sliceagent 0.1.7__tar.gz → 0.1.8__tar.gz

{sliceagent-0.1.7 → sliceagent-0.1.8}/CHANGELOG.md

@@ -5,6 +5,31 @@ this project aims for [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.1.8] — 2026-07-02
+
+Launch-day bug-hunt round: a security fix plus config-robustness and /model correctness.
+
+### Security
+- `run_command` in the default *teenager* mode no longer auto-runs exec/write commands disguised as
+  "read-only": `env <program>`, `sort -o FILE`, `date -s`, `tree -o FILE`, `uniq IN OUT`, and
+  `git grep --open-files-in-pager` now take the confirm path (arbitrary code-exec / file-overwrite
+  confirm-bypass). Read-only siblings like `du -s` / `grep -o` still auto-run.
+
+### Fixed
+- Boot no longer cross-wires a prefs-pinned provider's key with the DEFAULT provider's endpoint (an
+  env `gpt-5.5` @ OpenAI pin on a DeepSeek-default config used to 401 every call on relaunch).
+- A prefs `provider`/model pin whose `[providers.<id>]` table was removed from config.toml is now
+  dropped at boot instead of forcing a model onto the wrong endpoint.
+- The wizard no longer silently ERASES other providers' API keys when config.toml is unparseable —
+  the old file is moved to a non-clobbering `.bak` first (keys recoverable).
+- `sliceagent config` / `config --use` / the init wizard no longer crash on a non-UTF-8 config.toml
+  or a scalar value under `[providers]` (they degrade).
+- `llm.switch()` (a `/model` provider hop) closes the replaced HTTP client — no more fd leak per hop.
+- The `/model` reasoning menu offers `high` (not a misleading `max`) for OpenRouter models, and offers
+  the levels the *target* provider supports when the pick rebinds the endpoint.
+- The wizard's typed provider fallback rejects an unknown choice instead of silently configuring
+  OpenRouter.
+
 ## [0.1.7] — 2026-07-02
 
 ### Fixed

{sliceagent-0.1.7 → sliceagent-0.1.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sliceagent
-Version: 0.1.7
+Version: 0.1.8
 Summary: A coding agent with a new context-engineering framework: bounded, deterministic, reconstructed context (slice architecture) — built for long-horizon work.
 Author: TT-Wang
 License-Expression: MIT

{sliceagent-0.1.7 → sliceagent-0.1.8}/src/sliceagent/__init__.py

@@ -1,3 +1,3 @@
 """sliceagent — a memory-native coding agent (deterministic, bounded, reconstructed context)."""
 
-__version__ = "0.1.7"
+__version__ = "0.1.8"

{sliceagent-0.1.7 → sliceagent-0.1.8}/src/sliceagent/cli.py

@@ -151,6 +151,21 @@ def _ws_name(path: str) -> str:
     return "~" if p == os.path.realpath(os.path.expanduser("~")) else (os.path.basename(p) or p)
 
 
+def _env_from_config(c, pid: str | None = None) -> None:
+    """Populate LLM_API_KEY/LLM_BASE_URL from config (ENV still wins). A prefs-pinned provider `pid`
+    binds AS A UNIT: its key with ITS OWN endpoint — an absent base_url means the SDK default (OpenAI),
+    NOT the default provider's base_url (that fallback cross-wired an openai key onto the deepseek
+    endpoint after `/model`-hop + restart when default_provider pointed elsewhere)."""
+    tbl = (c.providers() or {}).get(pid) if pid else None
+    if isinstance(tbl, dict) and tbl.get("api_key"):
+        key, base = tbl["api_key"], tbl.get("base_url") or ""
+    else:                                    # no/unusable pin → the default provider's own pairing
+        key, base = c.api_key, c.base_url
+    for _env, _val in (("LLM_API_KEY", key), ("LLM_BASE_URL", base)):
+        if not os.environ.get(_env) and _val:
+            os.environ[_env] = _val
+
+
 def main() -> None:
     # subcommands (onboarding / discovery) are handled BEFORE any key gate, so `sliceagent init` runs on a
     # machine with nothing configured yet. A bare `sliceagent` (or one with non-subcommand args) falls through.
@@ -165,14 +180,6 @@ def main() -> None:
     from .config import load_config, load_prefs
     _boot_prefs = load_prefs()   # the last /model choice may pin a PROVIDER (endpoint+key), not just a model
 
