fix(local-model): a switch or a new model from a stopped model undoes the Stop

A job started from a model the person had stopped runs the runtime, and
the model it ends on is in use and running. The stored "stopped" flag
stayed set, so that model would not have started with the server again.
Both verbs now set it back once their job started, the way Start does.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

CLAUDE.md

@@ -194,7 +194,7 @@ Codeman is a Claude Code session manager with web interface and autonomous Ralph
 
 **Local model recommendation** (`GET /api/local-model`, `src/local-model/`, `src/config/local-model-catalog.ts`, `src/types/local-model.ts`; EXPERIMENTAL): the server looks at the Mac it runs on and says which local coding model fits it and with which agent CLI. ⚠️ The READ side stays read-only: the probe, the catalogue and `recommend()` download nothing, install nothing and write nothing; everything that changes the machine is the install below, behind an explicit request. Apple silicon macOS only: anywhere else the answer is a `200` with verdict `none` (reasons `not-macos`, `intel`, `memory`, `disk`, `macos`, `no-harness`), and a failed probe is an answer, never a 500. The probe (`hardware.ts`) is ONE bounded async spawn of `/usr/sbin/sysctl` WITHOUT `-n`, parsed as `key: value` lines by the pure `parseSysctl()`, plus `statfs` of the data dir (probed bounded first, #516) and `node:os` fallbacks, cached 60 s; ⚠️ never `system_profiler`, never a second spawn, and `iogpu.wired_limit_mb` of 0 means not set. The catalogue is a compiled constant validated by a Zod schema: ⚠️ no override file and no runtime data, and a model id is `name:tag` in lowercase with no slash (`LOCAL_MODEL_ID_PATTERN`, so an id can never name another registry host). ⚠️ A harness is a catalogue ROW (`{ cli, minContext, rank, gated?, slowFirstTurn? }`) plus a `HarnessFact` built from the CLI registry at call time (`harness-facts.ts`); no code compares a CLI id (both id-branching guards scan these files). `recommend()` (`recommend.ts`) is pure. ⚠️ A model's need is its PEAK (`bytes + heldBytesPerToken * context + overheadBytes + peakExtraBytes`, measured on a Mac for one row and marked `estimated` on the others), and every row names its `runner` (`mlx` or `llamacpp`, the build a Mac really pulls) and carries figures of its OWN: computed from its model's config.json by that runner's rule (catalogue header, MEMORY), never borrowed from another row; `test/local-model-catalog.test.ts` recomputes them, and the `llamacpp` rows assume the runtime's `OLLAMA_KV_CACHE_TYPE=q8_0`, `LLAMA_ARG_CACHE_RAM=1024` and `LLAMA_ARG_CTX_CHECKPOINTS=8` (`runtimeEnv()`) and count what llama-server keeps beside the cache (8 context checkpoints of the recurrent or sliding-window state, and for a GGUF with a prediction layer one rollback copy of the recurrent state per drafted token and that layer's cache in f16), so change the two together. The need is judged against a budget that is `estimated` until the runtime ran and `measured` from then on (`RecommendOptions.measuredTotalBytes`). ⚠️ Ranking, lexicographic: tested on a Mac like this first, then speed `ok` before `unknown` before `slow`, then model rank, harness rank, larger context; the fit grade decides whether a row is listed and what it says, it does NOT sort, so a model is offered at the largest context it fits at. ⚠️ `limited` is a statement about the MAC (no model with 12 billion parameters or more fits), judged before the disk filter and whatever the pick is; a small pick under `ok` carries `noteSmallPick`, and a model left out for disk space is named in `noteDiskDropped`, never dropped in silence. ⚠️ The word "Recommended" exists only in `headlineTested`, and the tag "Tested on a Mac like this" only on a row whose model has a `tested` entry for exactly this chip, memory size and harness. ⚠️ Speed is `ok`/`slow`/`unknown`, graded on the unrounded figure, and a chip in no chips row is `unknown`: never guess a bandwidth. ⚠️ ONE unit for every computed size a person reads: decimal GB text from `formatGb()` (`format.ts`), sent beside the bytes, and the browser never divides bytes; the one exception is the installed memory, shown as `memClassGb` (the size the Mac is sold as, 48 and not 51.5). ⚠️ Every sentence the server chooses is a `LOCAL_MODEL_LABELS`, `LOCAL_MODEL_TAG_LABELS` or `LOCAL_MODEL_INSTALL_LABELS` text with `{placeholder}` slots filled from `vars` (no apostrophe in a text: the zh-CN key is single-quoted), and each needs a zh-CN entry. Admin only in multi-user mode (403 before anything is probed). Tests: `test/local-model-*.test.ts`, `test/routes/local-model-routes.test.ts`. Window rules: `src/web/CLAUDE.md` (Run a model on this Mac). → `docs/api-reference.md` (Local model), `docs/versioning-policy.md`
 
-**Local model install** (`POST /api/local-model/install|cancel|resume|runtime`, `DELETE /api/local-model`; `src/local-model/{install-job,runtime,ollama-client,connect,state-store,paths,developer-tools}.ts`; EXPERIMENTAL, admin only in multi-user mode on EVERY verb; guide `docs/local-models.md`): installs the chosen model on the Mac the server runs on and ends on a session of the coding agent running on it. ONE job of five idempotent steps (`runtime`, `model`, `verify`, `agent`, `connect`; `agent` only when the coding agent is missing), a pure reducer (`reduceInstallJob()`) over three tables in `install-job.ts` driven by one service per process (`getLocalModelService()`); the window polls the GET once a second, no SSE event. ⚠️ Layout only through `localModelPaths()` (all `dataPath()`): `local-model/runtime/ollama-<version>/`, `local-model/models/`, `local-model/home/` (the runtime's PRIVATE HOME, so the user's `~/.ollama` is never touched) and the state file `local-model.json` (0600, ONE serialized writer, total reader, holds NO path); nothing is written or deleted outside `local-model/` except that file and the two writes of the connect step. ⚠️ The runtime pin (`OLLAMA_RUNTIME_PIN`: version, URL, size, sha256) is a COMPILED constant no file, setting or request may supply; the hash is compared BEFORE anything is unpacked. ⚠️ The runtime is a NON-detached child whose environment comes from the `runtimeEnv()` ALLOWLIST, never `process.env` (no `CODEMAN_*`, none of the user's `OLLAMA_*`); the port is chosen ONCE by binding (from 11435, never 11434) and stored; a listener on it is adopted or replaced only when its stored pid runs a binary under OUR runtime folder, anything else is `port-in-use`; started at boot when installed and enabled, max 3 restarts, SIGTERM at shutdown beside `stopDeepSeekWeb()`; under vitest nothing spawns or fetches. ⚠️ Consent is bound to the size: `acknowledgedBytes` must equal the server's own total (`Candidate.installBytes`) or the answer is 409 `size-changed`; the model, context and CLI must be a row the current recommendation offers (400). ⚠️ ONE job at a time (409 `job-running`); a job a restart interrupted comes back `paused` and NEVER continues without a click (so `shutdown()` writes nothing), and an interrupted step is never recorded as failed. ⚠️ An event the transition table does not list is refused (same object back, 409 `wrong-state`): add a row to the table, never a special case. ⚠️ The budget is MEASURED from the runtime's "inference compute" log line and the model judged against it BEFORE it is downloaded. ⚠️ The pull stream is parsed incrementally (about 1.4 million lines for 23 GB): never buffer it, never write state per line. ⚠️ A failure is a code with ONE next step (`LOCAL_MODEL_ERROR_NEXT`), never a bare "failed"; a probe that ended on its token limit is `probe-unfinished`, not `no-tool-call`. ⚠️ The coding agent is installed through the shared runner `src/cli-install-runner.ts` (extracted from `cli-registry-routes.ts`, ONE install slot per CLI for both callers) with `stockInstallCommand()`, the COMPILED stock command, never the `clis.json`-merged one (this path has no `cliManagementEnabled` gate); only for a catalogue harness row, after the consent click that showed the literal command, audited (`cli_install`, `via: 'local-model'`); afterwards `forgetResolvedCli()` and a fresh lookup, and still missing is `harness-failed`. ⚠️ Connect writes ONE endpoint record under the RESERVED id `local-ollama` through `mutateCustomModelHosts()` and `customModelEndpointsEnabled: true` through `mutateSettingsFile()`, remembering the flag's first value; a record with that id that is not ours is never overwritten, and while it is ours it is MANAGED: the endpoint routes refuse to edit or delete it and the discovery sweep skips it (the runtime's port has no login, so its `models` must stay the one model that was checked). ⚠️ The model digest is stored and read again at boot and before every START of a coding agent on that endpoint (`launchRefusalMessage()`): the two custom-model launch routes in `session-routes.ts` ask it before anything is written, the reboot-restore rebuild asks it before it builds (reason `local-model-not-ready`, left on offer), and `Session`'s launch guard (`setLaunchGuard()`, set in `setupSessionListeners()`) asks it right before a NEW agent process starts (a fresh pane, the respawn of a dead one, `restartCli()`), never for an attach to an agent that runs; a refusal is a `LaunchRefusedError` that never falls back to a direct PTY. A changed or missing model, a runtime Codeman did not start or that did not start, or another model id refuses the launch with one sentence. ⚠️ The connection is CLAIMED in the state file (`connection`, with the flag's value read by `inspectLocalEndpoint()`) BEFORE the endpoint record and the settings flag are written, so a state write that fails or a kill between the two never leaveLine truncated
+**Local model install** (`POST /api/local-model/install|use|cancel|resume|runtime`, `DELETE /api/local-model`, `DELETE /api/local-model/models`; `src/local-model/{install-job,runtime,ollama-client,connect,state-store,paths,developer-tools}.ts`; EXPERIMENTAL, admin only in multi-user mode on EVERY verb; guide `docs/local-models.md`): installs the chosen model on the Mac the server runs on and ends on a session of the coding agent running on it. ONE job of five idempotent steps (`runtime`, `model`, `verify`, `agent`, `connect`; `agent` only when the coding agent is missing), a pure reducer (`reduceInstallJob()`) over three tables in `install-job.ts` driven by one service per process (`getLocalModelService()`); the window polls the GET once a second, no SSE event. ⚠️ A LIBRARY with ONE model in use: the store may hold several models and `LocalModelStateFile.library` lists the ones that passed the check (written by the service when `verify` passes, carried by the reducer, dropped by `remove`; an `installed` file without it counts its one model, `libraryOf()`), but the endpoint record lists ONE model, the runtime holds one and only the state's model is ever launched: never widen the record to every checked model. `install` from `installed` adds a model (the earlier one stays: `replacedModelFor()` never names a library model), `use` switches to a checked one (a job of `USE_JOB_STEPS`, `verify` then `connect`; the stored digest is compared before anything is loaded, else `model-changed`), and both answer 409 `sessions-open` while a live session uses the endpoint; until such a job ends `installed`, no session starts (`launchRefusal()` answers `job-unfinished`). `DELETE /api/local-model/models` deletes ONE model by its NAME (`LOCAL_MODEL_ID_PATTERN`, never a path), only a name of the server's own listing, only through the runtime's own delete, never the model of the installation or of the current job (409 `model-active`), and it is no reducer event: its row is the `delete-model` action of `INSTALL_STATE_TABLE`. ⚠️ The view's `library` (state entries joined with the runtime's `/api/tags`: `ready`, `changed`, `missing`, `unverified`) and `store` (the blob folder's size, `measureModelStore()`) are cached (5 s, 30 s), refreshed in the background and thrown away by every verb and step that changes them (`forgetStore()`): never ask the runtime or the disk on the one-second poll, and a runtime that does not answer keeps the last list. ⚠️ Layout only through `localModelPaths()` (all `dataPath()`): `local-model/runtime/ollama-<version>/`, `local-model/models/`, `local-model/home/` (the runtime's PRIVATE HOME, so the user's `~/.ollama` is never touched) and the state file `local-model.json` (0600, ONE serialized writer, total reader, holds NO path); nothing is written or deleted outside `local-model/` except that file and the two writes of the connect step. ⚠️ The runtime pin (`OLLAMA_RUNTIME_PIN`: version, URL, size, sha256) is a COMPILED constant no file, setting or request may supply; the hash is compared BEFORE anything is unpacked. ⚠️ The runtime is a NON-detached child whose environment comes from the `runtimeEnv()` ALLOWLIST, never `process.env` (no `CODEMAN_*`, none of the user's `OLLAMA_*`); the port is chosen ONCE by binding (from 11435, never 11434) and stored; a listener on it is adopted or replaced only when its stored pid runs a binary under OUR runtime folder, anything else is `port-in-use`; started at boot when installed and enabled, max 3 restarts, SIGTERM at shutdown beside `stopDeepSeekWeb()`; under vitest nothing spawns or fetches. ⚠️ Consent is bound to the size: `acknowledgedBytes` must equal the server's own total (`Candidate.installBytes`) or the answer is 409 `size-changed`; the model, context and CLI must be a row the current recommendation offers (400). ⚠️ ONE job at a time (409 `job-running`); a job a restart interrupted comes back `paused` and NEVER continues without a click (so `shutdown()` writes nothing), and an interrupted step is never recorded as failed. ⚠️ An event the transition table does not list is refused (same object back, 409 `wrong-state`): add a row to the table, never a special case. ⚠️ The budget is MEASURED from the runtime's "inference compute" log line and the model judged against it BEFORE it is downloaded. ⚠️ The pull stream is parsed incrementally (about 1.4 million lines for 23 GB): never buffer it, never write state per line. ⚠️ A failure is a code with ONE next step (`LOCAL_MODEL_ERROR_NEXT`), never a bare "failed"; a probe that ended on its token limit is `probe-unfinished`, not `no-tool-call`. ⚠️ The coding agent is installed through the shared runner `src/cli-install-runner.ts` (extracted from `cli-registry-routes.ts`, ONE install slot per CLI for both callers) with `stockInstallCommand()`, the COMPILED stock command, never the `clis.json`-merged one (this path has no `cliManagementEnabled` gate); only for a catalogue hLine truncated
 
 **MCP server sync** (opt-in, `mcpSyncEnabled`, SYNCED, default OFF; `src/mcp-sync.ts`, `GET`/`POST /api/mcp-sync`): copies each installed, enabled CLI's user-level MCP servers into the others. It is the ONE subsystem that writes another CLI's REAL user config (`~/.claude.json`, `~/.codex/config.toml`, `~/.gemini/*`, opencode's), which is why it is opt-in and admin-only in multi-user mode (both verbs 403 for a non-admin, and the Settings group is hidden for them). Where each CLI keeps the file is registry data, `capabilities.mcpConfig` (`{ path, format, relocation? }`), never a branch on the id. ⚠️ Tools that sync but are not run modes (GitHub Copilot CLI, the first) are plain data in `MCP_SYNC_ONLY_TOOLS` (`src/mcp-sync-targets.ts`), take part only when installed or already configured, and their companion `settings.json` (`disabledMcpServers`) is read, never written; a test must clear their relocation vars too. ⚠️ ADDITIVE only: a name already defined, in any shape, is never edited or removed (a different same-name definition is a reported conflict), and a server switched off in its own CLI is never copied. ⚠️ Never write a file that did not parse; re-parse the NEW text and require every added server to read back before the tmp+rename (written through a symlink, previous file kept as `<file>.codeman-bak`, one apply at a time, else 409). ⚠️ A file that receives copied `env`/`headers` (secrets) is left `0600`, and so is the backup. ⚠️ Responses carry server NAMES only, never env values, headers or file text: a parse failure is reported by line and column (`describeMcpSyncError`), never the parser's own message (smol-toml and V8 both quote source). ⚠️ `mcpConfig.relocation` names the env var the CLI reads to move its file (`CLAUDE_CONFIG_DIR`, `CODEX_HOME`, `XDG_CONFIG_HOME`, `GEMINI_CLI_HOME`, and `COPILOT_HOME` for Copilot), resolved from the SERVER env at call time; a relative value reports the target `skipped`, never a guessed write, and a per-session `envOverrides` relocation is not followed. Tests must pass `home` (which drops the `process.env` default) or clear those vars first. → `docs/cli-registry.md` (MCP server sync), `docs/api-reference.md`, `docs/wiki/Settings-Reference.md`
 
@@ -328,7 +328,7 @@ One module per domain in `src/web/routes/` (plus a barrel; `ls src/web/routes/`
 
 ## State Files
 
-All in `~/.codeman/`: `state.json` (sessions, settings, respawn, orchestrator, cron jobs/runs, owner tab layouts, case default groups), `mux-sessions.json` (tmux recovery), `settings.json` (user prefs), `push-keys.json` + `push-subscriptions.json`, `session-lifecycle.jsonl` (audit log), `update-status.json` (self-updater progress, polled across the service restart), `docker-env-applied.json` (Compose deployment only: sha256 of the Dockerfile + compose file the running container was built from, written by `Start-Codeman.sh`, read by the self-updater's environment gate), `docker-build-source.json` (Compose deployment only: the checkout's HEAD commit and `package-lock.json` hash the `codeman-node-modules`/`codeman-dist` volumes currently reflect, written by both `Start-Codeman.sh` and a successful in-place self-update, compared to detect and refresh a volume left stale by an externally-triggered rebuild), `linked-cases.json`, `webviews.json` (saved web-tab dashboard URLs), `remote-hosts.json` + `remote-cases.json`, `docker-hosts.json` + `docker-cases.json` + `docker-exports/`, `subagent-window-states.json` + `subagent-parents.json` (subagent window layout, GET/PUT `/api/subagent-window-states`/`-parents`), `hook-secret` (per-instance), `users.json` (multi-user, mode 0600) + `admin-audit.jsonl`, `intents.json` (Read My Mind intent profiles, mode 0600), `agent-inbox.json` (agent inbox snapshot, only while `agentInboxPersistEnabled` is on, mode 0600), `edit-history/<id>.json` (Edit history panel, one store per session, every diff an agent wrote, mode 0600), `webhook.json` (webhook notifications: enabled/service/scope plus the ntfy/Slack/Discord URL, a bearer secret, so mode 0600, kept out of `settings.json` and never returned by `/api/webhook`, which is admin-only in multi-user mode), `discord.json` (Discord bridge: bot token, a bearer secret, so mode 0600, never returned by `/api/discord`, admin-only in multi-user mode) + `discord-bridge.json` (sessionId to Discord thread id), `local-model.json` (local model install: state, step, model, port, pid, digest, the previous `customModelEndpointsEnabled` value; mode 0600, holds no path, not part of a config backup) + `local-model/` (the pinned runtime, the model store and the runtime's private HOME, removed by `DELETE /api/local-model`), `agent-skill-default-migrated.json` (written once by the 1.50.0 boot migration of `agentSkillEnabled`; while it exists the migration never runs again, so deleting it would switch a stored off on at the next start; never tracked or restored), `config-backup-id` (the random id config backups record as each manifest's `origin`, so instances sharing a backup folder keep to their own snapshots; mode 0600, never tracked or restored, and deleting it unlists this instance's earlier snapshots), `backups/config/` (the default config-backup folder, moved by `configBackupDir`: `cfg-YYYYMMDD-HHMMSS/` snapshots, 0700 with 0600 files, each with a `manifest.json` of SHA-256s, the origin and the retention in force (`keepCount`/`keepDays`), which a pass falls back to when `settings.json` lacks a retention key), `certs/` (self-signed TLS for `--https`), `.env` (CODEMAN_USERNAME/PASSWORD fallback for the `codeman attach` CLI), `install.log` (installer step output, written by `install.sh`'s `run_step`) `tailscale-rename` (the node name before `install.sh` renamed it, so uninstall can offer it back), `cli-installed` (empty, touched by `install.sh` when it installs a CLI: a running server reads only its mtime, and a change ends that CLI's negative-cache backoff) and `runtime/` (the Node.js and tmux `install.sh` downloaded on its no-admin route, linked from `~/.local/bin`; all four installer-route only). Transient: `self-update-runner.sh`. Multi-user case spaces live OUTSIDE the data dir at `~/codeman-users/<username>/cases` (shared across instances like `~/codeman-cases`, override `CODEMAN_USER_SPACES_DIR`).
+All in `~/.codeman/`: `state.json` (sessions, settings, respawn, orchestrator, cron jobs/runs, owner tab layouts, case default groups), `mux-sessions.json` (tmux recovery), `settings.json` (user prefs), `push-keys.json` + `push-subscriptions.json`, `session-lifecycle.jsonl` (audit log), `update-status.json` (self-updater progress, polled across the service restart), `docker-env-applied.json` (Compose deployment only: sha256 of the Dockerfile + compose file the running container was built from, written by `Start-Codeman.sh`, read by the self-updater's environment gate), `docker-build-source.json` (Compose deployment only: the checkout's HEAD commit and `package-lock.json` hash the `codeman-node-modules`/`codeman-dist` volumes currently reflect, written by both `Start-Codeman.sh` and a successful in-place self-update, compared to detect and refresh a volume left stale by an externally-triggered rebuild), `linked-cases.json`, `webviews.json` (saved web-tab dashboard URLs), `remote-hosts.json` + `remote-cases.json`, `docker-hosts.json` + `docker-cases.json` + `docker-exports/`, `subagent-window-states.json` + `subagent-parents.json` (subagent window layout, GET/PUT `/api/subagent-window-states`/`-parents`), `hook-secret` (per-instance), `users.json` (multi-user, mode 0600) + `admin-audit.jsonl`, `intents.json` (Read My Mind intent profiles, mode 0600), `agent-inbox.json` (agent inbox snapshot, only while `agentInboxPersistEnabled` is on, mode 0600), `edit-history/<id>.json` (Edit history panel, one store per session, every diff an agent wrote, mode 0600), `webhook.json` (webhook notifications: enabled/service/scope plus the ntfy/Slack/Discord URL, a bearer secret, so mode 0600, kept out of `settings.json` and never returned by `/api/webhook`, which is admin-only in multi-user mode), `discord.json` (Discord bridge: bot token, a bearer secret, so mode 0600, never returned by `/api/discord`, admin-only in multi-user mode) + `discord-bridge.json` (sessionId to Discord thread id), `local-model.json` (local model install: state, step, model, port, pid, digest, the checked models of the library, the previous `customModelEndpointsEnabled` value; mode 0600, holds no path, not part of a config backup) + `local-model/` (the pinned runtime, the model store and the runtime's private HOME, removed by `DELETE /api/local-model`), `agent-skill-default-migrated.json` (written once by the 1.50.0 boot migration of `agentSkillEnabled`; while it exists the migration never runs again, so deleting it would switch a stored off on at the next start; never tracked or restored), `config-backup-id` (the random id config backups record as each manifest's `origin`, so instances sharing a backup folder keep to their own snapshots; mode 0600, never tracked or restored, and deleting it unlists this instance's earlier snapshots), `backups/config/` (the default config-backup folder, moved by `configBackupDir`: `cfg-YYYYMMDD-HHMMSS/` snapshots, 0700 with 0600 files, each with a `manifest.json` of SHA-256s, the origin and the retention in force (`keepCount`/`keepDays`), which a pass falls back to when `settings.json` lacks a retention key), `certs/` (self-signed TLS for `--https`), `.env` (CODEMAN_USERNAME/PASSWORD fallback for the `codeman attach` CLI), `install.log` (installer step output, written by `install.sh`'s `run_step`) `tailscale-rename` (the node name before `install.sh` renamed it, so uninstall can offer it back), `cli-installed` (empty, touched by `install.sh` when it installs a CLI: a running server reads only its mtime, and a change ends that CLI's negative-cache backoff) and `runtime/` (the Node.js and tmux `install.sh` downloaded on its no-admin route, linked from `~/.local/bin`; all four installer-route only). Transient: `self-update-runner.sh`. Multi-user case spaces live OUTSIDE the data dir at `~/codeman-users/<username>/cases` (shared across instances like `~/codeman-cases`, override `CODEMAN_USER_SPACES_DIR`).
 
