muonroi-cli 1.8.4 → 1.8.5

package/dist/src/agent-harness/mock-model.d.ts

@@ -48,6 +48,34 @@ export interface MockModelFixture {
     provider?: string;
     /** Reported model id. Default "mock-model". */
     modelId?: string;
+    /**
+     * Response for PIL's model-first intent classifier (src/pil/llm-classify.ts).
+     * Since the no-regex refactor (2026-07-07) PIL classifies EVERY turn by
+     * calling the model with a distinctive system prompt ("Reply with ONE line of
+     * EIGHT lowercase words…") and parses a comma-separated line. The generic
+     * fixture stream ("Hello back!" / arbitrary chunks) does not parse → the turn
+     * degrades to intentKind=UNKNOWN, which skips the gsd gate and breaks routing
+     * in E2E specs. The mock detects that classify call by its system prompt and
+     * returns THIS line instead of consuming the turn fixture — so every spec gets
+     * a sane classification for free. Override per-fixture when a spec needs a
+     * specific taskType/intent/depth. Format:
+     *   <taskType>,<style>,<intent>,<deliverable>,<depth>,<scope>,<lang>,<clarity>
+     */
+    classify?: string;
+    /**
+     * Opt in to the PIL-classifier intercept described on `classify`. When true,
+     * a `doStream` call carrying the classifier's system prompt is answered with
+     * `classify` (or DEFAULT_CLASSIFY_LINE) WITHOUT consuming a turn fixture.
+     *
+     * This is a convenience for the file-based E2E harness (`loadMockModelFromDir`
+     * sets it true by default) whose fixtures supply agent turn-rounds and must
+     * not spend a round on the classify call. Direct in-memory callers
+     * (`createMockModel`/`installMockModel`, e.g. llm-classify.test.ts) leave it
+     * OFF so the fixture stream they configure IS delivered to the classifier —
+     * otherwise every classification would collapse to DEFAULT_CLASSIFY_LINE.
+     * Setting `classify` implies opting in.
+     */
+    autoClassify?: boolean;
 }
 export interface MockModelHandle {
     /** The mock model instance — assign to `globalThis.__muonroiMockModel`. */

