amicus 4.8.0 → 4.8.1

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.8.0",
+  "version": "4.8.1",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "author": {
     "name": "Christian Wagner"

package/CHANGELOG.md

@@ -3,6 +3,112 @@
 All notable changes to Amicus are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow semver.
 
+## [4.8.1] - 2026-08-25
+
+### Fixed
+
+- **Setup Step 2 offered one card per curated model *family*, with no way to choose which model
+  within it — issue #138.** `pickCurrent` kept exactly one winner per namespace, so a family with
+  several live models collapsed to a single card, and the route pill it wrote stored a **provider**
+  id, never a **model** id, so nothing downstream could tell them apart either. The family regex
+  made this worse for one vendor outright: `/^deepseek-v[\d.]+(-pro)?$/` only matches a
+  version-numbered `-v` name with an optional `-pro` suffix, so `deepseek-r1`, `deepseek-chat`, and
+  `deepseek-flash` never had a route to *any* card — structurally excluded, not just hidden behind
+  the flagship. Both wizard surfaces — the Electron Settings window and the readline setup flow —
+  now offer a vendor-scoped drill-down after the family pick, built on the existing priced picker
+  via a new pure module, `model-shortlist.js`, which splits a vendor's rows into suggested/rest so
+  the UI can show a handful of recommended models plus an "all" escape hatch. Persistence is
+  unchanged: `config.aliases[<family>]` still holds a route-encoded id and `config.default` still
+  holds the alias *name* — only the picker got smarter, not the storage shape. Two review rounds on
+  this branch closed five further blockers before it shipped: a silent setup-fallback path, a
+  misleading model-count label, a false alias-deletion report, a same-run double-ask of the same
+  vendor's drill-down, and an unescaped catalog id.
+
+- **`chooseRowId` fabricated bare `<vendor>/<model>` ids for catalog rows that exist only on
+  OpenRouter — issue #195.** Once the user held that vendor's own API key, the fabricated id routed
+  `direct`-first and `catalogGate` rejected it as `model_not_found`. Measured against the live
+  catalog: 19 of 69 `google` rows and 51 of 175 `openai` rows. The picker unconditionally stripped
+  the `openrouter/` prefix off any non-`DIVERGENT_VENDORS` OR-only row, regardless of whether the
+  direct namespace actually carried that model. It now reuses `classifyModel` — never a
+  reimplementation of its rule — and synthesizes the bare form only when that id would *not*
+  classify `invalid` on `direct`; `deepseek`'s empty-namespace rows (14/14) still synthesize bare,
+  unchanged. The identical unconditional strip existed in two more places that would otherwise have
+  silently undone the fix at write time — `canonicalizeResolved` (preselection matching) and
+  `applyProviderDefault` (the actual persist-to-config path, reached from both the Electron IPC
+  handler and the readline flow) — both now carry the same guard. Persistence was hardened further
+  in review: a failed or empty catalog fetch at persist time used to degrade straight back to the
+  old unconditional strip (confirmed against the real 601-row catalog), so `applyProviderDefault`
+  now requires *positive* catalog evidence (`classifyModel` returning `valid`, not merely
+  non-`invalid`) before it will strip a prefix — an empty catalog is inert, never a silent fallback.
+  ⚠️ **`doctor --fix` can now rewrite your config, not just diagnose it.** A new narrow repair,
+  `findFabricatedAliasRepairs`, finds aliases already persisted by v4.8.0 as a fabricated bare id —
+  one that classifies `invalid` on `direct` and has an unambiguous OpenRouter twin via
+  `pairAcrossGateways` — and rewrites them to the id the fixed picker would offer today. It is
+  gated on a **fresh** catalog fetch (declines with an explanatory hint if the same doctor run's own
+  `catalog` check reports the cache as stale, rather than repairing from data it has already told
+  you not to trust), idempotent, converts only to the one id `pairAcrossGateways` names, and every
+  repair is announced through the existing doctor-fix `heal` degrade channel, naming the alias and
+  both the old and new id. Outside that one class — a typo, a retired model, a user-invented id, or
+  a `DIVERGENT_VENDORS` alias — `doctor --fix` leaves the config alone exactly as before.
+
+### CI
+
+- **Council review on this repo ran with whatever alias each seat's name happened to resolve to on
+  a bare runner, not the intended bench — #193.** A CI runner has no user config, so
+  `getEffectiveAliases()` returned exactly `DEFAULT_ALIASES` and every seat bound to the shipped
