@bill10/agent-007 0.10.0 → 0.12.0

package/public/style.css

@@ -752,11 +752,6 @@ body {
 /* The one way back for a stopped Billion, so it reads as the row's action. */
 .explorer-billion-start { margin-left: auto; color: var(--accent); }
 /* notify_owner's questions, under Billion's row until dismissed */
-.explorer-waiting { list-style: none; margin: 0 0 4px; padding: 0 10px 0 22px; font-size: 11px; }
-.explorer-waiting-head { color: var(--accent); font-weight: 600; padding: 2px 0; }
-.explorer-waiting-item { display: flex; align-items: flex-start; gap: 4px; color: var(--text-muted); padding: 2px 0; }
-.explorer-waiting-item span { flex: 1; min-width: 0; overflow-wrap: anywhere; display: -webkit-box; -webkit-line-clamp: 3; -webkit-box-orient: vertical; overflow: hidden; }
-.explorer-waiting-item button { flex-shrink: 0; }
 
 .explorer-branch-name {
   overflow: hidden;
@@ -1181,7 +1176,7 @@ body {
 .mobile-nav { display: none; }
 @media (max-width: 700px) {
   .divider, .explorer-reopen-btn, #btn-toggle-explorer { display: none !important; }
-  .explorer-billion-start, .explorer-waiting-item button { min-width: 44px; min-height: 44px; }
+  .explorer-billion-start, .waiting-dismiss { min-width: 44px; min-height: 44px; }
   #explorer-panel, #office-panel, #terminal-panel {
     display: none; width: 100% !important; min-width: 0; max-width: none; flex: 1;
   }
@@ -1207,6 +1202,10 @@ body {
     cursor: pointer;
   }
   .mobile-nav button:hover, .mobile-nav button[aria-current="true"] { color: var(--accent); }
+  .mobile-nav-waiting { display: inline-flex; align-items: center; justify-content: center; gap: 5px; }
+  .mobile-nav-waiting .board-tab-badge { letter-spacing: 0; }
+  .waiting-choice, .waiting-send { min-height: 44px; }
+  .waiting-reply input { min-height: 44px; font-size: 16px; }
   /* Overlays sized for desktop */
   .spawn-form-inner, .dir-browser-inner { width: auto; max-width: 100%; }
   .spawn-form-main, .spawn-presets { flex-wrap: wrap; }
@@ -1302,6 +1301,117 @@ body {
   text-align: center;
 }
 