-    def _env_from_config(c, pid: str | None = None) -> None:
-        tbl = (c.providers() or {}).get(pid) if pid else None
-        key = (tbl or {}).get("api_key") or c.api_key
-        base = ((tbl or {}).get("base_url") if tbl and tbl.get("api_key") else None) or c.base_url
-        for _env, _val in (("LLM_API_KEY", key), ("LLM_BASE_URL", base)):
-            if not os.environ.get(_env) and _val:
-                os.environ[_env] = _val
-
     def _key_present() -> bool:
         return bool(os.environ.get("LLM_API_KEY") or os.environ.get("OPENAI_API_KEY")
                     or os.environ.get("ANTHROPIC_API_KEY") or os.environ.get("DEEPSEEK_API_KEY")
@@ -189,6 +196,14 @@ def main() -> None:
         return run_init() == 0
 
     cfg = load_config()
+    # A prefs `provider` pin whose [providers.<id>] table was since removed from config.toml is STALE:
+    # its key/endpoint already fall back to the default provider (see _env_from_config), but its pinned
+    # MODEL would still win at the resolution below and get sent to the wrong endpoint (model_not_found
+    # every turn). Drop the whole stale pin so model/endpoint resolve together from the live config.
+    if _boot_prefs.get("provider") and _boot_prefs["provider"] not in (cfg.providers() or {}):
+        from .config import save_prefs as _sp
+        _sp({"provider": None, "model": None})       # None DELETES (see save_prefs)
+        _boot_prefs.pop("provider", None); _boot_prefs.pop("model", None)
     _env_from_config(cfg, _boot_prefs.get("provider"))
     if not _key_present() and _first_run_setup("Welcome! No API key configured yet"):
         cfg = load_config()          # the wizard just wrote ~/.sliceagent/config.toml — pick it up
@@ -468,6 +483,18 @@ def main() -> None:
         ans = input(f"  ⚠ allow {name} {str(detail)[:60]!r}? ({reason}) [y]es/[n]o/[a]lways: ").strip().lower()
         return {"y": "yes", "yes": "yes", "a": "always", "always": "always"}.get(ans, "no")
 
+    def _live_pid():
+        """The configured provider the LIVE llm is actually bound to (endpoint+key match), or None.
+        Prefs must pin what's IN EFFECT, not the last menu pick — a typed `/model <name>` keeps the
+        endpoint, so blindly re-saving the old pin resurrected a dead endpoint+model pairing at boot."""
+        lbase = getattr(llm, "_base_url", "") or ""
+        lkey = getattr(llm.client, "api_key", None)
+        for p, t in (cfg.providers() or {}).items():
+            if isinstance(t, dict) and t.get("api_key") and t["api_key"] == lkey \
+                    and (t.get("base_url") or "") == lbase:
+                return p
+        return None
+
     def _handle_slash(line):  # TUI navigation palette — wired to existing session ops
         nonlocal cfg          # /config hot-reloads the config after the in-session wizard
         parts = line.split(maxsplit=1)
@@ -595,8 +622,9 @@ def main() -> None:
                             _kw = {"base_url": _tbl.get("base_url") or "", "api_key": _tbl["api_key"]}
                     llm.switch(model=_model, reasoning=_reasoning, **_kw)
                     _stats["model"] = llm.model
+                    # pin the provider ACTUALLY in effect (None DELETES a stale pin — see save_prefs)
                     save_prefs({"model": llm.model, "reasoning": llm.reasoning,
-                                **({"provider": _pid} if _pid else {})})
+                                "provider": _pid or _live_pid()})
                     note = _reasoning_note(llm)
                     _console.print(f"  ✓ model → [bold]{llm.model}[/]"
                                    + (f" @ [bold]{_pid}[/]" if _pid else "")
@@ -619,7 +647,9 @@ def main() -> None:
                     _console.print("  effort must be one of: fast | full | high | max"); return True
                 llm.switch(model=name, reasoning=eff)
                 _stats["model"] = llm.model
-                save_prefs({"model": llm.model, "reasoning": llm.reasoning})
+                # typed /model keeps the endpoint — re-resolve the pin against the LIVE binding so a
+                # stale provider pin can't resurrect the old endpoint under this model at next boot
+                save_prefs({"model": llm.model, "reasoning": llm.reasoning, "provider": _live_pid()})
                 note = _reasoning_note(llm)
                 _console.print(f"  ✓ model → [bold]{llm.model}[/]"
                                + (f" · reasoning [bold]{llm.reasoning}[/]" if eff else "")

