amicus 1.9.1 → 2.0.0

package/src/sidecar/read.js

@@ -8,7 +8,7 @@
 const fs = require('fs');
 const path = require('path');
 const { safeSessionDir, TASK_ID_PATTERN } = require('../utils/validators');
-const { SESSIONS_DIR, LEGACY_SESSIONS_DIR } = require('../session-manager');
+const { SESSIONS_DIR } = require('../session-manager');
 const { fenceSidecarOutput } = require('../utils/untrusted-fence');
 
 /**
@@ -31,18 +31,16 @@ function formatAge(dateStr) {
 }
 
 /**
- * Enumerate sessions across canonical + legacy roots (dedup, amicus wins).
+ * Enumerate sessions under the canonical amicus_sessions root.
  * @param {string} project
  * @param {{status?: string}} [opts] - status filter ('running', etc.); omit/'all' for all
  * @returns {Array<{id, model, status, agent, briefing, createdAt}>}
  */
 function enumerateSessions(project, opts = {}) {
-  const roots = [SESSIONS_DIR, LEGACY_SESSIONS_DIR]
-    .map(d => path.join(project, '.claude', d))
-    .filter(fs.existsSync);
+  const root = path.join(project, '.claude', SESSIONS_DIR);
 
   const byId = new Map();
-  for (const root of roots) {
+  if (fs.existsSync(root)) {
     for (const d of fs.readdirSync(root)) {
       if (!TASK_ID_PATTERN.test(d)) { continue; }
       if (byId.has(d)) { continue; }

package/src/sidecar/resume.js

@@ -6,6 +6,7 @@
 const fs = require('fs');
 const path = require('path');
 
+const { writeFileAtomic } = require('../utils/atomic-write');
 const { runInteractive, buildMcpConfig } = require('./start');
 const {
   SessionPaths,
@@ -16,6 +17,7 @@ const {
 } = require('./session-utils');
 const { acquireLock, releaseLock } = require('../utils/session-lock');
 const { runHeadless } = require('../headless');
+const { extractNonceFromText, generateFoldNonce } = require('../utils/fold-marker');
 const { logger } = require('../utils/logger');
 
 /** Load session metadata from session directory */
@@ -106,7 +108,7 @@ function updateSessionStatus(sessionDir, status) {
   if (status === 'running') {
     meta.resumedAt = new Date().toISOString();
   }
-  fs.writeFileSync(metaPath, JSON.stringify(meta, null, 2));
+  writeFileAtomic(metaPath, JSON.stringify(meta, null, 2));
   return meta;
 }
 
@@ -159,6 +161,18 @@ async function resumeSidecar(options) {
       logger.warn('Files changed since last activity', { taskId, changedFileCount: drift.changedFiles.length });
     }
 
+    // 15b.3: resume re-sends the ORIGINAL prompt text verbatim (unlike
+    // continue, which builds a fresh one) — that prompt already instructed
+    // the model with the nonce baked in at the initial start/continue time.
+    // Recover it from the saved text so the detector agrees with what the
+    // model was actually told. A session saved before 15b.3 shipped (or any
+    // prompt that somehow lost its marker instruction) has no nonce to
+    // recover — generate a fresh one so resume still gets nonce protection,
+    // even though the OLD prompt text won't mention it (that just means this
+    // resumed run can only complete via a non-fold-marker path, same as any
+    // other run whose prompt and detector nonce happen to mismatch).
+    const foldNonce = extractNonceFromText(systemPrompt) || generateFoldNonce();
+
     // Update metadata (get updated metadata with resumedAt)
     const updatedMetadata = updateSessionStatus(sessionDir, 'running');
 
@@ -179,7 +193,7 @@ async function resumeSidecar(options) {
       const userMessage = buildResumeUserMessage(metadata.briefing || '', existingConversation);
       result = await runHeadless(
         metadata.model, resumePrompt, userMessage,
-        taskId, project, timeout * 60 * 1000, effectiveAgent, { mcp: mcpServers }
+        taskId, project, timeout * 60 * 1000, effectiveAgent, { mcp: mcpServers, nonce: foldNonce }
       );
       summary = result.summary || '## Sidecar Results: No Output\n\nResumed session completed without summary.';
 
