thincoder 0.12.59 → 0.12.61

package/src/cli/setup-wizard.mjs

@@ -1,6 +1,6 @@
-import { existsSync, readFileSync } from "node:fs"
 import { createInterface } from "node:readline"
-import { configPath, saveConfig, PROVIDER_PRESETS } from "../config.mjs"
+import { configPath, writeConfigAtomic, PROVIDER_PRESETS } from "../config.mjs"
+import { probeChannelModels } from "../tui/model-catalog.mjs"
 
 /** First-time setup (TTY chat / distill): ask a few questions to configure a provider, save to disk, return runtime provider. Cancel returns null. */
 export async function setupWizard() {
@@ -29,7 +29,7 @@ export async function setupWizard() {
     presets.forEach(([n, p], i) => console.error(`  ${i + 1}. ${n.padEnd(10)} ${p.desc}`))
     console.error(`  ${presets.length + 1}. Custom endpoint`)
     const choice = Number((await ask(`Pick [1-${presets.length + 1}]: `)).trim())
-    let name, baseURL, model
+    let name, baseURL, model, presetFields = null
     if (choice === presets.length + 1) {
       name = (await ask("Name (e.g. my-openai): ")).trim()
       baseURL = (await ask("baseURL (e.g. https://api.openai.com/v1): ")).trim().replace(/\/+$/, "")
@@ -39,9 +39,11 @@ export async function setupWizard() {
         return null
       }
     } else if (choice >= 1 && choice <= presets.length) {
+      // 预设全量字段随行（format/thinking/maxTokens…）——探针分派与落盘同源（M9 需要 format）
+      presetFields = presets[choice - 1][1]
       name = presets[choice - 1][0]
-      baseURL = presets[choice - 1][1].baseURL
-      model = presets[choice - 1][1].model
+      baseURL = presetFields.baseURL
+      model = presetFields.model
     } else {
       console.error("Invalid choice — cancelled")
       return null
@@ -52,19 +54,42 @@ export async function setupWizard() {
       return null
     }
     const embedKey = (await ask("Optional: embedding API key (SiliconFlow, for vector search; press Enter to skip): ")).trim()
-    const raw = existsSync(configPath) ? JSON.parse(readFileSync(configPath, "utf8")) : {}
-    const providers = raw.providers?.length ? raw.providers : []
-    const existing = providers.find((p) => p.name === name)
-    if (existing) Object.assign(existing, { baseURL, model, apiKey })
-    else providers.push({ name, baseURL, model, apiKey })
-    raw.providers = providers
-    raw.activeProvider = name
-    delete raw.activeModel  // reset to default model
-    if (embedKey) raw.embedding = { ...(raw.embedding ?? {}), apiKey: embedKey }
-    saveConfig(raw)
-    console.error(`Configured: ${name} / ${model} (saved to ${configPath})`)
+    // M9 配置阶段准入（加渠道 = 配置写入面）：探一次 `/models`——探通/探不通都不阻断保存，
+    // 仅明示结果（失败文案 = M8 消息本体；无绕过指引）。
+    // 探针输入带预设扩展字段（format 决定 M1 分派——claude/gemini 预设必须走自己的拉取分支）。
+    const probe = await probeChannelModels(presetFields ? { ...presetFields, name, apiKey } : { name, baseURL, apiKey })
+    console.error(probe.ok
+      ? `✓ ${name}: /models 可用（${probe.list.length} 个模型可候选）`
+      : `⚠ ${probe.message}`)
+    // D-F5b：磁盘新鲜读 → mutate → mtime 门控写（writeConfigAtomic 收口）；冲突 = 放弃
+    // + 提示重试（首配场景另有实例同时写盘——极低概率；不自动合并——决策点① A）
+    // MODEL-SELECTION v2：渠道默认模型 = 单值 `model` + defaultModel 顶层复合；
+    // 预设扩展字段（format/thinking/maxTokens…）随行落盘——与 TUI wizard 近似同构（探针/聊天字段同源），
+    // 但 `thinking` 复制语义不同：本文件用 `!== undefined` → kimi/kimi-code 预设的 `thinking: null`
+    // **被落盘**；TUI 路径用真值过滤（model-picker.mjs / wizard.mjs）不落该键。
+    // `thinking: null`（NF1 = 显式 off）落盘差异已登记待口径统一（父侧）。
+    const r = writeConfigAtomic(configPath, (raw) => {
+      const providers = raw.providers?.length ? raw.providers : []
+      const existing = providers.find((p) => p.name === name)
+      const rec = { name, baseURL, model, apiKey }
+      for (const k of ["format", "thinking", "reasoningEffort", "maxTokens", "chatPath"]) {
+        if (presetFields?.[k] !== undefined) rec[k] = presetFields[k]
+      }
+      if (existing) Object.assign(existing, rec) // 渠道老字段（models 候选清单）由 config-migrate 在下次 load 统一清理
+      else providers.push(rec)
+      raw.providers = providers
+      raw.defaultModel = `${name}:${model}`
+      delete raw.activeProvider
+      delete raw.activeModel
+      if (embedKey) raw.embedding = { ...(raw.embedding ?? {}), apiKey: embedKey }
+    })
+    if (!r.ok) {
+      console.error("config changed on disk concurrently — retry")
+      return null
+    }
+    console.error(`Configured: ${name} / ${model} (defaultModel = ${name}:${model} — saved to ${configPath})`)
     console.error(embedKey ? "Vector search enabled\n" : "(No embedding key configured: memory search will use text-only FTS. Add embedding.apiKey to config.json to enable vector search later.)\n")
-    return { name, baseURL, model, apiKey }
+    return { name, baseURL, model, apiKey, defaultModel: `${name}:${model}` }
   } finally {
     rl.close()
   }

