fix: drop npm@latest from the OIDC publish path

Rely on the npm bundled with the pinned Node 24 toolchain (>= 11.5.1,
the trusted-publishing minimum) instead of pulling an unpinned
npm@latest from the registry inside the publish job, and fail fast
with a clear error if a future toolchain change regresses it.

.github/workflows/release-artifacts.yml

@@ -112,12 +112,6 @@ jobs:
     needs: package
     if: ${{ startsWith(github.ref, 'refs/tags/v') }}
     runs-on: ubuntu-latest
-    # Manual approval gate: this environment carries a required-reviewer rule
-    # (Settings -> Environments -> npm-publish), so the job pauses until a
-    # maintainer approves it in the Actions UI before anything reaches npm.
-    environment:
-      name: npm-publish
-      url: https://www.npmjs.com/package/@gitlawb/zero
     permissions:
       contents: read
       id-token: write # OIDC token exchange for npm trusted publishing + provenance

.release-please-manifest.json

@@ -1 +1 @@
-{".":"0.1.0"}
+{}

CHANGELOG.md

@@ -6,19 +6,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html) once the first release is
 tagged. Until then, source builds report the version `dev`.
 
-## 0.1.0 (2026-07-02)
-
-
-### Features
-
-* publish zero to npm via release-please ([#367](https://github.com/Gitlawb/zero/issues/367)) ([8eccc26](https://github.com/Gitlawb/zero/commit/8eccc2669887bc38d35bc16a315c888e4d9ec43a))
-* **tui:** FILES sidebar panel with click-to-select and file drill-in ([#365](https://github.com/Gitlawb/zero/issues/365)) ([142c548](https://github.com/Gitlawb/zero/commit/142c548c89a8652ce300e64ddf1228ee36df7606))
-
-
-### Bug Fixes
-
-* **auth:** propagate credentials to every provider-build surface and pin children to the live provider ([#366](https://github.com/Gitlawb/zero/issues/366)) ([6e0a665](https://github.com/Gitlawb/zero/commit/6e0a665118fe0e09c4b07d482dd18f86045acd2b))
-
 ## [Unreleased]
 
 ### Added

internal/cli/acp.go

@@ -43,11 +43,8 @@ func runACP(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) int
 	conn := acp.NewConn(deps.stdin, stdout)
 	acp.NewAgent(conn, acp.Deps{
 		ResolveConfig: deps.resolveConfig,
-		// deps.newProvider is wrapped in fillAppDeps to apply the stored API key,
-		// so ACP is authenticated for apiKeyStored profiles like every other
-		// surface — no ACP-specific credential handling needed.
-		NewProvider: deps.newProvider,
-		RunAgent:    agent.Run,
+		NewProvider:   deps.newProvider,
+		RunAgent:      agent.Run,
 		// Build the SCOPED registry + sandbox engine per workspace, exactly like the
 		// exec surface, so ACP shell/file tools are confined — never run unconfined.
 		BuildWorkspace: func(workspaceRoot string, resolved config.ResolvedConfig) (*tools.Registry, *sandbox.Engine, error) {

internal/cli/app.go

@@ -43,17 +43,12 @@ import (
 var version = "dev"
 
 type appDeps struct {
-	getwd            func() (string, error)
-	stdin            io.Reader
-	userConfigPath   func() (string, error)
-	resolveConfig    func(workspaceRoot string, overrides config.Overrides) (config.ResolvedConfig, error)
-	resolveMCPConfig func(workspaceRoot string) (config.MCPConfig, error)
-	newProvider      func(config.ProviderProfile) (zeroruntime.Provider, error)
-	// exportActiveProvider pins spawned children to the run's provider (production:
-	// config.SetActiveProviderEnv, set in defaultAppDeps — deliberately NOT filled
-	// by fillAppDeps, so tests never mutate the process environment unless they
-	// inject it). nil ⇒ no export.
-	exportActiveProvider  func(providerName string)
+	getwd                 func() (string, error)
+	stdin                 io.Reader
+	userConfigPath        func() (string, error)
+	resolveConfig         func(workspaceRoot string, overrides config.Overrides) (config.ResolvedConfig, error)
+	resolveMCPConfig      func(workspaceRoot string) (config.MCPConfig, error)
+	newProvider           func(config.ProviderProfile) (zeroruntime.Provider, error)
 	probeProviderHealth   func(context.Context, providerhealth.Options) providerhealth.Result
 	detectLocalRuntimes   func(context.Context, provideronboarding.LocalDetectOptions) []provideronboarding.DetectedLocalRuntime
 	newSessionStore       func() *sessions.Store
@@ -104,10 +99,9 @@ func Run(args []string, stdout io.Writer, stderr io.Writer) int {
 
 func defaultAppDeps() appDeps {
 	return appDeps{
-		getwd:                os.Getwd,
-		stdin:                os.Stdin,
-		userConfigPath:       config.DefaultUserConfigPath,
-		exportActiveProvider: config.SetActiveProviderEnv,
+		getwd:          os.Getwd,
+		stdin:          os.Stdin,
+		userConfigPath: config.DefaultUserConfigPath,
 		resolveConfig: func(workspaceRoot string, overrides config.Overrides) (config.ResolvedConfig, error) {
 			options, err := config.DefaultResolveOptions(workspaceRoot)
 			if err != nil {
@@ -124,14 +118,9 @@ func defaultAppDeps() appDeps {
 			return config.ResolveMCP(options)
 		},
 		newProvider: func(profile config.ProviderProfile) (zeroruntime.Provider, error) {
-			// Resolve the OAuth login ONCE: the bearer resolver and the login key it
-			// bound must describe the same login (the key is passed on to the Codex
-			// account-header resolver so it never re-selects independently).
-			resolver, loginKey := oauthLoginForProfile(profile)
 			return providers.New(profile, providers.Options{
 				UserAgent:     userAgent(),
-				OAuthResolver: resolver,
-				OAuthLoginKey: loginKey,
+				OAuthResolver: oauthResolverForProfile(profile),
 			})
 		},
 		probeProviderHealth: providerhealth.Probe,
@@ -402,14 +391,6 @@ func runWithDeps(args []string, stdout io.Writer, stderr io.Writer, deps appDeps
 		if _, err := fmt.Fprintf(stderr, "unknown command %q\n", args[0]); err != nil {
 			return 1
 		}
-		// First-run users reach for `zero login`/`zero logout` (reported in the
-		// wild); point them at the real command instead of a bare usage pointer.
-		switch strings.ToLower(args[0]) {
-		case "login", "logout":
-			if _, err := fmt.Fprintf(stderr, "did you mean %q?\n", "zero auth "+strings.ToLower(args[0])); err != nil {
-				return 1
-			}
-		}
 		if _, err := fmt.Fprintln(stderr, "Run zero --help for usage."); err != nil {
 			return 1
 		}
@@ -512,17 +493,6 @@ func fillAppDeps(deps appDeps) appDeps {
 	if deps.now == nil {
 		deps.now = defaults.now
 	}
-	// Wrap newProvider ONCE, after all defaults are filled, so every surface that
-	// builds the runtime provider gets the credential-store key applied. The
-	// resolver is pure and leaves apiKeyStored profiles keyless; an unwrapped
-	// build sends unauthenticated requests. config.ApplyStoredAPIKey is a no-op
-	// when the key is already set or the profile isn't stored-key, so this is
-	// safe and idempotent for every profile kind and every injected newProvider.
-	baseNewProvider := deps.newProvider
-	userConfigPath := deps.userConfigPath
-	deps.newProvider = func(profile config.ProviderProfile) (zeroruntime.Provider, error) {
-		return baseNewProvider(applyStoredProviderKeyAt(profile, userConfigPath))
-	}
 	return deps
 }
 
@@ -538,21 +508,7 @@ func runInteractiveTUIWithSetup(stderr io.Writer, deps appDeps, permissionMode a
 
 	resolved, err := deps.resolveConfig(workspaceRoot, config.Overrides{})
 	if err != nil {
-		// A resolve failure the setup wizard can FIX is not fatal for the
-		// interactive TUI: drop into the wizard with an empty config so the user
-		// can onboard/repair, instead of exiting with an error they can only fix
-		// by hand-editing config.json. That covers a missing/unresolvable active
-		// provider and an active provider without a model (custom endpoints have
-		// no catalog default) — previously the second shape bricked bare `zero`
-		// and `zero setup`, the exact commands that could have fixed it. Any
-		// other error (malformed JSON, directory conflict, etc.) is still fatal,
-		// and headless commands (zero config / zero exec) still fail with the
-		// actionable message.
-		if !errors.Is(err, config.ErrNoActiveProvider) && !errors.Is(err, config.ErrProviderRequiresModel) {
-			return writeAppError(stderr, err.Error(), 1)
-		}
-		resolved = config.ResolvedConfig{}
-		forceSetup = true
+		return writeAppError(stderr, err.Error(), 1)
 	}
 	userConfigPath, err := deps.userConfigPath()
 	if err != nil {
@@ -764,50 +720,20 @@ func tuiSandboxSetupCommand(backend sandbox.Backend, deps appDeps) func(context.
 	}
 }
 
-// buildProvider constructs the run's provider at STARTUP — it is called only from
-// the two launch paths (interactive TUI and headless exec), never from mid-run
-// rebuilds (escalation, wizard, ACP go through deps.newProvider directly).
 func buildProvider(resolved config.ResolvedConfig, deps appDeps) (zeroruntime.Provider, error) {
 	if !config.HasProviderProfile(resolved.Provider) {
 		return nil, nil
 	}
-	// deps.newProvider is wrapped in fillAppDeps to apply the stored key, so this
-	// (and every other newProvider caller) needs no per-site key handling.
-	provider, err := deps.newProvider(resolved.Provider)
-	if err != nil {
-		return nil, err
-	}
-	// Pin spawned children (sub-agents / swarm members inherit the environment) to
-	// THIS run's provider from launch, not only after an in-session switch. Without
-	// the launch-time export a child re-resolves config.json at spawn time, so a
-	// provider switch persisted by ANOTHER zero process mid-session would silently
-	// move new children onto a different provider (and different credentials) than
-	// the parent is running. Runtime switches (/model, /provider, wizard,
-	// onboarding) re-export on commit, keeping the pin current. Injected via deps
-	// (nil in tests) because it mutates the process environment.
-	if deps.exportActiveProvider != nil {
-		deps.exportActiveProvider(resolved.Provider.Name)
-	}
-	return provider, nil
-}
-
-// applyStoredProviderKeyAt loads the API key from the encrypted credential store
-// when the resolver left it empty (the resolver is pure — no I/O — so an
-// apiKeyStored profile reaches this layer keyless). No-op for inline/env-key
-// providers and when nothing is stored. This is applied once, centrally, by the
-// deps.newProvider wrapper in fillAppDeps so EVERY surface that builds a runtime
-// provider (headless exec, the ACP builder, exec's mid-run escalation switcher,
-// and any future caller) is covered without a per-site invariant to forget.
-func applyStoredProviderKeyAt(profile config.ProviderProfile, userConfigPath func() (string, error)) config.ProviderProfile {
-	if userConfigPath == nil {
-		return profile
-	}
-	if path, perr := userConfigPath(); perr == nil {
+	// Load the API key from the encrypted credential store when it isn't already
+	// resolved from inline config or an env var. This keeps the resolver pure (no
+	// I/O) and is a no-op for env/inline-key providers and when nothing is stored.
+	profile := resolved.Provider
+	if path, perr := deps.userConfigPath(); perr == nil {
 		if store, err := config.ProviderKeyStoreAt(filepath.Dir(path)); err == nil {
 			profile = config.ApplyStoredAPIKey(profile, store)
 		}
 	}
-	return profile
+	return deps.newProvider(profile)
 }
 
 func newCoreRegistry(workspaceRoot string) *tools.Registry {

internal/cli/app_test.go

@@ -5,7 +5,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"io"
 	"os"
 	"path/filepath"
@@ -158,80 +157,6 @@ func TestRunNoArgsLaunchesSetupTUIWithNilProviderWhenNoProviderConfigured(t *tes
 	assertAgentOptions(t, launchedOptions, 12, agent.PermissionModeAsk)
 }
 
-func TestRunNoArgsEntersSetupWhenResolveReportsNoActiveProvider(t *testing.T) {
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	cwd := t.TempDir()
-	setCLIUserConfigRoot(t)
-	userConfigPath := filepath.Join(t.TempDir(), "zero", "config.json")
-	var launchedOptions tui.Options
-	launched := false
-
-	exitCode := runWithDeps([]string{}, &stdout, &stderr, appDeps{
-		getwd: func() (string, error) {
-			return cwd, nil
-		},
-		resolveConfig: func(workspaceRoot string, overrides config.Overrides) (config.ResolvedConfig, error) {
-			return config.ResolvedConfig{}, fmt.Errorf("%w: active provider %q not found", config.ErrNoActiveProvider, "ghost")
-		},
-		newProvider: func(config.ProviderProfile) (zeroruntime.Provider, error) {
-			t.Fatal("newProvider should not be called without a resolved provider")
-			return nil, nil
-		},
-		userConfigPath: func() (string, error) {
-			return userConfigPath, nil
-		},
-		registerMCPTools: func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error) {
-			return noopMCPRuntime{}, nil
-		},
-		runTUI: func(ctx context.Context, options tui.Options) int {
-			launched = true
-			launchedOptions = options
-			return 0
-		},
-	})
-
-	if exitCode != 0 {
-		t.Fatalf("exit code = %d, want 0 (setup TUI launched), stderr=%q", exitCode, stderr.String())
-	}
-	if !launched {
-		t.Fatal("TUI was not launched; expected fallback into setup instead of a fatal error")
-	}
-	if !launchedOptions.Setup.Visible || !launchedOptions.Setup.Required {
-		t.Fatalf("Setup = %#v, want visible required setup", launchedOptions.Setup)
-	}
-	if launchedOptions.Provider != nil {
-		t.Fatalf("Provider = %#v, want nil for no-provider fallback", launchedOptions.Provider)
-	}
-}
-
-func TestRunNoArgsFailsWhenResolveErrorIsNotProviderRelated(t *testing.T) {
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	cwd := t.TempDir()
-	setCLIUserConfigRoot(t)
-
-	exitCode := runWithDeps([]string{}, &stdout, &stderr, appDeps{
-		getwd: func() (string, error) {
-			return cwd, nil
-		},
-		resolveConfig: func(workspaceRoot string, overrides config.Overrides) (config.ResolvedConfig, error) {
-			return config.ResolvedConfig{}, fmt.Errorf("invalid config JSON")
-		},
-		runTUI: func(ctx context.Context, options tui.Options) int {
-			t.Fatal("TUI must not launch on a non-provider resolve error")
-			return 0
-		},
-	})
-
-	if exitCode == 0 {
-		t.Fatal("exit code = 0, want non-zero for fatal config error")
-	}
-	if !strings.Contains(stderr.String(), "invalid config JSON") {
-		t.Fatalf("stderr = %q, want the underlying config error", stderr.String())
-	}
-}
-
 func TestRunNoArgsLaunchesTUIWithMCPState(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
@@ -1476,75 +1401,3 @@ func TestRunThemeFlagRejectsBadValue(t *testing.T) {
 		t.Fatalf("expected a clear --theme error, got %q", stderr.String())
 	}
 }
-
-// A custom endpoint saved without a model previously bricked bare `zero` and
-// `zero setup` — the exact commands that could have fixed it (the resolve
-// error escaped before the wizard could open). The interactive TUI now treats
-// the requires-model failure as "needs onboarding", same as a missing active
-// provider. The error comes from a REAL Resolve over a real config file, so
-// this exercises the production sentinel wrapping, not a hand-built error.
-func TestRunNoArgsEntersSetupWhenActiveProviderMissesModel(t *testing.T) {
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	cwd := t.TempDir()
-	setCLIUserConfigRoot(t)
-	brokenConfig := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(brokenConfig, []byte(`{
-		"activeProvider": "gw",
-		"providers": [{"name": "gw", "provider_kind": "openai-compatible", "baseURL": "https://gw.example/v1", "apiKey": "sk-x"}]
-	}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	launched := false
-	var launchedOptions tui.Options
-
-	exitCode := runWithDeps([]string{}, &stdout, &stderr, appDeps{
-		getwd: func() (string, error) { return cwd, nil },
-		resolveConfig: func(string, config.Overrides) (config.ResolvedConfig, error) {
-			return config.Resolve(config.ResolveOptions{UserConfigPath: brokenConfig, Env: map[string]string{}})
-		},
-		newProvider: func(config.ProviderProfile) (zeroruntime.Provider, error) {
-			t.Fatal("newProvider must not be called without a resolved provider")
-			return nil, nil
-		},
-		userConfigPath: func() (string, error) { return filepath.Join(t.TempDir(), "zero", "config.json"), nil },
-		registerMCPTools: func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error) {
-			return noopMCPRuntime{}, nil
-		},
-		runTUI: func(_ context.Context, options tui.Options) int {
-			launched = true
-			launchedOptions = options
-			return 0
-		},
-	})
-
-	if exitCode != 0 {
-		t.Fatalf("exit code = %d, want 0 (setup TUI launched), stderr=%q", exitCode, stderr.String())
-	}
-	if !launched {
-		t.Fatal("TUI was not launched; a fixable requires-model config must fall into setup, not exit fatally")
-	}
-	if !launchedOptions.Setup.Visible || !launchedOptions.Setup.Required {
-		t.Fatalf("Setup = %#v, want visible required setup", launchedOptions.Setup)
-	}
-}
-
-// `zero login`/`zero logout` don't exist (it's `zero auth login`); first-run
-// users try them (reported in the wild), so the unknown-command error points at
-// the real command.
-func TestRunUnknownLoginSuggestsAuthLogin(t *testing.T) {
-	var stdout, stderr bytes.Buffer
-	exitCode := runWithDeps([]string{"login"}, &stdout, &stderr, appDeps{})
-	if exitCode != 2 {
-		t.Fatalf("exit = %d, want 2 (unknown command)", exitCode)
-	}
-	if !strings.Contains(stderr.String(), `"zero auth login"`) {
-		t.Fatalf("stderr = %q, want a zero auth login suggestion", stderr.String())
-	}
-	// An unrelated unknown command gets no misleading suggestion.
-	stderr.Reset()
-	runWithDeps([]string{"frobnicate"}, &stdout, &stderr, appDeps{})
-	if strings.Contains(stderr.String(), "did you mean") {
-		t.Fatalf("stderr = %q, unrelated commands must not get the auth hint", stderr.String())
-	}
-}

internal/cli/auth_propagation_test.go

@@ -1,180 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"errors"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/Gitlawb/zero/internal/config"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
-)
-
-// seedStoredProviderKey writes key into a credential store rooted beside the
-// returned config path, and returns deps fields wired at that path — the same
-// layout applyStoredProviderKey resolves through in production.
-func seedStoredProviderKey(t *testing.T, providerName, key string) (userConfigPath string) {
-	t.Helper()
-	t.Setenv("ZERO_CRED_STORAGE", "encrypted-file") // never touch the real OS keychain in tests
-	dir := t.TempDir()
-	store, err := config.ProviderKeyStoreAt(dir)
-	if err != nil {
-		t.Fatalf("ProviderKeyStoreAt: %v", err)
-	}
-	if err := store.Set(providerName, key); err != nil {
-		t.Fatalf("seed stored key: %v", err)
-	}
-	return filepath.Join(dir, "config.json")
-}
-
-// applyStoredProviderKeyAt must fill APIKey from the credential store for an
-// apiKeyStored profile — the single central helper the newProvider wrapper uses.
-func TestApplyStoredProviderKeyAtFillsFromCredstore(t *testing.T) {
-	configPath := seedStoredProviderKey(t, "echo", "sk-stored-test")
-	ucp := func() (string, error) { return configPath, nil }
-
-	stored := applyStoredProviderKeyAt(config.ProviderProfile{Name: "echo", APIKeyStored: true}, ucp)
-	if stored.APIKey != "sk-stored-test" {
-		t.Fatalf("APIKey = %q, want the stored key", stored.APIKey)
-	}
-
-	// A profile that did NOT opt into stored-key auth must be left unchanged —
-	// a stale store entry must not silently reactivate credentials.
-	plain := applyStoredProviderKeyAt(config.ProviderProfile{Name: "echo"}, ucp)
-	if plain.APIKey != "" {
-		t.Fatalf("non-stored profile APIKey = %q, want empty", plain.APIKey)
-	}
-}
-
-// fillAppDeps wraps newProvider so EVERY surface that builds a runtime provider
-// (buildProvider, the ACP builder — which is just deps.newProvider — and exec's
-// escalation switcher) gets the stored key applied. Passing the raw resolved
-// profile previously sent unauthenticated requests for apiKeyStored profiles,
-// the default onboarding outcome. Testing the wrap covers all those surfaces.
-func TestFillAppDepsWrapsNewProviderWithStoredKey(t *testing.T) {
-	configPath := seedStoredProviderKey(t, "echo", "sk-stored-wrap")
-
-	var captured config.ProviderProfile
-	deps := fillAppDeps(appDeps{
-		userConfigPath: func() (string, error) { return configPath, nil },
-		newProvider: func(profile config.ProviderProfile) (zeroruntime.Provider, error) {
-			captured = profile
-			return nil, nil // only the captured profile matters here
-		},
-	})
-
-	if _, err := deps.newProvider(config.ProviderProfile{Name: "echo", APIKeyStored: true}); err != nil {
-		t.Fatalf("wrapped newProvider: %v", err)
-	}
-	if captured.APIKey != "sk-stored-wrap" {
-		t.Fatalf("wrapped newProvider built with APIKey = %q, want the stored key (unauthenticated regression)", captured.APIKey)
-	}
-}
-
-// buildProvider (the TUI/exec STARTUP construction site) must export
-// ZERO_PROVIDER so children spawned at any point in the run are pinned to the
-// parent's provider from launch — not only after an in-session switch. Without
-// this, a provider switch persisted by another zero process mid-session moves
-// new children onto a different provider (and credentials) than the parent.
-func TestBuildProviderExportsActiveProviderEnv(t *testing.T) {
-	t.Setenv(config.ActiveProviderEnv, "stale-from-elsewhere")
-	// The exporter is injected (defaultAppDeps wires config.SetActiveProviderEnv;
-	// fillAppDeps deliberately leaves it nil so ordinary tests never mutate the
-	// process env). Inject the real one here to assert the actual env effect.
-	deps := appDeps{
-		exportActiveProvider: config.SetActiveProviderEnv,
-		newProvider: func(config.ProviderProfile) (zeroruntime.Provider, error) {
-			return nil, nil
-		},
-	}
-
-	resolved := config.ResolvedConfig{Provider: config.ProviderProfile{Name: "pinned", ProviderKind: config.ProviderKindAnthropic, Model: "m"}}
-	if _, err := buildProvider(resolved, deps); err != nil {
-		t.Fatalf("buildProvider: %v", err)
-	}
-	if got := os.Getenv(config.ActiveProviderEnv); got != "pinned" {
-		t.Fatalf("%s = %q after startup build, want %q (children would spawn on the stale provider)", config.ActiveProviderEnv, got, "pinned")
-	}
-
-	// A FAILED build must not move the pin: the process never committed to the
-	// new provider, so children must keep resolving whatever was in effect.
-	t.Setenv(config.ActiveProviderEnv, "still-current")
-	failing := appDeps{
-		exportActiveProvider: config.SetActiveProviderEnv,
-		newProvider: func(config.ProviderProfile) (zeroruntime.Provider, error) {
-			return nil, errors.New("boom")
-		},
-	}
-	if _, err := buildProvider(resolved, failing); err == nil {
-		t.Fatal("expected build error")
-	}
-	if got := os.Getenv(config.ActiveProviderEnv); got != "still-current" {
-		t.Fatalf("%s = %q after failed build, want it untouched", config.ActiveProviderEnv, got)
-	}
-
-	// No provider profile at all → no provider, no pin change.
-	if _, err := buildProvider(config.ResolvedConfig{}, deps); err != nil {
-		t.Fatalf("buildProvider(empty): %v", err)
-	}
-	if got := os.Getenv(config.ActiveProviderEnv); got != "still-current" {
-		t.Fatalf("%s = %q after profile-less build, want it untouched", config.ActiveProviderEnv, got)
-	}
-}
-
-// A mid-run --allow-escalation model switch previously rebuilt the provider
-// from the PURE resolved profile (the stored key lives only in buildProvider's
-// local copy), so the escalated provider was keyless and the next completion
-// call 401'd mid-run. Every profile handed to newProvider on this path must
-// carry the stored key.
-func TestRunExecEscalationSwitchKeepsStoredKey(t *testing.T) {
-	dataHome := t.TempDir()
-	t.Setenv("XDG_DATA_HOME", dataHome)
-	cwd := t.TempDir()
-
-	if _, ok := mustUpgradeTarget(t, "claude-haiku-4.5"); !ok {
-		t.Skip("registry has no upgrade target for claude-haiku-4.5")
-	}
-
-	configPath := seedStoredProviderKey(t, "echo", "sk-stored-escalation")
-
-	var builtProfiles []config.ProviderProfile
-	var stdout, stderr bytes.Buffer
-	exitCode := runWithDeps([]string{
-		"exec",
-		"--allow-escalation",
-		"--model", "claude-haiku-4.5",
-		"--init-session-id", "escalation_stored_key_run",
-		"escalate please",
-	}, &stdout, &stderr, appDeps{
-		getwd:          func() (string, error) { return cwd, nil },
-		userConfigPath: func() (string, error) { return configPath, nil },
-		resolveConfig: func(_ string, overrides config.Overrides) (config.ResolvedConfig, error) {
-			model := "claude-haiku-4.5"
-			if overrides.Provider.Model != "" {
-				model = overrides.Provider.Model
-			}
-			cfg := execResolvedConfig()
-			cfg.Provider.ProviderKind = config.ProviderKindAnthropic
-			cfg.Provider.Model = model
-			cfg.Provider.APIKeyStored = true // key lives ONLY in the credstore
-			cfg.MaxTurns = 3
-			return cfg, nil
-		},
-		newProvider: func(profile config.ProviderProfile) (zeroruntime.Provider, error) {
-			builtProfiles = append(builtProfiles, profile)
-			return &usageEmittingEscalatingProvider{escalate: len(builtProfiles) == 1}, nil
-		},
-	})
-	if exitCode != exitSuccess {
-		t.Fatalf("exit = %d, want success; stderr=%s", exitCode, stderr.String())
-	}
-	if len(builtProfiles) < 2 {
-		t.Fatalf("want at least 2 provider builds (initial + escalated), got %d", len(builtProfiles))
-	}
-	for i, profile := range builtProfiles {
-		if profile.APIKey != "sk-stored-escalation" {
-			t.Fatalf("provider build %d APIKey = %q, want the stored key (escalated build went out keyless)", i, profile.APIKey)
-		}
-	}
-}