@@ -196,7 +210,8 @@ async function resumeSidecar(options) {
           isResume: true,
           conversation: existingConversation,
           opencodeSessionId: metadata.opencodeSessionId,
-          mcp: mcpServers
+          mcp: mcpServers,
+          foldNonce
         }
       );
       summary = result.summary || '';
@@ -216,7 +231,7 @@ async function resumeSidecar(options) {
       updatedMetadata.status = 'error';
       updatedMetadata.reason = (result && result.error) ? String(result.error) : 'Incomplete';
       updatedMetadata.completedAt = new Date().toISOString();
-      fs.writeFileSync(metaPath, JSON.stringify(updatedMetadata, null, 2), { mode: 0o600 });
+      writeFileAtomic(metaPath, JSON.stringify(updatedMetadata, null, 2), { mode: 0o600 });
       logger.error('Resume completed with error', { taskId, error: updatedMetadata.reason });
     } else {
       finalizeSession(sessionDir, summary, project, updatedMetadata, { status: terminal.status });

package/src/sidecar/session-finalize.js

@@ -42,6 +42,7 @@ function finalizeHeadlessResult(sessionDir, result, project, metadata) {
   const fs = require('fs');
   const path = require('path');
   const { finalizeSession, SessionPaths } = require('./session-utils');
+  const { writeFileAtomic } = require('../utils/atomic-write');
 
   const terminal = resolveTerminalState(result);
   if (terminal.status === 'error') {
@@ -51,7 +52,7 @@ function finalizeHeadlessResult(sessionDir, result, project, metadata) {
     metadata.status = 'error';
     metadata.reason = (result && result.error) ? String(result.error) : 'Incomplete';
     metadata.completedAt = new Date().toISOString();
-    fs.writeFileSync(
+    writeFileAtomic(
       path.join(sessionDir, 'metadata.json'),
       JSON.stringify(metadata, null, 2),
       { mode: 0o600 }

package/src/sidecar/session-utils.js

@@ -9,6 +9,11 @@ const path = require('path');
 const { detectConflicts, formatConflictWarning } = require('../conflict');
 const { logger } = require('../utils/logger');
 const { fenceSidecarOutput } = require('../utils/untrusted-fence');
+const { writeFileAtomic } = require('../utils/atomic-write');
+// isProcessAlive/checkSessionLiveness live in utils/abort-coordinator.js
+// (shared EPERM-aware liveness classification with isAlive); re-exported
+// below for backward-compatible imports.
+const { isAlive: isProcessAlive, checkSessionLiveness } = require('../utils/abort-coordinator');
 const {
   SESSIONS_DIR,
   getSessionDir,
@@ -31,9 +36,8 @@ const SessionPaths = {
   },
 
   /**
-   * Resolve an EXISTING session directory for READS: prefer amicus, fall back
-   * to legacy `sidecar_sessions` (backward-compat shim). Use this when
-   * resuming/continuing an existing session so pre-rebrand sessions are found.
+   * Resolve an EXISTING session directory for READS. Use this when
+   * resuming/continuing an existing session.
    */
   resolveSessionDir(project, taskId) {
     return resolveExistingSessionDir(project, taskId);
@@ -100,7 +104,7 @@ function finalizeSession(sessionDir, summary, project, metadata, opts = {}) {
   const hasSummary = typeof summary === 'string' && summary.trim().length > 0;
   metadata.status = opts.status || (hasSummary ? 'complete' : 'error');
   metadata.completedAt = new Date().toISOString();
-  fs.writeFileSync(metaPath, JSON.stringify(metadata, null, 2), { mode: 0o600 });
+  writeFileAtomic(metaPath, JSON.stringify(metadata, null, 2), { mode: 0o600 });
 
   logger.info('Session finalized', { taskId: metadata.taskId, status: metadata.status });
 }
@@ -248,43 +252,17 @@ async function startOpenCodeServer(mcpConfig, options = {}) {
 