+  `curated-models.js` pin: `glm` reviewed at 5.1 while 5.2 and 5.3 had already shipped, and an alias
+  missing from that table was silently dropped by `classifyCouncilMembers` with only a `run.json`
+  note to show for it. It was invisible by construction — `run.json`, `events.jsonl`, and
+  `verdict.json` all record alias *names*, so they read identically whichever model actually
+  answered; `spend-ledger.jsonl`, written to `getConfigDir()`, is the only artifact that carries a
+  resolved id. `council-review.yml` now provisions `.github/amicus-ci-aliases.json` from the
+  **base** ref (a PR can never edit the map used to review it), validates it by shape, pre-flights
+  every seat before any spend, and uploads the ledger as the receipt; every fetch failure but a 404
+  now fails closed instead of silently swapping the bench. A companion job, `alias-pin-drift.yml`,
+  compares each curated pin against its newest same-vendor sibling on the same tier/variant and
+  opens a weekly bump issue — `models --check` alone is structurally blind to this, since it
+  validates a curated *family* against its own `idPattern`, not a flat cardless pin like
+  `glm`/`qwen`/`kimi`.
+- **The council briefing now includes the `env:` blocks a diff can't show — #194.** PR #193 was
+  reviewed twice, and both benches unanimously raised the same blocker: `$GH_REPO`, `$MODELS`, and
+  `$CHAIR` looked undefined in the `run:` step under review. They were defined — in a workflow- or
+  job-level `env:` block the PR never touched, so it never appeared in the diff. Four seats agreeing
+  was one shared blind spot, not four independent findings. The briefing now appends the workflow-
+  and job-level `env:` blocks of every changed workflow (fetched from the base ref, exactly like the
+  alias map above), labelled explicitly as context and not part of the diff; step-level `env:` is
+  excluded because it already travels with its own hunk. A literal value under a
+  `TOKEN`/`SECRET`/`PASSWORD`/`KEY`-shaped name is withheld from the briefing — a pure `${{ }}`
+  reference is kept, since it names a secret rather than exposing one.
+- **The council-review check is no longer hardcoded green — #197.** Its `none`-policy branch set
+  `CONCLUSION="success"` before the chair's verdict was even read, so three distinct outcomes — a
+  clean review, a review with real findings, and a review that never ran at all — rendered as the
+  identical green check. `fail_on` now defaults to `rethink`: the check fails only when the chair
+  returns "Fundamental rethink," and passes on both "Fix these first" and "Ship it" (a null or
+  absent chair verdict still maps to neutral, never failure). A stricter `fail_on: fix` default was
+  tried first and reverted within hours: three live runs against PR #196 each came back "Fix these
+  first," but of the confirmed findings only one was a real, reachable defect — several were
+  accurate statements about states the system cannot produce, and two rested on premises that were
+  factually wrong. Gating on that verdict would have blocked more good work than bad. `fail_on` is
+  spelled twice in `council-review.yml` — the `workflow_call` input default, and the `pull_request`
+  path's `||` fallback, which is the load-bearing one for every label-triggered review on this repo
+  — and both spellings moved together, with a drift test re-verified against the historical
+  one-site-only mutant at the new value. `none` (report-only) and `fix` (the stricter gate) both
+  remain available for a caller that wants them.
+
+### Internal
+
+- **Burned down the citation allowlist and re-anchored the citations the gate cannot see —
+  citation-burndown, #192.** Twelve stale citations corrected, `CONFIG.grandfathered` emptied to
+  zero. Five of the eight previously-allowlisted entries were born stale — wrong in the commit that
+  introduced them, not rotted afterward; the no-output-backstop comment among them was a truth
+  failure rather than a numbering one, since the guard it warned was missing had been added by the
+  very commit that wrote the warning, so it is now reframed as closed history instead of
+  renumbered. Separately, several source comments cited a bare `(:129)`/`(:293)` line number with no
+  `.js` immediately before the colon — a shape `check-citations.js` cannot parse and so silently
+  never checks — and those are now `file.js :: symbol` anchors instead, both correct today and
+  visible to the gate from now on; one of them (`run.js:293`) had already rotted to the wrong line
+  and is corrected to `run.js:279` in the same pass.
+
 ## [4.8.0] - 2026-08-23
 