package/dist/src/agent-harness/mock-model.js

@@ -25,6 +25,40 @@
 import { APICallError } from "@ai-sdk/provider";
 import { simulateReadableStream } from "ai";
 import { MockLanguageModelV3 } from "ai/test";
+/**
+ * System-prompt substring that uniquely identifies PIL's model-first intent
+ * classifier call (see SYSTEM_PROMPT in src/pil/llm-classify.ts). Kept in sync
+ * with that constant's opening line.
+ */
+const CLASSIFY_SIGNATURE = "Reply with ONE line of EIGHT lowercase words";
+/**
+ * Safe default classification: a non-chitchat coding task of standard depth.
+ * `intent=task` keeps the toolset + gsd gate active; `standard` depth avoids
+ * forcing heavy-only paths. First word MUST be a valid taskType.
+ */
+const DEFAULT_CLASSIFY_LINE = "generate, balanced, task, code, standard, local, english, clear";
+/** Concatenated text of every `system` message in a doStream call's prompt. */
+function systemPromptText(options) {
+    const prompt = options.prompt;
+    if (!Array.isArray(prompt))
+        return "";
+    const parts = [];
+    for (const msg of prompt) {
+        const m = msg;
+        if (m.role !== "system")
+            continue;
+        if (typeof m.content === "string")
+            parts.push(m.content);
+        else if (Array.isArray(m.content)) {
+            for (const c of m.content) {
+                const t = c.text;
+                if (typeof t === "string")
+                    parts.push(t);
+            }
+        }
+    }
+    return parts.join("\n");
+}
 function isNestedArray(v) {
     return Array.isArray(v) && v.length > 0 && Array.isArray(v[0]);
 }
@@ -44,10 +78,34 @@ export function createMockModel(fx) {
     let genIdx = 0;
     const provider = fx.provider ?? "mock";
     const modelId = fx.modelId ?? "mock-model";
+    const classifyLine = fx.classify ?? DEFAULT_CLASSIFY_LINE;
+    // Intercept the PIL classifier call ONLY when the fixture opts in (E2E
+    // harness fixtures do, via loadMockModelFromDir). Direct in-memory callers
+    // (llm-classify.test.ts) leave it off so the stream they configure IS
+    // delivered to the classifier — intercepting would override their reply with
+    // DEFAULT_CLASSIFY_LINE and make every classification collapse to "generate".
+    const interceptClassify = fx.autoClassify === true || fx.classify !== undefined;
     const model = new MockLanguageModelV3({
         provider,
         modelId,
-        doStream: async () => {
+        doStream: async (options) => {
+            // PIL model-first classifier call — answer with the parseable eight-word
+            // line and DO NOT advance the turn-fixture cursor, so the classify call
+            // (which fires on every turn) never steals the round chunks meant for the
+            // agent's actual reply. Without this the generic fixture text fails
+            // parseResponse → intentKind=UNKNOWN → gsd gate/routing break in E2E.
+            if (interceptClassify && systemPromptText(options).includes(CLASSIFY_SIGNATURE)) {
+                if (process.env.MUONROI_DEBUG_MOCK_MODEL === "1") {
+                    process.stderr.write(`[mock-model] doStream classify → "${classifyLine}"\n`);
+                }
+                return {
+                    stream: simulateReadableStream({
+                        chunks: textOnlyStream(classifyLine),
+                        initialDelayInMs: null,
+                        chunkDelayInMs: null,
+                    }),
+                };
+            }
             const chunks = streams[Math.min(callIdx, streams.length - 1)];
             callIdx += 1;
             if (process.env.MUONROI_DEBUG_MOCK_MODEL === "1") {
@@ -397,6 +455,10 @@ export async function loadMockModelFromDir(dir) {
         // to createMockModel, so the AI SDK stream-loop and orchestrator see a
         // consistent Error shape regardless of fixture serialization.
         const normalized = {
+            // File-based E2E fixtures supply agent turn-rounds; auto-answer the PIL
+            // classifier call so it never consumes a round (a fixture may still set
+            // autoClassify:false to opt out, or classify:"…" to force a line).
+            autoClassify: true,
             ...raw.model,
             stream: isNestedArray(raw.model.stream)
                 ? raw.model.stream.map(normalizeStreamChunks)

package/dist/src/agent-harness/test-spawn.js

@@ -19,6 +19,35 @@ import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { createServer } from "node:net";
 // ---------------------------------------------------------------------------
+// Internal: teardown-safe stream error guards
+// ---------------------------------------------------------------------------
+/**
+ * Attach `'error'` listeners to both transport streams so a broken-pipe write
+ * (EPIPE / UV_EPIPE -4047 on Windows) or a peer reset (ECONNRESET) during
+ * process teardown is logged and swallowed instead of surfacing as an
+ * *uncaught* stream error that crashes the whole vitest worker.
+ *
+ * Root cause of the flake: when the child is killed in `afterAll`, an in-flight
+ * `inWrite.write()` (driver sendKey/sendType) or a half-open `outRead` races the
+ * child's death. A WritableStream with no `'error'` listener rethrows EPIPE as
+ * an unhandled exception — under full-suite load this reliably reproduces on
+ * `events.spec.ts` and fails the file even though every assertion passed.
+ *
+ * Logging (not silent swallow) satisfies the No-Silent-Catch rule — teardown
+ * broken-pipe is expected, but a mid-test error still gets a diagnostic line.
+ */
+function attachStreamErrorGuards(inWrite, outRead) {
+    const guard = (label) => (err) => {
+        // EPIPE / ECONNRESET / ERR_STREAM_DESTROYED are all normal teardown races.
+        const code = err?.code ?? "unknown";
+        if (code !== "EPIPE" && code !== "ECONNRESET" && code !== "ERR_STREAM_DESTROYED") {
+            console.error(`[test-spawn] ${label} stream error (${code}): ${err?.message}`);
+        }
+    };
+    inWrite.on("error", guard("inWrite"));
+    outRead.on("error", guard("outRead"));
+}
+// ---------------------------------------------------------------------------
 // Internal: Windows named-pipe transport
 // ---------------------------------------------------------------------------
 function makePipeName(role) {
@@ -143,6 +172,7 @@ async function spawnWindows(args, opts) {
         outServer.close();
     };
     proc.once("exit", cleanup);
+    attachStreamErrorGuards(inSocket, outSocket);
     return {
         proc,
         inWrite: inSocket, // host writes commands → child reads on MUONROI_HARNESS_IN_PIPE
@@ -161,6 +191,7 @@ function spawnPosix(args, opts) {
     const proc = spawn("bun", ["run", ...args], spawnOptions);
     const outRead = proc.stdio[3];
     const inWrite = proc.stdio[4];
+    attachStreamErrorGuards(inWrite, outRead);
     return { proc, inWrite, outRead, cleanup: () => { } };
 }
 // ---------------------------------------------------------------------------