{sliceagent-0.1.7 → sliceagent-0.1.8}/src/sliceagent/config.py

@@ -52,12 +52,17 @@ def load_prefs() -> dict:
 
 
 def save_prefs(updates: dict) -> None:
-    """Merge non-empty `updates` into the prefs sidecar (atomic write). Best-effort; never raises."""
+    """Merge non-empty `updates` into the prefs sidecar (atomic write); an explicit None DELETES the
+    key (a stale `provider` pin must be removable — merge-only let an old endpoint pin resurrect at
+    the next boot under a model it doesn't serve). Best-effort; never raises."""
     try:
         import json
         path = _prefs_path()
         os.makedirs(os.path.dirname(path), exist_ok=True)
         cur = load_prefs()
+        for k, v in updates.items():
+            if v is None:
+                cur.pop(k, None)
         cur.update({k: v for k, v in updates.items() if v})
         tmp = path + ".tmp"
         with open(tmp, "w", encoding="utf-8") as f:

{sliceagent-0.1.7 → sliceagent-0.1.8}/src/sliceagent/llm.py

@@ -283,7 +283,13 @@ class OpenAILLM:
             ckw: dict = {"api_key": new_key}
             if new_base:
                 ckw["base_url"] = new_base
+            old_client = getattr(self, "client", None)
             self.client = OpenAI(http_client=http_client, timeout=timeout, max_retries=2, **ckw)
+            if old_client is not None:       # close the replaced connection pool — /model hops leaked fds
+                try:
+                    old_client.close()
+                except Exception:  # noqa: BLE001 — cleanup must never break the switch
+                    pass
             self._base_url = new_base or ""
             self._drop_reasoning_effort = False
         if model:

{sliceagent-0.1.7 → sliceagent-0.1.8}/src/sliceagent/onboarding.py

@@ -140,10 +140,42 @@ def _read_config(path: str) -> dict:
     try:
         with open(path, "rb") as f:
             return tomllib.load(f)
-    except (OSError, tomllib.TOMLDecodeError):
+    except (OSError, tomllib.TOMLDecodeError, UnicodeDecodeError, ValueError):
+        # sibling parity with config.py:_read_toml — a non-UTF-8 or malformed config must DEGRADE, not
+        # crash `sliceagent config` / `config --use` / the init wizard with a traceback.
         return {}
 
 
+def _backup_if_corrupt(path: str) -> "str | None":
+    """A rewrite reads the existing config to MERGE into; but _read_config returns {} for BOTH 'missing'
+    and 'unparseable', so a rewrite over a corrupt file would silently ERASE every provider key + section
+    it couldn't parse. Guard the writers: if `path` exists and is non-empty but does NOT parse, move it
+    aside to a non-clobbering .bak first (the keys survive, recoverable) and return the backup path; else
+    None (absent / empty / valid — nothing to protect)."""
+    import tomllib
+    try:
+        with open(path, "rb") as f:
+            raw = f.read()
+    except OSError:
+        return None
+    if not raw.strip():
+        return None
+    try:
+        tomllib.loads(raw.decode("utf-8"))
+        return None                                  # parses fine → a normal merge is safe
+    except (tomllib.TOMLDecodeError, UnicodeDecodeError, ValueError):
+        pass
+    bak, n = path + ".bak", 0
+    while os.path.exists(bak):                        # never clobber an earlier backup
+        n += 1
+        bak = f"{path}.bak.{n}"
+    try:
+        os.replace(path, bak)
+        return bak
+    except OSError:
+        return None
+
+
 def _atomic_write(path: str, body: str) -> None:
     """ATOMIC 0600 write (the file holds an API key — never leave it half-written): write a temp in the same
     dir, fsync, then os.replace(); on ANY failure remove the temp so no key-bearing fragment is left behind."""
@@ -170,8 +202,10 @@ def _atomic_write(path: str, body: str) -> None:
                 pass
 
 
-def _save_provider(path: str, *, pid: str, model: str, api_key: str, base_url: str) -> None:
-    """Merge a provider into the config: add/update [providers.<pid>], set it as the default, keep the rest."""
+def _save_provider(path: str, *, pid: str, model: str, api_key: str, base_url: str) -> "str | None":
+    """Merge a provider into the config: add/update [providers.<pid>], set it as the default, keep the rest.
+    Returns the path of a backup taken when the existing config was unparseable (else None)."""
+    bak = _backup_if_corrupt(path)                   # never silently erase keys in a corrupt config
     data = _read_config(path)
     provs = data.setdefault("providers", {})
     if not isinstance(provs, dict):              # a corrupt non-dict providers must not crash on provs[pid]=
@@ -186,6 +220,7 @@ def _save_provider(path: str, *, pid: str, model: str, api_key: str, base_url: s
     agent["default_provider"] = pid
     agent["model"] = model                                     # keep top-level model in sync (back-compat)
     _atomic_write(path, _emit_toml(data))
+    return bak
 
