@worca/app 1.6.0-rc.1 → 1.6.0-rc.2

package/README.md

@@ -234,7 +234,7 @@ See [`docs/team-policy.md`](docs/team-policy.md).
   into that model's agent spawns. Share a model catalog as a plugin, with
   secrets required at install time.
 - **No first-party account needed** — run and chat titles are written by the
-  model the run or chat itself uses (Settings › General › Title generation picks
+  model the run or chat itself uses (Settings › Models › Title generation picks
   a fixed one instead), endpoint-routed models carry Claude Code's internal
   haiku/sonnet/opus/fable tier keys so nothing falls back to the Anthropic API,
   and *Hide built-in models* (Settings › Models) drops the built-ins from every

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@worca/app",
-  "version": "1.6.0-rc.1",
+  "version": "1.6.0-rc.2",
   "description": "Worca — deterministic multi-agent pipeline that drives Claude Code (headless) through Plan -> Refine -> Implement -> Review, with a CLI, an installable /worca skill, and a web UI.",
   "license": "MIT",
   "author": "Sinisha Djukic",

package/src/core/ask/turn.mjs

@@ -658,7 +658,11 @@ class AskTurn extends EventEmitter {
       await d.fs.writeFile(
         mcpConfigPath,
         JSON.stringify(d.buildMcpConfig({ homeBase, threadId: this.threadId, serverPath: d.serverPath, ...(this.reader ? { reader: this.reader } : {}), ...(this.relay ? { relay: this.relay } : {}), ...(this.web ? { web: this.web } : {}) }), null, 2),
-        { encoding: 'utf8', mode: 0o600 },          // never a key value (webKeyVar: the key rides the process env)
+        // Never a key value (webKeyVar: the key rides the process env). A relayed turn runs as
+        // the person's agent user (agent-pool.mjs), which reads this file through its group: the
+        // scratch dir is setgid worca-share (2770), so 0640 reaches the agent users and nobody
+        // else. It carries this turn's relay token, which that agent must present anyway.
+        { encoding: 'utf8', mode: this.relay ? 0o640 : 0o600 },
       );
       // One 30-minute budget for the whole turn, retry included. The timedOut
       // flag and abort() run in ONE synchronous callback, so R-C always reads

package/src/core/bridge/provider-ops.mjs

@@ -19,7 +19,7 @@ import {
 } from './providers/copilot.mjs';
 import { keyOptional } from './registry.mjs';
 import { listEndpointModels, catalogEntryForEndpointModel, importableModel } from './providers/endpoint.mjs';
-import { brokerEnabled, brokerInfo, cachedBrokerInfo, mintSpawnToken, revokeSpawnToken, slotBaseUrl } from '../broker-client.mjs';
+import { brokerEnabled, brokerInfo, cachedBrokerInfo, mintSpawnToken, revokeSpawnToken, slotBaseUrl, personSlots } from '../broker-client.mjs';
 import { routeUpstream } from '../broker-routing.mjs';
 import { resolveBillTo } from '../billing.mjs';
 
@@ -129,7 +129,7 @@ const secretSource = (v) => (!v ? null : modelEnvRef(v) ? 'env' : 'stored');
  * a network call to GitHub — and is null when the account exposes none.
  * @param {{quota?:boolean, fetch?:typeof fetch}} [opts]
  */
-export async function providersState({ quota = false, fetch: f } = {}) {
+export async function providersState({ quota = false, fetch: f, person = resolveBillTo(null) } = {}) {
   const all = allProviders();
   const c = all.copilot;
   const token = resolveProviderSecret(c.githubToken);
@@ -161,11 +161,47 @@ export async function providersState({ quota = false, fetch: f } = {}) {
       maxConcurrent: p.maxConcurrent,
     };
   };
-  // With the credential broker on, keys and the Copilot sign-in are per person on its key page.
-  const broker = brokerEnabled() ? { enabled: true, keyPage: cachedBrokerInfo()?.publicUrl || null, mode: cachedBrokerInfo()?.mode || null } : { enabled: false };
+  // With the credential broker on, keys and the Copilot sign-in are per person on its key page:
+  // each provider's state is the viewer's own slot there, not worca's (empty) settings.
+  const broker = brokerEnabled() ? await brokerProviders(all, person) : { enabled: false };
   return { copilot, openai: keyed('openai'), anthropic: keyed('anthropic'), broker };
 }
 
+/**
+ * The Providers card's view of the broker: which slot each provider spends from and the viewer's
+ * state in it — {slot, state:'set'|'missing'|'invalid'|'operator'|'keyless'|'none', suffix?, error?}.
+ * Never throws: an unreachable broker leaves the states out and says why.
+ */
+async function brokerProviders(all, person) {
+  const info = cachedBrokerInfo() || await brokerInfo().catch(() => null);
+  const out = { enabled: true, keyPage: info?.publicUrl || null, mode: info?.mode || null, providers: {} };
+  const slots = info?.slots || [];
+  const route = (name) => {
+    if (name === 'copilot') {
+      const s = slots.find((x) => x.auth === 'copilot');
+      return s ? { slot: s.id } : { state: 'none', error: 'the credential broker has no GitHub Copilot slot' };
+    }
+    const r = routeUpstream({ provider: name, baseUrl: all[name].baseUrl || null }, { slots });
+    return r.slot ? { slot: r.slot } : r.keyless ? { state: 'keyless' } : { state: 'none', error: r.error };
+  };
+  for (const name of ['copilot', 'openai', 'anthropic']) out.providers[name] = route(name);
+  const who = out.mode === 'multi' ? person : 'local';
+  if (!who || (out.mode === 'multi' && who === 'local')) { out.signInNeeded = true; return out; }
+  try {
+    const mine = new Map(((await personSlots(who)).slots || []).map((x) => [x.id, x]));
+    for (const p of Object.values(out.providers)) {
+      if (!p.slot) continue;
+      const s = mine.get(p.slot);
+      p.state = s ? s.state : 'missing';
+      if (s && s.suffix) p.suffix = s.suffix;
+      if (s && s.label) p.label = s.label;
+    }
+  } catch (err) {
+    out.error = err.message;
+  }
+  return out;
+}
+
 /** Patch a provider from the UI/CLI; masked key echoes are dropped ("keep"). */
 export async function patchProvider(name, patch = {}) {
   if (!UPSTREAM_PROVIDERS.includes(name)) throw new Error(`unknown provider ${JSON.stringify(name)}`);

package/ui/public/app.js

@@ -773,7 +773,7 @@ function paintBudget() {
     topAmt.classList.toggle('over', !!b.blocked);
   }
   applyBudgetToNewView();
-  if (currentView() === 'settings') paintBudgetReadout();
+  if (currentView() === 'settings' && currentSettingsTab === 'runs') paintBudgetReadout();
   repaintCostBanners();
 }
 
@@ -1066,7 +1066,7 @@ function handleServerMessage(msg) {
     if (currentView() === 'projects') paintProjectPolicyCells(true);
     if (currentView() === 'workspaces') paintWsPolicyLines(true);
     if (currentView() === 'team-policy' && !tpState.editing) loadTeamPolicyView();
-    if (currentView() === 'settings') paintTeamCapsReadout(true);
+    if (currentView() === 'settings' && currentSettingsTab === 'runs') paintTeamCapsReadout(true);
     if (currentView() === 'settings' && currentSettingsTab === 'plugins') paintPluginsPolicy(true);
     if (currentView() === 'new') schedulePolicyLine();
     return;
@@ -10953,7 +10953,7 @@ try {
   if (mq && typeof mq.addEventListener === 'function') mq.addEventListener('change', () => applyTheme(document.documentElement.dataset.theme));
 } catch { /* no media queries here */ }
 