package/src/completions.mjs

@@ -0,0 +1,114 @@
+/**
+ * completions.mjs — `thincoder completion <shell>` shell 补全脚本发射（bash/zsh/fish）。
+ * bin/thincoder.mjs case "completion" 直写段拆分（2026-09-08——500 行硬限触碰执行：
+ * 段逐字迁出，脚本字节与既有输出一致）。
+ */
+export function printCompletion(shell) {
+    if (shell === "bash") {
+      process.stdout.write(`_thincoder() {
+  local cur prev words cword
+  _init_completion 2>/dev/null || { COMPREPLY=(); return; }
+  cur="\${COMP_WORDS[COMP_CWORD]}"
+  prev="\${COMP_WORDS[COMP_CWORD-1]}"
+  case "\${COMP_WORDS[1]}" in
+    chat)    COMPREPLY=( \\$(compgen -W "--auto" -- "\\$cur") ) ;;
+    memory)
+      case "\\$prev" in
+        memory) COMPREPLY=( \\$(compgen -W "list search put remove" -- "\\$cur") ) ;;
+        list)   COMPREPLY=( \\$(compgen -W "--type=rule --type=knowledge --type=decision --type=pattern" -- "\\$cur") ) ;;
+        put)    COMPREPLY=( \\$(compgen -W "--type= --title= --content= --tags=" -- "\\$cur") ) ;;
+      esac ;;
+    distill) COMPREPLY=( \\$(compgen -W "--yes --layer=" -- "\\$cur") ) ;;
+    completion) COMPREPLY=( \\$(compgen -W "bash zsh fish" -- "\\$cur") ) ;;
+    *)
+      COMPREPLY=( \\$(compgen -W "chat acp memory sync reindex distill upgrade completion session -v --version -h --help" -- "\\$cur") ) ;;
+  esac
+}
+complete -F _thincoder thincoder
+`)
+    } else if (shell === "zsh") {
+      process.stdout.write(`#compdef thincoder
+
+_thincoder() {
+  local context state state_descr line
+  typeset -A opt_args
+  _arguments -C \\
+    '1: :->cmd' \\
+    '*:: :->args'
+
+  case "\\$state" in
+    cmd)
+      _values 'command' \\
+        'chat[One-shot agent run with tools]' \\
+        'acp[Agent Client Protocol server for IDEs]' \\
+        'memory[Manage long-term memory]' \\
+        'sync[Sync team memory repo]' \\
+        'reindex[Rebuild local index from markdown]' \\
+        'distill[Extract knowledge from session transcript]' \\
+        'upgrade[Update to latest version from npm]' \\
+        'completion[Generate shell completion script]' \\
+        'session[Session dir GC: session gc --dry-run|--confirm]'
+      ;;
+    args)
+      case "\\$words[1]" in
+        chat)    _arguments '--auto[Auto-approve all tool calls]' ;;
+        memory)
+          case "\\$words[2]" in
+            list) _arguments '--type=[Filter by type]' ;;
+            put)  _arguments '--type=[Entry type]' '--title=[Title]' '--content=[Content]' '--tags=[Space-separated tags]' ;;
+          esac ;;
+        distill) _arguments '--yes[Skip confirmation]' '--layer=[Layer filter]' ;;
+        completion) _values 'shell' 'bash' 'zsh' 'fish' ;;
+      esac ;;
+  esac
+}
+_thincoder
+`)
+    } else if (shell === "fish") {
+      process.stdout.write(`# thincoder completions for fish shell
+complete -c thincoder -f
+
+# Subcommands
+complete -c thincoder -a chat     -d 'One-shot agent run with tools'
+complete -c thincoder -a memory   -d 'Manage long-term memory'
+complete -c thincoder -a sync     -d 'Sync team memory repo'
+complete -c thincoder -a reindex  -d 'Rebuild local index from markdown'
+complete -c thincoder -a distill  -d 'Extract knowledge from session'
+complete -c thincoder -a upgrade  -d 'Update to latest version'
+complete -c thincoder -a completion -d 'Shell completion'
+complete -c thincoder -a session -d 'Session dir GC (session gc --dry-run|--confirm)'
+complete -c thincoder -a acp -d 'Agent Client Protocol server for IDEs'
+
+# Flags
+complete -c thincoder -s v -l version -d 'Print version'
+complete -c thincoder -s h -l help    -d 'Print help'
+
+# chat flags
+complete -c thincoder -n '__fish_seen_subcommand_from chat' -l auto -d 'Auto-approve tool calls'
+
+# memory subcommands
+complete -c thincoder -n '__fish_seen_subcommand_from memory' -a list   -d 'List entries'
+complete -c thincoder -n '__fish_seen_subcommand_from memory' -a search -d 'Search memory'
+complete -c thincoder -n '__fish_seen_subcommand_from memory' -a put    -d 'Add entry'
+complete -c thincoder -n '__fish_seen_subcommand_from memory' -a remove -d 'Remove entry'
+
+# memory list flags
+complete -c thincoder -n '__fish_seen_subcommand_from memory; and __fish_seen_subcommand_from list' -l type -d 'Filter by type' -xa 'rule knowledge decision pattern'
+
+# memory put flags
+complete -c thincoder -n '__fish_seen_subcommand_from memory; and __fish_seen_subcommand_from put' -l type    -d 'Entry type'
+complete -c thincoder -n '__fish_seen_subcommand_from memory; and __fish_seen_subcommand_from put' -l title   -d 'Title'
+complete -c thincoder -n '__fish_seen_subcommand_from memory; and __fish_seen_subcommand_from put' -l content -d 'Content'
+complete -c thincoder -n '__fish_seen_subcommand_from memory; and __fish_seen_subcommand_from put' -l tags    -d 'Space-separated tags'
+
+# distill flags
+complete -c thincoder -n '__fish_seen_subcommand_from distill' -l yes   -d 'Skip confirmation'
+complete -c thincoder -n '__fish_seen_subcommand_from distill' -l layer -d 'Layer filter'
+
+# completion shells
+complete -c thincoder -n '__fish_seen_subcommand_from completion' -a bash -d 'Bash completions'
+complete -c thincoder -n '__fish_seen_subcommand_from completion' -a zsh  -d 'Zsh completions'
+complete -c thincoder -n '__fish_seen_subcommand_from completion' -a fish -d 'Fish completions'
+`)
+    }
+}

