@provos/ironcurtain 0.11.0 → 0.13.0

package/dist/config/config-command.js

@@ -9,8 +9,9 @@ import * as p from '@clack/prompts';
 import { readFileSync } from 'node:fs';
 import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { loadUserConfig, saveUserConfig, validateModelId, ESCALATION_TIMEOUT_MIN, ESCALATION_TIMEOUT_MAX, WEB_SEARCH_PROVIDERS, WEB_SEARCH_PROVIDER_LABELS, WEB_SEARCH_PROVIDER_URLS, GOOSE_PROVIDERS, DOCKER_AGENTS, SESSION_MODES, } from './user-config.js';
+import { loadUserConfig, saveUserConfig, validateModelId, ESCALATION_TIMEOUT_MIN, ESCALATION_TIMEOUT_MAX, WEB_SEARCH_PROVIDERS, WEB_SEARCH_PROVIDER_LABELS, WEB_SEARCH_PROVIDER_URLS, GOOSE_PROVIDERS, DOCKER_AGENTS, SESSION_MODES, CONTAINER_RUNTIMES, NATIVE_PROFILE_NAME, DEFAULT_GLM_SLUG, maskApiKey, cloneProviderPreference, } from './user-config.js';
 import { getUserConfigPath } from './paths.js';
+import { listOpenrouterModels, catalogEnforces, } from './openrouter-catalog.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /** Known model options for selection prompts. */
 const KNOWN_MODELS = [
@@ -57,17 +58,97 @@ export function formatCost(n) {
         return 'disabled';
     return `$${n.toFixed(2)}`;
 }
-export function maskApiKey(key) {
-    if (!key)
-        return 'none';
-    if (key.length <= 6)
-        return '***';
-    return key.slice(0, 3) + '...' + key.slice(-3);
-}
 function formatModelShort(id) {
     const known = KNOWN_MODELS.find((m) => m.value === id);
     return known ? known.label : id;
 }
+/**
+ * The current editor view of the `profiles` record, in input shape (openrouter
+ * profiles carry the fields the editor mutates). A pending `profiles` record,
+ * when present, is already the whole record (read-modify-write) and replaces the
+ * resolved view; otherwise the resolved profiles are converted to input shape.
+ * The implicit `native` profile is intentionally excluded — it is never
+ * persisted and is always shown separately as read-only.
+ */
+function currentProfiles(resolved, pending) {
+    if (pending.modelProviders?.profiles) {
+        return { ...pending.modelProviders.profiles };
+    }
+    const view = {};
+    for (const [name, profile] of Object.entries(resolved.modelProviders.profiles)) {
+        if (name === NATIVE_PROFILE_NAME)
+            continue;
+        view[name] = resolvedProfileToInput(profile);
+    }
+    return view;
+}
+/** Converts a resolved profile back to its input shape (drops resolution-only defaults where empty). */
+function resolvedProfileToInput(profile) {
+    if (profile.type === 'native')
+        return { type: 'native' };
+    const input = { type: 'openrouter' };
+    if (profile.apiKey)
+        input.apiKey = profile.apiKey;
+    // A default-tracking profile OMITS `modelMap` so an edit round-trip re-persists
+    // the omission rather than pinning today's materialized DEFAULT_MODEL_MAP.
+    if (!profile.usesDefaultMap)
+        input.modelMap = profile.modelMap.map((r) => ({ match: r.match, model: r.model }));
+    const perAgent = {};
+    for (const agent of DOCKER_AGENTS) {
+        const slug = profile.perAgent[agent];
+        if (slug)
+            perAgent[agent] = slug;
+    }
+    if (Object.keys(perAgent).length > 0)
+        input.perAgent = perAgent;
+    if (profile.providerPreference) {
+        input.providerPreference = cloneProviderPreference(profile.providerPreference);
+    }
+    input.sessionAffinity = profile.sessionAffinity;
+    return input;
+}
+/** The current default profile name (pending override wins over the resolved value). */
+function currentDefault(resolved, pending) {
+    return pending.modelProviders?.default ?? resolved.modelProviders.default;
+}
+/**
+ * F10 — re-point a dangling `default` to `native`. Returns `NATIVE_PROFILE_NAME`
+ * when the current default no longer names a profile in `remainingNames` (and is
+ * not itself `native`), otherwise returns the current default unchanged. Pure so
+ * the delete-repoints-default invariant is unit-testable without the interactive
+ * flow. Persisting a `default` that names a missing profile would make the next
+ * `loadUserConfig` a HARD error (the Zod `.refine`), so callers must apply this
+ * in the same pending write that deletes a profile.