 ### Fixed

package/README.md

@@ -137,7 +137,7 @@ The council is the hero — start with the everyday way, and reach for the more
 
 ### Headless council (CI)
 
-The same pipeline runs with no Claude runtime at all: `amicus council run --prompt-file briefing.md --models gemini,glm --chair deepseek --json` executes the review waves, the anonymized cross-review, the tally, and the chair verdict in one command, and writes the full run directory (`verdict.json` with the chair's parsed `overallVerdict`, `report.html`, every review and judge output). That is what powers the repo's own **Council Review GitHub Action v2** — on PRs labeled `council-review` it posts an adjudicated verdict as a check run plus a sticky comment, uploads the run directory as an evidence artifact, and can optionally gate merges via its `fail_on` input (default: report-only). Reference: [docs/council.md](./docs/council.md#amicus-council-run).
+The same pipeline runs with no Claude runtime at all: `amicus council run --prompt-file briefing.md --models gemini,glm --chair deepseek --json` executes the review waves, the anonymized cross-review, the tally, and the chair verdict in one command, and writes the full run directory (`verdict.json` with the chair's parsed `overallVerdict`, `report.html`, every review and judge output). That is what powers the repo's own **Council Review GitHub Action v2** — on PRs labeled `council-review` it posts an adjudicated verdict as a check run plus a sticky comment, uploads the run directory as an evidence artifact, and gates merges by default via its `fail_on` input (fails only on a `Fundamental rethink` verdict; pass `fail_on: fix` to require `Ship it`, or `fail_on: none` for report-only). Reference: [docs/council.md](./docs/council.md#amicus-council-run).
 
 <p align="center"><img src="./docs/cards/ship-gate.svg" alt="A council gating a release pipeline: exit 0 ships it, exit 1 sends it back"></p>
 
@@ -275,7 +275,7 @@ This opens a graphical wizard:
 | Step | What it does |
 |------|--------------|
 | **1. API Keys** | Enter keys for OpenRouter, Google, OpenAI, Anthropic, and/or DeepSeek. Each is validated live against the provider's API. Written to `~/.config/amicus/.env` with `0600` permissions. |
-| **2. Default Model** | Pick your go-to model from a searchable live picker (backed by the catalog). Used whenever you omit `--model`. |
+| **2. Default Model** | Pick your go-to model from a searchable live picker (backed by the catalog) — each provider card also lets you drill down to a specific model instead of just the family default. Used whenever you omit `--model`. |
 | **3. Model Routing** | Decide which provider serves each model — e.g. route Gemini through a direct Google key and everything else through OpenRouter. |
 | **4. Review** | Confirm the configuration before saving. |
 
@@ -450,7 +450,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.8.0",
+  "version": "4.8.1",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }

package/docs/CITATIONS.md

@@ -107,8 +107,16 @@ form; do not silently renumber it.
 
 ## The burn-down list
 
-`CONFIG.grandfathered` in `scripts/check-citations.js` holds citations that were
-already stale when the gate landed, so the gate could block from day one instead
-of shipping advisory. Every entry rotted when v4.8 PR0 split its target. Fix the
-citation, then **delete the entry** — a test asserts every entry still names a
-real citation, so the list cannot quietly accumulate dead weight.
+`CONFIG.grandfathered` in `scripts/check-citations.js` is the escape hatch for
+citations already stale when a gate change lands, so the gate can block from day
+one instead of shipping advisory. **It is empty, and should stay that way.** Fix
+the citation, then **delete the entry** — a test asserts every entry still names
+a real citation, so the list cannot quietly accumulate dead weight.
+
+The original eight were burned down in one pass. **Four were born stale** — wrong
+in the commit that wrote them, not rotted by later drift: three reused a line
+number from a split that had already landed (one from a split made in that very
+commit), and one wrote a symbol name with `.js` appended as if it were a path.
+The other four were ordinary rot from the PR0/PR5c splits. A gate that catches
+only decay would never have caught the first four — which is the case for
+`file.js :: symbol` being the default form.

package/docs/configuration.md

@@ -1,6 +1,6 @@
 # Configuration Reference
 
-`amicus setup` is the recommended way to configure Amicus. It opens a graphical wizard that validates your API keys live, lets you pick a default model from the live catalog, and saves everything to `~/.config/amicus/.env` (permissions `0600`). The environment variables below are for overrides and advanced tuning — most users only need the API keys section.
+`amicus setup` is the recommended way to configure Amicus. It opens a graphical wizard that validates your API keys live, lets you pick a default model from the live catalog — down to a specific model per provider, not just the family default — and saves everything to `~/.config/amicus/.env` (permissions `0600`). The environment variables below are for overrides and advanced tuning — most users only need the API keys section.
 