package/src/config-migrate.mjs

@@ -0,0 +1,70 @@
+/**
+ * config-migrate.mjs — model-schema legacy-shape migration core (MODEL-SELECTION v2, §16.2 M7).
+ * Split out of config.mjs (500-line hard limit). Pure function, zero imports — the
+ * write-back orchestration (writeConfigAtomic / persistRaw, failure tolerance) stays in
+ * the caller (CLI: config.mjs loadConfig; VSC: config-io.mjs loadRaw — same rule, 双端各自
+ * 独立实现——不做同步依赖).
+ *
+ * 目标形态 C：每渠道恰好一个默认模型（`providers[].model` 单值）+ 顶层 `defaultModel` 复合。
+ * 老形态迁移（v2）：
+ * - A：`providers[].model` + `activeProvider/activeModel` → `p.model` **保留**（不再搬入 models）；
+ *   `activeProvider/activeModel` → `defaultModel` 复合（`activeModel` 优先；AP 不存在/AM 空 → 首渠道回退）
+ * - B：`providers[].models[]` → `p.model = defaultModel 属本渠道的模型段 ?? 现有 p.model（非空字符串）
+ *   ?? models[] 首个非空字符串`，然后 `delete p.models`
+ * - 混合/垃圾：非数组 `p.models` / 非字符串（空串）`p.model` → 删除（清理）
+ * - 顺序：先构造/读取有效 `defaultModel` 值（含老 active* 转换），再按它给各渠道播种 `p.model`
+ * - 幂等：无老字段（无 `models` / 无 active* / 无垃圾值）→ 返回 false 不动；slot 旧字段
+ *   （会话文件内）不迁移——读侧容忍
+ * - 空结果合法：渠道无模型来源 → `p.model` 不设（模型选择经 `/models` 拉取候选——M8/M9）
+ */
+export function migrateLegacyModelFields(raw) {
+  if (!raw || typeof raw !== "object") return false
+  const providers = Array.isArray(raw.providers) ? raw.providers : []
+  let changed = false
+
+  // ── ① 有效 defaultModel 值（含老 active* 转换）──
+  if (raw.activeProvider !== undefined || raw.activeModel !== undefined) {
+    const rawAP = typeof raw.activeProvider === "string" && raw.activeProvider.trim() ? raw.activeProvider : ""
+    const rawAM = typeof raw.activeModel === "string" && raw.activeModel.trim() ? raw.activeModel : ""
+    const ap = rawAP ? providers.find((p) => p?.name === rawAP) : null
+    if (ap && rawAM) {
+      if (raw.defaultModel == null) { raw.defaultModel = `${rawAP}:${rawAM}`; changed = true }
+    } else {
+      // AP 已不存在 / AM 无法归属 → 首渠道回退（该渠道有模型来源才可用——迁移产物必可用）
+      const first = providers.find((p) => seedModel(p) != null)
+      if (first && raw.defaultModel == null) { raw.defaultModel = `${first.name}:${seedModel(first)}`; changed = true }
+    }
+    delete raw.activeProvider
+    delete raw.activeModel
+    changed = true
+  }
+
+  // ── ② 渠道播种单值 `p.model` + 清 models ──
+  const dm = typeof raw.defaultModel === "string" && raw.defaultModel.trim() ? raw.defaultModel : null
+  const dmSep = dm ? dm.indexOf(":") : -1
+  const dmProvider = dmSep > 0 ? dm.slice(0, dmSep) : null
+  const dmModel = dmSep > 0 && dmSep < dm.length - 1 ? dm.slice(dmSep + 1) : null
+  for (const p of providers) {
+    if (!p || typeof p !== "object") continue
+    if (Array.isArray(p.models)) {
+      const next = (p.name === dmProvider && dmModel)
+        ? dmModel
+        : (typeof p.model === "string" && p.model.trim() ? p.model : seedModel(p))
+      if (next == null) delete p.model
+      else p.model = next
+      delete p.models
+      changed = true
+      continue
+    }
+    if (p.models !== undefined) { delete p.models; changed = true } // 非数组 models —— 垃圾清理
+    if (p.model !== undefined && !(typeof p.model === "string" && p.model.trim())) { delete p.model; changed = true }
+  }
+  return changed
+}
+
+/** 渠道级模型来源读数（迁移用）：现有 `p.model`（非空字符串优先）或 `models[]` 首个非空字符串。 */
+function seedModel(p) {
+  if (typeof p?.model === "string" && p.model.trim()) return p.model
+  const models = Array.isArray(p?.models) ? p.models : []
+  return models.find((m) => typeof m === "string" && m.trim()) ?? null
+}

