@open-mercato/cezar 0.9.1 → 0.9.2-pr710.1256

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Patryk Lewczuk
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -5,8 +5,8 @@
 **Parallel coding agents orchestrator** — a local cockpit for running and
 tracking AI coding-agent tasks in your repo.
 
-Type a task, pick a workflow and an agent — **Claude Code, Codex or OpenCode
-(experimental), or a mix of them per step** — and watch it work live: steps, tool calls,
+Type a task, pick a workflow and an agent — **Claude Code, Codex, OpenCode or pi
+(the latter two experimental), or a mix of them per step** — and watch it work live: steps, tool calls,
 tokens, diffs, in a browser cockpit that runs entirely on your machine.
 Your CLI logins, your `gh`, your files. No accounts, no database, no cloud.
 
@@ -19,7 +19,7 @@ your phone, working your backlog while you're away.
 
 [A look inside](#a-look-inside) · [What cezar does best](#what-cezar-does-best) · [What it solves](#what-it-solves) · [Who it's for](#who-its-for) · [Quick start](#quick-start) · [How it works](#how-it-works) · [Core concepts](#core-concepts) · [Cockpit tour](#cockpit-tour) · [Agent backends](#coding-agent-backends) · [Remote access](#remote-access-host-cezar-on-a-server)
 
-[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](#license)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 ![Node 20+](https://img.shields.io/badge/Node-20%2B-339933)
 ![TypeScript 7.x](https://img.shields.io/badge/TypeScript-7.x-3178c6)
 ![Zero config](https://img.shields.io/badge/config-zero-success)
@@ -60,7 +60,7 @@ it does better than any of them:
 
 - 🪶 **Genuinely zero config.** `npx cezar-cli` in your repo and you're running —
   no wizard, no API keys, no env vars, no schema, no database. It rides the
-  `claude` / `codex` / `opencode` logins and the `gh` you already have, and every
+  `claude` / `codex` / `opencode` / `pi` logins and the `gh` you already have, and every
   missing piece degrades gracefully instead of blocking you.
 - 🖥️ **Built for a server (VPS mode).** cezar is made to live on a **VPS, cloud,
   or dedicated box** as an always-on janitor for your repo — headless-first, with
@@ -207,7 +207,7 @@ event live and parks the run at a review gate when there's a diff to inspect.
         ▼
    ┌──────────────────────────────┐     ┌───────────────────────────────┐
    │  git worktree per task       │     │  agent CLI  (your login)      │
-   │  (isolated branch, parallel) │◄───►│  claude · codex · opencode    │
+   │  (isolated branch, parallel) │◄───►│ claude · codex · opencode · pi│
    └──────────────────────────────┘     │  Bash open · no prompts       │
         │                                 └───────────────────────────────┘
         │  agent text · tool calls · tool results · tokens · cost
@@ -285,11 +285,12 @@ Five moves that make the cockpit worth the browser tab:
 
 ## Cockpit tour
 
-Seven views, one browser window, all live over Server-Sent Events (six until you opt into the Inbox):
+Eight views, one browser window, all live over Server-Sent Events (seven until you opt into the Inbox):
 
 | View | What's in it |
 |---|---|
 | **Tasks** | Every task with its status, live event stream (agent text · tool calls · tool results · pasted/generated screenshots), tokens and cost. Continue, cancel, open in terminal (`claude --resume`), review the diff, or push a draft PR. |
+| **All tasks** | Every *registered project's* tasks in one table, filtered and grouped by tag, project, status or workflow — see [Grouping connected repositories](#grouping-connected-repositories-tags-and-the-all-tasks-page). Appears once a second project is registered. |
 | **Inbox** | **Opt-in** (`CEZ_FOLLOWUPS=1`; hidden by default). Follow-ups an agent left behind (`todos.json`) — one click turns a suggestion into the next task, pre-wired to its suggested skill. Off, agents are never asked to leave follow-ups; each task's own **Notes** handoff journal is unaffected. |
 | **Git** | Branch, working-tree status, diff vs HEAD, recent commits (click one for its inline patch + GitHub link), and the configurable base branch that worktrees fork from and PRs target. |
 | **GitHub** | Open issues and PRs of the repo's origin, read through your logged-in `gh`. Hand an issue straight to the agent — pick a workflow and skills, one click runs it. |
@@ -342,25 +343,86 @@ re-registers itself at the next start.
 **From the terminal** — the same registry, no cockpit required (handy over ssh):
 
 ```bash
-cezar projects                    # list: id, branch or status, path
+cezar projects                    # list: id, branch or status, path, tags
 cezar projects add ~/code/api     # register a folder (defaults to the current repo)
 cezar projects remove api         # drop the registry entry; the repo is untouched
+cezar projects tag api storefront backend   # set the grouping tags (no tags clears them)
 ```
 
 These read and write `~/.cezar/config.json` directly, so they work with the
 server stopped, and `CEZ_HOME` selects which workspace they operate on.
 
