toolroll 0.9.82 → 0.9.84

package/dist/folder-look.js

@@ -0,0 +1,306 @@
+/**
+ * Reads of a person's own folders, kept off the console's thread.
+ *
+ * A folder can stop answering: a drive that disconnected without unmounting, a folder macOS keeps in iCloud (Desktop &
+ * Documents), or one behind a privacy prompt nobody has answered. Opening it then blocks until the system answers, and
+ * a synchronous read on the console's thread freezes every page with it (the 0.9.82 deploy, 2026-10-31: the console
+ * listened for twenty minutes without answering, its main thread inside a directory read). So every such read runs in a
+ * child process, the same read it always was, and the console waits for it only as long as a deadline allows: a folder
+ * that didn't answer degrades the one thing that needed it, in plain words, and the next look tries again.
+ *
+ * A look never goes into another mounted drive, /Volumes, or the protected folders under ~/Library, unless that is the
+ * folder the person chose. Its answers are filesystem data, read exactly as before (directory names, a repository's
+ * `.git/config` as a plain bounded file never followed through a link), and the caller still checks every path against
+ * its own ceiling.
+ */
+import { spawn } from "node:child_process";
+import { homedir } from "node:os";
+import { resolve } from "node:path";
+/** How long the console waits for a look before saying the folder didn't answer. */
+export const FOLDER_LOOK_MS = 4_000;
+/** The `url` of `[remote "origin"]` in a git config's text. Plain JavaScript with no outside names: the look's child
+ * runs this same function (its source is sent along), so the parent and the child read a config one way. */
+export function originUrlIn(config) {
+    let inOrigin = false;
+    for (const line of config.split("\n")) {
+        if (/^\s*\[/.test(line)) {
+            inOrigin = /^\s*\[remote "origin"\]\s*$/.test(line);
+            continue;
+        }
+        if (!inOrigin)
+            continue;
+        const url = /^\s*url\s*=\s*(.+)$/.exec(line)?.[1];
+        if (url !== undefined)
+            return url.trim();
+    }
+    return null;
+}
+/** At most this many look processes at once, stuck ones included: a folder that never answers costs one each. */
+export const FOLDER_LOOK_CHILDREN = 8;
+/**
+ * The child's script: plain CommonJS, given the request as its one argument, printing one JSON answer. Every file it
+ * reads is opened without following a link and without waiting on a FIFO, checked to be a regular file under its cap
+ * on the open descriptor, and read only up to its limit; every folder is read through a bounded iterator.
+ */
+const LOOK_SCRIPT = `"use strict";
+const fs = require("fs"), path = require("path");
+const originUrlIn = ${originUrlIn.toString()};
+const request = JSON.parse(process.argv[1]);
+const within = (p, root) => p === root || p.startsWith(root === "/" ? "/" : root + "/");
+const home = request.home || "/nonexistent";
+const fenced = [path.join(home, "Library"), "/Volumes", "/System/Volumes", "/Network", "/net", "/private/var/automount"];
+// A place the look never enters, unless the path is inside a folder the person chose there (that root itself, not any
+// root that happens to lie in the same protected tree).
+const offLimits = (p, roots) => fenced.some(one => within(p, one) && !roots.some(root => within(root, one) && within(p, root)));
+const rootOf = (p, roots) => roots.filter(root => within(p, root)).sort((a, b) => b.length - a.length)[0];
+// A plain file read bounded by construction (ghlist review, finding 1): never through a link (O_NOFOLLOW), never
+// waiting on a FIFO (O_NONBLOCK), a regular file under the cap by the opened descriptor, at most the limit read.
+function readBounded(file, cap, limit) {
+  let fd = null;
+  try {
+    fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+    const stat = fs.fstatSync(fd);
+    if (!stat.isFile() || stat.size > cap) return null;
+    const buffer = Buffer.alloc(Math.min(limit, stat.size));
+    const read = buffer.length === 0 ? 0 : fs.readSync(fd, buffer, 0, buffer.length, 0);
+    return buffer.toString("utf8", 0, read);
+  } catch { return null; }
+  finally { if (fd !== null) { try { fs.closeSync(fd); } catch {} } }
+}
+function origin(repo) {
+  const config = readBounded(path.join(repo, ".git", "config"), 1024 * 1024, 64 * 1024);
+  return config === null ? null : originUrlIn(config);
+}
+function children(folder, roots, links) {
+  const out = [];
+  const folderDev = fs.statSync(folder).dev;
+  const dir = fs.opendirSync(folder);
+  try {
+    for (let seen = 0; seen < 2000 && out.length < 400; seen++) {
+      const entry = dir.readSync();
+      if (entry === null) break;
+      if (!(entry.isDirectory() || (links && entry.isSymbolicLink()))) continue;
+      const spelled = path.join(folder, entry.name);
+      if (offLimits(spelled, roots)) continue;
+      let real, stat;
+      try { real = fs.realpathSync(spelled); } catch { continue; }
+      if (offLimits(real, roots) || !roots.some(root => within(real, root))) continue;
+      try { stat = fs.statSync(real); } catch { continue; }
+      if (!stat.isDirectory()) continue;
+      // Another drive mounted here: not entered unless it is itself a chosen folder.