package/src/config.mjs

@@ -1,20 +1,40 @@
 /**
  * config.mjs — configuration loading and saving
- * Multi-provider structure: providers[] + activeProvider
+ * Model-merge schema v2 (2026-09-10 MODEL-SELECTION): providers[] carry ONE default model
+ * per channel (`providers[].model` — the new-install seed / empty-slot fallback); the
+ * candidates list field models[] is gone — the available-model list is fetched from the
+ * provider at runtime (`GET /models`, PROVIDER.md §16). config.defaultModel (top level,
+ * "provider:model" composite) is the new-session starting point; activeProvider/activeModel
+ * are gone from config (session slots keep their own double fields). Legacy fields migrate
+ * on load (write-back failure never blocks startup).
  * Config file: ~/.thincoder/config.json
  * API key can fall back to environment variables (when not configured in providers).
  */
 
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs"
 import { homedir } from "node:os"
-import { join } from "node:path"
+import { dirname, join } from "node:path"
+import { parseModelRef, resolveRuntimeProvider, defaultModelReason } from "./model-ref.mjs"
+// 老形态迁移核（M7 v2——纯函数零依赖——本文件超 500 行硬限拆分，VSC 同构文件）
+import { migrateLegacyModelFields } from "./config-migrate.mjs"
+import { expandHome } from "./expand-home.mjs"
+
+export { parseModelRef, resolveRuntimeProvider, defaultModelReason, migrateLegacyModelFields }
 
 export const configDir = join(homedir(), ".thincoder")
 export const configPath = join(configDir, "config.json")
 
-/** Built-in provider presets: shared by /provider add <preset> and first-run wizard */
+/** Test seam: override the config file location (mirrors thincoder-vscode config-io.mjs). */
+let _pathOverride = null
+export function _setConfigPathForTest(p) { _pathOverride = p }
+export function _resetConfigPathForTest() { _pathOverride = null }
+function cfgPath() { return _pathOverride ?? configPath }
+
+/** Built-in provider presets: shared by /provider add <preset> and first-run wizard.
+ *  MODEL-SELECTION v2 (2026-09-10): each preset carries exactly ONE default model
+ *  (`model` — 新装启动种子/槽位空兜底; 候选清单不再预置——运行期从 provider 拉取). */
 export const PROVIDER_PRESETS = {
-  deepseek: { baseURL: "https://api.deepseek.com", model: "deepseek-v4-pro", thinking: { type: "enabled" }, reasoningEffort: "max", maxTokens: 393216, desc: "DeepSeek" },
+  deepseek: { baseURL: "https://api.deepseek.com", model: "deepseek-flash", thinking: { type: "enabled" }, reasoningEffort: "max", maxTokens: 393216, desc: "DeepSeek" },
   kimi:     { baseURL: "https://api.moonshot.cn/v1", model: "kimi-k3", thinking: null, reasoningEffort: "max", maxTokens: 131072, desc: "Kimi / Moonshot" },
   "kimi-code": { baseURL: "https://api.kimi.com/coding/v1", model: "k3", thinking: null, reasoningEffort: "max", maxTokens: 131072, desc: "Kimi For Coding (platform.kimi.com — sk-kimi- keys; NOT interchangeable with Moonshot)" },
   glm:      { baseURL: "https://open.bigmodel.cn/api/paas/v4", model: "glm-5.2", thinking: { type: "enabled" }, reasoningEffort: "max", maxTokens: 128000, desc: "Zhipu GLM" },
@@ -37,7 +57,7 @@ export const PROVIDER_PRESETS = {
 }
 