   const ready = await waitForServer(client, checkHealth);
   if (!ready) {
-    server.close();
+    // Fire-and-forget: today close() is sync (Promise.resolve wraps a
+    // non-promise harmlessly); once close() becomes async (bounded
+    // kill-escalation poll) this guard prevents an unhandled rejection
+    // from racing the throw below.
+    Promise.resolve(server.close()).catch(() => {});
     throw new Error('OpenCode server failed to become ready');
   }
 
   return { client, server };
 }
 
-/**
- * Check if a process with the given PID is still alive.
- * @param {number|null} pid
- * @returns {boolean}
- */
-function isProcessAlive(pid) {
-  if (!pid) { return false; }
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Check if a session's processes are alive.
- * @param {Object} metadata - Session metadata with pid and goPid
- * @returns {'alive'|'server-dead'|'dead'}
- */
-function checkSessionLiveness(metadata) {
-  if (!metadata) { return 'dead'; }
-  const nodeAlive = isProcessAlive(metadata.pid);
-  const goAlive = isProcessAlive(metadata.goPid);
-
-  if (nodeAlive && goAlive) { return 'alive'; }
-  if (nodeAlive && !goAlive) { return 'server-dead'; }
-  return 'dead';
-}
-
 module.exports = {
   HEARTBEAT_INTERVAL,
   SessionPaths,

package/src/sidecar/setup-window.js

@@ -1,7 +1,7 @@
 /**
  * Setup Window Launcher
  *
- * Spawns the Electron window in setup mode (SIDECAR_MODE=setup)
+ * Spawns the Electron window in setup mode (AMICUS_MODE=setup)
  * for API key configuration. Waits for the window to close and
  * returns whether setup completed successfully.
  */
@@ -11,7 +11,6 @@ const path = require('path');
 const { logger } = require('../utils/logger');
 const { getElectronPath } = require('./interactive-process');
 const { ensureElectron } = require('./electron-ensure');
-const { getCompatEnv } = require('../utils/env-compat');
 
 /**
  * Launch the Electron setup window for API key entry.
@@ -35,7 +34,7 @@ async function launchSetupWindow() {
       AMICUS_MODE: 'setup'
     };
 
-    const debugPort = getCompatEnv('DEBUG_PORT');
+    const debugPort = process.env.AMICUS_DEBUG_PORT;
     const args = debugPort
       ? [`--remote-debugging-port=${debugPort}`, mainPath]
       : [mainPath];

package/src/sidecar/start.js

@@ -6,6 +6,7 @@
 const crypto = require('crypto');
 const fs = require('fs');
 
+const { writeFileAtomic } = require('../utils/atomic-write');
 const { buildContext } = require('./context-builder');
 const {
   SessionPaths,
@@ -25,6 +26,7 @@ const { loadMcpConfig, parseMcpSpec } = require('../opencode-client');
 const { mapAgentToOpenCode } = require('../utils/agent-mapping');
 const { discoverParentMcps } = require('../utils/mcp-discovery');
 const { stripSelfMcpEntries } = require('../utils/mcp-self-identity');
+const { generateFoldNonce } = require('../utils/fold-marker');
 
 /** Generate a unique 8-character hex task ID */
 function generateTaskId() {
@@ -66,7 +68,7 @@ function createSessionMetadata(taskId, project, options) {
     createdAt: existing.createdAt || new Date().toISOString()
   };
 
-  fs.writeFileSync(metaPath, JSON.stringify(metadata, null, 2), { mode: 0o600 });
+  writeFileAtomic(metaPath, JSON.stringify(metadata, null, 2), { mode: 0o600 });
 
   return sessionDir;
 }
@@ -163,6 +165,12 @@ async function startSidecar(options) {
   });
   const taskId = options.taskId || generateTaskId();
   const reasoning = thinking ? { effort: thinking } : undefined;
+  // 15b.3: one nonce per run, generated BEFORE prompt construction so the
+  // SAME value can be baked into the prompt's instruction (buildPrompts) and
+  // handed to the detector (runHeadless.options.nonce / the GUI fold writer
+  // via env). Harmless to generate even for the interactive path — buildPrompts
+  // only consumes it in headless mode.
+  const foldNonce = generateFoldNonce();
 
   logger.info('Starting task', { taskId, model, mode: effectiveHeadless ? 'headless' : 'interactive' });
 
