mulmoterminal 4.11.0 → 4.13.0

package/README.md

@@ -1400,7 +1400,11 @@ Favorited collections get their own toolbar buttons.
   grid — so you can flip between "see everything" and "focus on one" in a click. While
   zoomed, keys you bind walk the enlargement along the on-screen order without reaching for
   the mouse — **opt-in, nothing is bound by default**, since any bound key is taken from the
-  terminal underneath. Add a `keymap` to `~/.mulmoterminal/config.json`; see the
+  terminal underneath. Press **Set up shortcuts…** in Settings → **Keyboard shortcuts** and an
+  agent writes the `keymap` for you, checking each binding against your existing ones and the traps
+  a browser or a Mac adds; that section also lists every action and the `send` row whether bound or not, including the
+  [keys sent straight to the terminal](https://receptron.github.io/mulmoterminal/guide/en/config.html#keymap-send).
+  To write it by hand, add a `keymap` to `~/.mulmoterminal/config.json` — see the
   [guide](https://receptron.github.io/mulmoterminal/guide/en/config.html#keymap)
   for the syntax, the action list, and combinations a browser can never bind.
 

package/bin/cli-args.d.ts

@@ -6,6 +6,8 @@ export declare function probeFailureIsPortInUse(err: { code?: string } | null |
 export declare function companionHostsFor(boundAddress: string): string[];
 export declare function launcherReachHost(bindHost: string): string | null;
 export declare function launcherUrl(reachHost: string, port: number): string;
+export declare function browserUrl(port: number): string;
+export declare function launchTarget(reachHost: string, port: number, localhostIsUnambiguous: boolean): { url: string; note: string | null };
 export declare function chooseCwd(args: string[], env: Record<string, string | undefined>): CwdChoice;
 export declare function portInUseMessage(port: number, explicit: boolean): string;
 export declare function portInUseAction(explicit: boolean, isTTY: boolean | undefined): "ask" | "stop";

package/bin/cli-args.js

@@ -156,13 +156,13 @@ export function launcherReachHost(bindHost) {
   return isIP(bindHost) ? bindHost : null;
 }
 
-/** What to PRINT for a concrete address — never `localhost`.
+/** What to name a concrete address with — never `localhost`, because this one exists to say
+ *  WHICH ADDRESS WAS CHECKED. `launcherReachHost` picks `::1` precisely so an IPv4 listener
+ *  cannot answer for us, and writing `localhost` would hand that choice straight back: measured,
+ *  `localhost` resolves to BOTH `::1` and `127.0.0.1`.
  *
- *  It did say `localhost` for the loopback cases, because that is friendlier. CodeRabbit caught
- *  what that throws away: `launcherReachHost` picks `::1` precisely so an IPv4 listener cannot
- *  answer for us, and printing `localhost` hands the choice straight back — measured, `localhost`
- *  resolves to BOTH `::1` and `127.0.0.1`, so the browser may open the very process the poll was
- *  written to avoid. A URL the user clicks has to name the address that was checked.
+ *  This is no longer what the BROWSER is sent to — see `browserUrl`, and #1889 for why those are
+ *  two different questions.
  *
  *  Built through `URL` so the platform does the escaping: an IPv6 literal has to be bracketed or
  *  `http://::1:34567` is not a URL at all. The brackets go on BEFORE the assignment because the
@@ -174,6 +174,103 @@ export function launcherUrl(reachHost, port) {
   return url.origin;
 }
 