-Settings split along the same line: **Agents**, **Worktrees**, **Bookmarklets**,
-**Prompt templates** and **MCP** describe one repo and live under
-`/p/<projectId>/settings`; **Appearance**, **Notifications**, **Resources**,
-**Projects** and **Keyboard** are yours or the machine's and live at
-`/settings/global`.
-
-**Old URLs keep working.** Every unprefixed path — `/`, `/tasks/<id>`,
-`/settings`, and the whole `/api/…` surface — still answers exactly as before,
-bound to the project cezar was started in; the cockpit redirects flat paths to
-their `/p/<boot>/…` twin. Existing bookmarks, bookmarklets and scripts need no
-change.
+Settings split along the same line: **General** (the project's folder, its
+registry facts, its parallel-task ceiling, and Remove), **Agents**,
+**Worktrees**, **Bookmarklets**, **Prompt templates** and **MCP** describe one
+repo and live under `/p/<projectId>/settings`; **Appearance**,
+**Notifications**, **Resources**, **Projects** and **Keyboard** are yours or the
+machine's and live at `/settings/global`.
+
+### Grouping connected repositories: tags and the All tasks page
+
+Work rarely stops at a repo boundary. A storefront is an API, a web app and a
+design system; a platform is a handful of services plus the infra that runs
+them. **Tags** are how you say so, and **All tasks** is where saying so pays off.
+
+**Tag a repo** in **Settings → Projects**: type into the *Tags* cell on its row
+and press Enter (comma works too; the × on a chip, or Backspace in an empty
+field, removes one). The field **autocompletes from the tags already used in the
+workspace** — click the field to see them all, arrow keys and Enter to pick —
+which is what keeps the second repo landing on the first one's spelling instead
+of inventing `store-front` next to `storefront`. Anything not on the list is
+just typed. A tag is a free-form label — `storefront`, `infra`, `client-acme` —
+and a project can carry several, because a repo can belong to more than one
+piece of work. Tags are trimmed, deduplicated case-insensitively (`API` and
+`api` are one tag) and stored in `~/.cezar/config.json` beside the rest of the
+registry, so they are yours and this machine's, never something added to the
+repo.
+
+**All tasks** — the top item in the sidebar, `/tasks`, or `⌘K → All tasks` —
+then shows every registered project's work in one table:
+
+- **Filter** by tag, status and workflow. Tags are one-click chips; status and
+  workflow are searchable multi-selects. Every facet ORs inside itself and ANDs
+  across, so *"anything running or waiting in storefront or infra"* is one set
+  of clicks. Each option carries how many tasks it would leave, so a filter that
+  would empty the table says so before you click it. The search box matches
+  title, project, workflow, branch and tags.
+- **Group by** tag, project, status or workflow — click the pressed one again to
+  ungroup. Grouping by tag is the reason tags exist: three repos tagged
+  `storefront` become one section, and a repo tagged twice appears under both —
+  it genuinely belongs to both.
+
+The filters, the grouping and the Active/Archived tab live in the **URL**, so a
+filtered view survives a refresh, pastes into a chat, and sits in a bookmark —
+`/tasks?tag=storefront&status=running&group=tag` is a link to exactly what you
+were looking at. Only what you changed shows up: Active is the default, so the
+Archived view is `?archived=1` and a normal link carries no key for it.
+
+Each row shows **every** PR and issue it references — a task opened on an issue
+that landed a PR shows both — plus its cost and live CPU/memory, and can be
+marked **read/unread** (the eye) or **archived** (or restored) right there. Every task title, project name and project group heading links into that
+project, so the thread, its diff and its worktree are one click away and stay
+exactly where they were.
+
+There is deliberately **no project filter**: narrowing this page to one project
+is that project's own Tasks page, which is a better version of the same answer
+(live updates, the full column set, the composer). So picking a project *leaves*
+for it rather than turning the global view into a worse local one.
+
+Nothing else in cezar reads tags, on purpose: a tag is a lens, not a permission,
+a queue or a routing rule. Removing one changes what you see and nothing else.
+
+> The page reads a workspace-wide index capped at the newest 200 tasks per
+> project — it says so, and names the projects it capped, rather than showing a
+> short list as if it were complete. Older tasks are always in that project's own
+> Tasks page.
+
+**Old page URLs keep working.** Every unprefixed page path — `/`, `/tasks/<id>`,
+`/settings` — still answers, bound to the project cezar was started in; the
+cockpit redirects flat paths to their `/p/<boot>/…` twin, so existing bookmarks
+and bookmarklets need no change. The HTTP API is the exception: it moved to
+`/api/v1/…` (see the CHANGELOG), so a script that calls it needs the extra
+segment.
 