 **Generated top-level dirs** (all gitignored — don't edit or commit): `dist/` (esbuild output), `out/`, `coverage/`, `test-results/`, `tmp/`, `screenshots-echo-diag/`. The committed gesture bundle (`src/web/public/gesture/gesture-codeman.js`) IS tracked, but its runtime wasm/model assets (`src/web/public/gesture/wasm/`, `*.task`) are fetched and gitignored.
 

README.md

@@ -8,6 +8,12 @@
   <em>Claude Code &bull; OpenCode &bull; Codex &bull; Antigravity &bull; Gemini &bull; Pi &bull; Grok &bull; DeepSeek &bull; OMP &bull; Copilot &bull; Terminal - One Dashboard &bull; Any Device</em>
 </p>
 
+<p align="center">
+  <a href="https://github.com/Ark0N/Codeman/releases/latest/download/Codeman.dmg"><img src="https://img.shields.io/badge/Download_for_Mac-Codeman.dmg-2f6fe0?style=for-the-badge&logo=apple&logoColor=white&labelColor=000000" alt="Download Codeman for Mac (Codeman.dmg)" width="354"></a>
+  <br>
+  <sub>The native Mac app: signed and notarized, Apple Silicon and Intel, macOS 11.3 or later. <a href="#on-a-mac-the-codeman-app">What it does</a></sub>
+</p>
+
 <p align="center">
   <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-1e3a5f?style=flat-square" alt="License: MIT"></a>
   <a href="https://nodejs.org/"><img src="https://img.shields.io/badge/Node.js-22%2B-22c55e?style=flat-square&logo=node.js&logoColor=white" alt="Node.js 22+"></a>
@@ -17,7 +23,6 @@
   <a href="https://github.com/Ark0N/Codeman/stargazers"><img src="https://img.shields.io/github/stars/Ark0N/Codeman?style=flat-square&color=eab308" alt="GitHub stars"></a>
   <a href="https://github.com/Ark0N/Codeman/graphs/contributors"><img src="https://img.shields.io/github/contributors/Ark0N/Codeman?style=flat-square&color=3b82f6" alt="Contributors"></a>
   <a href="https://github.com/Ark0N/Codeman/commits/master"><img src="https://img.shields.io/github/commit-activity/t/Ark0N/Codeman?style=flat-square&color=1e3a5f" alt="Total commits"></a>
-  <a href="https://github.com/NipunaRanasinghe/awesome-ai-agents"><img src="https://img.shields.io/badge/Featured_in-Awesome_AI_Agents-2ea44f?style=flat-square" alt="Featured in Awesome AI Agents"></a>
 </p>
 
 <p align="center">

README.zh-CN.md

@@ -8,6 +8,12 @@
   <em>Claude Code &bull; OpenCode &bull; Codex &bull; Antigravity &bull; Gemini &bull; Pi &bull; Grok &bull; DeepSeek &bull; OMP &bull; Copilot &bull; 终端 —— 统一仪表盘 &bull; 任意设备</em>
 </p>
 
+<p align="center">
+  <a href="https://github.com/Ark0N/Codeman/releases/latest/download/Codeman.dmg"><img src="https://img.shields.io/badge/%E4%B8%8B%E8%BD%BD_Mac_%E7%89%88-Codeman.dmg-2f6fe0?style=for-the-badge&logo=apple&logoColor=white&labelColor=000000" alt="下载 Mac 版 Codeman（Codeman.dmg）" width="281"></a>
+  <br>
+  <sub>原生 Mac 应用：已签名并经过 Apple 公证，支持 Apple 芯片和 Intel，macOS 11.3 或更高版本。<a href="#在-mac-上codeman-应用">它能做什么</a></sub>
+</p>
+
 <p align="center">
   <a href="README.md">English</a> &bull; <strong>简体中文</strong>
 </p>
@@ -21,7 +27,6 @@
   <a href="https://github.com/Ark0N/Codeman/stargazers"><img src="https://img.shields.io/github/stars/Ark0N/Codeman?style=flat-square&color=eab308" alt="GitHub stars"></a>
   <a href="https://github.com/Ark0N/Codeman/graphs/contributors"><img src="https://img.shields.io/github/contributors/Ark0N/Codeman?style=flat-square&color=3b82f6" alt="Contributors"></a>
   <a href="https://github.com/Ark0N/Codeman/commits/master"><img src="https://img.shields.io/github/commit-activity/t/Ark0N/Codeman?style=flat-square&color=1e3a5f" alt="Total commits"></a>
-  <a href="https://github.com/NipunaRanasinghe/awesome-ai-agents"><img src="https://img.shields.io/badge/Featured_in-Awesome_AI_Agents-2ea44f?style=flat-square" alt="Featured in Awesome AI Agents"></a>
 </p>
 
 <p align="center">

docs/api-reference.md

@@ -1716,7 +1716,7 @@ Only replies from `allowedUserIds`, in `guildId`, inside a thread the bridge cre
 
 ## Local model
 
-`GET /api/local-model` looks at the machine the server runs on and says which local coding model fits it, with which agent CLI, and where an install of one stands. Five verbs install a model, pause and continue the install, stop and start the model runtime, and remove everything again. It covers Apple silicon macOS only; anywhere else the GET is still a `200`, with verdict `none`, and nothing can be installed. How it works: [local-models.md](local-models.md).
+`GET /api/local-model` looks at the machine the server runs on and says which local coding model fits it, with which agent CLI, where an install of one stands and which models are on the machine. Seven verbs install a model (a first one, or another one beside it), switch to a model that is already there, pause and continue a job, stop and start the model runtime, delete one model, and remove everything again. It covers Apple silicon macOS only; anywhere else the GET is still a `200`, with verdict `none`, and nothing can be installed. How it works: [local-models.md](local-models.md).
 
 **Experimental.** These routes and their payloads are labeled experimental: the fields below, the states, the error codes and the sentences may change or go in a MINOR or PATCH release (see [versioning-policy.md](versioning-policy.md), "What SemVer does NOT cover", item 3). Do not build on their shape yet.
 
@@ -1725,11 +1725,13 @@ Every route is admin only in multi-user mode (`403 FORBIDDEN`, answered before a
 | Method   | Path                       | Body                                             | Notes                                                                                                                                                                                                                                                  |
 | -------- | -------------------------- | ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | `GET`    | `/api/local-model`         | none                                             | `200` with `{ hardware, recommendation, catalogUpdated, install }`. `500 INTERNAL_ERROR` only when the recommendation itself fails, never for a failed probe.                                                                                             |
-| `POST`   | `/api/local-model/install` | `{ modelId, cli, context, acknowledgedBytes }`   | Starts the one install job and answers at once; the job runs on in the server. `400 INVALID_INPUT` when the three choices are not a row the server offers right now. `409`: `job-running`, `already-installed`, `size-changed`.                         |
+| `POST`   | `/api/local-model/install` | `{ modelId, cli, context, acknowledgedBytes }`   | Starts the one install job and answers at once; the job runs on in the server. With a model installed it adds another one: the earlier model stays on disk, and the new one is the model in use when the job ends. `400 INVALID_INPUT` when the three choices are not a row the server offers right now. `409`: `job-running`, `already-installed` (this model at this context is the one in use), `size-changed`, `sessions-open`. |
+| `POST`   | `/api/local-model/use`     | `{ modelId }`                                    | Switches to a model of `install.library` whose `actions` list `use`. A job of the two steps `verify` and `connect`; nothing is downloaded. `400 INVALID_INPUT` when the model is not a checked model of the library, or no coding agent for it is installed. `409`: `job-running`, `wrong-state` (nothing is installed), `already-installed`, `sessions-open`. |
 | `POST`   | `/api/local-model/cancel`  | none                                             | Interrupts the step in flight; the job is `paused` at that step. `409 wrong-state` when no job is running.                                                                                                                                                |
 | `POST`   | `/api/local-model/resume`  | `{ newPort? }` (may be absent)                   | Continues a `paused` or `failed` job at the same step. `newPort: true` chooses another port first. `409`: `job-running`, `wrong-state`, `sessions-open` (`newPort` while live sessions use the model).                                                  |
 | `POST`   | `/api/local-model/runtime` | `{ action: "start" \| "stop", newPort? }`        | `stop` stops the runtime and keeps it from starting at the next boot; `start` undoes that. `newPort: true` with `start` chooses another port and moves the saved endpoint to it. `409`: `job-running`, `wrong-state` (nothing is installed), `sessions-open` (`stop` or `newPort` while live sessions use the model: their agents keep calling the address they were started with). |
-| `DELETE` | `/api/local-model`         | `{ removeModel? }` (may be absent)               | Stops the runtime, removes the saved endpoint, restores the settings flag when this feature switched it on and no other endpoint is saved, deletes the runtime; the model only with `removeModel: true`. `409`: `job-running`, `sessions-open`.        |
+| `DELETE` | `/api/local-model`         | `{ removeModel? }` (may be absent)               | Stops the runtime, removes the saved endpoint, restores the settings flag when this feature switched it on and no other endpoint is saved, deletes the runtime; the downloaded models (all of them) only with `removeModel: true`. With nothing installed it is what deletes the models an earlier Remove kept. `409`: `job-running`, `sessions-open`. |
+| `DELETE` | `/api/local-model/models`  | `{ modelId }`                                    | Deletes ONE model from the store, through the runtime. `modelId` is a model name (`name:tag`) of `install.library` whose `actions` list `delete`, never a path. `400 INVALID_INPUT` for a name that is not on this machine. `409`: `job-running`, `wrong-state` (nothing is installed), `model-active` (the model of the installation or of the current job), `runtime-not-running`. `500 OPERATION_FAILED` when the runtime did not delete it. |
 
 Every verb answers `{ success: true, data: <install> }` with the `install` object (below) as it is after the verb. A refusal the feature names is a `409` whose envelope also carries the conflict:
 