+/**
+ * The URL the BROWSER is opened at — always `localhost`, and that is a COMPATIBILITY constraint,
+ * not a preference about which spelling reads better.
+ *
+ * The grid layout (`grid_v2`), the theme, the font size and eleven other things live in
+ * `localStorage`, which is partitioned by ORIGIN. So this string is not merely an address the
+ * user is sent to; it is the key their state is filed under. Changing it silently empties the
+ * app: 4.11.0 moved it to `http://127.0.0.1:<port>` as part of #1876's review and every upgrading
+ * user's grid came up blank, with their sessions alive in tmux and nothing on screen to say the
+ * layout was one hostname away (#1889).
+ *
+ * And there is no way back for state left on the old origin. Measured on Chrome 152: a hidden
+ * iframe on the old origin reads an EMPTY store (third-party storage partitioning), and
+ * `document.requestStorageAccess()` resolving does not change that — it governs cookies. Only a
+ * TOP-LEVEL visit to the old origin can see it. A URL that has to be stable is therefore cheaper
+ * to keep stable than to migrate.
+ *
+ * SECOND, INDEPENDENT reason, and the one this comment was missing: Firebase gates
+ * `signInWithPopup` on the CALLING PAGE'S ORIGIN, against the authorized-domain list of the
+ * project — and RemoteHost's Google sign-in is exactly that call
+ * (`src/components/RemoteHostControl.vue`, against `mulmoserver` in `common/firebaseConfig.ts`).
+ * Reported on #1900: that project authorizes `localhost` and NOT `127.0.0.1`, checked in the
+ * console on 2026-08-28, which is why phone pairing could not sign in on 4.11.0 and can on
+ * 4.12.0. Not verified here — this repo cannot read that project's settings.
+ *
+ * It matters because the two reasons fail INDEPENDENTLY. Someone who solves the storage half —
+ * moves the grid layout server-side, say — would read the paragraph above as the whole
+ * justification and be free to change this string, and the first thing to break would be a
+ * feature nothing in `bin/` mentions. Changing the URL means adding the new loopback address to
+ * that authorized-domain list first.
+ *
+ * Reachability is not the reason it is safe; #1834 is. `server/infra/loopback-listener.ts` makes
+ * this server serve `127.0.0.1` in EVERY configuration — as the primary bind, or as a second
+ * listener when the operator widens it — because eight local callers write that address as a
+ * literal. So `localhost` arrives here whatever `MULMOTERMINAL_HOST` says, falling back to v4
+ * when v6 refuses.
+ *
+ * What this deliberately does NOT do is decide anything about the port PROBE or the readiness
+ * POLL. Those still follow the address the child reports binding, which is what #1876 actually
+ * fixed — the second-instance guard, and a ready banner that was reporting a stranger's 200. The
+ * residual risk restored here is only the one 4.10.1 and every release before it carried: another
+ * APP holding this port on `::1` alone could answer a browser resolving `localhost` that way. A
+ * second MulmoTerminal cannot, because `companionHostsFor` requires `127.0.0.1` free for every
+ * bind before the child is ever spawned.
+ */
+export function browserUrl(port) {
+  return new URL(`http://localhost:${port}`).origin;
+}
+
+/**
+ * Where to send the browser, and what to say about it — as one decision, because the two answers
+ * have to agree.
+ *
+ * `localhostIsUnambiguous` is a MEASUREMENT, not a guess: the launcher tried to bind `[::1]:port`
+ * before spawning, so `false` means something else already answers there. That is the hole Codex
+ * flagged on this change and it is real for the DEFAULT bind, not only a widened one —
+ * `companionHostsFor` requires `127.0.0.1` free for every launch but never asks about `::1`, and
+ * `localhost` resolves to BOTH (measured). Sending the browser to `localhost` while a stranger
+ * holds the v6 loopback is exactly the case #1876's review was worried about.
+ *
+ * So the rule is: use the name the user's state is filed under WHEN NOTHING ELSE CAN ANSWER TO
+ * IT, and otherwise say plainly that we stepped aside — including where their layout went, since
+ * a silent switch here is #1889 all over again for that one user.
+ *
+ * Stepping aside costs more than the layout, and the note says so: on `http://127.0.0.1:<port>`
+ * RemoteHost's Google sign-in is refused as well, because Firebase checks the page's origin
+ * against its authorized domains and that project lists `localhost` only (#1900). This branch is
+ * a real degradation of the app rather than a cosmetic change of address, and the second failure
+ * would otherwise be found only by trying to pair a phone — which is the shape of #1889 again,
+ * one feature further along.
+ *
+ * The probe cannot close the window, only narrow it: `::1` is free when asked, and unless the
+ * server binds it (a `::1` or `::` bind), a stranger could still take it afterwards. That is the
+ * same probe/bind race `isPortFree` already documents and accepts.
+ *
+ * The loopback spellings below are compared against the address the kernel REPORTED, whose output
+ * vocabulary is finite — not against anything a user typed.
+ */
+export function launchTarget(reachHost, port, localhostIsUnambiguous) {
+  if (!localhostIsUnambiguous) {
+    const checked = launcherUrl(reachHost, port);
+    return {
+      url: checked,
+      note: `Something else is already listening on [::1]:${port}, so the browser is being sent to ${checked} — the address that was checked. If your layout and settings look empty, they are filed under http://localhost:${port}, and the phone's Google sign-in works only there.`,
+    };
+  }
+  const bound = reachHost === V4_LOOPBACK_CLIENTS_DIAL || reachHost === "::1";
+  return {
+    url: browserUrl(port),
+    // `browserUrl` sends everyone to `localhost`, which is right for the machine the launcher runs
+    // on and useless to the operator who set `MULMOTERMINAL_HOST` so ANOTHER machine could open
+    // the app. 4.11.0 told them their address by putting it in the banner; saying it here means
+    // restoring the origin costs them nothing.
+    note: bound ? null : `Bound to ${reachHost} — reachable from another machine at ${launcherUrl(reachHost, port)}`,
+  };
+}
+
 /**
  * Which directory to run in, before it is made absolute.
  * Precedence: `--cwd` (relative allowed) > CLAUDE_CWD > the directory the launcher was run