-// Settings › General › Scheduled runs: the defaults a new schedule inherits.
+// Settings › Runs › Scheduled runs: the defaults a new schedule inherits.
 function setSchedDefaultsMsg(text, kind) { setHintMsg('schedDefaultsMsg', text, kind); }
 function paintScheduleSettings(data) {
   const d = data && data.schedule;
@@ -12702,6 +12702,7 @@ async function loadModelsView() {
     const pdata = await safeJson(pres);
     mvState.providers = pres.ok ? pdata : null;
     renderModelsViewBody();
+    void paintHelperModelCards();
     // "+ Add model…" from a picker on another page: the dialog opens once the catalog is here.
     if (mvState.openEditorOnLoad) { mvState.openEditorOnLoad = false; openModelEditorDialog(); }
     // Copilot's models feed the editor's upstream-id datalist; fetched in the
@@ -12716,6 +12717,18 @@ async function loadModelsView() {
   }
 }
 
+// Settings › Models › Title generation + Auto workflow model: both pickers list the catalog, so they
+// repaint whenever it loads — a model added a moment ago is selectable without leaving the tab.
+async function paintHelperModelCards() {
+  try {
+    const res = await fetch('/api/settings');
+    if (!res.ok) return;
+    const data = await safeJson(res);
+    await paintTitleModelSettings(data);
+    await paintAutoModelSettings(data);
+  } catch { /* the cards keep their last paint */ }
+}
+
 /** The Providers tab: the same card, on a page of its own (§8.1). */
 async function loadProvidersView() {
   if (!el.providersList) return;
@@ -13886,7 +13899,7 @@ if (runListEl) {
       if (runId) confirmCostOverride(runId, overrideBtn);
       return;
     }
-    if (e.target.closest && e.target.closest('.cb-settings')) { location.hash = 'settings'; return; }
+    if (e.target.closest && e.target.closest('.cb-settings')) { location.hash = 'settings/runs'; return; }
     // Team-cap banner (team-policy design board 9): continue past, or open the page.
     const pastBtn = e.target.closest && e.target.closest('.cb-past-team-cap');
     if (pastBtn) {
@@ -14575,7 +14588,7 @@ if (tpSection) tpSection.addEventListener('click', async (e) => {
   await handlePolicyPluginClick(e);
 });
 
-// Settings › Budget (board 7): each home's caps as a readout, the tightest as a chip on the labels.
+// Settings › Runs › Budget (board 7): each home's caps as a readout, the tightest as a chip on the labels.
 async function paintTeamCapsReadout(force = false) {
   if (!el.teamCapsReadout) return;
   const data = await loadTpScopes({ force });
@@ -17377,7 +17390,7 @@ function paintHdBanners(screen, record, data) {
       { pauseReason, pauseDetail, pipelineId: record.id, totalCostUsd: st.totalCostUsd },
       { budget: budgetState.budget || {}, fmt: { usd: fmtUsd, usd4: fmtUsd4, duration: fmtDuration, estTitle } });
     const settingsBtn = banner.querySelector('.cb-settings');
-    if (settingsBtn) settingsBtn.addEventListener('click', () => { location.hash = 'settings'; });
+    if (settingsBtn) settingsBtn.addEventListener('click', () => { location.hash = 'settings/runs'; });
     const overrideBtn = banner.querySelector('.cb-override');
     if (overrideBtn) {
       overrideBtn.addEventListener('click', () => {
@@ -22537,7 +22550,7 @@ el.runDetail?.addEventListener('click', (e) => {
   if (!r) return;
   const override = e.target.closest && e.target.closest('.cb-override');
   if (override) { confirmCostOverride(r.runId, override); return; }   // async, fire-and-forget
-  if (e.target.closest && e.target.closest('.cb-settings')) { location.hash = 'settings'; return; }
+  if (e.target.closest && e.target.closest('.cb-settings')) { location.hash = 'settings/runs'; return; }
   const past = e.target.closest && e.target.closest('.cb-past-team-cap');
   if (past) { confirmPastTeamCap(r.runId, past); return; }             // team-policy board 9
   if (e.target.closest && e.target.closest('.cb-policy-open')) { location.hash = 'team-policy'; return; }
@@ -23654,11 +23667,11 @@ const VIEW_MIN_LEVEL = Object.freeze({
   'team-metrics': 'expert', 'team-policy': 'expert', agents: 'expert', scripts: 'expert',
   schedules: 'advanced',
 });
-const SETTINGS_TAB_MIN_LEVEL = Object.freeze({ guardrails: 'advanced', plugins: 'advanced', memory: 'advanced', models: 'expert', providers: 'expert' });
+const SETTINGS_TAB_MIN_LEVEL = Object.freeze({ ask: 'advanced', guardrails: 'advanced', plugins: 'advanced', memory: 'advanced', models: 'expert', providers: 'expert' });
 const VIEW_TITLES = Object.freeze({
   stats: 'Statistics', composer: 'Workflow Composer', workspaces: 'Workspaces', 'workspace-create': 'Workspaces',
   'agent-create': 'Create agent', 'team-metrics': 'Team metrics', 'team-policy': 'Team policy', agents: 'Agents', scripts: 'Scripts',
-  guardrails: 'Guardrails', plugins: 'Plugins', memory: 'Memory', models: 'Models', providers: 'Providers',
+  guardrails: 'Guardrails', plugins: 'Plugins', memory: 'Memory', models: 'Models', providers: 'Providers', ask: 'Ask Worca',
   schedules: 'Schedules',
 });
 function pageMinLevel() {
@@ -23715,7 +23728,10 @@ document.addEventListener('worca:level', () => {
 // The tab is the Settings view's hash param; a guardrail deep link nests its id
 // behind it (#settings/guardrails/<id>). parseHash splits on the FIRST '/' only,
 // so that is view 'settings', param 'guardrails/<id>' — no parseHash change.
-const SETTINGS_TABS = ['general', 'guardrails', 'models', 'providers', 'plugins', 'memory'];
+const SETTINGS_TABS = ['general', 'runs', 'ask', 'guardrails', 'memory', 'plugins', 'models', 'providers'];
+// The tabs whose cards GET /api/settings paints (loadSettings paints every card, wherever it sits).
+// Models is not one: loadModelsView repaints its two helper-model cards with the catalog.
+const SETTINGS_FORM_TABS = ['general', 'runs', 'ask'];
 const settingsPanes = $$('[data-view="settings"] .settings-pane');
 // Old top-level hashes keep working. The hashchange listener DROPS any view it
 // does not know, so without this map a bookmark or an old in-app link would
@@ -23965,7 +23981,7 @@ function showSettingsTab(param = '') {
   // request, and re-entry refetches (which is what lets grvExitWizard's
   // '#settings/guardrails/<id>' -> '#settings/guardrails' hop reset the wizard).
   paintLevelBanner();
-  if (tab === 'general') loadSettings();
+  if (SETTINGS_FORM_TABS.includes(tab)) loadSettings();
   if (tab === 'guardrails') loadGuardrailsView(sub);
   if (tab === 'models') loadModelsView(sub);
   if (tab === 'providers') loadProvidersView();