+      if (stat.dev !== folderDev && !roots.includes(real)) continue;
+      out.push({ name: entry.name, path: real });
+    }
+  } finally { dir.closeSync(); }
+  return out;
+}
+function look() {
+  if (request.op === "projectMcp") {
+    const text = readBounded(path.join(request.path, ".mcp.json"), 1024 * 1024, 1024 * 1024);
+    if (text === null) return { config: null };
+    try { const parsed = JSON.parse(text); return { config: parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null }; }
+    catch { return { config: null }; }
+  }
+  if (request.op === "identities") {
+    return { paths: request.paths.slice(0, 500).map(one => {
+      try { const real = fs.realpathSync(path.resolve(one)); return { path: one, real: fs.statSync(real).isDirectory() ? real : null }; }
+      catch { return { path: one, real: null }; }
+    }) };
+  }
+  const roots = request.roots;
+  if (request.op === "list") {
+    const at = fs.realpathSync(request.path);
+    const root = rootOf(at, roots);
+    if (root === undefined || offLimits(at, roots) || !fs.statSync(at).isDirectory()) return { at: null, entries: [] };
+    // A folder on another drive than the root that allows it is not entered (the root itself may be one).
+    if (at !== root && fs.statSync(at).dev !== fs.statSync(root).dev) return { at: null, entries: [] };
+    const entries = children(at, roots, true)
+      .filter(one => !one.name.startsWith(".") && one.name !== "node_modules")
+      .map(one => ({ name: one.name, path: one.path, git: fs.existsSync(path.join(one.path, ".git")) }));
+    return { at, entries };
+  }
+  const registered = request.registered.slice(0, 500).map(repo => ({ path: repo, url: origin(repo) }));
+  const found = [];
+  for (const root of roots) {
+    let listed = [];
+    try { listed = children(root, roots, false); } catch { continue; }
+    for (const child of listed) {
+      if (!fs.existsSync(path.join(child.path, ".git"))) continue;
+      found.push({ path: child.path, url: origin(child.path) });
+    }
+  }
+  return { registered, found };
+}
+let answer;
+try { answer = { ok: true, value: look() }; } catch (error) { answer = { ok: false, code: error && error.code || null }; }
+process.stdout.write(JSON.stringify(answer));
+`;
+/** The production look: the script above in a child process of this same Node (or Electron as Node), killed at its
+ * deadline. Its environment carries nothing of this process's (no NODE_OPTIONS, no secrets). At the deadline its pipe
+ * is closed and nothing of it keeps this process alive; `ended` settles only when the process has really gone. */
+export const childLook = (request, deadlineMs) => {
+    const child = spawn(process.execPath, ["-e", LOOK_SCRIPT, JSON.stringify(request)], {
+        stdio: ["ignore", "pipe", "ignore"],
+        env: { PATH: process.env["PATH"] ?? "/usr/bin:/bin", ELECTRON_RUN_AS_NODE: "1" },
+        killSignal: "SIGKILL",
+    });
+    child.unref();
+    const ended = new Promise(resolveEnded => {
+        child.once("exit", () => resolveEnded());
+        child.once("error", () => resolveEnded());
+    });
+    const answer = new Promise((resolveAnswer, reject) => {
+        const chunks = [];
+        let size = 0;
+        const timer = setTimeout(() => {
+            child.kill("SIGKILL");
+            // A child stuck in the kernel can't be reaped yet: its pipe is closed now, so it holds nothing here.
+            child.stdout.destroy();
+            reject(new Error("the look didn't answer"));
+        }, deadlineMs);
+        timer.unref();
+        child.stdout.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > 8 * 1024 * 1024) {
+                child.kill("SIGKILL");
+                child.stdout.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        child.once("error", error => { clearTimeout(timer); reject(error); });
+        child.once("close", code => {
+            clearTimeout(timer);
+            if (code !== 0) {
+                reject(new Error(`the look ended with ${code}`));
+                return;
+            }
+            try {
+                resolveAnswer(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+            }
+            catch (error) {
+                reject(error);
+            }
+        });
+    });
+    answer.catch(() => { });
+    return { answer, ended };
+};
+/** Looks whose process hasn't ended, by request: callers asking the same thing share one; each holds a child slot
+ * until its process is gone. */
+const inFlight = new Map();
+/** Looks started so far: each look's place in that order is fixed when its process starts. */
+let starts = 0;
+/** The same request however its paths were spelled: resolved paths, roots in order. */
+function lookKey(request) {
+    const sorted = (paths) => paths.map(one => resolve(one)).sort();
+    switch (request.op) {
+        case "list": return JSON.stringify([request.op, resolve(request.path), sorted(request.roots), request.home]);
+        case "origins": return JSON.stringify([request.op, sorted(request.registered), sorted(request.roots), request.home]);
+        case "identities": return JSON.stringify([request.op, sorted(request.paths)]);
+        case "projectMcp": return JSON.stringify([request.op, resolve(request.path)]);