+ */
+export function repointDefaultAfterDelete(currentDefaultName, remainingNames) {
+    if (currentDefaultName === NATIVE_PROFILE_NAME)
+        return currentDefaultName;
+    return remainingNames.includes(currentDefaultName) ? currentDefaultName : NATIVE_PROFILE_NAME;
+}
+/** Compact one-line summary of an openrouter profile for list/hint rendering. */
+function summarizeOpenrouterProfile(profile) {
+    const parts = [];
+    const map = profile.modelMap;
+    if (map && map.length === 0) {
+        parts.push('per-agent only');
+    }
+    else if (map && map.length > 0) {
+        parts.push(map.length === 1 ? `-> ${map[0].model}` : `${map.length} map rules`);
+    }
+    else {
+        parts.push('default map');
+    }
+    parts.push(`key: ${maskApiKey(profile.apiKey)}`);
+    return parts.join(', ');
+}
+/** Compact rendering of a modelMap for diffs: `*sonnet*->z-ai/glm-5.2; *opus*->…`. */
+function formatModelMap(map) {
+    if (!map)
+        return 'default';
+    if (map.length === 0)
+        return 'per-agent only (empty map)';
+    return map.map((r) => `${r.match}->${r.model}`).join('; ');
+}
 export function computeDiff(resolved, pending) {
     const diffs = [];
     const topLevelKeys = [
@@ -79,6 +160,7 @@ export function computeDiff(resolved, pending) {
         'gooseModel',
         'preferredDockerAgent',
         'preferredMode',
+        'containerRuntime',
     ];
     for (const key of topLevelKeys) {
         if (key in pending && pending[key] !== undefined && pending[key] !== resolved[key]) {
@@ -92,6 +174,7 @@ export function computeDiff(resolved, pending) {
         'auditRedaction',
         'memory',
         'dockerResources',
+        'snapshot',
     ];
     for (const section of nestedSections) {
         const pendingSection = pending[section];
@@ -140,8 +223,77 @@ export function computeDiff(resolved, pending) {
             }
         }
     }
+    diffModelProviders(resolved, pending, diffs);
     return diffs;
 }
+/**
+ * Dedicated `modelProviders` diff branch (not the generic nestedSections loop,
+ * which compares by reference and would spuriously diff freshly-materialized
+ * profile objects — m14). Deep-compares each profile field via JSON.stringify so
+ * a no-op read-modify-write yields an EMPTY diff; masks every `apiKey`; renders
+ * modelMap rows compactly.
+ */
+function diffModelProviders(resolved, pending, diffs) {
+    const pendingMp = pending.modelProviders;
+    if (!pendingMp)
+        return;
+    // default selector
+    const resolvedDefault = resolved.modelProviders.default;
+    if (pendingMp.default !== undefined && pendingMp.default !== resolvedDefault) {
+        diffs.push(['modelProviders.default', { from: resolvedDefault, to: pendingMp.default }]);
+    }
+    if (!pendingMp.profiles)
+        return;
+    const resolvedProfiles = resolved.modelProviders.profiles;
+    const pendingProfiles = pendingMp.profiles;
+    // Added / changed profiles.
+    for (const [name, pendingProfile] of Object.entries(pendingProfiles)) {
+        if (name === NATIVE_PROFILE_NAME)
+            continue;
+        const before = name in resolvedProfiles ? resolvedProfileToInput(resolvedProfiles[name]) : undefined;
+        diffOneProfile(name, before, pendingProfile, diffs);
+    }
+    // Removed profiles (present in resolved, absent in the whole-record pending write).
+    for (const name of Object.keys(resolvedProfiles)) {
+        if (name === NATIVE_PROFILE_NAME)
+            continue;
+        if (!(name in pendingProfiles)) {
+            diffs.push([`modelProviders.profiles.${name}`, { from: 'configured', to: 'removed' }]);
+        }
+    }
+}
+/** Field-by-field diff of one profile, masking apiKey and rendering modelMap compactly. */
+function diffOneProfile(name, before, after, diffs) {
+    const prefix = `modelProviders.profiles.${name}`;
+    if (!before) {
+        diffs.push([prefix, { from: 'none', to: `added (${after.type})` }]);
+        return;
+    }
+    if (before.type !== after.type) {
+        diffs.push([`${prefix}.type`, { from: before.type, to: after.type }]);
+        return;
+    }
+    if (before.type === 'native' || after.type === 'native')
+        return;
+    if (before.apiKey !== after.apiKey) {
+        diffs.push([`${prefix}.apiKey`, { from: maskApiKey(before.apiKey), to: maskApiKey(after.apiKey) }]);
+    }
+    if (JSON.stringify(before.modelMap) !== JSON.stringify(after.modelMap)) {
+        diffs.push([`${prefix}.modelMap`, { from: formatModelMap(before.modelMap), to: formatModelMap(after.modelMap) }]);
+    }
+    if (JSON.stringify(before.perAgent) !== JSON.stringify(after.perAgent)) {
+        diffs.push([`${prefix}.perAgent`, { from: before.perAgent ?? {}, to: after.perAgent ?? {} }]);
+    }
+    if (JSON.stringify(before.providerPreference) !== JSON.stringify(after.providerPreference)) {
+        diffs.push([
+            `${prefix}.providerPreference`,
+            { from: before.providerPreference ?? 'default', to: after.providerPreference ?? 'default' },