package/bin/mulmoterminal.js

@@ -19,9 +19,9 @@ import { waitUntilReady } from "./wait-ready.js";
 import {
   bindHostFor,
   chooseCwd,
+  launchTarget,
   companionHostsFor,
   launcherReachHost,
-  launcherUrl,
   probeFailureIsPortInUse,
   parsePortArg,
   portInUseAction,
@@ -295,6 +295,24 @@ async function isPortFree(port) {
   return primary;
 }
 
+// Can `localhost` reach anything OTHER than the server this launcher is about to start? (#1889)
+//
+// The browser is sent to `localhost` so a user's saved layout stays where it has always been, and
+// `localhost` resolves to BOTH `::1` and `127.0.0.1` (measured). `isPortFree` already proves
+// `127.0.0.1` is free for every launch — `companionHostsFor` requires it — but nothing asks about
+// `::1`, so a stranger holding the v6 loopback could answer a browser that resolves that way.
+//
+// Asked by BINDING rather than by classifying the host string, which is this file's rule
+// throughout: free means nobody is there, and that is true whether the server is about to take
+// `::1` itself (a `::1` or `::` bind) or leave it empty. Both are answers the browser can only
+// reach us with. A machine with no IPv6 fails EADDRNOTAVAIL, which probeFailureIsPortInUse
+// correctly reports as "not in use" — and there `localhost` is v4-only, so it is unambiguous.
+//
+// Must run BEFORE the server is spawned, or the server's own `::1` listener answers the probe.
+async function localhostReachesOnlyUs(port) {
+  return (await canBind(port, "::1")).free;
+}
+
 function printReadyBanner(url, stopCommand) {
   const bar = "\x1b[32m" + "─".repeat(48) + "\x1b[0m";
   console.log(`\n${bar}`);
@@ -367,7 +385,7 @@ async function confirmNoRunningInstance() {
   log(SECOND_INSTANCE_NOTE);
 }
 
-async function choosePort(requested, explicit) {
+async function pickPort(requested, explicit) {
   const asked = await isPortFree(requested);
   if (asked.free) return { port: requested, address: asked.address };
   // No SILENT fallback: starting a second server on another port without saying so is how
@@ -386,12 +404,39 @@ async function choosePort(requested, explicit) {
   return fallback;
 }
 