 export const DEFAULTS = {
-  activeModel: null,  // optional: override provider.model (set via /model picker or /model provider:model)
+  defaultModel: null, // top-level "provider:model" composite — new-session starting point (F-1)
   agent: {
     maxTurns: 200,
     subagentTurns: 100,
@@ -54,7 +74,19 @@ export const DEFAULTS = {
     streamRules: [],      // time-traveling stream rules: [{ pattern: "regex", message: "reminder", action: "abort"|"warn", repeat: "always"|"once" }]
     advisor: { guard: false },  // code review is always available; guard: true pushes completion back until reviewed (opt-in). Also accepts provider/model/thinking/reasoningEffort/timeoutMs overrides. Deprecated: enabled (2026-08-21)
     autoThink: false,     // auto-classify task difficulty and set reasoning effort per-turn
-    engineering: false,   // strict methodology enforcement — read METHODOLOGY.md, design-before-code
+    engineering: false,   // strict methodology enforcement — design-before-code (design review + user approval before code)
+    // Async pool limits (AGENT-LOOP.md §11.1 D-24a/R14 + §11.2 R13 — POOL-CONFIG-
+    // UNIFIED 2026-09-09): { engCoder, other, advisor } — eng-coder pool / other-role
+    // pool / advisor-review pool, defaults 4/4/4 (user ruling "eng-coder 四路，其他
+    // 4 路" + advisor 评审池并入同一可配体系——三池统一默认 4)。engCoder/other
+    // runtime-validated at every subagent pool admission (subagent-async
+    // resolvePoolLimits); advisor runtime-validated at every advisor launch
+    // (advisor-async advisorPoolLimitFor——F-2——两域读取器独立不共享)——非法/缺省
+    // 回退 4——settings tool 与 /config 并发池菜单写此键——变更下个 spawn/launch 生效。
+    // ⚠ 与 subagent-async.mjs ASYNC_POOL_LIMITS（两键）/advisor-async.mjs
+    // ADVISOR_POOL_LIMIT 逐键同值（运行时回退常量）——耦合锚 T-24a4 断言锁住——
+    // 勿单侧改默认。
+    poolLimits: { engCoder: 4, other: 4, advisor: 4 },
   },
   memory: {
     dbPath: join(configDir, "memory.db"),
@@ -70,7 +102,7 @@ export const DEFAULTS = {
     servers: [],
   },
   websearch: {
-    provider: "tavily",  // structured search API; empty apiKey → fall back to Bing HTML scraping
+    // Structured search via Tavily when a key is set — empty apiKey → Bing RSS/HTML fallback (zero-config).
     apiKey: "",          // Tavily key (tvly-...) — optional
   },
   traces: {
@@ -82,8 +114,8 @@ export const DEFAULTS = {
 // Model capability table + spec lookup live in model-specs.mjs (2026-08-31
 // extract — config.mjs had grown past the 300-line advisory). Re-exported here
 // so the 23 existing importers keep their import paths.
-import { specForModel, providerSpec } from "./model-specs.mjs"
-export { specForModel, providerSpec }
+import { specForModel, providerSpec, specMatch } from "./model-specs.mjs"
+export { specForModel, providerSpec, specMatch }
 
 
 // Window utilization threshold: compacts at 60% context, reserving 40% headroom
@@ -136,6 +168,44 @@ export function resolveEnableThinking(provider, spec) {
 /** Module-level one-time warn dedupe for invalid providers[].context (PROVIDER.md §15 D-C1). */
 const warnedContextProviders = new Set()
 
+/** F-4 (IKCDMR) 软失败清洗（D-S1 范式——loadConfig 是 CLI 启动砖点）：consultModels 非法
+ *  条目过滤不 throw——非数组 → []、形状非法/未知渠道丢弃、超 5 截断（keep 前 5）。
+ *  返回 { keep, dropped }——dropped 供一次性警告；merged.agent.consultModelsFiltered 挂载
+ *  供后续首帧引导消费（数据层——本批文件面无消费方——同 providerInvalidReason 载体先例）。 */
+function sanitizeConsultModels(cm, providerNames) {
+  if (cm === undefined || cm === null) return { keep: [], dropped: [] }
+  if (!Array.isArray(cm)) {
+    return { keep: [], dropped: [`agent.consultModels must be an array of { provider, model } entries (got ${typeof cm})`] }
+  }
+  const names = new Set(providerNames)
+  const keep = []
+  const dropped = []
+  for (const entry of cm) {
+    if (keep.length >= 5) { dropped.push(`over the 5-entry cap — dropped ${JSON.stringify(entry)}`); continue }
+    if (!entry || typeof entry !== "object" || typeof entry.provider !== "string" || !entry.provider.trim()
+        || typeof entry.model !== "string" || !entry.model.trim()) {
+      dropped.push(`invalid entry (expected { provider: string, model: string }) — got ${JSON.stringify(entry)}`)
+      continue
+    }
+    if (!names.has(entry.provider)) {
+      dropped.push(`entry "${entry.provider}:${entry.model}" references unknown provider "${entry.provider}" (available: ${[...names].join(", ") || "none"})`)
+      continue
+    }
+    keep.push(entry)
+  }
+  return { keep, dropped }
+}
+
+/** F-4：过滤警告——进程级一次性（loadConfig 同进程可多次调用：TUI 启动 + reloadConfig）。 */
+let warnedConsultModels = false
+function warnConsultModelsFiltered(dropped, path) {
+  if (warnedConsultModels || dropped.length === 0) return
+  warnedConsultModels = true
+  console.warn(`[config] agent.consultModels: ${dropped.length} invalid entr${dropped.length === 1 ? "y ignored" : "ies ignored"} (filtered — startup continues; no crash):\n` +
+    dropped.map((d) => `  - ${d}`).join("\n") +
+    `\n  Fix: clean agent.consultModels in ${path} or use /config → consult/escalate pool menu.`)
+}
+
 /**
  * Find provider by name in providers[].
  * Throws if name is non-empty but not found — a typo in activeProvider silently falling to the first provider would use the wrong key on the wrong endpoint.
@@ -179,29 +249,58 @@ function sanitizeProviderHeaders(p) {
   return p
 }
 