 
 def _test_key(model: str, api_key: str, base_url: str, llm_factory) -> tuple[bool, str]:
@@ -250,8 +285,20 @@ def run_init(*, inp=input, getpw=None, llm_factory=None, home=None) -> int:
             for k in keys:
                 _id, label, _base, model0 = PROVIDERS[k]
                 out(f"    {k}. {label}" + (f"  ({model0})" if model0 else ""))
-            choice = inp("  > ").strip() or "1"
-        pid, label, base_url, model = PROVIDERS.get(choice, PROVIDERS["1"])
+            # an unrecognized answer must NOT silently become provider 1 (a typed "openai" used to
+            # configure OpenRouter without a word) — accept a number OR a provider id, else re-ask.
+            choice = None
+            for _attempt in range(3):
+                raw = inp("  > ").strip() or "1"
+                if raw in PROVIDERS:
+                    choice = raw; break
+                byname = next((k for k in keys if PROVIDERS[k][0] == raw.lower()), None)
+                if byname:
+                    choice = byname; break
+                out(f"  not a valid choice: {raw!r} — enter 1-{len(PROVIDERS)} or a provider name")
+            if choice is None:
+                out("  no valid choice — aborting."); return 1
+        pid, label, base_url, model = PROVIDERS[choice]
         if pid == "custom":
             base_url = inp("  Base URL (OpenAI-compatible, e.g. https://host/v1): ").strip()
         # RE-CONFIGURING an ALREADY-SAVED provider (re-running `sliceagent init` to update the model,
@@ -303,7 +350,9 @@ def run_init(*, inp=input, getpw=None, llm_factory=None, home=None) -> int:
         if cont not in ("y", "yes"):
             out("  Not saved. Re-run `sliceagent init` to try again."); return 1
 
-    _save_provider(path, pid=pid, model=model, api_key=key, base_url=base_url)
+    bak = _save_provider(path, pid=pid, model=model, api_key=key, base_url=base_url)
+    if bak:
+        out(f"  ⚠ the existing config didn't parse — moved it to {bak} (its keys are recoverable there).")
     out(f"\n  Saved provider '{pid}' (model {model}) → {path} (0600)")
     out("  Ready. Run:  sliceagent\n")
     return 0
@@ -356,7 +405,8 @@ def run_config(argv=None, *, home=None, env=None) -> int:
         out("  providers (* = default · `config --use <id>` to switch):")
         for pid, p in provs.items():
             mark = "*" if pid == default else " "
-            out(f"    {mark} {pid}  ({(p or {}).get('model', '?')})")
+            model = p.get("model", "?") if isinstance(p, dict) else "?"   # a scalar under [providers] must not crash
+            out(f"    {mark} {pid}  ({model})")
     out("  set values:")
     any_set = False
     for e in REGISTRY:

{sliceagent-0.1.7 → sliceagent-0.1.8}/src/sliceagent/policy.py

@@ -96,11 +96,30 @@ def ask_mutations(name: str, args: dict) -> Optional[ToolDecision]:
 # mode runs it without a confirm prompt. Deny-by-default: an unknown verb still asks. The catastrophic floor
 # (no_dangerous_commands) runs BEFORE this, so e.g. `cat /etc/passwd` is still denied.
 _RO_VERBS = frozenset((
-    "ls", "pwd", "cat", "head", "tail", "wc", "echo", "which", "type", "env", "printenv", "date",
+    "ls", "pwd", "cat", "head", "tail", "wc", "echo", "which", "type", "printenv", "date",
     "whoami", "hostname", "uname", "id", "groups", "tree", "stat", "file", "du", "df", "realpath",
-    "dirname", "basename", "grep", "rg", "egrep", "fgrep", "sort", "uniq", "nl", "cut", "column",
+    "dirname", "basename", "grep", "rg", "egrep", "fgrep", "sort", "nl", "cut", "column",
     "cksum", "md5", "md5sum", "sha1sum", "sha256sum", "true",
 ))
+# `env` and `uniq` were REMOVED from the allowlist: `env <program>` executes an arbitrary program, and
+# `uniq [IN] OUT` OVERWRITES its optional second positional — neither is provably read-only, so they now
+# take the normal confirm path. A few remaining allowlisted verbs stay read-only ONLY without a specific
+# WRITE/EXEC option; deny-by-default when that option is present (verb-scoped so read-only siblings like
+# `du -s` / `grep -o` keep auto-running). Value-taking flags match `-o`, `-o=…`, `-oFILE`, `--output=…`.
+_UNSAFE_OPTS = {
+    "sort": ("-o", "--output"),   # -o FILE / --output=FILE overwrite a file
+    "date": ("-s", "--set"),      # set the system clock (a mutation)
+    "tree": ("-o",),              # -o FILE writes the listing to a file
+}
+
+
+def _has_unsafe_opt(verb: str, toks: list) -> bool:
+    bad = _UNSAFE_OPTS.get(verb, ())
+    for t in toks[1:]:
+        for b in bad:
+            if t == b or t.startswith(b + "=") or (len(b) == 2 and len(t) > 2 and t.startswith(b)):
+                return True
+    return False
 # git subcommands with NO mutating form (excludes branch/tag/config/remote/stash/reflog, which can write).
 _RO_GIT_SUB = frozenset((
     "status", "log", "diff", "show", "rev-parse", "ls-files", "ls-tree", "describe", "blame",
@@ -127,10 +146,15 @@ def _is_readonly_command(cmd: str) -> bool:
     verb = os.path.basename(toks[0])
     if verb == "git":
         sub = next((t for t in toks[1:] if not t.startswith("-")), "")
-        return sub in _RO_GIT_SUB
+        if sub not in _RO_GIT_SUB:
+            return False
+        # `git grep --open-files-in-pager[=<cmd>]` / `-O[<cmd>]` runs a PAGER program (arbitrary exec).
+        if sub == "grep" and any(t.startswith("--open-files-in-pager") or t.startswith("-O") for t in toks):
+            return False
+        return True
     if verb == "find":
         return not any(t in _FIND_MUTATORS for t in toks)
-    return verb in _RO_VERBS
+    return verb in _RO_VERBS and not _has_unsafe_opt(verb, toks)
 
