amicus 4.7.1 → 4.8.1

package/src/sidecar/setup.js

@@ -51,7 +51,11 @@ function createDefaultConfig(defaultModel) {
   const cfg = {
     ...existing,
     default: existing.default || defaultModel,
-    aliases: { ...getDefaultAliases(), ...(existing.aliases || {}) },
+    // Same restatement as the readline gate below (fix round 3, G-2): a spread
+    // into `{}` re-materialises Object.prototype. `saveConfig` rebuilds this
+    // into its own literal anyway, so this one is defense in depth rather than
+    // a measured hole — recorded as such rather than claimed as a fix.
+    aliases: { __proto__: null, ...getDefaultAliases(), ...(existing.aliases || {}) },
   };
   saveConfig(cfg);
   logger.info('Default config ensured', {
@@ -128,7 +132,14 @@ function resolveChoice(input, picks, catalog) {
     return { modelId: input };
   }
   const cfg = loadConfig();
-  const aliases = { ...getDefaultAliases(), ...((cfg && cfg.aliases) || {}) };
+  // ⚠️ `__proto__: null` — v4.8 SI-22.4 fix round 3 (council G-2). `input` here
+  // is FREE-FORM readline text, and the gate below is `aliases[input] !==
+  // undefined`, so on a plain literal `toString` / `valueOf` / `constructor` /
+  // `hasOwnProperty` all measured TRUE and returned `{alias: input, noUpgrade:
+  // true}` — setup accepted them as existing aliases. Spreading a
+  // null-prototype object into a bare `{}` produces a PLAIN object again, so the
+  // curated-models fix does not reach this literal; the seed has to be restated.
+  const aliases = { __proto__: null, ...getDefaultAliases(), ...((cfg && cfg.aliases) || {}) };
   if (aliases[input] !== undefined) {
     return { alias: input, noUpgrade: true };
   }
@@ -342,6 +353,73 @@ async function printDoctorFinale(deps = {}) {
   }
 }
 