+/** loadConfig 内联迁移核已迁 config-migrate.mjs（500 行硬限拆分——VSC 同构）——
+ *  migrateLegacyModelFields 纯函数 + 本文件 import/写回编排（折中 C 见其头注释）。 */
 export function loadConfig() {
   let config = {}
-  if (existsSync(configPath)) {
+  const path = cfgPath()
+  if (existsSync(path)) {
     try {
-      config = JSON.parse(readFileSync(configPath, "utf8"))
+      config = JSON.parse(readFileSync(path, "utf8"))
     } catch (error) {
-      throw new Error(`Config file is not valid JSON, check or delete it: ${configPath}\n  ${error.message}`, { cause: error })
+      throw new Error(`Config file is not valid JSON, check or delete it: ${path}\n  ${error.message}`, { cause: error })
+    }
+  }
+
+  // ── 迁移（M7 v2）：检测老字段（models[] / active* / 垃圾值）→ 内存迁移态先行；写回失败绝不阻断（下次 load 重试——幂等）──
+  if (migrateLegacyModelFields(config)) {
+    try {
+      const r = writeConfigAtomic(path, migrateLegacyModelFields) // 磁盘 fresh raw 同变换
+      if (r.ok === false) console.warn(`[config] migration write-back skipped (${r.reason}) — memory state continues, retried on next load`)
+    } catch (e) {
+      console.warn(`[config] migration write-back failed — memory state continues, retried on next load: ${e.message}`)
     }
   }
 
   const merged = {
     ...DEFAULTS,
     ...config,
+    defaultModel: typeof config.defaultModel === "string" && config.defaultModel.trim() ? config.defaultModel : null,
     providers: Array.isArray(config.providers)
       ? config.providers.map((p) => sanitizeProviderHeaders({ ...p }))
       : [],
-    activeProvider: config.activeProvider ?? "",
     agent: { ...DEFAULTS.agent, ...config.agent },
     memory: { ...DEFAULTS.memory, ...config.memory },
     embedding: { ...DEFAULTS.embedding, ...config.embedding },
     traces: { ...DEFAULTS.traces, ...config.traces },
   }
 
+  // 家目录展开（第 29 批）：config 路径字段单一规范化点——只读归一（磁盘原文保留）
+  merged.memory.dbPath = expandHome(merged.memory.dbPath)
+  merged.memory.projectDir = expandHome(merged.memory.projectDir)
+  const team = merged.memory.team
+  if (team && typeof team === "object" && !Array.isArray(team) && team.dir !== undefined) {
+    merged.memory.team = { ...team, dir: expandHome(team.dir) }   // 无 dir 键不注入（零键面变化）
+  }
+  merged.shell = expandHome(merged.shell)
+
+  // providers[].model 内存归一（v2 M3：非空字符串保留；非字符串/空串归一删除）——渠道默认模型
+  // 单值；无默认模型合法（模型选择经 /models 拉取候选——准入判据见 M8/M9）。
+  for (const p of merged.providers) {
+    if (typeof p.model === "string" && p.model.trim()) continue
+    if (p.model !== undefined) delete p.model
+  }
+
   // providers[].context (K units, PROVIDER.md §15 D-C1): positive integer only — invalid
   // values (0/negative/non-numeric) are IGNORED (spec value applies) with a ONE-TIME warn
   // per provider name (module-level dedupe, same precedent as warnedModels in model-specs.mjs).
@@ -215,27 +314,15 @@ export function loadConfig() {
     delete p.context
   }
 