@@ -170,7 +178,7 @@ async function startSidecar(options) {
     ? buildContext(effectiveProject, effectiveSession, { contextTurns, contextSince, contextMaxTokens, sessionDir, client, coworkProcess })
     : '[Context excluded by caller - briefing is self-contained]';
   const { system: systemPrompt, userMessage } = buildPrompts(
-    effectivePrompt, context, effectiveProject, effectiveHeadless, agent, summaryLength, client
+    effectivePrompt, context, effectiveProject, effectiveHeadless, agent, summaryLength, client, foldNonce
   );
 
   const sessDir = createSessionMetadata(taskId, effectiveProject, {
@@ -188,7 +196,8 @@ async function startSidecar(options) {
       try {
         result = await runHeadless(
           model, systemPrompt, userMessage, taskId, effectiveProject,
-          timeout * 60 * 1000, agent || 'build', { mcp: mcpServers, summaryLength, reasoning, port: opencodePort }
+          timeout * 60 * 1000, agent || 'build',
+          { mcp: mcpServers, summaryLength, reasoning, port: opencodePort, nonce: foldNonce }
         );
       } catch (err) {
         if (!json) { throw err; }
@@ -204,7 +213,7 @@ async function startSidecar(options) {
       logger.info('Launching interactive sidecar', { taskId, model, agent: effectiveAgent });
       result = await runInteractive(
         model, systemPrompt, userMessage, taskId, effectiveProject,
-        { agent, mcp: mcpServers, reasoning, client, windowPosition: position }
+        { agent, mcp: mcpServers, reasoning, client, windowPosition: position, foldNonce }
       );
       summary = result.summary || '';
       if (result.error) { logger.error('Interactive task error', { taskId, error: result.error }); }
@@ -221,7 +230,7 @@ async function startSidecar(options) {
   // Persist OpenCode session ID for resume capability
   if (result && result.opencodeSessionId) {
     meta.opencodeSessionId = result.opencodeSessionId;
-    fs.writeFileSync(metaPath, JSON.stringify(meta, null, 2), { mode: 0o600 });
+    writeFileAtomic(metaPath, JSON.stringify(meta, null, 2), { mode: 0o600 });
   }
 
   // Map the run result to a definitive terminal status + exit code (single source of truth).
@@ -231,7 +240,7 @@ async function startSidecar(options) {
     meta.status = 'error';
     meta.reason = (result && result.error) ? String(result.error) : 'Incomplete';
     meta.completedAt = new Date().toISOString();
-    fs.writeFileSync(metaPath, JSON.stringify(meta, null, 2), { mode: 0o600 });
+    writeFileAtomic(metaPath, JSON.stringify(meta, null, 2), { mode: 0o600 });
     logger.error('Session completed with error', { taskId, error: meta.reason });
   } else {
     // complete / timed-out / aborted: persist the (possibly partial) summary with the correct status.
@@ -243,7 +252,13 @@ async function startSidecar(options) {
   if (runUsage) {
     const m = JSON.parse(fs.readFileSync(metaPath, 'utf-8'));
     m.usage = runUsage;
-    fs.writeFileSync(metaPath, JSON.stringify(m, null, 2), { mode: 0o600 });
+    writeFileAtomic(metaPath, JSON.stringify(m, null, 2), { mode: 0o600 });
+    // B24: cross-run spend ledger. Best-effort — appendSpend never throws, but
+    // this run's own success must never hinge on ledger bookkeeping either way.
+    try {
+      const { appendSpend } = require('../utils/spend-ledger');
+      appendSpend({ taskId, model, mode: effectiveHeadless ? 'headless' : 'interactive', usage: runUsage });
+    } catch { /* best-effort */ }
   }
 
   if (json) {

package/src/utils/abort-coordinator.js

@@ -54,18 +54,36 @@ function killPidBestEffort(pid, kill = process.kill.bind(process)) {
   }
 }
 