+/**
+ * #138 second level: after a family pick, let the user name a SPECIFIC model
+ * from that vendor. Returns the chosen catalog id, or null to keep the
+ * family default (bare Enter, an empty shortlist, or two invalid entries).
+ *
+ * The prompt deliberately avoids the substring "Pick a number":
+ * tests/sidecar/setup.test.js:392,475 branch on that literal and would
+ * answer '' here, leaving new coverage green but vacuous.
+ * @param {(q: string) => Promise<string>} ask
+ * @param {(line: string) => void} print
+ * @param {{suggested: Array<object>, rest: Array<object>, total: number}} shortlist
+ * @param {string} vendorPath
+ * @returns {Promise<string|null>}
+ */
+async function promptForVendorModel(ask, print, shortlist, vendorPath) {
+  if (!shortlist || shortlist.total === 0) { return null; }
+
+  let visible = shortlist.suggested;
+  const fmt = (r, i) => {
+    const price = r.pricePerMInput === null ? 'n/a' : `$${r.pricePerMInput.toFixed(2)}/M in`;
+    const ctx = r.contextLength === null || r.contextLength === undefined ? '' : ` · ctx ${r.contextLength}`;
+    return `  ${i + 1}) ${r.id}${ctx} · ${price}${r.isRecommended ? '  (recommended)' : ''}`;
+  };
+
+  const render = () => {
+    print('');
+    print(`Which ${vendorPath} model?`);
+    visible.forEach((r, i) => print(fmt(r, i)));
+    if (visible.length < shortlist.total) {
+      print(`  … ${shortlist.total - visible.length} more`);
+    }
+    print('');
+  };
+  render();
+
+  for (let attempt = 0; attempt < 2; attempt++) {
+    const hint = visible.length < shortlist.total ? ", 'a' for all" : '';
+    const answer = (await ask(
+      `Choose 1-${visible.length}${hint}, a full model id, or Enter to keep the default: `
+    ) || '').trim();
+
+    if (answer === '') { return null; }
+    if (answer.toLowerCase() === 'a' && visible.length < shortlist.total) {
+      visible = shortlist.suggested.concat(shortlist.rest);
+      render();
+      attempt--; // expanding the list is not a failed attempt
+      continue;
+    }
+    if (/^\d+$/.test(answer)) {
+      const n = Number.parseInt(answer, 10);
+      if (n >= 1 && n <= visible.length) { return visible[n - 1].id; }
+    }
+    if (answer.includes('/')) { return answer; }
+    // F1 (council review, PR 196): the final attempt used to fall through
+    // silently -- the loop just exited and the caller kept the family
+    // default with no feedback at all, so the user's last keystroke
+    // visibly did nothing. Both attempts now print, but the last one also
+    // states the consequence instead of implying a further retry.
+    if (attempt === 0) {
+      print(`Invalid choice: "${answer}".`);
+    } else {
+      print(`Invalid choice: "${answer}". Keeping the family default.`);
+    }
+  }
+  return null;
+}
+
 /**
  * Run the readline-based setup wizard (headless fallback)
  *
@@ -475,6 +553,62 @@ async function runReadlineSetup() {
         const fallback = getDefaultAliases()[chosen.alias];
         if (fallback !== undefined) { cfg.aliases[chosen.alias] = fallback; }
       }
+
+      // #138: offer the family -> model second level. `pick.vendorPath` is
+      // the vendor whose catalog rows we drill into; a chosen id REPLACES
+      // the flagship route for this alias only. Guarded — a picker failure
+      // must never abort a setup run that has already collected keys.
+      //
+      // R4a (fix round 2, supersedes R4's noUpgrade disjunct; wording
+      // corrected in the F7 fix wave -- the previous wording claimed the
+      // governing rule was "never ask about the same vendor twice in one
+      // run", which this guard cannot implement and does not):
+      //
+      // `vendorAliasesWritten` holds PROVIDER names (runProviderDefaultPickers
+      // adds each entry of `foundKeys`, e.g. 'google'/'openai'/'anthropic'/
+      // 'deepseek'), while `chosen.alias` is a FAMILY ALIAS name ('gemini',
+      // 'gemini-pro', 'gpt', 'opus', 'deepseek'). The two prompts write
+      // DIFFERENT config keys -- the per-provider picker writes
+      // `config.aliases[provider]` (e.g. `aliases.google`), this drill-down
+      // writes `config.aliases[chosen.alias]` (e.g. `aliases.gemini`) -- so
+      // `!vendorAliasesWritten.has(chosen.alias)` only skips the drill-down
+      // when the alias STRING happens to collide with an already-written
+      // provider name. Today that's 'deepseek' alone (alias 'deepseek' ===
+      // provider 'deepseek'); every other family alias never collides, so
+      // this drill-down still fires for those even after the per-provider
+      // phase ran for that family's vendor -- correctly: the two prompts
+      // bind different keys, they are not "the same vendor twice".
+      //
+      // TRAP: re-keying this guard to `pick.vendorPath` (so it tests the
+      // actual vendor instead of the alias-name coincidence) looks like the
+      // obvious fix for the mismatch above and is NOT one -- it was
+      // measured to delete issue 138's feature entirely for every user
+      // holding a direct key, by skipping the drill-down for every family
+      // whose per-provider picker already ran this session. Leave this
+      // guard exactly as it is.
+      //
+      // `chosen.noUpgrade` does NOT imply no question was asked for this
+      // vendor: a user can type a known alias name (noUpgrade=true) for a
+      // vendor the per-provider phase already walked through this run, and
+      // that must still be skipped. Whenever noUpgrade is true AND the
+      // alias is genuinely unasked-about, `!vendorAliasesWritten.has(...)`
+      // is already true on its own, so dropping the noUpgrade disjunct
+      // loses no legitimate firing case -- only the double-ask.
+      if (pick && !vendorAliasesWritten.has(chosen.alias)) {
+        try {
+          const { buildModelShortlist } = require('../utils/model-shortlist');
+          const shortlist = buildModelShortlist(pick.vendorPath, {
+            catalog,
+            recommendedId: cfg.aliases[chosen.alias],
+          });
+          const specific = await promptForVendorModel(
+            askQuestion.bind(null, rl), console.log, shortlist, pick.vendorPath
+          );
+          if (specific) { cfg.aliases[chosen.alias] = specific; }
+        } catch (err) {
+          console.log(`Note: couldn't list ${pick.vendorPath} models (${err.message}).`);
+        }
+      }
     } else {
       cfg.default = chosen.modelId;
     }
@@ -602,6 +736,7 @@ module.exports = {
   createDefaultConfig,
   deriveFreeAlias,
   detectApiKeys,
+  promptForVendorModel,
   runFreeCouncilBranch,
   runInteractiveSetup,
   runReadlineSetup,

package/src/utils/alias-audit.js

@@ -1,10 +1,21 @@
 /**
- * Alias Audit (F5) — report + suggest, never auto-repair.
+ * Alias Audit (F5) — report + suggest for most classes; doctor --fix auto-repairs one narrow, mechanically-unambiguous class (B3).
  *
  * Finds aliases/routes pointing at models absent from the catalog and
  * suggests current same-vendor replacements. Pure functions over inputs;
  * collectAliasSources() does the gathering. Consumed by `amicus models
  * --check` and the npm wrapper scripts.
+ *
+ * `findFabricatedAliasRepairs()` (B3, council review of PR 198) is the one
+ * exception to "never auto-repair": it detects the single class `doctor
+ * --fix` can safely rewrite unattended -- a bare id `classifyModel` proves
+ * `invalid` on the `direct` gateway AND for which the catalog holds an
+ * unambiguous OpenRouter twin (`pairAcrossGateways`, never string
+ * concatenation) -- still pure detection here; the actual write lives in
+ * `doctor-alias-check.js`'s `repairAlias()`. Every OTHER class this module
+ * finds (typo, retired model, ambiguous twin, drifted-but-live) stays
+ * report-and-suggest only, same as before -- this module does not become a
+ * general auto-repair tool.
  */
 