package/ui/public/bridge-view.mjs

@@ -106,11 +106,48 @@ export function needsSignInPill(m, { doc = globalThis.document } = {}) {
 // ── Providers card (§8.1) ────────────────────────────────────────────────────
 
 function providerStatePill(doc, c) {
-  if (!c.termsCurrent) return h(doc, 'span', 'badge grey', 'sign-in blocked until acknowledged');
+  if (!c.termsCurrent) {
+    // What unblocks sign-in, in the "Read notice" button's own words — and it opens that notice.
+    const pill = h(doc, 'button', 'badge grey mv-cp-terms mv-cp-terms-pill',
+      c.acknowledgedTerms ? 'please re-read the updated notice' : 'please read the notice first');
+    pill.type = 'button';
+    pill.title = 'Sign-in is blocked until you acknowledge the GitHub Copilot notice. Click to read it.';
+    return pill;
+  }
   if (!c.connected) return h(doc, 'span', 'badge grey', 'not connected');
   return h(doc, 'span', 'badge green', `connected${c.login ? ` as @${c.login}` : ''}`);
 }
 
+/**
+ * With the credential broker: the viewer's own state in the slot `name` spends from (key page),
+ * not worca's settings, which hold no key. A missing key links to the key page.
+ */
+function brokerPill(doc, b, name) {
+  const p = (b.providers || {})[name] || {};
+  const what = name === 'copilot' ? 'sign-in' : 'key';
+  if (b.signInNeeded) return h(doc, 'span', 'badge grey', `sign in to see your ${what}`);
+  if (p.state === 'none') {
+    const x = h(doc, 'span', 'badge red', 'no broker slot for this URL');
+    x.title = p.error || 'The credential broker has no slot for this base URL.';
+    return x;
+  }
+  if (p.state === 'keyless') return h(doc, 'span', 'badge green', 'local — no key needed');
+  if (b.error) {
+    const x = h(doc, 'span', 'badge grey', 'key page unreachable');
+    x.title = b.error;
+    return x;
+  }
+  if (p.state === 'set') return h(doc, 'span', 'badge green', `your ${what}${p.suffix ? ` ••••${p.suffix}` : ''}`);
+  if (p.state === 'operator') return h(doc, 'span', 'badge green', 'team key');
+  const label = p.state === 'invalid' ? `your ${what} was rejected` : `add your ${what} on the key page`;
+  const cls = p.state === 'invalid' ? 'badge red' : 'badge grey';
+  if (!b.keyPage) return h(doc, 'span', cls, label);
+  const a = h(doc, 'a', `${cls} mv-broker-pill`, label);
+  a.href = b.keyPage; a.target = '_blank'; a.rel = 'noopener';
+  a.title = 'Opens the key page in a new tab. Reopen this tab afterwards to see the change.';
+  return a;
+}
+
 function quotaLine(q) {
   if (!q) return '';
   if (q.unlimited) return 'Premium requests: unlimited on this plan';
@@ -181,7 +218,9 @@ export function renderProvidersCard(providers, { doc = globalThis.document, sign
   const cpMain = h(doc, 'div', 'mv-pv-main');
   const cpHead = h(doc, 'div', 'mv-head');
   cpHead.appendChild(h(doc, 'b', 'mv-name', 'GitHub Copilot'));
-  cpHead.appendChild(providerStatePill(doc, c));
+  const brokered = !!(p.broker && p.broker.enabled);
+  // The notice gates Copilot models either way; past it, the broker's view of your sign-in.
+  cpHead.appendChild(brokered && c.termsCurrent ? brokerPill(doc, p.broker, 'copilot') : providerStatePill(doc, c));
   cpMain.appendChild(cpHead);
   cpMain.appendChild(h(doc, 'small', 'hint',
     c.acknowledgedTerms
@@ -215,7 +254,6 @@ export function renderProvidersCard(providers, { doc = globalThis.document, sign
   const cpBtns = h(doc, 'div', 'mv-pv-btns');
   const imp = h(doc, 'button', 'btn-ghost mv-cp-fetch-models', 'Import models…');
   // With the broker, the import runs with the viewer's own Copilot sign-in (on the key page).
-  const brokered = !!(p.broker && p.broker.enabled);
   imp.type = 'button'; imp.disabled = !c.connected && !brokered;
   if (imp.disabled) imp.title = 'Sign in first';
   cpBtns.appendChild(imp);
@@ -245,7 +283,7 @@ export function renderProvidersCard(providers, { doc = globalThis.document, sign
     const main = h(doc, 'div', 'mv-pv-main');
     const rh = h(doc, 'div', 'mv-head');
     rh.appendChild(h(doc, 'b', 'mv-name', PROVIDER_LABELS[name]));
-    rh.appendChild(k.configured ? h(doc, 'span', 'badge green', 'key set')
+    rh.appendChild(p.broker && p.broker.enabled ? brokerPill(doc, p.broker, name) : k.configured ? h(doc, 'span', 'badge green', 'key set')
       : k.keySet ? h(doc, 'span', 'badge red', 'key ${VAR} not set')
         : k.keyOptional ? h(doc, 'span', 'badge green', 'local — no key needed') : h(doc, 'span', 'badge grey', 'no key'));
     main.appendChild(rh);

package/ui/public/index.html

@@ -1350,12 +1350,16 @@
              literal routing attribute name, so never spell it out in a comment. -->
         <section class="view hidden" data-view="settings">
           <div class="seg settings-tabs" id="settings-tabs" role="group" aria-label="Settings section">
+            <!-- Ordered by mode (Simple, Advanced, Expert) so each mode sees a gap-free prefix of the
+                 strip; Models sits next to Providers. -->
             <button type="button" class="on" data-tab="general" data-min-level="simple" aria-pressed="true">General</button>
+            <button type="button" data-tab="runs" data-min-level="simple" aria-pressed="false">Runs</button>
+            <button type="button" data-tab="ask" data-min-level="advanced" aria-pressed="false">Ask Worca</button>
             <button type="button" data-tab="guardrails" data-min-level="advanced" aria-pressed="false">Guardrails</button>
+            <button type="button" data-tab="memory" data-min-level="advanced" aria-pressed="false">Memory</button>
+            <button type="button" data-tab="plugins" data-min-level="advanced" aria-pressed="false">Plugins</button>
             <button type="button" data-tab="models" data-min-level="expert" aria-pressed="false">Models</button>
             <button type="button" data-tab="providers" data-min-level="expert" aria-pressed="false">Providers</button>
-            <button type="button" data-tab="plugins" data-min-level="advanced" aria-pressed="false">Plugins</button>
-            <button type="button" data-tab="memory" data-min-level="advanced" aria-pressed="false">Memory</button>
           </div>
 
           <section class="settings-pane" data-tab="general">
@@ -1452,6 +1456,97 @@
               <small class="hint" id="settingsMsg"></small>
             </section>
 