+        ]);
+    }
+    if (before.sessionAffinity !== after.sessionAffinity) {
+        diffs.push([`${prefix}.sessionAffinity`, { from: before.sessionAffinity, to: after.sessionAffinity }]);
+    }
+}
 function formatDiffValue(key, value) {
     if (value === null)
         return 'disabled';
@@ -155,7 +307,11 @@ function formatDiffValue(key, value) {
         return formatSeconds(value);
     if (key.includes('Cost'))
         return formatCost(value);
-    return String(value);
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'number')
+        return String(value);
+    return JSON.stringify(value);
 }
 // ─── Model prompt ────────────────────────────────────────────
 async function promptModelId(message, current) {
@@ -365,6 +521,76 @@ async function handleMemory(resolved, pending) {
         }
     }
 }
+async function handleSnapshot(resolved, pending) {
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- interactive loop exited via return
+    while (true) {
+        const currentEnabled = pending.snapshot?.enabled ?? resolved.snapshot.enabled;
+        const currentMaxAge = pending.snapshot?.maxAgeDays ?? resolved.snapshot.maxAgeDays;
+        const currentSweep = pending.snapshot?.sweepIntervalHours ?? resolved.snapshot.sweepIntervalHours;
+        const field = await p.select({
+            message: 'Container Snapshots',
+            options: [
+                {
+                    value: 'enabled',
+                    label: 'Enabled (kill switch — snapshot capture + GC for all workflows)',
+                    hint: currentEnabled ? 'on' : 'off',
+                },
+                {
+                    value: 'maxAgeDays',
+                    label: 'Max snapshot age before GC (days)',
+                    hint: currentMaxAge === null ? 'unbounded' : String(currentMaxAge),
+                },
+                { value: 'sweepIntervalHours', label: 'GC sweep interval (hours)', hint: String(currentSweep) },
+                { value: 'back', label: 'Back' },
+            ],
+        });
+        if (isCancelled(field) || field === 'back')
+            return;
+        if (field === 'enabled') {
+            const enabled = await p.confirm({
+                message: 'Enable workflow container snapshots globally? ' +
+                    '(off disables snapshot capture on stop and GC for all workflows)',
+                initialValue: currentEnabled,
+            });
+            if (isCancelled(enabled))
+                continue;
+            if (enabled !== currentEnabled) {
+                pending.snapshot = { ...pending.snapshot, enabled: enabled };
+            }
+        }
+        else if (field === 'maxAgeDays') {
+            const next = await promptNullableNumber({
+                message: 'Max snapshot age before automatic GC',
+                current: currentMaxAge,
+                validate: (n) => (n > 0 ? undefined : 'Must be a positive number of days'),
+                format: (n) => (n === null ? 'unbounded' : `${n} day(s)`),
+            });
+            if (next !== undefined && next !== currentMaxAge) {
+                pending.snapshot = { ...pending.snapshot, maxAgeDays: next };
+            }
+        }
+        else if (field === 'sweepIntervalHours') {
+            const input = await p.text({
+                message: 'GC sweep interval (hours):',
+                placeholder: String(currentSweep),
+                validate: (val) => {
+                    if (!val || val.trim() === '')
+                        return 'Must be a positive number';
+                    const n = Number(val);
+                    if (!Number.isFinite(n) || n <= 0)
+                        return 'Must be positive';
+                    return undefined;
+                },
+            });
+            if (isCancelled(input))
+                continue;
+            const newVal = Number(input);
+            if (newVal !== currentSweep) {
+                pending.snapshot = { ...pending.snapshot, sweepIntervalHours: newVal };
+            }
+        }
+    }
+}
 async function handleResourceLimits(resolved, pending) {
     // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- interactive loop exited via return
     while (true) {
@@ -576,6 +802,437 @@ async function handleWebSearch(resolved, pending) {
         };
     }
 }
+// ─── Model Providers ─────────────────────────────────────────
+/** Returns a shallow copy of `obj` without the given key (avoids `delete obj[dynamicKey]`). */
+function omitKey(obj, key) {
+    const copy = { ...obj };
+    // eslint-disable-next-line @typescript-eslint/no-dynamic-delete -- key is intentionally dynamic here
+    delete copy[key];
+    return copy;
+}
+/**
+ * Writes the whole `profiles` record + `default` into pending (read-modify-write,
+ * required by the shallow `deepMergeConfig`). Callers always pass the complete
+ * view so no unmentioned profile is dropped unintentionally.