 'use strict';
@@ -132,7 +143,10 @@ function suggestReplacements(staleModel, catalog, n = 3) {
  * fresh `amicus setup` would seed today — the v4.6.1 release-gate class
  * (stored `gemini` -> 3.1-flash-lite-preview: still catalog-listed so
  * findStaleAliases passes it, no longer what the family resolves to).
- * Report + suggest, never auto-repair (this module's charter).
+ * Report + suggest only -- unlike `findFabricatedAliasRepairs` below (B3's
+ * narrow, mechanically-unambiguous exception), THIS function never
+ * auto-repairs: a drifted-but-live target has no single unambiguous
+ * "correct" answer to converge on the way a fabricated id does.
  *
  * Only user-config rows are checked (defaults/curated follow the catalog by
  * construction), only for aliases that are quick-pick families (a custom
@@ -178,4 +192,68 @@ function findDriftedStoredAliases(sources, catalog) {
     .map(({ alias, model }) => ({ alias, stored: model, current: current.get(alias).display }));
 }
 
-module.exports = { collectAliasSources, findStaleAliases, findDriftedStoredAliases, suggestReplacements };
+/**
+ * B3 (council review of PR 198, issue 195): the narrow, mechanically-
+ * unambiguous class of stored alias `doctor --fix` may repair -- a bare
+ * `<vendor>/<model>` id in a 'user-config' row (what's actually persisted to
+ * `config.aliases`, the only source a repair can rewrite) that
+ * `classifyModel` proves `invalid` on the `direct` gateway AND for which the
+ * catalog contains an unambiguous OpenRouter twin (`pairAcrossGateways` --
+ * never string-concatenation). This is exactly the class the pre-fix
+ * v4.8.0 `chooseRowId`/`applyProviderDefault` could persist (an unconditional
+ * `openrouter/` strip with no catalog evidence); PR 198's
+ * `directFormIfProven` (model-canonicalization.js) now refuses to write it
+ * going forward, so this function finds the ones already ON DISK and
+ * converges them onto the same OpenRouter-prefixed answer the picker would
+ * offer today, rather than inventing a third one.
+ *
+ * Deliberately narrower than findStaleAliases: a typo'd, retired, or
+ * user-invented id also classifies `invalid`, but `pairAcrossGateways` can
+ * only find a twin when the extracted vendor + version token names a REAL
+ * model that still exists, under that exact normalized name, in the
+ * catalog's OpenRouter namespace -- a typo or a genuinely dead model can
+ * never satisfy that. Ambiguous (>1 match) or absent twins are left
+ * untouched -- still reported as stale by findStaleAliases, never repaired.
+ *
+ * DIVERGENT_VENDORS (e.g. anthropic) are excluded on purpose:
+ * model-canonicalization.js gates that set FIRST and unconditionally, so its
+ * predicates never strip a divergent vendor's prefix in the first place --
+ * a bare divergent-vendor alias could not have been produced by the bug
+ * this repairs, so treating one as fabricated here would be inventing a new
+ * class, not converging on the picker's own answer.
+ *
+ * Empty/absent catalog -> [] : classifyModel can only return 'unknown' with
+ * no catalog rows, and 'unknown' never authorises a repair -- no positive
+ * evidence, no write.
+ * @param {Array<{alias:string,model:string,source:string}>} sources
+ * @param {Array<{id:string}>} catalog
+ * @returns {Array<{alias:string,oldId:string,newId:string}>}
+ */
+function findFabricatedAliasRepairs(sources, catalog) {
+  if (!catalog || catalog.length === 0) { return []; }
+  const { classifyModel } = require('./model-classification');
+  const { pairAcrossGateways } = require('./gateway-route-catalog');
+  const { DIVERGENT_VENDORS } = require('./curated-models');
+  const catalogInfo = { models: catalog };
+
+  const out = [];
+  for (const { alias, model, source } of sources) {
+    if (source !== 'user-config') { continue; }
+    if (typeof model !== 'string' || model.startsWith('openrouter/')) { continue; } // not bare
+    const parts = model.split('/');
+    if (parts.length < 2) { continue; } // not a <vendor>/<model> shape
+    const vendor = parts[0];
+    if (DIVERGENT_VENDORS.has(vendor)) { continue; }
+    const versionToken = parts.slice(1).join('/');
+    if (classifyModel(model, 'direct', catalogInfo) !== 'invalid') { continue; }
+    const paired = pairAcrossGateways(vendor, versionToken, catalogInfo);
+    if (!paired.openrouter) { continue; } // ambiguous or absent twin -- leave as a warning
+    out.push({ alias, oldId: model, newId: paired.openrouter });
+  }
+  return out;
+}
+
+module.exports = {
+  collectAliasSources, findStaleAliases, findDriftedStoredAliases, suggestReplacements,
+  findFabricatedAliasRepairs,
+};

