelId": "gpt-5.6-sol",
+          "reasoning": { "mode": "on", "effort": "medium" }
+        }
+      }
+    },
+    "openrouter": {
+      "providerType": "openrouter",
+      "apiUrl": "https://openrouter.ai/api/v1/chat/completions",
+      "apiKeyEnv": "OPENROUTER_API_KEY",
+      "defaultModel": "auto",
+      "models": {
+        "auto": {
+          "modelId": "openrouter/auto",
+          "reasoning": { "mode": "auto" }
+        },
+        "quality": {
+          "modelId": "openai/gpt-5.6-terra",
+          "reasoning": { "mode": "on", "effort": "high" }
+        }
+      }
+    },
+    "ollama": {
+      "providerType": "ollama",
+      "apiUrl": "http://127.0.0.1:11434/api/chat",
+      "defaultModel": "qwen",
+      "models": {
+        "qwen": {
+          "modelId": "qwen3:8b",
+          "reasoning": { "mode": "on", "effort": "medium" }
+        },
+        "deepseek": {
+          "modelId": "deepseek-r1:8b",
+          "reasoning": { "mode": "on", "effort": "medium" }
+        }
       }
     }
   }
 }
 ```
 
+导出所配置 Provider 使用的 API Key 环境变量后，建议在第一次真实提交前逐个验证模型配置：
+
+```bash
+export MINIMAX_API_KEY='your-minimax-api-key'
+export DEEPSEEK_API_KEY='your-deepseek-api-key'
+export OPENAI_API_KEY='your-openai-api-key'
+export OPENROUTER_API_KEY='your-openrouter-api-key'
+
+aicommit doctor -p minimax -m default
+aicommit doctor -p deepseek -m reasoner
+aicommit doctor -p openai -m reasoner
+aicommit doctor -p openrouter -m quality
+aicommit doctor -p ollama -m qwen
+
+aicommit -p minimax
+aicommit -p deepseek -m reasoner
+```
+
 `schemaVersion`、`defaultProvider`、`providers`，以及每个 Provider 的 `providerType`、`apiUrl`、`defaultModel` 和非空 `models` 都是必填项。未指定 `-p` 时选择 `defaultProvider`；未指定 `-m` 时选择该 Provider 的 `defaultModel`。模型配置会继承全局生成设置和 Provider 连接设置，并可覆盖 `temperature`、`maxTokens`、`timeoutMs`、`reasoning` 与 `extraBody`。Provider 名和模型名是稳定的本地别名，`modelId` 才是发送给 API 的模型标识。
 
 这是唯一支持的用户配置格式。旧版扁平配置或 Provider 级 `modelId` 会被直接拒绝；请运行 `aicommit setup` 或显式迁移。
@@ -125,44 +195,10 @@ AICommit 也可以读取操作系统上已经配置的 Git credential helper。
 | `stripFiles`         | 额外替换为占位的文件，按 basename 使用 `*` / `?` 通配，如 `["*.min.js", "*.map", "*.snap"]`（默认：`[]`；项目项与用户项合并而非覆盖） |
 | `regenerateWithDiff` | `true` 表示每次重写都重发完整 diff，以获得更多变化；`false`（默认）只要求模型改写上一条消息，成本更低                                 |
 | `extraBody`          | 模型配置中合并到请求体的 JSON 字段，但不允许覆盖 `model` / `messages`（默认：`{}`）                                                   |
-| `reasoning`          | 全局或模型级推理控制：`mode`、`effort`、`maxTokens` 和 `maxDisplayChars`；默认为 `mode: "on"`，并自动流式展示推理                     |
+| `reasoning`          | 全局或模型级推理控制：`mode` / `effort`（默认：`on` / `medium`）、`maxTokens` 和 `maxDisplayChars`                                    |
 
 AICommit 支持 OpenAI、DeepSeek、[OpenRouter](https://openrouter.ai)、MiniMax、[Kimi Code](https://www.kimi.com/code/docs/)、Ollama（原生 `/api/chat` 或 OpenAI 兼容 `/v1/chat/completions`）、LiteLLM，以及其他兼容端点。远程端点必须使用 HTTPS；明文 HTTP 只允许 localhost / loopback。
 
-### Kimi Code 示例
-
-在 Kimi Code 控制台创建 API Key，通过环境变量导出，避免把密钥存入 JSON，然后在 `aicommit setup` 中选择内置预设。手动配置时请使用完整的 OpenAI 兼容端点：
-
-```bash
-export KIMI_API_KEY='your-kimi-code-api-key'
-```
-
-```json
-{
-  "schemaVersion": 1,
-  "defaultProvider": "kimi-code",
-  "providers": {
-    "kimi-code": {
-      "providerType": "custom",
-      "apiUrl": "https://api.kimi.com/coding/v1/chat/completions",
-      "apiKeyEnv": "KIMI_API_KEY",
-      "defaultModel": "default",
-      "models": {
-        "default": { "modelId": "kimi-for-coding" }
-      }
-    }
-  }
-}
-```
-
-首次提交前验证端点、Key 和模型：
-
-```bash
-aicommit doctor -p kimi-code
-```
-
-`kimi-for-coding` 对所有 Kimi Code 会员档位开放，并随服务滚动升级模型。Kimi Code 会员 Key 使用 `api.kimi.com`；Kimi 开放平台按量付费 Key 使用不同端点，两者不能混用。
-
 流式输出、推理、token 预算、usage 和鉴权边界，请参阅双语 [Provider 兼容表](docs/provider-compatibility.md)。
 
 ### 仓库策略与受限上下文
@@ -417,7 +453,7 @@ exec zsh
 
 `aicommit split`（也可以显式写成 `aicommit split run`）会询问是对暂存 index 快照分组，还是对全部已暂存、未暂存和未跟踪变更做文件级分组。边界必须明确时请使用 `--scope=staged` 或 `--scope=all`，所有非交互运行都应显式指定范围。提交前可以审阅计划、为选中的组重新生成消息，或直接编辑 JSON 计划。敏感内容检测会在非交互 Provider 请求或自动暂存前 fail closed。
 
-如需可审计的两步流程，使用 `aicommit split plan --scope=staged|all --file=<path>` 导出版本化 JSON 工件，再用 `aicommit split apply --file=<path>` 在接触 index 前重新校验 base commit、变更集和内容指纹。计划文件应保存在工作区之外或 `.git` 下，避免被纳入自身计划。
+如需可审计的两步流程，使用 `aicommit split plan --scope=staged|all --file=<path>` 导出版本化 JSON 工件，再用 `aicommit split apply --file=<path>` 在接触 index 前重新校验 base commit、变更集和内容指纹。计划文件应保存在工作区之外或专用的 `.git/aicommit/` 目录下，避免被纳入自身计划；导出不会覆盖已有目标文件。
 
 执行过程使用临时 index，并在 `.git/aicommit` 下保存不含代码内容的 checkpoint。hook、Git 错误、中断或崩溃发生后，已完成提交仍保留在历史中，待处理快照也会保留；失败报告会显示已 checkpoint、执行中、待处理，以及当前工作区 / index 状态。解决问题后运行 `aicommit split resume`。恢复流程会先协调“提交完成后崩溃”的可能窗口，再创建任何新提交，因此不会重复或遗漏已完成分组。如果你通过其他 Git 流程有意完成或替换了中断工作，请运行 `aicommit split abort`；它只删除过期 checkpoint，绝不会改写 HEAD、index 或工作区。新的 split 提交流程会在联系 Provider 前检测现有 checkpoint。如果规划或预检在第一组之前失败，不会创建任何 split 提交，真实 index 也保持不变。
 

package/docs/distribution.md

@@ -26,7 +26,7 @@ The release workflow uses npm Trusted Publishing without a long-lived `NPM_TOKEN
 ```bash
 workdir=$(mktemp -d)
 cd "$workdir"
-npm install --package-lock-only @hifullmoon/aicommit@2.2.0
+npm install --package-lock-only @hifullmoon/aicommit@2.2.2
 npm audit signatures
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hifullmoon/aicommit",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "description": "Safe, local-first AI commit message generator for Git workflows",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -3,6 +3,7 @@ import { createRequire } from 'node:module';
 import chalk from 'chalk';
 