+// The port, the address a probe of it landed on, and whether `localhost` can reach anything but us
+// on it — settled together because all three have to be known BEFORE the spawn, which is the only
+// moment `::1` can be asked about honestly (see localhostReachesOnlyUs).
+async function choosePort(requested, explicit) {
+  const chosen = await pickPort(requested, explicit);
+  return { ...chosen, localhostIsUnambiguous: await localhostReachesOnlyUs(chosen.port) };
+}
+
+// What the launcher does the moment the server answers: say where it is, and open it there.
+//
+// `url` is where the BROWSER goes and `note` is what launchTarget wants said about that choice —
+// two different facts since #1889, and the note is null whenever the URL already covers it.
+function announceReady(url, note, noOpen) {
+  printReadyBanner(url, STOP_COMMAND);
+  // Either the address a widened bind serves other machines on, or why the browser was NOT sent
+  // to `localhost`. Null whenever the URL above already said everything.
+  if (note) log(note);
+  if (noOpen) return;
+  try {
+    // The command is a hardcoded literal; url is built by browserUrl from a numeric port, so it
+    // is http://localhost:<n>.
+    execSync(`${pickOpenCommand()} ${url}`, { stdio: "pipe" });
+  } catch {
+    log(`Open your browser: ${url}`);
+  }
+}
+
 // Spawn the server on `port` and report the child via `onChild` (so signal
 // handlers target the live process). Resolves only when the server exits because
 // the port was taken at bind time before it became ready — the caller then
 // reports that and stops. In every other case (clean shutdown, fatal error,
 // or the server simply running) the process exits with the server's code.
-function runServer(port, probedAddress, noOpen, cwd, onChild) {
+function runServer(port, probedAddress, localhostIsUnambiguous, noOpen, cwd, onChild) {
   return new Promise((resolveExit) => {
     log(`Starting MulmoTerminal on port ${port}...`);
     // stderr is piped (and passed through) so a fatal boot error can be inspected once the
@@ -427,31 +472,29 @@ function runServer(port, probedAddress, noOpen, cwd, onChild) {
     let readyStarted = false;
     let cancelReady = () => {};
     // Takes a CONCRETE address — callers resolve first, and a caller that cannot does not call.
-    const beginReady = (reachHost) => {
+    //
+    // Two different questions, and #1889 is what happens when one answer is given to both. The
+    // POLL asks "did the server we started come up", so it uses the address the child reported
+    // binding — that is #1876's fix and it stays. The URL asks "where does this user's browser
+    // keep its state", and the only answer that does not empty the app is the one it has always
+    // been given: see browserUrl.
+    // `serverSaysLocalhostIsOurs` is the child's own report and OUTRANKS the probe when present.
+    // The probe ran before the child existed, so it cannot see a process that claimed EITHER
+    // loopback during the boot — only the child knows how its own binds went (Codex, PR #1903).
+    // `undefined` means the child said nothing about it, and then the probe is all there is.
+    const beginReady = (reachHost, serverSaysLocalhostIsOurs) => {
       if (readyStarted) return;
       readyStarted = true;
-      const url = launcherUrl(reachHost, port);
-      cancelReady = waitUntilReady(
-        port,
-        () => {
-          printReadyBanner(url, STOP_COMMAND);
-          if (noOpen) return;
-          try {
-            // The command is a hardcoded literal; url is built by launcherUrl from the address the
-            // child reported and a numeric port, so it is http://<addr>:<n> or http://[<v6>]:<n>.
-
-            execSync(`${pickOpenCommand()} ${url}`, { stdio: "pipe" });
-          } catch {
-            log(`Open your browser: ${url}`);
-          }
-        },
-        { host: reachHost },
-      );
+      const localhostIsOurs = localhostIsUnambiguous && serverSaysLocalhostIsOurs !== false;
+      const { url, note } = launchTarget(reachHost, port, localhostIsOurs);
+      cancelReady = waitUntilReady(port, () => announceReady(url, note, noOpen), { host: reachHost });
     };
     server.on("message", (msg) => {
       if (!isRecordLike(msg) || msg.type !== "listening" || typeof msg.address !== "string") return;
       const reported = launcherReachHost(msg.address);
-      if (reported) beginReady(reported);
+      // Absent rather than false when the field is missing, so "an older child said nothing" and
+      // "this child could not take it" stay different answers.
+      if (reported) beginReady(reported, typeof msg.localhostIsOurs === "boolean" ? msg.localhostIsOurs : undefined);
     });
     // The fallback runs ONLY on an address we can name without asking anyone. Guessing from a
     // NAME is what the child's report exists to replace, and a fallback that guessed anyway just
@@ -463,7 +506,8 @@ function runServer(port, probedAddress, noOpen, cwd, onChild) {
     // into something connectable; BIND_HOST is the last resort and returns null for a name.
     const guessed = probedAddress ? launcherReachHost(probedAddress) : launcherReachHost(BIND_HOST);
     const fallbackReady = setTimeout(() => {
-      if (guessed) return beginReady(guessed);
+      // No report, so no v6 answer either — the probe is all this path ever had.
+      if (guessed) return beginReady(guessed, undefined);
       if (!readyStarted)
         log(`Started, but ${BIND_HOST} is a name and the server has not reported which address it bound — not guessing. It may still be starting.`);
     }, REPORTED_ADDRESS_GRACE_MS);
@@ -613,12 +657,12 @@ async function main() {
   // The address comes back with the port because the PROBE learned it from the kernel, which is
   // the one answer that needs no interpreting (#1876). It is the fallback the readiness poll uses
   // when the child reports nothing.
-  const { port, address: probedAddress } = await choosePort(requestedPort, portExplicit);
+  const { port, address: probedAddress, localhostIsUnambiguous } = await choosePort(requestedPort, portExplicit);
   // Named only now, because the port is half the name — and named at all so that the user who
   // loses this terminal has something to search for (#1820). The server child names itself the
   // same, so `pkill mulmoterminal` reaches whichever half is found first.
   setProcessTitle(port);
-  await runServer(port, probedAddress, noOpen, cwd, (c) => {
+  await runServer(port, probedAddress, localhostIsUnambiguous, noOpen, cwd, (c) => {
     child = c;
   });
   error(portInUseMessage(port, portExplicit));