package/src/utils/config.js

@@ -60,7 +60,16 @@ function saveConfig(configData) {
   if (configData && configData.aliases) {
     const cleaned = {};
     for (const [key, value] of Object.entries(configData.aliases)) {
-      if (key === 'null' || !value || typeof value !== 'string' || value === 'null') {
+      // `key === '__proto__'` — v4.8 SI-22.4 fix round 3 (council G-5). Without
+      // it the write below (`cleaned[key] = value`) hit Object.prototype's
+      // INHERITED `__proto__` setter, which ignores a string, so the alias
+      // vanished with NO "Removing invalid alias" notice — the only silent
+      // removal in this loop. Rejecting it explicitly puts it on the same
+      // footing as the `'null'` key beside it: same branch, same message.
+      // (No pollution was possible either way — only strings reach this line,
+      // and the setter ignores them — so this is an announcement fix, not a
+      // security one. Stated that way on purpose.)
+      if (key === 'null' || key === '__proto__' || !value || typeof value !== 'string' || value === 'null') {
         process.stderr.write(
           `Notice: Removing invalid alias '${key}' (value: ${JSON.stringify(value)}) from config.\n`
         );
@@ -78,7 +87,14 @@ function saveConfig(configData) {
 
 /** @returns {object} Copy of the default alias map */
 function getDefaultAliases() {
-  return { ...DEFAULT_ALIASES };
+  // ⚠️ `__proto__: null` must be RESTATED here, not inherited. A spread into a
+  // bare `{}` literal produces a plain object again, so fixing the builders in
+  // curated-models.js does NOT reach this copy — measured, not assumed. Its
+  // consumers index it: `sidecar/setup.js:479` (`getDefaultAliases()[alias]`)
+  // and `electron/setup-ui-aliases.js :: buildAliasEditorHTML`
+  // (`aliases[key] !== undefined`).
+  // Named mutant "BUILDERPROTO" covers this line too.
+  return { __proto__: null, ...DEFAULT_ALIASES };
 }
 
 /**
@@ -216,7 +232,44 @@ function checkConfigChanged(currentHash) {
 function getEffectiveAliases() {
   const config = loadConfig();
   const userAliases = (config && config.aliases) || {};
-  return { ...DEFAULT_ALIASES, ...userAliases };
+  // `__proto__: null` — v4.8 SI-22.4 fix round 2 (council B1). This table is
+  // read with BARE INDEXING by five gates, so on a normal object a member
+  // literally named 'toString' / 'constructor' / 'valueOf' / 'hasOwnProperty'
+  // resolved off Object.prototype to a truthy Function and was treated as a
+  // KNOWN ALIAS. Measured, not argued:
+  //   resolveModel('toString')                    -> the Function itself,
+  //       typeof 'function', where every caller expects a model-id STRING
+  //       (`:111` and `:142` gate on `!== undefined`, which a Function passes)
+  //   classifyCouncilMembers(['toString '], [])   -> ACCEPTED, i.e. runnable
+  // The SAME defect class this release already closed at other lookup tables —
+  // `tally.js :: VERDICTS`, `report.js :: SYMBOL`, `debate.js :: PAST_TENSE`
+  // (all `__proto__: null`), plus `street-cred.js :: perJudgeRank` and
+  // `report.js :: ROLE_SUFFIX` (both `Object.create(null)`, the same guarantee
+  // in the other spelling). The ALIAS table was not among them.
+  // ⚠️ SI-22.4 WIDENED it and that is why it is fixed here: at BASE the padded
+  // spelling ('toString ') missed the prototype and was correctly dropped;
+  // trimming before the lookup landed it on the inherited property. The
+  // unpadded spelling was already accepted, so restoring only the padded case
+  // would take more code AND deliberately preserve a known hole.
+  // ⚠️ Fixed HERE, not at the call sites — one line closes all five, each
+  // MEASURED at its own gate expression with `'toString'` (not inferred from
+  // this one): `resolveModel` `:111`/`:142` (`!== undefined` true→false) ·
+  // `classifyCouncilMembers` (accepted→dropped, end to end) ·
+  // `council/presets-cli.js:41` (`amicus council save`: unresolved false→true) ·
+  // `pack/pack-validate.js:71` (`seatOk` true→false) ·
+  // `utils/route-launch.js:205` (`isAlias` true→false).
+  // No consumer breaks: every reference either indexes (`aliases[key]`) or
+  // iterates own-enumerable keys (`Object.entries`/`Object.keys` —
+  // `buildProviderModels`, `formatAliasNames`, `mcp-tools.js :: getGuideText`,
+  // `sidecar/models.js :: aliasMarks`), and both behave identically on a
+  // null-prototype object. NOTHING calls a method ON the object — swept
+  // uncapped over `src/` and `electron/` for `aliases.<x>`, `in aliases`,
+  // `Object.values`, `JSON.stringify`, spread and `for…in`.
+  // A `__proto__` key inside the user's own config.json is copied as an ORDINARY
+  // own property by spread (never the setter), so the prototype stays null —
+  // measured on both a literal and a `JSON.parse`d source.
+  // Named mutant "PROTOALIASES": drop `__proto__: null` from the literal below.
+  return { __proto__: null, ...DEFAULT_ALIASES, ...userAliases };
 }
 