+/** SIGKILL a pid, swallowing ESRCH. @returns {boolean} signal was sent */
+function killPidHard(pid, kill = process.kill.bind(process)) {
+  if (!pid) { return false; }
+  try { kill(pid, 'SIGKILL'); return true; } catch (err) {
+    if (err.code !== 'ESRCH') {
+      logger.warn('Failed to force-kill process', { pid, error: err.message });
+    }
+    return false;
+  }
+}
+
 /**
  * Wait up to graceMs for the pids to exit on their own (marker-honoring
  * teardown), then SIGTERM any survivor. Early-exits as soon as every target
  * is gone, so a process that honors the marker in ~2s never sees a signal.
  *
+ * Opt-in escalation (B06): pass `escalate` to additionally wait up to
+ * `escalate.killGraceMs` after the SIGTERM for the survivor(s) to exit, then
+ * SIGKILL anyone still alive. Same REF'd poll cadence (`pollMs`) as the TERM
+ * tier. A pid that was already dead at entry, or that exits during the TERM
+ * grace window, is never escalated — escalation only applies to the set that
+ * was actually SIGTERM'd and remained alive.
+ *
  * NOTE: the poll timer is deliberately REF'D. The CLI awaits this call and
  * must stay alive through the grace window; callers that must not block
  * (MCP handler) fire-and-forget the returned promise instead.
  *
  * @param {number|null|Array<number|null>} pids
- * @param {{graceMs?:number, pollMs?:number, deps?:{kill?:Function, sleep?:Function}}} [opts]
- * @returns {Promise<{killed:number[], exited:number[]}>}
+ * @param {{graceMs?:number, pollMs?:number, escalate?:{killGraceMs?:number}, deps?:{kill?:Function, sleep?:Function}}} [opts]
+ * @returns {Promise<{killed:number[], exited:number[], escalated:number[]}>}
  */
 async function waitThenKill(pids, opts = {}) {
   const graceMs = opts.graceMs !== undefined ? opts.graceMs : abortGraceMs();
@@ -82,10 +100,42 @@ async function waitThenKill(pids, opts = {}) {
     remaining = remaining.filter((pid) => isAlive(pid, kill));
   }
   const killed = remaining.filter((pid) => killPidBestEffort(pid, kill));
-  return {
-    killed,
-    exited: targets.filter((pid) => !remaining.includes(pid)),
-  };
+  const exited = targets.filter((pid) => !remaining.includes(pid));
+
+  let escalated = [];
+  if (opts.escalate && killed.length > 0) {
+    const killGraceMs = opts.escalate.killGraceMs !== undefined ? opts.escalate.killGraceMs : 2000;
+    const killDeadline = Date.now() + killGraceMs;
+    let stillAlive = killed.filter((pid) => isAlive(pid, kill));
+    while (stillAlive.length > 0 && Date.now() < killDeadline) {
+      await sleep(pollMs);
+      stillAlive = stillAlive.filter((pid) => isAlive(pid, kill));
+    }
+    // Anyone SIGTERM'd that isn't in the final stillAlive set exited on its
+    // own during the kill-grace window; anyone left gets SIGKILL'd here.
+    escalated = stillAlive.filter((pid) => killPidHard(pid, kill));
+    for (const pid of killed) { exited.push(pid); }
+  }
+
+  return opts.escalate ? { killed, exited, escalated } : { killed, exited };
+}
+
+/**
+ * Check if a session's Node/Go process pair is alive. Thin wrapper over
+ * isAlive — kept here (not sidecar/session-utils.js) so both liveness
+ * checks share one EPERM-aware classification. session-utils.js re-exports
+ * this for backward-compatible imports.
+ * @param {Object} metadata - Session metadata with pid and goPid
+ * @returns {'alive'|'server-dead'|'dead'}
+ */
+function checkSessionLiveness(metadata) {
+  if (!metadata) { return 'dead'; }
+  const nodeAlive = isAlive(metadata.pid);
+  const goAlive = isAlive(metadata.goPid);
+
+  if (nodeAlive && goAlive) { return 'alive'; }
+  if (nodeAlive && !goAlive) { return 'server-dead'; }
+  return 'dead';
 }
 