+ */
+function commitModelProviders(pending, profiles, defaultName) {
+    pending.modelProviders = { default: defaultName, profiles };
+}
+async function handleModelProviders(resolved, pending) {
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- interactive loop exited via return
+    while (true) {
+        const profiles = currentProfiles(resolved, pending);
+        const defaultName = currentDefault(resolved, pending);
+        const options = [
+            {
+                value: `profile:${NATIVE_PROFILE_NAME}`,
+                label: NATIVE_PROFILE_NAME,
+                hint: defaultName === NATIVE_PROFILE_NAME ? 'native routing (default, not editable)' : 'native routing',
+            },
+        ];
+        for (const [name, profile] of Object.entries(profiles)) {
+            const summary = profile.type === 'openrouter' ? summarizeOpenrouterProfile(profile) : 'native';
+            options.push({
+                value: `profile:${name}`,
+                label: name,
+                hint: `${profile.type}, ${summary}${name === defaultName ? ' (default)' : ''}`,
+            });
+        }
+        options.push({ value: 'add', label: 'Add profile...' });
+        options.push({ value: 'default', label: 'Set default', hint: defaultName });
+        options.push({ value: 'back', label: 'Back' });
+        const action = await p.select({ message: 'Model Providers', options });
+        if (isCancelled(action) || action === 'back')
+            return;
+        if (action === 'add') {
+            await addProfile(resolved, pending);
+        }
+        else if (action === 'default') {
+            await setDefaultProfile(resolved, pending);
+        }
+        else if (typeof action === 'string' && action.startsWith('profile:')) {
+            const name = action.slice('profile:'.length);
+            if (name === NATIVE_PROFILE_NAME) {
+                p.note('The native profile uses today’s canonical routing and cannot be edited or deleted.', 'native');
+                continue;
+            }
+            await editProfile(resolved, pending, name);
+        }
+    }
+}
+async function addProfile(resolved, pending) {
+    const profiles = currentProfiles(resolved, pending);
+    const name = await p.text({
+        message: 'Profile name:',
+        placeholder: 'e.g. glm-5.2',
+        validate: (val) => {
+            if (!val || val.trim() === '')
+                return 'Name is required';
+            if (val === NATIVE_PROFILE_NAME)
+                return `"${NATIVE_PROFILE_NAME}" is a reserved profile name.`;
+            if (val in profiles)
+                return `Profile "${val}" already exists.`;
+            return undefined;
+        },
+    });
+    if (isCancelled(name))
+        return;
+    // v1 supports only the 'openrouter' type; native is implicit and never user-defined.
+    p.note('OpenRouter routes Docker agents through openrouter.ai with a bound model map + key.\n' +
+        'Paste an sk-or-v1-... key; defaults map *sonnet*/*opus*/*haiku* -> ' +
+        `${DEFAULT_GLM_SLUG} with a soft z-ai cache pin.`, 'openrouter');
+    const apiKey = await p.text({
+        message: 'OpenRouter API key (sk-or-v1-...):',
+        placeholder: 'set via OPENROUTER_API_KEY env, or leave blank',
+        validate: () => undefined,
+    });
+    if (isCancelled(apiKey))
+        return;
+    const profile = { type: 'openrouter' };
+    if (apiKey)
+        profile.apiKey = apiKey;
+    profiles[name] = profile;
+    commitModelProviders(pending, profiles, currentDefault(resolved, pending));
+}
+async function setDefaultProfile(resolved, pending) {
+    const profiles = currentProfiles(resolved, pending);
+    const currentName = currentDefault(resolved, pending);
+    const options = [
+        {
+            value: NATIVE_PROFILE_NAME,
+            label: NATIVE_PROFILE_NAME,
+            hint: currentName === NATIVE_PROFILE_NAME ? '(current)' : undefined,
+        },
+        ...Object.keys(profiles).map((name) => ({
+            value: name,
+            label: name,
+            hint: name === currentName ? '(current)' : undefined,
+        })),
+    ];
+    const selected = await p.select({
+        message: 'Default profile (applies when no per-session choice is made):',
+        options,
+    });
+    if (isCancelled(selected))
+        return;
+    const name = selected;
+    if (name !== currentName) {
+        commitModelProviders(pending, profiles, name);
+    }
+}
+async function editProfile(resolved, pending, name) {
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- interactive loop exited via return
+    while (true) {
+        const profiles = currentProfiles(resolved, pending);
+        if (!(name in profiles))
+            return;
+        const profile = profiles[name];
+        if (profile.type !== 'openrouter')
+            return;
+        const field = await p.select({
+            message: `Profile: ${name}`,
+            options: [
+                { value: 'apiKey', label: 'API key', hint: maskApiKey(profile.apiKey) },
+                { value: 'modelMap', label: 'Model map (glob -> slug)', hint: formatModelMap(profile.modelMap) },
+                { value: 'perAgent', label: 'Per-agent model overrides', hint: perAgentSummary(profile) },
+                {
+                    value: 'providerPreference',
+                    label: 'Provider preference (cache pinning)',
+                    hint: providerPreferenceSummary(profile.providerPreference),
+                },
+                {
+                    value: 'sessionAffinity',
+                    label: 'Session affinity (GLM cache)',
+                    hint: (profile.sessionAffinity ?? true) ? 'on' : 'off',
+                },
+                { value: 'delete', label: 'Delete profile' },
+                { value: 'back', label: 'Back' },
+            ],
+        });
+        if (isCancelled(field) || field === 'back')
+            return;
+        if (field === 'delete') {
+            const confirmed = await p.confirm({ message: `Delete profile "${name}"?`, initialValue: false });
+            if (isCancelled(confirmed) || !confirmed)
+                continue;
+            const remaining = omitKey(profiles, name);
+            // F10: never persist a `default` that names the just-deleted profile.