 /**
@@ -414,11 +467,42 @@ function getCouncilWithSource(name, catalog = []) {
  * at the last refresh; the leg itself fails pre-flight with the actionable
  * local_endpoint_unreachable error if it is truly down). Only a NON-EMPTY
  * catalog that omits the resolved id is a definitive drop.
- * @param {string[]} members raw council members (aliases or provider/model ids)
+ *
+ * WHITESPACE (v4.8 SI-22.4). Each member is TRIMMED before it is classified,
+ * closing a divergence: `--models` already trimmed
+ * (`sidecar/fanout-validate.js :: parseModelsList`, and `cli-council-run-bench.js
+ * :: parseList` on the council surface) while `--council` did not, so the same
+ * stray space was benign on one flag and, here, converted a typo into a dropped
+ * member and a degraded (2) exit. ⚠️ The dominant effect is RESURRECTION, not
+ * de-duplication: a padded member that is dropped today starts RUNNING, which
+ * is a new paid leg. Where the trim makes two members collide, the bench
+ * becomes a real twin and `seats.js :: buildSeats` mints `alias#N` for both.
+ * An all-whitespace member trims to `''`, which no alias table names, so gate 1
+ * below drops it — the `.filter(Boolean)` half of `parseModelsList`'s shape,
+ * reached without a third `reason` string (see the tripwire note below).
+ * @param {string[]} members council members as configured — aliases or
+ *   provider/model ids, trimmed per member here. ⚠️ This is the only place the
+ *   preset READ path trims — NOT the only place the preset path trims at all,
+ *   and NOT the only trim a member meets. The WRITE side already trimmed:
+ *   `council/presets-cli.js:34` (`amicus council save`) stores
+ *   `.split(',').map(m => m.trim()).filter(Boolean)`, and the only other writer
+ *   of `cfg.councils` in `src/` (`sidecar/setup.js:593`, the seeded `free`
+ *   council) composes its members from generated/existing alias KEYS, which
+ *   cannot carry user padding. So a padded member in `cfg.councils` comes from
+ *   a hand-edited `config.json`, and that is the case this trim serves.
+ *   Downstream, both council
+ *   surfaces re-join the expanded bench and re-parse it downstream —
+ *   `cli-handlers-fanout.js:91` → `:119` → `sidecar/fanout.js ::
+ *   validateFanoutModels` → `parseModelsList`, and `mcp-council-run.js:177` →
+ *   the spawned child's `cli-council-run-bench.js :: parseList` — so a member
+ *   that somehow kept padding past this point would still be trimmed there
  * @param {Array<{id:string}>} [catalog]
  * @returns {{models:string[], dropped:string[], droppedMembers:Array<{member:string, reason:string}>}}
  *   `dropped` is the flat member-ref list (unchanged shape, pre-v4.5-Wave-2
  *   callers keep working); `droppedMembers` additively pairs each with WHY.
+ *   ⚠️ Both report the member RAW — untrimmed, byte-for-byte as configured
+ *   (v4.8 SI-22.4, R22.4-2) — so a user can find the offending string in their
+ *   own config. Only `models` carries the trimmed value.
  *
  *   Standing note (D18, v4.7 PR5): each `droppedMembers` entry is `{member, reason}`
  *   (that is the real key — BACKLOG.md's description of this shape had drifted to
@@ -442,18 +526,29 @@ function classifyCouncilMembers(members, catalog = []) {
   const models = [];
   const dropped = [];
   const droppedMembers = [];
-  for (const member of members) {
+  for (const raw of members) {
+    // v4.8 SI-22.4. Trim BEFORE gate 1 below, never after: a padded ALIAS
+    // ('gpt ') must reach the alias table as written in the table, and a padded
+    // full id ('openai/gpt-5 ') must reach the catalog lookup clean. Trimming
+    // downstream of either gate would leave both misses in place. Non-strings
+    // pass through untouched so their `.includes` still throws exactly as it
+    // did before this line existed. Named mutant "NOTRIM": drop the `.trim()`.
+    const member = typeof raw === 'string' ? raw.trim() : raw;
     const id = member.includes('/') ? member : aliases[member];
+    // R22.4-2: `models` gets the TRIMMED value, `dropped`/`droppedMembers` get
+    // `raw` — a member still dropped after trimming is reported as the user
+    // wrote it, or they cannot grep their own config for it. Named mutant
+    // "TRIMDROPPED": report `member` instead of `raw` in the two drop branches.
     if (!id) { // alias no longer resolves
-      dropped.push(member);
-      droppedMembers.push({ member, reason: 'alias no longer resolves to a known model' });
+      dropped.push(raw);
+      droppedMembers.push({ member: raw, reason: 'alias no longer resolves to a known model' });
       continue;
     }
     const vendor = typeof id === 'string' ? id.split('/')[0] : '';
     if (isLocalProvider(vendor)) { models.push(member); continue; }
     if (known.size > 0 && !known.has(id)) { // delisted model
-      dropped.push(member);
-      droppedMembers.push({ member, reason: 'resolved id is not present in the cached model catalog' });
+      dropped.push(raw);
+      droppedMembers.push({ member: raw, reason: 'resolved id is not present in the cached model catalog' });
       continue;
     }
     models.push(member);
@@ -465,8 +560,11 @@ function classifyCouncilMembers(members, catalog = []) {
  * Expand a saved council into a runnable members list, degrading gracefully.
  * Unresolvable aliases and delisted ids are dropped with a warning rather than
  * fail-fast-aborting the whole wave (classification: classifyCouncilMembers
- * above). Returns members RAW (alias or id) — leg-time validation resolves
- * them again.
+ * above). Returns members UNRESOLVED (the alias or id as configured, never the
+ * id an alias maps to) — leg-time validation resolves them again. ⚠️ Not
+ * byte-identical to the configured string since v4.8 SI-22.4: classification
+ * trims each member, so `models[i]` is the configured member minus any
+ * surrounding whitespace. `dropped`/`droppedMembers` still carry it raw.
  *
  * Resolution order: user config (`config.councils`) is checked first; when
  * `name` is absent there, the built-in benches (`free`/`budget`/`frontier`)