@@ -1747,9 +1749,9 @@ Every verb answers `{ success: true, data: <install> }` with the `install` objec
 }
 ```
 
-`data.reason` is `job-running`, `already-installed` (remove the installed model first), `size-changed` (with `expectedBytes` and `expectedGb`), `sessions-open` (with `sessions`, the names of the live sessions that use the model) or `wrong-state`. A `409 CONFLICT` without `data` means a config file that must not be overwritten (`settings.json` or `custom-model-hosts.json` does not parse); `error` names the fix.
+`data.reason` is `job-running`, `already-installed` (the model is the one in use already), `size-changed` (with `expectedBytes` and `expectedGb`), `sessions-open` (with `sessions`, the names of the live sessions that use the model), `wrong-state`, `model-active` (a delete of the model in use: switch first, or remove everything) or `runtime-not-running` (a delete while the runtime is down: start it first). A `409 CONFLICT` without `data` means a config file that must not be overwritten (`settings.json` or `custom-model-hosts.json` does not parse); `error` names the fix.
 
-`POST /api/local-model/install` also answers `400` when a saved model endpoint already uses the id `local-ollama` and was not created by this feature: rename or delete that endpoint first. The check is made before anything is downloaded. Every `400` the install names, and the `507 OPERATION_FAILED` of a first install on a full disk, carries its sentence as `data.message` (`{ text, vars }`, like a `409`), so a client can print it in its own language.
+`POST /api/local-model/install` also answers `400` when a saved model endpoint already uses the id `local-ollama` and was not created by this feature: rename or delete that endpoint first. The check is made before anything is downloaded. Every `400` the feature names, the `507 OPERATION_FAILED` of a first install on a full disk and the `500 OPERATION_FAILED` of a delete the runtime refused carry their sentence as `data.message` (`{ text, vars }`, like a `409`), so a client can print it in its own language.
 
 **Consent is bound to the size shown.** `acknowledgedBytes` must be the `installBytes` of the chosen row: the model download plus the runtime download while the runtime is not unpacked yet. The server compares it with its own total before anything starts and answers `409 size-changed` when they differ, so a click confirms exactly the size the person saw.
 
@@ -1775,12 +1777,13 @@ A probe that fails is an answer, not an error: a server that is not on macOS, or
     - `tag?`: `{ kind, label }`, the one tag of the row. `kind` is `tested`, `best`, `tight`, `slow` or `small`;
     - `fit`: `good` (up to 0.85 of the budget) or `tight` (up to 0.98), with its label `fitLabel`;
     - `speed`: `ok`, `slow` (under 10 tokens per second) or `unknown`, with `speedLabel` (absent for `ok`) and `tokensPerSecond` (rounded to one decimal, absent for `unknown`; `speed` is decided on the unrounded figure, so `10` can be `slow`). `unknown` means the chip is in no row of the catalogue's chip table, or the catalogue has no speed figure for the model: a speed is never guessed;
-    - `tested`: we ran this model with this CLI on a Mac like this one (same chip, same memory size). Its `tokensPerSecond` is then the speed measured in that run.
+    - `tested`: we ran this model with this CLI on a Mac like this one (same chip, same memory size). Its `tokensPerSecond` is then the speed measured in that run;
+    - `library?`: the model at this context is a checked model on this machine already (see `install.library`). `active`: it is the model in use. `ready`: `POST /api/local-model/use` switches to it, and nothing is downloaded. Absent otherwise.
   - `budgetBytes` and `budgetGb`: the memory a model may use on this Mac (`0` for `not-macos` and `intel`, where none is computed). `budgetSource` is `estimated` (computed from the installed memory: all there is before the runtime ran), `wired-limit` (taken from `iogpu.wired_limit_mb`) or `measured` (the device total the runtime itself printed when it started; the GET uses it from the first install on).
 - `catalogUpdated`: ISO date on which the catalogue's rows were last checked.
 - `install`: where the install stands and what can be done about it.
   - `state`: `idle` (nothing installed, no job), `installing`, `paused` (Cancel or a server restart stopped the job; it never continues without a click), `failed` or `installed`.
-  - `step` and `steps[]` (present with `installing`, `paused` and `failed`): the step the job is in or stopped in, and the steps of this job in order, out of `runtime`, `model`, `verify`, `agent`, `connect`. `agent` is absent from a job whose agent CLI was already installed.
+  - `step` and `steps[]` (present with `installing`, `paused` and `failed`): the step the job is in or stopped in, and the steps of this job in order, out of `runtime`, `model`, `verify`, `agent`, `connect`. `agent` is absent from a job whose agent CLI was already installed. A switch (`POST .../use`) is the two steps `verify` and `connect`.
   - `progress` (while a download runs, and as it stood on a paused or failed job): `completedBytes`, `totalBytes`, `completedGb`, `totalGb`, and while it moves `bytesPerSecond`, `mbPerSecond` (whole decimal megabytes per second as text) and `secondsLeft`. During the `model` step both byte figures come from the download's own lines, not from the catalogue.
   - `error` (with `failed`; with `installed` only when something blocks a session): `{ code, message: { text, vars? }, next, nextModel?, detail? }`. `next` is the ONE action that helps: `retry` (`POST .../resume`), `other-port` (`POST .../resume` or `.../runtime` with `newPort: true`), `next-model` (choose again; `nextModel` is `{ modelId, modelLabel }` when the server knows one), `start` (`POST .../runtime`) or `remove` (`DELETE`). `detail` is raw text for the curious (an installer's last lines), not translated.
   - `model` (`{ id, label }`), `cli`, `cliLabel`, `context`: the choice of the job or of the installation. `port`: the runtime's loopback port, once chosen.
@@ -1790,7 +1793,9 @@ A probe that fails is an answer, not an error: a server that is not on macOS, or
   - `developerTools`: `present`, `missing` (the Mac has no Xcode or Command Line Tools, so macOS will offer to install them the first time an agent runs `git` or `python3`) or `unknown`.
   - `runtime`: `{ version, installed, downloadBytes, downloadGb, unpackedGb }`. `downloadBytes` is `0` once the runtime is unpacked.
   - `folder`: the absolute folder everything of this feature is kept in.
-  - `actions[]`: exactly what the server accepts right now, out of `install`, `cancel`, `resume`, `start`, `stop`, `remove` and `start-session` (not a route here: start a session on `endpointId`; offered only while the runtime runs and nothing blocks a session).
+  - `library[]`: the models on this machine, the model in use first. Empty with `idle` (no runtime is there to ask). Each row: `id` (the name the runtime lists, `name:tag`), `label`, `context?` (the context it was checked with), `sizeBytes?` and `sizeGb?` (its size on disk as the runtime reports it, else as recorded when it was checked), `active` (it is the model in use), `verified` (Codeman checked it), `status` and `actions[]`. `status` is `ready`, `changed` (checked, and the runtime now reports another digest under the name), `missing` (checked, and the runtime no longer lists it) or `unverified` (the runtime lists it and Codeman never checked it: a model an earlier Remove kept, the model of a job that has not passed its check, or one another program pulled through the runtime's port). `actions` is what the server accepts for THAT row right now, out of `use` and `delete`; `delete` needs the running runtime, and a name that is not a plain `name:tag` is listed with no action.
+  - `store?`: `{ bytes, gb }`, what the model store takes on disk (the files of its blob folder, so shared layers count once and an interrupted download is included). Present in every state once it was measured; cached for about thirty seconds.
+  - `actions[]`: exactly what the server accepts right now, out of `install` (with `installed`: add another model), `cancel`, `resume`, `start`, `stop`, `remove` (with `idle` only while `store` holds something), `use` and `delete-model` (only while a row of `library` offers them) and `start-session` (not a route here: start a session on `endpointId`; offered only while the runtime runs and nothing blocks a session).
 
 Error codes (`install.error.code`), each with one next step:
 
@@ -1800,9 +1805,11 @@ Error codes (`install.error.code`), each with one next step:
 | `start`      | `runtime-stopped` (the runtime crashed three times in a row and is no longer restarted)                                                                                                                                                 |
 | `other-port` | `port-in-use`                                                                                                                                                                                                                           |
 | `next-model` | `model-not-found`, `does-not-fit`, `no-tool-call`                                                                                                                                                                                       |
-| `remove`     | `model-changed` (the model's digest is no longer the one stored at install time; a session on it is refused)                                                                                                                            |
+| `remove`     | `model-changed` (the model's digest is no longer the one stored when it was checked; a session on it is refused, and so is a switch to it)                                                                                              |
 
-Starting a session on the saved endpoint goes through the existing custom model launch (`POST /api/quick-start` with `customModel`, or `POST /api/sessions/:id/custom-model`). For the endpoint this feature manages both answer `OPERATION_FAILED` with one sentence while the runtime is not running, when the model's digest changed, or for a model other than the installed one.
+Two codes are only ever the reason of a refused session start, never on `install.error`: `runtime-not-running` (the person stopped the runtime) and `job-unfinished` (a job that changes the model in use is running or stopped: nothing is started until it ended `installed` again).
+
+Starting a session on the saved endpoint goes through the existing custom model launch (`POST /api/quick-start` with `customModel`, or `POST /api/sessions/:id/custom-model`). For the endpoint this feature manages both answer `OPERATION_FAILED` with one sentence while the runtime is not running, while a job that changes the model in use is running or stopped, when the model's digest changed, or for a model other than the one in use.
 
 Every computed size a person reads travels twice: as bytes, and as decimal GB text without the unit (`"needGb": "29.6"`). Show the text and add the unit; do not divide the bytes yourself, so one request never shows two different roundings. The installed memory is the exception named above: show `memClassGb`.
 

docs/architecture-invariants.md

@@ -720,11 +720,19 @@ Either way the actual launch (`runCustomModelEntry`) routes through `run()` itse
 
 **Remove** stops the child, undoes the connection FIRST (a refused write of the endpoint store or of the settings rejects before any file is deleted), restores the flag only when this feature switched it on AND no other endpoint is saved, then deletes the runtime and the private home and, when asked, the models (`removeLocalModelFiles()`, which refuses any path outside the root). ⚠️ While a live session uses the endpoint the answer is 409 `sessions-open` with the session names (`sessionNamesUsingEndpoint()`, read at the moment of the request). ⚠️ The coding agent stays: what its installer wrote is not ours to remove.
 
+**The library** (one model in use, several on disk). `LocalModelStateFile.library` lists every model that PASSED the check through Codeman: `{ id, label, context, digest, bytes?, cli?, verifiedAt? }`, no path. The service upserts the entry as a fact when `verify` passes (where it stores the digest); the reducer only carries the list, through every event but `remove`. An `installed` file an earlier build wrote has no list: `libraryOf()` then counts its one model, and an install or a switch from it writes that model into the list before the state's `model` member becomes the new job's. ⚠️ ONE model is in use: the endpoint record still lists exactly one model, the runtime still holds one (`OLLAMA_MAX_LOADED_MODELS=1`), and `launchRefusalMessage()` still starts only the state's model with its stored digest. Never widen the record to "every checked model": the port has no login, and two sessions on two models would make the runtime swap 20 GB on every request.
+
+⚠️ Three verbs, each a row of the tables and never a special case. **Add**: `install` is also listed for `installed` in `INSTALL_TRANSITIONS`; the job is the same five steps, and the earlier model stays (the `replacedModelId` rule, `replacedModelFor()`, never names a model of the library: only an unchecked or partial download is deleted as a leftover). **Switch**: the event `use` (`installed`, `paused`, `failed`) starts a job of `USE_JOB_STEPS` (`verify`, `connect`) for a library entry, carrying its stored digest in `model.digest`; `stepVerify` compares that digest BEFORE it loads anything and again after the check, and a different or missing one fails with `model-changed`. A switch has no `model` step, so the leftovers of the job it replaced are deleted at the start of `verify` (`dropReplacedModel()`). Its coding agent is the entry's own when that is installed now, else the state's (`recheckCliInstalled()`), else a 400: a job that stopped while it installed another agent leaves the state naming one that is not there. **Delete** (`deleteLibraryModel()`) moves no state, so it is not an event; whether a state allows it is the `delete-model` action of its `INSTALL_STATE_TABLE` row. It takes a model NAME (the request schema and the service both hold it to `LOCAL_MODEL_ID_PATTERN`), requires that name in the server's own listing (the library or the runtime's tags), goes through the runtime's `/api/delete` only (never a file delete, never a path), and trusts only the runtime's answer that the model is gone, never an empty listing. ⚠️ It refuses the model of the installation or of the current job (`model-active`), a running job, and a runtime that is down or does not answer (`runtime-not-running`).
+
+⚠️ `install` from `installed` and `use` are refused with 409 `sessions-open` while live sessions use the endpoint, like Stop: both change which model the runtime holds and often restart it for another context. ⚠️ While a job that started from `installed` is unfinished (`installing`, `paused`, `failed`) the launch check refuses every start with `job-unfinished` (a code only a refused start says, like `runtime-not-running`), because it wants the state `installed`; the view then offers `use` on the other checked models, which is the way back. A switch is never offered for the model of the stopped job itself: Resume goes on with that one. ⚠️ Both verbs undo a Stop (`undoStop()`, `runtime.enabled` back to true) once their job started: the job runs the runtime, and a model that is in use and running must also start with the server again.
+
+**The view's two listings.** `install.library` (`buildLibraryRows()`, pure) joins the state's entries with what the RUNNING runtime lists (`/api/tags`): `ready`, `changed` (another digest under the name), `missing` (no longer listed) for a checked model, `unverified` for anything else the runtime lists (a model an earlier Remove kept, the model of a job that has not passed its check, one another program pulled through the unauthenticated port), which can be deleted and never switched to. A name that is not a plain `name:tag` is listed with no action. `install.store` is `measureModelStore()`: the sizes of the regular files directly in `models/blobs`, nothing followed, nothing outside the root. ⚠️ Neither is asked for on the one-second poll: `tagsCache` (5 s) and `storeCache` (30 s) are refreshed in the background, only a figure that was never read is waited for (300 ms at most), a runtime that does not answer keeps the last list (or every checked model would read as `missing` for a moment), and every verb and finished step that changes the store throws both away (`forgetStore()`). ⚠️ In `idle` there is no runtime to ask, so the list is empty and only `store` says that an earlier Remove kept models; `remove` is listed there only while it holds something, and `DELETE /api/local-model { removeModel: true }` is what frees it. `Candidate.library` (`active`, `ready`) is added by the ROUTE (`markLibraryCandidates()`), never by `recommend()`, which stays pure and knows nothing of what is installed.
+
 **Developer tools**: `checkDeveloperTools()` runs ONLY `/usr/bin/xcode-select -p`, bounded, on darwin. ⚠️ Never `git`, `python3` or `xcrun` from the server: on a Mac without the tools each opens a system window. The view carries `developerTools`, and the window prints the one sentence when it is `missing`.
 
 **The endpoint store's writer** (`src/custom-model-hosts-writer.ts`): `mutateCustomModelHosts(fn)` is the shape of `mutateSettingsFile()`: one promise chain, a random temp name, a refusal (409) to write over a file that does not parse. ⚠️ EVERY writer of `custom-model-hosts.json` goes through it: the four endpoint routes, the sweep and the connect step (`test/custom-model-hosts-writer.test.ts` fails a `writeCustomModelHosts()` call anywhere else in `src/`). The routes used to read, change and write on their own through one shared temp name, so two creates sent together lost a record or failed, and a file that did not parse was read as `[]` and replaced by one record, with every other endpoint's API key gone. ⚠️ A route's check runs INSIDE the callback, and discover splices onto the record as it is after the probe, not the copy read before it.
 
-Tests: `test/local-model-install-job.test.ts` (the tables and the reducer, every state with every event), `test/local-model-install-service.test.ts`, `test/local-model-install-e2e.test.ts` (the real modules over the fake runtime), `test/local-model-state-store.test.ts`, `test/local-model-connect.test.ts`, `test/custom-model-hosts-writer.test.ts`, `test/cli-install-runner.test.ts`, `test/routes/local-model-routes.test.ts`, `test/routes/local-model-launch-guard.test.ts`, and the runtime's own `test/local-model-runtime.test.ts`, `test/local-model-ollama-client.test.ts`. The fake runtime is `test/fixtures/fake-ollama.ts`.
+Tests: `test/local-model-install-job.test.ts` (the tables and the reducer, every state with every event, the library rows), `test/local-model-install-service.test.ts` (the three library verbs and the two caches included), `test/local-model-install-e2e.test.ts` (the real modules over the fake runtime: install A, add B, switch back, delete B), `test/local-model-state-store.test.ts`, `test/local-model-connect.test.ts`, `test/custom-model-hosts-writer.test.ts`, `test/cli-install-runner.test.ts`, `test/routes/local-model-routes.test.ts`, `test/routes/local-model-launch-guard.test.ts`, and the runtime's own `test/local-model-runtime.test.ts`, `test/local-model-ollama-client.test.ts`. The fake runtime is `test/fixtures/fake-ollama.ts`.
 
 ### Approvals Inbox
 

docs/local-models.md

@@ -4,7 +4,9 @@ Codeman can set up a coding model that runs on the Mac the server runs on: no ac
 no API key, and the session's prompts and files go to a model on this Mac rather than a
 cloud provider (the coding agent itself may still check for updates). One button on the welcome screen opens a window that
 shows what fits this Mac, installs the choice and ends on a coding agent session that
-runs on it.
+runs on it. The same window then lists the models that are on this Mac with what each takes
+on disk, adds another one, switches between them and deletes one
+([The models on this Mac](#the-models-on-this-mac)).
 
 **Experimental.** The routes and their payloads may change in any release
 ([versioning-policy.md](versioning-policy.md), "Experimental local model routes"). Apple
@@ -103,7 +105,9 @@ for a row it does not know. Its answer for each memory size is then pinned in
 ## What an install does, in order
 
 The person picks a model, presses "Install on this Mac" and confirms the sizes once. The
-server then runs one job of five steps. The window polls `GET /api/local-model` once a
+server then runs one job of five steps. The same job adds a second model to an installed one
+("Add a model"): the runtime is there already, so it downloads the model alone, and the
+earlier model stays on disk. The window polls `GET /api/local-model` once a
 second; the job runs in the server, so the window can be closed.
 
 | Step      | What it does                                                                                                                                              |
@@ -244,10 +248,13 @@ Switching the setting on also starts that five-minute sweep for every other save
 existing custom model launch. Before a coding agent is STARTED on that endpoint the server
 checks, in this order:
 
+- no job that changes the model in use is running or stopped: until an install or a switch
+  ended, nothing is started ("The model on this Mac is being changed and is not ready");
 - the runtime child Codeman started is alive (whatever else answers on the port is not
   ours);
-- the digest the runtime reports for the installed model is the one stored at install time;
-- the model asked for is the one that was installed and checked.
+- the digest the runtime reports for the model in use is the one stored when it was checked;
+- the model asked for is the model in use. Another model that is on this Mac is not started
+  on the endpoint: switch to it in the window first.
 
 That check runs wherever a new agent process comes to be on the endpoint: a session created
 with the model, a model applied to a running session (which restarts its agent), the attach
@@ -273,22 +280,76 @@ answer back from a file it writes in its own folder. The skill never installs a
 answers a confirmation, the runtime still answers one request at a time, and while a worker it
 opened is live, Stop and Remove are refused until it is closed.
 
+## The models on this Mac
+
+The model store can hold several models. **One of them is the model in use**: the one the
+endpoint record `local-ollama` lists, the runtime is started for and a session can be
+started on. The runtime holds one model in memory at a time (`OLLAMA_MAX_LOADED_MODELS=1`),
+so this is what the Mac can really do, and it keeps every rule above: one record, one
+model, one stored digest per model.
+
+The installed screen lists what is on this Mac, the model in use first:
+
+| A row says    | It means                                                                                                                                                              |
+| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| In use        | The model sessions start on                                                                                                                                           |
+| Ready         | Codeman downloaded and checked it. **Use** switches to it                                                                                                             |
+| Not checked   | The runtime lists it and Codeman never checked it: a model an earlier Remove kept, or one another program pulled through the runtime's port. It can only be deleted   |
+| Changed       | It was checked, and the runtime now reports another digest under its name. It is never started; delete it and install it again                                        |
+| Missing       | It was checked, and the runtime no longer lists it. **Delete** drops the entry                                                                                        |
+
+Each row shows the context the model was checked with and its size on disk, as the runtime
+reports it. Under the list is what all downloads take together: the size of the files in
+`local-model/models/blobs`, so layers two models share are counted once and an interrupted
+download is included. The window asks the runtime for the list at most every five seconds
+and measures the store at most every thirty, never on every poll.
+
+- **Add a model** opens the chooser. A model that is not on this Mac is installed like the
+  first one, with its sizes confirmed; when the job ends it is the model in use, and the
+  earlier model stays in the list. A row that is on this Mac already says so and is switched
+  to, without a download and without a confirm screen.
+- **Use** switches to a checked model. It is a job of two steps, `verify` and `connect`:
+  the runtime is restarted with the context the model was checked with, the model is loaded
+  and checked again (the tiny chat, the GPU, the tool probe), its digest must still be the
+  stored one (else the switch fails with `model-changed` before the model is loaded), and
+  the endpoint record is rewritten. The coding agent is the one the model was checked with
+  when it is still installed, else the one of the installation.
+- **Delete** removes one model through the runtime's own delete, after one question in the
+  row. The request carries the model's name, never a path, and the server deletes only a
+  name of its own listing. The model in use cannot be deleted: switch first, or Remove. It
+  needs the running runtime, so a stopped model shows no Delete until Start.
+
+Adding a model and switching are refused while a session uses the model ("Sessions are
+still using this model"), like Stop: their coding agents were started with the other model's
+name, and the runtime would swap models on every request.
+
+While a job that started from an installed model runs, or after it stopped (paused or
+failed), no session is started: the checks above want a finished installation, and the
+refusal says so (`job-unfinished`). The window
+then lists the checked models with **Use**, which is the way back to the earlier one. Going
+back deletes what the stopped job left of a model that never passed its check, the way a new
+install does; a checked model is never deleted that way.
+
 ## Stop, Start, Remove
 
 - **Stop** stops the runtime and keeps it from starting at the next boot. **Start** undoes
-  that.
+  that, and so does a switch to another model or the install of one: the job starts the
+  runtime, and the model it ends on is in use.
 - **Remove** stops the runtime, removes the endpoint record, switches the setting off again
   only when this feature switched it on and no other endpoint is saved, and deletes the
-  runtime and its private home. The downloaded model is deleted only when asked. The coding
-  agent stays. While a live session uses the model, Remove answers with the session names
-  instead.
+  runtime and its private home. The downloaded models (all of them) are deleted only when
+  asked. The coding agent stays. While a live session uses the model, Remove answers with
+  the session names instead.
+- **Models a Remove kept** are not lost space: with nothing installed the window says how
+  much they still take and offers "Delete them", and after a new install they show in the
+  list as "Not checked", each with its own Delete.
 
 ## Where everything is
 
 All under the data directory (`~/.codeman`, or the instance's own):
 
 ```
-local-model.json                           the state file (mode 0600)
+local-model.json                           the state file (mode 0600), with the list of checked models
 local-model/
   runtime/ollama-0.40.15.tgz.partial       the runtime archive while it downloads
   runtime/ollama-0.40.15/                  the unpacked runtime (about 579 MB)
@@ -313,9 +374,12 @@ in App Settings.
 | ------------ | ------------------------------------------------------------- | ---------------- | -------------------------------------- |
 | `idle`       | stays idle                                                    | refused          | install                                |
 | `installing` | becomes `paused` at the same step                             | becomes `paused` | cancel                                 |
-| `paused`     | stays paused                                                  | refused          | resume, install, remove                |
-| `failed`     | stays failed, same error                                      | refused          | resume, install, remove                |
-| `installed`  | stays installed; the runtime is started unless it was stopped | refused          | start a session, stop or start, remove |
+| `paused`     | stays paused                                                  | refused          | resume, install, use, delete a model, remove |
+| `failed`     | stays failed, same error                                      | refused          | resume, install, use, delete a model, remove |
+| `installed`  | stays installed; the runtime is started unless it was stopped | refused          | start a session, stop or start, install (add a model), use, delete a model, remove |
+
+`use` and "delete a model" are listed only while a row of the list offers them, and in
+`idle` "remove" is offered only while the model store still holds something.
 
 One job at a time. A job a server restart interrupted comes back paused and never continues
 without a click. Cancel interrupts the step in flight (the download, the pull, the request,
@@ -357,6 +421,12 @@ or `python3`.
   on a Mac. "Recommended" appears only for the pair we ran, on the Mac we ran it on.
 - **The model stays in memory for ten minutes** after the last request, then the runtime
   unloads it.
+- **One model runs at a time.** Several can be on disk; the runtime holds one, and a switch
+  restarts it and loads the other model (seconds to a minute). Close the sessions on the
+  model first: the window refuses the switch while one is open.
+- **The disk figures are the runtime's.** A row's size is what the runtime reports for the
+  model, and the total is the size of its blob files. Neither was compared with Finder on a
+  Mac yet.
 
 ## Keeping the catalogue current
 

docs/wiki/Custom-Model-Endpoints.md

@@ -234,6 +234,11 @@ Good to know:
   but it is changed and removed in the local model window, not here.
 - Codeman starts the runtime with the server and stops it with it. **Stop** keeps it from
   starting next time.
+- More than one model can be on the Mac, and one of them runs at a time. Once a model is
+  installed the window lists the models with what each takes on disk: **Add a model**
+  downloads another one, **Use** switches to a model that is already there (nothing is
+  downloaded; close the sessions on the model first), and **Delete** removes one, after one
+  question. The model in use cannot be deleted: switch first, or use **Remove**.
 - **Remove** deletes the runtime and the endpoint, and the model too if you tick that. The
   coding agent stays installed.
 - If the model on disk is no longer the one that was installed, Codeman refuses to start a

packages/desktop/Cargo.lock

@@ -37,12 +37,6 @@ version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
-[[package]]
-name = "base64"
-version = "0.22.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
-
 [[package]]
 name = "base64"
 version = "0.23.1"
@@ -161,9 +155,9 @@ checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
 name = "codeman-desktop"
 version = "0.1.0"
 dependencies = [
- "base64 0.22.1",
+ "base64",
  "block2",
- "dirs 6.0.0",
+ "dirs",
  "libc",
  "muda",
  "objc2",
@@ -353,15 +347,6 @@ dependencies = [
  "crypto-common",
 ]
 
-[[package]]
-name = "dirs"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
-dependencies = [
- "dirs-sys",
-]
-
 [[package]]
 name = "dirs"
 version = "7.0.0"
@@ -2460,7 +2445,7 @@ version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cde93ff05758a36a851a398a772b0b79a82fbe3c186a46f2696baaeaf84c966b"
 dependencies = [
- "base64 0.23.1",
+ "base64",
  "flate2",
  "log",
  "percent-encoding",
@@ -2478,7 +2463,7 @@ version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841583fc36089d7d59419568ae157f43a5a03a2e5a81ba87c77d1596ef46e922"
 dependencies = [
- "base64 0.23.1",
+ "base64",
  "http",
  "httparse",
  "log",
@@ -2981,11 +2966,11 @@ version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "759c50ddad0ef9913bb5496cb9d509a50433a3b78cb0238d61105526589cf0e9"
 dependencies = [
- "base64 0.23.1",
+ "base64",
  "block2",
  "cookie",
  "crossbeam-channel",
- "dirs 7.0.0",
+ "dirs",
  "dom_query",
  "dpi",
  "dunce",

packages/desktop/Cargo.toml

@@ -22,8 +22,10 @@ muda = "0.21"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 url = "2"
-base64 = "0.22"
-dirs = "6"
+# The versions ureq and wry already pull in, so neither crate is built twice
+# (ureq builds base64 without its default SIMD engines, and so do we).
+base64 = { version = "0.23", default-features = false, features = ["std"] }
+dirs = "7"
 # The reachability probe. platform-verifier = the OS trust store, the same one
 # WKWebView uses, so the probe and the window agree on which certificates pass.
 ureq = { version = "3", features = ["platform-verifier"] }

packages/desktop/README.md

@@ -9,7 +9,7 @@ macOS first: the app runs on 11.3 or later, and Codeman's own page needs the
 WebKit of Safari 16.4 (see Known limits). The same code is meant to build for
 Windows and Linux later.
 