internal/cli/exec.go

@@ -365,9 +365,6 @@ func runExec(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) in
 	var modelSwitcher func(context.Context, string) (agent.Provider, error)
 	if options.allowEscalation {
 		modelSwitcher = func(_ context.Context, modelID string) (agent.Provider, error) {
-			// deps.newProvider is wrapped (fillAppDeps) to apply the stored key, so
-			// the escalated provider is authenticated even though resolved.Provider
-			// is the pure profile — no per-site key handling here.
 			switchedProfile := resolved.Provider
 			switchedProfile.Model = modelID
 			switchedProvider, err := deps.newProvider(switchedProfile)

internal/cli/oauth_credential_test.go

@@ -24,7 +24,6 @@ func TestProviderHasOAuthLogin(t *testing.T) {
 
 func TestSetupRequiredRecognizesOAuthLogin(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "tok.json")
-	t.Setenv("ZERO_OAUTH_STORAGE", "file") // an inherited "keyring" would ignore the temp path and hit the OS keychain
 	t.Setenv("ZERO_OAUTH_TOKENS_PATH", path)
 	store, err := oauth.NewStore(oauth.StoreOptions{FilePath: path})
 	if err != nil {
@@ -46,88 +45,3 @@ func TestSetupRequiredRecognizesOAuthLogin(t *testing.T) {
 		t.Fatal("a keyless provider with no OAuth login must require onboarding")
 	}
 }
-
-// A profile renamed away from its catalog ID must still get a runtime OAuth
-// resolver when the login is stored under the catalog name — and a CASE-VARIANT
-// profile name must not drop the catalog-ID candidate (the store is
-// case-sensitive; a case-insensitive dedupe would swallow it).
-func TestOAuthResolverForProfileFallsBackToCatalogID(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "tok.json")
-	t.Setenv("ZERO_OAUTH_STORAGE", "file") // an inherited "keyring" would ignore the temp path and hit the OS keychain
-	t.Setenv("ZERO_OAUTH_TOKENS_PATH", path)
-	store, err := oauth.NewStore(oauth.StoreOptions{FilePath: path})
-	if err != nil {
-		t.Fatalf("NewStore: %v", err)
-	}
-	if err := store.Save(oauth.ProviderKey("chatgpt"), oauth.Token{AccessToken: "tok", ExpiresAt: time.Now().Add(time.Hour)}); err != nil {
-		t.Fatalf("seed token: %v", err)
-	}
-
-	// A renamed profile resolves the catalog-ID login, and the returned key MUST be
-	// that login's key — the same key the Codex account-header resolver reads from,
-	// so bearer and account can never come from different logins.
-	if resolver, key := oauthLoginForProfile(config.ProviderProfile{Name: "codex", CatalogID: "chatgpt"}); resolver == nil {
-		t.Fatal("renamed profile with a catalog-ID login must get a resolver (unauthenticated-children regression)")
-	} else if key != oauth.ProviderKey("chatgpt") {
-		t.Fatalf("bound key = %q, want the chatgpt login key (bearer/account must share it)", key)
-	}
-	// Name differs from catalog ID only in CASE: the exact-case store key is
-	// "provider:chatgpt", so "chatgpt" must survive as a distinct candidate.
-	if resolver, key := oauthLoginForProfile(config.ProviderProfile{Name: "ChatGPT", CatalogID: "chatgpt"}); resolver == nil {
-		t.Fatal("case-variant profile name must still resolve the catalog-ID login (case-insensitive dedupe regression)")
-	} else if key != oauth.ProviderKey("chatgpt") {
-		t.Fatalf("case-variant bound key = %q, want the chatgpt login key", key)
-	}
-	if resolver, _ := oauthLoginForProfile(config.ProviderProfile{Name: "chatgpt", CatalogID: "chatgpt"}); resolver == nil {
-		t.Fatal("catalog-named profile must get a resolver")
-	}
-	if resolver, key := oauthLoginForProfile(config.ProviderProfile{Name: "openai", CatalogID: "openai"}); resolver != nil || key != "" {
-		t.Fatalf("a profile with no stored login must get no resolver and an empty key, got key=%q", key)
-	}
-}
-
-// The catalog-ID fallback must NOT reach a sibling profile's OAuth login when
-// this profile has its own key — withBearer would erase the key and silently
-// bill the model call under the sibling's account (a real cross-profile
-// override the fallback introduced). A profile WITH its own resolved key gets no
-// resolver even when a catalog-shared login exists.
-func TestOAuthResolverForProfileDoesNotOverrideExplicitKey(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "tok.json")
-	t.Setenv("ZERO_OAUTH_STORAGE", "file") // an inherited "keyring" would ignore the temp path and hit the OS keychain
-	t.Setenv("ZERO_OAUTH_TOKENS_PATH", path)
-	store, err := oauth.NewStore(oauth.StoreOptions{FilePath: path})
-	if err != nil {
-		t.Fatalf("NewStore: %v", err)
-	}
-	// A personal login stored under the catalog name.
-	if err := store.Save(oauth.ProviderKey("anthropic"), oauth.Token{AccessToken: "personal-tok", ExpiresAt: time.Now().Add(time.Hour)}); err != nil {
-		t.Fatalf("seed token: %v", err)
-	}
-
-	// Work profile: same catalog, its OWN resolved API key, deliberately NOT the
-	// personal OAuth account. It must keep using its key (no resolver attached).
-	work := config.ProviderProfile{Name: "anthropic-work", CatalogID: "anthropic", APIKey: "sk-work-key"}
-	if resolver, key := oauthLoginForProfile(work); resolver != nil || key != "" {
-		t.Fatalf("a profile with its own API key must not get a catalog-shared OAuth resolver (cross-profile override), got key=%q", key)
-	}
-	// A raw auth-header credential must be protected the same way.
-	header := config.ProviderProfile{Name: "anthropic-hdr", CatalogID: "anthropic", AuthHeaderValue: "Bearer byo"}
-	if resolver, _ := oauthLoginForProfile(header); resolver != nil {
-		t.Fatal("a profile with its own auth header must not get a catalog-shared OAuth resolver")
-	}
-	// A same-NAME login must not override an explicit key either (the name
-	// candidate is gated on the profile being keyless, not just the catalog one).
-	if err := store.Save(oauth.ProviderKey("anthropic-work"), oauth.Token{AccessToken: "name-tok", ExpiresAt: time.Now().Add(time.Hour)}); err != nil {
-		t.Fatalf("seed name token: %v", err)
-	}
-	if resolver, _ := oauthLoginForProfile(work); resolver != nil {
-		t.Fatal("a profile with its own API key must not get an OAuth resolver even from a same-name login")
-	}
-	// Sanity: a keyless sibling on the same catalog DOES resolve the shared login.
-	keyless := config.ProviderProfile{Name: "anthropic-oauth", CatalogID: "anthropic"}
-	if resolver, key := oauthLoginForProfile(keyless); resolver == nil {
-		t.Fatal("a keyless profile should still resolve the catalog-shared login")
-	} else if key != oauth.ProviderKey("anthropic") {
-		t.Fatalf("keyless sibling bound key = %q, want the catalog login key", key)
-	}
-}

internal/cli/oauth_provider.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"net/http"
+	"strings"
 	"time"
 
 	"github.com/Gitlawb/zero/internal/config"
@@ -11,36 +12,33 @@ import (
 	"github.com/Gitlawb/zero/internal/providers/providerio"
 )
 
-// oauthLoginForProfile resolves the user's OAuth login for a provider ONCE and
-// returns both a TokenResolver that authenticates model calls with it and the
-// credential-store key it bound to. It returns (nil, "") when no login exists —
-// keeping API-key users free of any per-request store lookups, since the resolver
-// is only attached when a login is present at construction time.
-//
-// The returned key is the single source of truth for "which login is this
-// provider using": callers pass it to providers.Options.OAuthLoginKey so the
-// Codex chatgpt-account-id header reads its account from the exact login that
-// issued the bearer token, instead of doing a second, independent lookup that
-// could select a different login (a backend-rejected mismatch).
-//
-// Candidate login names (profile name, then a catalog-ID fallback, both gated on
-// the profile having no own configured credential) come from the shared
-// ProviderProfile.OAuthLoginCandidates so the runtime resolver, the Codex account
-// resolver, and the onboarding presence check never diverge.
-func oauthLoginForProfile(profile config.ProviderProfile) (providerio.TokenResolver, string) {
-	candidates := profile.OAuthLoginCandidates()
-	if len(candidates) == 0 {
-		return nil, ""
+// providerOAuthName resolves the OAuth login name for a provider profile. It is
+// the name a user logs in under (`zero auth login <name>`) whose token then
+// authenticates this provider's model calls. For now it is the profile name;
+// the provider presets map well-known kinds (openai/anthropic) to canonical
+// names on top of this.
+func providerOAuthName(profile config.ProviderProfile) string {
+	return strings.TrimSpace(profile.Name)
+}
+
+// oauthResolverForProfile returns a TokenResolver that authenticates a provider's
+// model calls with the user's OAuth login, or nil when no login exists for this
+// provider. Returning nil for the no-login case keeps API-key users free of any
+// per-request store lookups: the resolver is only attached once a login is
+// present at construction time.
+func oauthResolverForProfile(profile config.ProviderProfile) providerio.TokenResolver {
+	name := providerOAuthName(profile)
+	if name == "" {
+		return nil
 	}
 	store, err := oauth.NewStore(oauth.StoreOptions{})
 	if err != nil {
-		return nil, ""
+		return nil
 	}
-	_, key, ok := oauth.FirstStored(store, candidates)
-	if !ok {
-		// No login under any candidate (or unreadable/invalid keys) → API-key
-		// auth, no resolver.
-		return nil, ""
+	key := oauth.ProviderKey(name)
+	if _, ok, loadErr := store.Load(key); loadErr != nil || !ok {
+		// No login (or an unreadable/invalid key) → API-key auth, no resolver.
+		return nil
 	}
 	manager, err := oauth.NewManager(oauth.ManagerOptions{
 		Store:      store,
@@ -50,9 +48,9 @@ func oauthLoginForProfile(profile config.ProviderProfile) (providerio.TokenResol
 		AllowPresets: true,
 	})
 	if err != nil {
-		return nil, ""
+		return nil
 	}
-	resolver := func(ctx context.Context, forceRefresh bool) (string, string, bool, error) {
+	return func(ctx context.Context, forceRefresh bool) (string, string, bool, error) {
 		var token string
 		var rerr error
 		if forceRefresh {
@@ -69,5 +67,4 @@ func oauthLoginForProfile(profile config.ProviderProfile) (providerio.TokenResol
 		}
 		return "Authorization", "Bearer " + token, true, nil
 	}
-	return resolver, key
 }

internal/cli/provider_setup.go

@@ -488,7 +488,7 @@ func validateProviderRuntimeReady(profile config.ProviderProfile) error {
 }
 
 func providerProfileHasCredential(profile config.ProviderProfile) bool {
-	return profile.HasConfiguredCredential()
+	return strings.TrimSpace(profile.APIKey) != "" || profile.APIKeyStored || strings.TrimSpace(profile.AuthHeaderValue) != ""
 }
 
 func providerKindForDescriptor(descriptor providercatalog.Descriptor) config.ProviderKind {

internal/cli/setup.go

@@ -314,14 +314,10 @@ func setupRequired(resolved config.ResolvedConfig) bool {
 }
 
 // providerHasOAuthLogin reports whether a stored OAuth login exists for the
-// provider. It uses the same ProviderProfile.OAuthLoginCandidates the runtime
-// resolver does, so the "authenticated in the UI" gate and the "authenticated at
-// runtime" resolver can never diverge. This is only consulted for a profile with
-// no usable API-key credential (setupRequired returns early otherwise), where
-// the candidate set is permissive (profile name + catalog ID).
+// provider, keyed by its profile name or catalog id.
 func providerHasOAuthLogin(profile config.ProviderProfile, oauthLogins map[string]bool) bool {
-	for _, name := range profile.OAuthLoginCandidates() {
-		if oauthLogins[name] {
+	for _, name := range []string{strings.TrimSpace(profile.Name), strings.TrimSpace(profile.CatalogID)} {
+		if name != "" && oauthLogins[name] {
 			return true
 		}
 	}

internal/cli/specialist_test.go

@@ -8,8 +8,6 @@ import (
 	"runtime"
 	"strings"
 	"testing"
-
-	"github.com/Gitlawb/zero/internal/config"
 )
 
 func TestRunSpecialistListShowAndPath(t *testing.T) {
@@ -328,7 +326,7 @@ func setSpecialistConfigRoot(t *testing.T) string {
 	default:
 		t.Setenv("XDG_CONFIG_HOME", root)
 	}
-	configRoot, err := config.UserConfigDir()
+	configRoot, err := os.UserConfigDir()
 	if err != nil {
 		t.Fatalf("UserConfigDir() error = %v", err)
 	}

internal/config/credentials.go

@@ -155,63 +155,6 @@ func MigratePlaintextProviderKeys(path string, store APIKeySetter) (int, error)
 	return migrated, nil
 }
 
-// HasConfiguredCredential reports whether the profile is set up to authenticate
-// with its own API key (inline, stored, or a raw auth header). It is the single
-// definition of "this profile is key-authed", shared by OAuthLoginCandidates and
-// the cli/tui setup surfaces so they never disagree about whether a profile is
-// keyed. APIKeyEnv is deliberately NOT included: an env var may be unset at
-// runtime while the profile actually relies on an OAuth login, so an
-// env-configured-but-empty profile must still be allowed to resolve a token.
-func (profile ProviderProfile) HasConfiguredCredential() bool {
-	return strings.TrimSpace(profile.APIKey) != "" ||
-		profile.APIKeyStored ||
-		strings.TrimSpace(profile.AuthHeaderValue) != ""
-}
-
-// OAuthLoginCandidates returns the login names to try, in order, when resolving
-// this profile's OAuth token — used by the runtime bearer resolver, the Codex
-// account-header resolver, and the onboarding presence check so all three agree.
-//
-// It returns NO candidates for a profile that carries its own configured
-// credential: attaching an OAuth resolver to such a profile makes withBearer
-// erase the key the instant a token resolves, silently routing/billing the call
-// through the OAuth account instead of the intended key (the cross-profile
-// override the review caught — and, via the profile name, a same-name login
-// overriding an explicit key). A stored-key profile that reaches this keyless
-// (e.g. a transiently unreadable keyring) is likewise treated as key-auth, so it
-// fails with a clear missing-credential error rather than silently borrowing an
-// unrelated OAuth login. APIKeyEnv is intentionally not part of that gate (an
-// env var may be unset while the profile relies on OAuth).
-//
-// For a keyless profile the profile name comes first (a login under your own
-// profile name is unambiguously yours), then the catalog ID as a FALLBACK (so a
-// profile renamed away from its catalog ID — e.g. {name:"codex",
-// catalogID:"chatgpt"} — still finds a `zero auth login chatgpt` token).
-// Candidates are trimmed, blank-skipped, and de-duplicated CASE-SENSITIVELY — the
-// OAuth token store is a case-sensitive map, so "ChatGPT" and "chatgpt" are
-// distinct keys and both must survive.
-func (profile ProviderProfile) OAuthLoginCandidates() []string {
-	if profile.HasConfiguredCredential() {
-		return nil
-	}
-	var names []string
-	add := func(s string) {
-		s = strings.TrimSpace(s)
-		if s == "" {
-			return
-		}
-		for _, existing := range names {
-			if existing == s { // case-sensitive: the store lookup is case-sensitive
-				return
-			}
-		}
-		names = append(names, s)
-	}
-	add(profile.Name)
-	add(profile.CatalogID)
-	return names
-}
-
 // ApplyStoredAPIKey fills profile.APIKey from the credential store when it is not
 // already resolved — an inline config key or a resolved APIKeyEnv always wins, so
 // this only supplies a key for providers whose secret lives in the store. A nil

internal/config/credentials_test.go

@@ -172,69 +172,3 @@ func TestProviderProfileAPIKeyStoredRoundTrips(t *testing.T) {
 		t.Fatalf("no inline key expected, got %q", p.APIKey)
 	}
 }
-
-// OAuthLoginCandidates always offers the profile name, adds the catalog ID as a
-// fallback ONLY when the profile has no effective own credential, and dedupes
-// case-sensitively (the OAuth store is a case-sensitive map).
-func TestOAuthLoginCandidates(t *testing.T) {
-	cases := []struct {
-		name    string
-		profile ProviderProfile
-		want    []string
-	}{
-		{
-			name:    "renamed keyless profile falls back to catalog id",
-			profile: ProviderProfile{Name: "codex", CatalogID: "chatgpt"},
-			want:    []string{"codex", "chatgpt"},
-		},
-		{
-			name:    "case-variant name keeps distinct catalog-id candidate",
-			profile: ProviderProfile{Name: "ChatGPT", CatalogID: "chatgpt"},
-			want:    []string{"ChatGPT", "chatgpt"},
-		},
-		{
-			name:    "exact-duplicate name and catalog id collapse",
-			profile: ProviderProfile{Name: "chatgpt", CatalogID: "chatgpt"},
-			want:    []string{"chatgpt"},
-		},
-		{
-			// A configured key must block ALL candidates (name included): a login
-			// under the profile's own name would otherwise erase the key too.
-			name:    "own inline key blocks every candidate",
-			profile: ProviderProfile{Name: "anthropic-work", CatalogID: "anthropic", APIKey: "sk-work"},
-			want:    nil,
-		},
-		{
-			name:    "own auth header blocks every candidate",
-			profile: ProviderProfile{Name: "acme", CatalogID: "anthropic", AuthHeaderValue: "Bearer x"},
-			want:    nil,
-		},
-		{
-			// APIKeyStored means key-auth even if the key isn't loaded here (e.g. a
-			// transiently unreadable keyring): don't silently borrow an OAuth login.
-			name:    "stored-key profile blocks every candidate",
-			profile: ProviderProfile{Name: "openai-stored", CatalogID: "openai", APIKeyStored: true},
-			want:    nil,
-		},
-		{
-			// APIKeyEnv is NOT a configured credential for gating: the env var may be
-			// unset while the profile relies on an OAuth login, so candidates stand.
-			name:    "env-only profile still yields candidates",
-			profile: ProviderProfile{Name: "xai", CatalogID: "xai", APIKeyEnv: "XAI_API_KEY"},
-			want:    []string{"xai"},
-		},
-		{
-			name:    "empty profile yields no candidates",
-			profile: ProviderProfile{},
-			want:    nil,
-		},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			got := c.profile.OAuthLoginCandidates()
-			if strings.Join(got, ",") != strings.Join(c.want, ",") {
-				t.Fatalf("OAuthLoginCandidates() = %#v, want %#v", got, c.want)
-			}
-		})
-	}
-}

internal/config/paths.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"runtime"
 	"strings"
 )
 
@@ -34,32 +33,13 @@ func DefaultResolveOptions(workspaceRoot string) (ResolveOptions, error) {
 }
 
 func DefaultUserConfigPath() (string, error) {
-	userConfigDir, err := UserConfigDir()
+	userConfigDir, err := os.UserConfigDir()
 	if err != nil {
 		return "", fmt.Errorf("resolve user config directory: %w", err)
 	}
 	return filepath.Join(userConfigDir, "zero", "config.json"), nil
 }
 
-// UserConfigDir returns the base directory Zero stores per-user config under.
-// It mirrors os.UserConfigDir everywhere except macOS: there Go defaults to
-// ~/Library/Application Support, but Zero deliberately uses ~/.config (XDG-style,
-// matching Linux and Claude Code) so a single config path works cross-platform.
-// $XDG_CONFIG_HOME still wins on macOS when set.
-func UserConfigDir() (string, error) {
-	if runtime.GOOS == "darwin" {
-		if xdg := strings.TrimSpace(os.Getenv("XDG_CONFIG_HOME")); xdg != "" {
-			return xdg, nil
-		}
-		home, err := os.UserHomeDir()
-		if err != nil {
-			return "", fmt.Errorf("resolve home directory: %w", err)
-		}
-		return filepath.Join(home, ".config"), nil
-	}
-	return os.UserConfigDir()
-}
-
 func existingConfigFile(path string) (string, error) {
 	info, err := os.Stat(path)
 	if err != nil {

internal/config/paths_test.go

@@ -105,7 +105,7 @@ func setUserConfigRoot(t *testing.T) string {
 		t.Setenv("XDG_CONFIG_HOME", root)
 	}
 