package/src/utils/curated-models.js

@@ -111,6 +111,13 @@ const CARDLESS = [
   { alias: 'grok', routes: { openrouter: 'openrouter/x-ai/grok-4.3' } },
   { alias: 'kimi', routes: { openrouter: 'openrouter/moonshotai/kimi-k2.6' } },
   { alias: 'seed', routes: { openrouter: 'openrouter/bytedance-seed/seed-2.0-lite' } },
+  // inkling added 2026-08-14: the council-review workflow's default bench
+  // names it, and this table is the FLOOR a runner falls back to when no
+  // alias map is provisioned (workflow_call callers, forks) — there, a
+  // locally defined alias still resolves to nothing. Pinned to the full
+  // model, not `inkling-small`: the bench seat wants the flagship's
+  // judgment. `:batch` is not pinned (wrong for an interactive council leg).
+  { alias: 'inkling', routes: { openrouter: 'openrouter/thinkingmachines/inkling' } },
 ];
 
 /**
@@ -242,7 +249,14 @@ function directFormProvenance() {
  * without corrupting divergent-vendor ids (e.g. Anthropic's dash format).
  */
 function toGatewayRoutes() {
-  const out = {};
+  // `__proto__: null` — v4.8 SI-22.4 round 3 (G-1). Read by BARE INDEXING
+  // downstream, so a plain `{}` let an alias named 'toString'/'constructor'/
+  // 'valueOf'/'hasOwnProperty' resolve off Object.prototype to a truthy
+  // Function — including on the auto-repair path (`alias-resolver.js ::
+  // autoRepairAlias`), which `getEffectiveAliases`'s own fix could never reach.
+  // Full measurement + why THREE seeds were needed:
+  // tests/council/preset-trim-mutants.js :: BUILDERPROTO (the named mutant).
+  const out = { __proto__: null };
   for (const f of FAMILIES) { out[f.alias] = gatewayRoutesFor(f.vendorPath, f.fallback); }
   for (const e of CARDLESS) { out[e.alias] = gatewayRoutesFor(vendorOf(e.routes.openrouter), e.routes); }
   return out;
@@ -262,7 +276,8 @@ function toGatewayRoutes() {
  * shipped defaults.
  */
 function toDefaultAliases() {
-  const out = {};
+  // `__proto__: null` — see toGatewayRoutes above. Becomes DEFAULT_ALIASES.
+  const out = { __proto__: null };
   for (const [alias, routes] of Object.entries(toGatewayRoutes())) {
     out[alias] = routes.direct || routes.openrouter;
   }