+            <!-- Spawn-debug diagnostics: the stored side of WORCA_DEBUG_SPAWN.
+                 claude-runner.mjs reads the setting per spawn (UI server AND CLI);
+                 a non-empty env var overrides it. This card only flips the gate —
+                 the runner decides what is printable (routing keys readable,
+                 credentials as "<set, N chars>"). -->
+            <section class="card settings-card" id="debug-spawn-settings-card" data-min-level="expert">
+              <div class="card-head">
+                <div class="label-row">
+                  <h2>Spawn diagnostics</h2>
+                  <button type="button" class="info-tip" aria-label="About spawn diagnostics">i<span class="tip-content hidden">
+                    Logs the exact claude binary, argv and routing env handed to every spawn, in the run
+                    log. Credentials never appear: routing keys (endpoint, wire model) print readable,
+                    every other value as <code>&lt;set, N chars&gt;</code>. Applies to runs started here
+                    and from the CLI, with no restart. A non-empty <code>WORCA_DEBUG_SPAWN</code> in the
+                    environment overrides this setting.
+                  </span></button>
+                </div>
+              </div>
+              <div class="field">
+                <label class="check-row" for="debugSpawnEnabled"><input id="debugSpawnEnabled" type="checkbox" /> Log claude spawn details (binary, argv, routing env)</label>
+              </div>
+              <small class="hint" id="debugSpawnEnvNote"></small>
+              <div class="add-project-actions" style="margin-top:14px">
+                <button type="button" id="debugSpawnReset" class="btn btn-ghost btn-mini">Reset to default</button>
+                <button type="button" id="debugSpawnSave" class="btn btn-primary btn-mini">Save</button>
+              </div>
+              <small class="hint" id="debugSpawnMsg"></small>
+            </section>
+
+            <!-- Getting started: the checklist's Hide is undone here. Only the checklist —
+                 the welcome dialog stays seen. No info-tip (the row explains itself);
+                 the .hint is painted by app.js like every other settings status line. -->
+            <section class="card settings-card" id="getting-started-card" data-min-level="simple">
+              <div class="label-row">
+                <h2>Getting started</h2>
+              </div>
+              <div class="gs-settings-row">
+                <p class="gs-settings-text">The checklist on New pipeline walks through the first nine things to do with Worca. Hidden it, or want the guided tour back?</p>
+                <button type="button" id="gsShowAgain" class="btn btn-ghost btn-mini">Show again</button>
+              </div>
+              <small class="hint" id="gsSettingsMsg"></small>
+            </section>
+
+            <!-- About: intentionally no info-tip and no .hint (test/ui-settings-tooltips.test.mjs pins both). -->
+            <section class="card settings-card" id="about-card" data-min-level="simple">
+              <div class="label-row">
+                <h2>About</h2>
+              </div>
+              <div class="about-row">
+                <span class="about-key">Version</span>
+                <!-- href is painted from app.releaseUrl (the worca-app-v<version> tag);
+                     without one the anchor is plain text, so the placeholder never links. -->
+                <a class="about-val about-version" id="aboutVersion"
+                   target="_blank" rel="noopener noreferrer">&mdash;</a>
+              </div>
+              <div class="about-row">
+                <span class="about-key">Repository</span>
+                <a class="about-val about-link" id="aboutRepoLink"
+                   href="https://github.com/SinishaDjukic/worca-cc"
+                   target="_blank" rel="noopener noreferrer">github.com/SinishaDjukic/worca-cc</a>
+              </div>
+              <div class="about-row">
+                <span class="about-key">Feedback</span>
+                <!-- hrefs are repainted from app.bugsUrl (package.json bugs.url); the
+                     static fallback keeps the links usable before /api/settings lands.
+                     Anchors only: ui-settings-about.test.mjs forbids a control here,
+                     and neither the label nor the href carries a version string. -->
+                <a class="about-val about-link" id="aboutBugLink"
+                   href="https://github.com/SinishaDjukic/worca-cc/issues/new?labels=bug"
+                   target="_blank" rel="noopener noreferrer">Report a bug</a>
+              </div>
+              <div class="about-row">
+                <span class="about-key"></span>
+                <a class="about-val about-link" id="aboutIdeaLink"
+                   href="https://github.com/SinishaDjukic/worca-cc/issues/new?labels=enhancement"
+                   target="_blank" rel="noopener noreferrer">Suggest an improvement</a>
+              </div>
+            </section>
+          </section>
+          <!-- /pane general -->
+
+          <!-- ===== TAB: RUNS — how pipeline runs are capped, scheduled and reported.
+               Simple, for Budget; the two Advanced cards keep their own level. ===== -->
+          <section class="settings-pane hidden" data-tab="runs">
+            <div class="topbar">
+              <div>
+                <h1>Runs</h1>
+                <div class="sub">Cost limits and defaults for your pipeline runs</div>
+              </div>
+            </div>
+
             <section class="card settings-card" id="budget-settings-card" data-min-level="simple">
               <div class="card-head">
                 <div class="label-row">
@@ -1510,63 +1605,6 @@
               <small class="hint" id="budgetMsg"></small>
             </section>
 
-            <!-- Ask Worca (ask-worca-design §6.9): per-turn guards for the
-                 assistant chat. Read fresh on every turn (D12); a stored null
-                 budget means "no cap". Posted ALONE — never with root/budget keys. -->
-            <section class="card settings-card" id="ask-settings-card" data-min-level="advanced">
-              <div class="card-head">
-                <div class="label-row">
-                  <h2>Ask Worca</h2>
-                  <button type="button" class="info-tip" aria-label="About Ask Worca limits">i<span class="tip-content hidden">
-                    Per-turn guards for the Ask Worca assistant chat. A chat turn stops when it reaches the turn limit or the per-turn cost cap; both are read fresh on every turn.
-                  </span></button>
-                </div>
-              </div>
-              <div class="field">
-                <div class="label-row">
-                  <label for="askMaxTurns">Turn limit</label>
-                  <button type="button" class="info-tip" aria-label="About Turn limit">i<span class="tip-content hidden">
-                    Maximum assistant/tool turns one chat message may use (1&ndash;500). Leave empty to restore the default of 400.
-                  </span></button>
-                </div>
-                <input id="askMaxTurns" class="input" type="number" min="1" max="500" step="1" inputmode="numeric" placeholder="400" autocomplete="off" />
-              </div>
-              <div class="field">
-                <div class="label-row">
-                  <label for="askMaxBudgetUsd">Per-turn cost cap (USD)</label>
-                  <button type="button" class="info-tip" aria-label="About Per-turn cost cap">i<span class="tip-content hidden">
-                    There is no cap by default. Untick No cap and enter an amount (0.1&ndash;100) to turn the guard on: a chat turn then stops when its estimated cost reaches it. Leaving the amount empty, or pressing Use defaults, means no cap.
-                  </span></button>
-                </div>
-                <input id="askMaxBudgetUsd" class="input" type="number" min="0.1" max="100" step="0.1" inputmode="decimal" placeholder="No cap" autocomplete="off" />
-                <label class="check-row" for="askNoCap"><input id="askNoCap" type="checkbox" /> No cap</label>
-              </div>
-              <!-- Scripts workbench W20: the chat's save_script / test_script switch. Body
-                   rendered by chat-settings-view.mjs; saved with this card's Save button. -->
-              <div class="field" id="ask-script-tools-host"></div>
-              <!-- Ask web access (off by default): rendered by chat-settings-view.mjs; saved with this
-                   card's Save button, and only when one of its fields was touched. -->
-              <div class="field" id="ask-web-host"></div>
-              <div class="add-project-actions" style="margin-top:14px">
-                <button type="button" id="askLimitsReset" class="btn btn-ghost btn-mini">Use defaults</button>
-                <button type="button" id="askLimitsSave" class="btn btn-primary btn-mini">Save</button>
-              </div>
-              <small class="hint" id="askLimitsMsg"></small>
-              <!-- Chat history: the counts paint with the view; the button opens a
-                   danger confirm quoting FRESH counts, then DELETE /api/ask/threads. -->
-              <div class="field" style="margin-top:14px">
-                <div class="label-row">
-                  <label for="askHistoryDelete">Chat history</label>
-                  <button type="button" class="info-tip" aria-label="About Chat history">i<span class="tip-content hidden">
-                    Every saved Ask Worca chat: transcripts, attachments and the git worktrees checked out for them. Runs started from a chat are not affected.
-                  </span></button>
-                </div>
-                <button type="button" id="askHistoryDelete" class="ask-history-delete" disabled>Delete all chat history</button>
-                <small class="hint" id="askHistoryCounts"></small>
-                <small class="hint" id="askHistoryMsg"></small>
-              </div>
-            </section>
-
             <!-- Scheduled runs: the defaults a NEW schedule inherits. Each schedule keeps
                  its own copy, so a change here never rewrites an existing one. -->
             <section class="card settings-card" id="schedule-settings-card" data-min-level="advanced">
@@ -1618,95 +1656,6 @@
               <small class="hint" id="schedDefaultsMsg"></small>
             </section>
 