package/common/keymap.ts

@@ -18,6 +18,7 @@ export const KEYMAP_ACTIONS = [
   "zoom-prev",
   "next-attention",
   "terminal-new",
+  "terminal-new-here",
   "terminal-new-adjacent",
   "terminal-close",
   "copy",
@@ -39,6 +40,16 @@ export const isKeymapAction = (value: unknown): value is KeymapAction => typeof
 //     ^C. A handler that has already swallowed the key cannot change its mind.
 export const TERMINAL_SCOPED_ACTIONS: readonly KeymapAction[] = ["copy", "paste"];
 
+// Actions that act ON a terminal and so need one the grid can name. The enlarged cell is the only
+// such state the grid has, so un-zoomed these do nothing rather than guessing which cell was meant.
+// `terminal-new` is exempt (appending needs no subject), and so are `zoom-toggle` / `next-attention`,
+// which pick the cell themselves — that is what makes them the keyboard's way INTO the zoom.
+//
+// Here rather than beside gridShortcutFor because BOTH sides decide from it: the grid dispatches on
+// it, and validateKeymap has to know that these decline the key — the handler returns WITHOUT
+// stopping the event, so a `send` on the same keystroke fires instead (codex on #1906).
+export const NEEDS_A_CURRENT_TERMINAL: readonly KeymapAction[] = ["zoom-next", "zoom-prev", "terminal-new-adjacent", "terminal-close"];
+
 // A key that puts BYTES into the focused terminal instead of running an app action (#1005) —
 // Cmd+Right as Ctrl+E for end-of-line, say, or Alt+B for word-back.
 //
@@ -163,9 +174,17 @@ export function validateKeymap(input: unknown): KeymapProblem[] {
     return [{ action: "keymap", binding: input, reason: "`keymap` must be an object of action -> key binding", fatal: true }];
   }
   const entries = Object.entries(input);
-  // A claim on one keystroke. `rank` is DISPATCH order, so the winner can be named: every action
-  // outranks every send binding, because the grid's handler runs in the capture phase and stops
-  // the event before the terminal — see sendBytesFor.
+  // A claim on one keystroke. `rank` is DISPATCH order, so the winner can be named — with ONE
+  // exception, which is why `kind` is carried alongside it.
+  //
+  // Most actions are claimed by the grid in the capture phase, before the terminal sees the key.
+  // `copy` and `paste` are not (TERMINAL_SCOPED_ACTIONS — gridShortcutFor skips them); they are
+  // decided inside the terminal by clipboardActionFor, which runs ahead of the send handler. So
+  // `paste` still outranks a send.
+  //
+  // `copy` does NOT, unconditionally: clipboardActionFor returns null when nothing is selected —
+  // deliberately, so Ctrl+C stays an interrupt — and the same-key send fires then. Naming `copy`
+  // as the winner there tells the user the opposite of what they will see half the time (#1901).
   const bound = new Map<string, Claim[]>();
   const claim = (parsed: KeyBinding, entry: Claim): void => {
     const key = canonicalBinding(parsed); // as PARSED: "Shift+PageUp" and "shift+pageup" are one keystroke
@@ -181,7 +200,7 @@ export function validateKeymap(input: unknown): KeymapProblem[] {
     if (parsed === null) {
       return [{ action, binding, reason: 'unparseable key binding — expected e.g. "PageDown" or "Shift+PageUp"', fatal: true }];
     }
-    claim(parsed, { label: action, binding, rank: KEYMAP_ACTIONS.indexOf(action) });
+    claim(parsed, { label: action, binding, rank: KEYMAP_ACTIONS.indexOf(action), kind: "action" });
     return [];
   });
   return [...problems, ...duplicateWarnings(bound)];
@@ -191,6 +210,9 @@ interface Claim {
   label: string;
   binding: string;
   rank: number;
+  /** Which side of the dispatch this is. `copy` vs a `send` is the one collision whose winner
+   *  depends on runtime state, and that cannot be read back off `label`. */
+  kind: "action" | "send";
 }
 