 > **Hosted cockpit?** The folder picker is confined to the independent browse
 > root. Set `CEZ_BROWSE_ROOT` narrowly before first boot (or save it in
@@ -382,7 +444,7 @@ steps:
     prompt: "{{task}}"
     skill: project-conventions   # optional — from .ai/skills or .ai/cezar/skills
     # model: opus                # optional per-step model override
-    # runner: codex              # optional per-step backend: claude · codex · opencode
+    # runner: codex              # optional per-step backend: claude · codex · opencode · pi
     # allowedTools: [Read, Edit, Write, Grep, Glob, Bash]
   - id: verify
     name: Verify
@@ -426,43 +488,87 @@ Useful environment variables:
 | Var | Effect |
 |---|---|
 | `CEZ_DRY_RUN=1` | Use the bundled mock instead of the real `claude` CLI — the entire cockpit works offline, for demos and development. |
+| `CEZ_AGENT_MODELS_LOCKED=1` | Globally lock each runner to the model configured in its native Claude/Codex/OpenCode settings while keeping runner selection available. Exact `1` also delegates authentication and provider enablement to those native agents, so Cezar skips its credential probes and provider-disable preferences. Existing Cezar presets are preserved but ignored, and an environment change requires a restart. The config-file equivalent is `"modelsLocked": true` in global `~/.cezar/config.json` or one repository's `.ai/cezar/config.json`; config-file locks do not disable provider checks. |
 | `CEZ_APPROVAL_GATE=1` | Opt into Claude's interactive approval UI; by default, unapproved tools are denied without interrupting the run. |
 | `CEZ_FOLLOWUPS=1` | Turn on the global follow-up **Inbox**: agents are asked to leave follow-ups in `todos.json` when they finish, and the Inbox view appears. Off by default — each task's own **Notes** handoff journal runs either way. |
+| `CEZ_AUTOMATIONS=1` | Turn on **GitHub automations**: the Automations view appears and cezar polls GitHub on each enabled automation's interval, launching tasks from what it finds. Off by default, and only the exact value `1` enables it — without it nothing polls GitHub, the automations endpoints answer `409`, and the nav item is absent. Read at boot, so restart after changing it; definitions, receipts and high-watermarks are retained, so unsetting it and restarting restores the feature without migration or data loss. |
 | `CEZ_AUTOSAVE=1` | Re-enable the periodic (90 s) autosave commit in task worktrees. Off by default (#471) — turn-end and pre-PR flushes always run, so branches still end complete. Every autosave names its trigger in the commit subject (`cezar autosave (periodic)` vs `(turn end)` / `(run finalize)` / `(pre-PR)`), so the flushes you keep are distinguishable from the timer you disabled. |
 | `CEZ_CLAUDE_BIN=/path/to/claude` | Override which `claude` binary is used. |
 | `CEZ_CODEX_BIN=/path/to/codex` | Override which `codex` binary is used. |
 | `CEZ_OPENCODE_BIN=/path/to/opencode` | Override which `opencode` binary is used. |
+| `CEZ_PI_BIN=/path/to/pi` | Override which `pi` binary is used. |
+| `CLAUDE_CONFIG_DIR`, `CODEX_HOME` | The agents' **own** variables, honoured where the vendor documents one. Setting one moves that agent's **default account** — the config folder cezar discovers. A *second* login of the same CLI is deliberately not an environment setting, since one process-wide value cannot differ per project: add it under **Settings → Agent accounts** and pick it per project. |
 | `CEZ_BROWSE_ROOT=~/` | Default root for **Add project → Open local folder…**. The picker cannot navigate above it; a saved workspace value overrides the environment default and must name an existing folder. |
 | `CEZ_PROJECTS_DIR=~/cezar/projects` | Default destination for **Clone from GitHub**. Saved workspace settings override it, and missing directories are created recursively. |
+| `CEZ_SKILLS_AUTO_UPDATE=0` | Disable automatic checks and updates for upstream-CLI-tracked Open Mercato skill installations. On by default; a saved global Skills setting overrides this environment default. Checks are delayed, bounded, cached, and non-blocking. |
+| `CEZ_AUTONOMOUS_DEFAULT=0` | Seed the New Task Autonomous default (`0` or `1`). Without a seed, skills default on and workflows off; a saved global Resources setting overrides it. |
+| `CEZ_WORKTREE_DEFAULT=1` | Seed the New Task Worktree default (`0` or `1`). Without a seed, eligible runs default on; a saved global Resources setting overrides it. |
+| `CEZ_DISABLE_REPO_LOCK=1` | **Dangerous escape hatch:** allow any run executing in the repository root — an explicit `worktree=false` run, non-Git degradation, or a continuation whose worktree cannot be restored — to proceed without Cezar’s repository-root lease. Agents can overwrite each other’s files or Git state; isolated worktree runs are unaffected. Off by default; only the exact value `1` enables it. |
 | `CEZ_SINGLE_PROJECT=1` | Opt into a launch-project-only cockpit: only the exact value `1` enables it. Project add, edit, checkout, folder browsing, and removal are refused and only the launch project is shown. Off by default; stored registry rows are retained, so unsetting it and restarting restores the full multi-project workspace without migration or data loss. |