 
 def ask_commands(name: str, args: dict) -> Optional[ToolDecision]:

{sliceagent-0.1.7 → sliceagent-0.1.8}/src/sliceagent/tui.py

@@ -864,12 +864,16 @@ def _model_candidates(llm, cfg):
 
 def _reasoning_levels(model, base_url):
     """Reasoning levels valid for a model, derived from its capability (provider-aware). Effort-capable
-    models (gpt-5/o-series) expose all four; others only fast/full (high/max would degrade to default)."""
+    models (gpt-5/o-series) expose all four; OpenRouter exposes fast/full/high (its unified reasoning
+    object maps max→high, so offering max would be a lie); others only fast/full (high/max would
+    degrade to default)."""
     from .model_catalog import capability
     full4 = [("fast", "minimal reasoning — fastest, cheapest"),
              ("full", "provider default reasoning"),
              ("high", "deeper reasoning (effort=high, /v1/responses)"),
              ("max", "deepest reasoning (effort=xhigh)")]
+    if "openrouter" in (base_url or "").lower():   # unified reasoning object honors effort WITH tools
+        return full4[:2] + [("high", "deeper reasoning (unified reasoning, effort=high)")]
     if capability(model, base_url).supports_reasoning_effort:
         return full4
     return full4[:2]   # fast | full only — the model has no effort knob
@@ -888,7 +892,10 @@ def select_model_reasoning(llm, cfg, *, pt_input=None, pt_output=None):
     if pick is None:
         return None
     model, _grp, pid = cands[pick]
-    base = getattr(llm, "_base_url", "") if model == llm.model else ""
+    if pid:   # the pick will REBIND to this provider — offer the levels ITS endpoint supports
+        base = ((cfg.providers() or {}).get(pid) or {}).get("base_url") or ""
+    else:
+        base = getattr(llm, "_base_url", "") if model == llm.model else ""
     levels = _reasoning_levels(model, base)
     lvl_rows = [(name, desc) for name, desc in levels]
     lvl_cur = next((i for i, (n, _) in enumerate(levels) if n == llm.reasoning), -1)

{sliceagent-0.1.7 → sliceagent-0.1.8}/tests/test_bughunt_fixes.py

@@ -918,7 +918,10 @@ def cost_chart_renders_flat_vs_rising():
     import sys
     root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
     sys.path.insert(0, os.path.join(root, "evals"))
-    import realenv_multiturn as rem                                  # importable WITHOUT the heavy swebench dep
+    try:
+        import realenv_multiturn as rem                              # importable WITHOUT the heavy swebench dep
+    except ModuleNotFoundError:
+        return  # evals/ is a local-only dev tree, not shipped in the installed package (CI) — skip, don't fail
     rows = [{"turn": i, "peak_in": 6000, "transcript": 6000 * i} for i in range(1, 13)]
     chart = rem.render_cost_chart(rows)
     assert "sliceagent" in chart and "transcript" in chart and "12×" in chart, chart