 import { ERROR_CATEGORIES, fail } from './errors.js';
+import { REASONING_EFFORTS } from './providers.js';
 
 const _require = createRequire(import.meta.url);
 const { version: VERSION } = _require('../package.json');
@@ -364,7 +365,7 @@ export function parseArgs(args = process.argv.slice(2)) {
     }
   }
 
-  const reasoningLevels = ['off', 'low', 'medium', 'high', 'xhigh', 'max'];
+  const reasoningLevels = ['off', ...REASONING_EFFORTS];
   if (cliReasoning && !reasoningLevels.includes(cliReasoning)) {
     throw fail(
       ERROR_CATEGORIES.CONFIG,

package/src/completion.js

@@ -46,7 +46,9 @@ complete -F _aicommit aicommit
 
 const ZSH = `#compdef aicommit
 _aicommit() {
+  local curcontext="$curcontext" state state_descr line
   local -a commands options
+  typeset -A opt_args
   commands=(
     'setup:interactive configuration wizard'
     'doctor:diagnose configuration and connectivity'
@@ -71,15 +73,17 @@ _aicommit() {
     '--output=[output mode]:output:(text json)'
     '--debug[show debug details]'
   )
-  _arguments -C $options '*::argument:->args'
+  _arguments -C $options '1:command:->command' '*::argument:->args'
   case $state in
+    command)
+      _describe 'command' commands
+      ;;
     args)
-      case $words[2] in
+      case $line[1] in
         config) _values 'config action' show validate path ;;
         policy) _values 'policy action' template check ;;
         completion) _values 'shell' bash zsh fish ;;
         split) _values 'split action' run plan apply resume abort ;;
-        *) _describe 'command' commands ;;
       esac
       ;;
   esac

package/src/config.js

@@ -14,7 +14,12 @@ import {
   validateRepositoryContextConfig,
 } from './context.js';
 import { readTeamPolicy } from './team-policy.js';
-import { isProviderType, PROVIDER_TYPES } from './providers.js';
+import {
+  DEFAULT_REASONING_EFFORT,
+  isProviderType,
+  PROVIDER_TYPES,
+  REASONING_EFFORTS,
+} from './providers.js';
 import { projectConfigPath, resolveConfigLocations, userConfigLocations } from './config-paths.js';
 