package/dist/src/cli/config/screen-providers.js

@@ -9,7 +9,7 @@ import { A, captureKey, divider, enterRawMode, hiddenPrompt, maskKey } from "./t
  * until their integration is hardened — the router can still target them
  * programmatically. To re-expose one, add its id here.
  */
-const VISIBLE_PROVIDERS = ["deepseek", "siliconflow"];
+const VISIBLE_PROVIDERS = ["deepseek", "zai", "opencode-go", "xai"];
 const ALL_PROVIDERS = [...VISIBLE_PROVIDERS, "ollama"];
 void KEYCHAIN_PROVIDER_IDS;
 async function loadRows() {

package/dist/src/cli/cost-forensics.d.ts

@@ -35,6 +35,16 @@ export interface CostForensicsSummary {
     totalCostUsd: number;
     cacheHitRatio: number;
     peakSingleCallInput: number;
+    /**
+     * Peak FRESH (uncached) input on any single usage event — `max(input -
+     * cacheRead)`. This is the cap-escape discriminator: `task`/`council` rows
+     * store `totalUsage` AGGREGATED across a streamText call's internal steps, so
+     * a high `peakSingleCallInput` on those sources is usually cached-prefix reuse
+     * across steps (high cache hit), NOT a single call that breached the cap. A
+     * genuine cold cap-escape sends >cap FRESH tokens in one call, which shows up
+     * here regardless of source.
+     */
+    peakSingleCallFresh: number;
     events: CostForensicsRow[];
     /** Anti-mù counters for this session (null when none recorded). */
     experience: SessionExperienceCounts | null;