package/src/utils/degrade.js

@@ -17,6 +17,11 @@ const DEGRADE_CHANNELS = Object.freeze(new Set([
   'dropped-members', 'chair-skipped-cost-ceiling', 'chair-failed',
   'thin-cross-review', 'debate-degraded', 'inexact-under-ceiling',
   'stage1-retry',
+  // v4.8: the seat<->leg join failed. THREE shapes, one channel: a launched seat whose wave
+  // returned legs but none its own; a returned leg matching no roster slot; and (T5.5, `-rv` only)
+  // a leg that DID match a slot but whose join key names no judge the wave launched.
+  // Never a guess — silent mis-attribution is the failure seat identity exists to kill (§4.4).
+  'seat-unbound',
   'internal',
   // doctor channels
   'doctor-check-failed', 'doctor-fix',

package/src/utils/doctor-alias-check.js

@@ -0,0 +1,152 @@
+// src/utils/doctor-alias-check.js
+'use strict';
+
+/**
+ * @module utils/doctor-alias-check
+ * The `aliases` doctor check ("Model aliases"), split out of
+ * src/cli-handlers-doctor.js to keep that file under the 300-line gate
+ * (mirrors doctor-engine-check.js / doctor-electron-mcp-check.js /
+ * doctor-base-url-check.js / doctor-local-providers-check.js -- same reason,
+ * a different check).
+ *
+ * B3 (council review of PR 198, issue 195): `doctor --fix` repairs exactly
+ * one narrow class of stored alias -- see alias-audit.js's
+ * `findFabricatedAliasRepairs` for the detection rule (classifies `invalid`
+ * on the `direct` gateway AND has an unambiguous OpenRouter twin) and why it
+ * cannot false-positive a typo, a retired model, or a user-invented id.
+ * Repair = rewrite `config.aliases[alias]` to that catalog-confirmed
+ * OpenRouter id -- read-modify-write, no-clobber (mirrors
+ * `applyProviderDefault`, provider-default-picker.js). Every OTHER
+ * stale/drifted alias is left untouched and stays a warning, hinting at
+ * `amicus models --check` same as before this PR.
+ *
+ * A3 (council review of PR 198): the repair ACTION additionally requires the
+ * cached catalog to be FRESH (same `MAX_CATALOG_AGE_MS` window as doctor's
+ * own `catalog` check, cli-handlers-doctor.js). `readCache()` here reads the
+ * exact same cache doctor's `catalog` check may independently report as
+ * `stale (Nh old)` -- without this gate, `--fix` would rewrite a user's
+ * config from data the SAME run just called untrustworthy. A stale catalog
+ * can be missing rows that would make a "fabricated" id look repairable when
+ * it is merely unfetched, so a stale catalog declines the repair (explaining
+ * why via `repairFabricatedAliasStaleCatalog`) rather than writing on
+ * unverified evidence; detection/reporting is unaffected either way.
+ */
+
+const HINTS = require('./remediation-hints');
+
+// Mirrors cli-handlers-doctor.js's own MAX_CATALOG_AGE_MS (which itself
+// mirrors model-catalog.js's DEFAULT_MAX_AGE_MS) -- duplicated rather than
+// imported to avoid a require cycle (cli-handlers-doctor.js requires this
+// module at load time, before its own module.exports exists).
+const MAX_CATALOG_AGE_MS = 24 * 60 * 60 * 1000; // 24h
+
+/**
+ * @param {{fetchedAt?: number}|null} cache
+ * @returns {boolean} true when `cache` exists, has a numeric `fetchedAt`, and
+ *   is no older than `MAX_CATALOG_AGE_MS` -- the same test doctor's `catalog`
+ *   check applies to decide `ok` vs `stale (Nh old)`.
+ */
+function isCatalogFresh(cache) {
+  if (!cache || typeof cache.fetchedAt !== 'number') { return false; }
+  return (Date.now() - cache.fetchedAt) <= MAX_CATALOG_AGE_MS;
+}
+
+/**
+ * Rewrite one alias's stored value in place. Read-modify-write / no-clobber
+ * -- preserves `config.default` and every other alias/key (same contract as
+ * `applyProviderDefault`, provider-default-picker.js).
+ * @param {string} alias
+ * @param {string} newId verbatim catalog id (an OpenRouter-namespace id from
+ *   `pairAcrossGateways` -- never hand-derived by string concatenation)
+ */
+function repairAlias(alias, newId) {
+  const { loadConfig, saveConfig } = require('./config');