+/* ============================================================
+   Waiting on you
+   Billion's questions to the owner. A pinned tab next to Jobs,
+   same viewport, same badge; each open question is a card with
+   its choices and a reply line.
+   ============================================================ */
+
+.waiting-board {
+  position: absolute;
+  inset: 0;
+  display: flex;
+  flex-direction: column;
+  background: var(--bg-panel);
+  overflow-y: auto;
+  z-index: 5;
+}
+.waiting-list {
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  width: 100%;
+  max-width: 720px;
+  padding: 14px 12px 24px;
+}
+.waiting-empty { color: var(--text-dim); font-size: 12px; padding: 24px 2px; }
+
+.waiting-card {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  padding: 10px 12px;
+  background: var(--bg-dark);
+  border: 1px solid var(--border);
+  border-left: 2px solid var(--state-message);
+  border-radius: 3px;
+}
+.waiting-card-head { display: flex; align-items: center; gap: 8px; }
+.waiting-card-n { color: var(--accent); font-size: 11px; font-weight: 700; flex-shrink: 0; }
+.waiting-card-time { color: var(--text-dim); font-size: 10px; flex: 1; }
+.waiting-card-text {
+  margin: 0;
+  color: var(--text);
+  font-size: 12px;
+  line-height: 1.5;
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+}
+
+.waiting-choices { display: flex; flex-wrap: wrap; gap: 6px; }
+.waiting-choice {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  padding: 5px 12px;
+  font-size: 12px;
+  font-family: inherit;
+  color: var(--text);
+  background: transparent;
+  border: 1px solid var(--border);
+  border-radius: 3px;
+  cursor: pointer;
+}
+.waiting-choice:hover:not(:disabled) { border-color: var(--accent); color: var(--accent); }
+.waiting-choice.recommended { border-color: var(--accent); }
+.waiting-choice-tag {
+  color: var(--accent);
+  font-size: 9px;
+  letter-spacing: 1px;
+  text-transform: uppercase;
+}
+
+.waiting-reply { display: flex; gap: 6px; }
+.waiting-reply input {
+  flex: 1;
+  min-width: 0;
+  padding: 5px 8px;
+  font-size: 12px;
+  font-family: inherit;
+  color: var(--text);
+  background: var(--bg-panel);
+  border: 1px solid var(--border);
+  border-radius: 3px;
+}
+.waiting-reply input:focus { outline: none; border-color: var(--accent); }
+.waiting-send {
+  padding: 5px 12px;
+  font-size: 11px;
+  font-family: inherit;
+  color: var(--accent-contrast);
+  background: var(--accent);
+  border: none;
+  border-radius: 3px;
+  cursor: pointer;
+}
+.waiting-card :disabled { opacity: 0.55; cursor: default; }
+.waiting-error { margin: 0; color: var(--state-disconnected); font-size: 11px; }
+
+.waiting-answered { color: var(--text-muted); font-size: 11px; margin-top: 6px; }
+.waiting-answered summary {
+  cursor: pointer;
+  color: var(--text-dim);
+  font-size: 9px;
+  letter-spacing: 2px;
+  text-transform: uppercase;
+  padding: 4px 0;
+}
+.waiting-answered ul { list-style: none; margin: 4px 0 0; padding: 0; display: flex; flex-direction: column; gap: 6px; }
+.waiting-answered-item { display: grid; grid-template-columns: auto 1fr; column-gap: 8px; row-gap: 2px; }
+.waiting-answered-text { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.waiting-answered-answer { grid-column: 2; color: var(--text-dim); overflow-wrap: anywhere; }
+
 /* An agent the board created, not you. Subtle — it is still an ordinary agent
    you can type into; the marker only explains where it came from. */
 .terminal-tab.board-spawned .dot {

package/server/http.js

@@ -18,6 +18,7 @@ import { requestApproval, answerApproval } from './approvals.js';
 import { agentSummaries, sendMessage, flushMessages, pendingMessages, readAgentScreen } from './messages.js';
 import { handleMcpMessage } from './mcp.js';
 import { notifyOwner } from './owner.js';
+import { availableModels } from './models.js';
 
 // --- Origin Check Middleware (B2) ---
 // Rejects cross-origin requests from disallowed origins. localhost is always
@@ -106,6 +107,7 @@ export function setupRoutes(app, staticDir, { broadcast, killSession, respawnAge
     try {
       reply = await handleMcpMessage(req.body, {
         session: req.agentSession,
+        models: availableModels(),
         postJob: (fields) => postJobForAgent({ ...fields, user: userById(req.agentSession.ownerId) }, broadcast),
         listJobs: listJobsForAgent,
         readJob: readJobForAgent,
@@ -130,8 +132,8 @@ export function setupRoutes(app, staticDir, { broadcast, killSession, respawnAge
         answerPermission: ({ id, decision, reason }) => (req.agentSession.isBillion
           ? answerApproval(id, decision, reason)
           : { error: 'Only Billion answers permission requests.' }),
-        notifyOwner: (text) => (req.agentSession.isBillion
-          ? notifyOwner(text, { broadcast })
+        notifyOwner: (text, { choices, recommended } = {}) => (req.agentSession.isBillion
+          ? notifyOwner(text, { choices, recommended, broadcast })
           : { error: 'Only Billion can notify the owner.' }),
         // Never logged: a screen can hold a secret that scrolled by.
         readAgentScreen: ({ name, lines }) => readAgentScreen({
@@ -195,6 +197,7 @@ export function setupRoutes(app, staticDir, { broadcast, killSession, respawnAge
       type: body.type,
       schedule: body.schedule,
       agent: body.agent,
+      model: body.model,
       requiresPr: body.requiresPr ?? body.requires_pr,
       session,
       user: req.user || (session ? userById(session.ownerId) : null),