 ---
 

package/docs/usage.md

@@ -518,7 +518,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.8.0",
+  "version": "4.8.1",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }

package/electron/ipc-setup.js

@@ -80,10 +80,26 @@ function registerSetupHandlers(getMainWindow, { ipcMain = require('electron').ip
   // Task 8: apply a per-provider default picker choice. Read-modify-write,
   // no-clobber -- applyProviderDefault only ever writes aliases[vendor] and
   // seeds config.default when absent (see provider-default-picker.js).
-  ipcMain.handle('sidecar:set-provider-default', (_event, provider, chosenId) => {
+  // Fetches the catalog before applying (issue 195): applyProviderDefault
+  // uses directFormIfProven (model-canonicalization.js) to decide whether to
+  // strip an OpenRouter prefix off chosenId, and needs the catalog to do it.
+  ipcMain.handle('sidecar:set-provider-default', async (_event, provider, chosenId) => {
+    let catalog = [];
+    try {
+      const { getCatalog } = require('../src/utils/model-catalog');
+      catalog = await getCatalog();
+    } catch (err) {
+      // Best-effort only -- a fetch failure leaves `catalog` empty, which
+      // directFormIfProven (F1, council review of PR 198) reads as NO
+      // evidence, never as license to strip: chosenId is persisted exactly
+      // as given, not re-derived. Applying an already-made picker choice
+      // must never abort on a catalog hiccup, and must never fabricate an
+      // id on one either -- that was the exact bug issue 195 fixed.
+      logger.error('set-provider-default catalog fetch error', { error: err.message });
+    }
     try {
       const { applyProviderDefault } = require('../src/utils/provider-default-picker');
-      return applyProviderDefault(provider, chosenId, { seedDefaultIfAbsent: true });
+      return applyProviderDefault(provider, chosenId, { seedDefaultIfAbsent: true, catalog });
     } catch (err) {
       logger.error('set-provider-default handler error', { error: err.message });
       return { success: false, error: err.message };

package/electron/main.js

@@ -327,11 +327,24 @@ function createAmicusWindow() {
 async function createSetupWindow() {
   // Lazy-load setup UI to avoid loading it for sidecar mode
   const { buildSetupHTML } = require('./setup-ui');
-  const { resolveQuickPicks } = require('../src/utils/quick-picks');
+  const { resolveQuickPicks, toStorableRoute } = require('../src/utils/quick-picks');
   let quickPicks;
+  const shortlists = {};
   try {
     const catalog = await require('../src/utils/model-catalog').getCatalog();
     quickPicks = resolveQuickPicks(catalog);
+
+    // issue 138: one vendor shortlist per family card, resolved server-side from
+    // the same catalog the quick picks came from (no extra IPC round-trip).
+    const { buildModelShortlist } = require('../src/utils/model-shortlist');
+    for (const p of quickPicks) {
+      try {
+        shortlists[p.alias] = buildModelShortlist(p.vendorPath, {
+          catalog,
+          recommendedId: toStorableRoute(p),
+        });
+      } catch (_e) { /* a shortlist failure must never block the wizard */ }
+    }
   } catch (_err) {
     quickPicks = undefined;  // buildSetupHTML falls back to pinned
   }
@@ -348,7 +361,7 @@ async function createSetupWindow() {
     }
   });
 
-  const html = buildSetupHTML({ client: CLIENT, quickPicks });
+  const html = buildSetupHTML({ client: CLIENT, quickPicks, shortlists });
   mainWindow.loadURL(`data:text/html;charset=utf-8,${encodeURIComponent(html)}`);
   mainWindow.webContents.on('page-title-updated', (e) => e.preventDefault());
 
@@ -499,6 +512,36 @@ registerSetupHandlers(() => mainWindow);
 function createSettingsChildWindow() {
   const { buildSetupHTML } = require('./setup-ui');
 