 // Repository-owned config is untrusted input: a cloned repository must never
@@ -173,7 +178,7 @@ export const DEFAULT_CONFIG = {
   // switch.
   reasoning: {
     mode: 'on',
-    effort: 'medium',
+    effort: DEFAULT_REASONING_EFFORT,
     maxTokens: 4096,
     maxDisplayChars: 12000,
   },
@@ -508,10 +513,8 @@ export function validateConfig(config) {
   if (!['auto', 'on', 'off'].includes(config.reasoning.mode)) {
     throw new Error('Invalid config "reasoning.mode": expected "auto", "on", or "off".');
   }
-  if (!['low', 'medium', 'high', 'xhigh', 'max'].includes(config.reasoning.effort)) {
-    throw new Error(
-      'Invalid config "reasoning.effort": expected low, medium, high, xhigh, or max.',
-    );
+  if (!REASONING_EFFORTS.includes(config.reasoning.effort)) {
+    throw new Error(`Invalid config "reasoning.effort": expected ${REASONING_EFFORTS.join(', ')}.`);
   }
   for (const key of ['enabledBody', 'disabledBody']) {
     const value = config.reasoning[key];

package/src/context.js

@@ -381,20 +381,22 @@ function quotedValues(text) {
 
 function enumRule(text, name) {
   const index = text.search(new RegExp(`['"]?${name}['"]?\\s*:`));
-  if (index < 0) return [];
+  if (index < 0) return null;
   const window = text.slice(index, index + 3000);
   const nested = window.match(
-    /\[\s*[012]\s*,\s*['"](?:always|never)['"]\s*,\s*\[([\s\S]*?)\]\s*\]/i,
+    /\[\s*([012])\s*,\s*['"](always|never)['"]\s*,\s*\[([\s\S]*?)\]\s*\]/i,
   );
-  return nested ? quotedValues(nested[1]) : [];
+  if (!nested || nested[1] === '0') return null;
+  return { condition: nested[2].toLowerCase(), values: quotedValues(nested[3]) };
 }
 
 function numberRule(text, name) {
   const index = text.search(new RegExp(`['"]?${name}['"]?\\s*:`));
   if (index < 0) return null;
   const window = text.slice(index, index + 500);
-  const match = window.match(/\[\s*[012]\s*,\s*['"](?:always|never)['"]\s*,\s*(\d{1,3})\s*\]/i);
-  return match ? Number(match[1]) : null;
+  const match = window.match(/\[\s*([012])\s*,\s*['"](always|never)['"]\s*,\s*(\d{1,3})\s*\]/i);
+  if (!match || match[1] === '0') return null;
+  return { condition: match[2].toLowerCase(), value: Number(match[3]) };
 }
 