package/server/jobs.js

@@ -27,8 +27,9 @@ import {
   MAX_TITLE_LEN, MAX_DETAIL_LEN, isScheduled, jobType, resolveJobType, jobRequiresPr,
   scheduleHold, supersededRuns, createRunJob, runsToPrune, defaultRequiresPr, isJobDue, STATE_LABELS,
   jobAgent, jobAgentFromCommand, resolveJobAgent, resumeCommand, isValidJobAgent, recordedPermissionFlags,
-  BILLION_NAME, envPermissionMode,
+  BILLION_NAME, envPermissionMode, resolveJobModel,
 } from '../lib/jobs.js';
+import { availableModels } from './models.js';
 import { nextCronIso } from '../lib/cron.js';
 
 // --- Board settings ---
@@ -127,7 +128,8 @@ export function jobsPayload() {
   // The .env defaults ride along, so the toolbar can show the mode workers
   // really start in while no mode has been picked there.
   const envModes = { claude: envPermissionMode('claude'), codex: envPermissionMode('codex') };
-  return { type: 'jobs-list', jobs, settings: { ...boardSettings(), envModes } };
+  // The models each CLI's dropdown offers (server/models.js).
+  return { type: 'jobs-list', jobs, settings: { ...boardSettings(), envModes }, models: availableModels() };
 }
 
 export function broadcastJobs(broadcast) {
@@ -303,8 +305,8 @@ function clearFinishedAttachments() {
 
 // --- CRUD ---
 
-export function addJob({ title, detail, repoPath, type, schedule, permissionMode, agent, requiresPr, postedBy, postedByName, postedByAgent, postedByBillion, attachments }, broadcast) {
-  const result = createJob({ title, detail, repoPath, type, schedule, permissionMode, agent, requiresPr, postedBy, postedByName, postedByAgent, postedByBillion });
+export function addJob({ title, detail, repoPath, type, schedule, permissionMode, agent, model, requiresPr, postedBy, postedByName, postedByAgent, postedByBillion, attachments }, broadcast) {
+  const result = createJob({ title, detail, repoPath, type, schedule, permissionMode, agent, model, availableModels: availableModels(), requiresPr, postedBy, postedByName, postedByAgent, postedByBillion });
   if (result.error) return result;
   const plan = planAttachments(result.job, attachments);
   if (plan?.error) return plan;
@@ -366,7 +368,7 @@ function scheduleTypeError(schedule) {
     : null;
 }
 
-export function postJobForAgent({ title, detail, repo, schedule, type, agent, requiresPr, session, user }, broadcast) {
+export function postJobForAgent({ title, detail, repo, schedule, type, agent, model, requiresPr, session, user }, broadcast) {
   // The repo the calling agent is working in is the overwhelmingly likely
   // answer, so an agent only names one when it means a different repo.
   const resolved = resolveRepoRef(repo || (session && session.repoPath) || '');
@@ -403,6 +405,9 @@ export function postJobForAgent({ title, detail, repo, schedule, type, agent, re
     // Unnamed, the card runs on the same CLI as the agent posting it; a person
     // at the HTTP door with no session gets the board default.
     agent: agent || (session ? jobAgentFromCommand(session.command) : undefined),
+    // Checked against the discovered list by createJob, and put on the argv
+    // as one token by buildJobCommand.
+    model,
     requiresPr,
     // No permissionMode: an agent posting a card must not be able to pick the
     // mode the board will spawn with, which would be a way around every gate
@@ -450,6 +455,7 @@ function jobSummary(job) {
     state: job.state,
     type: jobType(job),
     agent: jobAgent(job),
+    model: job.model || null,
     requiresPr: jobRequiresPr(job),
     schedule: job.schedule || null,
     nextRunAt: job.nextRunAt || null,
@@ -543,7 +549,7 @@ export function readJobForAgent(jobId) {
 // land says so out loud and leaves its name on the card, because the whole
 // hazard is an edit nobody sees. Reading stays board-wide — every browser
 // already sees every card — but writing does not.
-export function editJobForAgent({ id, title, detail, repo, schedule, requiresPr, session, user }, broadcast) {
+export function editJobForAgent({ id, title, detail, repo, schedule, model, requiresPr, session, user }, broadcast) {
   const job = allJobs().find(j => j.id === id);
   if (!job) return { error: `No job with id "${id}" — list the board to see the ids.` };
   const gate = editableInPlace(job);
@@ -593,6 +599,11 @@ export function editJobForAgent({ id, title, detail, repo, schedule, requiresPr,
     fields.type = text ? 'scheduled' : 'one-time';
     if (text !== (job.schedule || '')) changed.push('schedule');
   }
+  if (model !== undefined && (model || null) !== (job.model || null)) {
+    // updateJob validates it against the card's agent.
+    fields.model = model;
+    changed.push('model');
+  }
   if (requiresPr !== undefined) {
     if (typeof requiresPr !== 'boolean') return { error: 'requires_pr must be true or false' };
     // Always passed on, so a type change in the same call cannot swap it for
@@ -602,7 +613,7 @@ export function editJobForAgent({ id, title, detail, repo, schedule, requiresPr,
   }
 