-- **Size:** 4.6 MB for the universal `Codeman.app` (Apple Silicon + Intel), 3 MB as a `.dmg` (measured on the first build).
+- **Size:** 5.3 MB for the universal `Codeman.app` (Apple Silicon + Intel), 3.5 MB as a `.dmg` (measured 2026-11-09).
 - **Stack:** Rust with [tao](https://crates.io/crates/tao) (window and event loop),
   [wry](https://crates.io/crates/wry) (the system web view: WKWebView on macOS) and
   [muda](https://crates.io/crates/muda) (native menus), plus [objc2](https://crates.io/crates/objc2)
@@ -24,7 +24,7 @@ operating system's own web view. An Electron build of the same thing would ship
 a whole Chromium (around 150 MB). The native side only adds what a browser tab
 cannot do.
 
-## What it does (v0.1)
+## What it does
 
 | | |
 | --- | --- |
@@ -109,8 +109,9 @@ classes of wry's own delegates, so wry stays an unmodified crates.io dependency.
   base path, checked after decoding the path once, and which ones depends on
   who asks. `window.CodemanHost` (the app shell only) may open sessions,
   rendered HTML views, the raw, preview, attachment and folder file routes, the
-  path picker's preview and `api/download`. A `window.open` or `target=_blank` link, which WebKit passes
-  on from any frame without saying which, gets only the file routes and
+  path picker's preview and `api/download`. A `window.open` or `target=_blank`
+  link, which WebKit passes on from any frame without saying which, gets only
+  the file routes and
   `api/download`, the pages Codeman itself opens that way; otherwise a rendered
   HTML file could open copies of itself as top-level windows that pass for the
   app's own. Such a window does not take keyboard focus, and these windows
@@ -218,11 +219,12 @@ Codeman counts a request without valid credentials against its login rate
 limit (10 per IP, 15 minutes; a successful login resets the count), so the app
 never retries in a loop. A look at this Mac asks each Codeman server found
 here once; the app has a login only for the one at the usual address, so the
-others are asked without one. Once the server refuses the login in a challenge, the
-app sends it only once more, in the single probe that checks the refusal. If
-that probe is refused or rate limited, the connect screen comes back; the
-app does not send the refused login again. Keeping no copy of the login in WebKit has a cost here: after a server
-restart, each request that arrives without a cookie gets a 401 before the
+others are asked without one. Once the server refuses the login in a challenge,
+the app sends it only once more, in the single probe that checks the refusal.
+If that probe is refused or rate limited, the connect screen comes back; the
+app does not send the refused login again. Keeping no copy of the login in
+WebKit has a cost here: after a server restart, each request that arrives
+without a cookie gets a 401 before the
 login goes out, and those count until one succeeds. Many windows reconnecting
 at once can push a request past 10, and that request then fails with a 429
 instead of being answered. A refusal that lands while you are in another app
@@ -305,15 +307,15 @@ crosses, so the login is never on a command line.
   answers at the usual address). A password-protected one counts the
   look as a failed login, like any look at a server the app has no login for.
   *Check again* asks again.
-
 - **The logo blink rests on a private macOS interface.** Apple documents the
   setting, not the way the app reaches it, so a macOS update can take it away;
   the menu then disappears. Every change of the logo writes `LEBacklightMode`,
   from about once every two seconds (*Slow*, *Wink*) to about three times a
   second (*Fast*), which `corebrightnessd` keeps in root's preferences. The
-  setting is on or off, so these styles are rhythms of hard changes. After a blink
-  the key stays there rather than being absent as on a fresh Mac. That reads the same to macOS; `sudo defaults delete
-  com.apple.CoreBrightness LEBacklightMode` removes it. After a power cut in a
+  setting is on or off, so these styles are rhythms of hard changes. After a
+  blink the key stays there rather than being absent as on a fresh Mac. That
+  reads the same to macOS; `sudo defaults delete com.apple.CoreBrightness
+  LEBacklightMode` removes it. After a power cut in a
   dark phase the logo stays dark until the app next starts. `api/sessions` does
   not say which turns are Codeman's own, so with prompt-cache keep-warm on, a
   keep-alive turn blinks too.
@@ -335,16 +337,16 @@ crosses, so the login is never on a command line.
   `SIGN_IDENTITY` (a self-made code-signing certificate from Keychain Access
   is enough). Microphone and camera permissions are asked again for the same
   reason.
-- **Gatekeeper.** Without a Developer ID the app is signed ad hoc. A build you
-  made yourself opens normally; a copy that arrived by download or AirDrop is
+- **Gatekeeper, for a build of your own.** The `Codeman.dmg` on each GitHub
+  release is signed with a Developer ID and notarized by CI
+  (`.github/workflows/desktop-dmg.yml`), so it opens like any downloaded app.
+  A build without a Developer ID is signed ad hoc: it opens normally on the Mac
+  that built it, while a copy that arrived by download or AirDrop is
   quarantined. On macOS 15 and later, try to open it once, then click *Open
   Anyway* in System Settings > Privacy & Security (it asks for an administrator
   password). On macOS 14 and earlier, right-click it and choose *Open* once.
   Either way, `xattr -dr com.apple.quarantine /Applications/Codeman.app` on the
-  copy in Applications works too. The `Codeman.dmg` on each GitHub release is
-  signed with a Developer ID and notarized by CI
-  (`.github/workflows/desktop-dmg.yml`), so it skips all of this. To do the
-  same by hand:
+  copy in Applications works too. To sign and notarize by hand:
   `SIGN_IDENTITY="Developer ID Application: ..." NOTARY_PROFILE=<profile> ./scripts/bundle-macos.sh --universal --notarize`,
   where `scripts/sign-macos.sh` lists what it needs.
 - **Local Network permission (macOS 15 and later).** The first connection to an

packages/desktop/assets/connect.html

@@ -53,7 +53,7 @@
     padding: 20px; box-shadow: 0 20px 60px rgba(0,0,0,0.45);
   }
   label.field { display: block; font-size: 12px; color: var(--muted); margin: 0 0 6px; }
-  input[type=text], input[type=password], input[type=url] {
+  input[type=text], input[type=password] {
     width: 100%; height: 38px; padding: 0 12px; border-radius: 9px;
     border: 1px solid var(--line-strong); background: #0c0d10; color: var(--text);
     font: inherit; outline: none; -webkit-user-select: text; user-select: text;
@@ -61,7 +61,6 @@
   input:focus { border-color: var(--accent-2); box-shadow: 0 0 0 3px rgba(59,130,246,0.25); }
   .row { display: flex; gap: 10px; }
   .row > * { flex: 1; }
-  .gap { height: 14px; }
   #recent { display: flex; flex-wrap: wrap; gap: 6px; margin-top: 10px; }
   #recent:empty { display: none; }
   .chip {
@@ -128,7 +127,7 @@
   /* The Codeman servers found on this Mac: a row each, in the look of a choice
      in the install, with the row's own Connect button. */
   #local-found-note { margin: 8px 0 0; }
-  #local-also { margin-top: 16px; padding-top: 14px; border-top: 1px solid var(--line); }
+  #local-also, #elsewhere { margin-top: 16px; padding-top: 14px; border-top: 1px solid var(--line); }
   #local-also-head { color: var(--muted); font-size: 12px; margin: 0 0 6px; }
   .found {
     display: flex; gap: 10px; align-items: center; padding: 9px 11px; border-radius: 9px;
@@ -139,7 +138,6 @@
   .found b { display: block; font-weight: 600; }
   .found small { display: block; margin-top: 1px; color: var(--muted); font-size: 12px; }
   .found button { flex: none; }
-  #elsewhere { margin-top: 16px; padding-top: 14px; border-top: 1px solid var(--line); }
   #elsewhere[hidden] { display: none; }
   #elsewhere summary { color: var(--muted); font-size: 13px; cursor: default; list-style: none; }
   #elsewhere summary::-webkit-details-marker { display: none; }
@@ -231,7 +229,6 @@
     border: 1px solid var(--line); color: #aab1bb; font: 11px/1.45 ui-monospace, SFMono-Regular, Menlo, monospace;
     white-space: pre-wrap; overflow-wrap: anywhere; -webkit-user-select: text; user-select: text;
   }
-  #wizard .actions .wiz-busy { display: inline-flex; align-items: center; gap: 8px; color: var(--muted); font-size: 13px; }
   footer { margin-top: 18px; text-align: center; color: var(--muted); font-size: 12px; }
   footer a { color: #aab1bb; text-decoration: none; cursor: default; }
   footer a:hover { color: var(--accent); }
@@ -416,9 +413,11 @@
   // suggestion: the address the suggest button connects to.
   // tab: 'local' (This Mac) or 'remote' (Another machine). askedFrom: the tab
   // the connect under way was asked from, where its answer belongs. local: the
-  // last This Mac status from the app. wait: set while an install runs in
-  // Terminal and this page polls for the server it brings up. gui: the
-  // graphical install while its screens are up (newWizard), null otherwise.
+  // last This Mac status from the app. wait: set while this page polls for the
+  // server an install brings up (one in Terminal, or a graphical one that
+  // finished; newWait). gui: the graphical install or the agent chooser while
+  // its screens are up (newWizard), null otherwise. clock: the timer of the
+  // running phase's clock.
   // reopen: a connect to this Mac was refused, so open it if it turns out to
   // be starting. startingLooks: how often the page has looked again at a
   // starting server. askedFound: the connect under way was asked from the row
@@ -427,7 +426,7 @@
     servers: [], busy: false, lastUrl: '', startUrl: '', suggestion: '',
     tab: 'local', askedFrom: 'local', askedFound: false, local: null, localChecking: false, opening: false,
     wait: null, waitTimer: 0, stoppedWaiting: false, gui: null, wantAgents: false,
-    reopen: false, startingLooks: 0, startingTimer: 0
+    reopen: false, startingLooks: 0, startingTimer: 0, clock: 0
   };
   // While an install runs: how often to look, how long a finished install may
   // take to answer before Start is offered, and when to stop looking.
@@ -511,14 +510,15 @@
     els.suggest.hidden = true;
   }
 
-  function host(url) {
+  function displayAddress(url) {
     try { var u = new URL(url); return u.host + (u.pathname === '/' ? '' : u.pathname.replace(/\/$/, '')); } catch (e) { return url; }
   }
 
   // The address as the app normalizes it (policy::normalize_server_url):
   // http:// by default, https:// for a .ts.net name without a port, no query
-  // or fragment, a trailing slash. Only used to tell whether two addresses
-  // are one server.
+  // or fragment, a trailing slash. Used to tell whether two addresses are one
+  // server, and which scheme and host a typed address ends up with
+  // (isLocalUrl, the http:// warning).
   function normalize(raw) {
     var s = String(raw || '').trim();
     if (!s) return '';
@@ -553,7 +553,7 @@
       chip.className = 'chip';
       var pick = document.createElement('button');
       pick.type = 'button';
-      pick.textContent = host(s.url) + (s.username ? '  (' + s.username + ')' : '');
+      pick.textContent = displayAddress(s.url) + (s.username ? '  (' + s.username + ')' : '');
       pick.title = 'Connect to ' + s.url;
       pick.addEventListener('click', function () {
         if (state.busy) return;
@@ -565,7 +565,7 @@
       x.className = 'x';
       x.textContent = '×';
       x.title = 'Forget this server' + (s.hasSavedPassword ? ' and its saved password' : '');
-      x.setAttribute('aria-label', 'Forget ' + host(s.url));
+      x.setAttribute('aria-label', 'Forget ' + displayAddress(s.url));
       x.addEventListener('click', function () { if (!state.busy) post({ cmd: 'forget', url: s.url }); });
       chip.appendChild(pick);
       chip.appendChild(x);
@@ -782,8 +782,11 @@
     return (s.found || []).filter(function (f) { return f && f.url !== s.url; });
   }
 
-  function canConnect(f) {
-    return f.state === 'running' || f.state === 'needsLogin';
+  // Codeman answers there, with or without a login, so the app can connect
+  // to it. Read the same way for a found server's row and for the This Mac
+  // status.
+  function answers(s) {
+    return s.state === 'running' || s.state === 'needsLogin';
   }
 
   // What a found server's row says under its address: its version, or why the
@@ -815,7 +818,7 @@
         text.appendChild(small);
       }
       row.appendChild(text);
-      if (canConnect(f)) {
+      if (answers(f)) {
         var button = document.createElement('button');
         button.type = 'button';
         button.className = primary ? 'primary' : 'secondary';
@@ -848,7 +851,7 @@
     } else if (!s) {
       dot = 'busy';
       title = 'Looking for Codeman on this Mac…';
-    } else if (s.installRunning && s.state !== 'running' && s.state !== 'needsLogin') {
+    } else if (s.installRunning && !answers(s)) {
       dot = 'busy';
       title = 'Codeman is being installed in Terminal.';
       detail = 'Finish the installer there, then Check again.';
@@ -861,7 +864,7 @@
     } else if (s.state === 'runningElsewhere') {
       // Not at the address the app opens by default: each one gets a row.
       main = (s.found || []).filter(Boolean);
-      dot = main.some(canConnect) ? 'ok' : 'warn';
+      dot = main.some(answers) ? 'ok' : 'warn';
       title = 'Codeman is already running on this Mac.';
       // No row: the app found the server's process, but no address to try.
       if (!main.length) {
@@ -869,16 +872,12 @@
           'Starting another server here would take over its sessions.';
       }
       show.check = true;
-    } else if (s.state === 'running') {
+    } else if (answers(s)) {
       dot = 'ok';
       title = 'Codeman is running on this Mac.';
-      detail = s.url + (s.version ? '  ·  version ' + s.version : '');
-      show.open = true;
-      also = otherServers(s);
-    } else if (s.state === 'needsLogin') {
-      dot = 'ok';
-      title = 'Codeman is running on this Mac.';
-      detail = s.url + ' asks for a login: Open asks for the password.';
+      detail = s.state === 'needsLogin'
+        ? s.url + ' asks for a login: Open asks for the password.'
+        : s.url + (s.version ? '  ·  version ' + s.version : '');
       show.open = true;
       also = otherServers(s);
     } else if (s.state === 'stopped') {
@@ -915,7 +914,7 @@
       if (o.kind === 'notCodeman') {
         title = 'Something else answers at ' + s.url;
         detail = 'It is not Codeman (HTTP ' + o.status + '). Stop what runs on that port, or connect to ' +
-          (also.some(canConnect) ? 'the Codeman listed below.' : 'Codeman’s real address under Another machine.');
+          (also.some(answers) ? 'the Codeman listed below.' : 'Codeman’s real address under Another machine.');
       } else {
         var e = explain[o.kind];
         title = e ? e[1] : 'Could not reach Codeman on this Mac.';
@@ -959,8 +958,8 @@
     }
     // An install from this app is still running (this page was shown again
     // while it ran): wait for it, unless the user stopped waiting.
-    if (!state.wait && s && s.installRunning && !s.installInApp && !state.stoppedWaiting && s.state !== 'running' && s.state !== 'needsLogin') {
-      state.wait = { since: Date.now(), finishedAt: 0, port: s.installPort || 3000 };
+    if (!state.wait && s && s.installRunning && !s.installInApp && !state.stoppedWaiting && !answers(s)) {
+      state.wait = newWait(s.installPort || 3000);
       renderLocal();
       scheduleWait();
     }
@@ -989,7 +988,7 @@
       }
       return false;
     }
-    var up = !!s && (s.state === 'running' || s.state === 'needsLogin');
+    var up = !!s && answers(s);
     var open = up && state.reopen && state.startingLooks > 0 && state.tab === 'local' && !state.busy;
     state.startingLooks = 0;
     state.reopen = false;
@@ -1041,10 +1040,15 @@
     var network = !!state.gui && state.gui.reach === 'network';
     closeWizard();
     selectTab('local');
+    openTerminal({ cmd: 'installLocal', network: network });
+  }
+
+  // Both Terminal installs: no second one while Terminal opens.
+  function openTerminal(msg) {
     state.opening = true;
     syncLocalButtons();
     setStatus('busy', 'Opening Terminal…');
-    post({ cmd: 'installLocal', network: network });
+    post(msg);
   }
 
   // mode 'install': Codeman itself. mode 'agent': one coding agent for a Mac
@@ -1056,17 +1060,22 @@
     };
   }
 
+  // The first screen of the graphical install ('install') or of adding an
+  // agent ('agent'), which asks the installer for its plan.
+  function prepareWizard(mode) {
+    state.gui = newWizard('preparing', mode);
+    post({ cmd: mode === 'agent' ? 'agentPrepare' : 'installPrepare' });
+  }
+
   function openWizard() {
     if (state.busy || tooOld || state.opening) return;
-    state.gui = newWizard('preparing');
-    post({ cmd: 'installPrepare' });
+    prepareWizard('install');
     renderWizard();
   }
 
   function openAgentChooser() {
     if (state.busy || tooOld || state.opening) return;
-    state.gui = newWizard('preparing', 'agent');
-    post({ cmd: 'agentPrepare' });
+    prepareWizard('agent');
     renderWizard();
   }
 
@@ -1086,14 +1095,14 @@
     renderLocal();
   }
 
+  // Try again keeps what was chosen.
   function retryWizard() {
-    var reach = state.gui ? state.gui.reach : 'local';
-    var agent = state.gui ? state.gui.agent : '';
-    var mode = state.gui ? state.gui.mode : 'install';
-    state.gui = newWizard('preparing', mode);
-    state.gui.reach = reach;
-    state.gui.agent = agent;
-    post({ cmd: mode === 'agent' ? 'agentPrepare' : 'installPrepare' });
+    var old = state.gui;
+    prepareWizard(old ? old.mode : 'install');
+    if (old) {
+      state.gui.reach = old.reach;
+      state.gui.agent = old.agent;
+    }
     renderWizard();
   }
 
@@ -1111,6 +1120,12 @@
     return offeredAgents().filter(function (c) { return c.id === id; })[0] || null;
   }
 
+  // This Mac has no coding agent and the installer offers one, so an install
+  // asks which one.
+  function needsAgent() {
+    return !installedAgents().length && offeredAgents().length > 0;
+  }
+
   // A run this page did not start has no plan, so no name for the agent.
   function agentName() {
     var c = agentById(state.gui.agent);
@@ -1129,7 +1144,7 @@
       g.step = 'agent';
     } else if (plan.blocker) {
       g.step = 'blocked';
-    } else if (!installedAgents().length && offeredAgents().length) {
+    } else if (needsAgent()) {
       // Kept across Try again; otherwise the first of the catalogue's order.
       if (!agentById(g.agent)) g.agent = offeredAgents()[0].id;
       g.step = 'agent';
@@ -1229,7 +1244,7 @@
     PHASES.forEach(function (id) {
       var label = {
         runtime: 'Getting Node.js and tmux',
-        agent: 'Installing ' + (chosen ? chosen.label : 'a coding agent'),
+        agent: 'Installing ' + agentName(),
         source: 'Downloading Codeman',
         packages: 'Installing packages',
         build: 'Building Codeman',
@@ -1313,21 +1328,14 @@
     if (!g) return;
     appendLog(msg.log);
     clearInterval(state.clock);
-    if (msg.ok && g.mode === 'agent') {
-      g.ok = true;
-      g.step = 'added';
-      renderWizard();
-      // Whether there is a Codeman to open from here.
-      checkLocal('quick');
-      return;
-    }
     if (msg.ok) {
       g.ok = true;
-      g.step = 'finishing';
+      g.step = g.mode === 'agent' ? 'added' : 'finishing';
       renderWizard();
-      // The same watch as a Terminal install: it opens Codeman at the first
-      // answer, and offers Start when none comes.
-      state.wait = { since: Date.now(), finishedAt: 0, port: g.port };
+      // An install gets the same watch as a Terminal install: it opens Codeman
+      // at the first answer, and offers Start when none comes. An added agent
+      // only asks whether there is a Codeman to open from here.
+      if (g.mode !== 'agent') state.wait = newWait(g.port);
       checkLocal('quick');
       return;
     }
@@ -1346,7 +1354,8 @@
     renderLog();
   }
 