-	configRoot, err := UserConfigDir()
+	configRoot, err := os.UserConfigDir()
 	if err != nil {
 		t.Fatalf("UserConfigDir() error = %v", err)
 	}
@@ -130,21 +130,3 @@ func mkdirAll(t *testing.T, path string) {
 		t.Fatalf("create directory %s: %v", path, err)
 	}
 }
-
-func TestDefaultUserConfigPathUsesXDGConfigOnMacOS(t *testing.T) {
-	if runtime.GOOS != "darwin" {
-		t.Skip("macOS-specific config path behavior")
-	}
-	home := t.TempDir()
-	t.Setenv("HOME", home)
-	t.Setenv("XDG_CONFIG_HOME", "")
-
-	path, err := DefaultUserConfigPath()
-	if err != nil {
-		t.Fatalf("DefaultUserConfigPath() error = %v", err)
-	}
-	want := filepath.Join(home, ".config", "zero", "config.json")
-	if path != want {
-		t.Fatalf("DefaultUserConfigPath() = %q, want %q", path, want)
-	}
-}

internal/config/resolver.go

@@ -2,7 +2,6 @@ package config
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"net/url"
 	"os"
@@ -15,31 +14,6 @@ import (
 	"github.com/Gitlawb/zero/internal/sandbox"
 )
 
-// ErrNoActiveProvider marks a resolve failure caused solely by a missing or
-// unresolvable active provider. The interactive TUI treats this as "needs
-// onboarding" (drop into the setup wizard) rather than a fatal config error.
-var ErrNoActiveProvider = errors.New("no active provider configured")
-
-// ErrProviderRequiresModel marks a resolve failure caused solely by the active
-// provider missing a model with no catalog default to fall back on (custom
-// openai-/anthropic-compatible endpoints — Zero cannot guess a gateway's model).
-// Like ErrNoActiveProvider, the interactive TUI treats it as "needs onboarding"
-// and drops into the setup wizard so the user can fix it; headless commands
-// (zero config, zero exec) still fail with the actionable message.
-var ErrProviderRequiresModel = errors.New("provider requires model")
-
-// setupFixableError tags an error with a sentinel for errors.Is WITHOUT
-// changing its message: the sentinel's own text must not prefix what the user
-// sees (the wrapped message is already complete and actionable).
-type setupFixableError struct {
-	err      error
-	sentinel error
-}
-
-func (e *setupFixableError) Error() string { return e.err.Error() }
-
-func (e *setupFixableError) Unwrap() []error { return []error{e.err, e.sentinel} }
-
 // defaultMaxTurns is the per-run tool-turn budget when none is configured. 30 was
 // too low for real multi-step agentic work (agents ran out mid-task before reaching
 // later steps); 50 matches the old "deep" preset. Raise per-session with /turns.
@@ -396,18 +370,6 @@ func effectiveProviderKind(profile ProviderProfile) ProviderKind {
 	return ""
 }
 
-// catalogDefaultModel returns the default model of a catalog provider ("" when
-// the id is unknown), used to fill a missing profile.Model for the official-API
-// kinds so a hand-written profile without a model resolves instead of bricking
-// every command that resolves config up front (zero config, bare zero setup).
-func catalogDefaultModel(catalogID string) string {
-	descriptor, ok := providercatalog.Get(catalogID)
-	if !ok {
-		return ""
-	}
-	return strings.TrimSpace(descriptor.DefaultModel)
-}
-
 func catalogDescriptorForProfile(profile ProviderProfile) (providercatalog.Descriptor, bool) {
 	catalogID := providercatalog.NormalizeID(profile.CatalogID)
 	if catalogID == "" {
@@ -769,16 +731,11 @@ func unionStrings(base []string, extra []string) []string {
 }
 
 type normalizeOptions struct {
-	// defaultModels fills a missing profile.Model for the official-API provider
-	// kinds (openai from the model registry; anthropic/google from their catalog
-	// descriptors). Off for provider-command configs (command.go), which must
-	// surface exactly what the external command returned rather than inventing
-	// a model behind its back.
-	defaultModels bool
+	defaultOpenAIModel bool
 }
 
 func normalizeProviders(providers []ProviderProfile, activeName string, envMaps ...map[string]string) ([]ProviderProfile, ProviderProfile, error) {
-	return normalizeProvidersWithOptions(providers, activeName, normalizeOptions{defaultModels: true}, envMaps...)
+	return normalizeProvidersWithOptions(providers, activeName, normalizeOptions{defaultOpenAIModel: true}, envMaps...)
 }
 
 func normalizeProvidersWithoutModelDefaults(providers []ProviderProfile, activeName string, envMaps ...map[string]string) ([]ProviderProfile, ProviderProfile, error) {
@@ -793,7 +750,7 @@ func normalizeProvidersWithOptions(providers []ProviderProfile, activeName strin
 	}
 	if len(providers) == 0 {
 		if activeName != "" {
-			return nil, ProviderProfile{}, fmt.Errorf("%w: active provider %q not found", ErrNoActiveProvider, activeName)
+			return nil, ProviderProfile{}, fmt.Errorf("active provider %q not found", activeName)
 		}
 		return []ProviderProfile{}, ProviderProfile{}, nil
 	}
@@ -825,13 +782,10 @@ func normalizeProvidersWithOptions(providers []ProviderProfile, activeName strin
 	}
 
 	if !activeFound {
-		return nil, ProviderProfile{}, fmt.Errorf("%w: active provider %q not found", ErrNoActiveProvider, activeName)
+		return nil, ProviderProfile{}, fmt.Errorf("active provider %q not found", activeName)
 	}
 	if active.Model == "" {
-		return nil, ProviderProfile{}, &setupFixableError{
-			err:      providerError(active, "provider %s requires model — add \"model\" to its entry in config.json, or re-run: zero setup <catalog-id> --model <model>", active.Name),
-			sentinel: ErrProviderRequiresModel,
-		}
+		return nil, ProviderProfile{}, providerError(active, "provider %s requires model", active.Name)
 	}
 
 	return normalized, active, nil
@@ -878,7 +832,7 @@ func normalizeProvider(profile ProviderProfile, env map[string]string, options n
 	case ProviderKindOpenAI:
 		if profile.BaseURL == "" || isOfficialOpenAIBaseURL(profile.BaseURL) {
 			profile.BaseURL = OpenAIBaseURL
-			if options.defaultModels && profile.Model == "" {
+			if options.defaultOpenAIModel && profile.Model == "" {
 				profile.Model = modelregistry.DefaultModelID
 			}
 			return profile, nil
@@ -895,9 +849,6 @@ func normalizeProvider(profile ProviderProfile, env map[string]string, options n
 	case ProviderKindAnthropic:
 		if profile.BaseURL == "" || isOfficialAnthropicBaseURL(profile.BaseURL) {
 			profile.BaseURL = AnthropicBaseURL
-			if options.defaultModels && profile.Model == "" {
-				profile.Model = catalogDefaultModel("anthropic")
-			}
 			return profile, nil
 		}
 		return ProviderProfile{}, providerError(profile, "anthropic provider %s requires official baseURL %s", profile.Name, AnthropicBaseURL)
@@ -912,9 +863,6 @@ func normalizeProvider(profile ProviderProfile, env map[string]string, options n
 	case ProviderKindGoogle:
 		if profile.BaseURL == "" || isOfficialGoogleBaseURL(profile.BaseURL) {
 			profile.BaseURL = GoogleBaseURL
-			if options.defaultModels && profile.Model == "" {
-				profile.Model = catalogDefaultModel("google")
-			}
 			return profile, nil
 		}
 		return ProviderProfile{}, providerError(profile, "google provider %s requires official baseURL %s", profile.Name, GoogleBaseURL)

internal/config/resolver_test.go

@@ -1,7 +1,6 @@
 package config
 
 import (
-	"errors"
 	"os"
 	"path/filepath"
 	"reflect"
@@ -899,9 +898,6 @@ func TestResolveRejectsActiveProviderWithoutConfiguredProfiles(t *testing.T) {
 	if !strings.Contains(err.Error(), `active provider "ghost" not found`) {
 		t.Fatalf("error = %q, want active provider missing message", err.Error())
 	}
-	if !errors.Is(err, ErrNoActiveProvider) {
-		t.Fatalf("error = %v, want errors.Is(err, ErrNoActiveProvider)", err)
-	}
 	if resolved.ActiveProvider != "" {
 		t.Fatalf("ActiveProvider = %q, want empty", resolved.ActiveProvider)
 	}
@@ -1555,97 +1551,3 @@ func TestResolveMaxTurnsZeroFallsBackToDefault(t *testing.T) {
 		t.Fatalf("MaxTurns = %d, want default %d", resolved.MaxTurns, defaultMaxTurns)
 	}
 }
-
-// The reported brick: a hand-written google profile with an apiKey but no
-// model made EVERY resolving command fail ("provider google requires model"),
-// including zero config and bare zero setup — the only commands that could
-// have fixed it. Official-API kinds now fall back to their catalog default
-// model, exactly like the openai kind always has.
-func TestResolveDefaultsGoogleModelFromCatalog(t *testing.T) {
-	path := writeConfig(t, `{
-		"activeProvider": "google",
-		"providers": [{"name": "google", "provider_kind": "google", "apiKey": "AIza-x"}]
-	}`)
-	resolved, err := Resolve(ResolveOptions{UserConfigPath: path, Env: map[string]string{}})
-	if err != nil {
-		t.Fatalf("Resolve() error = %v, want model defaulted from the google catalog", err)
-	}
-	if resolved.Provider.Model != "gemini-2.5-pro" {
-		t.Fatalf("Model = %q, want the google catalog default gemini-2.5-pro", resolved.Provider.Model)
-	}
-	if resolved.Provider.BaseURL != GoogleBaseURL {
-		t.Fatalf("BaseURL = %q, want %q", resolved.Provider.BaseURL, GoogleBaseURL)
-	}
-}
-
-func TestResolveDefaultsAnthropicModelFromCatalog(t *testing.T) {
-	path := writeConfig(t, `{
-		"activeProvider": "anthropic",
-		"providers": [{"name": "anthropic", "provider_kind": "anthropic", "apiKey": "sk-ant-x"}]
-	}`)
-	resolved, err := Resolve(ResolveOptions{UserConfigPath: path, Env: map[string]string{}})
-	if err != nil {
-		t.Fatalf("Resolve() error = %v, want model defaulted from the anthropic catalog", err)
-	}
-	if resolved.Provider.Model != "claude-sonnet-4.5" {
-		t.Fatalf("Model = %q, want the anthropic catalog default claude-sonnet-4.5", resolved.Provider.Model)
-	}
-}
-
-// An explicitly configured model must always win over the catalog default.
-func TestResolveKeepsExplicitGoogleModel(t *testing.T) {
-	path := writeConfig(t, `{
-		"activeProvider": "google",
-		"providers": [{"name": "google", "provider_kind": "google", "apiKey": "AIza-x", "model": "gemini-2.5-flash"}]
-	}`)
-	resolved, err := Resolve(ResolveOptions{UserConfigPath: path, Env: map[string]string{}})
-	if err != nil {
-		t.Fatalf("Resolve() error = %v", err)
-	}
-	if resolved.Provider.Model != "gemini-2.5-flash" {
-		t.Fatalf("Model = %q, want the explicitly configured gemini-2.5-flash", resolved.Provider.Model)
-	}
-}
-
-// Provider-command configs must NOT get invented models: the without-defaults
-// path surfaces exactly what the external command returned.
-func TestNormalizeWithoutModelDefaultsStillRequiresGoogleModel(t *testing.T) {
-	_, _, err := normalizeProvidersWithoutModelDefaults(
-		[]ProviderProfile{{Name: "google", ProviderKind: ProviderKindGoogle, APIKey: "AIza-x"}},
-		"google", map[string]string{})
-	if err == nil {
-		t.Fatal("provider-command path must still require an explicit model")
-	}
-	if !strings.Contains(err.Error(), "requires model") {
-		t.Fatalf("error = %q, want requires-model", err.Error())
-	}
-	// The residual error must tell the user how to fix it.
-	if !strings.Contains(err.Error(), "config.json") {
-		t.Fatalf("error = %q, want an actionable config.json hint", err.Error())
-	}
-}
-
-// The residual requires-model failure (custom endpoint, no catalog default)
-// must be tagged setup-fixable WITHOUT changing its message: the interactive
-// TUI matches the sentinel to drop into the wizard, while headless commands
-// print the exact actionable text.
-func TestResolveRequiresModelErrorIsSetupFixable(t *testing.T) {
-	path := writeConfig(t, `{
-		"activeProvider": "gw",
-		"providers": [{"name": "gw", "provider_kind": "openai-compatible", "baseURL": "https://gw.example/v1", "apiKey": "sk-x"}]
-	}`)
-	_, err := Resolve(ResolveOptions{UserConfigPath: path, Env: map[string]string{}})
-	if err == nil {
-		t.Fatal("expected requires-model error for a custom endpoint without model")
-	}
-	if !errors.Is(err, ErrProviderRequiresModel) {
-		t.Fatalf("error = %v, want errors.Is(err, ErrProviderRequiresModel)", err)
-	}
-	// The sentinel must NOT prefix the user-facing message.
-	if !strings.HasPrefix(err.Error(), "provider gw requires model") {
-		t.Fatalf("message = %q, want it to start with the provider error, not the sentinel text", err.Error())
-	}
-	if strings.Contains(err.Error(), "sk-x") {
-		t.Fatalf("error leaked API key: %q", err.Error())
-	}
-}

internal/config/validate_test.go

@@ -66,13 +66,10 @@ func TestValidateFileRedactsSecretInIssue(t *testing.T) {
 }
 
 func TestValidateFileMissingModelWarns(t *testing.T) {
-	// An openai-compatible CUSTOM endpoint has no catalog default to fall back
-	// on, so a missing model is still a real issue — and the message must tell
-	// the user how to fix it.
 	path := writeValidateFixture(t, `{
 		"activeProvider": "main",
 		"providers": [
-			{"name": "main", "provider_kind": "openai-compatible", "baseURL": "https://gateway.example/v1"}
+			{"name": "main", "provider_kind": "anthropic"}
 		]
 	}`)
 
@@ -83,30 +80,6 @@ func TestValidateFileMissingModelWarns(t *testing.T) {
 	if !strings.Contains(issues[0].Message, "requires model") {
 		t.Fatalf("expected requires-model issue, got %#v", issues)
 	}
-	if !strings.Contains(issues[0].Message, "config.json") {
-		t.Fatalf("requires-model issue should carry an actionable hint, got %#v", issues)
-	}
-}
-
-func TestValidateFileDefaultsOfficialKindModels(t *testing.T) {
-	// Official-API kinds (anthropic/google) fall back to their catalog default
-	// model, so a hand-written model-less profile validates clean instead of
-	// bricking zero config / bare zero setup — the only commands that could
-	// have fixed it (the reported google case).
-	path := writeValidateFixture(t, `{
-		"activeProvider": "google",
-		"providers": [
-			{"name": "google", "provider_kind": "google", "apiKey": "AIza-x"},
-			{"name": "anthropic", "provider_kind": "anthropic", "apiKey": "sk-ant-x"}
-		]
-	}`)
-
-	_, issues := ValidateFile(path)
-	for _, issue := range issues {
-		if strings.Contains(issue.Message, "requires model") {
-			t.Fatalf("official-kind profiles must default their model, got issue %#v", issue)
-		}
-	}
 }
 
 func TestValidateFileValidConfigHasNoIssues(t *testing.T) {

internal/mcp/client_test.go

@@ -1,11 +1,11 @@
 package mcp
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -393,43 +393,28 @@ func TestConnectRejectsUnsupportedTransport(t *testing.T) {
 }
 
 func TestClientRequestWaitsForMatchingResponseID(t *testing.T) {
-	// Pipes, not a pre-filled bytes.Buffer: the fake server responds only AFTER
-	// reading the outgoing request, matching production ordering. With responses
-	// pre-loaded, the client's reader goroutine could consume the matching
-	// response — and hit EOF — before request() registered its pending id,
-	// flaking as "request() error = EOF" on fast runners.
-	serverReader, clientWriter := io.Pipe() // client → server
-	clientReader, serverWriter := io.Pipe() // server → client
-	t.Cleanup(func() {
-		_ = clientWriter.Close()
-		_ = serverWriter.Close()
-	})
-
-	serverErr := make(chan error, 1)
-	go func() {
-		requests := newMessageReader(serverReader)
-		request, err := requests.read()
-		if err != nil {
-			serverErr <- err
-			return
-		}
-		responses := newMessageWriter(serverWriter)
-		for _, message := range []rpcMessage{
-			{Method: "notifications/progress"},
-			{ID: 99, Error: &rpcError{Code: -32000, Message: "wrong response"}},
-			{ID: request.ID, Result: mustRaw(map[string]any{"value": "matched"})},
-		} {
-			if err := responses.write(message); err != nil {
-				serverErr <- err
-				return
-			}
-		}
-		serverErr <- nil
-	}()
+	var incoming bytes.Buffer
+	incomingWriter := newMessageWriter(&incoming)
+	if err := incomingWriter.write(rpcMessage{Method: "notifications/progress"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := incomingWriter.write(rpcMessage{
+		ID:    99,
+		Error: &rpcError{Code: -32000, Message: "wrong response"},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := incomingWriter.write(rpcMessage{
+		ID:     1,
+		Result: mustRaw(map[string]any{"value": "matched"}),
+	}); err != nil {
+		t.Fatal(err)
+	}
 
+	var outgoing bytes.Buffer
 	client := &Client{
-		reader: newMessageReader(clientReader),
-		writer: newMessageWriter(clientWriter),
+		reader: newMessageReader(&incoming),
+		writer: newMessageWriter(&outgoing),
 		nextID: 1,
 	}
 	var result struct {
@@ -441,9 +426,6 @@ func TestClientRequestWaitsForMatchingResponseID(t *testing.T) {
 	if result.Value != "matched" {
 		t.Fatalf("result.Value = %q, want matched response", result.Value)
 	}
-	if err := <-serverErr; err != nil {
-		t.Fatalf("fake server error: %v", err)
-	}
 }
 
 type errorCloser struct {

internal/oauth/store.go

@@ -41,26 +41,6 @@ func ValidateKey(key string) error {
 // ProviderKey builds the store key for a provider login.
 func ProviderKey(name string) string { return KeyPrefixProvider + name }
 
-// FirstStored returns the token and its ProviderKey for the FIRST candidate name
-// that has a token in the store, with ok=false when none do. Callers pass
-// ProviderProfile.OAuthLoginCandidates() so that everything derived from a login
-// — the bearer token AND any header claim like chatgpt-account-id — comes from
-// the SAME login; selecting independently per consumer could otherwise pair a
-// bearer from one login with an account header from another. A load error on a
-// candidate is treated as a miss (skip to the next), never a hard failure.
-func FirstStored(store *Store, candidates []string) (Token, string, bool) {
-	if store == nil {
-		return Token{}, "", false
-	}
-	for _, name := range candidates {
-		key := ProviderKey(name)
-		if token, ok, err := store.Load(key); err == nil && ok {
-			return token, key, true
-		}
-	}
-	return Token{}, "", false
-}
-
 // Status is a redaction-safe summary of a stored token (no secret material).
 type Status struct {
 	Key             string    `json:"key"`

internal/providers/factory.go

@@ -26,13 +26,6 @@ type Options struct {
 	// OAuth bearer token (preferred over the API key). nil => API-key auth only.
 	// Applied to the OpenAI and Anthropic providers.
 	OAuthResolver providerio.TokenResolver
-	// OAuthLoginKey is the credential-store key OAuthResolver bound to (empty when
-	// there is no OAuth login). It is the SAME selection the bearer resolver made,
-	// resolved ONCE by the caller so the Codex chatgpt-account-id header reads its
-	// account from the exact login that issued the bearer token — never a second,
-	// independent lookup that could pick a different login (a backend-rejected
-	// mismatch).
-	OAuthLoginKey string
 }
 
 // New creates a runtime provider for a resolved provider profile.
@@ -258,22 +251,14 @@ func isCodexCatalog(profile config.ProviderProfile, _ resolvedProfile) bool {
 
 // newCodexProvider builds a Codex-flavored openai provider for the chatgpt
 // catalog. The Codex headers (`originator`, `chatgpt-account-id`) are
-// injected by the CodexProvider wrapper. The `chatgpt-account-id` is read from
-// the stored OAuth token's Account field on every request so a refresh that
-// rotates the token (and its account claim) takes effect immediately — a static
-// AccountID captured at construction would go stale on the first refresh.
-//
-// The *login* the header reads from is options.OAuthLoginKey — the SAME key the
-// bearer resolver bound, resolved ONCE by the caller. The bearer resolver
-// refreshes the token in place under that key; reading the account from the same
-// key keeps header and token on one login for the provider's life. Resolving the
-// key independently here (a second oauth.FirstStored) could, after a transient
-// per-candidate load error or a mid-session `zero auth login`, pick a different
-// login than the bearer — a mismatch the backend rejects.
+// injected by the CodexProvider wrapper. The `chatgpt-account-id` is
+// resolved dynamically from the stored OAuth token's Account field on
+// every request so a refresh that rotates the token (and its account
+// claim) takes effect immediately — a static AccountID captured at
+// construction would go stale on the first refresh.
 func newCodexProvider(profile config.ProviderProfile, resolved resolvedProfile, options Options) (zeroruntime.Provider, error) {
-	accountKey := options.OAuthLoginKey
 	resolver := openai.CodexAccountResolver(func(ctx context.Context) (string, bool, error) {
-		account := codexAccountForKey(accountKey)
+		account := codexAccountFromStore(profile.Name)
 		if account == "" {
 			return "", false, nil
 		}
@@ -303,20 +288,17 @@ func newCodexProvider(profile config.ProviderProfile, resolved resolvedProfile,
 	})
 }
 
-// codexAccountForKey reads the chatgpt_account_id from the token currently
-// stored under key. Called per-request (via the resolver) so a refresh that
-// rotates the token — saved back in place under the same key — takes effect
-// immediately without restarting the agent. Returns "" when key is empty (no
-// OAuth login), or the token is absent or carries no account claim.
-func codexAccountForKey(key string) string {
-	if key == "" {
-		return ""
-	}
+// codexAccountFromStore reads the chatgpt_account_id from the stored OAuth
+// token for the given provider name. It is called per-request (via the
+// resolver) so a refresh that rotates the token takes effect immediately
+// without restarting the agent. Returns "" when no token is stored (the
+// Codex provider then omits the header and the user sees a clear 401).
+func codexAccountFromStore(providerName string) string {
 	store, err := oauth.NewStore(oauth.StoreOptions{})
 	if err != nil {
 		return ""
 	}
-	token, ok, err := store.Load(key)
+	token, ok, err := store.Load(oauth.ProviderKey(providerName))
 	if err != nil || !ok {
 		return ""
 	}

internal/providers/factory_test.go

@@ -269,7 +269,6 @@ func TestNewRoutesChatGPTCatalogToCodexProvider(t *testing.T) {
 	// OAuth token and the "want empty chatgpt-account-id" assertion fails locally
 	// (it still passes in CI, where no login is stored). Mirrors the isolation in
 	// TestNewRoutesChatGPTCatalogWithStoredAccountID.
-	t.Setenv("ZERO_OAUTH_STORAGE", "file")
 	t.Setenv("ZERO_OAUTH_TOKENS_PATH", t.TempDir()+"/tokens.json")
 
 	transport := &captureTransport{
@@ -323,10 +322,11 @@ func TestNewRoutesChatGPTCatalogToCodexProvider(t *testing.T) {
 
 func TestNewRoutesChatGPTCatalogWithStoredAccountID(t *testing.T) {
 	// The factory reads the stored OAuth token's Account field for the
-	// chatgpt-account-id header, from the login key the CALLER supplies in
-	// Options.OAuthLoginKey (the same key the bearer resolver bound). Seed a
-	// token in an isolated temp store, then pass that key.
-	store, err := newOAuthStoreForTest(t)
+	// chatgpt-account-id header. Seed a token in a temp store and point
+	// ZERO_OAUTH_TOKENS_PATH at it so the factory picks it up.
+	dir := t.TempDir()
+	t.Setenv("ZERO_OAUTH_TOKENS_PATH", dir+"/tokens.json")
+	store, err := newOAuthStoreForTest()
 	if err != nil {
 		t.Fatalf("NewStore: %v", err)
 	}
@@ -344,9 +344,8 @@ func TestNewRoutesChatGPTCatalogWithStoredAccountID(t *testing.T) {
 		CatalogID: "chatgpt",
 		Model:     "gpt-5",
 	}, Options{
-		HTTPClient:    &http.Client{Transport: transport},
-		UserAgent:     "zero-factory-test",
-		OAuthLoginKey: oauth.ProviderKey("chatgpt"),
+		HTTPClient: &http.Client{Transport: transport},
+		UserAgent:  "zero-factory-test",
 	})
 	if err != nil {
 		t.Fatalf("New() error = %v", err)
@@ -408,61 +407,10 @@ func (transport *captureTransport) body() io.Reader {
 	return strings.NewReader(transport.requestBody)
 }
 