 export function detectCommitlintConstraints(
@@ -410,22 +412,53 @@ export function detectCommitlintConstraints(
     ) {
       continue;
     }
-    const types = enumRule(text, 'type-enum').filter((value) => /^[a-z][a-z0-9-]*$/.test(value));
-    const scopes = enumRule(text, 'scope-enum').filter((value) => /^[a-z0-9._/-]+$/i.test(value));
-    const subjectMaxLength = numberRule(text, 'subject-max-length');
-    const headerMaxLength = numberRule(text, 'header-max-length');
-    if (!types.length && !scopes.length && !subjectMaxLength && !headerMaxLength) continue;
+    const typeRule = enumRule(text, 'type-enum');
+    const scopeRule = enumRule(text, 'scope-enum');
+    const subjectLengthRule = numberRule(text, 'subject-max-length');
+    const headerLengthRule = numberRule(text, 'header-max-length');
+    const validTypes = (typeRule?.values || []).filter((value) => /^[a-z][a-z0-9-]*$/.test(value));
+    const validScopes = (scopeRule?.values || []).filter((value) => /^[a-z0-9._/-]+$/i.test(value));
+    const types = typeRule?.condition === 'always' ? validTypes : [];
+    const disallowedTypes = typeRule?.condition === 'never' ? validTypes : [];
+    const scopes = scopeRule?.condition === 'always' ? validScopes : [];
+    const disallowedScopes = scopeRule?.condition === 'never' ? validScopes : [];
+    const subjectMaxLength =
+      subjectLengthRule?.condition === 'always' ? subjectLengthRule.value : null;
+    const headerMaxLength =
+      headerLengthRule?.condition === 'always' ? headerLengthRule.value : null;
+    const unsupported = [];
+    if (subjectLengthRule?.condition === 'never') unsupported.push('subject-max-length: never');
+    if (headerLengthRule?.condition === 'never') unsupported.push('header-max-length: never');
+    if (
+      !types.length &&
+      !disallowedTypes.length &&
+      !scopes.length &&
+      !disallowedScopes.length &&
+      !subjectMaxLength &&
+      !headerMaxLength &&
+      !unsupported.length
+    ) {
+      continue;
+    }
     const lines = [`Detected commitlint constraints from ${path}:`];
     if (types.length) lines.push(`- allowed types: ${types.join(', ')}`);
+    if (disallowedTypes.length) lines.push(`- disallowed types: ${disallowedTypes.join(', ')}`);
     if (scopes.length) lines.push(`- allowed scopes: ${scopes.join(', ')}`);
+    if (disallowedScopes.length) {
+      lines.push(`- disallowed scopes: ${disallowedScopes.join(', ')}`);
+    }
     if (subjectMaxLength) lines.push(`- subject max length: ${subjectMaxLength}`);
     if (headerMaxLength) lines.push(`- header max length: ${headerMaxLength}`);
+    if (unsupported.length) lines.push(`- unsupported inverted rules: ${unsupported.join(', ')}`);
     return {
       path,
       types,
+      disallowedTypes,
       scopes,
+      disallowedScopes,
       subjectMaxLength,
       headerMaxLength,
+      unsupported,
       text: truncate(lines.join('\n'), settings.maxChars),
     };
   }
@@ -436,17 +469,72 @@ export function applyCommitlintPolicy(commitPolicy, constraints, fallbackLanguag
   if (!constraints) return commitPolicy;
   const current = normalizeCommitPolicy(commitPolicy, fallbackLanguage);
   const patch = {};
-  if (constraints.types?.length) patch.types = constraints.types;
+  if (constraints.unsupported?.length) {
+    throw new Error(
+      `Invalid config: unsupported inverted commitlint rules: ${constraints.unsupported.join(', ')}.`,
+    );
+  }
+
+  let types = [...current.types];
+  if (constraints.types?.length) {
+    types = types.filter((type) => constraints.types.includes(type));
+  }
+  if (constraints.disallowedTypes?.length) {
+    types = types.filter((type) => !constraints.disallowedTypes.includes(type));
+  }
+  if (!types.length) {
+    throw new Error('Invalid config: commitPolicy and commitlint allow no common commit types.');
+  }
+  if (types.length !== current.types.length) patch.types = types;
+
+  let scopeMode = current.scope.mode;
+  let scopes = [...current.scope.values];
+  const disallowedScopes = new Set(current.scope.disallowedValues || []);
+  const hasFiniteScopeAllowlist = Boolean(
+    current.scope.values.length || constraints.scopes?.length,
+  );
   if (constraints.scopes?.length) {
-    patch.scope = {
+    scopes = scopes.length
+      ? scopes.filter((scope) => constraints.scopes.includes(scope))
+      : [...constraints.scopes];
+  }
+  for (const scope of constraints.disallowedScopes || []) disallowedScopes.add(scope);
+  if (scopes.length) scopes = scopes.filter((scope) => !disallowedScopes.has(scope));
+  if (!scopes.length && hasFiniteScopeAllowlist) {
+    if (scopeMode === 'required') {
+      throw new Error('Invalid config: commitPolicy and commitlint allow no common scopes.');
+    }
+    scopeMode = 'forbidden';
+    disallowedScopes.clear();
+  }
+  if (
+    scopeMode !== current.scope.mode ||
+    JSON.stringify(scopes) !== JSON.stringify(current.scope.values) ||
+    JSON.stringify([...disallowedScopes]) !== JSON.stringify(current.scope.disallowedValues || [])
+  ) {
+    const nextScope = {
       ...current.scope,
-      values: constraints.scopes,
+      mode: scopeMode,
+      values: scopes,
+      ...(disallowedScopes.size ? { disallowedValues: [...disallowedScopes] } : {}),
     };
+    if (!disallowedScopes.size) delete nextScope.disallowedValues;
+    patch.scope = nextScope;
   }
-  if (constraints.subjectMaxLength) {
+  if (constraints.subjectMaxLength || constraints.headerMaxLength) {
     patch.subject = {
       ...current.subject,
-      maxLength: Math.min(current.subject.maxLength, constraints.subjectMaxLength),
+      maxLength: constraints.subjectMaxLength
+        ? Math.min(current.subject.maxLength, constraints.subjectMaxLength)
+        : current.subject.maxLength,
+      ...(constraints.headerMaxLength
+        ? {
+            headerMaxLength: Math.min(
+              current.subject.headerMaxLength ?? Infinity,
+              constraints.headerMaxLength,
+            ),
+          }
+        : {}),
     };
   }
   const merged = mergeCommitPolicy(current, patch);

package/src/git.js

@@ -336,7 +336,7 @@ const SENSITIVE_FILE_RE =
 const PRIVATE_KEY_RE = /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----/i;
 const AWS_KEY_RE = /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g;
 const ASSIGNED_SECRET_RE =
-  /(\b(?:api[_-]?key|access[_-]?token|auth(?:orization)?|client[_-]?secret|password|passwd|secret|token)\b\s*[:=]\s*["']?)([^\s,"'}]{8,})/gi;
+  /(\b(?:api[_-]?key|access[_-]?token|auth(?:orization)?|client[_-]?secret|password|passwd|secret|token)\b["']?\s*[:=]\s*["']?)([^\s,"'}]{8,})/gi;
 
 export function isSensitiveFile(path) {
   const normalized = String(path || '').replace(/\\/g, '/');

package/src/policy-command.js

@@ -21,8 +21,19 @@ function normalizedPolicyDocument(policy) {
   return {
     version: policy.version,
     types: [...policy.types],
-    scope: { mode: policy.scope.mode, values: [...policy.scope.values] },
-    subject: { maxLength: policy.subject.maxLength },
+    scope: {
+      mode: policy.scope.mode,
+      values: [...policy.scope.values],
+      ...(policy.scope.disallowedValues?.length
+        ? { disallowedValues: [...policy.scope.disallowedValues] }
+        : {}),
+    },
+    subject: {
+      maxLength: policy.subject.maxLength,
+      ...(policy.subject.headerMaxLength
+        ? { headerMaxLength: policy.subject.headerMaxLength }
+        : {}),
+    },
     body: { mode: policy.body.mode, maxLines: policy.body.maxLines },
     breakingChange: policy.breakingChange,
     language: policy.language,