-  // Each screen of the graphical install, drawn from state.gui alone.
+  // Each screen of the graphical install and of adding an agent, drawn from
+  // state.gui (and state.local for Open Codeman).
   function renderWizard() {
     var g = state.gui;
     els.card.classList.toggle('wizard-on', !!g);
@@ -1418,10 +1427,6 @@
     else els.wizTitle.focus();
   }
 
-  function localAnswers() {
-    return !!state.local && (state.local.state === 'running' || state.local.state === 'needsLogin');
-  }
-
   function renderWizardButtons() {
     var g = state.gui;
     var step = g.step;
@@ -1430,7 +1435,7 @@
     var next = {
       agent: agentMode ? (chosen ? 'Install ' + chosen.label : '') : 'Continue',
       reach: 'Install Codeman', failed: 'Try again', prepareFailed: 'Try again', blocked: 'Install in Terminal',
-      ready: 'Open Codeman', added: localAnswers() ? 'Open Codeman' : ''
+      ready: 'Open Codeman', added: state.local && answers(state.local) ? 'Open Codeman' : ''
     }[step];
     els.wizNext.hidden = !next;
     els.wizNext.textContent = next || '';
@@ -1478,7 +1483,7 @@
     els.wizPw.value = '';
     els.wizPw2.value = '';
     // Skipped: the first thing to say once Codeman answers.
-    g.noAgent = !installedAgents().length && !msg.aiCli && offeredAgents().length > 0;
+    g.noAgent = needsAgent() && !msg.aiCli;
     beginRun();
     post(msg);
   }
@@ -1524,7 +1529,7 @@
   function wizardBack() {
     var g = state.gui;
     if (!g) return;
-    if (g.step === 'reach' && !installedAgents().length && offeredAgents().length && !g.plan.blocker) {
+    if (g.step === 'reach' && needsAgent() && !g.plan.blocker) {
       g.step = 'agent';
       renderWizard();
     } else {
@@ -1532,6 +1537,12 @@
     }
   }
 
+  // A wait for the server an install brings up, on `port` until the
+  // installer says otherwise.
+  function newWait(port) {
+    return { since: Date.now(), finishedAt: 0, port: port };
+  }
+
   function scheduleWait() {
     clearTimeout(state.waitTimer);
     state.waitTimer = setTimeout(function () { if (state.wait) checkLocal('quick'); }, WAIT_POLL_MS);
@@ -1560,7 +1571,7 @@
     // Until the installer writes its LaunchAgent, the app looks at port 3000,
     // where something else may answer when the install took another port.
     var ours = portOf(s.url) === w.port;
-    if (ours && (s.state === 'running' || s.state === 'needsLogin')) {
+    if (ours && answers(s)) {
       var g = state.gui;
       if (g && g.step === 'finishing' && g.noAgent) {
         clearTimeout(state.waitTimer);
@@ -1608,10 +1619,7 @@
       els.ssh.focus();
       return;
     }
-    state.opening = true;
-    syncLocalButtons();
-    setStatus('busy', 'Opening Terminal…');
-    post({ cmd: 'installRemote', target: target });
+    openTerminal({ cmd: 'installRemote', target: target });
   }
 
   window.__codemanDesktop = {
@@ -1690,7 +1698,7 @@
         case 'installStarted':
           state.opening = false;
           setStatus('', '');
-          state.wait = { since: Date.now(), finishedAt: 0, port: Number(msg.port) || 3000 };
+          state.wait = newWait(Number(msg.port) || 3000);
           selectTab('local');
           renderLocal();
           scheduleWait();

packages/desktop/src/agents.rs

@@ -115,19 +115,22 @@ fn session_cookie(header: &str) -> Option<&str> {
     (name == COOKIE_NAME && !value.is_empty()).then_some(pair)
 }
 
+/// A refused login: Codeman counts each against the login rate limit, so the
+/// polling ends.
+fn refused(status: u16) -> bool {
+    matches!(status, 401 | 403 | 429)
+}
+
 /// What a status code says about asking again.
-fn answer(status: u16, body: impl FnOnce() -> Option<String>) -> Poll {
+fn answer(status: u16, body: Option<&str>) -> Poll {
     match status {
-        200 => body()
-            .as_deref()
-            .and_then(count_working)
-            .map_or(Poll::Failed, |working| {
-                Poll::Seen(Activity {
-                    working: working > 0,
-                    ..Activity::default()
-                })
-            }),
-        401 | 403 | 429 => Poll::Refused,
+        200 => body.and_then(count_working).map_or(Poll::Failed, |working| {
+            Poll::Seen(Activity {
+                working: working > 0,
+                ..Activity::default()
+            })
+        }),
+        s if refused(s) => Poll::Refused,
         _ => Poll::Failed,
     }
 }
@@ -192,7 +195,7 @@ impl Poller {
         let Some((status, body)) = self.ask(&url) else {
             return Poll::Failed;
         };
-        let mut activity = match answer(status, || body) {
+        let mut activity = match answer(status, body.as_deref()) {
             Poll::Seen(activity) => activity,
             other => return other,
         };
@@ -203,7 +206,7 @@ impl Poller {
                         self.alerts = alerts;
                     }
                 }
-                Some((401 | 403 | 429, _)) => return Poll::Refused,
+                Some((s, _)) if refused(s) => return Poll::Refused,
                 // A server from before the list has no alerts to report.
                 Some((404, _)) => self.alerts = (false, false),
                 _ => {}
@@ -264,17 +267,17 @@ mod tests {
     fn a_body_that_is_not_the_list_is_no_answer() {
         assert_eq!(count_working("<html>"), None);
         assert_eq!(count_working(r#"{"success":false,"error":"nope"}"#), None);
-        assert_eq!(answer(200, || Some("<html>".into())), Poll::Failed);
-        assert_eq!(answer(200, || None), Poll::Failed);
+        assert_eq!(answer(200, Some("<html>")), Poll::Failed);
+        assert_eq!(answer(200, None), Poll::Failed);
     }
 
     #[test]
     fn only_a_login_refusal_ends_the_polling() {
         for status in [401, 403, 429] {
-            assert_eq!(answer(status, || None), Poll::Refused, "{status}");
+            assert_eq!(answer(status, None), Poll::Refused, "{status}");
         }
         for status in [301, 404, 500, 502, 503] {
-            assert_eq!(answer(status, || None), Poll::Failed, "{status}");
+            assert_eq!(answer(status, None), Poll::Failed, "{status}");
         }
     }
 

packages/desktop/src/config.rs

@@ -13,8 +13,8 @@ const MAX_SERVERS: usize = 8;
 /// How many recovery copies of an unreadable config can sit side by side:
 /// `desktop.json.corrupt`, then `desktop.json.corrupt.1` to `.9`.
 const ASIDE_SLOTS: usize = 10;
-const MIN_WIDTH: f64 = 480.0;
-const MIN_HEIGHT: f64 = 360.0;
+pub const MIN_WIDTH: f64 = 480.0;
+pub const MIN_HEIGHT: f64 = 360.0;
 const MAX_EDGE: f64 = 20_000.0;
 
 /// Height of a standard title bar, in points.

packages/desktop/src/credentials.rs

@@ -88,9 +88,7 @@ impl Keychain {
             password: password.to_owned(),
             reply,
         };
-        if self.jobs.send(job).is_err() {
-            return Err(WORKER_GONE.into());
-        }
+        self.jobs.send(job).map_err(|_| WORKER_GONE.to_string())?;
         answer.recv().unwrap_or_else(|_| Err(WORKER_GONE.into()))
     }
 

packages/desktop/src/gui_install.rs

@@ -6,8 +6,8 @@
 //! tmux in the home folder, so nothing in it asks for a password, and the two
 //! questions only a person can answer (which coding agent, who may reach
 //! Codeman) are asked by the page and passed as flags. The Terminal route in
-//! `setup.rs` stays for what this one cannot do, a Mac older than macOS 15 with
-//! no tmux first of all.
+//! `terminal_install.rs` stays for what this one cannot do, a Mac older than
+//! macOS 15 with no tmux first of all.
 //!
 //! `prepare` downloads the installer once into a private folder and asks it
 //! what is on this Mac (`install.sh preflight`); `start` runs the same file with
@@ -100,8 +100,8 @@ impl Run {
     /// not one: it has no `--progress`.
     pub fn matches(self, command: &str) -> bool {
         let suffix = format!("/{}/{SCRIPT_FILE}", self.folder());
-        let mut words = command.split_whitespace();
-        words.any(|w| w.ends_with(&suffix)) && command.split_whitespace().any(|w| w == "--progress")
+        command.split_whitespace().any(|w| w.ends_with(&suffix))
+            && command.split_whitespace().any(|w| w == "--progress")
     }
 
     /// A process of this run, if it is running.
@@ -269,11 +269,12 @@ fn download_installer(script: &Path) -> Result<(), String> {
     if out.code == Some(0) && script.is_file() {
         return Ok(());
     }
+    const FAILED: &str = "Could not download the installer. Check the internet connection, then try again.";
     let said = out.stderr.trim();
     Err(if said.is_empty() {
-        "Could not download the installer. Check the internet connection, then try again.".to_string()
+        FAILED.to_string()
     } else {
-        format!("Could not download the installer. Check the internet connection, then try again.\n{said}")
+        format!("{FAILED}\n{said}")
     })
 }
 
@@ -571,9 +572,8 @@ pub fn follow(run: Run, stale: impl Fn() -> bool, send: impl Fn(Value)) {
             return;
         }
         let running = run.process().is_some();
-        let log = progress.feed(&read_more(&mut file, &path, &mut offset));
+        let mut log = progress.feed(&read_more(&mut file, &path, &mut offset));
         if !running || progress.done {
-            let mut log = log;
             log.extend(progress.finish());
             let cancelled = CANCELLED.load(Ordering::SeqCst);
             if progress.done {

packages/desktop/src/local_server.rs

@@ -1,4 +1,7 @@
 //! "Start Codeman on this Mac": `codeman web -d` through the user's login shell.
+//! The same login-shell machinery answers whether Codeman is installed
+//! (`installed`) and hands its environment to the graphical install
+//! (`login_environment`); `exec_bounded` is the crate's bounded process runner.
 //!
 //! A double-clicked app gets launchd's bare PATH (`/usr/bin:/bin:...`), which
 //! finds neither `codeman` nor `node`, and the server inherits whatever
@@ -143,7 +146,8 @@ fn pump<R: Read + Send + 'static>(pipe: Option<R>, stream: usize, tx: mpsc::Send
     });
 }
 
-/// `exec_bounded` for a start.
+/// `exec_bounded` with the start's timeout message. The installed check and
+/// `login_environment` run through it too, and drop its error.
 fn exec(cmd: Command, deadline: Instant) -> Result<Output, String> {
     exec_bounded(
         cmd,
@@ -248,13 +252,16 @@ fn parse_env(output: &str) -> Option<Vec<(String, String)>> {
     None
 }
 
+/// A portable variable name: a letter or `_`, then letters, digits or `_`.
+pub fn is_env_name(name: &str) -> bool {
+    let mut chars = name.chars();
+    chars.next().is_some_and(|c| c.is_ascii_alphabetic() || c == '_')
+        && chars.all(|c| c.is_ascii_alphanumeric() || c == '_')
+}
+
 fn env_entry(line: &str) -> Option<(&str, &str)> {
     let (name, value) = line.split_once('=')?;
-    let mut chars = name.chars();
-    let first = chars.next()?;
-    let portable =
-        (first.is_ascii_alphabetic() || first == '_') && chars.all(|c| c.is_ascii_alphanumeric() || c == '_');
-    portable.then_some((name, value))
+    is_env_name(name).then_some((name, value))
 }
 
 /// Ask `shell` for its environment with `flags`. The outer error ends the
@@ -339,16 +346,13 @@ fn run_in_shell(
 /// 127 means "no codeman here" and moves on to the next way of asking; the
 /// interactive profile is asked only when `interactive` allows it.
 fn launch(script: &str, shell: &Path, args: &[String], deadline: Instant, interactive: bool) -> Result<Run, String> {
-    let attempts = match flavor(shell) {
-        Flavor::Posix => {
-            let result = run_in_shell(script, shell, false, args, deadline)?;
-            if result.code != Some(127) || !interactive {
-                return Ok(result);
-            }
-            // Not on the login PATH; try the interactive profile too.
-            return run_in_shell(script, shell, true, args, deadline);
+    let Flavor::Capture(attempts) = flavor(shell) else {
+        let result = run_in_shell(script, shell, false, args, deadline)?;
+        if result.code != Some(127) || !interactive {
+            return Ok(result);
         }
-        Flavor::Capture(attempts) => attempts,
+        // Not on the login PATH; try the interactive profile too.
+        return run_in_shell(script, shell, true, args, deadline);
     };
     let mut last_run = None;
     let mut capture_error = None;
@@ -386,8 +390,8 @@ const FIND_SCRIPT: &str = r#"if command -v codeman >/dev/null 2>&1; then exit 0;
 if [ -f "$HOME/.codeman/app/dist/index.js" ] && command -v node >/dev/null 2>&1; then exit 0; fi
 exit 127"#;
 
-/// How long the This Mac tab waits for the login shell to answer whether
-/// Codeman is installed.
+/// How long one look at the login shell may take: whether Codeman is
+/// installed (the This Mac tab), or its environment for the graphical install.
 const FIND_TIMEOUT: Duration = Duration::from_secs(15);
 
 /// `installed` with the shell given, so tests need not touch `$SHELL`.
@@ -453,7 +457,7 @@ mod tests {
             })
             .output
         };
-        // stdout that ended without a newline used to be glued to stderr.
+        // stdout that ends without a newline: stderr still starts a line of its own.
         assert_eq!(
             said("Starting Codeman", "Error: port 3000 is in use\n"),
             "Starting Codeman\nError: port 3000 is in use"

packages/desktop/src/login.rs

@@ -0,0 +1,256 @@
+//! The login a connect goes out with, and what the Keychain keeps once the
+//! server has answered it.
+
+use crate::credentials::{self, Keychain};
+use crate::probe::ProbeOutcome;
+
+/// The login a connect goes out with, and where its password came from. A
+/// typed password wins, then the one the Keychain holds for this user. Last
+/// comes the login of the Codeman on this Mac, which keeps it where its own
+/// clients find it (setup::local_login: its launchd job, then
+/// ~/.codeman/.env) and only answers it at its own loopback address. That one
+/// is used only when the config expected no password in the Keychain
+/// (`expect_saved`: one that should be there and is not is reported, not
+/// papered over), only for the username in use when there is one, and it is
+/// never saved anywhere. `local` is asked only then: it runs processes.
+pub fn choose_login(
+    user: Option<String>,
+    typed_password: Option<String>,
+    saved: Option<String>,
+    expect_saved: bool,
+    local: impl FnOnce() -> Option<(String, String)>,
+) -> (Option<String>, Option<String>, PasswordSource) {
+    if let Some(password) = typed_password {
+        return (user, Some(password), PasswordSource::Typed);
+    }
+    if let Some(password) = saved {
+        return (user, Some(password), PasswordSource::Keychain);
+    }
+    if !expect_saved {
+        if let Some((local_user, password)) = local() {
+            if user.as_deref().is_none_or(|current| current == local_user) {
+                return (Some(local_user), Some(password), PasswordSource::LocalServer);
+            }
+        }
+    }
+    (user, None, PasswordSource::Absent)
+}
+
+/// A login the probe just tried, and what the user asked for it.
+pub struct ProbedLogin<'a> {
+    /// The server, as the config and the Keychain accounts key it.
+    pub server: &'a str,
+    /// The username the config named for this server before the connect.
+    pub previous_user: Option<&'a str>,
+    pub username: Option<&'a str>,
+    pub password: Option<&'a str>,
+    /// Where the password came from.
+    pub source: PasswordSource,
+    pub remember: bool,
+}
+
+/// Where a connect's password came from, which decides what the Keychain
+/// does with it (update_keychain).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PasswordSource {
+    /// Typed on the connect page this time: saved if Remember is on.
+    Typed,
+    /// From the Keychain: there already.
+    Keychain,
+    /// The local Codeman's own login (setup::local_login): it stays where it
+    /// is, and the Keychain never gets a copy.
+    LocalServer,
+    /// No password.
+    Absent,
+}
+
+/// What update_keychain did: whether the Keychain now holds the login's
+/// password, and whose items it deleted.
+#[derive(Default)]
+pub struct KeychainUpdate {
+    pub saved: bool,
+    pub deleted: Vec<String>,
+}
+
+/// Bring the Keychain in line with a probe the server answered, on the probe
+/// worker. Only an accepted login changes anything (Ok, or a password the
+/// server wants changed), since only then does the config get the new entry.
+///
+/// When that entry names another user than the config did (compared exactly,
+/// as the account string is), the old user's item is deleted FIRST, before any
+/// save: the Keychain worker runs jobs in order, so a Keychain that treats two
+/// spellings of a name as one item cannot lose the new password to that
+/// delete. Then the typed password is saved when Remember is on and deleted
+/// when it is off, and a password the server wants changed is never kept.
+pub fn update_keychain(keychain: &Keychain, outcome: &ProbeOutcome, login: &ProbedLogin<'_>) -> KeychainUpdate {
+    let mut update = KeychainUpdate::default();
+    if !matches!(outcome, ProbeOutcome::Ok { .. } | ProbeOutcome::PasswordChangeRequired) {
+        return update;
+    }
+    let mut delete = |user: &str| {
+        keychain.delete(&credentials::account(login.server, user));
+        update.deleted.push(user.to_string());
+    };
+    if let Some(old) = login.previous_user.filter(|old| login.username != Some(*old)) {
+        delete(old);
+    }
+    let saved = match (outcome, login.username, login.password) {
+        (ProbeOutcome::Ok { .. }, Some(user), Some(password)) if login.source == PasswordSource::Typed => {
+            if login.remember {
+                keychain
+                    .save_blocking(&credentials::account(login.server, user), password)
+                    .is_ok()
+            } else {
+                delete(user);
+                false
+            }
+        }
+        // A password that came from the Keychain is saved there already.
+        (ProbeOutcome::Ok { .. }, Some(_), Some(_)) => login.source == PasswordSource::Keychain,
+        (ProbeOutcome::PasswordChangeRequired, Some(user), _) => {
+            delete(user);
+            false
+        }
+        _ => false,
+    };
+    update.saved = saved;
+    update
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::credentials::memory;
+
+    fn none() -> Option<(String, String)> {
+        panic!("the local login must not be looked up here");
+    }
+
+    #[test]
+    fn the_login_a_connect_uses() {
+        let s = |v: &str| Some(v.to_string());
+        let local = || Some(("admin".to_string(), "from-this-mac".to_string()));
+
+        // A typed password wins over everything, and nothing else is asked.
+        assert_eq!(
+            choose_login(s("kay"), s("typed"), s("kept"), true, none),
+            (s("kay"), s("typed"), PasswordSource::Typed)
+        );
+        // Then the Keychain's.
+        assert_eq!(
+            choose_login(s("kay"), None, s("kept"), true, none),
+            (s("kay"), s("kept"), PasswordSource::Keychain)
+        );
+        // The Keychain should hold one and does not: reported as absent, the
+        // local login is not tried in its place.
+        assert_eq!(
+            choose_login(s("kay"), None, None, true, none),
+            (s("kay"), None, PasswordSource::Absent)
+        );
+        // Nothing typed, nothing expected: the Codeman on this Mac's own
+        // login, for no username or the same one.
+        assert_eq!(
+            choose_login(None, None, None, false, local),
+            (s("admin"), s("from-this-mac"), PasswordSource::LocalServer)
+        );
+        assert_eq!(
+            choose_login(s("admin"), None, None, false, local),
+            (s("admin"), s("from-this-mac"), PasswordSource::LocalServer)
+        );
+        // Never for another user: the names are compared exactly.
+        assert_eq!(
+            choose_login(s("kay"), None, None, false, local),
+            (s("kay"), None, PasswordSource::Absent)
+        );
+        assert_eq!(
+            choose_login(s("Admin"), None, None, false, local),
+            (s("Admin"), None, PasswordSource::Absent)
+        );
+        // No local login either.
+        assert_eq!(
+            choose_login(None, None, None, false, || None),
+            (None, None, PasswordSource::Absent)
+        );
+    }
+
+    /// update_keychain for one probe answer; the log is what the Keychain did,
+    /// in order (the last load only waits for the queue to drain).
+    fn keychain_after(outcome: ProbeOutcome, login: ProbedLogin<'_>) -> (KeychainUpdate, Vec<String>) {
+        let (keychain, store) = memory::keychain();
+        let update = update_keychain(&keychain, &outcome, &login);
+        keychain.load_blocking("done");
+        let mut log = store.log();
+        assert_eq!(log.pop().as_deref(), Some("load done"));
+        (update, log)
+    }
+
+    fn login<'a>(
+        previous_user: Option<&'a str>,
+        username: Option<&'a str>,
+        source: PasswordSource,
+        remember: bool,
+    ) -> ProbedLogin<'a> {
+        ProbedLogin {
+            server: "http://a/",
+            previous_user,
+            username,
+            password: (source != PasswordSource::Absent).then_some("secret"),
+            source,
+            remember,
+        }
+    }
+
+    #[test]
+    fn what_the_keychain_keeps_after_a_connect() {
+        let ok = || ProbeOutcome::Ok {
+            version: "1.48.0".into(),
+        };
+        let item = |user: &str| credentials::account("http://a/", user);
+
+        // A typed password is saved when Remember is on, deleted when it is off.
+        let (update, log) = keychain_after(ok(), login(Some("kay"), Some("kay"), PasswordSource::Typed, true));
+        assert!(update.saved && update.deleted.is_empty());
+        assert_eq!(log, [format!("save {}", item("kay"))]);
+        let (update, log) = keychain_after(ok(), login(Some("kay"), Some("kay"), PasswordSource::Typed, false));
+        assert!(!update.saved);
+        assert_eq!(update.deleted, ["kay"]);
+        assert_eq!(log, [format!("delete {}", item("kay"))]);
+
+        // One that came from the Keychain is there already: nothing is written.
+        let (update, log) = keychain_after(ok(), login(Some("kay"), Some("kay"), PasswordSource::Keychain, true));
+        assert!(update.saved && log.is_empty());
+
+        // The local Codeman's own login never gets a copy, Remember or not.
+        let (update, log) = keychain_after(ok(), login(None, Some("admin"), PasswordSource::LocalServer, true));
+        assert!(!update.saved && update.deleted.is_empty() && log.is_empty());
+
+        // Another user than before: the old user's item goes FIRST, then the save.
+        let (update, log) = keychain_after(ok(), login(Some("old"), Some("new"), PasswordSource::Typed, true));
+        assert!(update.saved);
+        assert_eq!(update.deleted, ["old"]);
+        assert_eq!(
+            log,
+            [format!("delete {}", item("old")), format!("save {}", item("new"))]
+        );
+
+        // A password the server wants changed is never kept.
+        let (update, log) = keychain_after(
+            ProbeOutcome::PasswordChangeRequired,
+            login(Some("kay"), Some("kay"), PasswordSource::Typed, true),
+        );
+        assert!(!update.saved);
+        assert_eq!(update.deleted, ["kay"]);
+        assert_eq!(log, [format!("delete {}", item("kay"))]);
+
+        // A login the server did not accept changes nothing.
+        for refused in [
+            ProbeOutcome::BadCredentials,
+            ProbeOutcome::NeedsLogin,
+            ProbeOutcome::Refused,
+            ProbeOutcome::Timeout,
+        ] {
+            let (update, log) = keychain_after(refused, login(Some("old"), Some("new"), PasswordSource::Typed, true));
+            assert!(!update.saved && update.deleted.is_empty() && log.is_empty());
+        }
+    }
+}

