Model picker silently rewrites the global default model (and drops reasoningEffort)

[hZsFN]

Summary

Switching the model of the current session in the UI model picker also rewrites the global default model (agent-default-model) in both cordis.yml and cordis.patch.yml. The rewrite additionally drops the reasoningEffort field, leaving the default with only provider + model.

Because every session that does not pin its own model inherits this default (heartbeat / autonomous sessions, task-board cron jobs, newly opened sessions), a user who merely tries a more expensive model in one session silently moves all background work onto that model.

Environment

• @deepseek-ai/dsh 0.2.1-rc.2, desktop profile
• Windows 11
• Relevant packages: @deepseek-ai/dsh-agent-default-model (lib/index.js), @deepseek-ai/dsh-client-ui-model-selection (locale/zh.json)

Steps to reproduce

1. In any session, switch the model from deepseek-flash to another model (e.g. gpt-5.6-luna).
2. Inspect the agent-default-model section in both config files:
   • ~/.dsh/profiles/desktop/cordis.yml
   • ~/.dsh/profiles/desktop/cordis.patch.yml
3. Both sections are rewritten within the same second and now read:

- id: agent-default-model
  name: '@deepseek-ai/dsh-agent-default-model'
  config:
    provider: openasi
    model: gpt-5.6-luna

The previously present reasoningEffort: high line is gone.

Why it matters

The picker's own hint says:

查看可用模型，并切换当前会话使用的模型。
("View available models and switch the model used by the current session.")

So the documented behaviour is session-scoped, while the implementation also mutates the global default.

Real cost incident

On 2026-10-19 a single session-level model switch changed the default to a high-priced model (gpt-6-astra). A heartbeat session — which has no model field in its plugin schema and therefore can only inherit the default — had accumulated roughly 400k tokens of context, then issued two requests of 394,322 and 414,009 input tokens. That is about ¥60 for one call (~¥145 per 1M input tokens) and ¥153.47 over one day, without the user touching that session at all.

Secondary issue: reasoningEffort loss

After the rewrite reasoningEffort is missing, so the value falls back to whatever the model negotiates. The effective reasoning level then becomes invisible in the UI and unpredictable in cost.

Suggestions

1. Split "session model" and "default model" into two independent settings. Put the default model under Settings → Model with explicit provider / model / reasoningEffort, and let the picker only affect the active session.
2. If the current coupling is intentional, at least (a) do not write agent-default-model when switching a session model, or (b) preserve reasoningEffort on write instead of replacing the whole block.
3. Notify when the default model changes (toast or confirmation), e.g. "Default model changed to X — this affects all new sessions and background jobs."
4. Allow background / system sessions to pin their own model (heartbeat, scheduled tasks) instead of only inheriting the global default.
5. (Optional) Support a lock: true flag on agent-default-model, so the UI picker cannot rewrite it.

Note on the two save paths

The three fields of agent-default-model are volatile(), and the existing comments in the config say a UI edit fails because desktop-host has not registered a root Include entry, so the write has to go through the patch file. Yet the model picker does succeed in rewriting both files, i.e. it uses a different save path. Reconciling those two paths would probably remove a whole class of surprises.

---

中文摘要：在 UI 里切换「当前会话」的模型时，会同时改写全局默认模型（cordis.yml 与 cordis.patch.yml 的 agent-default-model 段），并且丢掉 reasoningEffort 字段。所有未单独指定模型的会话（心跳、任务看板定时任务、新建会话）都会跟着变，导致后台任务静默改用高价模型——实测一次误切造成单次 414,009 输入 token（约 ¥60）、当天共 ¥153.47。建议把「会话模型」与「默认模型」拆成两个独立设置项；若保持现状，至少切换会话模型时不要改写默认段，并在写入时保留 reasoningEffort；另外建议后台/系统会话支持单独钉死模型。

[PerryLink]

Everything you observed happens, but it is a recorded decision rather than a leak in the picker. .agents/notes/archived/feature/2026-08-07-default-model-follows-the-picker.md is the note, and three lines settle each half of your report.

Line 20: "session.selectModel applies an accepted ModelSelection to its session and calls saveDefaultModelSelection() for the shared Agent default." That is the rewrite you saw. Line 30 goes further: "A successful model switch stores an agent-default-model: section in settings.yaml. The Settings page does not expose that namespace; the model picker is its editor." So the picker is not merely allowed to move the default — it is the designated editor for it.

Line 10 gives the reason: if the picker affected only its addressed session, "the next blank session can select a different model with no user-facing way to align the default". The trade you are objecting to is the one the note chose deliberately.

The dropped reasoningEffort is described too, at line 18: settings layers merge by field, so a partial write would let a configured effort survive a selection that omitted it; saveSelection() therefore writes the complete user section, and "absence therefore clears a stored effort". The note also says where a deployment-wide effort belongs instead: the adapter profile, which resolves it per model.

So what is left that is genuinely reportable is discoverability, not logic:

• Nothing in the composer says that switching model also moves the default that heartbeat, cron and new sessions inherit. The note's own justification assumes the user understands the two layers are one preference; the UI does not say so.
• Clearing an effort that the user never saw set is a real surprise even if the merge semantics are right. If the picker showed the effort it is about to clear, the "absence clears" rule would stop being a trap.

If you file it, I would file it as those two UI statements rather than as "silently rewrites the global default", because the rewrite is the feature and a maintainer will close the report by quoting line 20.

The code side, for reference: packages/core/agent-default-model/src/index.ts:24-41 — Config carries provider, model, and a volatile reasoningEffort, and selection() builds the ModelSelection with the effort only when it is present.

[hZsFN]

Thanks for your reply,I'll try to solve this by my self.

[yingyu4451]

Related data point, from the other direction: the same coupling is reachable by integrations, not just by the picker.

A third-party plugin can only give a session a model through session.selectModel, and that call also writes the shared agent-default-model. Concrete case: @xmanrui/dsh-im 5.4.0 + a Feishu bot model card set to deepseek-flash/High → new IM session created at 18:56:01.716 → model/selection high at 18:56:01.759 → cordis.patch.yml agent-default-model.reasoningEffort becomes high at 18:56:02 → every new conversation starts at High, with no picker interaction involved.

Filed separately with reproduction and a patch that keeps the picker as the default's editor and makes programmatic callers session-local: #10784

Upvoted this one too — the "absence clears an effort" surprise is the same trap from the effort side.

[hZsFN]

actually when i realized that i made a pugin,it can block dsh changing model from source,you can see https://github.com/hZsFN/dsh-default-model-lock