package/src/policy.js

@@ -46,7 +46,13 @@ function clonePolicy(policy) {
   return {
     ...policy,
     types: [...policy.types],
-    scope: { ...policy.scope, values: [...policy.scope.values] },
+    scope: {
+      ...policy.scope,
+      values: [...policy.scope.values],
+      ...(policy.scope.disallowedValues
+        ? { disallowedValues: [...policy.scope.disallowedValues] }
+        : {}),
+    },
     subject: { ...policy.subject },
     body: { ...policy.body },
   };
@@ -69,6 +75,14 @@ export function mergeCommitPolicy(base = DEFAULT_COMMIT_POLICY, override = {}) {
               : base.scope.values,
           }
         : override.scope;
+  if (object(scope)) {
+    if (Array.isArray(scope.values)) scope.values = [...scope.values];
+    if (Array.isArray(scope.disallowedValues)) {
+      scope.disallowedValues = [...scope.disallowedValues];
+    } else {
+      delete scope.disallowedValues;
+    }
+  }
   const subject =
     override.subject === undefined
       ? { ...base.subject }
@@ -111,6 +125,25 @@ function assertStringArray(values, name, { max = 64, pattern } = {}) {
   }
 }
 
+function assertOptionalStringArray(values, name, { max = 64, pattern } = {}) {
+  if (values === undefined) return;
+  if (!Array.isArray(values) || values.length > max) {
+    throw new Error(`Invalid config "${name}": expected at most ${max} strings.`);
+  }
+  if (
+    values.some(
+      (value) =>
+        typeof value !== 'string' ||
+        !value ||
+        value.length > 64 ||
+        (pattern && !pattern.test(value)),
+    ) ||
+    new Set(values).size !== values.length
+  ) {
+    throw new Error(`Invalid config "${name}": contains an invalid or duplicate value.`);
+  }
+}
+
 export function validateCommitPolicyConfig(value) {
   if (!object(value)) throw new Error('Invalid config "commitPolicy": expected an object.');
   if (value.version !== 1) {
@@ -137,6 +170,14 @@ export function validateCommitPolicyConfig(value) {
   ) {
     throw new Error('Invalid config "commitPolicy.scope.values": contains an invalid value.');
   }
+  assertOptionalStringArray(value.scope.disallowedValues, 'commitPolicy.scope.disallowedValues', {
+    pattern: SCOPE_RE,
+  });
+  if (value.scope.disallowedValues?.some((scope) => value.scope.values.includes(scope))) {
+    throw new Error(
+      'Invalid config "commitPolicy.scope": allowed and disallowed values must not overlap.',
+    );
+  }
 
   if (!object(value.subject)) {
     throw new Error('Invalid config "commitPolicy.subject": expected an object.');
@@ -150,6 +191,16 @@ export function validateCommitPolicyConfig(value) {
       'Invalid config "commitPolicy.subject.maxLength": expected an integer between 1 and 200.',
     );
   }
+  if (
+    value.subject.headerMaxLength !== undefined &&
+    (!Number.isInteger(value.subject.headerMaxLength) ||
+      value.subject.headerMaxLength < 1 ||
+      value.subject.headerMaxLength > 1000)
+  ) {
+    throw new Error(
+      'Invalid config "commitPolicy.subject.headerMaxLength": expected an integer between 1 and 1000.',
+    );
+  }
 
   if (!object(value.body)) {
     throw new Error('Invalid config "commitPolicy.body": expected an object.');
@@ -197,7 +248,10 @@ function scopeRule(policy) {
   const allowed = policy.scope.values.length
     ? `; allowed values: ${policy.scope.values.join(', ')}`
     : '';
-  return `${policy.scope.mode}${allowed}`;
+  const disallowed = policy.scope.disallowedValues?.length
+    ? `; disallowed values: ${policy.scope.disallowedValues.join(', ')}`
+    : '';
+  return `${policy.scope.mode}${allowed}${disallowed}`;
 }
 
 export function buildCommitPolicyPrompt(policy, customPrompt = '') {
@@ -219,6 +273,9 @@ export function buildCommitPolicyPrompt(policy, customPrompt = '') {
     `- Allowed types: ${policy.types.join(', ')}`,
     `- Scope: ${scopeRule(policy)}`,
     `- Subject text: required, at most ${policy.subject.maxLength} characters`,
+    ...(policy.subject.headerMaxLength
+      ? [`- Complete header: at most ${policy.subject.headerMaxLength} characters`]
+      : []),
     `- Body: ${policy.body.mode}, at most ${policy.body.maxLines} non-empty lines, separated from the subject by a blank line`,
     `- Breaking change: ${policy.breakingChange}; use "!" and/or a "BREAKING CHANGE:" footer`,
     `- Language: ${targetLanguage}`,
@@ -344,6 +401,9 @@ export function validateCommitCandidate(message, { policy, diff = '' } = {}) {
         ),
       );
     }
+    if (parsed.scope && normalizedPolicy.scope.disallowedValues?.includes(parsed.scope)) {
+      issues.push(issue('scope_value', `Scope "${parsed.scope}" is forbidden.`));
+    }
     if ([...parsed.subject].length > normalizedPolicy.subject.maxLength) {
       issues.push(
         issue(
@@ -352,6 +412,17 @@ export function validateCommitCandidate(message, { policy, diff = '' } = {}) {
         ),
       );
     }
+    if (
+      normalizedPolicy.subject.headerMaxLength &&
+      [...parsedMessage.header].length > normalizedPolicy.subject.headerMaxLength
+    ) {
+      issues.push(
+        issue(
+          'header_length',
+          `Header exceeds ${normalizedPolicy.subject.headerMaxLength} characters.`,
+        ),
+      );
+    }
     if (effectiveLanguage === 'zh' && !/\p{Script=Han}/u.test(parsed.subject)) {
       issues.push(issue('language', 'The subject must be written in Simplified Chinese.'));
     }
@@ -414,6 +485,9 @@ export function buildPolicyCorrectionPrompt(badReply, errors, policy) {
     `Allowed types: ${policy.types.join(', ')}`,
     `Scope rule: ${scopeRule(policy)}`,
     `Maximum subject length: ${policy.subject.maxLength}`,
+    ...(policy.subject.headerMaxLength
+      ? [`Maximum complete header length: ${policy.subject.headerMaxLength}`]
+      : []),
     `Body rule: ${policy.body.mode}, maximum ${policy.body.maxLines} non-empty lines`,
     `Breaking-change rule: ${policy.breakingChange}`,
     'Rewrite it once. Output only the complete corrected commit message; do not include explanations or fences.',