-            <!-- Title generation (#422): which model writes run/chat titles.
-                 Empty = the model of the run or chat itself (title.mjs
-                 resolveTitleModel), so a first-party-free install needs no setup.
-                 The select is built from the project-less catalog; a stored id
-                 that left the catalog paints disabled + "not installed". -->
-            <section class="card settings-card" id="title-model-settings-card" data-min-level="expert">
-              <div class="card-head">
-                <div class="label-row">
-                  <h2>Title generation</h2>
-                  <button type="button" class="info-tip" aria-label="About title generation">i<span class="tip-content hidden">
-                    Every run and chat gets a short LLM-written title. By default it is written by the
-                    model the run or chat itself uses, so an install without a first-party Anthropic
-                    account needs no setup here. Pick a model to write every title with it instead;
-                    the change applies to the next title, no restart. A non-empty
-                    <code>WORCA_TITLE_MODEL</code> in the environment overrides this setting.
-                  </span></button>
-                </div>
-              </div>
-              <div class="field">
-                <div class="label-row">
-                  <label for="titleModel">Model</label>
-                </div>
-                <select id="titleModel" class="select" aria-label="Title model"></select>
-              </div>
-              <small class="hint" id="titleModelEnvNote"></small>
-              <div class="add-project-actions" style="margin-top:14px">
-                <button type="button" id="titleModelTest" class="btn btn-ghost btn-mini" title="Send one tiny prompt to the selected model">Test</button>
-                <button type="button" id="titleModelReset" class="btn btn-ghost btn-mini">Use default</button>
-                <button type="button" id="titleModelSave" class="btn btn-primary btn-mini">Save</button>
-              </div>
-              <small class="hint" id="titleModelMsg"></small>
-            </section>
-
-            <!-- Auto workflow model (spec D14 / §7.7): which model classifies a task into a workflow.
-                 Empty = the Sonnet-class default; WORCA_AUTO_MODEL in the environment wins. -->
-            <section class="card settings-card" id="auto-model-settings-card" data-min-level="expert">
-              <div class="card-head">
-                <div class="label-row">
-                  <h2>Auto workflow model</h2>
-                  <button type="button" class="info-tip" aria-label="About the Auto workflow model">i<span class="tip-content hidden">
-                    When a run starts on <b>Auto</b>, one short model call reads the task and picks the workflow.
-                    Pick the model that makes that call; empty means the Sonnet-class default. A non-empty
-                    <code>WORCA_AUTO_MODEL</code> in the environment overrides this setting. Each call is billed to the
-                    run as a sub-agent row named "Auto workflow (round n)".
-                  </span></button>
-                </div>
-              </div>
-              <div class="field">
-                <div class="label-row"><label for="autoModel">Model</label></div>
-                <select id="autoModel" class="select" aria-label="Auto workflow model"></select>
-              </div>
-              <small class="hint" id="autoModelEnvNote"></small>
-              <div class="add-project-actions" style="margin-top:14px">
-                <button type="button" id="autoModelTest" class="btn btn-ghost btn-mini" title="Send one tiny prompt to the selected model">Test</button>
-                <button type="button" id="autoModelReset" class="btn btn-ghost btn-mini">Use default</button>
-                <button type="button" id="autoModelSave" class="btn btn-primary btn-mini">Save</button>
-              </div>
-              <small class="hint" id="autoModelMsg"></small>
-            </section>
-
-            <!-- Spawn-debug diagnostics: the stored side of WORCA_DEBUG_SPAWN.
-                 claude-runner.mjs reads the setting per spawn (UI server AND CLI);
-                 a non-empty env var overrides it. This card only flips the gate —
-                 the runner decides what is printable (routing keys readable,
-                 credentials as "<set, N chars>"). -->
-            <section class="card settings-card" id="debug-spawn-settings-card" data-min-level="expert">
-              <div class="card-head">
-                <div class="label-row">
-                  <h2>Spawn diagnostics</h2>
-                  <button type="button" class="info-tip" aria-label="About spawn diagnostics">i<span class="tip-content hidden">
-                    Logs the exact claude binary, argv and routing env handed to every spawn, in the run
-                    log. Credentials never appear: routing keys (endpoint, wire model) print readable,
-                    every other value as <code>&lt;set, N chars&gt;</code>. Applies to runs started here
-                    and from the CLI, with no restart. A non-empty <code>WORCA_DEBUG_SPAWN</code> in the
-                    environment overrides this setting.
-                  </span></button>
-                </div>
-              </div>
-              <div class="field">
-                <label class="check-row" for="debugSpawnEnabled"><input id="debugSpawnEnabled" type="checkbox" /> Log claude spawn details (binary, argv, routing env)</label>
-              </div>
-              <small class="hint" id="debugSpawnEnvNote"></small>
-              <div class="add-project-actions" style="margin-top:14px">
-                <button type="button" id="debugSpawnReset" class="btn btn-ghost btn-mini">Reset to default</button>
-                <button type="button" id="debugSpawnSave" class="btn btn-primary btn-mini">Save</button>
-              </div>
-              <small class="hint" id="debugSpawnMsg"></small>
-            </section>
-
             <!-- Chat notifications (chat-connectivity-design.md §4.8): which run
                  events ping which chat channels. Body rendered by
                  chat-settings-view.mjs; app.js owns fetch/save/Test wiring. -->
@@ -1720,58 +1669,78 @@
               </div>
               <small class="hint" id="chatSettingsMsg"></small>
             </section>
+          </section>
+          <!-- /pane runs -->
 