   if (!changed.length) {
-    return { error: 'Nothing to change — pass a new title, detail, repo, schedule or requires_pr.' };
+    return { error: 'Nothing to change — pass a new title, detail, repo, schedule, model or requires_pr.' };
   }
   const result = updateJob(job.id, fields, broadcast);
   if (result.error) return result;
@@ -815,6 +826,16 @@ export function updateJob(jobId, fields, broadcast) {
     cli = resolveJobAgent(fields.agent);
     if (cli.error) return { error: cli.error };
   }
+  // Checked against the agent the card will have. A card switched to another
+  // CLI with no model named drops its old one, which belongs to the old CLI.
+  const nextAgent = cli ? cli.agent : jobAgent(job);
+  let chosen = null;
+  if (fields.model !== undefined) {
+    chosen = resolveJobModel(fields.model, nextAgent, availableModels());
+    if (chosen.error) return { error: chosen.error };
+  } else if (nextAgent !== jobAgent(job)) {
+    chosen = { model: null };
+  }
   // Type and schedule move together: "scheduled with no cron" and "one-time
   // carrying a cron" are both incoherent, so they are resolved as a pair and
   // rejected as a pair.
@@ -839,6 +860,7 @@ export function updateJob(jobId, fields, broadcast) {
   if (fields.repoPath) job.repoPath = fields.repoPath;
   if (mode) job.permissionMode = mode.permissionMode;
   if (cli) job.agent = cli.agent;
+  if (chosen) job.model = chosen.model;
   const typeChanged = !!resolved && resolved.type !== jobType(job);
   if (resolved) {
     job.type = resolved.type;
@@ -1327,7 +1349,10 @@ export function orphanResumePlan(orphan, homes) {
   const sessionId = agent !== 'codex' ? null
     : probed ? probed.codexSessionId
     : codexSessionIdFor(orphan.worktreePath, homes);
-  return { agent, mode, flags, command: resumeCommand(agent, mode, flags, sessionId) };
+  // The card's model, when the card is for this CLI: a worker picked for a
+  // strong model comes back on it, not the CLI's default.
+  const model = card && jobAgent(card) === agent ? card.model || null : null;
+  return { agent, mode, flags, command: resumeCommand(agent, mode, flags, sessionId, model) };
 }
 
 export function resumeCommandForOrphan(orphan, homes) {

package/server/mcp.js

@@ -22,6 +22,7 @@
 import { JOB_STATES, STATE_LABELS, JOB_AGENTS } from '../lib/jobs.js';
 import { APPROVAL_WAIT_MS } from './agent-mcp.js';
 import { SCREEN_LINES_DEFAULT, SCREEN_LINES_MAX, quoteLines, oneLine } from './messages.js';
+import { MAX_CHOICES, MAX_CHOICE_CHARS } from './owner.js';
 