 // Everything wrong with the `send` list, claiming the keystrokes that are well-formed.
@@ -213,7 +235,7 @@ function sendProblems(input: unknown, claim: (parsed: KeyBinding, entry: Claim)
       return [{ action: label, binding: entry.key, reason: "`bytes` is empty — the key would be taken from the terminal and nothing sent", fatal: true }];
     }
     // Ranked after every action, matching who actually wins (see the `bound` comment above).
-    claim(parsed, { label, binding: entry.key, rank: KEYMAP_ACTIONS.length + i });
+    claim(parsed, { label, binding: entry.key, rank: KEYMAP_ACTIONS.length + i, kind: "send" });
     return [];
   });
 }
@@ -228,15 +250,55 @@ function duplicateWarnings(bound: Map<string, Claim[]>): KeymapProblem[] {
     if (claims.length < 2) return [];
     const [winner, ...losers] = [...claims].sort((a, b) => a.rank - b.rank);
     if (!winner) return []; // unreachable: claims.length >= 2 was checked above
-    return losers.map(({ label, binding }) => ({
-      action: label,
-      binding,
-      reason: `same keystroke as \`${winner.label}\` — only \`${winner.label}\` will fire`,
+    const runnerUp = fallthroughWinner(winner, losers);
+    return losers.map((loser) => ({
+      action: loser.label,
+      binding: loser.binding,
+      reason: collisionReason(winner, runnerUp, loser),
       fatal: false,
     }));
   });
 }
 