+    }
+}
+/** How many look processes are running now (stuck ones included). */
+export function folderLooksRunning() {
+    return inFlight.size;
+}
+/**
+ * One look, answered within `deadlineMs` whatever the folder does: its value, or that the folder didn't answer (it ran
+ * past the deadline, the same look is still stuck, or every child slot is held) or the look failed. A look already
+ * under way for the same request is joined, never started twice.
+ */
+export async function lookFolders(request, options = {}) {
+    const deadlineMs = options.deadlineMs ?? FOLDER_LOOK_MS;
+    const key = lookKey(request);
+    let run = inFlight.get(key);
+    if (run === undefined) {
+        if (inFlight.size >= FOLDER_LOOK_CHILDREN)
+            return { ok: false, why: "no-answer" };
+        let started;
+        try {
+            started = (options.runner ?? childLook)(request, deadlineMs);
+        }
+        catch {
+            return { ok: false, why: "failed" };
+        }
+        const mine = { ...started, started: ++starts };
+        run = mine;
+        inFlight.set(key, mine);
+        const forget = () => { if (inFlight.get(key) === mine)
+            inFlight.delete(key); };
+        mine.ended.then(forget, forget);
+    }
+    let timer;
+    const late = new Promise(resolveLate => { timer = setTimeout(() => resolveLate("late"), deadlineMs); });
+    try {
+        const first = await Promise.race([run.answer.then(value => ({ value }), () => "failed"), late]);
+        if (first === "late")
+            return { ok: false, why: "no-answer" };
+        if (first === "failed")
+            return { ok: false, why: "failed" };
+        const answer = first.value;
+        if (answer === null || typeof answer !== "object" || answer.ok !== true)
+            return { ok: false, why: "failed" };
+        return { ok: true, value: answer.value, started: run.started };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+const text = (value) => typeof value === "string" && value.length > 0 && value.length <= 4096 && !value.includes("\0");
+/** A folder's sub-folders for the browse page (null `at`: outside every root, or not a folder). */
+export async function listFolder(path, roots, options = {}) {
+    const looked = await lookFolders({ op: "list", path, roots: [...roots], home: options.home ?? homedir() }, options);
+    if (!looked.ok)
+        return looked;
+    const value = looked.value;
+    if (value === null || typeof value !== "object" || !(value.at === null || text(value.at)) || !Array.isArray(value.entries))
+        return { ok: false, why: "failed" };
+    const entries = value.entries.flatMap((one) => {
+        const row = one;
+        return row !== null && typeof row === "object" && text(row.name) && text(row.path) && typeof row.git === "boolean" ? [{ name: row.name, path: row.path, git: row.git }] : [];
+    });
+    return { ok: true, value: { at: value.at, entries } };
+}
+/** The origin URL of each registered project, and the repositories directly in each root with theirs. */
+export async function localOrigins(registered, roots, options = {}) {
+    const looked = await lookFolders({ op: "origins", registered: [...registered], roots: [...roots], home: options.home ?? homedir() }, options);
+    if (!looked.ok)
+        return looked;
+    const value = looked.value;
+    if (value === null || typeof value !== "object" || !Array.isArray(value.registered) || !Array.isArray(value.found))
+        return { ok: false, why: "failed" };
+    const rows = (list) => list.flatMap((one) => {
+        const row = one;
+        return row !== null && typeof row === "object" && text(row.path) && (row.url === null || text(row.url)) ? [{ path: row.path, url: row.url }] : [];
+    });
+    return { ok: true, value: { registered: rows(value.registered), found: rows(value.found) } };
+}
+/** Each path's identity (its real path when that is a folder, else null), resolved off the thread. */
+export async function lookIdentities(paths, options = {}) {
+    const looked = await lookFolders({ op: "identities", paths: [...paths] }, options);
+    if (!looked.ok)
+        return looked;
+    const value = looked.value;
+    if (value === null || typeof value !== "object" || !Array.isArray(value.paths))
+        return { ok: false, why: "failed" };
+    const out = new Map();
+    for (const one of value.paths) {
+        const row = one;
+        if (row !== null && typeof row === "object" && text(row.path) && (row.real === null || text(row.real)))
+            out.set(row.path, row.real);
+    }
+    return { ok: true, value: out, ...(looked.started === undefined ? {} : { started: looked.started }) };
+}
+/** A project's own `.mcp.json` (parsed object, or null when absent or not one), read off the thread. */
+export async function lookProjectMcp(repo, options = {}) {
+    const looked = await lookFolders({ op: "projectMcp", path: repo }, options);
+    if (!looked.ok)
+        return looked;
+    const value = looked.value;
+    if (value === null || typeof value !== "object")
+        return { ok: false, why: "failed" };
+    const config = value.config;
+    return { ok: true, value: config !== null && typeof config === "object" && !Array.isArray(config) ? config : null };
+}