+| `CEZ_HIDE_TOKEN_USAGE=1` | Hide raw input/output token counts throughout the browser cockpit while leaving backend-reported cost visible. Only the exact value `1` enables it; telemetry and API payloads are unchanged, and a restart is required after changing it. |
+| `CEZ_HIDE_COST=1` | Hide backend-reported monetary cost throughout the browser cockpit while leaving raw input/output token counts visible. Only the exact value `1` enables it; telemetry and API payloads are unchanged, and a restart is required after changing it. |
+| `CEZ_HIDE_TOKEN_METRICS=1` | Legacy master switch that hides both token usage and cost. It takes precedence over the two independent flags; only the exact value `1` enables it, payloads are unchanged, and a restart is required. |
 | `GITHUB_TOKEN` | Fallback for GitHub reads/PRs when `gh` isn't authenticated. |
 | `CEZ_ENV_PASSTHROUGH=A,B` | Forward these extra host env vars to spawned agents. By default agents get a least-privilege env (safe shell/toolchain vars + the backend's own auth + `GITHUB_TOKEN` + `CEZ_*`), not your full environment — use this to add a var an agent needs. |
 | `CEZ_AGENT_ENV_FULL=1` | Escape hatch: give spawned agents the full host environment (pre-hardening behavior). Off by default; only set it if you understand that this hands every host secret to the agent process. |
+| `CEZ_AGENT_TMPDIR=0` | Stop giving each task its own temp directory and hand agents the host `TMPDIR` again (pre-#785 behavior). On by default: every run gets `TMPDIR`/`TEMP`/`TMP` pointing at `.ai/cezar/tmp/<task-id>`, created and write-probed before the agent spawns and reaped when the run ends, so concurrent tasks stop sharing one directory and a task refuses to start rather than run against a temp directory that silently swallows its shell output (see Troubleshooting below). Only an exact `0` disables it, and it disables the whole thing — the pre-spawn check included, so this stays an escape hatch you can actually take. |
 | `CEZ_REDACT_SECRETS=0` | Disable scrubbing of credential values/token shapes from the on-disk state (the NDJSON transcript and the free-text fields of `runs.json`). On by default; leave it on. Best-effort defense-in-depth, not a guarantee: it catches known token shapes and the values of your own secret-named env vars, so a credential in neither category can still get through. |
 | `CEZ_TITLE_UPDATES=0` | Turn off the live task-title refresh (namer re-runs on each turn end). The Settings → Agents toggle overrides this default. |
 | `CEZ_AUTONAME=0` | Disable ALL LLM task naming (creation + live) — titles stay heuristic (`437: /om-auto-review-pr`). Under `CEZ_DRY_RUN=1` naming is already off unless forced with `CEZ_AUTONAME=1`. |
 | `CEZ_REVIEW_GATE=1` | Turn ON the optional diff-first review gate (#489): a successful, non-autonomous run with changes parks at `review` (Accept / Send back / Draft PR) instead of finishing. Off by default — changed runs settle to `done` with the diff left in the worktree. Only `1` enables. The Settings → Agents toggle overrides this; autonomous runs always skip it. |
 | `CEZ_NO_BANNER=1` | Skip the `open-mercato/skills` banner on `cezar serve` startup. (The cockpit no longer shows a banner — its skills now live on the Skills page's Manage panel — so this env var is the terminal banner's only switch.) |
+| `VITE_CEZ_API_BASE=http://localhost:4321` | **Build time only**, and only when the cockpit bundle is deployed apart from the service it talks to. Empty (the default) means "the origin that served this page", which is right for both normal cases: the CLI serves the bundle itself, and `npm run dev` proxies `/api` to the local service. A deployment that must be configured without a rebuild can put `<meta name="cez-api-base" content="…">` in the served HTML instead, which wins over this. |
+
+### Troubleshooting: the agent's shell returns nothing
+
+**Symptom.** A task on the Claude backend keeps working, but every shell command
+comes back with no output and a spurious non-zero exit status — `echo hello`
+included. Redirecting into a file inside the worktree still produces the right
+content, so the commands genuinely run; only the *capture* is lost. Codex tasks
+on the same machine are unaffected, because that backend streams over stdio
+pipes instead of round-tripping a command's output through a temp file.
+
+**Diagnosis.** The temp directory the agent was given is out of space or out of
+quota. One line tells you:
+
+```bash
+echo probe > "${TMPDIR:-/tmp}/probe"   # "Disk quota exceeded" / "No space left on device"
+df -i "${TMPDIR:-/tmp}"                # a tmpfs can exhaust inodes long before bytes
+```
+
+Under quota the file is *created* and the write then fails, so the backend reads
+back a zero-byte capture file and hands the agent an empty result.
+
+**Fix.** Since #785 cezar gives each task its own `TMPDIR` under
+`.ai/cezar/tmp/<task-id>` and write-probes it before spawning, so a broken temp
+directory fails the task with `agent temp directory is not writable: …` on the
+task thread instead of corrupting its work. If you see that error, free space on
+the disk holding the repo. `CEZ_AGENT_TMPDIR=0` turns the whole mechanism off —
+per-task directory and pre-spawn check alike — and hands agents the host
+`TMPDIR` again, which is the way out if the check itself is wrong on your
+platform.
 