+// An action that DECLINES the keystroke in some runtime state, letting it fall through to a `send`
+// binding on the same key. Naming such an action as the sole winner is wrong whenever the user is
+// in the other state, which is the whole of #1901.
+//
+// Two handlers decline, for the same structural reason — each returns WITHOUT stopping the event:
+//
+//   - `copy` with no selection (clipboardActionFor), deliberately, so Ctrl+C stays interrupt.
+//   - NEEDS_A_CURRENT_TERMINAL with nothing enlarged (gridShortcutFor).
+//
+// `acts` and `otherwise` are the two halves of what the user is told.
+interface StandsAside {
+  acts: string;
+  otherwise: string;
+}
+const WHILE_ENLARGED: StandsAside = { acts: "only while a terminal is enlarged", otherwise: "when none is" };
+const standsAside = (label: string): StandsAside | null => {
+  if (label === "copy") return { acts: "only while text is selected", otherwise: "when nothing is" };
+  return NEEDS_A_CURRENT_TERMINAL.some((action) => action === label) ? WHILE_ENLARGED : null;
+};
+
+// The claim that fires when the winner stands aside, or null when the winner takes every state.
+//
+// Only a send can be this one. `actionForKey` returns the lowest-ranked bound action and stops, so
+// a second ACTION on the key is never reached in either state; and `sendBytesFor` takes the FIRST
+// match, so only the first send is. A conditional collision therefore has exactly TWO reachable
+// claims and every later one is unreachable in BOTH states.
+const fallthroughWinner = (winner: Claim, losers: Claim[]): Claim | null =>
+  winner.kind === "action" && standsAside(winner.label) !== null ? (losers.find((claim) => claim.kind === "send") ?? null) : null;
+
+// What the user will actually see, which is not always a single winner.
+const collisionReason = (winner: Claim, runnerUp: Claim | null, loser: Claim): string => {
+  const aside = standsAside(winner.label);
+  if (runnerUp === null || aside === null) return `same keystroke as \`${winner.label}\` — only \`${winner.label}\` will fire`;
+  if (loser === runnerUp) {
+    return `same keystroke as \`${winner.label}\` — \`${winner.label}\` acts ${aside.acts}, and \`${loser.label}\` fires ${aside.otherwise}`;
+  }
+  return `same keystroke as \`${winner.label}\` and \`${runnerUp.label}\` — \`${winner.label}\` acts ${aside.acts} and \`${runnerUp.label}\` fires ${aside.otherwise}, so \`${loser.label}\` never fires`;
+};
+
 // A binding's identity as a keystroke, for spotting two actions that claim the same one.
 const canonicalBinding = (b: KeyBinding): string => `${b.shift ? "S" : ""}${b.alt ? "A" : ""}${b.ctrl ? "C" : ""}${b.meta ? "M" : ""}|${b.key}`;
 

package/common/modelPresets.ts

@@ -78,7 +78,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "nvidia/nemotron-3-super-120b-a12b",
     label: "Nemotron 3 Super 120B",
     contextLength: 1_000_000,
-    pricePerMTok: { input: 0.08, output: 0.45 },
+    pricePerMTok: { input: 0.085, output: 0.4 },
     trials: measured(3, 3, 18),
   },
   {
@@ -86,7 +86,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "qwen/qwen3-235b-a22b-2507",
     label: "Qwen3 235B A22B",
     contextLength: 262_144,
-    pricePerMTok: { input: 0.09, output: 0.55 },
+    pricePerMTok: { input: 0.0875, output: 0.35 },
     trials: measured(3, 3, 16),
   },
   {
@@ -94,7 +94,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "minimax/minimax-m2.7",
     label: "MiniMax M2.7",
     contextLength: 204_800,
-    pricePerMTok: { input: 0.25, output: 1.0 },
+    pricePerMTok: { input: 0.3, output: 1.2 },
     trials: measured(3, 3, 16),
   },
   {
@@ -102,7 +102,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "deepseek/deepseek-v3.2",
     label: "DeepSeek V3.2",
     contextLength: 163_840,
-    pricePerMTok: { input: 0.269, output: 0.4 },
+    pricePerMTok: { input: 0.26, output: 0.38 },
     trials: measured(3, 3, 42),
   },
   {
@@ -118,7 +118,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "deepseek/deepseek-v4-pro",
     label: "DeepSeek V4 Pro",
     contextLength: 1_048_576,
-    pricePerMTok: { input: 0.435, output: 0.87 },
+    pricePerMTok: { input: 0.87, output: 1.74 },
     trials: measured(3, 3, 20),
   },
   {
@@ -126,7 +126,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "deepseek/deepseek-v4-flash",
     label: "DeepSeek V4 Flash",
     contextLength: 1_048_576,
-    pricePerMTok: { input: 0.094, output: 0.188 },
+    pricePerMTok: { input: 0.088606, output: 0.177212 },
     trials: measured(3, 4, 26),
   },
   {
@@ -158,7 +158,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "moonshotai/kimi-k2.6",
     label: "Kimi K2.6",
     contextLength: 262_144,
-    pricePerMTok: { input: 0.684, output: 3.42 },
+    pricePerMTok: { input: 0.95, output: 4.0 },
     trials: measured(3, 3, 46),
   },
   {
@@ -166,7 +166,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "z-ai/glm-5.2",
     label: "GLM 5.2",
     contextLength: 1_048_576,
-    pricePerMTok: { input: 0.819, output: 2.574 },
+    pricePerMTok: { input: 1.19, output: 3.74 },
     trials: measured(3, 3, 21),
   },
   {
@@ -174,7 +174,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "moonshotai/kimi-k2.7-code",
     label: "Kimi K2.7 Code",
     contextLength: 262_144,
-    pricePerMTok: { input: 0.82, output: 3.75 },
+    pricePerMTok: { input: 0.66, output: 3.4 },
     trials: measured(3, 3, 14),
   },
   {
@@ -190,19 +190,35 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "tencent/hy3",
     label: "Tencent Hy3",
     contextLength: 262_144,
-    pricePerMTok: { input: 0.14, output: 0.58 },
+    pricePerMTok: { input: 0.132, output: 0.528 },
     trials: measured(3, 3, 17),
   },
   {
     provider: "openrouter",
     id: "nvidia/nemotron-3-ultra-550b-a55b",
     label: "Nemotron 3 Ultra 550B",
-    contextLength: 524_288, // 512 KiB = 512 * 1024; was 512_288 (a typo)
-    pricePerMTok: { input: 0.6, output: 3.6 },
+    contextLength: 262_144,
+    pricePerMTok: { input: 0.5, output: 2.2 },
     trials: measured(3, 3, 13),
   },
 