-// newOAuthStoreForTest pins the OAuth token store to a plain temp FILE and
-// returns a Store on it. Pinning ZERO_OAUTH_STORAGE matters as much as the
-// path: an inherited "keyring" value would send NewStore to the OS keychain
-// and ignore ZERO_OAUTH_TOKENS_PATH entirely, making the test read/write the
-// developer's real logins. Exists so the chatgpt factory tests can seed a
-// token without copying the path-handling dance from internal/cli.
-func newOAuthStoreForTest(t *testing.T) (*oauth.Store, error) {
-	t.Helper()
-	t.Setenv("ZERO_OAUTH_STORAGE", "file")
-	t.Setenv("ZERO_OAUTH_TOKENS_PATH", t.TempDir()+"/tokens.json")
+// newOAuthStoreForTest builds a Store pointed at the current
+// ZERO_OAUTH_TOKENS_PATH (set by the caller). It exists so the chatgpt
+// factory tests can seed a token without copying the path-handling dance
+// from internal/cli.
+func newOAuthStoreForTest() (*oauth.Store, error) {
 	return oauth.NewStore(oauth.StoreOptions{})
 }
-
-// codexAccountForKey reads the chatgpt-account-id from the token stored under a
-// FIXED key — the key the caller (cli.oauthLoginForProfile) already bound for the
-// bearer token, passed through providers.Options.OAuthLoginKey. The account is
-// therefore always read from the same login that issued the bearer (no second,
-// independent selection). It re-reads per call, so an in-place token refresh (new
-// account claim under the SAME key) is picked up; an empty key (no OAuth login)
-// or a missing/account-less token yields "".
-func TestCodexAccountForKey(t *testing.T) {
-	store, err := newOAuthStoreForTest(t)
-	if err != nil {
-		t.Fatalf("NewStore: %v", err)
-	}
-	if err := store.Save(oauth.ProviderKey("chatgpt"), oauth.Token{AccessToken: "tok-1", Account: "acc-catalog-7"}); err != nil {
-		t.Fatalf("Save chatgpt: %v", err)
-	}
-	// A different login WITHOUT an account claim, to prove the read stays on the
-	// requested key and never crosses to another login's account.
-	if err := store.Save(oauth.ProviderKey("codex"), oauth.Token{AccessToken: "tok-codex"}); err != nil {
-		t.Fatalf("Save codex: %v", err)
-	}
-
-	if got := codexAccountForKey(oauth.ProviderKey("chatgpt")); got != "acc-catalog-7" {
-		t.Fatalf("account = %q, want acc-catalog-7", got)
-	}
-	// The bound key's token has no account → "", NOT the other login's account.
-	if got := codexAccountForKey(oauth.ProviderKey("codex")); got != "" {
-		t.Fatalf("account = %q, want empty (must not cross to another login's account)", got)
-	}
-	// Empty key (no OAuth login) → header omitted.
-	if got := codexAccountForKey(""); got != "" {
-		t.Fatalf("account for empty key = %q, want empty", got)
-	}
-	// Unknown key → "".
-	if got := codexAccountForKey(oauth.ProviderKey("nope")); got != "" {
-		t.Fatalf("account for unknown key = %q, want empty", got)
-	}
-
-	// An in-place refresh under the bound key IS reflected per request.
-	if err := store.Save(oauth.ProviderKey("chatgpt"), oauth.Token{AccessToken: "tok-refreshed", Account: "acc-rotated"}); err != nil {
-		t.Fatalf("refresh chatgpt: %v", err)
-	}
-	if got := codexAccountForKey(oauth.ProviderKey("chatgpt")); got != "acc-rotated" {
-		t.Fatalf("account = %q, want acc-rotated (in-place refresh must be picked up)", got)
-	}
-}

internal/providers/gemini/provider.go

@@ -342,7 +342,7 @@ func (provider *Provider) geminiRequest(request zeroruntime.CompletionRequest) (
 			declarations = append(declarations, geminiFunctionDeclaration{
 				Name:        tool.Name,
 				Description: tool.Description,
-				Parameters:  sanitizeGeminiSchema(tool.Parameters),
+				Parameters:  tool.Parameters,
 			})
 		}
 		mapped.Tools = []geminiToolGroup{{FunctionDeclarations: declarations}}
@@ -350,71 +350,6 @@ func (provider *Provider) geminiRequest(request zeroruntime.CompletionRequest) (
 	return mapped, nil
 }
 
-// geminiSchemaFields is the subset of JSON Schema keywords Google's
-// functionDeclarations[].parameters accepts (the Generative AI Schema type).
-// Anything outside it — most notably OpenAI's `additionalProperties`, which Zero
-// emits on every tool's parameters and which Gemini 400s on ("Unknown name
-// \"additionalProperties\" … Cannot find field") — must be dropped before the
-// request goes out. Kept as an allowlist rather than a denylist so a schema
-// keyword Zero (or an MCP server) adds later can't silently leak an unsupported
-// field into the Gemini payload.
-var geminiSchemaFields = map[string]bool{
-	"type": true, "format": true, "title": true, "description": true,
-	"nullable": true, "enum": true, "items": true, "properties": true,
-	"required": true, "anyOf": true, "propertyOrdering": true, "default": true,
-	"minimum": true, "maximum": true, "minItems": true, "maxItems": true,
-	"minLength": true, "maxLength": true, "minProperties": true,
-	"maxProperties": true, "pattern": true, "example": true,
-}
-
-// sanitizeGeminiSchema returns a copy of a JSON-Schema map keeping only the
-// keywords Gemini supports (geminiSchemaFields), recursing through the nested
-// schemas under `properties`, `items`, and `anyOf`. Returns nil for a nil input
-// so a parameterless tool stays parameterless.
-func sanitizeGeminiSchema(schema map[string]any) map[string]any {
-	if schema == nil {
-		return nil
-	}
-	out := make(map[string]any, len(schema))
-	for key, value := range schema {
-		if !geminiSchemaFields[key] {
-			continue
-		}
-		switch key {
-		case "properties":
-			if props, ok := value.(map[string]any); ok {
-				cleaned := make(map[string]any, len(props))
-				for name, sub := range props {
-					if subMap, ok := sub.(map[string]any); ok {
-						cleaned[name] = sanitizeGeminiSchema(subMap)
-					} else {
-						cleaned[name] = sub
-					}
-				}
-				value = cleaned
-			}
-		case "items":
-			if subMap, ok := value.(map[string]any); ok {
-				value = sanitizeGeminiSchema(subMap)
-			}
-		case "anyOf":
-			if variants, ok := value.([]any); ok {
-				cleaned := make([]any, len(variants))
-				for i, variant := range variants {
-					if subMap, ok := variant.(map[string]any); ok {
-						cleaned[i] = sanitizeGeminiSchema(subMap)
-					} else {
-						cleaned[i] = variant
-					}
-				}
-				value = cleaned
-			}
-		}
-		out[key] = value
-	}
-	return out
-}
-
 func mapMessages(messages []zeroruntime.Message) (*geminiContent, []geminiContent, error) {
 	systemParts := []geminiPart{}
 	contents := []geminiContent{}

internal/providers/gemini/provider_test.go

@@ -3,7 +3,6 @@ package gemini
 import (
 	"context"
 	"encoding/json"
-	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"reflect"
@@ -505,129 +504,3 @@ func eventsOfType(events []zeroruntime.StreamEvent, eventType zeroruntime.Stream
 	}
 	return matching
 }
-
-// TestSanitizeGeminiSchemaStripsUnsupportedFields: the sanitizer keeps only
-// Gemini-supported keywords and recurses into properties/items/anyOf, so no
-// OpenAI-ism (additionalProperties, $schema, patternProperties) survives at any
-// depth while legitimate fields (type/description/enum/required/default) stay.
-func TestSanitizeGeminiSchemaStripsUnsupportedFields(t *testing.T) {
-	in := map[string]any{
-		"type":                 "object",
-		"additionalProperties": false,
-		"$schema":              "https://json-schema.org/draft/2020-12/schema",
-		"required":             []string{"path"},
-		"properties": map[string]any{
-			"path": map[string]any{
-				"type":        "string",
-				"description": "a path",
-				"default":     ".",
-			},
-			"nested": map[string]any{
-				"type":                 "object",
-				"additionalProperties": false, // must be stripped at depth too
-				"properties": map[string]any{
-					"tags": map[string]any{
-						"type":  "array",
-						"items": map[string]any{"type": "string", "additionalProperties": true},
-					},
-				},
-			},
-		},
-	}
-	out := sanitizeGeminiSchema(in)
-
-	assertNoAdditionalProps(t, out, "root")
-	if out["additionalProperties"] != nil {
-		t.Fatal("top-level additionalProperties must be stripped")
-	}
-	if out["$schema"] != nil {
-		t.Fatal("$schema must be stripped")
-	}
-	// Legitimate fields survive.
-	if out["type"] != "object" {
-		t.Fatalf("type should survive, got %v", out["type"])
-	}
-	props := out["properties"].(map[string]any)
-	pathProp := props["path"].(map[string]any)
-	if pathProp["description"] != "a path" || pathProp["default"] != "." {
-		t.Fatalf("legitimate property fields must survive: %#v", pathProp)
-	}
-	// nil input stays nil (parameterless tool).
-	if sanitizeGeminiSchema(nil) != nil {
-		t.Fatal("nil schema should map to nil")
-	}
-}
-
-// assertNoAdditionalProps fails if additionalProperties appears anywhere in the
-// (recursively walked) schema.
-func assertNoAdditionalProps(t *testing.T, node any, path string) {
-	t.Helper()
-	switch v := node.(type) {
-	case map[string]any:
-		if _, ok := v["additionalProperties"]; ok {
-			t.Fatalf("additionalProperties leaked at %s", path)
-		}
-		for k, sub := range v {
-			assertNoAdditionalProps(t, sub, path+"."+k)
-		}
-	case []any:
-		for i, sub := range v {
-			assertNoAdditionalProps(t, sub, fmt.Sprintf("%s[%d]", path, i))
-		}
-	}
-}
-
-// TestGeminiRequestOmitsAdditionalPropertiesInToolSchema: end-to-end, the tool
-// parameters Zero emits (schemaToRuntimeMap always writes additionalProperties)
-// must not reach Gemini — otherwise every functionDeclaration is 400-rejected
-// ("Unknown name additionalProperties"), which broke all tool-using exec calls
-// against Google (issue #373).
-func TestGeminiRequestOmitsAdditionalPropertiesInToolSchema(t *testing.T) {
-	var gotBody map[string]any
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if err := json.NewDecoder(r.Body).Decode(&gotBody); err != nil {
-			t.Fatalf("decode request body: %v", err)
-		}
-		writeSSE(w, `{"usageMetadata":{"promptTokenCount":1}}`)
-	}))
-	defer server.Close()
-
-	provider, err := New(Options{APIKey: "k", BaseURL: server.URL + "/", Model: "models/gemini-2.5-flash"})
-	if err != nil {
-		t.Fatalf("New returned error: %v", err)
-	}
-	stream, err := provider.StreamCompletion(context.Background(), zeroruntime.CompletionRequest{
-		Messages: []zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: "hi"}},
-		Tools: []zeroruntime.ToolDefinition{{
-			Name:        "grep",
-			Description: "search",
-			Parameters: map[string]any{ // exactly what schemaToRuntimeMap produces
-				"type":                 "object",
-				"additionalProperties": false,
-				"required":             []string{"pattern"},
-				"properties": map[string]any{
-					"pattern": map[string]any{"type": "string", "description": "regex"},
-				},
-			},
-		}},
-	})
-	if err != nil {
-		t.Fatalf("StreamCompletion returned error: %v", err)
-	}
-	drain(stream)
-
-	tools := gotBody["tools"].([]any)
-	decls := tools[0].(map[string]any)["functionDeclarations"].([]any)
-	params := decls[0].(map[string]any)["parameters"].(map[string]any)
-	if _, ok := params["additionalProperties"]; ok {
-		t.Fatalf("additionalProperties must not be sent to Gemini: %#v", params)
-	}
-	// The tool is still usable: its real schema survived.
-	if params["type"] != "object" {
-		t.Fatalf("tool parameters type should survive, got %v", params["type"])
-	}
-	props := params["properties"].(map[string]any)
-	if _, ok := props["pattern"]; !ok {
-		t.Fatalf("tool property must survive sanitization: %#v", props)
-	}
-}

internal/specialist/manifest.go

@@ -11,7 +11,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/Gitlawb/zero/internal/config"
 	"github.com/Gitlawb/zero/internal/modelregistry"
 )
 
@@ -121,7 +120,7 @@ var knownToolNames = map[string]bool{
 }
 
 func DefaultPaths(workspaceRoot string) (Paths, error) {
-	userConfigDir, err := config.UserConfigDir()
+	userConfigDir, err := os.UserConfigDir()
 	if err != nil {
 		return Paths{}, fmt.Errorf("resolve user config directory: %w", err)
 	}

internal/tui/command_views.go

@@ -467,7 +467,7 @@ func providerNextActionLines(profile config.ProviderProfile, snapshot zerocomman
 }
 
 func providerProfileHasCredential(profile config.ProviderProfile) bool {
-	return profile.HasConfiguredCredential()
+	return strings.TrimSpace(profile.APIKey) != "" || profile.APIKeyStored || strings.TrimSpace(profile.AuthHeaderValue) != ""
 }
 
 func providerCredentialRequired(profile config.ProviderProfile, providerKind string) bool {

internal/tui/file_view.go

@@ -1,251 +0,0 @@
-// file_view.go is the drill-in view for a touched file, opened from the FILES
-// sidebar section (files_panel.go). It reuses the subchat pattern: while
-// active, the chat column's body swaps to this file's content — the sidebar,
-// composer, and scroll engine keep working unchanged (transcriptBodyItems is
-// the single source the viewport, renderer, and hit-testers all read, so
-// swapping there keeps every consumer consistent). Two modes:
-//
-//	diff (default) — the file's edit cards from this session, full-depth
-//	full           — the file as it stands on disk, syntax highlighted, with
-//	                 gutter markers on the lines this session's diffs added
-//
-// d/f switch modes (with an empty composer), Esc returns to the chat at the
-// scroll position it was left at.
-package tui
-
-import (
-	"bufio"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-// fileViewMaxLines caps the full-file mode so a giant generated file can't
-// freeze a render; the tail collapses into a "… N more lines" trailer.
-const fileViewMaxLines = 4000
-
-const (
-	fileViewDiff = iota
-	fileViewFull
-)
-
-// fileViewState manages the drill-in view for a touched file. When active, the
-// transcript body swaps to the file's diff/content instead of the chat rows.
-type fileViewState struct {
-	active bool
-	path   string // workspace-relative, as carried by changedFiles
-	mode   int    // fileViewDiff | fileViewFull
-	// parentScrollOffset preserves the chat scroll position so closing the view
-	// returns to the same spot (mirrors subchatState).
-	parentScrollOffset int
-}
-
-// openFileView activates the drill-in for path in diff mode. Opening from an
-// already-open view (clicking another FILES row) keeps the original saved chat
-// scroll position rather than saving the file view's own offset as "parent".
-// Re-opening the file that is ALREADY being viewed is a no-op: a stray
-// re-click must not bounce the user from full mode back to diff or reset
-// their scroll position.
-func (m model) openFileView(path string) model {
-	if m.fileView.active && m.fileView.path == path {
-		return m
-	}
-	if !m.fileView.active {
-		m.fileView.parentScrollOffset = m.chatScrollOffset
-	}
-	m.fileView.active = true
-	m.fileView.path = path
-	m.fileView.mode = fileViewDiff
-	// A file only the git sweep knows about (bash/subagent mutation) has no edit
-	// cards to stack — open straight on the full file instead of a placeholder.
-	if len(m.fileViewResultRows()) == 0 {
-		m.fileView.mode = fileViewFull
-	}
-	m.chatScrollOffset = 0
-	m = m.clearHover() // bodyY numbering differs between the file body and the chat
-	return m
-}
-
-// exitFileView deactivates the view and restores the chat scroll position.
-func (m model) exitFileView() model {
-	if !m.fileView.active {
-		return m
-	}
-	m.chatScrollOffset = m.fileView.parentScrollOffset
-	m.fileView = fileViewState{}
-	m = m.clearHover()
-	return m
-}
-
-// setFileViewMode switches diff/full, resetting the scroll to the bottom-anchored
-// start since the two bodies have unrelated heights.
-func (m model) setFileViewMode(mode int) model {
-	if !m.fileView.active || m.fileView.mode == mode {
-		return m
-	}
-	m.fileView.mode = mode
-	m.chatScrollOffset = 0
-	return m
-}
-
-// fileViewNavBar renders the single-line header shown in place of the pinned
-// title bar while the view is active: the path plus the key hints. One line
-// exactly, so every scrollableTranscriptFrame computed against it agrees with
-// the title bar's geometry.
-func (m model) fileViewNavBar(width int) string {
-	mode := "diff"
-	other := "f full"
-	if m.fileView.mode == fileViewFull {
-		mode = "full"
-		other = "d diff"
-	}
-	left := zeroTheme.accent.Render("← "+truncatePathLeft(m.fileView.path, maxInt(8, width/2))) +
-		zeroTheme.faint.Render("  ·  "+mode)
-	right := zeroTheme.faint.Render(other + " · esc back")
-	return fitStyledLine(joinHeaderLine(left, right, width), width)
-}
-
-// fileViewBodyItems builds the body items the transcript machinery renders
-// while the view is active — one pre-rendered block, so scrolling and height
-// accounting flow through the exact same path as chat rows.
-func (m model) fileViewBodyItems(width int) []transcriptBodyItem {
-	var block string
-	if m.fileView.mode == fileViewFull {
-		block = m.renderFileViewFull(width)
-	} else {
-		block = m.renderFileViewDiff(width)
-	}
-	return []transcriptBodyItem{transcriptBlockBodyItem(transcriptBodyItemRow, -1, block)}
-}
-
-// fileViewResultRows returns the transcript's tool-result rows that touched the
-// viewed file, in chronological order.
-func (m model) fileViewResultRows() []transcriptRow {
-	var rows []transcriptRow
-	for _, row := range m.transcript {
-		if row.kind != rowToolResult {
-			continue
-		}
-		for _, p := range row.changedFiles {
-			if p == m.fileView.path {
-				rows = append(rows, row)
-				break
-			}
-		}
-	}
-	return rows
-}
-
-// renderFileViewDiff renders the session's edits to the file as its full-depth
-// tool cards (bodyCap 0, the detailed-view depth), stacked chronologically —
-// the same cards the chat shows, so the diffs read identically in both places.
-func (m model) renderFileViewDiff(width int) string {
-	rows := m.fileViewResultRows()
-	if len(rows) == 0 {
-		return zeroTheme.faint.Render("No recorded edits for this file in this session.")
-	}
-	rc := buildRowContext(m.transcript)
-	opts := cardRenderOptions{bodyCap: 0, cwd: m.cwd}
-	var b strings.Builder
-	for i, row := range rows {
-		if i > 0 {
-			b.WriteString("\n\n")
-		}
-		if len(rows) > 1 {
-			b.WriteString(zeroTheme.faint.Render(fmt.Sprintf("edit %d of %d", i+1, len(rows))))
-			b.WriteString("\n")
-		}
-		b.WriteString(m.renderRowModeUncached(row, width, rc, opts))
-	}
-	return b.String()
-}
-
-// renderFileViewFull renders the file as it currently stands on disk, syntax
-// highlighted, with a line-number gutter and an accent ▎ marker on the lines
-// this session's diffs added (matched by exact text — an approximation that
-// tolerates later drift; a stale marker just doesn't highlight).
-func (m model) renderFileViewFull(width int) string {
-	target := m.fileView.path
-	if !filepath.IsAbs(target) {
-		target = filepath.Join(m.cwd, target)
-	}
-	// Stream the read and stop at the cap: os.ReadFile would load a multi-GB
-	// file wholesale before any truncation, which is the exact render freeze
-	// fileViewMaxLines exists to prevent.
-	file, err := os.Open(target)
-	if err != nil {
-		return zeroTheme.faint.Render("Could not read file: " + err.Error())
-	}
-	defer file.Close()
-	var lines []string
-	truncated := false
-	scanner := bufio.NewScanner(file)
-	scanner.Buffer(make([]byte, 0, 64*1024), 16*1024*1024)
-	for scanner.Scan() {
-		if len(lines) == fileViewMaxLines {
-			truncated = true
-			break
-		}
-		lines = append(lines, scanner.Text())
-	}
-	if err := scanner.Err(); err != nil {
-		if len(lines) == 0 {
-			return zeroTheme.faint.Render("Could not read file: " + err.Error())
-		}
-		truncated = true // e.g. a single over-long line mid-file: show what we have
-	}
-
-	changed := m.fileViewChangedLines()
-	gutterW := len(fmt.Sprintf("%d", len(lines)))
-	textBudget := maxInt(8, width-gutterW-3) // gutter + space + marker column
-	// Highlight with an effectively-infinite measure so the highlighter never
-	// wraps — output lines stay 1:1 with file lines and the gutter numbering
-	// can't desync. Each line is then truncated to the column budget below.
-	display, ok := highlightCodeForPath(lines, m.fileView.path, 1<<20, nil)
-	if !ok || len(display) != len(lines) {
-		display = lines // no lexer for this path: render plain
-	}
-
-	var b strings.Builder
-	for i, line := range display {
-		line = fitStyledLine(line, textBudget)
-		if i > 0 {
-			b.WriteString("\n")
-		}
-		marker := " "
-		if changed[strings.TrimSpace(lines[i])] {
-			marker = zeroTheme.accent.Render("▎")
-		}
-		b.WriteString(zeroTheme.faintest.Render(fmt.Sprintf("%*d ", gutterW, i+1)))
-		b.WriteString(marker)
-		b.WriteString(line)
-	}
-	if truncated {
-		// No exact remaining-line count: computing one would require reading the
-		// rest of the file, defeating the bounded read above.
-		b.WriteString("\n")
-		b.WriteString(zeroTheme.faint.Render(fmt.Sprintf("… more lines (file truncated at %d for display)", len(lines))))
-	}
-	return b.String()
-}
-
-// fileViewChangedLines collects the trimmed text of every line the session's
-// diffs ADDED to the viewed file, for the full-mode gutter markers. Very short
-// lines ("}", "return", ")") are skipped: text-matching them would mark every
-// unrelated occurrence across the file, which misleads far more than a missing
-// marker on a brace line ever could.
-func (m model) fileViewChangedLines() map[string]bool {
-	changed := map[string]bool{}
-	for _, row := range m.fileViewResultRows() {
-		for _, line := range strings.Split(row.detail, "\n") {
-			if !strings.HasPrefix(line, "+") || strings.HasPrefix(line, "+++") {
-				continue
-			}
-			if text := strings.TrimSpace(strings.TrimPrefix(line, "+")); len(text) >= 4 {
-				changed[text] = true
-			}
-		}
-	}
-	return changed
-}