package/dist/src/cli/cost-forensics.js

@@ -83,6 +83,7 @@ export function collectCostForensics(sessionId) {
     let totalCacheCreation = 0;
     let totalCostMicros = 0;
     let peakSingleCallInput = 0;
+    let peakSingleCallFresh = 0;
     for (const e of events) {
         totalInput += e.inputTokens;
         totalOutput += e.outputTokens;
@@ -91,6 +92,9 @@ export function collectCostForensics(sessionId) {
         totalCostMicros += e.costMicros;
         if (e.inputTokens > peakSingleCallInput)
             peakSingleCallInput = e.inputTokens;
+        const fresh = Math.max(0, e.inputTokens - e.cacheReadTokens);
+        if (fresh > peakSingleCallFresh)
+            peakSingleCallFresh = fresh;
     }
     const cacheable = totalInput;
     const cacheHitRatio = cacheable > 0 ? totalCacheRead / cacheable : 0;
@@ -106,6 +110,7 @@ export function collectCostForensics(sessionId) {
         totalCostUsd: totalCostMicros / 1_000_000,
         cacheHitRatio,
         peakSingleCallInput,
+        peakSingleCallFresh,
         events,
         experience: selectSessionExperience(sessionId),
     };
@@ -159,7 +164,8 @@ export function printCostForensics(summary, opts = {}) {
     w(`Total output tokens: ${formatNum(summary.totalOutput)}`);
     w(`Cache read tokens:   ${formatNum(summary.totalCacheRead)} (${formatPct(summary.cacheHitRatio)} of input)`);
     w(`Cache create tokens: ${formatNum(summary.totalCacheCreation)}`);
-    w(`Peak single call:    ${formatNum(summary.peakSingleCallInput)} input`);
+    w(`Peak single call:    ${formatNum(summary.peakSingleCallInput)} input ` +
+        `(${formatNum(summary.peakSingleCallFresh)} fresh)`);
     w(`Estimated cost:      $${summary.totalCostUsd.toFixed(4)}`);
     // Cache-cadence diagnostic — surface fast-loop prompt-cache latency loss.
     const cadence = computeCacheCadence(summary.events);
@@ -199,8 +205,17 @@ export function printCostForensics(summary, opts = {}) {
     }
     // Acceptance hints — surface anomalies relative to Phase A/B/C targets.
     const anomalies = [];
-    if (summary.peakSingleCallInput > 80_000) {
-        anomalies.push(`peak single-call input ${formatNum(summary.peakSingleCallInput)} > 80,000 — sub-agent cap may not have kicked in (Phase B target breach)`);
+    // Phase B breach = a single call that sent >80K FRESH (uncached) tokens.
+    // Use FRESH, not raw input: `task`/`council` usage rows store `totalUsage`
+    // aggregated across a streamText call's internal steps, so a high raw input
+    // there is normally cached-prefix reuse across steps (high cache hit), NOT a
+    // cold cap breach. Evidence: session 6f17a13c1591 peaked at 378,613 raw input
+    // but only 54,389 fresh (324,224 cache-read) — aggregate reuse, no breach.
+    if (summary.peakSingleCallFresh > 80_000) {
+        anomalies.push(`peak single-call FRESH input ${formatNum(summary.peakSingleCallFresh)} > 80,000 — sub-agent cap may not have kicked in (Phase B target breach)`);
+    }
+    else if (summary.peakSingleCallInput > 80_000) {
+        anomalies.push(`peak single-call input ${formatNum(summary.peakSingleCallInput)} > 80,000 but only ${formatNum(summary.peakSingleCallFresh)} FRESH — aggregate multi-step reuse (task/council totalUsage), NOT a cap breach`);
     }
     if (summary.events.some((e) => e.messageSeq === null && e.source === "message")) {
         anomalies.push(`some 'message' events have NULL message_seq — Phase A5 message write-ahead bypassed (check persistMessageWriteAhead wiring)`);

package/dist/src/cli/keys-bundle.d.ts

@@ -7,7 +7,7 @@
  * Format (JSON):
  *   { v:1, kdf:"scrypt", salt:hex, iv:hex, tag:hex, ct:base64 }
  *
- * Plaintext payload (JSON): { providers: { deepseek: "sk-...", siliconflow: "sf-..." } }
+ * Plaintext payload (JSON): { providers: { deepseek: "sk-...", xai: "xai-..." } }
  *
  * Crypto:
  *   - scrypt(passphrase, salt, 32) → 256-bit key

package/dist/src/cli/keys-bundle.js

@@ -7,7 +7,7 @@
  * Format (JSON):
  *   { v:1, kdf:"scrypt", salt:hex, iv:hex, tag:hex, ct:base64 }
  *
- * Plaintext payload (JSON): { providers: { deepseek: "sk-...", siliconflow: "sf-..." } }
+ * Plaintext payload (JSON): { providers: { deepseek: "sk-...", xai: "xai-..." } }
  *
  * Crypto:
  *   - scrypt(passphrase, salt, 32) → 256-bit key

package/dist/src/cli/keys.d.ts

@@ -15,8 +15,8 @@
  *   keys delete <provider>        — remove a stored key
  *   keys import-bw [providers]    — pull from Bitwarden vault, store in keychain
  *   keys cleanup-settings         — strip plaintext keys from user-settings.json
- *   keys login <provider>         — OAuth login (openai, google/agy)
- *   keys logout <provider>        — OAuth logout (openai, google/agy)
+ *   keys login <provider>         — OAuth login (openai, xai)
+ *   keys logout <provider>        — OAuth logout (openai, xai)
  */
 import { type ChatSecretId } from "../chat/chat-keychain.js";
 export interface KeysSetOptions {