 ---
 
 ## Coding agent backends
 
 cezar is not married to one vendor. Every agent step runs through a single
-`AgentRunner` seam with three built-in backends:
+`AgentRunner` seam with four built-in backends:
 
 | Backend | CLI | How cezar drives it | Tool access |
 |---|---|---|---|
 | **Claude Code** (default) | [`claude`](https://github.com/anthropics/claude-code) | Headless `stream-json` mode. | Per-tool `--allowedTools` (`bashAllowlist` scopes `Bash`); `dontAsk` denies unapproved tools without prompting (`CEZ_APPROVAL_GATE=1` → `acceptEdits` + approval UI). |
 | **Codex** | [`codex`](https://github.com/openai/codex) | `codex app-server` — JSON-RPC over stdio, the same transport the Codex IDE extensions use. | Ignores `allowedTools`; the default auto mode uses `danger-full-access` with `approvalPolicy: never` (`CEZ_CODEX_NETWORK=0` opts into the network-blocked `workspace-write` sandbox). |
 | **OpenCode** _(experimental)_ | [`opencode`](https://opencode.ai) | `opencode serve` — a local HTTP server with an SSE event stream. | Ignores `allowedTools` entirely; every permission is auto-approved. |
+| **pi** _(experimental)_ | [`pi`](https://github.com/badlogic/pi-mono) | Persistent `--mode rpc` over JSONL; models are picked with the `provider/model` convention. | Maps `allowedTools` onto pi's `--tools` allowlist; a configured `bashAllowlist` disables Bash because pi cannot express command-prefix rules. |
 
-> ⚠️ **OpenCode support is experimental.** The runner works but is less battle-tested
-> than the Claude Code and Codex backends, and OpenCode auto-approves every permission
-> (it ignores `allowedTools`). Treat it as a preview and expect rough edges.
+> ⚠️ **OpenCode and pi support are experimental.** Both runners work but are less
+> battle-tested than the Claude Code and Codex backends, and OpenCode auto-approves
+> every permission (it ignores `allowedTools`). Treat them as previews and expect
+> rough edges.
 
 On startup cezar probes which CLIs are installed and the cockpit only offers
-the backends it found — install any one of the three and you're operational.
+the backends it found — install any one of the four and you're operational.
 
 **Pick a backend at three levels** (most specific wins):
 
@@ -493,8 +599,19 @@ steps:
 Parallel variants (×2/×3) of one task share that task's backend — mixing
 happens per task and per step, not inside a variant group.
 
+**Models come from your own machine.** For Codex and OpenCode, the model picker
+is not a list cezar ships — it asks the installed CLI what it can actually run
+(`codex app-server`'s `model/list`, and `opencode models`), caches the answer in
+memory for five minutes, and shows it. A model your provider rolled out
+yesterday is selectable without a cezar release, and one it retired stops being
+offered. Claude Code has no equivalent local catalog, so it keeps a short list
+of tier aliases and pinned versions. `auto` (let the agent decide) is always
+available, including when the CLI is missing, logged out, or slow — discovery
+never blocks the cockpit, and a model you pinned yourself stays selectable even
+if it is absent from the discovered list.
+
 The seam is deliberately small: a backend is one class implementing the
-`AgentRunner` interface (`src/core/agent-runner.ts`) that turns a prompt into
+`AgentRunner` interface (`packages/cezar/src/core/agent-runner.ts`) that turns a prompt into
 a stream of normalized events. Other CLIs — pi, aider, whatever ships next —
 can slot in the same way.
 
@@ -562,12 +679,20 @@ never blocks startup):
   // the source against a moving branch head — cezar verifies it resolves to
   // exactly that commit, and reports it as `team.commit`.
   "worktreeRetention": 10,   // keep the last N finished worktrees on disk; 0 = unlimited (branch always kept)
-  "defaultRunner": "claude", // agent backend: "claude" (default) · "codex" · "opencode"
+  "defaultRunner": "claude", // agent backend: "claude" (default) · "codex" · "opencode" · "pi"
+  "modelsLocked": true,      // optional: native per-runner model is fixed/read-only; runner stays selectable
   "plannerModel": "sonnet",  // model the "Plan first" button uses to draft chains
   "baseBranch": "develop"    // branch worktrees fork from + PRs target (also settable in the Git tab)
 }
 ```
 
+Put the same `"modelsLocked": true` key in `~/.cezar/config.json` to apply it
+to every registered project. When the key is absent or `false` in both config
+files (and `CEZ_AGENT_MODELS_LOCKED` is not `1`), each runner's normal model
+selector uses that runner's discovered model list. While locked, the model is
+shown read-only and follows the selected runner's native settings; the runner
+itself remains selectable.
+
 Run data (`runs.json`, NDJSON event logs, worktrees, `todos.json`) is
 git-ignored automatically; your workflows and skills stay committable.
 
@@ -610,8 +735,8 @@ cd cezar
 npm install
 ```
 
-**3. Build** — compiles the server (`tsc → dist/`) and the cockpit
-(`vite build → web/dist/`), then runs the pack gate:
+**3. Build** — compiles the api-client and the server (`tsc → packages/cezar/dist/`) and the cockpit
+(`vite build → packages/cezar/web/dist/`), then runs the pack gate:
 
 ```bash
 npm run build
@@ -663,9 +788,9 @@ npm run uninstall-as-command    # removes cezar / cez / cezar-cli (either flavor
 