sliceagent-0.1.8/tests/test_config_journey.py

@@ -0,0 +1,260 @@
+"""The clear config journey (user-designed): /config manages providers in-session, and /model shows
+ONLY configured providers' models — picking one switches model + endpoint + key together.
+Offline: stub objects, no network, no pytest. Run: PYTHONPATH=src python tests/test_config_journey.py
+"""
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "src"))
+
+from sliceagent.config import Config                      # noqa: E402
+from sliceagent.llm import OpenAILLM                      # noqa: E402
+from sliceagent.tui import _SLASH, _model_candidates, select_model_reasoning  # noqa: E402
+
+CHECKS = []
+def check(fn):
+    CHECKS.append(fn)
+    return fn
+
+
+class _Llm:
+    model = "deepseek-chat"
+    _base_url = "https://api.deepseek.com/v1"
+    reasoning = "full"
+
+
+_CFG = Config({"providers": {
+    "deepseek": {"api_key": "k1", "base_url": "https://api.deepseek.com/v1", "model": "deepseek-chat"},
+    "openrouter": {"api_key": "k2", "base_url": "https://openrouter.ai/api/v1", "model": "openai/gpt-5.5"},
+    "keyless": {"model": "phantom-model"},               # no api_key → NOT usable → must not appear
+}})
+
+
+@check
+def model_menu_lists_only_configured_providers():
+    cands = _model_candidates(_Llm(), _CFG)
+    pids = {pid for _, _, pid in cands if pid}
+    models = [m for m, _, _ in cands]
+    assert pids == {"deepseek", "openrouter"}, f"only keyed providers may appear, got {pids}"
+    assert "phantom-model" not in models, "a provider without a key must not contribute models"
+    assert "deepseek-chat" in models and "openai/gpt-5.5" in models
+    assert "anthropic/claude-sonnet-5" in models, "configured providers contribute their suggestions too"
+
+
+@check
+def every_candidate_carries_its_provider_for_endpoint_switch():
+    for m, _grp, pid in _model_candidates(_Llm(), _CFG):
+        assert pid in ("deepseek", "openrouter"), f"{m} must map to a configured provider, got {pid!r}"
+
+
+@check
+def env_current_model_is_labeled_honestly_not_as_a_provider():
+    class _EnvLlm:                                    # env model NOT in any configured provider's list
+        model = "gpt-5.5"
+        _base_url = "https://api.deepseek.com/v1"     # deepseek endpoint must NOT make it say "deepseek"
+        reasoning = "full"
+    cands = _model_candidates(_EnvLlm(), _CFG)
+    m, grp, pid = cands[0]
+    assert m == "gpt-5.5" and pid is None
+    assert grp == "current (env)", f"env model must not masquerade as a configured provider, got {grp!r}"
+
+
+@check
+def no_providers_configured_falls_back_to_known_set():
+    cands = _model_candidates(_Llm(), Config({}))
+    assert cands, "env-only setups still need a menu"
+    assert all(pid is None for _, _, pid in cands), "fallback entries have no provider to rebind to"
+    assert any(m == "deepseek-chat" for m, _, _ in cands)
+
+
+@check
+def switch_rebinds_endpoint_and_key():
+    saved = {k: os.environ.pop(k, None) for k in ("AGENT_PROXY", "HTTPS_PROXY", "HTTP_PROXY")}
+    try:
+        llm = OpenAILLM(model="deepseek-chat", api_key="k1", base_url="https://api.deepseek.com/v1")
+        assert llm._base_url == "https://api.deepseek.com/v1"
+        llm.switch(model="openai/gpt-5.5", base_url="https://openrouter.ai/api/v1", api_key="k2")
+        assert llm.model == "openai/gpt-5.5"
+        assert llm._base_url == "https://openrouter.ai/api/v1"
+        assert str(llm.client.base_url).startswith("https://openrouter.ai/api/v1"), \
+            "the OpenAI client itself must be rebuilt against the new endpoint"
+        assert llm.client.api_key == "k2", "the key must follow the provider"
+        # base_url="" → SDK default endpoint (OpenAI)
+        llm.switch(model="gpt-5.5", base_url="", api_key="k3")
+        assert llm._base_url == "" and "openrouter" not in str(llm.client.base_url)
+        # model-only switch keeps the endpoint (the classic /model <name> path)
+        llm.switch(model="gpt-5")
+        assert llm.model == "gpt-5" and llm.client.api_key == "k3"
+    finally:
+        for k, v in saved.items():
+            if v is not None:
+                os.environ[k] = v
+
+
+@check