-module.exports = { abortGraceMs, isAlive, killPidBestEffort, waitThenKill };
+module.exports = { abortGraceMs, isAlive, killPidBestEffort, killPidHard, waitThenKill, checkSessionLiveness };

package/src/utils/api-key-store.js

@@ -5,7 +5,6 @@
 const fs = require('fs');
 const path = require('path');
 const { validateApiKey, validateOpenRouterKey, VALIDATION_ENDPOINTS } = require('./api-key-validation');
-const { getCompatEnv } = require('./env-compat');
 
 /** Maps provider IDs to environment variable names */
 const PROVIDER_ENV_MAP = {
@@ -23,7 +22,7 @@ const LEGACY_KEY_NAMES = {
 
 /** Get the path to the .env file */
 function getEnvPath() {
-  const envDir = getCompatEnv('ENV_DIR');
+  const envDir = process.env.AMICUS_ENV_DIR;
   if (envDir) {
     const resolved = path.resolve(envDir);
     if (resolved.includes('\0')) {
@@ -32,17 +31,7 @@ function getEnvPath() {
     return path.join(resolved, '.env');
   }
   const homeDir = process.env.HOME || process.env.USERPROFILE;
-  const amicusEnvPath = path.join(homeDir, '.config', 'amicus', '.env');
-  // DEPRECATED(amicus-shim): fall back to the legacy ~/.config/sidecar/.env if it
-  // exists and the new one does not, so pre-rebrand installs keep reading/writing
-  // their existing keys. Remove in a future revision — see docs/SHIMS.md.
-  if (!fs.existsSync(amicusEnvPath)) {
-    const legacyEnvPath = path.join(homeDir, '.config', 'sidecar', '.env');
-    if (fs.existsSync(legacyEnvPath)) {
-      return legacyEnvPath;
-    }
-  }
-  return amicusEnvPath;
+  return path.join(homeDir, '.config', 'amicus', '.env');
 }
 
 /** Parse a .env file into a key-value map (comments/blanks excluded) */

package/src/utils/config.js

@@ -9,15 +9,17 @@ const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
 const { applyDirectApiFallback, autoRepairAlias } = require('./alias-resolver');
-const { getCompatEnv } = require('./env-compat');
 
 /** Default model alias map — derived from the curated-models single source (F5) */
 const { toDefaultAliases } = require('./curated-models');
 const DEFAULT_ALIASES = toDefaultAliases();
 
+/** Built-in council benches (B23) — consulted only when a name is absent from user config. */
+const { resolveBuiltinCouncil } = require('./council-presets');
+
 /** @returns {string} Config directory path */
 function getConfigDir() {
-  const override = getCompatEnv('CONFIG_DIR');
+  const override = process.env.AMICUS_CONFIG_DIR;
   if (override) {
     const resolved = path.resolve(override);
     if (resolved.includes('\0')) {
@@ -26,45 +28,7 @@ function getConfigDir() {
     return resolved;
   }
   const homeDir = process.env.HOME || process.env.USERPROFILE;
-  const amicusDir = path.join(homeDir, '.config', 'amicus');
-  // DEPRECATED(amicus-shim): fall back to the legacy ~/.config/sidecar dir if it
-  // exists and the new one does not, so pre-rebrand credentials keep working.
-  // Remove in a future revision — see docs/SHIMS.md.
-  if (!fs.existsSync(amicusDir)) {
-    const legacyDir = path.join(homeDir, '.config', 'sidecar');
-    if (fs.existsSync(legacyDir)) {
-      return legacyDir;
-    }
-  }
-  return amicusDir;
-}
-
-/**
- * One-time, non-destructive migration of the legacy ~/.config/sidecar config
- * directory onto the canonical ~/.config/amicus. Copies (does not move), so the
- * legacy dir is left intact as a backup. This collapses the two-dir split that
- * let getConfigDir() flip between them and orphan data: once ~/.config/amicus
- * exists it always wins. No-op when amicus already exists, when there is no
- * legacy dir, or when a CONFIG_DIR override is set. Best-effort — returns a
- * result object and never throws. Call once at startup, before any config read.
- *
- * @param {{home?: string}} [opts]
- * @returns {{migrated: boolean, from?: string, to?: string, reason?: string, error?: string}}
- */
-function migrateLegacyConfigDir(opts = {}) {
-  if (getCompatEnv('CONFIG_DIR')) { return { migrated: false, reason: 'override-set' }; }
-  const home = opts.home || process.env.HOME || process.env.USERPROFILE;
-  if (!home) { return { migrated: false, reason: 'no-home' }; }
-  const amicusDir = path.join(home, '.config', 'amicus');
-  const legacyDir = path.join(home, '.config', 'sidecar');
-  try {
-    if (fs.existsSync(amicusDir)) { return { migrated: false, reason: 'amicus-exists' }; }
-    if (!fs.existsSync(legacyDir)) { return { migrated: false, reason: 'no-legacy' }; }
-    fs.cpSync(legacyDir, amicusDir, { recursive: true });
-    return { migrated: true, from: legacyDir, to: amicusDir };
-  } catch (err) {
-    return { migrated: false, reason: 'error', error: err.message };
-  }
+  return path.join(homeDir, '.config', 'amicus');
 }
 