internal/tui/file_view_test.go

@@ -1,288 +0,0 @@
-package tui
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	tea "charm.land/bubbletea/v2"
-
-	"github.com/Gitlawb/zero/internal/agent"
-	"github.com/Gitlawb/zero/internal/sessions"
-	"github.com/Gitlawb/zero/internal/tools"
-)
-
-// TestFileViewOpenExitRestoresScroll: opening saves the chat scroll position,
-// resets it for the file body, and Esc restores it; switching files while open
-// keeps the ORIGINAL saved position (not the file view's own).
-func TestFileViewOpenExitRestoresScroll(t *testing.T) {
-	m := filesPanelTestModel()
-	m.chatScrollOffset = 12
-
-	m = m.openFileView("web/app.js")
-	if !m.fileView.active || m.fileView.mode != fileViewDiff {
-		t.Fatalf("open should activate in diff mode: %+v", m.fileView)
-	}
-	if m.chatScrollOffset != 0 || m.fileView.parentScrollOffset != 12 {
-		t.Fatalf("open should reset scroll and save the parent offset: offset=%d saved=%d", m.chatScrollOffset, m.fileView.parentScrollOffset)
-	}
-
-	m.chatScrollOffset = 5 // scrolled within the file body
-	m = m.openFileView("internal/tui/sidebar.go")
-	if m.fileView.parentScrollOffset != 12 {
-		t.Fatalf("switching files must keep the original parent offset, got %d", m.fileView.parentScrollOffset)
-	}
-
-	m = m.exitFileView()
-	if m.fileView.active || m.chatScrollOffset != 12 {
-		t.Fatalf("exit should restore the chat scroll: active=%v offset=%d", m.fileView.active, m.chatScrollOffset)
-	}
-}
-
-// TestFileViewEscAndModeKeys: Esc exits the view via the model's key handler;
-// d/f switch modes while the composer is empty and never while typing.
-func TestFileViewEscAndModeKeys(t *testing.T) {
-	m := filesPanelTestModel()
-	m = m.openFileView("web/app.js")
-
-	updated, _ := m.Update(tea.KeyPressMsg{Code: 'f', Text: "f"})
-	m = updated.(model)
-	if m.fileView.mode != fileViewFull {
-		t.Fatal("f should switch to full mode")
-	}
-	updated, _ = m.Update(tea.KeyPressMsg{Code: 'd', Text: "d"})
-	m = updated.(model)
-	if m.fileView.mode != fileViewDiff {
-		t.Fatal("d should switch back to diff mode")
-	}
-
-	// With text in the composer, d/f type as normal characters.
-	m.input.SetValue("say")
-	updated, _ = m.Update(tea.KeyPressMsg{Code: 'f', Text: "f"})
-	m = updated.(model)
-	if m.fileView.mode != fileViewDiff {
-		t.Fatal("f while typing must not hijack the composer")
-	}
-	m.input.SetValue("")
-
-	updated, _ = m.Update(tea.KeyPressMsg{Code: tea.KeyEsc})
-	m = updated.(model)
-	if m.fileView.active {
-		t.Fatal("Esc should exit the file view")
-	}
-}
-
-// TestFileViewDiffBody: diff mode stacks the file's edit cards chronologically
-// with "edit N of M" labels; a file with no recorded edits shows the quiet
-// placeholder.
-func TestFileViewDiffBody(t *testing.T) {
-	m := filesPanelTestModel()
-	m = m.openFileView("internal/tui/sidebar.go")
-	body := plainRender(t, m.renderFileViewDiff(78))
-	if !strings.Contains(body, "edit 1 of 2") || !strings.Contains(body, "edit 2 of 2") {
-		t.Fatalf("expected chronological edit labels:\n%s", body)
-	}
-	if !strings.Contains(body, "added one") || !strings.Contains(body, "three") {
-		t.Errorf("expected both diffs' content:\n%s", body)
-	}
-
-	m.fileView.path = "never/touched.go"
-	if got := plainRender(t, m.renderFileViewDiff(78)); !strings.Contains(got, "No recorded edits") {
-		t.Errorf("untouched file should show the placeholder, got:\n%s", got)
-	}
-}
-
-// TestFileViewFullBody: full mode shows the on-disk content with line numbers
-// and marks session-added lines with the gutter marker; a missing file degrades
-// to a readable error line.
-func TestFileViewFullBody(t *testing.T) {
-	dir := t.TempDir()
-	if err := os.WriteFile(filepath.Join(dir, "app.js"), []byte("let a = 1\nlet untouched = 0\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	m := filesPanelTestModel()
-	m.cwd = dir
-	m.transcript = append(m.transcript, transcriptRow{
-		kind: rowToolResult, tool: "write_file", id: "w9", status: tools.StatusOK,
-		detail:       "+let a = 1",
-		changedFiles: []string{"app.js"},
-	})
-	m = m.openFileView("app.js")
-	m = m.setFileViewMode(fileViewFull)
-
-	body := m.renderFileViewFull(78)
-	plain := plainRender(t, body)
-	if !strings.Contains(plain, "1 ") || !strings.Contains(plain, "let untouched = 0") {
-		t.Fatalf("full view should show numbered file content:\n%s", plain)
-	}
-	lines := strings.Split(plain, "\n")
-	if len(lines) != 2 {
-		t.Fatalf("one rendered line per file line, got %d:\n%s", len(lines), plain)
-	}
-	if !strings.Contains(lines[0], "▎") {
-		t.Errorf("session-added line should carry the gutter marker: %q", lines[0])
-	}
-	if strings.Contains(lines[1], "▎") {
-		t.Errorf("untouched line must not carry the marker: %q", lines[1])
-	}
-
-	m.fileView.path = "gone.js"
-	if got := plainRender(t, m.renderFileViewFull(78)); !strings.Contains(got, "Could not read file") {
-		t.Errorf("missing file should degrade to an error line, got:\n%s", got)
-	}
-}
-
-// TestFileViewSwapsTranscriptBody: while active, transcriptBodyItems returns
-// the file body (a single block) instead of the chat rows, and the pinned
-// title bar swaps to the one-line nav bar — the geometry every frame consumer
-// relies on.
-func TestFileViewSwapsTranscriptBody(t *testing.T) {
-	m := filesPanelTestModel()
-	m = m.openFileView("internal/tui/sidebar.go")
-
-	items := m.transcriptBodyItems(m.chatColumnWidth(), "")
-	if len(items) != 1 {
-		t.Fatalf("file view should swap the body to a single block item, got %d items", len(items))
-	}
-	nav := plainRender(t, m.pinnedTitleBar(m.chatColumnWidth()))
-	if !strings.Contains(nav, "sidebar.go") || !strings.Contains(nav, "esc back") {
-		t.Fatalf("nav bar should show the path and key hints: %q", nav)
-	}
-	if lines := len(viewLines(m.fileViewNavBar(m.chatColumnWidth()))); lines != 1 {
-		t.Fatalf("nav bar must be exactly one line (title-bar geometry), got %d", lines)
-	}
-
-	// The whole view renders without panicking in both modes and shows the nav.
-	if view := plainRender(t, m.transcriptView()); !strings.Contains(view, "esc back") {
-		t.Fatal("transcript view should carry the file nav bar")
-	}
-}
-
-// TestSubchatEntryClosesFileView: drilling into an AGENTS row while a file view
-// is open closes the file view first (the subchat owns the single-column view).
-func TestSubchatEntryClosesFileView(t *testing.T) {
-	store := sessions.NewStore(sessions.StoreOptions{RootDir: t.TempDir()})
-	if _, err := store.Create(sessions.CreateInput{SessionID: "sess-1"}); err != nil {
-		t.Fatal(err)
-	}
-	m := filesPanelTestModel()
-	m.sessionStore = store
-	m.swarmSessionMap = map[string]string{"subagent-1": "sess-1"}
-	m.transcript = append(m.transcript,
-		transcriptRow{kind: rowToolCall, tool: "swarm_spawn", detail: "build it", runID: 1},
-		transcriptRow{kind: rowToolResult, tool: "swarm_spawn", detail: "Spawned subagent as task subagent-1 on team default.", runID: 1},
-	)
-	m.activeRunID = 1
-	m = m.openFileView("web/app.js")
-
-	width := sidebarWidth(m.width)
-	agents := m.sidebarAgentSelectables(width)
-	if len(agents) == 0 {
-		t.Fatal("expected a clickable agent row")
-	}
-	click := testMouseClick(tea.MouseLeft, m.chatColumnWidth()+3, agents[0].lineOffset)
-	updated, _, handled := m.handleTranscriptSelectionMouse(click)
-	if !handled {
-		t.Fatal("agent row click should be handled")
-	}
-	if updated.fileView.active {
-		t.Fatal("entering the subchat should close the file view")
-	}
-	if !updated.subchat.active {
-		t.Fatal("subchat should be active")
-	}
-}
-
-// TestChangedFilesRehydration: a persisted tool-result payload's changedFiles
-// restores onto the rehydrated transcript row, so the FILES panel survives
-// /resume.
-func TestChangedFilesRehydration(t *testing.T) {
-	events := []sessions.Event{{
-		Type:    sessions.EventToolResult,
-		Payload: json.RawMessage(`{"toolCallId":"t1","name":"edit_file","status":"ok","output":"+x","changedFiles":["pkg/a.go","pkg/b.go"]}`),
-	}}
-	rows := transcriptRowsFromSessionEvents(events)
-	if len(rows) != 1 {
-		t.Fatalf("expected 1 row, got %d", len(rows))
-	}
-	got := rows[0].changedFiles
-	if len(got) != 2 || got[0] != "pkg/a.go" || got[1] != "pkg/b.go" {
-		t.Fatalf("changedFiles not rehydrated: %v", got)
-	}
-}
-
-// TestOpenFileViewSamePathIsNoOp: re-clicking the FILES row of the file already
-// being viewed must not clobber the user's mode or scroll — the old
-// unconditional openFileView bounced full mode back to diff and reset scroll.
-func TestOpenFileViewSamePathIsNoOp(t *testing.T) {
-	m := filesPanelTestModel()
-	m = m.openFileView("web/app.js")
-	m = m.setFileViewMode(fileViewFull)
-	m.chatScrollOffset = 7 // scrolled within the file body
-
-	m = m.openFileView("web/app.js")
-	if m.fileView.mode != fileViewFull {
-		t.Fatal("re-opening the same file must keep full mode")
-	}
-	if m.chatScrollOffset != 7 {
-		t.Fatalf("re-opening the same file must keep the scroll, got %d", m.chatScrollOffset)
-	}
-	// A DIFFERENT file still switches (and resets to diff mode as documented).
-	m = m.openFileView("internal/tui/sidebar.go")
-	if m.fileView.path != "internal/tui/sidebar.go" || m.fileView.mode != fileViewDiff {
-		t.Fatalf("opening another file should switch views: %+v", m.fileView)
-	}
-}
-
-// TestFileViewFullBodyTruncatesLongFile: the full view stops reading at
-// fileViewMaxLines (bounded read — a giant file must not be loaded wholesale)
-// and appends the truncation trailer.
-func TestFileViewFullBodyTruncatesLongFile(t *testing.T) {
-	dir := t.TempDir()
-	var b strings.Builder
-	for i := 0; i < fileViewMaxLines+50; i++ {
-		fmt.Fprintf(&b, "line %d\n", i)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "big.txt"), []byte(b.String()), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	m := filesPanelTestModel()
-	m.cwd = dir
-	m.gitTouched = []gitSweepFile{{path: "big.txt"}}
-	m = m.openFileView("big.txt")
-
-	plain := plainRender(t, m.renderFileViewFull(80))
-	lines := strings.Split(plain, "\n")
-	if len(lines) != fileViewMaxLines+1 { // capped content + the trailer line
-		t.Fatalf("rendered %d lines, want %d content lines + 1 trailer", len(lines), fileViewMaxLines)
-	}
-	if !strings.Contains(lines[len(lines)-1], "truncated") {
-		t.Fatalf("expected the truncation trailer, got %q", lines[len(lines)-1])
-	}
-}
-
-// TestFileViewKeysDeferToBlockingModal: with a permission prompt up, Esc and
-// the d/f shortcuts belong to the prompt — the drill-in must not swallow them
-// (Esc exiting the view instead of reaching the prompt's deny handling).
-func TestFileViewKeysDeferToBlockingModal(t *testing.T) {
-	m := filesPanelTestModel()
-	m = m.openFileView("web/app.js")
-	m.pendingPermission = &pendingPermissionPrompt{
-		request: agent.PermissionRequest{ToolName: "write_file"},
-		decide:  func(agent.PermissionDecision) {},
-	}
-
-	updated, _ := m.Update(tea.KeyPressMsg{Code: 'f', Text: "f"})
-	m = updated.(model)
-	if m.fileView.mode != fileViewDiff {
-		t.Fatal("f with a permission prompt up must not switch file-view modes")
-	}
-	updated, _ = m.Update(tea.KeyPressMsg{Code: tea.KeyEsc})
-	m = updated.(model)
-	if !m.fileView.active {
-		t.Fatal("Esc with a permission prompt up must not exit the file view")
-	}
-}

internal/tui/files_git_sweep.go

@@ -1,237 +0,0 @@
-// files_git_sweep.go fills the FILES sidebar's blind spot: mutations that
-// bypass the file tools entirely — bash/exec_command scaffolding (npm create,
-// go generate, heredoc writes) and subagents editing the shared workspace. None
-// of those produce a changedFiles-carrying tool result, so the transcript-derived
-// roster (files_panel.go) never sees them. The sweep asks git instead: a
-// baseline `git status --porcelain` snapshot is taken at startup (Init), and a
-// re-run after each command tool result / turn end reports any NEWLY dirty
-// paths, which merge into the roster with a diffstat from `git diff --numstat`.
-// Pre-existing dirty state stays in the baseline and never shows; a non-git
-// workspace fails the first command and the sweep silently stays off.
-package tui
-
-import (
-	"context"
-	"strconv"
-	"strings"
-	"time"
-
-	tea "charm.land/bubbletea/v2"
-)
-
-// gitSweepTimeout bounds each background git invocation so a hung index lock
-// can never stall message delivery (the command runs off the update goroutine).
-const gitSweepTimeout = 3 * time.Second
-
-// gitSweepFile is one workspace file git reports as dirty: workspace-relative
-// path (git's own output convention, matching changedFiles), whether it is new
-// (untracked/added), and the tracked diffstat when known (0/0 for untracked).
-type gitSweepFile struct {
-	path    string
-	created bool
-	adds    int
-	dels    int
-}
-
-// gitSweepMsg carries one sweep's result. baseline marks the startup snapshot
-// (recorded as "pre-existing, never show") vs a live re-check (merged into the
-// roster). ok is false when git failed (not a repo, no git binary) — the
-// handler then marks the sweep unavailable rather than retrying every turn.
-type gitSweepMsg struct {
-	baseline bool
-	ok       bool
-	files    []gitSweepFile
-}
-
-// gitSweepCmd runs the status+numstat pair off the update goroutine. cwd is the
-// workspace root the TUI resolves paths against.
-func gitSweepCmd(parent context.Context, cwd string, baseline bool) tea.Cmd {
-	return func() tea.Msg {
-		if parent == nil {
-			parent = context.Background()
-		}
-		ctx, cancel := context.WithTimeout(parent, gitSweepTimeout)
-		defer cancel()
-		// --untracked-files=all enumerates files inside new directories; plain
-		// porcelain collapses them to "dir/", which is useless as a FILES row.
-		status, err := defaultPRCommandRunner(ctx, cwd, "git", "status", "--porcelain", "--untracked-files=all")
-		if err != nil {
-			return gitSweepMsg{baseline: baseline, ok: false}
-		}
-		files := parseGitPorcelain(status)
-		// Diffstat for tracked modifications; untracked files have no diff to
-		// stat. -z makes the output machine-parseable: NUL-terminated records, no
-		// path quoting, and renames as explicit preimage/postimage fields instead
-		// of the brace-mangled "src/{old => new}" a plain --numstat emits (which
-		// would never match a porcelain path). Best-effort: a failure (e.g. unborn
-		// HEAD in a fresh repo) keeps the file list with zero counts rather than
-		// dropping the sweep.
-		if numstat, err := defaultPRCommandRunner(ctx, cwd, "git", "diff", "HEAD", "--numstat", "-z"); err == nil {
-			stats := parseGitNumstat(numstat)
-			for i := range files {
-				if counts, ok := stats[files[i].path]; ok {
-					files[i].adds, files[i].dels = counts[0], counts[1]
-				}
-			}
-		}
-		return gitSweepMsg{baseline: baseline, ok: true, files: files}
-	}
-}
-
-// parseGitPorcelain parses `git status --porcelain` v1 output into sweep files.
-// Format: two status columns, a space, then the path ("XY path"); renames show
-// "old -> new" (keep the new side); untracked entries are "?? path".
-func parseGitPorcelain(out string) []gitSweepFile {
-	var files []gitSweepFile
-	for _, line := range strings.Split(out, "\n") {
-		if len(line) < 4 {
-			continue
-		}
-		code, path := line[:2], strings.TrimSpace(line[3:])
-		if to, _, found := cutRename(path); found {
-			path = to
-		}
-		path = unquoteGitPath(path)
-		if path == "" {
-			continue
-		}
-		files = append(files, gitSweepFile{
-			path:    path,
-			created: code == "??" || strings.Contains(code, "A"),
-		})
-	}
-	return files
-}
-
-// cutRename splits a porcelain rename value "old -> new", returning the new
-// path. found is false for ordinary (non-rename) paths.
-func cutRename(path string) (string, string, bool) {
-	if idx := strings.Index(path, " -> "); idx >= 0 {
-		return path[idx+4:], path[:idx], true
-	}
-	return "", "", false
-}
-
-// unquoteGitPath strips the quotes git wraps around paths with special
-// characters ("web/my file.js"). Escapes inside are left as-is — such a path
-// still identifies the file well enough for a sidebar row.
-func unquoteGitPath(path string) string {
-	if len(path) >= 2 && strings.HasPrefix(path, `"`) && strings.HasSuffix(path, `"`) {
-		return path[1 : len(path)-1]
-	}
-	return path
-}
-
-// parseGitNumstat parses `git diff --numstat -z` output into path → [added,
-// deleted]. -z records are NUL-terminated "added\tdeleted\tpath"; a rename/copy
-// instead ends the counts record with an EMPTY path ("added\tdeleted\t") and
-// appends two more NUL-terminated fields, preimage then postimage — the stats
-// key is the postimage (the path porcelain/changedFiles report). Paths are
-// never quoted or brace-mangled in -z mode. Binary files report "-" counts and
-// are skipped.
-func parseGitNumstat(out string) map[string][2]int {
-	stats := map[string][2]int{}
-	fields := strings.Split(out, "\x00")
-	for i := 0; i < len(fields); i++ {
-		parts := strings.SplitN(fields[i], "\t", 3)
-		if len(parts) != 3 {
-			continue
-		}
-		adds, errA := strconv.Atoi(parts[0])
-		dels, errD := strconv.Atoi(parts[1])
-		if errA != nil || errD != nil {
-			continue
-		}
-		path := parts[2]
-		if path == "" {
-			// Rename/copy record: the next two fields are preimage, postimage.
-			if i+2 >= len(fields) {
-				break // truncated output — drop the partial record
-			}
-			path = fields[i+2]
-			i += 2
-		}
-		if path != "" {
-			stats[path] = [2]int{adds, dels}
-		}
-	}
-	return stats
-}
-
-// handleGitSweepMsg folds a sweep result into the model: the baseline snapshot
-// records what was already dirty before this TUI session (those paths never
-// show), a live sweep upserts newly dirty paths into gitTouched in first-seen
-// order. A failed sweep marks git unavailable so no further sweeps are issued.
-func (m model) handleGitSweepMsg(msg gitSweepMsg) model {
-	m.gitSweepInFlight = false
-	if !msg.ok {
-		m.gitSweepUnavailable = true
-		if m.gitFileBaseline == nil {
-			m.gitFileBaseline = map[string]bool{}
-		}
-		return m
-	}
-	if msg.baseline {
-		baseline := make(map[string]bool, len(msg.files))
-		for _, f := range msg.files {
-			baseline[f.path] = true
-		}
-		m.gitFileBaseline = baseline
-		return m
-	}
-	for _, f := range msg.files {
-		if m.gitFileBaseline[f.path] {
-			continue
-		}
-		found := false
-		for i := range m.gitTouched {
-			if m.gitTouched[i].path == f.path {
-				m.gitTouched[i] = f
-				found = true
-				break
-			}
-		}
-		if !found {
-			// Copy-on-append: model copies share the backing array, so an in-place
-			// append from two update branches could alias. Rebuilding is cheap at
-			// sidebar scale.
-			m.gitTouched = append(append([]gitSweepFile(nil), m.gitTouched...), f)
-		}
-	}
-	return m
-}
-
-// maybeGitSweep issues a live sweep when one is useful and none is running:
-// the baseline exists (Init's snapshot answered), git works here, and the
-// workspace is known. Returns the (possibly nil) command to batch.
-func (m model) maybeGitSweep() (model, tea.Cmd) {
-	if m.gitSweepInFlight || m.gitSweepUnavailable || m.gitFileBaseline == nil || strings.TrimSpace(m.cwd) == "" {
-		return m, nil
-	}
-	m.gitSweepInFlight = true
-	return m, gitSweepCmd(m.ctx, m.cwd, false)
-}
-
-// gitTouchedFiles adapts the sweep results to the roster's touchedFile shape,
-// for merging under the transcript-derived entries (files_panel.go), newest
-// detection first — gitTouched upserts in first-seen order, so iterating it in
-// reverse keeps the merged FILES tail consistent with the roster's
-// newest-first ordering. No transcript row backs them (lastRowIndex -1), so
-// selecting one skips the scroll/tint and the drill-in opens on the full file.
-func (m model) gitTouchedFiles() []touchedFile {
-	if len(m.gitTouched) == 0 {
-		return nil
-	}
-	files := make([]touchedFile, 0, len(m.gitTouched))
-	for i := len(m.gitTouched) - 1; i >= 0; i-- {
-		f := m.gitTouched[i]
-		files = append(files, touchedFile{
-			path:         f.path,
-			created:      f.created,
-			adds:         f.adds,
-			dels:         f.dels,
-			lastRowIndex: -1,
-		})
-	}
-	return files
-}