 // Echoed back from the client's own initialize when it sends one. MCP clients
 // negotiate this, and answering with whatever the client asked for is the
@@ -35,6 +36,12 @@ export const SERVER_INFO = { name: 'agent-007-board', version: '1' };
 // for and — deliberately — when to reach for it. "When the user asks" is the
 // operative clause: a job board full of work an agent queued for itself is not
 // what this is for.
+// The model field's description. toolsFor appends the models discovered on
+// this machine right now, since those are the only values the board accepts.
+const MODEL_HELP = 'Optional. Which model the card\'s CLI runs, from the list below for its '
+  + 'agent; empty for the CLI\'s default. A strong model for core code, security and '
+  + 'debugging; a fast one for docs, mechanical edits and research.';
+
 export const POST_JOB_TOOL = {
   name: 'post_job',
   description:
@@ -83,6 +90,10 @@ export const POST_JOB_TOOL = {
           'Optional. Which CLI the board spawns for this card: claude (Claude Code) '
           + 'or codex. Defaults to the one you are running as.',
       },
+      model: {
+        type: 'string',
+        description: MODEL_HELP,
+      },
       requires_pr: {
         type: 'boolean',
         description:
@@ -151,7 +162,7 @@ export const EDIT_JOB_TOOL = {
   name: 'edit_job',
   description:
     'Change a card that is still in To do: its title, detail, repository, '
-    + 'schedule or whether it requires a pull request. Only To do cards can be edited — once the board has dispatched a '
+    + 'schedule, model or whether it requires a pull request. Only To do cards can be edited — once the board has dispatched a '
     + 'card its agent has already been handed the text, so a later edit would leave '
     + 'the card describing work nobody was asked to do. Pass only the fields that '
     + 'change; the rest are left alone. Ids come from list_jobs.',
@@ -176,6 +187,10 @@ export const EDIT_JOB_TOOL = {
           'Replaces the cron schedule (five fields, or an @shorthand). Pass an empty '
           + 'string to turn a scheduled card back into one that runs once.',
       },
+      model: {
+        type: 'string',
+        description: `${MODEL_HELP} Switching the card's agent without naming a model clears it.`,
+      },
       requires_pr: {
         type: 'boolean',
         description:
@@ -326,15 +341,23 @@ export const NOTIFY_OWNER_TOOL = {
   name: 'notify_owner',
   description:
     'Put a question or a decision in front of the owner when they may be away '
-    + 'from the terminal: it is pinned in the "Waiting on you" list at the top of '
-    + 'the owner\'s browser, and sent to their phone over Telegram when that is set '
-    + 'up. One short message: the question, why, and what you recommend. Their '
-    + 'reply, if they answer from Telegram, arrives in this terminal as '
-    + '"[Owner via Telegram] <text>". At most a few per minute.',
+    + 'from the terminal: it goes in the "Waiting on you" tab of the owner\'s '
+    + 'browser, numbered (Q3), and to their phone over Telegram when that is set '
+    + 'up. One short message: the question, why, and what you recommend. When the '
+    + 'answer is a pick, pass choices (yes/no, maybe one alternative) and mark the '
+    + 'one you recommend: the owner answers with one tap. Their answer arrives in '
+    + 'this terminal as "[Owner via app] Q3: <answer>" or "[Owner via Telegram] Q3: '
+    + '<answer>". At most a few per minute.',
   inputSchema: {
     type: 'object',
     properties: {
       text: { type: 'string', description: 'The message, written to be read on a phone.' },
+      choices: {
+        type: 'array', minItems: 2, maxItems: MAX_CHOICES,
+        items: { type: 'string', minLength: 1, maxLength: MAX_CHOICE_CHARS },
+        description: `2 to ${MAX_CHOICES} short answers the owner can tap. The owner can still type something else.`,
+      },
+      recommended: { type: 'string', description: 'The choice you recommend; must be one of choices.' },
     },
     required: ['text'],
     additionalProperties: false,
@@ -389,8 +412,21 @@ export const RESPAWN_AGENT_TOOL = {
 export const TOOLS = [POST_JOB_TOOL, LIST_JOBS_TOOL, READ_JOB_TOOL, EDIT_JOB_TOOL, FINISH_JOB_TOOL, LIST_AGENTS_TOOL, SEND_MESSAGE_TOOL];
 const BILLION_TOOLS = [BILLION_READY_TOOL, ADD_REPO_TOOL, CLOSE_JOB_TOOL, ANSWER_PERMISSION_TOOL, NOTIFY_OWNER_TOOL, READ_AGENT_SCREEN_TOOL, RESPAWN_AGENT_TOOL];
 