+  const config = loadConfig() || {};
+  if (!config.aliases || typeof config.aliases !== 'object') { config.aliases = {}; }
+  config.aliases[alias] = newId;
+  saveConfig(config);
+}
+
+/** One pass: sources + both existing audits + the repairable set, over the same catalog. */
+function computeState(d, catalog) {
+  const sources = d.collectAliasSources();
+  return {
+    sources,
+    stale: d.findStaleAliases(sources, catalog),
+    drifted: d.findDriftedStoredAliases(sources, catalog),
+    repairable: d.findFabricatedAliasRepairs(sources, catalog),
+  };
+}
+
+/**
+ * @param {{readCache: () => ({models?: Array}|null), collectAliasSources: () => Array,
+ *   findStaleAliases: (s:Array, c:Array) => Array, findDriftedStoredAliases: (s:Array, c:Array) => Array,
+ *   findFabricatedAliasRepairs: (s:Array, c:Array) => Array<{alias:string,oldId:string,newId:string}>,
+ *   fix?: boolean, repairAlias?: (alias:string, newId:string) => void}} d
+ * @returns {{id,name,status,message,hint,fixed?,fixDetail?}}
+ */
+function evaluateAliasesCheck(d) {
+  const id = 'aliases';
+  const name = 'Model aliases';
+  const cache = d.readCache();
+  const catalog = (cache && cache.models) || [];
+  const catalogFresh = isCatalogFresh(cache);
+
+  let state = computeState(d, catalog);
+  let fixFields = {};
+
+  // Only under --fix, only when there is something in the narrow,
+  // mechanically-unambiguous class to repair (rule 1), and only on a FRESH
+  // catalog (A3) -- a failed individual rewrite is best-effort -- it simply
+  // stays a warning, same as one findStaleAliases could never resolve.
+  if (d.fix && state.repairable.length > 0 && catalogFresh) {
+    const repaired = [];
+    for (const r of state.repairable) {
+      try { d.repairAlias(r.alias, r.newId); repaired.push(r); }
+      catch { /* best-effort -- an unrepaired alias just stays a warning below */ }
+    }
+    if (repaired.length > 0) {
+      // Rule 6: announce every repair, naming the alias and both ids -- this
+      // fixDetail flows into the 'heal' degrade's `why` field (doctor-degrade.js).
+      const detail = repaired.map((r) => `'${r.alias}' (${r.oldId} -> ${r.newId})`).join('; ');
+      fixFields = {
+        fixed: true,
+        fixDetail: `rewrote ${repaired.length} fabricated alias(es) to its catalog-confirmed OpenRouter id: ${detail}`,
+      };
+      // Rule 5 (idempotency): recompute from a fresh config read so both this
+      // run's message and a second --fix run see the post-repair reality, not
+      // the pre-repair snapshot -- a repaired alias must not still count as
+      // stale/repairable below.
+      state = computeState(d, catalog);
+    }
+  }
+
+  const { stale, drifted, repairable } = state;
+  if (stale.length === 0 && drifted.length === 0) {
+    return {
+      id, name, status: 'ok',
+      message: catalog.length ? 'all resolve' : 'catalog empty — not checked', hint: null,
+      ...fixFields,
+    };
+  }
+  const parts = [];
+  if (stale.length) { parts.push(`${stale.length} stale: ${stale.map((s) => s.alias).join(', ')}`); }
+  if (drifted.length) { parts.push(`${drifted.length} drifted: ${drifted.map((s) => s.alias).join(', ')}`); }
+  // Rule 1: without --fix, report the repairable count and the hint, change
+  // nothing. A3: when the catalog is stale, say so explicitly rather than
+  // offering a fix that will silently decline to write.
+  if (repairable.length) {
+    parts.push(catalogFresh
+      ? `${repairable.length} fixable via doctor --fix`
+      : `${repairable.length} fixable via doctor --fix once the catalog is refreshed (catalog is stale)`);
+  }
+  return {
+    id, name, status: 'warn', message: parts.join('; '),
+    hint: repairable.length === 0
+      ? 'amicus models --check'
+      : (catalogFresh ? HINTS.repairFabricatedAlias : HINTS.repairFabricatedAliasStaleCatalog),
+    ...fixFields,
+  };
+}
+
+module.exports = { evaluateAliasesCheck, repairAlias };