internal/tui/files_git_sweep_test.go

@@ -1,243 +0,0 @@
-package tui
-
-import (
-	"os"
-	"os/exec"
-	"path/filepath"
-	"testing"
-)
-
-func TestParseGitPorcelain(t *testing.T) {
-	out := " M web/app.js\n?? web/new.css\nA  docs/added.md\nR  old.go -> pkg/new.go\n?? \"web/my file.js\"\n\n"
-	files := parseGitPorcelain(out)
-	if len(files) != 5 {
-		t.Fatalf("expected 5 entries, got %d: %+v", len(files), files)
-	}
-	byPath := map[string]gitSweepFile{}
-	for _, f := range files {
-		byPath[f.path] = f
-	}
-	if f := byPath["web/app.js"]; f.created {
-		t.Error("modified file must not read as created")
-	}
-	if f := byPath["web/new.css"]; !f.created {
-		t.Error("untracked file should read as created")
-	}
-	if f := byPath["docs/added.md"]; !f.created {
-		t.Error("index-added file should read as created")
-	}
-	if _, ok := byPath["pkg/new.go"]; !ok {
-		t.Errorf("rename should keep the new path: %+v", files)
-	}
-	if _, ok := byPath["web/my file.js"]; !ok {
-		t.Errorf("quoted path should unquote: %+v", files)
-	}
-}
-
-// TestParseGitNumstat feeds the exact `git diff --numstat -z` record shapes:
-// plain "added\tdeleted\tpath\0", binary "-\t-\tpath\0", and the rename form
-// "added\tdeleted\t\0preimage\0postimage\0" — the stats must key the postimage
-// (the path porcelain/changedFiles report), which the old newline parser lost
-// (plain --numstat brace-mangles renames, so they never matched a roster path).
-func TestParseGitNumstat(t *testing.T) {
-	out := "12\t3\tweb/app.js\x00" +
-		"-\t-\tassets/logo.png\x00" +
-		"4\t0\t\x00old.go\x00pkg/new.go\x00" +
-		"1\t1\tweb/my file.js\x00" // -z paths are never quoted
-	stats := parseGitNumstat(out)
-	if got := stats["web/app.js"]; got != [2]int{12, 3} {
-		t.Errorf("web/app.js = %v, want [12 3]", got)
-	}
-	if _, ok := stats["assets/logo.png"]; ok {
-		t.Error("binary '-' entries must be skipped")
-	}
-	if got := stats["pkg/new.go"]; got != [2]int{4, 0} {
-		t.Errorf("renamed file must key the postimage path = %v, want [4 0]", got)
-	}
-	if _, ok := stats["old.go"]; ok {
-		t.Error("the rename preimage must not appear as its own entry")
-	}
-	if got := stats["web/my file.js"]; got != [2]int{1, 1} {
-		t.Errorf("path with spaces = %v, want [1 1] (no quoting in -z mode)", got)
-	}
-	// Truncated rename record (missing postimage) must not panic or mis-key.
-	if got := parseGitNumstat("4\t0\t\x00old.go"); len(got) != 0 {
-		t.Errorf("truncated rename record should be dropped, got %v", got)
-	}
-}
-
-// TestGitSweepMergeAndBaseline: the baseline snapshot hides pre-existing dirty
-// paths; live sweeps upsert only new ones; a failed sweep latches unavailable.
-func TestGitSweepMergeAndBaseline(t *testing.T) {
-	m := model{}
-	m = m.handleGitSweepMsg(gitSweepMsg{baseline: true, ok: true, files: []gitSweepFile{{path: "dirty-before.go"}}})
-	if !m.gitFileBaseline["dirty-before.go"] {
-		t.Fatal("baseline should record pre-existing dirty paths")
-	}
-
-	m = m.handleGitSweepMsg(gitSweepMsg{ok: true, files: []gitSweepFile{
-		{path: "dirty-before.go", adds: 9},
-		{path: "kanban/board.tsx", created: true, adds: 120},
-	}})
-	if len(m.gitTouched) != 1 || m.gitTouched[0].path != "kanban/board.tsx" {
-		t.Fatalf("only newly dirty paths should merge: %+v", m.gitTouched)
-	}
-
-	// Re-sweep updates stats in place, no duplicate.
-	m = m.handleGitSweepMsg(gitSweepMsg{ok: true, files: []gitSweepFile{{path: "kanban/board.tsx", created: true, adds: 150, dels: 2}}})
-	if len(m.gitTouched) != 1 || m.gitTouched[0].adds != 150 {
-		t.Fatalf("re-sweep should upsert stats: %+v", m.gitTouched)
-	}
-
-	failed := model{}
-	failed = failed.handleGitSweepMsg(gitSweepMsg{baseline: true, ok: false})
-	if !failed.gitSweepUnavailable {
-		t.Fatal("a failed sweep should latch unavailable")
-	}
-	if _, cmd := failed.maybeGitSweep(); cmd != nil {
-		t.Fatal("no further sweeps once unavailable")
-	}
-}
-
-// TestMaybeGitSweepGating: no sweep before the baseline answers, none while one
-// is in flight, and the in-flight flag sets when one is issued.
-func TestMaybeGitSweepGating(t *testing.T) {
-	m := model{cwd: "/tmp"}
-	if _, cmd := m.maybeGitSweep(); cmd != nil {
-		t.Fatal("no baseline yet: sweep must not run")
-	}
-	m.gitFileBaseline = map[string]bool{}
-	next, cmd := m.maybeGitSweep()
-	if cmd == nil || !next.gitSweepInFlight {
-		t.Fatal("with a baseline, a sweep should be issued and marked in flight")
-	}
-	if _, again := next.maybeGitSweep(); again != nil {
-		t.Fatal("single-flight: no second sweep while one runs")
-	}
-}
-
-// TestTouchedFilesMergesGitSweep: git-discovered files append below the
-// transcript-derived entries, deduped by path (a tool-result entry wins).
-func TestTouchedFilesMergesGitSweep(t *testing.T) {
-	m := filesPanelTestModel()
-	m.gitTouched = []gitSweepFile{
-		{path: "kanban/board.tsx", created: true, adds: 120},
-		{path: "web/app.js", adds: 999}, // duplicate of a transcript entry
-	}
-	files := m.touchedFiles()
-	var kanban *touchedFile
-	appCount := 0
-	for i := range files {
-		if files[i].path == "kanban/board.tsx" {
-			kanban = &files[i]
-		}
-		if files[i].path == "web/app.js" {
-			appCount++
-			if files[i].adds == 999 {
-				t.Error("transcript-derived entry should win over the git duplicate")
-			}
-		}
-	}
-	if kanban == nil || !kanban.created || kanban.lastRowIndex != -1 {
-		t.Fatalf("git-only file should merge with created badge and no row anchor: %+v", files)
-	}
-	if appCount != 1 {
-		t.Fatalf("web/app.js should appear exactly once, got %d", appCount)
-	}
-}
-
-// TestOpenFileViewGitOnlyFallsBackToFull: a file with no edit cards (git sweep
-// discovery) opens straight on the full-file view instead of an empty diff.
-func TestOpenFileViewGitOnlyFallsBackToFull(t *testing.T) {
-	m := filesPanelTestModel()
-	m.gitTouched = []gitSweepFile{{path: "kanban/board.tsx", created: true}}
-	m = m.openFileView("kanban/board.tsx")
-	if m.fileView.mode != fileViewFull {
-		t.Fatal("git-only file should open in full mode")
-	}
-	m = m.exitFileView()
-	m = m.openFileView("web/app.js")
-	if m.fileView.mode != fileViewDiff {
-		t.Fatal("a file with edit cards still opens in diff mode")
-	}
-}
-
-// TestGitSweepCmdAgainstRealRepo: end-to-end against a real git repo — the
-// baseline sees pre-existing dirt, a post-mutation sweep reports the new file
-// as created and the modified file with its numstat.
-func TestGitSweepCmdAgainstRealRepo(t *testing.T) {
-	if _, err := exec.LookPath("git"); err != nil {
-		t.Skip("git not installed")
-	}
-	dir := t.TempDir()
-	run := func(args ...string) {
-		t.Helper()
-		cmd := exec.Command("git", args...)
-		cmd.Dir = dir
-		cmd.Env = append(os.Environ(),
-			"GIT_AUTHOR_NAME=t", "GIT_AUTHOR_EMAIL=t@t", "GIT_COMMITTER_NAME=t", "GIT_COMMITTER_EMAIL=t@t")
-		if out, err := cmd.CombinedOutput(); err != nil {
-			t.Fatalf("git %v: %v\n%s", args, err, out)
-		}
-	}
-	write := func(name, content string) {
-		t.Helper()
-		if err := os.WriteFile(filepath.Join(dir, name), []byte(content), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	run("init", "-q")
-	write("tracked.txt", "one\ntwo\n")
-	run("add", ".")
-	run("commit", "-q", "-m", "seed")
-	write("pre-existing.txt", "dirt\n") // dirty BEFORE the TUI "opens"
-
-	baseline := gitSweepCmd(nil, dir, true)().(gitSweepMsg)
-	if !baseline.ok || len(baseline.files) != 1 || baseline.files[0].path != "pre-existing.txt" {
-		t.Fatalf("baseline should see only the pre-existing dirt: %+v", baseline)
-	}
-
-	// The "agent" now scaffolds via the shell.
-	write("scaffolded.txt", "hello\n")
-	write("tracked.txt", "one\ntwo\nthree\nfour\n")
-
-	sweep := gitSweepCmd(nil, dir, false)().(gitSweepMsg)
-	if !sweep.ok {
-		t.Fatal("sweep failed")
-	}
-	byPath := map[string]gitSweepFile{}
-	for _, f := range sweep.files {
-		byPath[f.path] = f
-	}
-	if f, ok := byPath["scaffolded.txt"]; !ok || !f.created {
-		t.Fatalf("scaffolded file should report created: %+v", sweep.files)
-	}
-	if f := byPath["tracked.txt"]; f.adds != 2 || f.dels != 0 {
-		t.Fatalf("tracked.txt numstat = +%d −%d, want +2 −0", f.adds, f.dels)
-	}
-
-	// A rename WITH edits: porcelain reports the new path, and the -z numstat
-	// rename record must resolve to the same (postimage) path so the diffstat
-	// actually attaches — the plain --numstat form brace-mangles the path and
-	// the counts were silently lost.
-	run("add", ".")
-	run("commit", "-q", "-m", "second")
-	run("mv", "tracked.txt", "renamed.txt")
-	write("renamed.txt", "one\ntwo\nthree\nfour\nfive\n")
-	renameSweep := gitSweepCmd(nil, dir, false)().(gitSweepMsg)
-	if !renameSweep.ok {
-		t.Fatal("rename sweep failed")
-	}
-	renamed := map[string]gitSweepFile{}
-	for _, f := range renameSweep.files {
-		renamed[f.path] = f
-	}
-	if f, ok := renamed["renamed.txt"]; !ok || f.adds != 1 {
-		t.Fatalf("renamed file should carry its numstat under the new path, got %+v", renameSweep.files)
-	}
-
-	// Not-a-repo → ok=false (the sweep latches off).
-	if msg := gitSweepCmd(nil, t.TempDir(), false)().(gitSweepMsg); msg.ok {
-		t.Fatal("a non-repo should report ok=false")
-	}
-}

internal/tui/files_panel.go

@@ -1,416 +0,0 @@
-// files_panel.go renders the FILES section of the right context sidebar: the
-// workspace files this session has touched, newest first, with an A/M badge and
-// a +added/−removed diffstat per file, plus a pulsing row for the file whose
-// write is streaming right now. Like the swarm roster (sidebar.go), the touched
-// set is not separate model state — it is recovered on demand from the
-// transcript's tool-result rows (their changedFiles), so it survives resume for
-// free and can never drift from what the chat shows.
-//
-// Interaction (see handleTranscriptSelectionMouse): the first click on a row
-// SELECTS the file — its edit cards tint in the chat and the transcript scrolls
-// to the most recent one; a second click (or a click while the drill-in is
-// already open) opens the file view (file_view.go). Esc clears the selection.
-package tui
-
-import (
-	"fmt"
-	"sort"
-	"strings"
-
-	tea "charm.land/bubbletea/v2"
-
-	"github.com/Gitlawb/zero/internal/tools"
-)
-
-// maxSidebarFiles caps the FILES rows so the section stays a glanceable set,
-// not a scrolling log; older files collapse into a "+N more" trailer.
-const maxSidebarFiles = 6
-
-// touchedFile is one workspace file the session has mutated, aggregated across
-// every tool-result row that touched it.
-type touchedFile struct {
-	path         string
-	adds         int  // total added lines across its diffs
-	dels         int  // total removed lines across its diffs
-	edits        int  // number of mutations
-	created      bool // first touch created the file (write_file "Created …")
-	failed       bool // the latest touch errored
-	lastRowIndex int  // transcript index of the most recent result touching it
-}
-
-// touchedFiles recovers the session's touched-file roster from the transcript,
-// most recently touched first. Recomputed on demand (the value-receiver model
-// can't persist a registry from View), mirroring swarmSpawnedAgents; the scan is
-// a single pass over the transcript per render, same order as the sidebar's
-// other sections.
-func (m model) touchedFiles() []touchedFile {
-	var files []touchedFile
-	index := map[string]int{}
-	for i, row := range m.transcript {
-		if row.kind != rowToolResult || len(row.changedFiles) == 0 {
-			continue
-		}
-		adds, dels := planDiffStat(row.detail)
-		// A multi-file result (apply_patch spanning several files) must not charge
-		// the WHOLE patch's totals to every file it touched — split the diff by its
-		// per-file headers and attribute each file its own counts.
-		var perFile map[string][2]int
-		if len(row.changedFiles) > 1 {
-			perFile = perFileDiffStats(row.detail)
-		}
-		for _, path := range row.changedFiles {
-			if path == "" {
-				continue
-			}
-			at, seen := index[path]
-			if !seen {
-				index[path] = len(files)
-				files = append(files, touchedFile{
-					path:         path,
-					created:      resultRowCreatedFile(row),
-					lastRowIndex: i,
-				})
-				at = len(files) - 1
-			}
-			fileAdds, fileDels := adds, dels
-			if perFile != nil {
-				// Headers were found: use this file's own counts. A path the split
-				// couldn't attribute shows 0/0 rather than the inflated patch totals.
-				counts := perFile[path]
-				fileAdds, fileDels = counts[0], counts[1]
-			}
-			files[at].adds += fileAdds
-			files[at].dels += fileDels
-			files[at].edits++
-			files[at].failed = row.status == tools.StatusError
-			files[at].lastRowIndex = i
-		}
-	}
-	// Most recently touched first: the file being worked on now belongs at the
-	// top, like the sidebar's ACTIVITY feed. Sorted by last touch (not reversed
-	// first-seen order): a file touched early and touched again last must list
-	// first. Stable, so same-row files keep their changedFiles order.
-	sort.SliceStable(files, func(i, j int) bool {
-		return files[i].lastRowIndex > files[j].lastRowIndex
-	})
-	// Merge the git sweep's discoveries (bash/subagent mutations that carry no
-	// changedFiles — files_git_sweep.go) below the transcript-derived entries,
-	// skipping paths a tool result already reported.
-	for _, f := range m.gitTouchedFiles() {
-		if _, seen := index[f.path]; seen {
-			continue
-		}
-		files = append(files, f)
-	}
-	return files
-}
-
-// perFileDiffStats splits a (possibly multi-file) unified diff into per-path
-// +added/−removed counts, keyed by the workspace-relative path from each
-// section's "+++ b/…" header (the "--- a/…" old side when the new side is
-// /dev/null, i.e. a deletion). Returns nil when the detail carries no file
-// headers at all (write_file/edit_file previews may be bare hunks) — the caller
-// then falls back to whole-detail totals, which are correct for a single file.
-func perFileDiffStats(detail string) map[string][2]int {
-	stats := map[string][2]int{}
-	current, oldPath := "", ""
-	normalize := func(line string, prefix string) string {
-		path := strings.TrimSpace(line[4:])
-		if tab := strings.IndexByte(path, '\t'); tab >= 0 {
-			path = path[:tab] // unified-diff convention: optional timestamp after a tab
-		}
-		path = unquoteGitPath(path)
-		if path == "/dev/null" {
-			return ""
-		}
-		return strings.TrimPrefix(path, prefix)
-	}
-	for _, line := range strings.Split(detail, "\n") {
-		switch {
-		case strings.HasPrefix(line, "--- "):
-			oldPath = normalize(line, "a/")
-		case strings.HasPrefix(line, "+++ "):
-			current = normalize(line, "b/")
-			if current == "" {
-				current = oldPath // deletion: charge the removed lines to the old path
-			}
-		case current == "":
-			// Lines before the first header (or in an unattributable section).
-		case strings.HasPrefix(line, "+"):
-			counts := stats[current]
-			counts[0]++
-			stats[current] = counts
-		case strings.HasPrefix(line, "-"):
-			counts := stats[current]
-			counts[1]++
-			stats[current] = counts
-		}
-	}
-	if len(stats) == 0 {
-		return nil
-	}
-	return stats
-}
-
-// resultRowCreatedFile reports whether a tool-result row reads as a file
-// creation ("tool result: write_file ok Created x (…)"), so the FILES row can
-// badge it A rather than M. Heuristic on the confirmation text write_file
-// already emits; a miss just shows M, never breaks anything.
-func resultRowCreatedFile(row transcriptRow) bool {
-	return strings.Contains(row.text, " Created ")
-}
-
-// liveEditingPath is the path of the file whose mutating tool call is streaming
-// its arguments RIGHT NOW (the same live write streamingToolCallView previews),
-// or "" when no mutation is in flight. It renders as a pulsing row pinned atop
-// the FILES section.
-func (m model) liveEditingPath() string {
-	if m.streamCallDecoder == nil {
-		return ""
-	}
-	switch m.streamCallName {
-	case "write_file", "edit_file", "apply_patch":
-		return m.streamCallDecoder.path
-	}
-	return ""
-}
-
-// fileHit marks a rendered FILES row (by its ABSOLUTE index inside the rendered
-// sidebar) that is clickable, carrying the file it refers to.
-type fileHit struct {
-	lineOffset int
-	path       string
-}
-
-// sidebarFilesHeader renders the FILES section header with the touched count.
-func (m model) sidebarFilesHeader(width int) string {
-	n := len(m.touchedFiles())
-	if n == 0 {
-		return sidebarHeader("FILES", width)
-	}
-	return sidebarHeaderWithCount("FILES", fmt.Sprintf("%d", n), zeroTheme.muted, width)
-}
-
-// sidebarFileLines renders the FILES section body: the live "writing" pulse row
-// first, then the touched files newest-first, capped at maxSidebarFiles with a
-// "+N more" trailer. Returns nil when the session has touched nothing (the
-// caller shows a placeholder). The paired hits slice records each clickable
-// row's index WITHIN the returned lines.
-func (m model) sidebarFileLines(width int) ([]string, []fileHit) {
-	files := m.touchedFiles()
-	live := m.liveEditingPath()
-	if len(files) == 0 && live == "" {
-		return nil, nil
-	}
-	room := maxInt(4, width-3)
-	var lines []string
-	var hits []fileHit
-
-	// The file being written this instant: an accent pulse, not yet clickable
-	// (its result row — the diff — doesn't exist until the call completes).
-	if live != "" {
-		lines = append(lines, " "+zeroTheme.accent.Render("●")+" "+
-			zeroTheme.ink.Render(truncatePathLeft(live, room)))
-	}
-
-	// Filter the live row out FIRST so the "+N more" trailer counts only rows
-	// that could actually render — counting the skipped live entry would inflate
-	// the overflow by one.
-	visible := files[:0:0]
-	for _, f := range files {
-		if f.path != live {
-			visible = append(visible, f)
-		}
-	}
-	shown := 0
-	for _, f := range visible {
-		if shown >= maxSidebarFiles {
-			lines = append(lines, "   "+zeroTheme.faint.Render(fmt.Sprintf("+%d more", len(visible)-shown)))
-			break
-		}
-		shown++
-		hits = append(hits, fileHit{lineOffset: len(lines), path: f.path})
-		lines = append(lines, m.renderFileRow(f, room))
-	}
-	return lines, hits
-}
-
-// renderFileRow renders one touched file: status badge, left-truncated path,
-// and the +/− diffstat, with the selected file carrying an accent marker so the
-// selection reads in the sidebar as well as in the chat tint.
-func (m model) renderFileRow(f touchedFile, room int) string {
-	badge := zeroTheme.muted.Render("M")
-	switch {
-	case f.failed:
-		badge = zeroTheme.red.Render("✗")
-	case f.created:
-		badge = zeroTheme.green.Render("A")
-	}
-	// Reserve the diffstat's width so the path truncates around it.
-	stat := ""
-	if f.adds > 0 || f.dels > 0 {
-		stat = fmt.Sprintf(" +%d −%d", f.adds, f.dels)
-	}
-	pathRoom := maxInt(4, room-len(stat))
-	pathStyle := zeroTheme.muted
-	lead := " "
-	if m.selectedFile == f.path {
-		lead = zeroTheme.accent.Render("▸")
-		pathStyle = zeroTheme.ink
-	}
-	line := lead + badge + " " + pathStyle.Render(truncatePathLeft(f.path, pathRoom))
-	if stat != "" {
-		line += zeroTheme.faintest.Render(stat)
-	}
-	return line
-}
-
-// sidebarFileSelectables returns the clickable FILES rows with their ABSOLUTE
-// index inside the rendered sidebar. The FILES section renders after PLAN in
-// renderContextSidebar: AGENTS header + body, blank + PLAN header + body, then
-// blank + FILES header, then the file rows. The offset accounting mirrors
-// sidebarPlanSelectables exactly, extended one section down.
-func (m model) sidebarFileSelectables(width int) []fileHit {
-	lines, hits := m.sidebarFileLines(width)
-	if len(lines) == 0 {
-		return nil
-	}
-	agentBody := len(m.sidebarAgentLines(width))
-	if agentBody == 0 {
-		agentBody = 1 // the "no agents spawned" placeholder occupies one line
-	}
-	planBody := len(m.sidebarPlanLines(width))
-	if planBody == 0 {
-		planBody = 1 // the "no active plan" placeholder occupies one line
-	}
-	base := 1 + agentBody + 2 + planBody + 2 // sections above + (blank + FILES header)
-	for i := range hits {
-		hits[i].lineOffset += base
-	}
-	return hits
-}
-
-// fileRowAtMouse maps a left-click in the context sidebar to a touched file,
-// mirroring planStepAtMouse's column/x gate. Rows truncated away by the
-// sidebar's height budget (or colliding with the token floor line) never match.
-func (m model) fileRowAtMouse(msg tea.MouseMsg) (string, bool) {
-	if !m.sidebarActive() {
-		return "", false
-	}
-	if m.setup.visible || m.providerWizard != nil || m.mcpAddWizard != nil || m.mcpManager != nil || m.picker != nil || m.suggestionsActive() {
-		return "", false
-	}
-	sidebarW := sidebarWidth(m.width)
-	if sidebarW <= 0 {
-		return "", false
-	}
-	x0 := m.chatColumnWidth() + 3 // " │ " divider between the columns
-	x, y := mouseX(msg), mouseY(msg)
-	if x < x0 || x >= x0+sidebarW {
-		return "", false
-	}
-	for _, hit := range m.sidebarFileSelectables(sidebarW) {
-		if hit.lineOffset == y && hit.lineOffset < m.height-1 && hit.path != "" {
-			return hit.path, true
-		}
-	}
-	return "", false
-}
-
-// rowTouchesSelectedFile reports whether a transcript row's mutation touched
-// the currently selected file, so its card renders with the selection tint.
-func (m model) rowTouchesSelectedFile(row transcriptRow) bool {
-	if m.selectedFile == "" || row.kind != rowToolResult {
-		return false
-	}
-	for _, path := range row.changedFiles {
-		if path == m.selectedFile {
-			return true
-		}
-	}
-	return false
-}
-
-// lastRowIndexForFile returns the transcript index of the most recent
-// tool-result row that touched path, or -1.
-func (m model) lastRowIndexForFile(path string) int {
-	for i := len(m.transcript) - 1; i >= 0; i-- {
-		row := m.transcript[i]
-		if row.kind != rowToolResult {
-			continue
-		}
-		for _, p := range row.changedFiles {
-			if p == path {
-				return i
-			}
-		}
-	}
-	return -1
-}
-
-// selectFile marks path as the selected file and scrolls the transcript so its
-// most recent edit card is in view; the card tint comes from the renderers
-// reading selectedFile (rowTouchesSelectedFile).
-func (m model) selectFile(path string) model {
-	m.selectedFile = path
-	if offset, ok := m.scrollOffsetForTranscriptRow(m.lastRowIndexForFile(path)); ok {
-		m.chatScrollOffset = offset
-		if offset == 0 {
-			m.chatBodyLines = 0
-		}
-	}
-	return m
-}
-
-// scrollOffsetForTranscriptRow computes the chatScrollOffset that places the
-// given transcript row's first rendered line at the top of the viewport (with
-// one line of breathing room), using the same layout metrics the scroll engine
-// itself uses. ok is false outside alt-screen or when the row isn't rendered
-// (e.g. skipped/collapsed).
-func (m model) scrollOffsetForTranscriptRow(rowIndex int) (int, bool) {
-	if rowIndex < 0 || !m.altScreen || m.height <= 0 {
-		return 0, false
-	}
-	width := m.chatColumnWidth()
-	items := m.transcriptBodyItems(width, "")
-	metrics := measureTranscriptBodyItems(items, m.transcriptBodyHeights)
-	startY := -1
-	for _, span := range metrics.spans {
-		if span.kind == transcriptBodyItemRow && span.rowIndex == rowIndex {
-			startY = span.startY
-			break
-		}
-	}
-	if startY < 0 {
-		return 0, false
-	}
-	frame := m.scrollableTranscriptFrame(m.pinnedTitleBar(width), m.footerView(width))
-	viewport := transcriptViewportForLayout(metrics, frame, m.chatScrollOffset)
-	// The offset counts lines below the fold: window.start == total-height-offset,
-	// so placing startY at the window top (minus one context line) means
-	// offset = total - height - (startY - 1), clamped to the scroll range.
-	offset := metrics.totalLines() - frame.bodyRect.height - (startY - 1)
-	return clampInt(offset, 0, viewport.maxOffset()), true
-}
-
-// truncatePathLeft fits a path into room cells by dropping leading components
-// ("internal/tui/sidebar.go" → "…/tui/sidebar.go"), keeping the filename — the
-// part that identifies the file — intact for as long as possible.
-func truncatePathLeft(path string, room int) string {
-	if room <= 0 {
-		return ""
-	}
-	if len(path) <= room {
-		return path
-	}
-	const ellipsis = "…/"
-	parts := strings.Split(path, "/")
-	for start := 1; start < len(parts); start++ {
-		candidate := ellipsis + strings.Join(parts[start:], "/")
-		if len(candidate) <= room {
-			return candidate
-		}
-	}
-	// Even "…/name" overflows: fall back to a right-truncated basename.
-	return truncateRunes(ellipsis+parts[len(parts)-1], room)
-}