   // ── Frontier vendors: cheapest first ─────────────────────────────────────────
+  {
+    provider: "openrouter",
+    id: "openai/gpt-5.6-luna",
+    label: "GPT-5.6 Luna",
+    contextLength: 1_050_000,
+    pricePerMTok: { input: 0.2, output: 1.2 },
+    trials: measured(3, 3, 27),
+  },
+  {
+    provider: "openrouter",
+    id: "openai/gpt-5.6-luna-pro",
+    label: "GPT-5.6 Luna Pro",
+    contextLength: 1_050_000,
+    pricePerMTok: { input: 0.2, output: 1.2 },
+    trials: measured(3, 3, 69),
+  },
   {
     provider: "openrouter",
     id: "google/gemini-3.5-flash-lite",
@@ -219,28 +235,12 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     pricePerMTok: { input: 0.3, output: 2.5 },
     trials: measured(2, 3, 20),
   },
-  {
-    provider: "openrouter",
-    id: "openai/gpt-5.6-luna",
-    label: "GPT-5.6 Luna",
-    contextLength: 1_050_000,
-    pricePerMTok: { input: 1.0, output: 6.0 },
-    trials: measured(3, 3, 27),
-  },
-  {
-    provider: "openrouter",
-    id: "openai/gpt-5.6-luna-pro",
-    label: "GPT-5.6 Luna Pro",
-    contextLength: 1_050_000,
-    pricePerMTok: { input: 1.0, output: 6.0 },
-    trials: measured(3, 3, 69),
-  },
   {
     provider: "openrouter",
     id: "google/gemini-3.6-flash",
     label: "Gemini 3.6 Flash",
     contextLength: 1_048_576,
-    pricePerMTok: { input: 1.5, output: 7.5 },
+    pricePerMTok: { input: 0.75, output: 3.75 },
     trials: measured(3, 3, 16),
   },
   {
@@ -256,7 +256,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "openai/gpt-5.6-terra-pro",
     label: "GPT-5.6 Terra Pro",
     contextLength: 1_050_000,
-    pricePerMTok: { input: 2.5, output: 15.0 },
+    pricePerMTok: { input: 2.0, output: 12.0 },
     trials: measured(3, 3, 38),
   },
 
@@ -303,7 +303,7 @@ export const MODEL_PRESETS: readonly ModelPreset[] = [
     id: "mistralai/devstral-2512",
     label: "Devstral 2512",
     contextLength: 262_144,
-    pricePerMTok: { input: 0.4, output: 2.0 },
+    pricePerMTok: { input: 0.44, output: 2.2 },
     trials: unreachable(ACCOUNT_PRIVACY),
   },
 ];