 ```bash
 npm run dev          # server (API :4321) + Vite dev server, opens the cockpit in the browser
-npm run dev:server   # tsx src/index.ts — the API server alone
+npm run dev:server   # tsx packages/cezar/src/index.ts — the API server alone
 npm run dev:web      # Vite dev server alone (proxies /api to :4321)
-npm run build        # tsc → dist/, vite build → web/dist/, then the pack gate
+npm run build        # tsc → packages/cezar/dist/, vite build → packages/cezar/web/dist/, then the pack gate
 npm run typecheck    # server + web (tsc --noEmit)
 npm test             # vitest — server + cockpit unit suites
 npm run test:unit    # node:test — fast core-module tests
@@ -675,7 +800,7 @@ npm run test:e2e     # real-browser cockpit suite (agent-browser)
 
 The stack is deliberately small: **TypeScript** (strict, ESM), **Hono** + SSE for
 the server, **Zod** at every boundary, **YAML** for workflows, and a **React 19 +
-Vite + Tailwind v4 + shadcn/ui** cockpit shipped pre-built in `web/dist/` — the
+Vite + Tailwind v4 + shadcn/ui** cockpit shipped pre-built in `packages/cezar/web/dist/` — the
 published package carries the built app, so `npx` users never run a bundler.
 Every module is meant to be read in one sitting.
 
@@ -694,4 +819,4 @@ Start here; graduate to cezar when a team needs shared visibility.
 
 ## License
 
-**MIT** © Patryk Lewczuk
+**MIT** © Patryk Lewczuk — full text in [LICENSE](LICENSE).

package/dist/agent-config/account-identity.d.ts

@@ -0,0 +1,44 @@
+import type { ProviderId } from '../core/provider-auth.ts';
+/**
+ * Who an agent account is logged in AS — the "Show details" read (spec
+ * `2026-07-29-agent-profiles.md`).
+ *
+ * This is the second place vendor knowledge lives about an agent's home, beside
+ * `catalog.ts` (which config FILES exist) and `core/agent-profiles.ts` (which env var relocates
+ * the home). This one knows where each agent writes its own identity. Facts verified against the
+ * files on disk 2026-07-29; re-verify before changing them.
+ *
+ * ## Two rules that are not negotiable
+ *
+ * 1. **Named fields only, never pass-through.** `~/.codex/auth.json` holds `OPENAI_API_KEY`,
+ *    `access_token` and `refresh_token` right beside the identity claims. Every reader below picks
+ *    fields by name and builds a fresh object; nothing here spreads, forwards or stringifies a
+ *    parsed vendor object, so a key the vendor adds tomorrow cannot leak through. The JWT is read
+ *    for its CLAIMS and its signature is never a credential we hold onto.
+ * 2. **Read on demand, answered to exactly one route.** This never joins the accounts listing,
+ *    never enters `runs.json` or the NDJSON, and is never logged. `provider-auth.ts` keeps account
+ *    identity out of its own boundary on purpose; this is the deliberate, opt-in exception —
+ *    localHandoff-gated, and only when the user asks for it — not a widening of that rule.
+ */
+/** One labelled row, as the pane renders it. Deliberately not a fixed per-provider shape: what an
+ *  agent knows about its own login differs, and inventing an empty "Organization" for one that has
+ *  no concept of it would be a worse answer than omitting the row. */
+export interface AccountIdentityField {
+    label: string;
+    value: string;
+}
+export interface AccountIdentity {
+    /** False when there is nothing to show — not signed in, no file, or a file we cannot parse. */
+    available: boolean;
+    /** Why, in the user's terms, when `available` is false. */
+    reason?: string;
+    fields: AccountIdentityField[];
+}
+/**
+ * What this account is logged in as, or an honest reason there is nothing to show.
+ *
+ * Never throws. OpenCode answers "unsupported": its credentials live in a SQLite DB outside the
+ * config dir (see `core/agent-profiles.ts`), so there is nothing in a config folder to read — and
+ * guessing from the default login would attribute one account's identity to another.
+ */
+export declare function readAccountIdentity(provider: ProviderId, configDir: string): Promise<AccountIdentity>;