+            const nextDefault = repointDefaultAfterDelete(currentDefault(resolved, pending), Object.keys(remaining));
+            commitModelProviders(pending, remaining, nextDefault);
+            return;
+        }
+        const updated = await editProfileField(field, profile);
+        if (updated) {
+            profiles[name] = updated;
+            commitModelProviders(pending, profiles, currentDefault(resolved, pending));
+        }
+    }
+}
+/** Edits one field of an openrouter profile, returning the updated profile or undefined (no change). */
+async function editProfileField(field, profile) {
+    if (field === 'apiKey') {
+        const apiKey = await p.text({
+            message: 'OpenRouter API key (sk-or-v1-...):',
+            placeholder: profile.apiKey ? '(keep current)' : 'leave blank to use OPENROUTER_API_KEY env',
+            validate: () => undefined,
+        });
+        if (isCancelled(apiKey))
+            return undefined;
+        const next = { ...profile };
+        if (apiKey)
+            next.apiKey = apiKey;
+        else
+            delete next.apiKey;
+        return next;
+    }
+    if (field === 'modelMap')
+        return editModelMap(profile);
+    if (field === 'perAgent')
+        return editPerAgent(profile);
+    if (field === 'providerPreference')
+        return editProviderPreference(profile);
+    if (field === 'sessionAffinity') {
+        const enabled = await p.confirm({
+            message: 'Inject a stable session_id for GLM cache affinity?',
+            initialValue: profile.sessionAffinity ?? true,
+        });
+        if (isCancelled(enabled))
+            return undefined;
+        return { ...profile, sessionAffinity: enabled };
+    }
+    return undefined;
+}
+/**
+ * Builds the option list for a model-slug autocomplete from the resolved catalog.
+ *
+ * - Every catalog slug becomes a `{ value, label }` option.
+ * - `allowNone` prepends a `(none)` sentinel (value `''`) FIRST — the only way a
+ *   selection-only prompt can clear a per-agent override.
+ * - A non-empty `current` absent from the catalog is appended as a grandfather
+ *   option, so editing a legacy/delisted slug never traps the user.
+ *
+ * There is intentionally NO refresh sentinel: `ironcurtain config` is short-lived
+ * and fetches the catalog once, so re-running it IS the refresh path.
+ */
+export function buildSlugOptions(catalog, current, opts) {
+    const options = catalog.models.map((slug) => ({ value: slug, label: slug }));
+    if (opts.allowNone) {
+        options.unshift({ value: '', label: '(none — use model map)' });
+    }
+    if (current !== '' && !catalog.models.includes(current)) {
+        options.push({ value: current, label: `${current}  (current, unverified)` });
+    }
+    return options;
+}
+/** Autocomplete (hard-block) for an authoritative catalog; free text for the bundled floor. */
+export function slugPromptMode(source) {
+    return catalogEnforces(source) ? 'autocomplete' : 'freetext';
+}
+/**
+ * Prompts for one OpenRouter model slug. Fetches the catalog lazily (module-cached)
+ * so apiKey / provider-preference-only edits never pay the network cost.
+ *
+ * Authoritative catalog (`live`/`cache`): a selection-only `autocomplete` whose
+ * options ARE the allowlist — a structural hard-block — with `validate` as
+ * belt-and-suspenders. For an UNSET field the `(none)` sentinel is first, so a
+ * no-op Enter keeps it unset — clack auto-preselects the first option and collapses
+ * a falsy `initialValue` to undefined; a non-empty `current` is passed as
+ * `initialValue` so editing an existing slug starts on it.
+ *
+ * Bundled floor (offline): the list is known-incomplete, so free-text entry with a
+ * one-line warning — the value is accepted as-is.
+ *
+ * Returns the chosen slug (`''` clears when `allowNone`), or `undefined` on cancel.