-            <!-- Getting started: the checklist's Hide is undone here. Only the checklist —
-                 the welcome dialog stays seen. No info-tip (the row explains itself);
-                 the .hint is painted by app.js like every other settings status line. -->
-            <section class="card settings-card" id="getting-started-card" data-min-level="simple">
-              <div class="label-row">
-                <h2>Getting started</h2>
-              </div>
-              <div class="gs-settings-row">
-                <p class="gs-settings-text">The checklist on New pipeline walks through the first nine things to do with Worca. Hidden it, or want the guided tour back?</p>
-                <button type="button" id="gsShowAgain" class="btn btn-ghost btn-mini">Show again</button>
+          <!-- ===== TAB: ASK WORCA — the assistant chat's limits, tools, web access and history ===== -->
+          <section class="settings-pane hidden" data-tab="ask">
+            <div class="topbar">
+              <div>
+                <h1>Ask Worca</h1>
+                <div class="sub">The assistant chat: how far one turn may go, which tools and websites it may use, and its saved history</div>
               </div>
-              <small class="hint" id="gsSettingsMsg"></small>
-            </section>
+            </div>
 
-            <!-- About: intentionally no info-tip and no .hint (test/ui-settings-tooltips.test.mjs pins both). -->
-            <section class="card settings-card" id="about-card" data-min-level="simple">
-              <div class="label-row">
-                <h2>About</h2>
+            <!-- Ask Worca (ask-worca-design §6.9): per-turn guards for the
+                 assistant chat. Read fresh on every turn (D12); a stored null
+                 budget means "no cap". Posted ALONE — never with root/budget keys. -->
+            <!-- Simple on purpose: the Ask Worca tab (Advanced) already gates it, and a deep link at a lower mode
+                 must still show the card under the level banner (docs/ui-levels.md rule 3). -->
+            <section class="card settings-card" id="ask-settings-card" data-min-level="simple">
+              <div class="card-head">
+                <div class="label-row">
+                  <h2>Limits &amp; access</h2>
+                  <button type="button" class="info-tip" aria-label="About Ask Worca limits">i<span class="tip-content hidden">
+                    Per-turn guards for the Ask Worca assistant chat. A chat turn stops when it reaches the turn limit or the per-turn cost cap; both are read fresh on every turn.
+                  </span></button>
+                </div>
               </div>
-              <div class="about-row">
-                <span class="about-key">Version</span>
-                <!-- href is painted from app.releaseUrl (the worca-app-v<version> tag);
-                     without one the anchor is plain text, so the placeholder never links. -->
-                <a class="about-val about-version" id="aboutVersion"
-                   target="_blank" rel="noopener noreferrer">&mdash;</a>
+              <div class="field">
+                <div class="label-row">
+                  <label for="askMaxTurns">Turn limit</label>
+                  <button type="button" class="info-tip" aria-label="About Turn limit">i<span class="tip-content hidden">
+                    Maximum assistant/tool turns one chat message may use (1&ndash;500). Leave empty to restore the default of 400.
+                  </span></button>
+                </div>
+                <input id="askMaxTurns" class="input" type="number" min="1" max="500" step="1" inputmode="numeric" placeholder="400" autocomplete="off" />
               </div>
-              <div class="about-row">
-                <span class="about-key">Repository</span>
-                <a class="about-val about-link" id="aboutRepoLink"
-                   href="https://github.com/SinishaDjukic/worca-cc"
-                   target="_blank" rel="noopener noreferrer">github.com/SinishaDjukic/worca-cc</a>
+              <div class="field">
+                <div class="label-row">
+                  <label for="askMaxBudgetUsd">Per-turn cost cap (USD)</label>
+                  <button type="button" class="info-tip" aria-label="About Per-turn cost cap">i<span class="tip-content hidden">
+                    There is no cap by default. Untick No cap and enter an amount (0.1&ndash;100) to turn the guard on: a chat turn then stops when its estimated cost reaches it. Leaving the amount empty, or pressing Use defaults, means no cap.
+                  </span></button>
+                </div>
+                <input id="askMaxBudgetUsd" class="input" type="number" min="0.1" max="100" step="0.1" inputmode="decimal" placeholder="No cap" autocomplete="off" />
+                <label class="check-row" for="askNoCap"><input id="askNoCap" type="checkbox" /> No cap</label>
               </div>
-              <div class="about-row">
-                <span class="about-key">Feedback</span>
-                <!-- hrefs are repainted from app.bugsUrl (package.json bugs.url); the
-                     static fallback keeps the links usable before /api/settings lands.
-                     Anchors only: ui-settings-about.test.mjs forbids a control here,
-                     and neither the label nor the href carries a version string. -->
-                <a class="about-val about-link" id="aboutBugLink"
-                   href="https://github.com/SinishaDjukic/worca-cc/issues/new?labels=bug"
-                   target="_blank" rel="noopener noreferrer">Report a bug</a>
+              <!-- Scripts workbench W20: the chat's save_script / test_script switch. Body
+                   rendered by chat-settings-view.mjs; saved with this card's Save button. -->
+              <div class="field" id="ask-script-tools-host"></div>
+              <!-- Ask web access (off by default): rendered by chat-settings-view.mjs; saved with this
+                   card's Save button, and only when one of its fields was touched. -->
+              <div class="field" id="ask-web-host"></div>
+              <div class="add-project-actions" style="margin-top:14px">
+                <button type="button" id="askLimitsReset" class="btn btn-ghost btn-mini">Use defaults</button>
+                <button type="button" id="askLimitsSave" class="btn btn-primary btn-mini">Save</button>
               </div>
-              <div class="about-row">
-                <span class="about-key"></span>
-                <a class="about-val about-link" id="aboutIdeaLink"
-                   href="https://github.com/SinishaDjukic/worca-cc/issues/new?labels=enhancement"
-                   target="_blank" rel="noopener noreferrer">Suggest an improvement</a>
+              <small class="hint" id="askLimitsMsg"></small>
+              <!-- Chat history: the counts paint with the view; the button opens a
+                   danger confirm quoting FRESH counts, then DELETE /api/ask/threads. -->
+              <div class="field" style="margin-top:14px">
+                <div class="label-row">
+                  <label for="askHistoryDelete">Chat history</label>
+                  <button type="button" class="info-tip" aria-label="About Chat history">i<span class="tip-content hidden">
+                    Every saved Ask Worca chat: transcripts, attachments and the git worktrees checked out for them. Runs started from a chat are not affected.
+                  </span></button>
+                </div>
+                <button type="button" id="askHistoryDelete" class="ask-history-delete" disabled>Delete all chat history</button>
+                <small class="hint" id="askHistoryCounts"></small>
+                <small class="hint" id="askHistoryMsg"></small>
               </div>
             </section>
           </section>
-          <!-- /pane general -->
+          <!-- /pane ask -->
 
           <!-- ===== TAB: GUARDRAILS (was the top-level Guardrails view) ===== -->
           <section class="settings-pane hidden" data-tab="guardrails">
@@ -1790,41 +1759,42 @@
           </section>
           <!-- /pane guardrails -->
 