package/dist/src/cli/keys.js

@@ -15,8 +15,8 @@
  *   keys delete <provider>        — remove a stored key
  *   keys import-bw [providers]    — pull from Bitwarden vault, store in keychain
  *   keys cleanup-settings         — strip plaintext keys from user-settings.json
- *   keys login <provider>         — OAuth login (openai, google/agy)
- *   keys logout <provider>        — OAuth logout (openai, google/agy)
+ *   keys login <provider>         — OAuth login (openai, xai)
+ *   keys logout <provider>        — OAuth logout (openai, xai)
  */
 import { spawnSync } from "node:child_process";
 import { promises as fs } from "node:fs";
@@ -43,7 +43,7 @@ const CHAT_SECRET_IDS = ["discord-token", "discord-guild-id", "slack-token", "sl
 function isChatSecretId(value) {
     return CHAT_SECRET_IDS.includes(value);
 }
-const SETTINGS_PATH = path.join(os.homedir(), ".muonroi-cli", "user-settings.json");
+const getSettingsPath = () => path.join(os.homedir(), ".muonroi-cli", "user-settings.json");
 function maskKey(key) {
     if (key.length <= 10)
         return "***";
@@ -51,8 +51,6 @@ function maskKey(key) {
 }
 function normalizeProvider(p) {
     const lower = p.toLowerCase();
-    if (lower === "agy")
-        return "google"; // agy is alias for google (OAuth + key)
     if (KEYCHAIN_PROVIDER_IDS.includes(lower)) {
         return lower;
     }
@@ -115,7 +113,7 @@ async function promptHidden(question) {
 export async function runKeysSet(provider, options = {}) {
     const norm = normalizeProvider(provider);
     if (!norm) {
-        console.error(`Unknown provider '${provider}'. Valid: ${KEYCHAIN_PROVIDER_IDS.join(", ")} (agy is alias for google)`);
+        console.error(`Unknown provider '${provider}'. Valid: ${KEYCHAIN_PROVIDER_IDS.join(", ")}`);
         process.exit(1);
     }
     const key = (await promptHidden(`Paste ${provider} API key (hidden): `)).trim();
@@ -199,30 +197,11 @@ export async function runKeysList() {
     const oauthIds = await getOAuthProviderIds();
     for (const p of oauthIds) {
         try {
-            let tokens = await loadTokens(p);
-            if (!tokens && p === "google") {
-                // Import from agy storage only for fresh (non-expired) tokens.
-                // Stale agy tokens should be cleaned by running `keys logout google` + removing old .gemini file.
-                const { loadAgyTokensWithRefresh } = await import("../providers/auth/gemini-oauth.js");
-                const agyTokens = await loadAgyTokensWithRefresh();
-                if (agyTokens && Date.now() < agyTokens.expiresAt) {
-                    tokens = agyTokens;
-                }
-            }
-            if (tokens) {
-                if (Date.now() < tokens.expiresAt) {
-                    const cfg = await getOAuthProviderConfig(p);
-                    const display = cfg?.displayName ?? p;
-                    oauthRows.push({ provider: p, display, email: tokens.email, expiresAt: tokens.expiresAt });
-                }
-                else if (p === "google") {
-                    // auto-clean stale Agy token from our store (imported from old ~/.gemini)
-                    try {
-                        const { deleteTokens } = await import("../providers/auth/token-store.js");
-                        await deleteTokens("google");
-                    }
-                    catch { }
-                }
+            const tokens = await loadTokens(p);
+            if (tokens && Date.now() < tokens.expiresAt) {
+                const cfg = await getOAuthProviderConfig(p);
+                const display = cfg?.displayName ?? p;
+                oauthRows.push({ provider: p, display, email: tokens.email, expiresAt: tokens.expiresAt });
             }
         }
         catch {
@@ -234,7 +213,6 @@ export async function runKeysList() {
         console.log("No keys stored in OS keychain.");
         console.log("Run 'muonroi-cli keys set <provider>' or 'muonroi-cli keys import-bw' to add some.");
         console.log("Run 'muonroi-cli keys login openai' to log in with your OpenAI subscription.");
-        console.log("Run 'muonroi-cli keys login google' or 'keys login agy' to log in with Agy (Google OAuth).");
         console.log("Run 'muonroi-cli keys login xai' to log in with your SuperGrok / X Premium+ subscription.");
         return;
     }
@@ -288,35 +266,11 @@ export async function runKeysList() {
 export async function runKeysDelete(provider) {
     const norm = normalizeProvider(provider);
     if (!norm) {
-        console.error(`Unknown provider '${provider}'. Valid: ${KEYCHAIN_PROVIDER_IDS.join(", ")} (agy is alias for google)`);
+        console.error(`Unknown provider '${provider}'. Valid: ${KEYCHAIN_PROVIDER_IDS.join(", ")}`);
         process.exit(1);
     }
     const ok = await deleteKeyForProvider(norm);
     console.log(ok ? `Deleted ${provider} key from keychain.` : `No ${provider} key was stored.`);
-    // If deleting google/agy, also clean the OAuth token (Agy uses the google slot for its OAuth)