+  // issue 138: mirror createSetupWindow's catalog resolution so Step 2 shows
+  // live per-model options here too, instead of falling back to the pinned
+  // `[offline list]` badge. This window must stay synchronous (opening
+  // Settings must never trigger a network fetch), so read the on-disk cache
+  // directly with readCache() rather than the async fetch-and-refresh helper
+  // createSetupWindow awaits. A missing or corrupt cache reads back as null
+  // and degrades to the same pinned fallback buildSetupHTML already applies
+  // when no quickPicks are given.
+  const { resolveQuickPicks, toStorableRoute } = require('../src/utils/quick-picks');
+  const { readCache } = require('../src/utils/model-catalog');
+  let quickPicks;
+  const shortlists = {};
+  try {
+    const cacheDoc = readCache();
+    const catalog = cacheDoc ? cacheDoc.models : [];
+    quickPicks = resolveQuickPicks(catalog);
+
+    const { buildModelShortlist } = require('../src/utils/model-shortlist');
+    for (const p of quickPicks) {
+      try {
+        shortlists[p.alias] = buildModelShortlist(p.vendorPath, {
+          catalog,
+          recommendedId: toStorableRoute(p),
+        });
+      } catch (_e) { /* a shortlist failure must never block the wizard */ }
+    }
+  } catch (_err) {
+    quickPicks = undefined;  // buildSetupHTML falls back to pinned
+  }
+
   const settingsWin = new BrowserWindow({
     width: 560, height: 680,
     parent: mainWindow, modal: false,
@@ -512,7 +555,7 @@ function createSettingsChildWindow() {
     }
   });
 
-  const html = buildSetupHTML({ client: CLIENT });
+  const html = buildSetupHTML({ client: CLIENT, quickPicks, shortlists });
   settingsWin.loadURL(`data:text/html;charset=utf-8,${encodeURIComponent(html)}`);
   settingsWin.webContents.on('page-title-updated', (e) => e.preventDefault());
 }

package/electron/setup-ui-model.js

@@ -20,6 +20,26 @@ const PROVIDER_NAMES = {
   deepseek: 'DeepSeek'
 };
 
+/**
+ * F5: HTML-escape a value for safe interpolation into BOTH an attribute
+ * value (double-quoted) and element text content. Catalog ids are
+ * data-controlled (this repo's own convention documents them as such --
+ * see renderSearchResults in electron/setup-ui.js, which uses createElement
+ * + textContent instead of a template string for this exact row source),
+ * so every id/name reaching a template string here must be escaped rather
+ * than trusted.
+ * @param {*} value
+ * @returns {string}
+ */
+function escapeAttr(value) {
+  return String(value === null || value === undefined ? '' : value)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
 /**
  * Check if a model has at least one route with a configured key.
  * When no keys are configured at all (empty configuredKeys), all models are available
@@ -63,15 +83,68 @@ function buildModelSearchHTML() {
     </div>`;
 }
 