-          <!-- ===== TAB: MODELS (was the top-level Models view) ===== -->
-          <section class="settings-pane hidden" data-tab="models">
+          <!-- ===== TAB: MEMORY (agent-memory-design.md §10) ===== -->
+          <section class="settings-pane hidden" data-tab="memory">
             <div class="topbar">
               <div>
-                <h1>Models</h1>
-                <div class="sub">The global model catalog — available in every project; entries can override built-ins, route through a provider, or carry per-model routing env. Sign-ins and endpoints live on the Providers tab.</div>
-              </div>
-              <div style="display:flex;gap:8px;flex:0 0 auto">
-                <button type="button" id="model-share-btn" class="btn-ghost" style="padding:11px 20px;white-space:nowrap">Share as plugin…</button>
-                <button type="button" id="model-import-btn" class="btn-ghost" style="padding:11px 20px;white-space:nowrap">Import models…</button>
-                <button type="button" id="model-create-btn" class="btn-go" style="padding:11px 20px;white-space:nowrap">
-                  <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round"><path d="M12 5v14M5 12h14"></path></svg>
-                  Add model
-                </button>
+                <h1>Memory</h1>
+                <div class="sub">What worca remembers across runs and chats — the global rules and preferences every agent sees. A project's own memory lives on its project page (Projects → open a project → Memory).</div>
               </div>
             </div>
-            <p id="models-msg" class="form-msg" aria-live="polite"></p>
-            <div class="run-list" id="models-list"></div>
-          </section>
-          <!-- /pane models -->
-
-          <!-- ===== TAB: PROVIDERS (model-bridge-design.md §8.1) =====
-               Split out of Models: the card is account-level setup you touch rarely, and at
-               1000+px it buried the catalog it unlocks. Expert only, like Models. -->
-          <section class="settings-pane hidden" data-tab="providers">
-            <div class="topbar">
-              <div>
-                <h1>Providers</h1>
-                <div class="sub">Sign-ins, endpoints and keys for the models Worca bridges — GitHub Copilot, any OpenAI-compatible server (llama.cpp, Ollama, LM Studio, vLLM), an Anthropic-compatible gateway. The models themselves live on the Models tab.</div>
+            <!-- Settings › Memory: the model + effort EVERY Memory defragment run uses (memory-defrag-model.mjs).
+                 Expert, like the health card's Defragment. No ⓘ and empty hints: the settings-view census
+                 (test/ui-settings-tooltips.test.mjs) pins both. A plain .card like the health card, NOT a
+                 .settings-card: that census (About last) counts the Settings cards. -->
+            <section class="card mem-model-card" id="mem-defrag-model-card" data-min-level="expert">
+              <div class="label-row"><h2>Defragment model</h2></div>
+              <p class="mem-model-text">The model every Memory defragment run uses — from the Defragment button, New pipeline, an Ask Worca card or the CLI. A model named when the run starts (<code>worca --model</code>) still wins.</p>
+              <div class="mem-model-row">
+                <div class="field">
+                  <div class="label-row"><label for="memDefragModel">Model</label></div>
+                  <select id="memDefragModel" class="select" aria-label="Defragment model"></select>
+                </div>
+                <div class="field">
+                  <div class="label-row"><label for="memDefragEffort">Effort</label></div>
+                  <select id="memDefragEffort" class="select" aria-label="Defragment effort"></select>
+                </div>
               </div>
-            </div>
-            <p id="providers-msg" class="form-msg" aria-live="polite"></p>
-            <div class="run-list" id="providers-list"></div>
+              <small class="hint" id="memDefragModelNote"></small>
+              <div class="add-project-actions" style="margin-top:14px">
+                <button type="button" id="memDefragModelReset" class="btn btn-ghost btn-mini">Use default</button>
+                <button type="button" id="memDefragModelSave" class="btn btn-primary btn-mini">Save</button>
+              </div>
+              <small class="hint" id="memDefragModelMsg"></small>
+            </section>
+            <p id="memory-msg" class="form-msg" aria-live="polite"></p>
+            <div id="memory-host" class="mem-host"></div>
           </section>
-          <!-- /pane providers -->
+          <!-- /pane memory -->
 
           <!-- ===== TAB: PLUGINS (was the top-level Plugins view) ===== -->
           <section class="settings-pane hidden" data-tab="plugins">
@@ -1856,42 +1826,104 @@
           </section>
           <!-- /pane plugins -->
 