-    if (norm === "google") {
-        try {
-            const { loadTokens, deleteTokens } = await import("../providers/auth/token-store.js");
-            const { getOAuthProviderConfig } = await import("../providers/auth/registry.js");
-            const tokens = await loadTokens("google");
-            if (tokens) {
-                const cfg = await getOAuthProviderConfig("google");
-                if (cfg?.provider) {
-                    try {
-                        await cfg.provider.revoke(tokens);
-                    }
-                    catch {
-                        // best effort
-                    }
-                }
-                await deleteTokens("google");
-                console.log(`Also cleared Agy/Google OAuth token.`);
-            }
-        }
-        catch {
-            // ignore secondary errors
-        }
-    }
 }
 export async function runKeysExport(filePath) {
     const providers = {};
@@ -679,9 +633,9 @@ export async function runChatImportBw(opts = {}) {
  */
 export async function runKeysLogin(provider) {
     const oauthIds = await getOAuthProviderIds();
-    const norm = provider.toLowerCase() === "agy" ? "google" : provider;
+    const norm = provider;
     if (!oauthIds.includes(norm)) {
-        const supported = oauthIds.map((id) => (id === "google" ? "google (or agy)" : id)).join(", ");
+        const supported = oauthIds.join(", ");
         console.error(`OAuth login not supported for '${provider}'. Supported: ${supported}`);
         process.exit(1);
     }
@@ -693,22 +647,6 @@ export async function runKeysLogin(provider) {
         process.exit(1);
     }
     const name = cfg.displayName;
-    // Special handling for google: prefer importing/reusing token from agy local config
-    // (~/.gemini/oauth_creds.json) so existing agy login "just works" without browser.
-    if (provider === "google") {
-        const { loadAgyTokensWithRefresh } = await import("../providers/auth/gemini-oauth.js");
-        const existing = await loadAgyTokensWithRefresh();
-        if (existing?.accessToken) {
-            console.log(`Found existing agy token for ${existing.email || "(no email)"}.`);
-            console.log("Reusing it (refreshed if near expiry). No browser needed.");
-            const expiry = new Date(existing.expiresAt).toLocaleString();
-            const isExpired = Date.now() > existing.expiresAt;
-            console.log(`Token expires: ${expiry}${isExpired ? " (was expired, refresh attempted)" : ""}`);
-            console.log("Run 'muonroi-cli keys list' to verify.");
-            return;
-        }
-        // No existing agy token — fall through to normal browser flow (using agy client)
-    }
     console.log(`Logging in to ${name} via OAuth...`);
     console.log("A browser window will open. Complete the sign-in to continue.");
     const tokens = await cfg.provider.login({
@@ -742,9 +680,9 @@ export async function runKeysLogin(provider) {
  */
 export async function runKeysLogout(provider) {
     const oauthIds = await getOAuthProviderIds();
-    const norm = provider.toLowerCase() === "agy" ? "google" : provider;
+    const norm = provider;
     if (!oauthIds.includes(norm)) {
-        const supported = oauthIds.map((id) => (id === "google" ? "google (or agy)" : id)).join(", ");
+        const supported = oauthIds.join(", ");
         console.error(`OAuth logout not supported for '${provider}'. Supported: ${supported}`);
         process.exit(1);
     }
@@ -766,7 +704,7 @@ export async function runKeysLogout(provider) {
 export async function runKeysCleanupSettings() {
     let raw;
     try {
-        raw = await fs.readFile(SETTINGS_PATH, "utf8");
+        raw = await fs.readFile(getSettingsPath(), "utf8");
     }
     catch (e) {
         if (e.code === "ENOENT") {
@@ -780,11 +718,11 @@ export async function runKeysCleanupSettings() {
         json = JSON.parse(raw);
     }
     catch {
-        console.error(`Settings file is not valid JSON: ${SETTINGS_PATH}`);
+        console.error(`Settings file is not valid JSON: ${getSettingsPath()}`);
         process.exit(1);
     }
     const ts = new Date().toISOString().replace(/[:.]/g, "-");
-    const backup = `${SETTINGS_PATH}.bak.${ts}`;
+    const backup = `${getSettingsPath()}.bak.${ts}`;
     await fs.writeFile(backup, raw, "utf8");
     let removed = 0;
     if ("apiKey" in json) {
@@ -806,9 +744,9 @@ export async function runKeysCleanupSettings() {
             delete json.providers;
         }
     }
-    await fs.writeFile(SETTINGS_PATH, `${JSON.stringify(json, null, 2)}\n`, "utf8");
+    await fs.writeFile(getSettingsPath(), `${JSON.stringify(json, null, 2)}\n`, "utf8");
     console.log(`Backed up to: ${backup}`);
-    console.log(`Removed ${removed} plaintext key field(s) from: ${SETTINGS_PATH}`);
+    console.log(`Removed ${removed} plaintext key field(s) from: ${getSettingsPath()}`);
     if (removed === 0) {
         console.log("(File was already clean.)");
     }