package/src/providers.js

@@ -6,6 +6,8 @@ export const PROVIDER_TYPES = Object.freeze([
   'ollama',
   'custom',
 ]);
+export const REASONING_EFFORTS = Object.freeze(['low', 'medium', 'high', 'xhigh', 'max']);
+export const DEFAULT_REASONING_EFFORT = 'medium';
 const PROVIDER_TYPE_SET = new Set(PROVIDER_TYPES);
 
 export function isProviderType(value) {
@@ -62,6 +64,24 @@ function openAIReasoningEfforts(modelId) {
   return null;
 }
 
+// Setup uses this to avoid offering an effort that a recognized official
+// OpenAI model will reject. Other adapters either accept the common effort
+// vocabulary, normalize it, or are model-dependent, so they retain the full
+// list and let the user/provider make the final choice.
+export function reasoningEffortsForModel(providerType, modelId) {
+  if ((providerType || '').toLowerCase() === 'openai') {
+    const supported = openAIReasoningEfforts(modelId);
+    if (supported) return supported.filter((effort) => effort !== 'none');
+  }
+  return [...REASONING_EFFORTS];
+}
+
+export function canDisableReasoningForModel(providerType, modelId) {
+  if ((providerType || '').toLowerCase() !== 'openai') return true;
+  const supported = openAIReasoningEfforts(modelId);
+  return !supported || supported.includes('none');
+}
+
 function openAIReasoningEffort(modelId, enabled, effort) {
   const requested = enabled ? effort : 'none';
   const supported = openAIReasoningEfforts(modelId);
@@ -179,7 +199,7 @@ function applyReasoning(payload, provider, modelId, reasoning, nativeOllama) {
   if (mode === 'auto') return;
 
   const enabled = mode === 'on';
-  const effort = reasoning?.effort || 'medium';
+  const effort = reasoning?.effort || DEFAULT_REASONING_EFFORT;
 
   if (provider === 'openai') {
     if (!isOpenAIReasoningModel(modelId)) return;

package/src/setup.js

@@ -9,11 +9,56 @@ import password from '@inquirer/password';
 import confirm from '@inquirer/confirm';
 
 import { checkConnection } from './api.js';
-import { CONFIG_SCHEMA_VERSION, isSecureApiUrl, validateUserConfig } from './config.js';
+import {
+  CONFIG_SCHEMA_VERSION,
+  DEFAULT_CONFIG,
+  isSecureApiUrl,
+  validateUserConfig,
+} from './config.js';
 import { vimSelect } from './ui.js';
 import { fileExists, formatMs, indentError, maskApiKey } from './utils.js';
 import { loadProviderPresetManifest } from './provider-presets.js';
 import { resolveConfigLocations, userConfigLocations } from './config-paths.js';
+import {
+  canDisableReasoningForModel,
+  getProviderAdapter,
+  reasoningEffortsForModel,
+} from './providers.js';
+
+const REASONING_MODES = new Set(['auto', 'on', 'off']);
+const REASONING_MODE_CHOICES = Object.freeze([
+  {
+    name: 'Provider default (auto)',
+    value: 'auto',
+    description: 'Do not send an explicit reasoning switch',
+  },
+  {
+    name: 'Enabled (on)',
+    value: 'on',
+    description: 'Request reasoning and configure its effort',
+  },
+  {
+    name: 'Disabled (off)',
+    value: 'off',
+    description: 'Explicitly disable reasoning when the model supports that switch',
+  },
+]);
+
+function suggestedReasoningMode({ currentModel, globalReasoning, apiUrl, providerType, modelId }) {
+  const configured = currentModel.reasoning?.mode ?? globalReasoning?.mode;
+  if (REASONING_MODES.has(configured)) return configured;
+  return getProviderAdapter({ apiUrl, providerType, modelId }).capabilities.reasoning === 'native'
+    ? 'on'
+    : 'auto';
+}
+
+function effortDescription(effort) {
+  if (effort === 'low') return 'Fastest and lowest-cost reasoning';
+  if (effort === 'medium') return 'Balanced reasoning (default)';
+  if (effort === 'high') return 'Deeper reasoning with more latency and tokens';
+  if (effort === 'xhigh') return 'Very deep reasoning for models that support it';
+  return 'Maximum reasoning for models that support it';
+}
 