-          <!-- ===== TAB: MEMORY (agent-memory-design.md §10) ===== -->
-          <section class="settings-pane hidden" data-tab="memory">
+          <!-- ===== TAB: MODELS (was the top-level Models view) ===== -->
+          <section class="settings-pane hidden" data-tab="models">
             <div class="topbar">
               <div>
-                <h1>Memory</h1>
-                <div class="sub">What worca remembers across runs and chats — the global rules and preferences every agent sees. A project's own memory lives on its project page (Projects → open a project → Memory).</div>
+                <h1>Models</h1>
+                <div class="sub">The global model catalog — available in every project; entries can override built-ins, route through a provider, or carry per-model routing env. The two cards on top pick the models Worca's own titles and Auto classifier use. Sign-ins and endpoints live on the Providers tab.</div>
+              </div>
+              <div style="display:flex;gap:8px;flex:0 0 auto">
+                <button type="button" id="model-share-btn" class="btn-ghost" style="padding:11px 20px;white-space:nowrap">Share as plugin…</button>
+                <button type="button" id="model-import-btn" class="btn-ghost" style="padding:11px 20px;white-space:nowrap">Import models…</button>
+                <button type="button" id="model-create-btn" class="btn-go" style="padding:11px 20px;white-space:nowrap">
+                  <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round"><path d="M12 5v14M5 12h14"></path></svg>
+                  Add model
+                </button>
               </div>
             </div>
-            <!-- Settings › Memory: the model + effort EVERY Memory defragment run uses (memory-defrag-model.mjs).
-                 Expert, like the health card's Defragment. No ⓘ and empty hints: the settings-view census
-                 (test/ui-settings-tooltips.test.mjs) pins both. A plain .card like the health card, NOT a
-                 .settings-card: that census (About last, twelve cards) counts the General tab's cards. -->
-            <section class="card mem-model-card" id="mem-defrag-model-card" data-min-level="expert">
-              <div class="label-row"><h2>Defragment model</h2></div>
-              <p class="mem-model-text">The model every Memory defragment run uses — from the Defragment button, New pipeline, an Ask Worca card or the CLI. A model named when the run starts (<code>worca --model</code>) still wins.</p>
-              <div class="mem-model-row">
+            <!-- The models Worca's own helper calls use (titles, the Auto classifier). Two columns on a
+                 wide screen so the catalog below is not pushed a screen down. -->
+            <div class="models-helpers" data-min-level="expert">
+              <!-- Title generation (#422): which model writes run/chat titles.
+                   Empty = the model of the run or chat itself (title.mjs
+                   resolveTitleModel), so a first-party-free install needs no setup.
+                   The select is built from the project-less catalog; a stored id
+                   that left the catalog paints disabled + "not installed". -->
+              <section class="card settings-card" id="title-model-settings-card" data-min-level="expert">
+                <div class="card-head">
+                  <div class="label-row">
+                    <h2>Title generation</h2>
+                    <button type="button" class="info-tip" aria-label="About title generation">i<span class="tip-content hidden">
+                      Every run and chat gets a short LLM-written title. By default it is written by the
+                      model the run or chat itself uses, so an install without a first-party Anthropic
+                      account needs no setup here. Pick a model to write every title with it instead;
+                      the change applies to the next title, no restart. A non-empty
+                      <code>WORCA_TITLE_MODEL</code> in the environment overrides this setting.
+                    </span></button>
+                  </div>
+                </div>
                 <div class="field">
-                  <div class="label-row"><label for="memDefragModel">Model</label></div>
-                  <select id="memDefragModel" class="select" aria-label="Defragment model"></select>
+                  <div class="label-row">
+                    <label for="titleModel">Model</label>
+                  </div>
+                  <select id="titleModel" class="select" aria-label="Title model"></select>
+                </div>
+                <small class="hint" id="titleModelEnvNote"></small>
+                <div class="add-project-actions" style="margin-top:14px">
+                  <button type="button" id="titleModelTest" class="btn btn-ghost btn-mini" title="Send one tiny prompt to the selected model">Test</button>
+                  <button type="button" id="titleModelReset" class="btn btn-ghost btn-mini">Use default</button>
+                  <button type="button" id="titleModelSave" class="btn btn-primary btn-mini">Save</button>
+                </div>
+                <small class="hint" id="titleModelMsg"></small>
+              </section>
+
+              <!-- Auto workflow model (spec D14 / §7.7): which model classifies a task into a workflow.
+                   Empty = the Sonnet-class default; WORCA_AUTO_MODEL in the environment wins. -->
+              <section class="card settings-card" id="auto-model-settings-card" data-min-level="expert">
+                <div class="card-head">
+                  <div class="label-row">
+                    <h2>Auto workflow model</h2>
+                    <button type="button" class="info-tip" aria-label="About the Auto workflow model">i<span class="tip-content hidden">
+                      When a run starts on <b>Auto</b>, one short model call reads the task and picks the workflow.
+                      Pick the model that makes that call; empty means the Sonnet-class default. A non-empty
+                      <code>WORCA_AUTO_MODEL</code> in the environment overrides this setting. Each call is billed to the
+                      run as a sub-agent row named "Auto workflow (round n)".
+                    </span></button>
+                  </div>
                 </div>
                 <div class="field">
-                  <div class="label-row"><label for="memDefragEffort">Effort</label></div>
-                  <select id="memDefragEffort" class="select" aria-label="Defragment effort"></select>
+                  <div class="label-row"><label for="autoModel">Model</label></div>
+                  <select id="autoModel" class="select" aria-label="Auto workflow model"></select>
                 </div>
+                <small class="hint" id="autoModelEnvNote"></small>
+                <div class="add-project-actions" style="margin-top:14px">
+                  <button type="button" id="autoModelTest" class="btn btn-ghost btn-mini" title="Send one tiny prompt to the selected model">Test</button>
+                  <button type="button" id="autoModelReset" class="btn btn-ghost btn-mini">Use default</button>
+                  <button type="button" id="autoModelSave" class="btn btn-primary btn-mini">Save</button>
+                </div>
+                <small class="hint" id="autoModelMsg"></small>
+              </section>
+            </div>
+            <p id="models-msg" class="form-msg" aria-live="polite"></p>
+            <div class="run-list" id="models-list"></div>
+          </section>
+          <!-- /pane models -->
+
+          <!-- ===== TAB: PROVIDERS (model-bridge-design.md §8.1) =====
+               Split out of Models: the card is account-level setup you touch rarely, and at
+               1000+px it buried the catalog it unlocks. Expert only, like Models. -->
+          <section class="settings-pane hidden" data-tab="providers">
+            <div class="topbar">
+              <div>
+                <h1>Providers</h1>
+                <div class="sub">Sign-ins, endpoints and keys for the models Worca bridges — GitHub Copilot, any OpenAI-compatible server (llama.cpp, Ollama, LM Studio, vLLM), an Anthropic-compatible gateway. The models themselves live on the Models tab.</div>
               </div>
-              <small class="hint" id="memDefragModelNote"></small>
-              <div class="add-project-actions" style="margin-top:14px">
-                <button type="button" id="memDefragModelReset" class="btn btn-ghost btn-mini">Use default</button>
-                <button type="button" id="memDefragModelSave" class="btn btn-primary btn-mini">Save</button>
-              </div>
-              <small class="hint" id="memDefragModelMsg"></small>
-            </section>
-            <p id="memory-msg" class="form-msg" aria-live="polite"></p>
-            <div id="memory-host" class="mem-host"></div>
+            </div>
+            <p id="providers-msg" class="form-msg" aria-live="polite"></p>
+            <div class="run-list" id="providers-list"></div>
           </section>
-          <!-- /pane memory -->
+          <!-- /pane providers -->
         </section>
         <!-- /view settings -->
       </main>

package/ui/public/style.css

@@ -2357,6 +2357,13 @@ section[data-view="team-metrics"] .topbar{align-items:flex-start;}
 /* Actor and Started never wrap: with the Saved column in, Title (ellipsis) and Workflow give way first. */
 .tm-run-tbl td:nth-last-child(-n+2){white-space:nowrap;}
 .badge.grey{background:var(--field);color:var(--ink-2);}
+/* The Copilot card's "read the notice first" pill is a button: it opens the notice (bridge-view.mjs). */
+.mv-cp-terms-pill{border:0;font-family:inherit;cursor:pointer;}
+.mv-cp-terms-pill:hover{background:var(--line);color:var(--ink);}
+.mv-cp-terms-pill:focus-visible{outline:2px solid var(--ink);outline-offset:2px;}
+/* With the credential broker, a provider pill for a missing key links to the key page. */
+.mv-broker-pill{text-decoration:none;cursor:pointer;}
+.mv-broker-pill:hover{text-decoration:underline;}
 .tm-empty{display:grid;grid-template-columns:1fr 1fr;gap:14px;} .tm-empty .card{padding:22px;}
 .tm-step{font-size:11px;letter-spacing:.08em;font-weight:700;color:var(--ink-2);}
 .tm-empty-foot{display:block;margin-top:14px;}
@@ -2622,6 +2629,10 @@ button.tl-tile[aria-pressed="true"]{border-color:var(--ink);}
 .settings-card{max-width:760px;padding:22px;margin-left:auto;margin-right:auto;}
 .settings-card + .settings-card{margin-top:18px;}
 .settings-card[hidden]{display:none;}
+/* Settings › Models: Title generation + Auto workflow model side by side above the catalog, so two
+   short cards do not push it a screen down; one column once they would squeeze. */
+.models-helpers{display:grid;grid-template-columns:repeat(auto-fit,minmax(340px,1fr));gap:18px;margin-bottom:18px;}
+.models-helpers > .settings-card{max-width:none;margin:0;}
 
 /* My model credentials (credential broker): one row per slot, a state chip on the right. */
 .cred-list{list-style:none;margin:0;padding:0;display:grid;gap:8px;}
@@ -5537,10 +5548,6 @@ a.ask-card-task-title:hover{text-decoration-color:currentColor;}
 :root[data-level="expert"] [data-max-level="simple"],
 :root[data-level="expert"] [data-max-level="advanced"]{display:none !important;}
 
-/* Simple shows General only: a one-button segmented control is noise, so the bar goes — unless a
-   deep link parked us on a higher tab, whose button is then kept (paintLevelBanner). */
-:root[data-level="simple"] #settings-tabs:not(:has([data-level-keep])){display:none !important;}
-
 /* The icon: a stack of layers, unlit ones ghosted. currentColor, so hover, the
    dark active fill and both themes come for free. */
 /* An <i>, not a <span>: the collapsed rail visually hides every direct span child of a nav button