package/dist/guides.js

@@ -287,9 +287,10 @@ ${AUTHORITY_LINE}
 
 - One command, inside the repository: \`npx toolroll up\` (or
   \`bunx toolroll up\`; Node 22.13+ must be installed — Bun's own
-  runtime cannot host it). \`up\` mints the first login and prints it (saved
-  beside the database as \`up-login.txt\`), registers the machine as a
-  worker, runs the console, opens the browser. Later starts ask for the
+  runtime cannot host it). \`up\` mints the first login and saves it beside the
+  database as \`up-login.txt\` (every start prints that path and the
+  \`cat\` command that shows the password, never the password itself),
+  registers the machine as a worker, runs the console, opens the browser. Later starts ask for the
   password at most once and remember it on that machine.
 - From a phone over a tailnet: add \`--host 0.0.0.0 --allow-host
   <name>:4180\`.

package/dist/learning-child.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/learning-child.js

@@ -0,0 +1,34 @@
+/**
+ * Started only by learning-look.ts: one project's learning recovery (project-learning.ts acceptedIdentities and
+ * recoverLearning) in a process of its own, so its synchronous reads of the project's Git folder can never hold the
+ * console's thread. It opens the database without migrating, does that one project, and ends; the console kills it
+ * at its deadline. Its one argument is JSON naming the database, the evidence folder and the project.
+ */
+import { acceptedIdentities, recoverLearning } from "./project-learning.js";
+import { openStoreNoMigrate } from "./store.js";
+const input = JSON.parse(process.argv[2] ?? "null");
+const text = (value) => typeof value === "string" && value !== "" && !value.includes("\0");
+if (input === null || !text(input.databaseFile) || !text(input.evidenceRoot) || !text(input.repo))
+    process.exit(2);
+const opened = openStoreNoMigrate(input.databaseFile);
+if (!opened.ok)
+    process.exit(3);
+let code = 0;
+try {
+    try {
+        acceptedIdentities(opened.store, input.repo);
+    }
+    catch {
+        code = 1;
+    }
+    try {
+        recoverLearning(opened.store, input.evidenceRoot, input.repo);
+    }
+    catch {
+        code = 1;
+    }
+}
+finally {
+    opened.store.close();
+}
+process.exit(code);