+def selector_returns_the_provider_triple():
+    from prompt_toolkit.input.defaults import create_pipe_input
+    from prompt_toolkit.output import DummyOutput
+    with create_pipe_input() as pinp:
+        pinp.send_text("\r\r")                     # Enter (model) + Enter (reasoning)
+        got = select_model_reasoning(_Llm(), _CFG, pt_input=pinp, pt_output=DummyOutput())
+    assert got is not None and len(got) == 3, f"expected (model, reasoning, pid), got {got!r}"
+    model, _reasoning, pid = got
+    assert pid in ("deepseek", "openrouter") and isinstance(model, str)
+
+
+@check
+def config_command_is_in_the_slash_palette():
+    assert "/config" in _SLASH, "/config must be discoverable in the palette"
+
+
+@check
+def boot_binds_pinned_provider_as_a_unit_never_default_providers_base():
+    """The cross-wiring bug: prefs pin openai (no base_url = SDK default) while default_provider is
+    deepseek → boot must NOT pair the openai key with the deepseek base_url."""
+    from sliceagent.cli import _env_from_config
+    c = Config({"providers": {
+        "openai": {"api_key": "sk-openai", "model": "gpt-5.5"},
+        "deepseek": {"api_key": "sk-ds", "base_url": "https://api.deepseek.com/v1", "model": "deepseek-chat"},
+    }, "agent": {"default_provider": "deepseek"}})
+    saved = {k: os.environ.pop(k, None) for k in ("LLM_API_KEY", "LLM_BASE_URL")}
+    try:
+        _env_from_config(c, "openai")
+        assert os.environ.get("LLM_API_KEY") == "sk-openai"
+        assert not os.environ.get("LLM_BASE_URL"), \
+            f"openai pin must leave base at SDK default, got {os.environ.get('LLM_BASE_URL')!r}"
+        os.environ.pop("LLM_API_KEY", None); os.environ.pop("LLM_BASE_URL", None)
+        _env_from_config(c, "deepseek")                       # a pin WITH base_url binds its own pair
+        assert os.environ.get("LLM_API_KEY") == "sk-ds"
+        assert os.environ.get("LLM_BASE_URL") == "https://api.deepseek.com/v1"
+        os.environ.pop("LLM_API_KEY", None); os.environ.pop("LLM_BASE_URL", None)
+        _env_from_config(c, "gone")                           # deleted pin → default provider's own pair
+        assert os.environ.get("LLM_API_KEY") == "sk-ds" and "deepseek" in os.environ.get("LLM_BASE_URL", "")
+    finally:
+        for k in ("LLM_API_KEY", "LLM_BASE_URL"):
+            os.environ.pop(k, None)
+        for k, v in saved.items():
+            if v is not None:
+                os.environ[k] = v
+
+
+@check
+def save_prefs_none_deletes_a_stale_pin():
+    import json
+    import tempfile
+    import sliceagent.config as _cfgmod
+    with tempfile.TemporaryDirectory() as tmp:
+        orig = _cfgmod._prefs_path
+        _cfgmod._prefs_path = lambda: os.path.join(tmp, "prefs.json")
+        try:
+            _cfgmod.save_prefs({"model": "a", "provider": "openrouter"})
+            _cfgmod.save_prefs({"model": "b", "provider": None})       # typed /model → pin removed
+            got = json.load(open(os.path.join(tmp, "prefs.json")))
+            assert got.get("model") == "b" and "provider" not in got, f"stale pin survived: {got}"
+        finally:
+            _cfgmod._prefs_path = orig
+
+
+@check
+def openrouter_models_offer_high_reasoning_in_the_menu():
+    from sliceagent.tui import _reasoning_levels
+    names = [n for n, _ in _reasoning_levels("openai/gpt-5.5", "https://openrouter.ai/api/v1")]
+    assert "high" in names, "openrouter's unified reasoning honors high — the menu must offer it"
+    assert "max" not in names, "openrouter maps max→high; offering max would lie"
+    assert [n for n, _ in _reasoning_levels("deepseek-chat", "https://api.deepseek.com/v1")] == ["fast", "full"]
+
+
+@check
+def switch_closes_the_replaced_client():
+    saved = {k: os.environ.pop(k, None) for k in ("AGENT_PROXY", "HTTPS_PROXY", "HTTP_PROXY")}
+    try:
+        llm = OpenAILLM(model="deepseek-chat", api_key="k1", base_url="https://api.deepseek.com/v1")
+        first = llm.client
+        llm.switch(model="openai/gpt-5.5", base_url="https://openrouter.ai/api/v1", api_key="k2")
+        hc = getattr(first, "_client", None)                  # the underlying httpx client