+/**
+ * issue 138: the family -> model second level for one card. Renders EVERY model
+ * in one <select> (scrollable and type-ahead searchable, so nothing is
+ * hidden), grouped "Suggested" / "All N models". Returns '' when no
+ * shortlist was supplied (or its `total` is 0).
+ *
+ * That '' is NOT dropped by the caller — buildModelStepHTML always splices
+ * it into the card template as its own line, so a card with no shortlist
+ * gains one whitespace-only line versus the pre-issue-138 HTML string. It is NOT
+ * byte-for-byte identical to that old output. It IS behaviorally identical:
+ * no <select> is emitted, and whitespace-only text nodes are inert once
+ * parsed as HTML, so the rendered card is unchanged.
+ *
+ * CONTROLLER RULING R1 (issue 138, 2026-08-24): every <option> carries
+ * data-or="<openrouterId>" (empty string when the row has no OpenRouter
+ * form), so a later task can read the user's chosen route without
+ * re-deriving a gateway prefix from the value id.
+ * @param {string} alias
+ * @param {{recommendedId:string, suggested:Array<object>, rest:Array<object>, total:number}} [shortlist]
+ * @returns {string} HTML fragment
+ */
+function buildModelPickHTML(alias, shortlist) {
+  if (!shortlist || !shortlist.total) { return ''; }
+  const opt = (r) => {
+    const price = r.pricePerMInput === null ? '' : ` · $${r.pricePerMInput.toFixed(2)}/M`;
+    const sel = r.isRecommended ? ' selected' : '';
+    return `<option value="${escapeAttr(r.id)}" data-or="${escapeAttr(r.openrouterId || '')}"${sel}>${escapeAttr(r.id)}${price}</option>`;
+  };
+  // Escaping-discipline consistency pass (council review, PR 196): alias
+  // is one of the five hardcoded FAMILIES names, not catalog data, so this
+  // is not closing a live vulnerability -- it matches the escapeAttr() use
+  // a few lines up for r.id/r.openrouterId, which ARE catalog-derived, so
+  // every attribute interpolation in this function follows the same rule.
+  let html = `<select class="model-pick" data-alias="${escapeAttr(alias)}">`;
+  html += `<optgroup label="Suggested">${shortlist.suggested.map(opt).join('')}</optgroup>`;
+  if (shortlist.rest.length > 0) {
+    // council review, PR 196 (F2): this optgroup holds ONLY `rest` -- label it
+    // by rest.length, not shortlist.total, or the label overstates what's in
+    // it (e.g. "All 14 models" over 6 rows when 8 are already under
+    // "Suggested" above). Singular/plural handled explicitly so a 9-row
+    // vendor with one leftover row doesn't read "1 models".
+    const restCount = shortlist.rest.length;
+    const restLabel = restCount === 1 ? '1 more model' : `${restCount} more models`;
+    html += `<optgroup label="${restLabel}">${shortlist.rest.map(opt).join('')}</optgroup>`;
+  }
+  return html + '</select>';
+}
+
 /**
  * Build the HTML fragment for Step 2 (Model Selection).
  * @param {Array<{alias:string, label:string, blurb:string, source:string, routes:Object<string,string>}>} choices
  *   Resolved rows from resolveQuickPicks(). Each row has separate label + blurb fields.
  * @param {string} [selectedAlias] - Pre-selected alias; defaults to first available choice.
  * @param {Object<string,boolean>} [configuredKeys] - Provider IDs the user has keys for.
+ * @param {Object<string,object>} [shortlists] - issue 138: per-alias vendor shortlist
+ *   from buildModelShortlist(), used to render the model-level <select>.
+ *   Defaults to {}; omitting it (or passing {}) is behaviorally identical to
+ *   today's card (no <select> for that alias) but not byte-for-byte identical
+ *   to the pre-issue-138 HTML string — see buildModelPickHTML's docstring.
  * @returns {string} HTML fragment
  */
-function buildModelStepHTML(choices, selectedAlias, configuredKeys = {}) {
+function buildModelStepHTML(choices, selectedAlias, configuredKeys = {}, shortlists = {}) {
   // Determine availability for each model
   const availability = choices.map(c => {
     const providers = Object.keys(c.routes);
@@ -102,6 +175,20 @@ function buildModelStepHTML(choices, selectedAlias, configuredKeys = {}) {
 
     // Resolved id for the write-preview (prefer bestProvider route)
     const previewId = c.routes[bestProvider] || Object.values(c.routes)[0] || '';
+    // Escaping-discipline consistency pass (council review, PR 196; extended
+    // by a second pass, N-c): NOT closing a live vulnerability -- c.alias is
+    // one of the five hardcoded FAMILIES names and previewId is filtered
+    // through resolveQuickPicks' anchored idPattern regexes (or a hardcoded
+    // fallback), neither of which can carry a payload. This applies the
+    // same escapeAttr() used a few lines up (buildModelPickHTML, for
+    // genuinely catalog-derived r.id/r.openrouterId) to every c.alias /
+    // previewId interpolation in this card template -- attributes
+    // (data-alias, the radio value) and text content alike (.model-alias,
+    // .model-resolved, .write-preview-id, the write-preview <code>s) --
+    // so a reader of this template does not have to work out which
+    // interpolations are "safe" and which are escaped; the rule is uniform.
+    const escapedAlias = escapeAttr(c.alias);
+    const escapedPreviewId = escapeAttr(previewId);
 