 /** @returns {string} Full path to config.json */
@@ -312,6 +276,24 @@ function getCouncil(name) {
   return getCouncils()[name] || null;
 }
 
+/**
+ * Look up a council's raw member list, checking user config FIRST and the
+ * built-in benches (free/budget/frontier — src/utils/council-presets.js)
+ * only when the name is absent from user config. User config always shadows
+ * a same-named built-in — this matches the pre-existing last-write-wins
+ * posture the wizard's `councils.free` seeding already relied on.
+ * @param {string} name
+ * @param {Array<{id:string}>} [catalog] needed only to resolve the dynamic 'free' bench
+ * @returns {{members:string[]|null, builtin:boolean}}
+ */
+function getCouncilWithSource(name, catalog = []) {
+  const userMembers = getCouncil(name);
+  if (userMembers) { return { members: userMembers, builtin: false }; }
+  const builtinMembers = resolveBuiltinCouncil(name, catalog);
+  if (builtinMembers) { return { members: builtinMembers, builtin: true }; }
+  return { members: null, builtin: false };
+}
+
 /**
  * Expand a saved council into a runnable members list, degrading gracefully.
  * Each member is resolved to its full model id (alias → id via effective
@@ -320,12 +302,17 @@ function getCouncil(name) {
  * warning rather than fail-fast-aborting the whole wave. The catalog check is
  * skipped when the catalog is empty (offline). Returns members RAW (alias or
  * id) — leg-time validation resolves them again.
+ *
+ * Resolution order: user config (`config.councils`) is checked first; when
+ * `name` is absent there, the built-in benches (`free`/`budget`/`frontier`)
+ * are consulted (src/utils/council-presets.js). A user-saved council always
+ * shadows a built-in of the same name.
  * @param {string} name
  * @param {Array<{id:string}>} [catalog]
  * @returns {{models:string[], dropped:string[]} | {error:string}}
  */
 function resolveCouncilMembers(name, catalog = []) {
-  const members = getCouncil(name);
+  const { members } = getCouncilWithSource(name, catalog);
   if (!members) {
     return { error: `Unknown council '${name}'. Run 'amicus setup' to create one.` };
   }
@@ -354,7 +341,6 @@ function resolveCouncilMembers(name, catalog = []) {
 
 module.exports = {
   getConfigDir,
-  migrateLegacyConfigDir,
   getConfigPath,
   loadConfig,
   saveConfig,
@@ -370,5 +356,6 @@ module.exports = {
   buildProviderModels,
   getCouncils,
   getCouncil,
+  getCouncilWithSource,
   resolveCouncilMembers,
 };