-export function toolsFor(session) {
-  return session?.isBillion ? [...TOOLS, ...BILLION_TOOLS] : TOOLS;
+// `models` is { claude: [...], codex: [...] } as server/models.js last found them.
+export function toolsFor(session, models) {
+  const tools = session?.isBillion ? [...TOOLS, ...BILLION_TOOLS] : TOOLS;
+  if (!models) return tools;
+  const known = JOB_AGENTS.map(a => `${a}: ${models[a]?.length ? models[a].join(', ') : '(none found; leave empty)'}`).join('; ');
+  return tools.map(tool => (tool.inputSchema.properties.model ? {
+    ...tool,
+    inputSchema: {
+      ...tool.inputSchema,
+      properties: {
+        ...tool.inputSchema.properties,
+        model: { ...tool.inputSchema.properties.model, description: `${tool.inputSchema.properties.model.description} Available now — ${known}.` },
+      },
+    },
+  } : tool));
 }
 
 const ok = (id, result) => ({ jsonrpc: '2.0', id, result });
@@ -419,6 +455,7 @@ const scheduleText = (job, sep = ', next ') =>
 function summaryLine(job) {
   const bits = [job.repo];
   if (job.agent === 'codex') bits.push('codex');
+  if (job.model) bits.push(`model ${job.model}`);
   if (job.type === 'scheduled') {
     bits.push(`schedule ${scheduleText(job)}`);
   }
@@ -440,6 +477,7 @@ const CALLS = {
       repo: args.repo,
       schedule: args.schedule,
       agent: args.agent,
+      model: args.model,
       requiresPr: args.requires_pr,
       session: ctx.session || null,
     });
@@ -499,6 +537,7 @@ const CALLS = {
       `repo: ${job.repo}`,
       // Only when it is not the default, the way the card's chip works.
       job.agent === 'codex' ? 'runs on: codex' : null,
+      `model: ${job.model || 'CLI default'}`,
       job.type === 'scheduled'
         ? `schedule: ${scheduleText(job, ' — next ')}`
           + `${job.runCount ? ` — posted ${job.runCount} run(s), last ${when(job.lastRunAt)}` : ''}`
@@ -537,6 +576,7 @@ const CALLS = {
       detail: args.detail,
       repo: args.repo,
       schedule: args.schedule,
+      model: args.model,
       requiresPr: args.requires_pr,
     });
     if (result.error) return toolText(result.error, true);
@@ -588,9 +628,11 @@ const CALLS = {
   },
 
   [NOTIFY_OWNER_TOOL.name]: async (args, ctx) => {
-    const result = ctx.notifyOwner ? await ctx.notifyOwner(args.text) : { error: 'Only Billion can notify the owner.' };
+    const result = ctx.notifyOwner
+      ? await ctx.notifyOwner(args.text, { choices: args.choices, recommended: args.recommended })
+      : { error: 'Only Billion can notify the owner.' };
     if (result.error) return toolText(result.error, true);
-    return toolText('Sent to the owner on Telegram and pinned under "Waiting on you". Keep working on everything else; their reply, if any, arrives here as [Owner via Telegram].');
+    return toolText(`Sent to the owner on Telegram and put under "Waiting on you" as Q${result.n}. Keep working on everything else; their answer, if any, arrives here as [Owner via app] Q${result.n}: … or [Owner via Telegram] Q${result.n}: ….`);
   },
 