internal/tui/files_panel_test.go

@@ -1,317 +0,0 @@
-package tui
-
-import (
-	"strings"
-	"testing"
-
-	tea "charm.land/bubbletea/v2"
-
-	"github.com/Gitlawb/zero/internal/tools"
-)
-
-// filesPanelTestModel is sidebarTestModel plus a couple of touched files: one
-// created, one edited twice (the second touch most recent).
-func filesPanelTestModel() model {
-	m := sidebarTestModel()
-	m.transcript = append(m.transcript,
-		transcriptRow{kind: rowToolResult, tool: "write_file", id: "f1", status: tools.StatusOK,
-			text:         "tool result: write_file ok Created web/app.js (10 lines).",
-			detail:       "+let a = 1\n+let b = 2",
-			changedFiles: []string{"web/app.js"}},
-		transcriptRow{kind: rowToolResult, tool: "edit_file", id: "f2", status: tools.StatusOK,
-			text:         "tool result: edit_file ok Edited internal/tui/sidebar.go.",
-			detail:       "+added one\n-removed one",
-			changedFiles: []string{"internal/tui/sidebar.go"}},
-		transcriptRow{kind: rowToolResult, tool: "edit_file", id: "f3", status: tools.StatusOK,
-			text:         "tool result: edit_file ok Edited internal/tui/sidebar.go.",
-			detail:       "+two\n+three\n-gone",
-			changedFiles: []string{"internal/tui/sidebar.go"}},
-	)
-	return m
-}
-
-// TestTouchedFilesAggregates: the roster is recovered from tool-result rows,
-// newest-touch first, with per-file diffstat totals, edit counts, and the
-// created badge from write_file's confirmation text.
-func TestTouchedFilesAggregates(t *testing.T) {
-	m := filesPanelTestModel()
-	files := m.touchedFiles()
-	if len(files) != 2 {
-		t.Fatalf("expected 2 touched files, got %d: %+v", len(files), files)
-	}
-	// sidebar.go was touched last, so it lists first.
-	if files[0].path != "internal/tui/sidebar.go" {
-		t.Fatalf("most recently touched file should list first, got %q", files[0].path)
-	}
-	if files[0].adds != 3 || files[0].dels != 2 || files[0].edits != 2 {
-		t.Errorf("sidebar.go diffstat = +%d −%d over %d edits, want +3 −2 over 2", files[0].adds, files[0].dels, files[0].edits)
-	}
-	if files[0].created {
-		t.Error("edited file must not read as created")
-	}
-	if !files[1].created {
-		t.Error("write_file 'Created …' result should mark the file created")
-	}
-	if files[0].lastRowIndex != len(m.transcript)-1 {
-		t.Errorf("lastRowIndex = %d, want the final transcript row", files[0].lastRowIndex)
-	}
-}
-
-// TestSidebarFileLinesRenderAndOverflow: rows carry the badge + left-truncated
-// path + diffstat; beyond maxSidebarFiles the tail collapses into "+N more";
-// hits index only real file rows.
-func TestSidebarFileLinesRenderAndOverflow(t *testing.T) {
-	m := filesPanelTestModel()
-	lines, hits := m.sidebarFileLines(34)
-	joined := plainRender(t, strings.Join(lines, "\n"))
-	if !strings.Contains(joined, "sidebar.go") || !strings.Contains(joined, "app.js") {
-		t.Fatalf("file rows missing paths:\n%s", joined)
-	}
-	if !strings.Contains(joined, "+3 −2") {
-		t.Errorf("expected aggregated diffstat +3 −2:\n%s", joined)
-	}
-	if !strings.Contains(joined, "A") || !strings.Contains(joined, "M") {
-		t.Errorf("expected A and M badges:\n%s", joined)
-	}
-	if len(hits) != 2 {
-		t.Fatalf("expected 2 clickable hits, got %d", len(hits))
-	}
-	if hits[0].path != "internal/tui/sidebar.go" {
-		t.Errorf("first hit should be the newest file, got %q", hits[0].path)
-	}
-
-	// Overflow: 8 distinct files -> maxSidebarFiles rows + a "+2 more" trailer.
-	over := sidebarTestModel()
-	for _, name := range []string{"a", "b", "c", "d", "e", "f", "g", "h"} {
-		over.transcript = append(over.transcript, transcriptRow{
-			kind: rowToolResult, tool: "edit_file", id: name, status: tools.StatusOK,
-			changedFiles: []string{name + ".go"},
-		})
-	}
-	overLines, overHits := over.sidebarFileLines(34)
-	if len(overHits) != maxSidebarFiles {
-		t.Fatalf("expected %d clickable rows, got %d", maxSidebarFiles, len(overHits))
-	}
-	if got := plainRender(t, overLines[len(overLines)-1]); !strings.Contains(got, "+2 more") {
-		t.Errorf("expected '+2 more' trailer, got %q", got)
-	}
-}
-
-// TestSidebarFilesLivePulseRow: while a mutating tool call streams its args,
-// the file it is writing shows as a pinned (unclickable) pulse row.
-func TestSidebarFilesLivePulseRow(t *testing.T) {
-	m := filesPanelTestModel()
-	m.streamCallName = "write_file"
-	m.streamCallDecoder = newStreamingDecoder()
-	m.streamCallDecoder.feed(`{"path":"web/new.css","content":"body{}`)
-
-	lines, hits := m.sidebarFileLines(34)
-	if got := plainRender(t, lines[0]); !strings.Contains(got, "web/new.css") {
-		t.Fatalf("live write should pin its path atop FILES, got %q", got)
-	}
-	for _, hit := range hits {
-		if hit.path == "web/new.css" {
-			t.Error("the live row must not be clickable (no result exists yet)")
-		}
-	}
-	// A non-mutating streaming call shows no pulse row.
-	m.streamCallName = "read_file"
-	if m.liveEditingPath() != "" {
-		t.Error("read_file must not read as a live edit")
-	}
-}
-
-// TestSidebarFileSelectablesMatchRenderedRows: the hit offsets computed by
-// sidebarFileSelectables must land exactly on the rendered FILES rows in
-// renderContextSidebar's output — the same invariant the mouse hit-test relies
-// on. Asserted against the real render, not a re-derivation of the math.
-func TestSidebarFileSelectablesMatchRenderedRows(t *testing.T) {
-	m := filesPanelTestModel()
-	width := sidebarWidth(m.width)
-	rendered := m.renderContextSidebar(width, m.height)
-	hits := m.sidebarFileSelectables(width)
-	if len(hits) == 0 {
-		t.Fatal("expected clickable FILES rows")
-	}
-	for _, hit := range hits {
-		if hit.lineOffset >= len(rendered) {
-			t.Fatalf("hit offset %d beyond rendered sidebar (%d lines)", hit.lineOffset, len(rendered))
-		}
-		line := plainRender(t, rendered[hit.lineOffset])
-		base := hit.path[strings.LastIndex(hit.path, "/")+1:]
-		if !strings.Contains(line, base) {
-			t.Errorf("hit for %q points at line %d which reads %q", hit.path, hit.lineOffset, line)
-		}
-	}
-}
-
-// TestFileRowClickSelectsThenOpens: the first sidebar click on a file selects
-// it (tint + scroll state, no view swap); the second click on the same file
-// opens the drill-in; clicking another file while the view is open switches it.
-func TestFileRowClickSelectsThenOpens(t *testing.T) {
-	m := filesPanelTestModel()
-	width := sidebarWidth(m.width)
-	hits := m.sidebarFileSelectables(width)
-	if len(hits) < 2 {
-		t.Fatal("expected two clickable FILES rows")
-	}
-	x := m.chatColumnWidth() + 3
-	click := func(hit fileHit) tea.MouseMsg { return testMouseClick(tea.MouseLeft, x, hit.lineOffset) }
-
-	m1, _, handled := m.handleTranscriptSelectionMouse(click(hits[0]))
-	if !handled {
-		t.Fatal("FILES row click should be handled")
-	}
-	if m1.selectedFile != hits[0].path || m1.fileView.active {
-		t.Fatalf("first click should select (not open): selected=%q active=%v", m1.selectedFile, m1.fileView.active)
-	}
-
-	m2, _, _ := m1.handleTranscriptSelectionMouse(click(hits[0]))
-	if !m2.fileView.active || m2.fileView.path != hits[0].path {
-		t.Fatalf("second click should open the file view: %+v", m2.fileView)
-	}
-
-	m3, _, _ := m2.handleTranscriptSelectionMouse(click(hits[1]))
-	if !m3.fileView.active || m3.fileView.path != hits[1].path {
-		t.Fatalf("clicking another file with the view open should switch it: %+v", m3.fileView)
-	}
-	if m3.selectedFile != hits[1].path {
-		t.Errorf("switching the view should move the selection too, got %q", m3.selectedFile)
-	}
-}
-
-// TestRowTouchesSelectedFileTint: only tool-result rows whose changedFiles
-// carry the selected path tint, and the render cache key differs across
-// selection states so the tint can't be served stale.
-func TestRowTouchesSelectedFileTint(t *testing.T) {
-	m := filesPanelTestModel()
-	row := m.transcript[len(m.transcript)-1]
-	if m.rowTouchesSelectedFile(row) {
-		t.Fatal("nothing selected: no row should tint")
-	}
-	m.selectedFile = "internal/tui/sidebar.go"
-	if !m.rowTouchesSelectedFile(row) {
-		t.Fatal("selected file's edit row should tint")
-	}
-	other := m.transcript[len(m.transcript)-3] // web/app.js
-	if m.rowTouchesSelectedFile(other) {
-		t.Fatal("an unrelated file's row must not tint")
-	}
-
-	rc := buildRowContext(m.transcript)
-	opts := cardRenderOptions{bodyCap: cardBodyMaxLines, cwd: m.cwd}
-	selectedKey, _ := m.renderRowCacheKey(row, 80, rc, opts, false)
-	m.selectedFile = ""
-	plainKey, _ := m.renderRowCacheKey(row, 80, rc, opts, false)
-	if selectedKey == plainKey {
-		t.Error("render cache key must change with the selection state")
-	}
-}
-
-// TestEscClearsFileSelectionThenNothing: Esc drops an active file selection
-// (before any run-level action) and is consumed doing so.
-func TestEscClearsFileSelectionThenNothing(t *testing.T) {
-	m := filesPanelTestModel()
-	m.selectedFile = "web/app.js"
-	updated, _ := m.Update(tea.KeyPressMsg{Code: tea.KeyEsc})
-	if got := updated.(model).selectedFile; got != "" {
-		t.Fatalf("Esc should clear the file selection, still %q", got)
-	}
-}
-
-func TestTruncatePathLeft(t *testing.T) {
-	if got := truncatePathLeft("internal/tui/sidebar.go", 40); got != "internal/tui/sidebar.go" {
-		t.Errorf("short path should pass through, got %q", got)
-	}
-	if got := truncatePathLeft("internal/tui/sidebar.go", 18); got != "…/tui/sidebar.go" {
-		t.Errorf("want …/tui/sidebar.go, got %q", got)
-	}
-	if got := truncatePathLeft("internal/tui/sidebar.go", 14); got != "…/sidebar.go" {
-		t.Errorf("want …/sidebar.go, got %q", got)
-	}
-}
-
-// TestTouchedFilesPerFileDiffStat: a multi-file result (apply_patch spanning
-// several files) must charge each file its OWN +/- counts from the per-file
-// diff sections — not the whole patch's totals to every file it touched.
-func TestTouchedFilesPerFileDiffStat(t *testing.T) {
-	m := sidebarTestModel()
-	patch := "diff --git a/web/one.js b/web/one.js\n" +
-		"--- a/web/one.js\n+++ b/web/one.js\n@@ -1,1 +1,2 @@\n+added one\n+added two\n" +
-		"diff --git a/web/two.js b/web/two.js\n" +
-		"--- a/web/two.js\n+++ b/web/two.js\n@@ -1,2 +1,1 @@\n-gone one\n-gone two\n-gone three\n"
-	m.transcript = append(m.transcript, transcriptRow{
-		kind: rowToolResult, tool: "apply_patch", id: "p1", status: tools.StatusOK,
-		detail:       patch,
-		changedFiles: []string{"web/one.js", "web/two.js"},
-	})
-	byPath := map[string]touchedFile{}
-	for _, f := range m.touchedFiles() {
-		byPath[f.path] = f
-	}
-	if f := byPath["web/one.js"]; f.adds != 2 || f.dels != 0 {
-		t.Errorf("web/one.js = +%d −%d, want its own +2 −0 (not the patch totals)", f.adds, f.dels)
-	}
-	if f := byPath["web/two.js"]; f.adds != 0 || f.dels != 3 {
-		t.Errorf("web/two.js = +%d −%d, want its own +0 −3 (not the patch totals)", f.adds, f.dels)
-	}
-}
-
-// TestTouchedFilesRetouchOrdersByLastTouch: touch a, then b, then a again — a
-// must list first. The old "reverse first-seen order" put b first because a's
-// slot kept its original position.
-func TestTouchedFilesRetouchOrdersByLastTouch(t *testing.T) {
-	m := sidebarTestModel()
-	for _, step := range []struct{ id, path string }{
-		{"r1", "a.go"}, {"r2", "b.go"}, {"r3", "a.go"},
-	} {
-		m.transcript = append(m.transcript, transcriptRow{
-			kind: rowToolResult, tool: "edit_file", id: step.id, status: tools.StatusOK,
-			changedFiles: []string{step.path},
-		})
-	}
-	files := m.touchedFiles()
-	if len(files) != 2 || files[0].path != "a.go" {
-		t.Fatalf("the re-touched file must list first, got %+v", files)
-	}
-}
-
-// TestSidebarFileLinesOverflowExcludesLiveRow: when the live-writing file is
-// also a touched file, it renders as the pulse row and is skipped from the
-// list — the "+N more" trailer must not count that skipped entry.
-func TestSidebarFileLinesOverflowExcludesLiveRow(t *testing.T) {
-	m := sidebarTestModel()
-	for _, name := range []string{"a", "b", "c", "d", "e", "f", "g", "h"} {
-		m.transcript = append(m.transcript, transcriptRow{
-			kind: rowToolResult, tool: "edit_file", id: name, status: tools.StatusOK,
-			changedFiles: []string{name + ".go"},
-		})
-	}
-	// h.go (a touched file) is ALSO the live write: 7 listable files remain,
-	// 6 render, so the trailer is +1 — not +2 (which counted the skipped live row).
-	m.streamCallName = "edit_file"
-	m.streamCallDecoder = newStreamingDecoder()
-	m.streamCallDecoder.feed(`{"path":"h.go","content":"x`)
-
-	lines, _ := m.sidebarFileLines(34)
-	trailer := plainRender(t, lines[len(lines)-1])
-	if !strings.Contains(trailer, "+1 more") {
-		t.Fatalf("overflow must exclude the live row from the count, got %q", trailer)
-	}
-}
-
-// TestSidebarHasContentForLiveWrite: the sidebar counts an in-flight first
-// write as content, so the FILES pulse is visible before any result row lands.
-func TestSidebarHasContentForLiveWrite(t *testing.T) {
-	m := sidebarTestModel()
-	m.plan.steps = nil // drop the helper's seeded plan: no agents/plan/files now
-	if m.sidebarHasContent() {
-		t.Fatal("session without agents/plan/files should have no sidebar content")
-	}
-	m.streamCallName = "write_file"
-	m.streamCallDecoder = newStreamingDecoder()
-	m.streamCallDecoder.feed(`{"path":"web/new.css","content":"body{}`)
-	if !m.sidebarHasContent() {
-		t.Fatal("a live in-flight write must count as sidebar content")
-	}
-}

internal/tui/hover.go

@@ -15,9 +15,6 @@ const (
 	// hoverPlanStep: a plan step row in the sidebar's PLAN section, identified by
 	// step index.
 	hoverPlanStep
-	// hoverFileRow: a touched-file row in the sidebar's FILES section, identified
-	// by path.
-	hoverFileRow
 )
 
 // hoverTarget identifies the single clickable row (if any) currently under the
@@ -37,7 +34,6 @@ type hoverTarget struct {
 	bodyY     int    // hoverTranscript
 	sessionID string // hoverSidebarAgent
 	stepIndex int    // hoverPlanStep
-	filePath  string // hoverFileRow
 }
 
 // mouseHover reports whether msg is a plain cursor-movement event with NO button
@@ -63,9 +59,6 @@ func (m model) updateHoverTarget(msg tea.MouseMsg) model {
 	if stepIndex, ok := m.planStepAtMouse(msg); ok {
 		return m.withHover(hoverTarget{kind: hoverPlanStep, stepIndex: stepIndex})
 	}
-	if path, ok := m.fileRowAtMouse(msg); ok {
-		return m.withHover(hoverTarget{kind: hoverFileRow, filePath: path})
-	}
 	if line, ok := m.transcriptLineAtMouse(msg); ok {
 		// A permission option reuses its OWN existing keyboard-cursor highlight
 		// (see hoverPermissionOption) rather than the m.hover mechanism, so there's

internal/tui/model.go

@@ -211,22 +211,6 @@ type model struct {
 	// sidebar; when set, the chat reflows to full width. Distinct from the
 	// availability conditions in sidebarAvailable (geometry / mode / overlays).
 	sidebarHidden bool
-	// selectedFile is the touched file selected by clicking its FILES sidebar
-	// row: its edit cards tint in the chat (rowTouchesSelectedFile) and a second
-	// click opens the drill-in file view. "" when nothing is selected; Esc clears.
-	selectedFile string
-	// fileView is the drill-in view for a touched file (file_view.go): while
-	// active the chat column's body shows the file's diff/content instead of the
-	// transcript, mirroring the subchat drill-in.
-	fileView fileViewState
-	// Git-sweep state (files_git_sweep.go): the startup snapshot of already-dirty
-	// paths (nil until Init's sweep answers), the newly dirty files discovered by
-	// live sweeps (bash/subagent mutations that carry no changedFiles), the
-	// single-flight guard, and the "not a git repo / no git" latch.
-	gitFileBaseline     map[string]bool
-	gitTouched          []gitSweepFile
-	gitSweepInFlight    bool
-	gitSweepUnavailable bool
 	// swarmDoneAt records when each swarm member was first seen finished (done/
 	// failed) in a swarm_status report, so the sidebar can linger it briefly with a
 	// fading ✓ before dropping it (a smooth exit, not an abrupt pop). Stamped in the
@@ -635,7 +619,7 @@ func newModel(ctx context.Context, options Options) model {
 		}
 	}
 
-	userConfigDir, _ := config.UserConfigDir()
+	userConfigDir, _ := os.UserConfigDir()
 	loadedUserCommands := usercommands.Load(usercommands.DefaultPaths(cwd, userConfigDir))
 
 	registry := options.Registry
@@ -819,12 +803,6 @@ func (m model) Init() tea.Cmd {
 	// terminal's unprompted push — mirrors the RequestBackgroundColor request
 	// below for the same reason.
 	cmds = append(cmds, tea.RequestWindowSize)
-	// Baseline git snapshot for the FILES sidebar sweep: whatever is already
-	// dirty when the TUI opens is pre-existing state, not this session's work
-	// (files_git_sweep.go). Async; a non-git workspace just disables the sweep.
-	if strings.TrimSpace(m.cwd) != "" {
-		cmds = append(cmds, gitSweepCmd(m.ctx, m.cwd, true))
-	}
 	// In auto mode, ask the terminal for its background color; the reply arrives
 	// as tea.BackgroundColorMsg and selects light vs dark (see updateModel).
 	if m.themeMode == themeAuto {
@@ -1080,14 +1058,6 @@ func (m model) updateModel(msg tea.Msg) (tea.Model, tea.Cmd) {
 			return m.handleCtrlC()
 		case keyCtrl(msg, 'o'):
 			return m.toggleDetailedTranscript(), nil
-		case m.fileView.active && m.noBlockingModal() && m.composerValue() == "" && (keyText(msg) == "d" || keyText(msg) == "f"):
-			// Mode toggle for the file drill-in, only while the composer is empty
-			// (so mid-sentence typing is never hijacked) and no modal is up (so a
-			// permission prompt / ask-user / wizard keeps its own key handling).
-			if keyText(msg) == "f" {
-				return m.setFileViewMode(fileViewFull), nil
-			}
-			return m.setFileViewMode(fileViewDiff), nil
 		case keyCtrl(msg, 'e'):
 			// Release/recapture the mouse so the user can drag-select and copy text
 			// natively (mouse capture otherwise intercepts terminal selection).
@@ -1112,14 +1082,6 @@ func (m model) updateModel(msg tea.Msg) (tea.Model, tea.Cmd) {
 				m = m.clearHover() // bodyY numbering differs between subchat and the parent transcript
 				return m, nil
 			}
-			// File drill-in exits on Esc (returns to the chat at its saved scroll
-			// position); the file stays selected so a second Esc clears that. Only
-			// with no blocking modal up: Esc on a permission prompt / ask-user /
-			// wizard must reach THAT surface's deny/cancel handling below, not
-			// silently close the drill-in behind it.
-			if m.fileView.active && m.noBlockingModal() {
-				return m.exitFileView(), nil
-			}
 			if m.mcpCommandCancel != nil {
 				m.cancelMCPCommand()
 				if m.mcpAddWizard != nil {
@@ -1176,13 +1138,6 @@ func (m model) updateModel(msg tea.Msg) (tea.Model, tea.Cmd) {
 			if m.suggestionsActive() {
 				return m.dismissSuggestions(), nil
 			}
-			// A selected FILES row clears before anything run-related: the
-			// selection is a passive highlight, so Esc dropping it is cheap and
-			// expected (mirrors how editors clear selection on Esc).
-			if m.selectedFile != "" {
-				m.selectedFile = ""
-				return m, nil
-			}
 			if m.hasQueuedMessage() {
 				return m.clearQueuedMessage(), nil
 			}
@@ -1857,13 +1812,8 @@ func (m model) updateModel(msg tea.Msg) (tea.Model, tea.Cmd) {
 			}
 			m, recapCmd = m.maybeRecapTurn(msg.runID, finalAnswer)
 		}
-		// End-of-turn git sweep: catch file mutations the tool stream couldn't
-		// report (bash scaffolding, subagent edits) so the FILES sidebar is
-		// complete once the turn settles.
-		var sweepCmd tea.Cmd
-		m, sweepCmd = m.maybeGitSweep()
 		next, queuedCmd := m.launchQueuedMessageIfReady()
-		return next, tea.Batch(titleCmd, recapCmd, sweepCmd, queuedCmd)
+		return next, tea.Batch(titleCmd, recapCmd, queuedCmd)
 	case sessionTitleGeneratedMsg:
 		return m.handleSessionTitleGenerated(msg)
 	case recapGeneratedMsg:
@@ -2014,14 +1964,6 @@ func (m model) updateModel(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.transcript = collapseRepeatedStatusCard(m.transcript, msg.row)
 		m.transcript = appendTranscriptRow(m.transcript, msg.row)
 		m = m.captureStepWork(msg.row)
-		// A finished command tool may have mutated files git can see but no
-		// changedFiles reports (npm create, heredoc writes, subagent edits) —
-		// re-sweep so the FILES sidebar picks them up mid-turn.
-		if msg.row.kind == rowToolResult && isPlanCommandTool(msg.row.tool) {
-			var sweep tea.Cmd
-			m, sweep = m.maybeGitSweep()
-			return m, sweep
-		}
 		return m, nil
 	case swarmSessionsMsg:
 		// Merge completed swarm members' session ids so their AGENTS sidebar rows
@@ -2052,8 +1994,6 @@ func (m model) updateModel(msg tea.Msg) (tea.Model, tea.Cmd) {
 	case prStateMsg:
 		m.prState = msg.state
 		return m, nil
-	case gitSweepMsg:
-		return m.handleGitSweepMsg(msg), nil
 	case prWatcherStartedMsg:
 		if msg.stop == nil {
 			return m, nil
@@ -2258,12 +2198,6 @@ func (m model) pinnedTitleBar(width int) string {
 	if !m.altScreen || m.height <= 0 {
 		return ""
 	}
-	// The file drill-in replaces the title bar with its nav line (path + key
-	// hints). Both are exactly one line, and every frame computation routes
-	// through here, so the swap never desyncs the viewport geometry.
-	if m.fileView.active {
-		return m.fileViewNavBar(width)
-	}
 	return m.titleBar(width)
 }
 