+ */
+async function promptSlug(message, opts) {
+    const { current, allowNone } = opts;
+    const catalog = await listOpenrouterModels();
+    if (slugPromptMode(catalog.source) === 'autocomplete') {
+        // Allowlist = catalog slugs, plus `current` (grandfather a legacy/delisted slug)
+        // and '' ONLY when the field is clearable (per-agent). A required field
+        // (map-row model, allowNone:false) never admits an empty submit.
+        const allowlist = new Set([...catalog.models, ...(current ? [current] : []), ...(allowNone ? [''] : [])]);
+        const picked = await p.autocomplete({
+            message,
+            options: buildSlugOptions(catalog, current, { allowNone }),
+            initialValue: current || '',
+            initialUserInput: current || undefined,
+            maxItems: 8,
+            validate: (v) => (typeof v === 'string' && !allowlist.has(v) ? `Unknown model: ${v}` : undefined),
+        });
+        if (isCancelled(picked))
+            return undefined;
+        return picked;
+    }
+    p.note("Model catalog unavailable — slug can't be verified; entered value accepted as-is.");
+    const typed = await p.text({
+        message,
+        placeholder: current || DEFAULT_GLM_SLUG,
+        validate: allowNone ? () => undefined : (val) => (!val || !val.trim() ? 'Target slug is required' : undefined),
+    });
+    if (isCancelled(typed))
+        return undefined;
+    // Trim: a free-typed slug is persisted as-is, and " " would pass the schema's
+    // min(1) yet break routing (and defeat "blank to clear" for per-agent). The web
+    // path already trims (editableToDto / validateSlugs); keep the CLI consistent.
+    return typed.trim();
+}
+async function editModelMap(profile) {
+    const rows = [...(profile.modelMap ?? [])];
+    p.note('Ordered glob -> slug rules; first match wins (matched against the requested model id).\n' +
+        'An EMPTY map means "per-agent-only mode": no glob mapping, rely on per-agent overrides.\n' +
+        'Leaving the map unset uses the built-in defaults (*sonnet*/*opus*/*haiku* -> ' +
+        `${DEFAULT_GLM_SLUG}).`, 'Model map');
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- interactive loop exited via return
+    while (true) {
+        const options = rows.map((row, i) => ({
+            value: `row:${i}`,
+            label: `${row.match} -> ${row.model}`,
+            hint: 'select to remove',
+        }));
+        options.push({ value: 'add', label: 'Add rule...' });
+        options.push({ value: 'done', label: 'Done', hint: rows.length === 0 ? 'empty = per-agent-only mode' : undefined });
+        const action = await p.select({ message: `Model map (${rows.length} rule(s))`, options });
+        if (isCancelled(action) || action === 'done')
+            break;
+        if (action === 'add') {
+            const match = await p.text({
+                message: 'Glob to match (e.g. *sonnet*):',
+                validate: (val) => (!val ? 'Match glob is required' : undefined),
+            });
+            if (isCancelled(match))
+                continue;
+            const model = await promptSlug('Target OpenRouter slug (e.g. z-ai/glm-5.2):', {
+                current: '',
+                allowNone: false,
+            });
+            if (model === undefined)
+                continue;
+            rows.push({ match: match, model });
+        }
+        else if (typeof action === 'string' && action.startsWith('row:')) {
+            const index = Number(action.slice('row:'.length));
+            rows.splice(index, 1);
+        }
+    }
+    return { ...profile, modelMap: rows };
+}
+async function editPerAgent(profile) {
+    let perAgent = { ...(profile.perAgent ?? {}) };
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- interactive loop exited via return
+    while (true) {
+        const options = DOCKER_AGENTS.map((agent) => ({
+            value: agent,
+            label: DOCKER_AGENT_LABELS[agent],
+            hint: perAgent[agent] ?? 'none (use model map)',
+        }));
+        const selected = await p.select({
+            message: 'Per-agent model overrides (wins over the model map)',
+            options: [...options, { value: 'back', label: 'Back', hint: '' }],
+        });
+        if (isCancelled(selected) || selected === 'back')
+            break;
+        const agent = selected;
+        const slug = await promptSlug(`${DOCKER_AGENT_LABELS[agent]} model slug (blank to clear):`, {
+            current: perAgent[agent] ?? '',
+            allowNone: true,
+        });
+        if (slug === undefined)
+            continue;
+        if (slug)
+            perAgent[agent] = slug;
+        else
+            perAgent = omitKey(perAgent, agent);
+    }
+    const next = { ...profile };
+    if (Object.keys(perAgent).length > 0)
+        next.perAgent = perAgent;
+    else
+        delete next.perAgent;
+    return next;
+}
+async function editProviderPreference(profile) {