package/dist/learning-look.d.ts

@@ -0,0 +1,25 @@
+import { type FirstTaskSuggestion } from "./first-run.js";
+/** How long one project's recovery may take before it is stopped (the next pass tries again). */
+export declare const LEARNING_LOOK_MS = 60000;
+/** How long reading one project's first-task suggestions may take. */
+export declare const FIRST_TASKS_LOOK_MS = 20000;
+export type LearningOutcome = "done" | "failed" | "no-answer";
+export type LearningRunner = (input: {
+    databaseFile: string;
+    evidenceRoot: string;
+    repo: string;
+}, deadlineMs: number) => Promise<LearningOutcome>;
+/** The production learning runner: learning-child in its own process. */
+export declare const learningChild: LearningRunner;
+/** Recover learning for each project in turn, each in its own bounded process. */
+export declare function recoverLearningOffThread(input: {
+    databaseFile: string;
+    evidenceRoot: string;
+    repos: readonly string[];
+}, options?: {
+    runner?: LearningRunner;
+    deadlineMs?: number;
+}): Promise<Map<string, LearningOutcome>>;
+/** One project's first-task suggestions (first-run.ts findFirstTasks: its issues through gh, its TODOs through the
+ * hardened git) read in a process of its own. Rejects when it failed or didn't answer: the caller keeps the generic ones. */
+export declare function firstTasksOffThread(repo: string, deadlineMs?: number): Promise<FirstTaskSuggestion[]>;

package/dist/learning-look.js

@@ -0,0 +1,72 @@
+/**
+ * Work that reads a project's own folder synchronously, run in a process of its own and killed at a deadline, so a
+ * folder that doesn't answer (a disconnected drive, an iCloud folder macOS is holding) costs that one piece of work,
+ * never the console's thread: learning recovery (learning-child.ts) and Chat's first-task suggestions
+ * (first-tasks-child.ts).
+ */
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import {} from "./first-run.js";
+/** How long one project's recovery may take before it is stopped (the next pass tries again). */
+export const LEARNING_LOOK_MS = 60_000;
+/** How long reading one project's first-task suggestions may take. */
+export const FIRST_TASKS_LOOK_MS = 20_000;
+/** Only what git and gh need from the environment (no NODE_OPTIONS, no other secrets). */
+const CHILD_ENV = ["PATH", "HOME", "TMPDIR", "LANG", "USER", "XDG_CONFIG_HOME", "GH_TOKEN", "GITHUB_TOKEN", "GH_HOST", "GH_CONFIG_DIR"];
+/** One of this build's own child entries, given `input` as JSON, killed at the deadline. Its stdout, bounded. */
+function ownChild(name, input, deadlineMs) {
+    return new Promise(resolveOutcome => {
+        const source = import.meta.url.endsWith(".ts");
+        const entry = fileURLToPath(new URL(source ? `./${name}.ts` : `./${name}.js`, import.meta.url));
+        const env = { ELECTRON_RUN_AS_NODE: "1" };
+        for (const one of CHILD_ENV)
+            if (process.env[one] !== undefined)
+                env[one] = process.env[one];
+        const child = spawn(process.execPath, [...(source ? ["--import", import.meta.resolve("tsx")] : []), entry, JSON.stringify(input)], {
+            stdio: ["ignore", "pipe", "ignore"], env, killSignal: "SIGKILL",
+        });
+        child.unref();
+        const chunks = [];
+        let size = 0;
+        let settled = false;
+        const settle = (outcome) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            child.stdout.destroy();
+            resolveOutcome({ outcome, stdout: Buffer.concat(chunks).toString("utf8") });
+        };
+        const timer = setTimeout(() => { child.kill("SIGKILL"); settle("no-answer"); }, deadlineMs);
+        timer.unref();
+        child.stdout.on("data", (chunk) => { size += chunk.length; if (size <= 1024 * 1024)
+            chunks.push(chunk); });
+        child.once("error", () => settle("failed"));
+        child.once("close", code => settle(code === 0 ? "done" : "failed"));
+    });
+}
+/** The production learning runner: learning-child in its own process. */
+export const learningChild = async (input, deadlineMs) => (await ownChild("learning-child", input, deadlineMs)).outcome;
+/** Recover learning for each project in turn, each in its own bounded process. */
+export async function recoverLearningOffThread(input, options = {}) {
+    const outcomes = new Map();
+    for (const repo of input.repos) {
+        outcomes.set(repo, await (options.runner ?? learningChild)({ databaseFile: input.databaseFile, evidenceRoot: input.evidenceRoot, repo }, options.deadlineMs ?? LEARNING_LOOK_MS));
+    }
+    return outcomes;
+}
+/** One project's first-task suggestions (first-run.ts findFirstTasks: its issues through gh, its TODOs through the
+ * hardened git) read in a process of its own. Rejects when it failed or didn't answer: the caller keeps the generic ones. */
+export async function firstTasksOffThread(repo, deadlineMs = FIRST_TASKS_LOOK_MS) {
+    const ran = await ownChild("first-tasks-child", { repo }, deadlineMs);
+    if (ran.outcome !== "done")
+        throw new Error(`the first-task read ${ran.outcome === "no-answer" ? "didn't answer" : "failed"}`);
+    const parsed = JSON.parse(ran.stdout);
+    if (!Array.isArray(parsed))
+        throw new Error("the first-task read answered something else");
+    return parsed.flatMap((one) => {
+        const row = one;
+        return row !== null && typeof row === "object" && (row.source === "issue" || row.source === "todo" || row.source === "generic") && typeof row.label === "string" && typeof row.draft === "string"
+            ? [{ source: row.source, label: row.label.slice(0, 500), draft: row.draft.slice(0, 4000) }] : [];
+    });
+}