package/dist/agent-config/account-identity.js

@@ -0,0 +1,128 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { claudeStateFilePath } from '../paths.js';
+/** `.claude.json` can carry per-project history; cap the read like `readUserMcpServers` does. */
+const READ_CAP = 2 * 1024 * 1024;
+const NOT_SIGNED_IN = 'Not signed in on this account yet — use Connect.';
+const UNREADABLE = 'Could not read this account’s details.';
+/** Read a JSON file under the cap. `null` for absent, unreadable, oversized or malformed. */
+async function readJsonCapped(path) {
+    try {
+        const raw = await readFile(path, 'utf8');
+        if (raw.length > READ_CAP)
+            return null;
+        const parsed = JSON.parse(raw);
+        return parsed && typeof parsed === 'object' ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** A non-empty display string, or undefined — so a blank vendor value never renders as an empty row. */
+function text(value) {
+    if (typeof value === 'string' && value.trim() !== '')
+        return value.trim();
+    if (typeof value === 'number' && Number.isFinite(value))
+        return String(value);
+    return undefined;
+}
+/** Push a row only when the value is really there. */
+function push(fields, label, value) {
+    const shown = text(value);
+    if (shown !== undefined)
+        fields.push({ label, value: shown });
+}
+/**
+ * Claude Code keeps its login in `.claude.json`'s `oauthAccount` — a *sibling* of `~/.claude` by
+ * default, but INSIDE an overridden config dir (`claudeStateFilePath` owns that rule, and getting
+ * it wrong is how one account reports another's email).
+ */
+async function readClaudeIdentity(configDir) {
+    const state = await readJsonCapped(claudeStateFilePath(configDir));
+    if (state === null)
+        return { available: false, reason: NOT_SIGNED_IN, fields: [] };
+    const account = state.oauthAccount;
+    if (!account || typeof account !== 'object') {
+        return { available: false, reason: NOT_SIGNED_IN, fields: [] };
+    }
+    const a = account;
+    const fields = [];
+    push(fields, 'Email', a.emailAddress);
+    push(fields, 'Name', a.displayName);
+    push(fields, 'Organization', a.organizationName);
+    push(fields, 'Role', a.organizationRole);
+    // `seatTier`/`billingType` are the closest thing to a plan the file states; neither is
+    // documented, so they are shown under a label that promises no more than they are.
+    push(fields, 'Seat', a.seatTier);
+    push(fields, 'Billing', a.billingType);
+    return fields.length > 0
+        ? { available: true, fields }
+        : { available: false, reason: UNREADABLE, fields: [] };
+}
+/**
+ * Codex keeps its login in `auth.json`'s `id_token` — a JWT whose payload carries the identity
+ * claims. Read for its claims only: the same file holds `OPENAI_API_KEY`, `access_token` and
+ * `refresh_token`, none of which this function so much as names.
+ *
+ * The signature is NOT verified, and that is correct here: this is a local file the user's own CLI
+ * wrote, read to display who they are — not a token cezar is accepting as proof of anything.
+ */
+async function readCodexIdentity(configDir) {
+    const auth = await readJsonCapped(join(configDir, 'auth.json'));
+    if (auth === null)
+        return { available: false, reason: NOT_SIGNED_IN, fields: [] };
+    const tokens = auth.tokens;
+    const idToken = tokens && typeof tokens === 'object'
+        ? tokens.id_token
+        : undefined;
+    const fields = [];
+    const claims = typeof idToken === 'string' ? decodeJwtClaims(idToken) : null;
+    if (claims !== null) {
+        push(fields, 'Email', claims.email);
+        push(fields, 'Name', claims.name);
+        const openai = claims['https://api.openai.com/auth'];
+        if (openai && typeof openai === 'object') {
+            push(fields, 'Plan', openai.chatgpt_plan_type);
+        }
+    }
+    // An API-key login has no id_token at all — say which kind of login this is rather than
+    // reporting "not signed in" for an account that is perfectly usable.
+    if (fields.length === 0 && typeof auth.OPENAI_API_KEY === 'string' && auth.OPENAI_API_KEY !== '') {
+        return { available: true, fields: [{ label: 'Login', value: 'API key' }] };
+    }
+    return fields.length > 0
+        ? { available: true, fields }
+        : { available: false, reason: NOT_SIGNED_IN, fields: [] };
+}
+/** A JWT's payload claims, or null when it is not a readable three-part token. */
+function decodeJwtClaims(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3 || !parts[1])
+        return null;
+    try {
+        const parsed = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+        return parsed && typeof parsed === 'object' ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * What this account is logged in as, or an honest reason there is nothing to show.
+ *
+ * Never throws. OpenCode answers "unsupported": its credentials live in a SQLite DB outside the
+ * config dir (see `core/agent-profiles.ts`), so there is nothing in a config folder to read — and
+ * guessing from the default login would attribute one account's identity to another.
+ */
+export async function readAccountIdentity(provider, configDir) {
+    if (provider === 'claude')
+        return readClaudeIdentity(configDir);
+    if (provider === 'codex')
+        return readCodexIdentity(configDir);
+    return {
+        available: false,
+        reason: 'OpenCode keeps its login outside its config folder, so cezar cannot read it.',
+        fields: [],
+    };
+}
+//# sourceMappingURL=account-identity.js.map

package/dist/agent-config/account-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-identity.js","sourceRoot":"","sources":["../../src/agent-config/account-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAwClD,iGAAiG;AACjG,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjC,MAAM,aAAa,GAAG,kDAAkD,CAAC;AACzE,MAAM,UAAU,GAAG,wCAAwC,CAAC;AAE5D,6FAA6F;AAC7F,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,GAAG,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,sDAAsD;AACtD,SAAS,IAAI,CAAC,MAA8B,EAAE,KAAa,EAAE,KAAc;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAAC,SAAiB;IACjD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnF,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC;IACnC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACzC,uFAAuF;IACvF,mFAAmF;IACnF,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE;QAC7B,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IAChD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAChE,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAClD,CAAC,CAAE,MAAkC,CAAC,QAAQ;QAC9C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;QACrD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAG,MAAkC,CAAC,iBAAiB,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,wFAAwF;IACxF,qEAAqE;IACrE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,KAAK,EAAE,EAAE,CAAC;QACjG,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE;QAC7B,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED,kFAAkF;AAClF,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxF,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAoB,EACpB,SAAiB;IAEjB,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAChE,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC9D,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8EAA8E;QACtF,MAAM,EAAE,EAAE;KACX,CAAC;AACJ,CAAC"}