@@ -4364,14 +4298,13 @@ func (m model) runAgentWithOptions(runID int, runCtx context.Context, prompt str
 				}
 			}
 			row := transcriptRow{
-				kind:         rowToolResult,
-				id:           effectiveToolRowID(result.ToolCallID, callSeq[result.ToolCallID]),
-				text:         toolResultRowText(result),
-				tool:         result.Name,
-				status:       result.Status,
-				detail:       toolResultDetail(result),
-				runID:        runID,
-				changedFiles: result.ChangedFiles,
+				kind:   rowToolResult,
+				id:     effectiveToolRowID(result.ToolCallID, callSeq[result.ToolCallID]),
+				text:   toolResultRowText(result),
+				tool:   result.Name,
+				status: result.Status,
+				detail: toolResultDetail(result),
+				runID:  runID,
 			}
 			// A Task result is shown by the specialist card, and update_plan by the
 			// plan panel/sidebar, so skip both redundant transcript rows.

internal/tui/onboarding.go

@@ -755,15 +755,6 @@ func (m model) completeSetup() (tea.Model, tea.Cmd) {
 		m.providerProfile = result.Provider
 		m.providerName = result.Provider.Name
 		m.modelName = result.Provider.Model
-		// Export ZERO_PROVIDER alongside the committed profile fields (and the
-		// config setupSave already persisted as active). Unlike command_center's
-		// switch — which commits everything only after a successful build — setup
-		// commits config + profile unconditionally here, so the env must match
-		// them unconditionally too: applyEnv makes ZERO_PROVIDER WIN over config,
-		// so a stale value from an earlier /model switch left in place would send
-		// spawned children to the OLD provider even though config now names the
-		// new one. That is the exact D3 gap this closes.
-		config.SetActiveProviderEnv(result.Provider.Name)
 		if m.newProvider != nil {
 			if provider, providerErr := m.newProvider(result.Provider); providerErr == nil {
 				m.provider = provider

internal/tui/onboarding_test.go

@@ -3,7 +3,6 @@ package tui
 import (
 	"context"
 	"errors"
-	"os"
 	"strings"
 	"testing"
 
@@ -1536,42 +1535,3 @@ func absInt(value int) int {
 	}
 	return value
 }
-
-// Completing setup switches the live provider, so it must export ZERO_PROVIDER
-// exactly like the /model, /provider, and wizard switch paths — a stale value
-// from an earlier switch would otherwise win over config in every spawned
-// child (applyEnv) and pin specialists/swarm members to the OLD provider's
-// credentials.
-func TestCompleteSetupExportsActiveProviderEnv(t *testing.T) {
-	t.Setenv(config.ActiveProviderEnv, "stale-previous-provider")
-	m := newModel(context.Background(), Options{
-		Setup: SetupOptions{
-			Visible: true,
-			Providers: []SetupProviderOption{
-				{ID: "openai", Name: "OpenAI", DefaultModel: "gpt-4.1", EnvVar: "OPENAI_API_KEY", RequiresAuth: true},
-			},
-			Save: func(selection SetupSelection) (SetupResult, error) {
-				return SetupResult{
-					Provider: config.ProviderProfile{
-						Name:      selection.CatalogID,
-						CatalogID: selection.CatalogID,
-						Model:     selection.Model,
-					},
-				}, nil
-			},
-		},
-	})
-	m.width = 100
-	m.height = 30
-	m.setup.stage = setupStageReady
-
-	updated, _ := m.completeSetup()
-	next := updated.(model)
-
-	if next.providerName == "" {
-		t.Fatal("setup completion should have set a provider name")
-	}
-	if got := os.Getenv(config.ActiveProviderEnv); got != next.providerName {
-		t.Fatalf("%s = %q after setup save, want %q (children would spawn on the stale provider)", config.ActiveProviderEnv, got, next.providerName)
-	}
-}

internal/tui/provider_wizard.go

@@ -20,7 +20,6 @@ import (
 	"github.com/Gitlawb/zero/internal/providercatalog"
 	"github.com/Gitlawb/zero/internal/provideroauth"
 	"github.com/Gitlawb/zero/internal/redaction"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // providerWizardOAuthMsg carries the result of an in-wizard browser OAuth login.
@@ -888,20 +887,13 @@ func (m model) applyProviderWizard() (model, tea.Cmd) {
 	modelChoice := wizard.currentModel()
 	profile := providerWizardProfile(provider, modelChoice.ID, wizard.apiKey, wizard.baseURL, wizard.profileName)
 	runtimeProfile := providerWizardRuntimeProfile(profile)
-
-	// Build and persist into LOCALS first, committing live state only once BOTH
-	// succeed. A persist failure (read-only config, disk full) must not leave the
-	// chat running on the new provider while the status line, m.providerProfile,
-	// and the ZERO_PROVIDER export (which pins spawned children) still point at
-	// the old one — parent and children would silently run on different providers.
-	var nextProvider zeroruntime.Provider
 	if m.newProvider != nil {
-		built, err := m.newProvider(runtimeProfile)
+		nextProvider, err := m.newProvider(runtimeProfile)
 		if err != nil {
 			wizard.err = redaction.RedactString(err.Error(), redaction.Options{ExtraSecretValues: []string{profile.APIKey, runtimeProfile.APIKey}})
 			return m, nil
 		}
-		nextProvider = built
+		m.provider = nextProvider
 	}
 	if strings.TrimSpace(m.userConfigPath) != "" {
 		// Capture flip: move the freshly entered key into the encrypted credential
@@ -911,24 +903,12 @@ func (m model) applyProviderWizard() (model, tea.Cmd) {
 		profile = config.SecureProviderProfile(profile, m.userConfigPath)
 		if _, err := config.UpsertProvider(m.userConfigPath, profile, true); err != nil {
 			wizard.err = redaction.RedactString(err.Error(), redaction.Options{ExtraSecretValues: []string{secret, profile.APIKey}})
-			return m, nil // nothing committed to live state yet
+			return m, nil
 		}
 	}
-
-	// Both succeeded — commit the live provider, profile, model, and the child
-	// env export together, so they can never disagree.
-	if nextProvider != nil {
-		m.provider = nextProvider
-	}
 	m.providerProfile = profile
 	m.providerName = profile.Name
 	m.modelName = profile.Model
-	// Keep sub-agent child processes on the same provider we just switched to —
-	// same as the /model and /provider switch paths (command_center.go). Without
-	// this, a ZERO_PROVIDER exported by an earlier switch stays pointing at the
-	// OLD provider and wins over config in every spawned child (applyEnv), so
-	// specialists/swarm members run on the wrong provider's credentials.
-	config.SetActiveProviderEnv(profile.Name)
 	m.providerWizard = nil
 	return m, nil
 }

internal/tui/provider_wizard_test.go

@@ -1189,104 +1189,3 @@ func containsString(values []string, want string) bool {
 	}
 	return false
 }
-
-// Applying the wizard switches the live provider, so it must export
-// ZERO_PROVIDER exactly like the /model and /provider switch paths — a stale
-// value from an earlier switch would otherwise win over config in every
-// spawned child (applyEnv) and pin specialists/swarm members to the OLD
-// provider's credentials.
-func TestApplyProviderWizardExportsActiveProviderEnv(t *testing.T) {
-	t.Setenv(config.ActiveProviderEnv, "stale-previous-provider")
-	m := newModel(context.Background(), Options{})
-	// Isolate the SUCCESS path's persist to a temp config (the default empty
-	// path would skip persist; a future default must never reach the real user
-	// config), and stub the build so the full commit sequence runs.
-	m.userConfigPath = filepath.Join(t.TempDir(), "config.json")
-	m.newProvider = func(config.ProviderProfile) (zeroruntime.Provider, error) {
-		return &fakeProvider{}, nil
-	}
-	m.providerWizard = &providerWizardState{
-		step:        providerWizardStepModel,
-		profileName: "acme-wizard",
-		providers: []providercatalog.Descriptor{{
-			ID:                  "openrouter",
-			Name:                "OpenRouter",
-			Transport:           providercatalog.TransportOpenAICompatible,
-			DefaultBaseURL:      "https://openrouter.ai/api/v1",
-			DefaultModel:        "openai/gpt-4.1",
-			AuthEnvVars:         []string{"OPENROUTER_API_KEY"},
-			RequiresAuth:        true,
-			SupportedAPIFormats: []providercatalog.APIFormat{providercatalog.APIFormatOpenAIChatCompletions},
-		}},
-		models: []providerWizardModel{{ID: "openai/gpt-4.1", Description: "GPT-4.1"}},
-	}
-
-	updated, _ := m.applyProviderWizard()
-	next := updated
-
-	if next.providerName == "" {
-		t.Fatal("wizard apply should have set a provider name")
-	}
-	if got := os.Getenv(config.ActiveProviderEnv); got != next.providerName {
-		t.Fatalf("%s = %q after wizard apply, want %q (children would spawn on the stale provider)", config.ActiveProviderEnv, got, next.providerName)
-	}
-}
-
-// On a config PERSIST failure, applyProviderWizard must leave live state fully
-// unchanged — the chat must NOT already be running on the new provider while the
-// status line and the ZERO_PROVIDER export (which pins spawned children) still
-// point at the old one. Build and persist are staged into locals; nothing is
-// committed unless both succeed.
-func TestApplyProviderWizardPersistFailureLeavesLiveStateUnchanged(t *testing.T) {
-	t.Setenv("ZERO_CRED_STORAGE", "encrypted-file") // never touch the real OS keychain: apiKey is secured before the persist fails
-	t.Setenv(config.ActiveProviderEnv, "old-provider")
-
-	// A config path whose parent is a regular FILE, so writeConfigFile's MkdirAll
-	// fails and UpsertProvider returns an error.
-	blocker := filepath.Join(t.TempDir(), "not-a-dir")
-	if err := os.WriteFile(blocker, []byte("x"), 0o600); err != nil {
-		t.Fatalf("seed blocker file: %v", err)
-	}
-	brokenConfigPath := filepath.Join(blocker, "config.json")
-
-	oldProvider := &fakeProvider{}
-	newProvider := &fakeProvider{}
-	m := newModel(context.Background(), Options{})
-	m.provider = oldProvider
-	m.providerProfile = config.ProviderProfile{Name: "old-provider"}
-	m.providerName = "old-provider"
-	m.userConfigPath = brokenConfigPath
-	m.newProvider = func(config.ProviderProfile) (zeroruntime.Provider, error) { return newProvider, nil }
-	m.providerWizard = &providerWizardState{
-		step:        providerWizardStepModel,
-		profileName: "acme-new",
-		providers: []providercatalog.Descriptor{{
-			ID:                  "openrouter",
-			Name:                "OpenRouter",
-			Transport:           providercatalog.TransportOpenAICompatible,
-			DefaultBaseURL:      "https://openrouter.ai/api/v1",
-			DefaultModel:        "openai/gpt-4.1",
-			AuthEnvVars:         []string{"OPENROUTER_API_KEY"},
-			RequiresAuth:        true,
-			SupportedAPIFormats: []providercatalog.APIFormat{providercatalog.APIFormatOpenAIChatCompletions},
-		}},
-		models: []providerWizardModel{{ID: "openai/gpt-4.1", Description: "GPT-4.1"}},
-		apiKey: "sk-new",
-	}
-
-	updated, _ := m.applyProviderWizard()
-	next := updated
-
-	if next.providerWizard == nil || next.providerWizard.err == "" {
-		t.Fatal("a persist failure must surface a wizard error and keep the wizard open")
-	}
-	if next.provider != oldProvider {
-		t.Fatal("live provider must NOT be swapped when the persist fails")
-	}
-	if next.providerName != "old-provider" {
-		t.Fatalf("providerName = %q, want it unchanged on persist failure", next.providerName)
-	}
-	if got := os.Getenv(config.ActiveProviderEnv); got != "old-provider" {
-		t.Fatalf("%s = %q, want it unchanged on persist failure (children would diverge from parent)", config.ActiveProviderEnv, got)
-	}
-}

internal/tui/render_cache.go

@@ -164,9 +164,6 @@ func (m model) renderRowCacheKey(row transcriptRow, width int, rc rowContext, op
 	appendRenderCacheField(&b, strconv.FormatBool(row.final))
 	appendRenderCacheField(&b, strconv.Itoa(row.turnTools))
 	appendRenderCacheField(&b, strconv.FormatInt(int64(row.turnElapsed), 10))
-	// The FILES selection tints this row's card border, so selecting/deselecting
-	// a file must miss the cache entry rendered under the other state.
-	appendRenderCacheField(&b, strconv.FormatBool(m.rowTouchesSelectedFile(row)))
 
 	key := rcKey(row.runID, row.id)
 	appendRenderCacheField(&b, rc.hints[key])

internal/tui/rendering.go

@@ -167,10 +167,6 @@ type cardRenderOptions struct {
 	bodyCap  int
 	cwd      string
 	expanded bool
-	// fileSelected marks a tool-result card whose mutation touched the file
-	// selected in the FILES sidebar; the card border tints accent so the
-	// selection reads in the transcript.
-	fileSelected bool
 }
 
 // flushCardBodyMaxLines is the body cap for cards flushed to scrollback. The
@@ -214,10 +210,6 @@ func (m model) renderRowMode(row transcriptRow, width int, rc rowContext, flush
 }
 
 func (m model) renderRowModeUncached(row transcriptRow, width int, rc rowContext, opts cardRenderOptions) string {
-	// Resolved per-row (not at the opts construction sites) so every render
-	// path — live, flush, detailed — carries the FILES selection tint; the
-	// cache key includes the same predicate (renderRowCacheKey).
-	opts.fileSelected = m.rowTouchesSelectedFile(row)
 	switch row.kind {
 	case rowUser:
 		return renderUserRow(row, width)
@@ -1398,11 +1390,6 @@ func renderToolResultCard(row transcriptRow, width int, rc rowContext, opts card
 	glyph := zeroTheme.green.Render("•")
 	nameStyle := zeroTheme.green
 	borderStyle := zeroTheme.line
-	if opts.fileSelected {
-		// The selected FILES row's edit card: accent border, same as the
-		// sidebar's ▸ marker, so click → highlight reads as one gesture.
-		borderStyle = zeroTheme.accent
-	}
 	if failed {
 		glyph = zeroTheme.red.Render("•")
 		nameStyle = zeroTheme.red

internal/tui/session.go

@@ -444,13 +444,12 @@ func transcriptRowsFromSessionEvents(events []sessions.Event) []transcriptRow {
 			}
 			output := payloadString(payload, "output")
 			rows = append(rows, transcriptRow{
-				kind:         rowToolResult,
-				id:           effectiveToolRowID(id, callSeq[id]),
-				text:         fmt.Sprintf("tool result: %s %s %s", name, status, truncateTUIOutput(output, tuiToolOutputLimit)),
-				tool:         name,
-				status:       status,
-				detail:       output,
-				changedFiles: payloadStringSlice(payload, "changedFiles"),
+				kind:   rowToolResult,
+				id:     effectiveToolRowID(id, callSeq[id]),
+				text:   fmt.Sprintf("tool result: %s %s %s", name, status, truncateTUIOutput(output, tuiToolOutputLimit)),
+				tool:   name,
+				status: status,
+				detail: output,
 			})
 		case sessions.EventError:
 			if message := payloadString(payload, "message"); message != "" {
@@ -620,28 +619,6 @@ func payloadString(payload map[string]any, key string) string {
 	}
 }
 
-// payloadStringSlice reads a []string persisted into a session payload (JSON
-// round-trips it as []any), skipping non-string entries. Nil when absent.
-func payloadStringSlice(payload map[string]any, key string) []string {
-	switch typed := payload[key].(type) {
-	case []string:
-		return typed
-	case []any:
-		out := make([]string, 0, len(typed))
-		for _, v := range typed {
-			if s, ok := v.(string); ok && s != "" {
-				out = append(out, s)
-			}
-		}
-		if len(out) == 0 {
-			return nil
-		}
-		return out
-	default:
-		return nil
-	}
-}
-
 func payloadBool(payload map[string]any, key string) bool {
 	value := payload[key]
 	switch typed := value.(type) {

internal/tui/sidebar.go

@@ -97,11 +97,6 @@ func (m model) sidebarHasContent() bool {
 	if len(m.sidebarSpecialists()) > 0 || len(m.swarmSpawnedAgents()) > 0 {
 		return true
 	}
-	if len(m.touchedFiles()) > 0 || m.liveEditingPath() != "" {
-		// A live in-flight write counts before its result row exists, so the
-		// FILES pulse for the session's first mutation isn't hidden.
-		return true
-	}
 	return !m.plan.isEmpty()
 }
 
@@ -592,19 +587,6 @@ func (m model) renderContextSidebar(width, height int) []string {
 		lines = append(lines, planLines...)
 	}
 
-	// FILES section: the files this session has touched (files_panel.go).
-	// Rendered BELOW the plan steps so it never shifts sidebarPlanSelectables'
-	// click offsets; its own hits (sidebarFileSelectables) account for the
-	// sections above it.
-	add("")
-	add(m.sidebarFilesHeader(width))
-	fileLines, _ := m.sidebarFileLines(width)
-	if len(fileLines) == 0 {
-		add(sidebarPlaceholder("no files touched", width))
-	} else {
-		lines = append(lines, fileLines...)
-	}
-
 	// ACTIVITY section: recent completed work + a live "generating…" pulse. Shown
 	// BELOW the plan steps so it never shifts sidebarPlanSelectables' click offsets,
 	// and budgeted (height-1 minus what's used) so it clips ITSELF from the bottom
@@ -669,12 +651,6 @@ func (m model) hoveredSidebarLineOffset(width int) (int, bool) {
 				return hit.lineOffset, true
 			}
 		}
-	case hoverFileRow:
-		for _, hit := range m.sidebarFileSelectables(width) {
-			if hit.path == m.hover.filePath {
-				return hit.lineOffset, true
-			}
-		}
 	}
 	return 0, false
 }

internal/tui/transcript.go

@@ -41,11 +41,6 @@ type transcriptRow struct {
 	askUser    *agent.AskUserRequest
 	expanded   bool // collapsible transcript rows, e.g. provider thoughts
 
-	// changedFiles lists the workspace-relative paths a mutating tool result
-	// wrote (from tools.Result.ChangedFiles; restored from the session payload on
-	// resume). The sidebar FILES section derives its roster from these.
-	changedFiles []string
-
 	// specialistInfo holds the specialist card data for rowSpecialist rows.
 	// Nil for all other row kinds.
 	specialistInfo *specialistInfo

internal/tui/transcript_selection.go

@@ -211,12 +211,6 @@ func (m model) renderHoverHighlight(rendered string, selectable []transcriptSele
 }
 
 func (m model) transcriptBodyItems(width int, emptyOverlay string) []transcriptBodyItem {
-	// File drill-in: the chat column's body swaps to the viewed file's
-	// diff/content. Swapping HERE (the single source every consumer reads) keeps
-	// the viewport, scroll engine, renderer, and mouse hit-tests consistent.
-	if m.fileView.active {
-		return m.fileViewBodyItems(width)
-	}
 	items := []transcriptBodyItem{}
 	// Transcript ROWS render at the full chat width; row/status glyphs provide
 	// structure without adding another body margin. Block items (title bar, empty
@@ -1248,9 +1242,6 @@ func (m model) handleTranscriptSelectionMouse(msg tea.MouseMsg) (model, tea.Cmd,
 		// session, reusing the specialist-card subchat path. Checked before the
 		// transcript hit-test since the sidebar is outside the chat column.
 		if hit, ok := m.sidebarLineAtMouse(msg); ok {
-			// The subchat drill-in owns the whole (single-column) view; a file
-			// drill-in can't meaningfully stay open behind it.
-			m = m.exitFileView()
 			if errMsg := m.subchat.enter(m.sessionStore, hit.sessionID, hit.title, m.chatScrollOffset); errMsg != "" {
 				m = m.appendSystemNotice(errMsg)
 			}
@@ -1261,24 +1252,10 @@ func (m model) handleTranscriptSelectionMouse(msg tea.MouseMsg) (model, tea.Cmd,
 		// A click on a PLAN step row drops a transcript card listing the file
 		// changes captured while that step was in progress.
 		if stepIndex, ok := m.planStepAtMouse(msg); ok {
-			// The card lands in the chat transcript; close the file drill-in so
-			// it isn't appended invisibly behind the swapped body.
-			m = m.exitFileView()
 			var cmd tea.Cmd
 			m, cmd = m.openPlanStepDetail(stepIndex)
 			return m, cmd, true
 		}
-		// A click on a FILES row: first click selects the file (its edit cards
-		// tint and the chat scrolls to the most recent one); a click on the
-		// already-selected file — or any FILES click while the drill-in is open —
-		// opens/switches the file view.
-		if path, ok := m.fileRowAtMouse(msg); ok {
-			if m.fileView.active || m.selectedFile == path {
-				m.selectedFile = path
-				return m.openFileView(path), nil, true
-			}
-			return m.selectFile(path), nil, true
-		}
 		line, ok := m.transcriptLineAtMouse(msg)
 		if !ok {
 			if m.transcriptSelection.active {

release-please-config.json

@@ -5,7 +5,8 @@
   "bootstrap-sha": "02f0c0929bec65f5fc41bdcab3eb518d2b0b329a",
   "packages": {
     ".": {
-      "package-name": "@gitlawb/zero"
+      "package-name": "@gitlawb/zero",
+      "release-as": "0.1.0"
     }
   }
 }