-  // Consult/escalate pool validation (CLI parity with the plugin): up to 5 candidates.
-  const cm = merged.agent.consultModels
-  if (cm !== undefined && !Array.isArray(cm)) {
-    throw new Error(`agent.consultModels must be an array of { provider, model } entries (got ${typeof cm})`)
-  }
-  if (Array.isArray(cm) && cm.length > 5) {
-    throw new Error(`agent.consultModels supports at most 5 models (got ${cm.length})`)
-  }
-  if (Array.isArray(cm)) {
-    // Fail fast at load: a pool entry whose provider doesn't exist in providers[] fails
-    // every consult/escalate call at runtime with a quiet error string (eats a turn).
-    const providerNames = merged.providers.map((p) => p.name)
-    for (const entry of cm) {
-      if (!entry || typeof entry !== "object" || typeof entry.provider !== "string" || typeof entry.model !== "string") {
-        throw new Error(`agent.consultModels entries must be { provider: string, model: string } objects (got ${JSON.stringify(entry)})`)
-      }
-      if (!providerNames.includes(entry.provider)) {
-        throw new Error(`agent.consultModels entry "${entry.provider}:${entry.model}" references unknown provider "${entry.provider}" (available: ${providerNames.join(", ") || "none"})`)
-      }
-    }
-  }
+  // F-4 (IKCDMR) consultModels 软失败化——D-S1 范式（defaultModel 无效同族）：非法条目
+  // 过滤不 throw（去 startup brick——无修复入口的硬崩消）；一次性启动警告内嵌修复指引
+  // （引导清条目载体——保留 discoverability）；过滤记录挂 merged.agent.consultModelsFiltered
+  // （数据层——consumer-ready——首帧 UI 消费点同 D-S1 promptProviderIfInvalid 属后续批）。
+  // VSC loadAgentSettings 同规则（共享 config——双端锁步）。
+  const cmClean = sanitizeConsultModels(merged.agent.consultModels, merged.providers.map((p) => p.name))
+  warnConsultModelsFiltered(cmClean.dropped, path)
+  merged.agent.consultModels = cmClean.keep
+  if (cmClean.dropped.length) merged.agent.consultModelsFiltered = cmClean.dropped
 
   // Backward compatibility: promote root-level config fields to agent sub-object
   if (config.verifyGuard !== undefined) {
@@ -251,35 +338,24 @@ export function loadConfig() {
   // 保证 agent.config.proxy 永远是规范形态或 undefined
   merged.proxy = normalizeProxy(merged.proxy)
 
-  // Get the currently active provider
-  // 2026-09-02 Q1（SESSION.md §8）：activeProvider 指向不存在的 provider 不再抛错——runtimeProvider
-  // 置空对象，由 make-agent.mjs assembleAgent 后的校验打 `_providerInvalid` 标记 → TUI 引导重选 /
-  // headless 报可读错误（原 findProvider throw 直接击穿 loadConfig → uncaughtException 退出）。
-  // findProvider 的 throw 契约保留（advisor/run.mjs 等直接调用方仍依赖）。
-  let active
-  try {
-    active = findProvider(merged.providers, merged.activeProvider)
-  } catch {
-    active = {}
-  }
-
-  // Build runtime provider object (for agent.provider usage)
-  const runtimeProvider = { ...active }
-
-  // activeModel overrides provider's default model (config only)
-  if (merged.activeModel) runtimeProvider.model = merged.activeModel
-  merged.activeModel = merged.activeModel || null  // normalize for agent.activeModel
+  // Runtime provider = config.defaultModel 复合解析（F-2——resolveRuntimeProvider）。
+  // 无效/未设 → {} + providerInvalidReason（D-S1 处置不 throw——make-agent 打 _providerInvalid
+  // 标记 → TUI 首帧弹选择 / headless 报可读错误；同 2026-09-02 Q1 语义——不复用 findProvider
+  // throw 契约——findProvider 保留给 advisor/run.mjs 等直接调用方）。
+  merged.provider = resolveRuntimeProvider(merged.providers, merged.defaultModel)
+  merged.providerInvalidReason = merged.provider.name
+    ? null
+    : defaultModelReason(merged.providers, merged.defaultModel)
 
   // Compaction threshold follows the model (provider-level context override honored — providerSpec)
   const explicitThreshold = config.agent?.compactThreshold
-  const { value, auto } = resolveCompactThreshold(explicitThreshold, runtimeProvider)
+  const { value, auto } = resolveCompactThreshold(explicitThreshold, merged.provider)
   merged.agent.compactThreshold = value
   merged.agent.compactThresholdAuto = auto
 