 // Merge the wizard's answers into the one supported Provider/Model schema.
 // Existing providers and unrelated global settings are preserved; the
@@ -175,6 +220,7 @@ export async function runSetup(dependencies = {}) {
 
   // ── 4. Model ────────────────────────────────────────────────────────
 
+  const providerType = presetAdapter || existingProvider.providerType || 'custom';
   const models = { ...presetModels, ...existingProvider.models };
   let suggestedModel = existingProvider.defaultModel || presetDefaultModel;
   while (true) {
@@ -192,7 +238,46 @@ export async function runSetup(dependencies = {}) {
       default: currentModel.modelId || undefined,
       validate: (v) => (v.trim() ? true : 'Model ID is required'),
     });
-    models[modelName] = { ...currentModel, modelId: modelIdInput.trim() };
+    const modelId = modelIdInput.trim();
+    const reasoningModeChoices = canDisableReasoningForModel(providerType, modelId)
+      ? REASONING_MODE_CHOICES
+      : REASONING_MODE_CHOICES.filter((choice) => choice.value !== 'off');
+    const suggestedMode = suggestedReasoningMode({
+      currentModel,
+      globalReasoning: existing.reasoning,
+      apiUrl,
+      providerType,
+      modelId,
+    });
+    const reasoningMode = await selectPrompt({
+      message: `Reasoning mode for ${modelName}`,
+      default: reasoningModeChoices.some((choice) => choice.value === suggestedMode)
+        ? suggestedMode
+        : 'auto',
+      choices: reasoningModeChoices,
+    });
+    const reasoning = { ...currentModel.reasoning, mode: reasoningMode };
+    if (reasoningMode === 'on') {
+      const efforts = reasoningEffortsForModel(providerType, modelId);
+      const configuredEffort = currentModel.reasoning?.effort ?? existing.reasoning?.effort;
+      const defaultEffort = efforts.includes(configuredEffort)
+        ? configuredEffort
+        : efforts.includes(DEFAULT_CONFIG.reasoning.effort)
+          ? DEFAULT_CONFIG.reasoning.effort
+          : efforts[0];
+      reasoning.effort = await selectPrompt({
+        message: `Reasoning effort for ${modelName}`,
+        default: defaultEffort,
+        choices: efforts.map((effort) => ({
+          name: effort,
+          value: effort,
+          description: effortDescription(effort),
+        })),
+      });
+    } else {
+      delete reasoning.effort;
+    }
+    models[modelName] = { ...currentModel, modelId, reasoning };
     const addAnother = await confirmPrompt({
       message: 'Add another model?',
       default: false,
@@ -214,6 +299,11 @@ export async function runSetup(dependencies = {}) {
           })),
         });
   const selectedModel = models[defaultModel];
+  const selectedReasoning = {
+    ...DEFAULT_CONFIG.reasoning,
+    ...existing.reasoning,
+    ...selectedModel.reasoning,
+  };
 
   // ── 5. Commit message language ──────────────────────────────────────
 
@@ -230,7 +320,7 @@ export async function runSetup(dependencies = {}) {
     apiUrl,
     apiKey,
     apiKeyEnv,
-    providerType: presetAdapter || existingProvider.providerType || 'custom',
+    providerType,
     defaultModel,
     models,
     ...(existingProvider.retry ? { retry: existingProvider.retry } : {}),
@@ -257,6 +347,7 @@ export async function runSetup(dependencies = {}) {
       const report = await connectionCheck({
         ...entry,
         ...selectedModel,
+        reasoning: selectedReasoning,
         apiKey: apiKeyEnv ? process.env[apiKeyEnv] : apiKey,
         maxTokens: 64,
         timeoutMs: 120000,
@@ -292,6 +383,16 @@ export async function runSetup(dependencies = {}) {
   console.log(
     '  ' + chalk.dim(`  Provider: ${providerName}/${defaultModel} (${selectedModel.modelId})`),
   );
+  console.log(
+    '  ' +
+      chalk.dim(
+        `  Reasoning: ${
+          selectedReasoning.mode === 'on'
+            ? `${selectedReasoning.mode}/${selectedReasoning.effort}`
+            : selectedReasoning.mode
+        }`,
+      ),
+  );
   console.log(
     '  ' + chalk.dim(`  API key:  ${apiKeyEnv ? `env:${apiKeyEnv}` : maskApiKey(apiKey)}`),
   );

package/src/split-plan.js

@@ -1,4 +1,4 @@
-import { lstat, mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises';
+import { link, lstat, mkdir, readFile, unlink, writeFile } from 'node:fs/promises';
 import { dirname, isAbsolute, resolve } from 'node:path';
 