   // Quoted line by line, like a message body, so the screen cannot pass for
@@ -665,7 +707,7 @@ export function handleMcpMessage(msg, ctx = {}) {
   if (isNotification) return null;
 
   if (method === 'ping') return ok(id, {});
-  if (method === 'tools/list') return ok(id, { tools: toolsFor(ctx.session) });
+  if (method === 'tools/list') return ok(id, { tools: toolsFor(ctx.session, ctx.models) });
 
   if (method === 'tools/call') {
     // hasOwn, not truthiness: a plain object inherits Object.prototype, so a

package/server/models.js

@@ -0,0 +1,76 @@
+// Which models a card may name, per CLI, discovered on this machine so nobody
+// keeps a list. Nothing here goes to the network: Claude Code's aliases are
+// fixed words its --model resolves to the newest model itself, and Codex
+// already caches the account's model list on disk.
+//
+// A CLI that is not on the PATH the board spawns with offers nothing — a card
+// could not run there anyway — and so does anything that fails to read. An
+// empty list leaves only the CLI's own default on offer.
+
+import { readFileSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import { commandExists } from './command-path.js';
+import { isSafeModelName } from '../lib/jobs.js';
+
+// `claude --model` takes these as "the latest model of that family"
+// (claude --help names fable, opus and sonnet; haiku is in the same alias
+// table in the 2.1.283 binary). Aliases rather than full names so a new
+// release needs no change here.
+export const CLAUDE_ALIASES = ['fable', 'opus', 'sonnet', 'haiku'];
+
+const codexHome = (env) => env.CODEX_HOME || join(homedir(), '.codex');
+
+// Codex (0.156) keeps the models its account can use in
+// $CODEX_HOME/models_cache.json: { fetched_at, client_version, models: [{ slug,
+// visibility, priority, ... }] }. Only `visibility: "list"` entries are kept:
+// that is Codex's own filter for its /model picker, and it is what hides the
+// internal ones (codex-auto-review, the reviewer's model; gpt-reserve) that
+// are not for a coding session. Picker order is `priority`, lowest first. A
+// slug must also pass isSafeModelName, since it ends up on a command line.
+// The CLI has no plain list-models subcommand (its app-server's model/list is
+// a JSON-RPC session, not a one-shot), so this reads the cache its picker is
+// built from — read-only; nothing here ever writes under CODEX_HOME.
+export function parseCodexModels(text) {
+  let models;
+  try { models = JSON.parse(text)?.models; } catch { return []; }
+  if (!Array.isArray(models)) return [];
+  return models
+    .filter(m => m && m.visibility === 'list' && isSafeModelName(m.slug))
+    .sort((a, b) => (Number(a.priority) || 0) - (Number(b.priority) || 0))
+    .map(m => m.slug);
+}
+
+export function discoverModels({ env = process.env, exists = (f) => commandExists(f, env), read = (p) => readFileSync(p, 'utf8') } = {}) {
+  let codex = [];
+  if (exists('codex')) {
+    try { codex = parseCodexModels(read(join(codexHome(env), 'models_cache.json'))); } catch { /* no cache yet */ }
+  }
+  return { claude: exists('claude') ? [...CLAUDE_ALIASES] : [], codex };
+}
+
+// The current answer, refreshed at most every 10 minutes when asked and hourly
+// regardless (see startModelRefresh).
+const STALE_MS = 10 * 60 * 1000;
+let cached = { claude: [], codex: [] };
+let cachedAt = 0;
+
+export function refreshModels(opts) {
+  cached = discoverModels(opts);
+  cachedAt = Date.now();
+  return cached;
+}
+
+export function availableModels() { return cached; }
+
+// Whether a refresh changed anything, so the caller only repaints boards when it did.
+export function refreshIfStale(now = Date.now()) {
+  if (now - cachedAt < STALE_MS) return false;
+  const before = JSON.stringify(cached);
+  return JSON.stringify(refreshModels()) !== before;
+}
+
+export function startModelRefresh() {
+  refreshModels();
+  setInterval(refreshModels, 60 * 60 * 1000).unref();
+}