package/dist/model-catalog.d.ts

@@ -47,6 +47,11 @@ export declare const RUNTIME_TOOLS: Record<RuntimeTool, {
     pkg: string;
 }>;
 export declare const WATCH_EVERY_MS: number;
+/** The current Claude models by exact id, offered even before the first catalog check has run. */
+export declare const CLAUDE_EXACT: readonly {
+    value: string;
+    label: string;
+}[];
 /** `anthropic/claude-opus-5.5` → `claude-opus-5-5`, the name the Claude CLI and API use. */
 export declare function claudeIdOf(openrouterId: string): string | null;
 /** The Codex CLI's own list — account-specific, maintained by the CLI. */

package/dist/model-catalog.js

@@ -58,6 +58,12 @@ export const WATCH_EVERY_MS = 6 * 3_600_000;
 const NEW_FOR_MS = 14 * 86_400_000;
 const FAMILIES = ["opus", "sonnet", "haiku", "fable"];
 const ALIAS_WORDS = { opus: "complex tasks", sonnet: "everyday coding", haiku: "smaller tasks" };
+/** The current Claude models by exact id, offered even before the first catalog check has run. */
+export const CLAUDE_EXACT = Object.freeze([
+    { value: "claude-opus-5-5", label: "Claude Opus 5.5" },
+    { value: "claude-sonnet-5-5", label: "Claude Sonnet 5.5" },
+    { value: "claude-haiku-5-5", label: "Claude Haiku 5.5" },
+]);
 const title = (word) => word.charAt(0).toUpperCase() + word.slice(1);
 const stripVendor = (name) => name.replace(/^(Anthropic|OpenAI|Google): /, "");
 /** `anthropic/claude-opus-5.5` → `claude-opus-5-5`, the name the Claude CLI and API use. */
@@ -182,12 +188,15 @@ export function modelWords(store, provider, model) {
 export function modelOptions(store, provider, now, home = homedir()) {
     const option = (model) => ({ value: model.id, label: `${model.name} · ${priceWords(model)}${isNewModel(model, now) ? " · New" : ""}`, isNew: isNewModel(model, now) });
     if (provider === "claude") {
+        // Exact ids first (Settings → Models presets write only these); the short names float to the newest version.
+        const seen = seenModels(store, "claude").slice(0, 20);
+        const builtIn = CLAUDE_EXACT.filter(one => !seen.some(model => model.id === one.value)).map(one => ({ ...one, isNew: false }));
         const aliases = ["sonnet", "opus", "haiku"].map(alias => {
             const target = aliasTarget(store, alias);
             // Short enough that a phone's select still shows which model it means.
-            return { value: alias, label: target === null ? `${title(alias)} — ${ALIAS_WORDS[alias]}` : `${title(alias)} · latest (${target.name.replace(/^Claude /, "")})`, isNew: false };
+            return { value: alias, label: target === null ? `${title(alias)} (floating) — ${ALIAS_WORDS[alias]}` : `${title(alias)} (floating) · now ${target.name.replace(/^Claude /, "")}`, isNew: false };
         });
-        return [...aliases, ...seenModels(store, "claude").slice(0, 20).map(option)];
+        return [...seen.map(option), ...builtIn, ...aliases];
     }
     if (provider === "codex") {
         const live = codexCatalog(home);