+    const pref = { ...(profile.providerPreference ?? {}) };
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- interactive loop exited via return
+    while (true) {
+        const field = await p.select({
+            message: 'Provider preference (leave unset for the default soft z-ai pin on z-ai/* slugs)',
+            options: [
+                { value: 'order', label: 'order (soft pin)', hint: pref.order?.join(', ') ?? 'none' },
+                { value: 'only', label: 'only (strict pin)', hint: pref.only?.join(', ') ?? 'none' },
+                {
+                    value: 'allowFallbacks',
+                    label: 'allowFallbacks',
+                    hint: pref.allowFallbacks === undefined ? 'default (true)' : pref.allowFallbacks ? 'true' : 'false',
+                },
+                { value: 'clear', label: 'Clear (revert to default pin)' },
+                { value: 'back', label: 'Back' },
+            ],
+        });
+        if (isCancelled(field) || field === 'back')
+            break;
+        if (field === 'clear') {
+            return { ...profile, providerPreference: undefined };
+        }
+        if (field === 'order' || field === 'only') {
+            const input = await p.text({
+                message: `${field} — comma-separated provider slugs (e.g. z-ai), blank to clear:`,
+                placeholder: pref[field]?.join(', ') ?? 'z-ai',
+                validate: () => undefined,
+            });
+            if (isCancelled(input))
+                continue;
+            const list = input
+                .split(',')
+                .map((s) => s.trim())
+                .filter((s) => s.length > 0);
+            const next = list.length > 0 ? list : undefined;
+            if (field === 'order')
+                pref.order = next;
+            else
+                pref.only = next;
+        }
+        else if (field === 'allowFallbacks') {
+            const enabled = await p.confirm({
+                message: 'Allow OpenRouter to fall back to other providers?',
+                initialValue: pref.allowFallbacks ?? true,
+            });
+            if (isCancelled(enabled))
+                continue;
+            pref.allowFallbacks = enabled;
+        }
+    }
+    const cleaned = {};
+    if (pref.order !== undefined)
+        cleaned.order = pref.order;
+    if (pref.only !== undefined)
+        cleaned.only = pref.only;
+    if (pref.allowFallbacks !== undefined)
+        cleaned.allowFallbacks = pref.allowFallbacks;
+    const hasAny = Object.keys(cleaned).length > 0;
+    return { ...profile, providerPreference: hasAny ? cleaned : undefined };
+}
+function perAgentSummary(profile) {
+    const perAgent = profile.perAgent;
+    if (!perAgent)
+        return 'none';
+    const entries = Object.entries(perAgent).filter(([, v]) => v);
+    if (entries.length === 0)
+        return 'none';
+    return entries.map(([agent, slug]) => `${agent}=${slug}`).join(', ');
+}
+function providerPreferenceSummary(pref) {
+    if (!pref)
+        return 'default (soft z-ai pin)';
+    const parts = [];
+    if (pref.only)
+        parts.push(`only: ${pref.only.join(', ')}`);
+    if (pref.order)
+        parts.push(`order: ${pref.order.join(', ')}`);
+    if (pref.allowFallbacks !== undefined)
+        parts.push(`fallbacks: ${pref.allowFallbacks ? 'on' : 'off'}`);
+    return parts.length > 0 ? parts.join(', ') : 'default';
+}
 // ─── Server Credentials ──────────────────────────────────────
 /** Loads server names from mcp-servers.json for the credential editor. */
 function loadServerNames() {
@@ -688,18 +1345,25 @@ async function handleServerCredentials(resolved, pending) {
 // ─── Session Mode ─────────────────────────────────────────────
 /** Human-readable labels for session modes. */
 const SESSION_MODE_LABELS = {
-    docker: 'Docker (recommended)',
+    container: 'Container (recommended)',
     builtin: 'Builtin (V8 sandbox)',
 };
 /** Short labels used in hints (no parenthetical). */
 const SESSION_MODE_SHORT_LABELS = {
-    docker: 'Docker',
+    container: 'Container',
     builtin: 'Builtin',
 };
+/** Human-readable labels for container runtime backends. */
+const CONTAINER_RUNTIME_LABELS = {
+    auto: 'Auto (prefer Apple container when available)',
+    docker: 'Docker',
+    'apple-container': 'Apple container (macOS 26+, Apple silicon)',
+};
 async function handleSessionMode(resolved, pending) {
     // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- interactive loop exited via return
     while (true) {
         const currentMode = pending.preferredMode ?? resolved.preferredMode;
+        const currentRuntime = pending.containerRuntime ?? resolved.containerRuntime;
         const field = await p.select({
             message: 'Session Mode',
             options: [
@@ -708,11 +1372,35 @@ async function handleSessionMode(resolved, pending) {
                     label: 'Preferred mode',
                     hint: SESSION_MODE_LABELS[currentMode],
                 },