package/dist/src/council/clarifier.d.ts

@@ -69,6 +69,26 @@ export interface ClarifyOptionsResult {
  * so the UI knows to suppress the "(Recommended)" tag.
  */
 export declare function buildClarifyOptions(suggestions: string[] | undefined, recommended?: string): ClarifyOptionsResult;
+/**
+ * Model-designed option object: a choice the user picks between, carrying its
+ * own explanation. `recommended:true` marks the pre-selected default. This is
+ * the richer shape the clarifier prompt now asks for so every choice shows a
+ * per-option "why" (not just the question-level `why`).
+ */
+export interface ClarifyOptionSpec {
+    label: string;
+    description?: string;
+    recommended?: boolean;
+}
+/**
+ * Build council options from the model's richer `{label, description,
+ * recommended}` objects, preserving each choice's explanation as `description`
+ * and pointing `defaultIndex` at the option the model flagged `recommended`
+ * (falling back to the first when none is flagged). The same "Type something" /
+ * "Chat about this" escape-hatches are appended as in `buildClarifyOptions`.
+ * Pure + exported for unit testing.
+ */
+export declare function buildClarifyOptionsRich(specs: ClarifyOptionSpec[] | undefined): ClarifyOptionsResult;
 export declare function runClarification(topic: string, leaderModelId: string, conversationContext: string, respondToQuestion: QuestionResponder, llm: CouncilLLM, signal?: AbortSignal, seedQuestions?: GrayAreaQuestion[], maxRounds?: number, 
 /**
  * Optional pre-filled answers keyed by seed-question id. When the loop's
@@ -83,5 +103,11 @@ prefillAnswers?: Map<string, string>,
  * a cheaper tier model on the same provider as the leader. Falls back to
  * the leader model if no cheaper model is cataloged. Default false.
  */
-costAware?: boolean): AsyncGenerator<StreamChunk, ClarifiedSpec, unknown>;
-export declare function buildSpecFromTopic(topic: string, _conversationContext: string): ClarifiedSpec;
+costAware?: boolean, 
+/**
+ * Healthy panel models to fall back to when the leader's cost-tier spec-synth
+ * model is on a failing proxy — keeps the spec's ≥3 observable criteria (and
+ * thus a meaningful leader eval) instead of degrading to one generic criterion.
+ */
+fallbackModels?: string[]): AsyncGenerator<StreamChunk, ClarifiedSpec, unknown>;
+export declare function buildSpecFromTopic(topic: string, conversationContext: string): ClarifiedSpec;