packages/desktop/src/logo.rs

@@ -270,7 +270,7 @@ const SETTLE: Duration = Duration::from_secs(3);
 const LOOK_EVERY: Duration = Duration::from_millis(250);
 
 /// What a blink needs from the machine, so its decisions can be tested.
-pub trait Logo {
+trait Logo {
     /// The current mode, None if it could not be read.
     fn mode(&self) -> Option<i64>;
     /// Set the mode; false if the daemon did not take it.
@@ -281,7 +281,7 @@ pub trait Logo {
 }
 
 /// The file that says a blink may have left the logo dark.
-pub struct Marker(Option<PathBuf>);
+struct Marker(Option<PathBuf>);
 
 impl Marker {
     fn default_location() -> Self {
@@ -363,7 +363,7 @@ fn blink(logo: &impl Logo, marker: &Marker, pattern: &[Beat], mut wait: impl FnM
 }
 
 /// Put back a logo that a blink could not finish with.
-pub fn recover(logo: &impl Logo, marker: &Marker) {
+fn recover(logo: &impl Logo, marker: &Marker) {
     if !marker.is_set() {
         return;
     }
@@ -507,25 +507,24 @@ fn spawn_child(connection: Connection) -> Option<(Connection, ChildStdin)> {
     Some((connection, stdin))
 }
 
-#[cfg(target_os = "macos")]
 pub use system::{available, blink_main, recover_at_launch, switched_off};
 
+/// No lit logo to blink outside macOS.
 #[cfg(not(target_os = "macos"))]
-pub fn available() -> bool {
-    false
-}
+mod system {
+    pub fn available() -> bool {
+        false
+    }
 
-#[cfg(not(target_os = "macos"))]
-pub fn blink_main() -> ! {
-    std::process::exit(0)
-}
+    pub fn blink_main() -> ! {
+        std::process::exit(0)
+    }
 
-#[cfg(not(target_os = "macos"))]
-pub fn recover_at_launch() {}
+    pub fn recover_at_launch() {}
 
-#[cfg(not(target_os = "macos"))]
-pub fn switched_off() -> bool {
-    false
+    pub fn switched_off() -> bool {
+        false
+    }
 }
 
 #[cfg(target_os = "macos")]

packages/desktop/src/menu.rs

@@ -0,0 +1,161 @@
+//! The menu bar.
+
+use muda::accelerator::{Accelerator, Code, Modifiers};
+use muda::{AboutMetadata, CheckMenuItem, Menu, MenuItem, PredefinedMenuItem, Submenu};
+
+use crate::config::Config;
+use crate::logo::{self, BlinkStyle, Signal};
+use crate::{APP_NAME, VERSION};
+
+/// Codeman's repository and its documentation (the Help menu, About).
+pub const REPO_URL: &str = "https://github.com/Ark0N/Codeman";
+pub const DOCS_URL: &str = "https://github.com/Ark0N/Codeman/wiki";
+
+pub mod menu_id {
+    pub const SWITCH: &str = "switch-server";
+    pub const ADD_AGENT: &str = "add-agent";
+    pub const RELOAD: &str = "reload";
+    pub const START_FULLSCREEN: &str = "start-fullscreen";
+    pub const DEVTOOLS: &str = "devtools";
+    pub const HELP_DOCS: &str = "help-docs";
+    pub const HELP_GITHUB: &str = "help-github";
+}
+
+pub struct AppMenu {
+    pub bar: Menu,
+    pub window_menu: Submenu,
+    pub help_menu: Submenu,
+    pub start_fullscreen: CheckMenuItem,
+    /// One item per state and style. Empty on a Mac without a lit logo, which has no
+    /// such menu.
+    pub logo_styles: Vec<(Signal, BlinkStyle, CheckMenuItem)>,
+}
+
+pub fn build_menu(config: &Config) -> muda::Result<AppMenu> {
+    let bar = Menu::new();
+    let about = PredefinedMenuItem::about(
+        Some("About Codeman"),
+        Some(AboutMetadata {
+            name: Some(APP_NAME.into()),
+            version: Some(VERSION.into()),
+            comments: Some("A native window for your Codeman server.".into()),
+            website: Some(REPO_URL.into()),
+            ..Default::default()
+        }),
+    );
+    let switch = MenuItem::with_id(
+        menu_id::SWITCH,
+        "Switch Server\u{2026}",
+        true,
+        Some(Accelerator::new(Modifiers::META | Modifiers::SHIFT, Code::KeyO)),
+    );
+    let app_menu = Submenu::with_items(
+        APP_NAME,
+        true,
+        &[
+            &about,
+            &PredefinedMenuItem::separator(),
+            &switch,
+            &MenuItem::with_id(menu_id::ADD_AGENT, "Add a Coding Agent to This Mac\u{2026}", true, None),
+            &PredefinedMenuItem::separator(),
+            &PredefinedMenuItem::services(None),
+            &PredefinedMenuItem::separator(),
+            &PredefinedMenuItem::hide(None),
+            &PredefinedMenuItem::hide_others(None),
+            &PredefinedMenuItem::show_all(None),
+            &PredefinedMenuItem::separator(),
+            &PredefinedMenuItem::quit(None),
+        ],
+    )?;
+    // Without these items Cmd+C / Cmd+V do nothing inside a WKWebView.
+    let edit = Submenu::with_items(
+        "Edit",
+        true,
+        &[
+            &PredefinedMenuItem::undo(None),
+            &PredefinedMenuItem::redo(None),
+            &PredefinedMenuItem::separator(),
+            &PredefinedMenuItem::cut(None),
+            &PredefinedMenuItem::copy(None),
+            &PredefinedMenuItem::paste(None),
+            &PredefinedMenuItem::select_all(None),
+        ],
+    )?;
+    let start_fullscreen = CheckMenuItem::with_id(
+        menu_id::START_FULLSCREEN,
+        "Always Open in Full Screen",
+        true,
+        config.start_fullscreen,
+        None,
+    );
+    let view = Submenu::with_items(
+        "View",
+        true,
+        &[
+            &MenuItem::with_id(
+                menu_id::RELOAD,
+                "Reload",
+                true,
+                Some(Accelerator::new(Modifiers::META, Code::KeyR)),
+            ),
+            &PredefinedMenuItem::separator(),
+            &PredefinedMenuItem::fullscreen(None),
+            &start_fullscreen,
+            &PredefinedMenuItem::separator(),
+            &MenuItem::with_id(
+                menu_id::DEVTOOLS,
+                "Developer Tools",
+                true,
+                Some(Accelerator::new(Modifiers::META | Modifiers::ALT, Code::KeyI)),
+            ),
+        ],
+    )?;
+    // Only a Mac with a lit Apple logo has this menu at all.
+    let mut logo_styles = Vec::new();
+    if logo::available() {
+        let submenu = Submenu::new("Blink Apple Logo", true);
+        for signal in Signal::ALL {
+            let group = Submenu::new(signal.label(), true);
+            for style in BlinkStyle::ALL {
+                let chosen = style == config.logo_blink.get(signal);
+                let item = CheckMenuItem::with_id(style.menu_id(signal), style.label(), true, chosen, None);
+                group.append(&item)?;
+                if style == BlinkStyle::Off {
+                    group.append(&PredefinedMenuItem::separator())?;
+                }
+                logo_styles.push((signal, style, item));
+            }
+            submenu.append(&group)?;
+        }
+        // Right under "Always Open in Full Screen", before the separator.
+        view.insert(&submenu, 4)?;
+    }
+    let window_menu = Submenu::with_items(
+        "Window",
+        true,
+        &[
+            &PredefinedMenuItem::minimize(None),
+            &PredefinedMenuItem::maximize(None),
+            &PredefinedMenuItem::separator(),
+            &PredefinedMenuItem::close_window(None),
+            &PredefinedMenuItem::separator(),
+            &PredefinedMenuItem::bring_all_to_front(None),
+        ],
+    )?;
+    let help_menu = Submenu::with_items(
+        "Help",
+        true,
+        &[
+            &MenuItem::with_id(menu_id::HELP_DOCS, "Codeman Documentation", true, None),
+            &MenuItem::with_id(menu_id::HELP_GITHUB, "Codeman on GitHub", true, None),
+        ],
+    )?;
+    bar.append_items(&[&app_menu, &edit, &view, &window_menu, &help_menu])?;
+    Ok(AppMenu {
+        bar,
+        window_menu,
+        help_menu,
+        start_fullscreen,
+        logo_styles,
+    })
+}

packages/desktop/src/policy.rs

@@ -21,6 +21,7 @@ pub const CONNECT_PAGE: &str = "codemanapp://localhost/index.html";
 /// Caps on what a page may hand the native side.
 pub const MAX_URL_LEN: usize = 4096;
 pub const MAX_FIELD_LEN: usize = 1024;
+const MAX_MESSAGE_LEN: usize = 16 * 1024;
 
 /// Where the main window is in reaching a server. The gates below take it
 /// instead of "is a server set", because what may talk to the native side
@@ -61,6 +62,16 @@ impl Phase {
     }
 }
 
+/// The phase a commit of `committed` in the main window moves to: Loaded once
+/// a page from the server that is loading is the document.
+pub fn loaded_on_commit(phase: &Phase, committed: &str) -> Option<Phase> {
+    let Phase::Loading(server) = phase else {
+        return None;
+    };
+    let url = Url::parse(committed).ok()?;
+    same_origin(&url, server).then(|| Phase::Loaded(server.clone()))
+}
+
 /// Turn what the user typed into a server URL: scheme added when missing,
 /// query and fragment dropped, and the path ending in `/` so `api/status`
 /// joins below a base path. The scheme is `https` for a tailnet `.ts.net`
@@ -542,12 +553,9 @@ pub fn new_window(target: &str, phase: &Phase, via: Via) -> NewWindow {
     if target.len() > MAX_URL_LEN {
         return NewWindow::Deny;
     }
-    let Ok(url) = Url::parse(target) else {
+    let Some(url) = external_url(target) else {
         return NewWindow::Deny;
     };
-    if !matches!(url.scheme(), "http" | "https") {
-        return NewWindow::Deny;
-    }
     let Some(srv) = phase.loaded() else {
         return NewWindow::Deny;
     };
@@ -631,7 +639,7 @@ pub enum ConnectCmd {
     /// Show the agent install that is running already.
     AgentAttach,
     /// Run the installer on another machine over SSH, in Terminal. `target`
-    /// is what the user typed; setup::SshTarget::parse checks it.
+    /// is what the user typed; terminal_install::SshTarget::parse checks it.
     InstallRemote {
         target: String,
     },
@@ -646,7 +654,12 @@ pub enum Ipc {
 }
 
 #[derive(Deserialize)]
-#[serde(tag = "cmd", rename_all = "camelCase", deny_unknown_fields)]
+#[serde(
+    tag = "cmd",
+    rename_all = "camelCase",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
 enum RawConnect {
     Ready,
     Connect {
@@ -686,18 +699,15 @@ enum RawConnect {
     },
     InstallPrepare,
     InstallStart {
-        // rename_all above reaches variant names only, and deny_unknown_fields
-        // would refuse the page's spelling of these.
-        #[serde(default, rename = "networkPassword")]
+        #[serde(default)]
         network_password: Option<String>,
-        #[serde(default, rename = "aiCli")]
+        #[serde(default)]
         ai_cli: Option<String>,
     },
     InstallAttach,
     InstallCancel,
     AgentPrepare,
     AgentStart {
-        #[serde(rename = "aiCli")]
         ai_cli: String,
     },
     AgentAttach,
@@ -751,7 +761,7 @@ fn is_connect_page(frame: &Url) -> bool {
 /// - A server page is listened to only once it committed, and only from a
 ///   frame running Codeman's own app shell (trusted_frame).
 pub fn parse_ipc(frame_url: &str, body: &str, phase: &Phase, is_main_window: bool) -> Option<Ipc> {
-    if body.len() > 16 * 1024 {
+    if body.len() > MAX_MESSAGE_LEN {
         return None;
     }
     let frame = Url::parse(frame_url).ok()?;
@@ -766,17 +776,12 @@ pub fn parse_ipc(frame_url: &str, body: &str, phase: &Phase, is_main_window: boo
                 username,
                 password,
                 remember,
-            } => {
-                if url.len() > MAX_URL_LEN {
-                    return None;
-                }
-                ConnectCmd::Connect {
-                    url,
-                    username: bounded(username, MAX_FIELD_LEN)?,
-                    password: bounded(password, MAX_FIELD_LEN)?,
-                    remember,
-                }
-            }
+            } if url.len() <= MAX_URL_LEN => ConnectCmd::Connect {
+                url,
+                username: bounded(username, MAX_FIELD_LEN)?,
+                password: bounded(password, MAX_FIELD_LEN)?,
+                remember,
+            },
             RawConnect::Cancel => ConnectCmd::Cancel,
             RawConnect::StartServer { url } if url.len() <= MAX_URL_LEN => ConnectCmd::StartServer { url },
             RawConnect::Forget { url } if url.len() <= MAX_URL_LEN => ConnectCmd::Forget { url },
@@ -789,15 +794,10 @@ pub fn parse_ipc(frame_url: &str, body: &str, phase: &Phase, is_main_window: boo
             RawConnect::InstallStart {
                 network_password,
                 ai_cli,
-            } => {
-                if ai_cli.as_deref().is_some_and(|id| !is_cli_id(id)) {
-                    return None;
-                }
-                ConnectCmd::InstallStart {
-                    network_password: bounded(network_password, MAX_FIELD_LEN)?.filter(|p| !p.is_empty()),
-                    ai_cli,
-                }
-            }
+            } if ai_cli.as_deref().is_none_or(is_cli_id) => ConnectCmd::InstallStart {
+                network_password: bounded(network_password, MAX_FIELD_LEN)?.filter(|p| !p.is_empty()),
+                ai_cli,
+            },
             RawConnect::InstallAttach => ConnectCmd::InstallAttach,
             RawConnect::InstallCancel => ConnectCmd::InstallCancel,
             RawConnect::AgentPrepare => ConnectCmd::AgentPrepare,
@@ -959,6 +959,32 @@ mod tests {
         assert!(!Phase::Loaded(srv).connect_page_live());
     }
 
+    #[test]
+    fn a_commit_from_the_loading_server_is_the_loaded_page() {
+        let server = Url::parse("https://box.ts.net/codeman/").unwrap();
+        let loading = Phase::Loading(server.clone());
+        assert_eq!(
+            loaded_on_commit(&loading, "https://box.ts.net/codeman/"),
+            Some(Phase::Loaded(server.clone()))
+        );
+        // Any page of that origin counts: the server may redirect within it.
+        assert_eq!(
+            loaded_on_commit(&loading, "https://box.ts.net/codeman/session/abc"),
+            Some(Phase::Loaded(server.clone()))
+        );
+        // Another origin, the connect page, or junk: still loading.
+        assert_eq!(loaded_on_commit(&loading, "https://other.ts.net/codeman/"), None);
+        assert_eq!(loaded_on_commit(&loading, "http://box.ts.net/codeman/"), None);
+        assert_eq!(loaded_on_commit(&loading, CONNECT_PAGE), None);
+        assert_eq!(loaded_on_commit(&loading, "not a url"), None);
+        // Only a load under way can finish.
+        assert_eq!(loaded_on_commit(&Phase::Connect, "https://box.ts.net/codeman/"), None);
+        assert_eq!(
+            loaded_on_commit(&Phase::Loaded(server), "https://box.ts.net/codeman/"),
+            None
+        );
+    }
+
     #[test]
     fn navigation_policy() {
         let srv = u("http://127.0.0.1:3000/");

packages/desktop/src/probe.rs

@@ -2,8 +2,10 @@
 //!
 //! One `GET <server>/api/status`, five seconds at most, run off the UI thread.
 //! The answer is classified into something the connect page can explain. It is
-//! asked once per user action, never in a loop: Codeman counts a request
-//! without valid credentials against the login rate limit (10 per IP).
+//! asked on a user action, or by one of the This Mac tab's waits (for an
+//! install to bring Codeman up, for a server that is starting), which end at
+//! the first answer, never as a standing poll: Codeman counts a request without
+//! valid credentials against the login rate limit (10 per IP).
 