   // Write back to merged for convenient access by upper layers
-  merged.provider = runtimeProvider
   // fetch 超时可配置（2026-09-01：agent.fetchTimeoutMs——provider/core.mjs effectiveFetchTimeoutMs 消费）
-  runtimeProvider.fetchTimeoutMs = Number.isFinite(merged.agent?.fetchTimeoutMs) && merged.agent.fetchTimeoutMs > 0
+  merged.provider.fetchTimeoutMs = Number.isFinite(merged.agent?.fetchTimeoutMs) && merged.agent.fetchTimeoutMs > 0
     ? merged.agent.fetchTimeoutMs : undefined
   merged.providersList = merged.providers
   merged.advisor = { ...merged.agent.advisor }  // promote for consistent access (decoupled copy)
@@ -336,7 +412,8 @@ function readMcpSection(path = configPath) {
     if (!existsSync(path)) return { ok: true, servers: [] }
     const raw = JSON.parse(readFileSync(path, "utf8"))
     const servers = raw?.mcp?.servers
-    if (servers !== undefined && !Array.isArray(servers)) return { ok: true, servers: [] }
+    // 非数组 = 畸形磁盘配置（2.3 代码正确性批）——ok:false 走调用方既有畸形回退（reloadMcpFromDisk 早退）
+    if (servers !== undefined && !Array.isArray(servers)) return { ok: false, error: "mcp.servers must be an array" }
     return { ok: true, servers: Array.isArray(servers) ? servers : [] }
   } catch (error) {
     return { ok: false, error: error?.message ?? String(error) }
@@ -368,12 +445,52 @@ function mcpFingerprint(s) {
 }
 
 /**
- * Save configuration. Preserves providers list structure and activeProvider pointer.
- * providers[i].apiKey is only written when explicitly passed in (does not overwrite env-var-fallback keys).
+ * R10 F5（D-F5b，2026-09-06）——config.json 写前 mtime 门控收口函数（session-rename
+ * mtime-conflict 先例同型——MULTI-INSTANCE-COLLAB.md §2a.2）。所有 config.json 写点
+ * （config-helpers persistRaw / cmd-config saveProxy / cli setup-wizard / settings
+ * writeDisk）都经它落盘。
+ *
+ * 本函数持有整条「新鲜读 → mutate 单操作 → 写前重 stat → 写」链：
+ * - t0 = 写前重 stat 的比对基线，取在**新鲜读之前**（stat→read 序）：若对端在本端
+ *   stat 与 read 之间的微窗口写入，只会造成假冲突（放弃重试），绝不会带着旧内容覆盖
+ *   对端新值——read→stat 序存在漏检窗口（stat 已反映对端新 mtime → 门控放行旧内容）。
+ * - 写前重 stat ≠ t0 → **放弃**本次写（D-F5a 后各流已是 fresh 单操作语义，磁盘上对端
+ *   的新值保持在线不抹）；先 copy `.bak-{ts}` 留现场（仅冲突时——config 低频写不膨胀；
+ *   copy 而非 rename：冲突即放弃、本体不动，"保现场"是额外副本，非轮转腾位）。
+ * - 返回 { ok:false, reason:"mtime-conflict" }，调用方提示 "config changed on disk
+ *   concurrently — retry"——不自动合并（config 是用户显式操作——重试比猜测合并安全，
+ *   决策点① A）。
+ * - 文件缺失（首写）→ t0 = null；对端在本端读后创建 → null ≠ 新 mtime → 冲突放弃。
+ * - 畸形文件拒写（throw，绝不静默覆盖）；写后 chmod 0600 尽力而为（saveConfig 旧语义）。
+ *
+ * @param path config.json 路径（生产默认 configPath；测试注入 tmp 路径）
+ * @param mutate 在磁盘新鲜 raw 上执行单操作的同步回调（如 push/splice/单字段补丁）
+ * @returns { ok: true } | { ok: false, reason: "mtime-conflict" }
  */
-export function saveConfig(config) {
-  mkdirSync(configDir, { recursive: true })
+export function writeConfigAtomic(path, mutate) {
+  const mtimeOf = (p) => {
+    try { return statSync(p).mtimeMs } catch { return null } // 缺失 → null（t0 比对基线）
+  }
+  const t0 = mtimeOf(path) // stat 先于 read（安全方向——见头注释）
+  const text = existsSync(path) ? readFileSync(path, "utf8") : null
+  let raw = {}
+  if (text !== null) {
+    try {
+      raw = JSON.parse(text)
+    } catch (error) {
+      throw new Error(`config file not parseable — refusing to overwrite: ${path} — ${error.message}`, { cause: error })
+    }
+  }
+  mutate(raw)
+  const t1 = mtimeOf(path)
+  if (t0 !== t1) {
+    // 对端在我们新鲜读后改过磁盘 → 放弃本次写（对端内容保持在线）；.bak 副本留现场
+    try { if (existsSync(path)) copyFileSync(path, `${path}.bak-${Date.now()}`) } catch { /* 现场保留失败不阻断冲突报告 */ }
+    return { ok: false, reason: "mtime-conflict" }
+  }
+  mkdirSync(dirname(path), { recursive: true })
   // 0600: config.json contains API keys, must not be world-readable (POSIX; chmod is best-effort on Windows)
-  writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", { encoding: "utf8", mode: 0o600 })
-  try { chmodSync(configPath, 0o600) } catch { /* may fail on Windows, ignore */ }
+  writeFileSync(path, JSON.stringify(raw, null, 2) + "\n", { encoding: "utf8", mode: 0o600 })
+  try { chmodSync(path, 0o600) } catch { /* may fail on Windows, ignore */ }
+  return { ok: true }
 }