+        assert hc is None or hc.is_closed, "the replaced client's connection pool must be closed"
+        assert llm.client is not first
+    finally:
+        for k, v in saved.items():
+            if v is not None:
+                os.environ[k] = v
+
+
+@check
+def config_save_backs_up_a_corrupt_config_instead_of_erasing_keys():
+    import tempfile
+    from sliceagent.onboarding import _save_provider
+    with tempfile.TemporaryDirectory() as d:
+        p = os.path.join(d, "config.toml")
+        with open(p, "w") as f:
+            f.write('[providers.deepseek]\napi_key = "sk-PRECIOUS"\nmodel = "deepseek-chat"\n')
+        with open(p, "w") as f:
+            f.write('[providers.deepseek\napi_key = "sk-PRECIOUS"\n')   # one-char TOML typo
+        bak = _save_provider(p, pid="openai", model="gpt-5.5", api_key="sk-new", base_url="")
+        assert bak and os.path.exists(bak), "an unparseable config must be moved aside, not erased"
+        assert "sk-PRECIOUS" in open(bak).read(), "the old key must survive in the backup"
+        assert "sk-new" in open(p).read(), "the new provider must still be written"
+
+
+@check
+def config_read_degrades_on_non_utf8_instead_of_crashing():
+    import tempfile
+    from sliceagent.onboarding import _read_config, run_config
+    with tempfile.TemporaryDirectory() as d:
+        cfgdir = os.path.join(d, ".sliceagent"); os.makedirs(cfgdir)
+        p = os.path.join(cfgdir, "config.toml")
+        with open(p, "wb") as f:
+            f.write(b'[agent]\nmodel = "caf\xe9"\n')            # non-UTF-8 byte
+        assert _read_config(p) == {}, "_read_config must degrade, not raise UnicodeDecodeError"
+        assert run_config([], home=d) == 0, "`sliceagent config` must not crash on a non-utf8 file"
+
+
+@check
+def config_show_tolerates_a_scalar_under_providers():
+    import tempfile
+    from sliceagent.onboarding import run_config
+    with tempfile.TemporaryDirectory() as d:
+        cfgdir = os.path.join(d, ".sliceagent"); os.makedirs(cfgdir)
+        with open(os.path.join(cfgdir, "config.toml"), "w") as f:
+            f.write('[providers]\nfoo = "bar"\n')               # scalar, not a table
+        assert run_config([], home=d) == 0, "a scalar under [providers] must not crash `config`"
+
+
+@check
+def readonly_allowlist_rejects_exec_and_write_affordances():
+    from sliceagent.policy import _is_readonly_command as ro
+    for bypass in ["env sh -c 'touch x'", "env python3 e.py", "sort -o important.py /dev/null",
+                   "sort --output=x a", "date -s 2020-01-01", "tree -o out.txt",
+                   "uniq /dev/null important.py", "git grep --open-files-in-pager=/tmp/e.sh x",
+                   "git grep -Oless foo"]:
+        assert not ro(bypass), f"must NOT auto-run (execs/writes): {bypass!r}"
+    for ok in ["ls -la", "cat f", "du -s .", "grep -o pat file", "sort a.txt", "git grep foo",
+               "git log --oneline", "printenv PATH", "date", "tree -L 2", "wc -l f"]:
+        assert ro(ok), f"read-only command must still auto-run: {ok!r}"
+
+
+@check
+def wizard_typed_fallback_rejects_unknown_provider_choice():
+    """A typed 'openai' must configure OPENAI (name accepted); pure garbage must abort, not silently
+    become OpenRouter."""
+    import tempfile
+    from sliceagent.onboarding import run_init
+    with tempfile.TemporaryDirectory() as tmp:
+        feed = iter(["garbage", "junk", "nope"])              # 3 strikes → abort
+        rc = run_init(inp=lambda *_: next(feed), getpw=lambda *_: "k", home=tmp)
+        assert rc == 1, f"3 invalid choices must abort, got rc={rc}"
+    with tempfile.TemporaryDirectory() as tmp:
+        feed = iter(["openai", "my-model", ""])               # name accepted; blank key → abort path
+        rc = run_init(inp=lambda *_: next(feed), getpw=lambda *_: "", home=tmp)
+        assert rc == 1, "no key entered must abort"
+
+
+if __name__ == "__main__":
+    ok = 0
+    for fn in CHECKS:
+        try:
+            fn(); ok += 1; print(f"PASS {fn.__name__}")
+        except Exception as e:  # noqa: BLE001
+            print(f"FAIL {fn.__name__}: {type(e).__name__}: {e}")
+    print(f"\n{ok}/{len(CHECKS)} passed")
+    sys.exit(0 if ok == len(CHECKS) else 1)