+                {
+                    value: 'containerRuntime',
+                    label: 'Container runtime',
+                    hint: CONTAINER_RUNTIME_LABELS[currentRuntime],
+                },
                 { value: 'back', label: 'Back' },
             ],
         });
         if (isCancelled(field) || field === 'back')
             return;
+        if (field === 'containerRuntime') {
+            const runtimeOptions = CONTAINER_RUNTIMES.map((runtime) => ({
+                value: runtime,
+                label: CONTAINER_RUNTIME_LABELS[runtime],
+                hint: runtime === currentRuntime ? '(current)' : undefined,
+            }));
+            const selected = await p.select({
+                message: 'Select container runtime backend:',
+                options: runtimeOptions,
+                initialValue: currentRuntime,
+            });
+            if (isCancelled(selected))
+                continue;
+            const runtime = selected;
+            if (runtime !== currentRuntime) {
+                pending.containerRuntime = runtime;
+            }
+            continue;
+        }
         if (field === 'preferredMode') {
             const modeOptions = SESSION_MODES.map((mode) => ({
                 value: mode,
@@ -744,6 +1432,7 @@ const GOOSE_PROVIDER_LABELS = {
 const DOCKER_AGENT_LABELS = {
     'claude-code': 'Claude Code',
     goose: 'Goose',
+    codex: 'Codex CLI',
 };
 async function handleDockerAgent(resolved, pending) {
     // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- interactive loop exited via return
@@ -948,6 +1637,14 @@ function webSearchHint(resolved, pending) {
     const provider = pending.webSearch?.provider ?? resolved.webSearch.provider;
     return provider ? WEB_SEARCH_PROVIDER_LABELS[provider] : 'not configured';
 }
+function modelProvidersHint(resolved, pending) {
+    const profiles = currentProfiles(resolved, pending);
+    const count = Object.keys(profiles).length;
+    const defaultName = currentDefault(resolved, pending);
+    if (count === 0)
+        return `default: ${defaultName}`;
+    return `${count} profile${count > 1 ? 's' : ''}, default: ${defaultName}`;
+}
 function serverCredentialsHint(resolved, pending) {
     const creds = { ...resolved.serverCredentials, ...pending.serverCredentials };
     const configured = Object.entries(creds).filter(([, v]) => Object.keys(v).length > 0);
@@ -962,6 +1659,13 @@ function memoryHint(resolved, pending) {
         return 'off (kill switch)';
     return `on, auto-save: ${autoSave ? 'on' : 'off'}`;
 }
+function snapshotHint(resolved, pending) {
+    const enabled = pending.snapshot?.enabled ?? resolved.snapshot.enabled;
+    const maxAge = pending.snapshot?.maxAgeDays ?? resolved.snapshot.maxAgeDays;
+    if (!enabled)
+        return 'off (kill switch)';
+    return `on, max age: ${maxAge === null ? 'unbounded' : `${maxAge}d`}`;
+}
 function dockerAgentHint(resolved, pending) {
     const agent = DOCKER_AGENT_LABELS[pending.preferredDockerAgent ?? resolved.preferredDockerAgent];
     return `${agent}, ${dockerResourcesSummary(resolved, pending)}`;
@@ -1003,8 +1707,10 @@ export async function runConfigCommand() {
                 { value: 'resources', label: `Resource Limits (${resourceHint(resolved, pending)})` },
                 { value: 'compact', label: `Auto-Compact (${autoCompactHint(resolved, pending)})` },
                 { value: 'websearch', label: `Web Search (${webSearchHint(resolved, pending)})` },
+                { value: 'modelProviders', label: `Model Providers (${modelProvidersHint(resolved, pending)})` },
                 { value: 'credentials', label: `Server Credentials (${serverCredentialsHint(resolved, pending)})` },
                 { value: 'memory', label: `Memory (${memoryHint(resolved, pending)})` },
+                { value: 'snapshots', label: `Container Snapshots (${snapshotHint(resolved, pending)})` },
                 { value: 'sessionMode', label: `Session Mode (${sessionModeHint(resolved, pending)})` },
                 { value: 'dockerAgent', label: `Docker Agent (${dockerAgentHint(resolved, pending)})` },
                 { value: 'save', label: 'Save & Exit', hint: changeCount(resolved, pending) },
@@ -1031,12 +1737,18 @@ export async function runConfigCommand() {
             case 'websearch':
                 await handleWebSearch(resolved, pending);
                 break;
+            case 'modelProviders':
+                await handleModelProviders(resolved, pending);
+                break;
             case 'credentials':
                 await handleServerCredentials(resolved, pending);
                 break;
             case 'memory':
                 await handleMemory(resolved, pending);
                 break;
+            case 'snapshots':
+                await handleSnapshot(resolved, pending);
+                break;
             case 'sessionMode':
                 await handleSessionMode(resolved, pending);
                 break;