 use serde::Serialize;
 use std::time::Duration;
@@ -82,6 +84,16 @@ pub enum ProbeOutcome {
     },
 }
 
+impl ProbeOutcome {
+    /// The server's version, when it answered as Codeman.
+    pub fn version(&self) -> Option<String> {
+        match self {
+            ProbeOutcome::Ok { version } => Some(version.clone()),
+            _ => None,
+        }
+    }
+}
+
 /// Classify an HTTP answer to `<server>/api/status`. `request` is the URL that
 /// was asked, `location` and `retry_after` are those response headers.
 pub fn classify_response(
@@ -94,12 +106,10 @@ pub fn classify_response(
 ) -> ProbeOutcome {
     match status {
         200 => {
-            let parsed: Option<serde_json::Value> = serde_json::from_str(body).ok();
-            let version = parsed.as_ref().and_then(|v| {
-                (v.get("success")? == &serde_json::Value::Bool(true))
-                    .then(|| v.get("data")?.get("version")?.as_str().map(str::to_string))
-                    .flatten()
-            });
+            let version = serde_json::from_str::<serde_json::Value>(body)
+                .ok()
+                .filter(|v| v["success"] == true)
+                .and_then(|v| v["data"]["version"].as_str().map(str::to_string));
             match version {
                 Some(version) => ProbeOutcome::Ok { version },
                 None => ProbeOutcome::NotCodeman { status },
@@ -742,8 +752,8 @@ mod tests {
     }
 
     /// A Codeman that sends its status headers and then stalls (a blocked
-    /// event loop, a lossy link) did not answer in time. It is not "something
-    /// else on this port", which is what an empty body read as before.
+    /// event loop, a lossy link) did not answer in time: a Timeout, not
+    /// NotCodeman ("something else on this port").
     #[test]
     fn a_body_that_stalls_is_a_timeout() {
         use std::io::{Read, Write};

packages/desktop/src/setup.rs

@@ -1,25 +1,12 @@
-//! The connect screen's "This Mac" tab and its Terminal installs: where the
-//! Codeman on this Mac listens, whether it is installed, its login, which
-//! other Codeman servers of this user run here, and the installer runs in
-//! Terminal for this Mac and for another machine over SSH.
-//! The install most people get runs in the app, in `gui_install.rs`.
-//!
-//! The Terminal route is for what that one cannot do. `install.sh` asks for
-//! the administrator password on a terminal (Homebrew, its sudo keep-alive),
-//! the Xcode tools arrive as a system dialog, and ssh asks about host keys and
-//! passwords on a terminal too. So the app writes a small script that deletes itself and
-//! hands it to Terminal (`open -b com.apple.Terminal`), which needs no
-//! permission, unlike scripting Terminal through osascript (an Automation
-//! prompt). Everything the scripts contain is built here and unit-tested; the
-//! only text from the user is the SSH login, which `SshTarget::parse` limits to
-//! the characters of a user and host name before it is quoted.
+//! The connect screen's "This Mac" tab: where the Codeman on this Mac listens,
+//! whether it is installed, its login, and which other Codeman servers of this
+//! user run here. The install most people get runs in the app
+//! (`gui_install.rs`); the Terminal installs are in `terminal_install.rs`.
 
 use std::collections::HashMap;
-use std::io::Write;
 use std::net::{Ipv4Addr, SocketAddr, TcpStream};
 use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
-use std::sync::atomic::{AtomicU64, Ordering};
 use std::time::Duration;
 
 use serde::Serialize;
@@ -29,6 +16,7 @@ use crate::gui_install;
 use crate::local_server;
 use crate::policy;
 use crate::probe::{self, ProbeOutcome};
+use crate::terminal_install::LOCAL_SCRIPT_NAME;
 
 /// Codeman's published installer (a redirect to `install.sh` on master). A test
 /// build of an installer change sets `CODEMAN_DESKTOP_INSTALLER_URL` when it is
@@ -49,10 +37,9 @@ pub const INSTALL_ONE_LINER: &str = "curl -fsSL https://getcodeman.com/install |
 /// Codeman's default port, and the first one a fresh install tries.
 pub const DEFAULT_PORT: u16 = 3000;
 
-/// The Terminal scripts' file names (`<name>-<pid>-<n>.command`). The local
-/// one is also how `inspect` recognizes an install that is still running.
-pub const LOCAL_SCRIPT_NAME: &str = "install-codeman-local";
-pub const REMOTE_SCRIPT_NAME: &str = "install-codeman-remote";
+/// The username Codeman logs in with when only a password is set
+/// (`CODEMAN_USERNAME` unset).
+pub const DEFAULT_USERNAME: &str = "admin";
 
 /// How many ports above 3000 a fresh install tries when 3000 is taken.
 const PORT_SEARCH: u16 = 100;
@@ -195,10 +182,7 @@ pub fn parse_env_file(text: &str) -> HashMap<String, String> {
         let Some((name, value)) = line.split_once('=') else {
             continue;
         };
-        let mut chars = name.chars();
-        let portable = chars.next().is_some_and(|c| c.is_ascii_alphabetic() || c == '_')
-            && chars.all(|c| c.is_ascii_alphanumeric() || c == '_');
-        if !portable {
+        if !local_server::is_env_name(name) {
             continue;
         }
         let mut value = value.trim();
@@ -246,13 +230,13 @@ pub fn login_for(
     }
     if let Some(s) = service {
         if let Some(password) = &s.password {
-            let username = s.username.clone().unwrap_or_else(|| "admin".into());
+            let username = s.username.clone().unwrap_or_else(|| DEFAULT_USERNAME.into());
             return Some((username, password.clone()));
         }
     }
     let from_file = |key: &str| env_file.get(key).filter(|v| !v.is_empty()).cloned();
     let password = from_file("CODEMAN_PASSWORD")?;
-    let username = from_file("CODEMAN_USERNAME").unwrap_or_else(|| "admin".into());
+    let username = from_file("CODEMAN_USERNAME").unwrap_or_else(|| DEFAULT_USERNAME.into());
     Some((username, password))
 }
 
@@ -348,12 +332,17 @@ pub fn is_codeman_server(command: &str) -> bool {
     server_args(command).is_some()
 }
 
+/// The last path component of a command-line word.
+fn basename(word: &str) -> &str {
+    word.rsplit('/').next().unwrap_or(word)
+}
+
 /// What follows `web` on a Codeman server's command line, or None for any
 /// other command.
 fn server_args(command: &str) -> Option<Vec<&str>> {
     let words: Vec<&str> = command.split_whitespace().collect();
     let is_entry = |w: &str| {
-        let name = w.rsplit('/').next().unwrap_or(w);
+        let name = basename(w);
         w.ends_with("dist/index.js") || w.ends_with("src/index.ts") || name == "codeman" || name == "aicodeman"
     };
     // Any entry word that `web` follows: an earlier word may only look like
@@ -372,14 +361,14 @@ fn server_args(command: &str) -> Option<Vec<&str>> {
 /// the port it asked for once the installer runs.
 pub fn install_in_progress(command: &str) -> Option<Option<u16>> {
     let words: Vec<&str> = command.split_whitespace().collect();
-    let name = |w: &&str| w.rsplit('/').next().unwrap_or(w).to_string();
+    let script = format!("{LOCAL_SCRIPT_NAME}-");
     if words.iter().any(|w| {
-        let n = name(w);
-        n.starts_with(&format!("{LOCAL_SCRIPT_NAME}-")) && n.ends_with(".command")
+        let n = basename(w);
+        n.starts_with(&script) && n.ends_with(".command")
     }) {
         return Some(None);
     }
-    if words.iter().any(|w| name(w).starts_with("codeman-install.")) || gui_install::Run::Codeman.matches(command) {
+    if words.iter().any(|w| basename(w).starts_with("codeman-install.")) || gui_install::Run::Codeman.matches(command) {
         let port = words
             .iter()
             .position(|w| *w == "--port")
@@ -552,10 +541,7 @@ fn found_server(url: &Url, answer: &ProbeOutcome, default: &Url) -> FoundServer
     };
     FoundServer {
         url: url.to_string(),
-        version: match answer {
-            ProbeOutcome::Ok { version } => Some(version.clone()),
-            _ => None,
-        },
+        version: answer.version(),
         state,
         is_default: url == default,
     }
@@ -715,11 +701,10 @@ pub fn inspect(depth: Depth) -> LocalStatus {
     };
     let answer = probe::probe(&default, auth.as_deref());
 
-    // Every address one of this user's Codeman servers listens at. The one at
-    // the default address has just answered; the others are asked now, once
-    // each. With nothing at the default address, the first of them that
-    // answers is what the tab opens, as it always was, so each gets the
-    // probe's usual time; otherwise they are only listed, and get less.
+    // The other addresses this user's Codeman servers listen at, asked once
+    // each. With nothing at the default address, the first that answers is
+    // what the tab opens (`shown`), so each gets the probe's usual time;
+    // otherwise they are only listed, and get less.
     let patience = if answer == ProbeOutcome::Refused {
         probe::TIMEOUT
     } else {
@@ -755,10 +740,7 @@ pub fn inspect(depth: Depth) -> LocalStatus {
             Depth::Interactive => local_server::installed(true),
         };
     let state = local_state(&outcome, !servers.is_empty(), !listening.is_empty(), installed);
-    let version = match &outcome {
-        ProbeOutcome::Ok { version } => Some(version.clone()),
-        _ => None,
-    };
+    let version = outcome.version();
     LocalStatus {
         url: url.to_string(),
         state,
@@ -896,290 +878,6 @@ fn pick_port(free: impl Fn(u16) -> bool) -> u16 {
         .unwrap_or(DEFAULT_PORT)
 }
 
-/// `s` as one bash word.
-pub fn sh_quote(s: &str) -> String {
-    format!("'{}'", s.replace('\'', r"'\''"))
-}
-
-/// What the This Mac install asks `install.sh` for.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct LocalInstall {
-    pub port: u16,
-    /// Let the installer ask how other devices reach Codeman (Tailscale, the
-    /// local network with a password). Off: this Mac only (`--local`).
-    pub network: bool,
-}
-
-/// `install.sh`'s flags for a This Mac install. Always `--service`: a
-/// LaunchAgent runs Codeman, so it keeps running when the app quits and starts
-/// again at login, and the app finds it there (read_service). No `--yes`: the
-/// user answers the installer's questions (Homebrew, AI coding tools).
-pub fn local_install_args(opts: LocalInstall) -> Vec<String> {
-    let mut args = Vec::new();
-    if !opts.network {
-        args.push("--local".to_string());
-    }
-    args.push("--service".to_string());
-    args.push("--port".to_string());
-    args.push(opts.port.to_string());
-    args
-}
-
-/// The Terminal script for a This Mac install. It downloads the installer to a
-/// temporary file and runs it from there, so the installer's input is the
-/// terminal itself.
-pub fn local_install_script(opts: LocalInstall) -> String {
-    let args = local_install_args(opts);
-    let shown = format!("bash install.sh {}", args.join(" "));
-    let quoted: Vec<String> = args.iter().map(|a| sh_quote(a)).collect();
-    format!(
-        r#"#!/bin/bash
-rm -f -- "$0"
-printf '\033]0;%s\007' 'Install Codeman'
-cat <<'CODEMAN_MSG'
-Installing Codeman on this Mac.
-
-The installer may ask for your Mac password (it installs Homebrew, Node.js and
-tmux when they are missing) and which AI coding tools to set up. Codeman then
-runs in the background and starts when you log in, so your sessions keep
-running when the app is closed. The Codeman app opens it by itself when the
-install is done.
-
-CODEMAN_MSG
-tmp=$(mktemp "${{TMPDIR:-/tmp}}/codeman-install.XXXXXX") || exit 1
-trap 'rm -f "$tmp"' EXIT
-echo {from}
-if ! curl -fsSL {url} -o "$tmp"; then
-  echo
-  echo 'Could not download the installer. Check the internet connection, then try again from the Codeman app.'
-  exit 1
-fi
-echo {shown}
-echo
-bash "$tmp" {args}
-status=$?
-echo
-if [ "$status" -eq 0 ]; then
-  echo 'Done. You can close this window.'
-else
-  echo "The installer stopped (exit $status). Its log is ~/.codeman/install.log"
-fi
-exit "$status"
-"#,
-        from = sh_quote(&format!("Downloading the installer from {INSTALLER_URL}")),
-        url = sh_quote(INSTALLER_URL),
-        shown = sh_quote(&format!("$ {shown}")),
-        args = quoted.join(" "),
-    )
-}
-
-/// A machine to install Codeman on, as ssh takes it: `[user@]host`, plus a
-/// `:port` the app passes as `-p`. The host may be a name from `~/.ssh/config`.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct SshTarget {
-    pub user: Option<String>,
-    pub host: String,
-    pub port: Option<u16>,
-}
-
-const SSH_FORMAT: &str =
-    "Enter the machine the way ssh takes it: user@host (for example kay@build-box), or a name from your ssh config.";
-
-impl SshTarget {
-    /// Only the characters of a user and host name, never a leading `-` (ssh
-    /// would read it as an option) and never an IPv6 literal (ambiguous with
-    /// the port; a host name or an IPv4 address works).
-    pub fn parse(input: &str) -> Result<Self, String> {
-        let s = input.trim();
-        if s.is_empty() || s.len() > 300 {
-            return Err(SSH_FORMAT.into());
-        }
-        let (user, rest) = match s.split_once('@') {
-            Some((u, r)) => (Some(u), r),
-            None => (None, s),
-        };
-        let (host, port) = match rest.split_once(':') {
-            Some((h, p)) => {
-                let port = p.parse::<u16>().ok().filter(|p| *p > 0).ok_or_else(|| {
-                    "The part after the colon must be the SSH port, for example kay@build-box:2222.".to_string()
-                })?;
-                (h, Some(port))
-            }
-            None => (rest, None),
-        };
-        let name_ok = |v: &str, max: usize| {
-            !v.is_empty()
-                && v.len() <= max
-                && !v.starts_with(['-', '.'])
-                && v.chars().all(|c| c.is_ascii_alphanumeric() || "._-".contains(c))
-        };
-        if let Some(u) = user {
-            if !name_ok(u, 64) {
-                return Err(SSH_FORMAT.into());
-            }
-        }
-        if !name_ok(host, 253) {
-            return Err(SSH_FORMAT.into());
-        }
-        Ok(SshTarget {
-            user: user.map(str::to_string),
-            host: host.to_string(),
-            port,
-        })
-    }
-
-    /// `user@host`, or `host`.
-    pub fn destination(&self) -> String {
-        match &self.user {
-            Some(u) => format!("{u}@{}", self.host),
-            None => self.host.clone(),
-        }
-    }
-
-    /// The address the connect screen suggests once the install is done: the
-    /// installer's default port on that host. Tailscale and a sub-path give
-    /// another address, which the installer prints at the end.
-    pub fn suggested_url(&self) -> String {
-        format!("http://{}:{DEFAULT_PORT}", self.host)
-    }
-}
-
-/// What the remote login shell runs. It may be fish or tcsh, so the work is
-/// one single-quoted `bash -c` word with nothing in it those shells treat
-/// specially (no `!`, `$`, backslash or single quote). `curl | bash` is the
-/// documented install and the installer asks its questions on ssh's terminal
-/// (`-t`); `pipefail` makes a failed download fail the whole command, where a
-/// plain pipe would report bash's success on an empty script. The installer
-/// needs bash anyway.
-pub fn remote_command() -> String {
-    format!(
-        "bash -o pipefail -c 'if command -v curl >/dev/null 2>&1; then curl -fsSL {u} | bash; \
-         elif command -v wget >/dev/null 2>&1; then wget -qO- {u} | bash; \
-         else echo \"Codeman needs curl or wget on this machine.\" >&2; exit 1; fi'",
-        u = INSTALLER_URL
-    )
-}
-
-/// `ssh`'s arguments for an install on `target`: a terminal (`-t`) for the
-/// installer's questions, the port, and `--` before the destination.
-pub fn ssh_args(target: &SshTarget) -> Vec<String> {
-    let mut args = vec!["-t".to_string()];
-    if let Some(port) = target.port {
-        args.push("-p".into());
-        args.push(port.to_string());
-    }
-    args.push("--".into());
-    args.push(target.destination());
-    args.push(remote_command());
-    args
-}
-
-/// The Terminal script for an install on another machine over SSH.
-pub fn remote_install_script(target: &SshTarget) -> String {
-    let args: Vec<String> = ssh_args(target).iter().map(|a| sh_quote(a)).collect();
-    let dest = target.destination();
-    format!(
-        r#"#!/bin/bash
-rm -f -- "$0"
-printf '\033]0;%s\007' {title}
-echo {what}
-cat <<'CODEMAN_MSG'
-
-ssh may ask you to confirm the machine and for its password. Then the installer
-asks how Codeman should be reached (Tailscale, the local network with a password,
-or that machine only) and whether to run it in the background. At the end it
-prints the address of Codeman there: connect to it in the Codeman app, under
-Another machine.
-
-CODEMAN_MSG
-ssh {args}
-status=$?
-echo
-if [ "$status" -eq 0 ]; then
-  echo 'Done. You can close this window.'
-else
-  echo "ssh or the installer stopped (exit $status)."
-fi
-exit "$status"
-"#,
-        title = sh_quote(&format!("Install Codeman on {}", target.host)),
-        what = sh_quote(&format!("Installing Codeman on {dest} over SSH.")),
-        args = args.join(" "),
-    )
-}
-
-static SCRIPT_COUNTER: AtomicU64 = AtomicU64::new(0);
-
-/// Run `script` in a new Terminal window. The script file is private to this
-/// user (the per-user temporary folder, mode 0700, created fresh) and deletes
-/// itself as it starts.
-#[cfg(target_os = "macos")]
-pub fn open_in_terminal(name: &str, script: &str) -> Result<(), String> {
-    use std::os::unix::fs::OpenOptionsExt;
-
-    let n = SCRIPT_COUNTER.fetch_add(1, Ordering::Relaxed);
-    let path = std::env::temp_dir().join(format!("{name}-{}-{n}.command", std::process::id()));
-    let written = std::fs::OpenOptions::new()
-        .write(true)
-        .create_new(true)
-        .mode(0o700)
-        .open(&path)
-        .and_then(|mut f| f.write_all(script.as_bytes()));
-    if let Err(e) = written {
-        let _ = std::fs::remove_file(&path);
-        return Err(format!("Could not write the install script: {e}"));
-    }
-    let out = Command::new("/usr/bin/open")
-        .args(["-b", "com.apple.Terminal"])
-        .arg(&path)
-        .stdin(Stdio::null())
-        .stdout(Stdio::null())
-        .stderr(Stdio::piped())
-        .output();
-    match out {
-        Ok(o) if o.status.success() => Ok(()),
-        Ok(o) => {
-            let _ = std::fs::remove_file(&path);
-            let said = String::from_utf8_lossy(&o.stderr).trim().to_string();
-            Err(if said.is_empty() {
-                "Could not open Terminal.".into()
-            } else {
-                format!("Could not open Terminal: {said}")
-            })
-        }
-        Err(e) => {
-            let _ = std::fs::remove_file(&path);
-            Err(format!("Could not open Terminal: {e}"))
-        }
-    }
-}
-
-#[cfg(not(target_os = "macos"))]
-pub fn open_in_terminal(_name: &str, _script: &str) -> Result<(), String> {
-    let _ = &SCRIPT_COUNTER;
-    Err("Installing from the app is only available on macOS so far.".into())
-}
-
-/// Put `text` on the clipboard (`pbcopy`). The connect page is not a secure
-/// context, so it cannot use the web clipboard API itself.
-pub fn copy_to_clipboard(text: &str) -> Result<(), String> {
-    let mut child = Command::new("/usr/bin/pbcopy")
-        .stdin(Stdio::piped())
-        .stdout(Stdio::null())
-        .stderr(Stdio::null())
-        .spawn()
-        .map_err(|e| format!("Could not copy: {e}"))?;
-    if let Some(mut stdin) = child.stdin.take() {
-        stdin
-            .write_all(text.as_bytes())
-            .map_err(|e| format!("Could not copy: {e}"))?;
-    }
-    match child.wait() {
-        Ok(s) if s.success() => Ok(()),
-        _ => Err("Could not copy the command.".into()),
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1217,8 +915,7 @@ mod tests {
     #[cfg(target_os = "macos")]
     #[test]
     fn plutil_reads_both_launch_agent_shapes() {
-        let n = SCRIPT_COUNTER.fetch_add(1, Ordering::Relaxed);
-        let dir = std::env::temp_dir().join(format!("codeman-plist-test-{}-{n}", std::process::id()));
+        let dir = std::env::temp_dir().join(format!("codeman-plist-test-{}", std::process::id()));
         std::fs::create_dir_all(&dir).unwrap();
         let install_sh = r#"<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -1850,7 +1547,7 @@ mod tests {
     /// the answers come back in the order of the addresses.
     #[test]
     fn found_servers_are_asked_together() {
-        use std::io::Read;
+        use std::io::{Read, Write};
         use std::net::TcpListener;
         use std::sync::mpsc;
 