package/src/utils/council-presets.js

@@ -0,0 +1,87 @@
+/**
+ * Built-in council benches (B23).
+ *
+ * `resolveCouncilMembers` (src/utils/config.js) consults this table ONLY when
+ * the requested name is absent from user config (`config.councils`) — user
+ * config always shadows a built-in of the same name. This preserves today's
+ * behavior for the wizard-seeded `councils.free` (src/sidecar/setup.js
+ * seedFreeCouncil): once seeded, the user's `free` list wins over the
+ * built-in dynamic free bench below.
+ *
+ * Two shapes:
+ *   - 'free' is DYNAMIC: resolved at use time from the live catalog via
+ *     suggestFreeCouncil (one :free model per vendor), falling back to the
+ *     offline PINNED_FREE_MODELS when the catalog has no free rows. This
+ *     mirrors the wizard's own free-council derivation so the built-in and
+ *     the wizard-seeded version pick the same kind of members.
+ *   - 'budget' and 'frontier' are STATIC: three DEFAULT_ALIASES entries
+ *     (src/utils/curated-models.js) each, chosen by catalog pricing at
+ *     implementation time (see docs/CHANGELOG or the task report for the
+ *     pricing evidence). Alias-based so `amicus models --check` drift
+ *     tooling and normal alias resolution keep them healthy for free —
+ *     no raw model ids are hardcoded here.
+ */
+'use strict';
+
+const { suggestFreeCouncil, PINNED_FREE_MODELS } = require('./free-models');
+
+/**
+ * Budget bench: three cheapest DEFAULT_ALIASES entries, one per vendor
+ * family, verified against the cached catalog (~/.config/amicus/model-catalog.json)
+ * on 2026-07-02 (prices are $/token, prompt+completion):
+ *   minimax     openrouter/minimax/minimax-m2.7      $0.00000018 / $0.00000072
+ *   qwen-coder  openrouter/qwen/qwen3-coder-next     $0.00000011 / $0.0000008
+ *   deepseek    openrouter/deepseek/deepseek-v4-pro  $0.000000435 / $0.00000087
+ * These are the three lowest total (prompt+completion) prices in
+ * DEFAULT_ALIASES, and each is a distinct vendor family (MiniMax / Qwen /
+ * DeepSeek) — the qwen-flash entry (also cheap) was skipped to keep vendor
+ * diversity across the bench.
+ */
+const BUDGET_ALIASES = ['minimax', 'qwen-coder', 'deepseek'];
+
+/**
+ * Frontier bench: three premium-flagship DEFAULT_ALIASES entries, one per
+ * vendor family, verified against the same catalog snapshot:
+ *   gpt-pro     openrouter/openai/gpt-5.5-pro          $0.00003 / $0.00018
+ *   opus        openrouter/anthropic/claude-opus-4.8   $0.000005 / $0.000025
+ *   gemini-pro  openrouter/google/gemini-3.1-pro-preview  $0.000002 / $0.000012
+ * These are the three highest total (prompt+completion) prices in
+ * DEFAULT_ALIASES that are also each a distinct vendor family (OpenAI /
+ * Anthropic / Google) — `gpt` and `codex` (also OpenAI) and `claude`/`sonnet`
+ * (also Anthropic) were skipped as same-family duplicates of the pick above.
+ */
+const FRONTIER_ALIASES = ['gpt-pro', 'opus', 'gemini-pro'];
+
+/**
+ * @param {Array} catalog live model-catalog rows (for the dynamic free bench)
+ * @returns {string[]} council members (aliases or full ids), possibly empty
+ */
+function resolveFreeBench(catalog) {
+  const picks = suggestFreeCouncil(Array.isArray(catalog) ? catalog : []);
+  if (picks.length > 0) { return picks.map(p => p.id); }
+  return [...PINNED_FREE_MODELS];
+}
+
+/**
+ * @param {string} name
+ * @param {Array} [catalog] live model-catalog rows, needed only for 'free'
+ * @returns {string[]|null} resolved built-in members, or null if `name` is not a built-in
+ */
+function resolveBuiltinCouncil(name, catalog = []) {
+  if (name === 'free') { return resolveFreeBench(catalog); }
+  if (name === 'budget') { return [...BUDGET_ALIASES]; }
+  if (name === 'frontier') { return [...FRONTIER_ALIASES]; }
+  return null;
+}
+
+/** @returns {string[]} built-in bench names, in resolution-doc order */
+function listBuiltinCouncilNames() {
+  return ['free', 'budget', 'frontier'];
+}
+
+module.exports = {
+  BUDGET_ALIASES,
+  FRONTIER_ALIASES,
+  resolveBuiltinCouncil,
+  listBuiltinCouncilNames,
+};