     // Offline badge for fallback rows
     const badge = c.source === 'fallback'
@@ -114,23 +201,26 @@ function buildModelStepHTML(choices, selectedAlias, configuredKeys = {}) {
       const pills = providers.map(p => {
         const isActive = p === bestProvider;
         const cls = isActive ? 'route-pill active' : 'route-pill';
-        return `<button class="${cls}" data-alias="${c.alias}" data-provider="${p}">${PROVIDER_NAMES[p]}</button>`;
+        return `<button class="${cls}" data-alias="${escapedAlias}" data-provider="${p}">${PROVIDER_NAMES[p]}</button>`;
       }).join('');
       const toggleDisplay = showToggle ? '' : ' style="display:none"';
       const staticDisplay = showToggle ? ' style="display:none"' : '';
-      routeHtml = `<span class="route-toggle" data-alias="${c.alias}"${toggleDisplay}>${pills}</span>`;
-      routeHtml += `<span class="route-static" data-alias="${c.alias}"${staticDisplay}>via ${PROVIDER_NAMES[bestProvider]}</span>`;
+      routeHtml = `<span class="route-toggle" data-alias="${escapedAlias}"${toggleDisplay}>${pills}</span>`;
+      routeHtml += `<span class="route-static" data-alias="${escapedAlias}"${staticDisplay}>via ${PROVIDER_NAMES[bestProvider]}</span>`;
     } else {
       routeHtml = `<span class="route-static">via ${PROVIDER_NAMES[bestProvider]}</span>`;
     }
 
+    const modelPickHtml = buildModelPickHTML(c.alias, shortlists[c.alias]);
+
     return `<label class="${cardClass}">
-        <input type="radio" name="default-model" value="${c.alias}" ${checked}${disabled}>
-        <span class="model-alias">${c.alias}</span>
+        <input type="radio" name="default-model" value="${escapedAlias}" ${checked}${disabled}>
+        <span class="model-alias">${escapedAlias}</span>
         <span class="model-label">${c.label} — ${c.blurb}</span>${badge}
-        <span class="model-resolved">${previewId}</span>
+        <span class="model-resolved" data-alias="${escapedAlias}">${escapedPreviewId}</span>
         ${routeHtml}
-        <span class="write-preview" data-alias="${c.alias}">will set <code>${c.alias}</code> → <code class="write-preview-id">${previewId}</code></span>
+        ${modelPickHtml}
+        <span class="write-preview" data-alias="${escapedAlias}">will set <code>${escapedAlias}</code> → <code class="write-preview-id">${escapedPreviewId}</code></span>
       </label>`;
   }).join('\n      ');
 
@@ -145,4 +235,4 @@ function buildModelStepHTML(choices, selectedAlias, configuredKeys = {}) {
   </div>`;
 }
 
-module.exports = { buildModelSearchHTML, buildModelStepHTML, PROVIDER_NAMES };
+module.exports = { buildModelSearchHTML, buildModelStepHTML, buildModelPickHTML, PROVIDER_NAMES, escapeAttr };

package/electron/setup-ui-styles.js

@@ -192,6 +192,28 @@ function __rawWizardCSS() {
     margin-left: auto; font-size: 11px; color: var(--text-faint); font-style: italic;
   }
 
+  /* Model-level picker (Step 2 card) — issue 138. Mirrors .alias-model-select's
+     token-driven approach (background/border/radius/color/font/outline/cursor),
+     but this control lives inside a wrapping .model-card row alongside the
+     radio and route pills, not the Step-3 alias table's own linear row —
+     so it takes flex-basis:100% (its own line, below the route pills) rather
+     than alias-model-select's flex:1, and a plain --border (not --accent,
+     which the alias editor reserves for its active-edit state) so it reads
+     as a subordinate refinement, not the card's primary affordance. The
+     option/optgroup rules are load-bearing: Windows does not inherit a
+     <select>'s background/color into its <option>/<optgroup> children. */
+  .model-pick {
+    flex-basis: 100%; margin-top: 4px; padding: 3px 6px;
+    background: var(--surface); border: 1px solid var(--border);
+    border-radius: var(--r-3); color: var(--text-muted); font-size: 11px;
+    font-family: var(--font-mono);
+    outline: none; cursor: pointer; max-width: 280px;
+  }
+  .model-pick:hover { border-color: var(--border-strong); }
+  .model-pick:focus { border-color: var(--accent); }
+  .model-pick option { background: var(--surface); color: var(--text); }
+  .model-pick optgroup { color: var(--text-muted); font-style: normal; }
+
   /* Routing example */
   .routing-example {
     background: var(--surface); border: 1px solid var(--border); border-radius: var(--r-8);