package/dist/agent-config/catalog.d.ts

@@ -1,4 +1,4 @@
-import type { RunnerId } from '../core/agent-runner.js';
+import type { RunnerId } from '../core/agent-runner.ts';
 /**
  * The catalog of coding-agent config files cezar can surface and edit (spec
  * `.ai/specs/2026-07-16-agent-config-files.md`). This file is the ONLY place
@@ -47,6 +47,14 @@ export interface ConfigFileDef {
     seeded?: boolean;
     /** True when this file holds MCP server definitions (drives the MCP section's filter). */
     holdsMcp?: boolean;
+    /** Top-level native setting that supplies the agent's new-session model, when present. */
+    modelKey?: string;
+    /** Native model keys checked in precedence order, including nested `env.*` settings. */
+    modelKeys?: readonly string[];
+    /** Native provider key paired with the model, when the vendor separates the two. */
+    modelProviderKey?: string;
+    /** Higher values win when resolving a native default model across config scopes. */
+    modelPriority?: number;
     /** VERBATIM from the vendor docs. Never computed, never generic. */
     precedence: string;
     /** Documented mid-run reload behaviour, or undefined when the vendor is silent. */

package/dist/agent-config/catalog.js

@@ -21,6 +21,9 @@ export const CONFIG_FILES = [
         label: '~/.claude/settings.json',
         format: 'json',
         tracked: 'outside-repo',
+        modelKey: 'model',
+        modelKeys: ['env.ANTHROPIC_MODEL', 'model'],
+        modelPriority: 1,
         precedence: 'Lowest priority. Project and local settings override it key by key — except permission rules, which merge across all scopes.',
         hotReload: 'Edits to most keys — including permissions and hooks — apply to a running session without a restart.',
         docsUrl: CLAUDE_SETTINGS_DOCS,
@@ -34,6 +37,9 @@ export const CONFIG_FILES = [
         label: '.claude/settings.json',
         format: 'json',
         tracked: 'tracked',
+        modelKey: 'model',
+        modelKeys: ['env.ANTHROPIC_MODEL', 'model'],
+        modelPriority: 2,
         precedence: 'Overrides user settings key by key (permission rules merge). Local settings override this.',
         hotReload: 'Edits to most keys — including permissions and hooks — apply to a running session without a restart.',
         docsUrl: CLAUDE_SETTINGS_DOCS,
@@ -48,6 +54,9 @@ export const CONFIG_FILES = [
         format: 'json',
         tracked: 'gitignored',
         seeded: true,
+        modelKey: 'model',
+        modelKeys: ['env.ANTHROPIC_MODEL', 'model'],
+        modelPriority: 3,
         precedence: 'Highest of the file scopes — overrides project and user (permission rules merge). Git-ignored; copied into each run’s worktree so it takes effect immediately.',
         hotReload: 'Edits to most keys — including permissions and hooks — apply to a running session without a restart.',
         docsUrl: CLAUDE_SETTINGS_DOCS,
@@ -113,6 +122,9 @@ export const CONFIG_FILES = [
         format: 'toml',
         tracked: 'outside-repo',
         holdsMcp: true,
+        modelKey: 'model',
+        modelProviderKey: 'model_provider',
+        modelPriority: 1,
         precedence: 'User-level defaults. A trusted project’s .codex/config.toml overrides these; some keys (provider, auth, telemetry) cannot be overridden at project scope. MCP servers live here under [mcp_servers.<id>].',
         docsUrl: CODEX_CONFIG_DOCS,
     },
@@ -125,6 +137,8 @@ export const CONFIG_FILES = [
         label: '.codex/config.toml',
         format: 'toml',
         tracked: 'tracked',
+        modelKey: 'model',
+        modelPriority: 2,
         holdsMcp: true,
         precedence: 'Applies only in projects you have trusted. Some keys (provider, auth, telemetry) cannot be overridden here. MCP servers go under [mcp_servers.<id>]. Runs read the committed copy.',
         docsUrl: CODEX_CONFIG_DOCS,
@@ -152,6 +166,8 @@ export const CONFIG_FILES = [
         format: 'jsonc',
         tracked: 'outside-repo',
         holdsMcp: true,
+        modelKey: 'model',
+        modelPriority: 1,
         precedence: 'Global config. Merged with the project config, not replaced — later configs override earlier ones only for conflicting keys. MCP servers live under the "mcp" key.',
         docsUrl: OPENCODE_CONFIG_DOCS,
     },
@@ -165,6 +181,8 @@ export const CONFIG_FILES = [
         format: 'jsonc',
         tracked: 'tracked',
         holdsMcp: true,
+        modelKey: 'model',
+        modelPriority: 2,
         precedence: 'Merged over the global config per conflicting key (not a wholesale replace). MCP servers live under the "mcp" key. Runs read the committed copy.',
         docsUrl: OPENCODE_CONFIG_DOCS,
     },