 import { normalizeCommitPolicy, validateCommitCandidate } from './policy.js';
@@ -35,7 +35,13 @@ function clonePolicy(policy, language) {
   return {
     version: normalized.version,
     types: [...normalized.types],
-    scope: { ...normalized.scope, values: [...normalized.scope.values] },
+    scope: {
+      ...normalized.scope,
+      values: [...normalized.scope.values],
+      ...(normalized.scope.disallowedValues
+        ? { disallowedValues: [...normalized.scope.disallowedValues] }
+        : {}),
+    },
     subject: { ...normalized.subject },
     body: { ...normalized.body },
     breakingChange: normalized.breakingChange,
@@ -310,12 +316,19 @@ export async function writeSplitPlanArtifact(path, artifact) {
     await writeFile(temporary, JSON.stringify(validated, null, 2) + '\n', {
       encoding: 'utf8',
       mode: 0o600,
+      flag: 'wx',
     });
-    await rename(temporary, absolute);
+    // A same-directory hard link installs the completed file atomically while
+    // failing with EEXIST instead of replacing an unrelated destination.
+    await link(temporary, absolute);
   } catch (err) {
     await unlink(temporary).catch(() => {});
+    if (err.code === 'EEXIST') {
+      throw new Error(`Split plan output already exists: ${absolute}`, { cause: err });
+    }
     throw err;
   }
+  await unlink(temporary).catch(() => {});
   return absolute;
 }
 

package/src/split.js

@@ -117,17 +117,22 @@ function canonicalDestination(path) {
   }
 }
 
-function safeExportPlanPath(projectRoot, path) {
+export function safeExportPlanPath(projectRoot, path) {
   const absolute = resolve(path);
   const rawGitDir = readGit(['rev-parse', '--git-dir'], projectRoot).trim();
   const gitDir = isAbsolute(rawGitDir) ? rawGitDir : resolve(projectRoot, rawGitDir);
   const canonicalRoot = canonicalExistingPath(projectRoot);
   const canonicalGitDir = canonicalDestination(gitDir);
+  const canonicalAicommitDir = canonicalDestination(join(gitDir, 'aicommit'));
   const canonicalPlan = canonicalDestination(absolute);
-  if (pathIsWithin(canonicalRoot, canonicalPlan) && !pathIsWithin(canonicalGitDir, canonicalPlan)) {
+  const insideAicommitDir = pathIsWithin(canonicalAicommitDir, canonicalPlan);
+  if (
+    (pathIsWithin(canonicalRoot, canonicalPlan) && !insideAicommitDir) ||
+    (pathIsWithin(canonicalGitDir, canonicalPlan) && !insideAicommitDir)
+  ) {
     throw fail(
       ERROR_CATEGORIES.CONFIG,
-      'Split plan output must be outside the working tree or inside the repository Git directory.',
+      "Split plan output must be outside the working tree or inside the repository Git directory's dedicated .git/aicommit/ metadata subdirectory.",
     );
   }
   return absolute;
@@ -336,8 +341,13 @@ export async function generateSplitPlan(
       : []),
     'Rules:',
     `- Each group must represent ONE logical change and use one allowed type: ${policy.types.join(', ')}.`,
-    `- Scope mode: ${policy.scope.mode}${policy.scope.values.length ? `; allowed scopes: ${policy.scope.values.join(', ')}` : ''}.`,
+    `- Scope mode: ${policy.scope.mode}${policy.scope.values.length ? `; allowed scopes: ${policy.scope.values.join(', ')}` : ''}${policy.scope.disallowedValues?.length ? `; disallowed scopes: ${policy.scope.disallowedValues.join(', ')}` : ''}.`,
     `- Subject text must not exceed ${policy.subject.maxLength} characters.`,
+    ...(policy.subject.headerMaxLength
+      ? [
+          `- The complete commit header must not exceed ${policy.subject.headerMaxLength} characters.`,
+        ]
+      : []),
     `- Body mode: ${policy.body.mode}; at most ${policy.body.maxLines} non-empty lines.`,
     `- Breaking changes: ${policy.breakingChange}.`,
     '- Give every message a short subject line; when the subject alone does not say it all, add a body of bullet lines (what changed and why), each starting with "- " — the same format the single-commit flow produces.',
@@ -1277,13 +1287,39 @@ export function executeSplit(
           groups,
           hunkMode: allFiles.some((change) => change.hunks?.length),
         });
+      const fingerprintBeforeSnapshot = getSplitStateFingerprint(
+        projectRoot,
+        hasHead(projectRoot),
+        undefined,
+        scope,
+      );
+      if (fingerprintBeforeSnapshot !== plan.fingerprint) {
+        throw fail(
+          ERROR_CATEGORIES.CONCURRENT_MODIFICATION,
+          'Split state changed before the transaction snapshot was captured.',
+        );
+      }
+      options.faultInjector?.('before_snapshot_capture', { plan });
       const snapshots = captureCheckpointSnapshots(projectRoot, scope, allFiles);
+      const fingerprintAfterSnapshot = getSplitStateFingerprint(
+        projectRoot,
+        hasHead(projectRoot),
+        undefined,
+        scope,
+      );
+      if (fingerprintAfterSnapshot !== plan.fingerprint) {
+        throw fail(
+          ERROR_CATEGORIES.CONCURRENT_MODIFICATION,
+          'Split state changed while the transaction snapshot was being captured.',
+        );
+      }
       hunkExecution = validateHunkTransaction(projectRoot, plan, snapshots);
       transaction = {
         ...createSplitCheckpoint(projectRoot, plan, snapshots),
         faultInjector: options.faultInjector,
       };
     } catch (err) {
+      if (err?.category === ERROR_CATEGORIES.CONCURRENT_MODIFICATION) throw err;
       throw fail(ERROR_CATEGORIES.GIT_STATE, `Failed to create split checkpoint: ${err.message}`, {
         cause: err,
       });