@@ -1923,238 +1620,4 @@ mod tests {
         assert_eq!(pick_port(|p| p >= 3002), 3002);
         assert_eq!(pick_port(|_| false), 3000);
     }
-
-    #[test]
-    fn quoting() {
-        assert_eq!(sh_quote("plain"), "'plain'");
-        assert_eq!(sh_quote("it's"), r"'it'\''s'");
-        assert_eq!(sh_quote(""), "''");
-    }
-
-    #[test]
-    fn local_install_flags() {
-        assert_eq!(
-            local_install_args(LocalInstall {
-                port: 3000,
-                network: false
-            }),
-            ["--local", "--service", "--port", "3000"]
-        );
-        assert_eq!(
-            local_install_args(LocalInstall {
-                port: 3007,
-                network: true
-            }),
-            ["--service", "--port", "3007"]
-        );
-    }
-
-    /// Run a script under bash with `curl` and `bash`... replaced, and report
-    /// what it did. The real installer never runs in a test.
-    #[cfg(unix)]
-    fn run_script(script: &str, fakes: &[(&str, &str)]) -> (String, i32, bool) {
-        use std::os::unix::fs::PermissionsExt;
-        let n = SCRIPT_COUNTER.fetch_add(1, Ordering::Relaxed);
-        let dir = std::env::temp_dir().join(format!("codeman-setup-test-{}-{n}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(dir.join("bin")).unwrap();
-        for (name, body) in fakes {
-            let p = dir.join("bin").join(name);
-            std::fs::write(&p, body.replace("DIR", &dir.display().to_string())).unwrap();
-            std::fs::set_permissions(&p, std::fs::Permissions::from_mode(0o755)).unwrap();
-        }
-        let file = dir.join("run.command");
-        std::fs::write(&file, script).unwrap();
-        let out = Command::new("/bin/bash")
-            .arg(&file)
-            .env("PATH", format!("{}:/usr/bin:/bin", dir.join("bin").display()))
-            .env("TMPDIR", &dir)
-            .stdin(Stdio::null())
-            .output()
-            .unwrap();
-        let log = std::fs::read_to_string(dir.join("log")).unwrap_or_default();
-        let self_deleted = !file.exists();
-        let _ = std::fs::remove_dir_all(&dir);
-        (log, out.status.code().unwrap_or(-1), self_deleted)
-    }
-
-    #[cfg(unix)]
-    #[test]
-    fn local_script_downloads_then_runs_the_installer_with_its_flags() {
-        let script = local_install_script(LocalInstall {
-            port: 3001,
-            network: false,
-        });
-        let (log, code, self_deleted) = run_script(
-            &script,
-            &[(
-                "curl",
-                r#"#!/bin/sh
-echo "curl $*" >> DIR/log
-out=""
-while [ $# -gt 0 ]; do [ "$1" = -o ] && out="$2"; shift; done
-cat > "$out" <<'INSTALLER'
-for a in "$@"; do printf '[%s]' "$a" >> DIR/log; done
-echo >> DIR/log
-exit 7
-INSTALLER
-"#,
-            )],
-        );
-        assert!(self_deleted, "the script must delete itself");
-        assert!(
-            log.starts_with("curl -fsSL https://getcodeman.com/install -o "),
-            "{log}"
-        );
-        assert!(log.contains("\n[--local][--service][--port][3001]\n"), "{log}");
-        assert_eq!(code, 7, "the installer's exit status is the script's");
-    }
-
-    #[cfg(unix)]
-    #[test]
-    fn local_script_stops_when_the_download_fails() {
-        let script = local_install_script(LocalInstall {
-            port: 3000,
-            network: true,
-        });
-        let (log, code, _) = run_script(&script, &[("curl", "#!/bin/sh\necho curl >> DIR/log\nexit 22\n")]);
-        assert_eq!(log, "curl\n");
-        assert_eq!(code, 1);
-    }
-
-    #[test]
-    fn ssh_targets() {
-        assert_eq!(
-            SshTarget::parse(" kay@build-box ").unwrap(),
-            SshTarget {
-                user: Some("kay".into()),
-                host: "build-box".into(),
-                port: None
-            }
-        );
-        assert_eq!(
-            SshTarget::parse("pi@192.168.1.20:2222").unwrap(),
-            SshTarget {
-                user: Some("pi".into()),
-                host: "192.168.1.20".into(),
-                port: Some(2222)
-            }
-        );
-        assert_eq!(SshTarget::parse("macmini").unwrap().destination(), "macmini");
-        assert_eq!(
-            SshTarget::parse("a.b@tnode.tailnet.ts.net").unwrap().destination(),
-            "a.b@tnode.tailnet.ts.net"
-        );
-        for bad in [
-            "",
-            "-oProxyCommand=touch /tmp/x",
-            "kay@-oProxyCommand=x",
-            "-l@host",
-            "kay@host name",
-            "kay@host;rm",
-            "kay@host$(x)",
-            "k'y@host",
-            "kay@",
-            "@host",
-            "kay@host:",
-            "kay@host:0",
-            "kay@host:x",
-            "kay@fe80::1",
-            "kay@[::1]",
-            "a@b@c",
-            ".hidden",
-        ] {
-            assert!(SshTarget::parse(bad).is_err(), "accepted {bad:?}");
-        }
-        assert_eq!(SshTarget::parse("kay@box").unwrap().suggested_url(), "http://box:3000");
-    }
-
-    #[test]
-    fn ssh_arguments() {
-        let t = SshTarget::parse("kay@box:2222").unwrap();
-        let args = ssh_args(&t);
-        assert_eq!(&args[..5], ["-t", "-p", "2222", "--", "kay@box"]);
-        assert_eq!(args.len(), 6);
-        let remote = &args[5];
-        let head = "bash -o pipefail -c '";
-        assert!(remote.starts_with(head) && remote.ends_with('\''));
-        // One word for fish and tcsh: no quote inside, nothing they expand.
-        let inner = &remote[head.len()..remote.len() - 1];
-        assert!(!inner.contains(['\'', '!', '$', '\\', '`']), "{inner}");
-        assert!(inner.contains("curl -fsSL https://getcodeman.com/install | bash"));
-        assert_eq!(ssh_args(&SshTarget::parse("box").unwrap())[..3], ["-t", "--", "box"]);
-    }
-
-    #[cfg(unix)]
-    #[test]
-    fn remote_script_runs_ssh_with_exactly_those_arguments() {
-        let t = SshTarget::parse("kay@box:2222").unwrap();
-        let (log, code, self_deleted) = run_script(
-            &remote_install_script(&t),
-            &[(
-                "ssh",
-                "#!/bin/sh\nfor a in \"$@\"; do printf '[%s]' \"$a\" >> DIR/log; done\necho >> DIR/log\nexit 3\n",
-            )],
-        );
-        assert!(self_deleted);
-        let expected: String = ssh_args(&t).iter().map(|a| format!("[{a}]")).collect();
-        assert_eq!(log, format!("{expected}\n"));
-        assert_eq!(code, 3);
-    }
-
-    /// The remote command does what it says under a POSIX shell: curl first,
-    /// wget without curl, and a clear error with neither.
-    #[cfg(unix)]
-    #[test]
-    fn remote_command_picks_a_downloader() {
-        use std::os::unix::fs::PermissionsExt;
-        let n = SCRIPT_COUNTER.fetch_add(1, Ordering::Relaxed);
-        let dir = std::env::temp_dir().join(format!("codeman-remote-cmd-{}-{n}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(dir.join("bin")).unwrap();
-        let exe = |name: &str, body: &str| {
-            let p = dir.join("bin").join(name);
-            std::fs::write(&p, body).unwrap();
-            std::fs::set_permissions(&p, std::fs::Permissions::from_mode(0o755)).unwrap();
-        };
-        // The outer `bash -o pipefail` is the real one; the `bash` the
-        // download is piped into only reports what it was fed.
-        exe(
-            "bash",
-            "#!/bin/sh\nif [ \"$1\" = -o ]; then exec /bin/bash \"$@\"; fi\nprintf 'bash got: '; /bin/cat\n",
-        );
-        exe("wget", "#!/bin/sh\necho \"wget $*\"\n");
-        let run = || {
-            let out = Command::new("/bin/sh")
-                .arg("-c")
-                .arg(remote_command())
-                .env("PATH", dir.join("bin"))
-                .output()
-                .unwrap();
-            (
-                String::from_utf8_lossy(&out.stdout).into_owned(),
-                String::from_utf8_lossy(&out.stderr).into_owned(),
-                out.status.code(),
-            )
-        };
-        let (out, _, _) = run();
-        assert_eq!(out, "bash got: wget -qO- https://getcodeman.com/install\n");
-        exe("curl", "#!/bin/sh\necho \"curl $*\"\n");
-        let (out, _, _) = run();
-        assert_eq!(out, "bash got: curl -fsSL https://getcodeman.com/install\n");
-        // A failed download fails the command (pipefail), not "Done".
-        exe(
-            "curl",
-            "#!/bin/sh\necho 'curl: (6) Could not resolve host' >&2\nexit 6\n",
-        );
-        let (_, _, code) = run();
-        assert_ne!(code, Some(0));
-        std::fs::remove_file(dir.join("bin/curl")).unwrap();
-        std::fs::remove_file(dir.join("bin/wget")).unwrap();
-        let (out, err, code) = run();
-        assert_eq!(out, "");
-        assert!(err.contains("needs curl or wget"), "{err}");
-        assert_eq!(code, Some(1));
-        let _ = std::fs::remove_dir_all(&dir);
-    }
 }

packages/desktop/src/terminal_install.rs

@@ -0,0 +1,547 @@
+//! The installs that run in Terminal: on this Mac, and on another machine over
+//! SSH.
+//!
+//! The Terminal route is for what the in-app install (`gui_install.rs`) cannot
+//! do. `install.sh` asks for the administrator password on a terminal
+//! (Homebrew, its sudo keep-alive), the Xcode tools arrive as a system dialog,
+//! and ssh asks about host keys and passwords on a terminal too. So the app
+//! writes a small script that deletes itself and hands it to Terminal
+//! (`open -b com.apple.Terminal`), which needs no permission, unlike scripting
+//! Terminal through osascript (an Automation prompt). Everything the scripts
+//! contain is built here and unit-tested; the only text from the user is the
+//! SSH login, which `SshTarget::parse` limits to the characters of a user and
+//! host name before it is quoted.
+
+use std::io::Write;
+use std::process::{Command, Stdio};
+use std::sync::atomic::{AtomicU64, Ordering};
+
+use crate::setup::{DEFAULT_PORT, INSTALLER_URL};
+
+/// The Terminal scripts' file names (`<name>-<pid>-<n>.command`). The local
+/// one is also how `inspect` recognizes an install that is still running.
+pub const LOCAL_SCRIPT_NAME: &str = "install-codeman-local";
+pub const REMOTE_SCRIPT_NAME: &str = "install-codeman-remote";
+
+/// `s` as one bash word.
+pub fn sh_quote(s: &str) -> String {
+    format!("'{}'", s.replace('\'', r"'\''"))
+}
+
+/// What the This Mac install asks `install.sh` for.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct LocalInstall {
+    pub port: u16,
+    /// Let the installer ask how other devices reach Codeman (Tailscale, the
+    /// local network with a password). Off: this Mac only (`--local`).
+    pub network: bool,
+}
+
+/// `install.sh`'s flags for a This Mac install. Always `--service`: a
+/// LaunchAgent runs Codeman, so it keeps running when the app quits and starts
+/// again at login, and the app finds it there (read_service). No `--yes`: the
+/// user answers the installer's questions (Homebrew, AI coding tools).
+pub fn local_install_args(opts: LocalInstall) -> Vec<String> {
+    let mut args = Vec::new();
+    if !opts.network {
+        args.push("--local".to_string());
+    }
+    args.push("--service".to_string());
+    args.push("--port".to_string());
+    args.push(opts.port.to_string());
+    args
+}
+
+/// The Terminal script for a This Mac install. It downloads the installer to a
+/// temporary file and runs it from there, so the installer's input is the
+/// terminal itself.
+pub fn local_install_script(opts: LocalInstall) -> String {
+    let args = local_install_args(opts);
+    let shown = format!("bash install.sh {}", args.join(" "));
+    let quoted: Vec<String> = args.iter().map(|a| sh_quote(a)).collect();
+    format!(
+        r#"#!/bin/bash
+rm -f -- "$0"
+printf '\033]0;%s\007' 'Install Codeman'
+cat <<'CODEMAN_MSG'
+Installing Codeman on this Mac.
+
+The installer may ask for your Mac password (it installs Homebrew, Node.js and
+tmux when they are missing) and which AI coding tools to set up. Codeman then
+runs in the background and starts when you log in, so your sessions keep
+running when the app is closed. The Codeman app opens it by itself when the
+install is done.
+
+CODEMAN_MSG
+tmp=$(mktemp "${{TMPDIR:-/tmp}}/codeman-install.XXXXXX") || exit 1
+trap 'rm -f "$tmp"' EXIT
+echo {from}
+if ! curl -fsSL {url} -o "$tmp"; then
+  echo
+  echo 'Could not download the installer. Check the internet connection, then try again from the Codeman app.'
+  exit 1
+fi
+echo {shown}
+echo
+bash "$tmp" {args}
+status=$?
+echo
+if [ "$status" -eq 0 ]; then
+  echo 'Done. You can close this window.'
+else
+  echo "The installer stopped (exit $status). Its log is ~/.codeman/install.log"
+fi
+exit "$status"
+"#,
+        from = sh_quote(&format!("Downloading the installer from {INSTALLER_URL}")),
+        url = sh_quote(INSTALLER_URL),
+        shown = sh_quote(&format!("$ {shown}")),
+        args = quoted.join(" "),
+    )
+}
+
+/// A machine to install Codeman on, as ssh takes it: `[user@]host`, plus a
+/// `:port` the app passes as `-p`. The host may be a name from `~/.ssh/config`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SshTarget {
+    pub user: Option<String>,
+    pub host: String,
+    pub port: Option<u16>,
+}
+
+const SSH_FORMAT: &str =
+    "Enter the machine the way ssh takes it: user@host (for example kay@build-box), or a name from your ssh config.";
+
+impl SshTarget {
+    /// Only the characters of a user and host name, never a leading `-` (ssh
+    /// would read it as an option) and never an IPv6 literal (ambiguous with
+    /// the port; a host name or an IPv4 address works).
+    pub fn parse(input: &str) -> Result<Self, String> {
+        let s = input.trim();
+        if s.is_empty() || s.len() > 300 {
+            return Err(SSH_FORMAT.into());
+        }
+        let (user, rest) = match s.split_once('@') {
+            Some((u, r)) => (Some(u), r),
+            None => (None, s),
+        };
+        let (host, port) = match rest.split_once(':') {
+            Some((h, p)) => {
+                let port = p.parse::<u16>().ok().filter(|p| *p > 0).ok_or_else(|| {
+                    "The part after the colon must be the SSH port, for example kay@build-box:2222.".to_string()
+                })?;
+                (h, Some(port))
+            }
+            None => (rest, None),
+        };
+        let name_ok = |v: &str, max: usize| {
+            !v.is_empty()
+                && v.len() <= max
+                && !v.starts_with(['-', '.'])
+                && v.chars().all(|c| c.is_ascii_alphanumeric() || "._-".contains(c))
+        };
+        if let Some(u) = user {
+            if !name_ok(u, 64) {
+                return Err(SSH_FORMAT.into());
+            }
+        }
+        if !name_ok(host, 253) {
+            return Err(SSH_FORMAT.into());
+        }
+        Ok(SshTarget {
+            user: user.map(str::to_string),
+            host: host.to_string(),
+            port,
+        })
+    }
+
+    /// `user@host`, or `host`.
+    pub fn destination(&self) -> String {
+        match &self.user {
+            Some(u) => format!("{u}@{}", self.host),
+            None => self.host.clone(),
+        }
+    }
+
+    /// The address the connect screen suggests once the install is done: the
+    /// installer's default port on that host. Tailscale and a sub-path give
+    /// another address, which the installer prints at the end.
+    pub fn suggested_url(&self) -> String {
+        format!("http://{}:{DEFAULT_PORT}", self.host)
+    }
+}
+
+/// What the remote login shell runs. It may be fish or tcsh, so the work is
+/// one single-quoted `bash -c` word with nothing in it those shells treat
+/// specially (no `!`, `$`, backslash or single quote). `curl | bash` is the
+/// documented install and the installer asks its questions on ssh's terminal
+/// (`-t`); `pipefail` makes a failed download fail the whole command, where a
+/// plain pipe would report bash's success on an empty script. The installer
+/// needs bash anyway.
+pub fn remote_command() -> String {
+    format!(
+        "bash -o pipefail -c 'if command -v curl >/dev/null 2>&1; then curl -fsSL {u} | bash; \
+         elif command -v wget >/dev/null 2>&1; then wget -qO- {u} | bash; \
+         else echo \"Codeman needs curl or wget on this machine.\" >&2; exit 1; fi'",
+        u = INSTALLER_URL
+    )
+}
+
+/// `ssh`'s arguments for an install on `target`: a terminal (`-t`) for the
+/// installer's questions, the port, and `--` before the destination.
+pub fn ssh_args(target: &SshTarget) -> Vec<String> {
+    let mut args = vec!["-t".to_string()];
+    if let Some(port) = target.port {
+        args.push("-p".into());
+        args.push(port.to_string());
+    }
+    args.push("--".into());
+    args.push(target.destination());
+    args.push(remote_command());
+    args
+}
+
+/// The Terminal script for an install on another machine over SSH.
+pub fn remote_install_script(target: &SshTarget) -> String {
+    let args: Vec<String> = ssh_args(target).iter().map(|a| sh_quote(a)).collect();
+    let dest = target.destination();
+    format!(
+        r#"#!/bin/bash
+rm -f -- "$0"
+printf '\033]0;%s\007' {title}
+echo {what}
+cat <<'CODEMAN_MSG'
+
+ssh may ask you to confirm the machine and for its password. Then the installer
+asks how Codeman should be reached (Tailscale, the local network with a password,
+or that machine only) and whether to run it in the background. At the end it
+prints the address of Codeman there: connect to it in the Codeman app, under
+Another machine.
+
+CODEMAN_MSG
+ssh {args}
+status=$?
+echo
+if [ "$status" -eq 0 ]; then
+  echo 'Done. You can close this window.'
+else
+  echo "ssh or the installer stopped (exit $status)."
+fi
+exit "$status"
+"#,
+        title = sh_quote(&format!("Install Codeman on {}", target.host)),
+        what = sh_quote(&format!("Installing Codeman on {dest} over SSH.")),
+        args = args.join(" "),
+    )
+}
+
+static SCRIPT_COUNTER: AtomicU64 = AtomicU64::new(0);
+
+/// Run `script` in a new Terminal window. The script file is private to this
+/// user (the per-user temporary folder, mode 0700, created fresh) and deletes
+/// itself as it starts.
+#[cfg(target_os = "macos")]
+pub fn open_in_terminal(name: &str, script: &str) -> Result<(), String> {
+    use std::os::unix::fs::OpenOptionsExt;
+
+    let n = SCRIPT_COUNTER.fetch_add(1, Ordering::Relaxed);
+    let path = std::env::temp_dir().join(format!("{name}-{}-{n}.command", std::process::id()));
+    let written = std::fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(0o700)
+        .open(&path)
+        .and_then(|mut f| f.write_all(script.as_bytes()));
+    if let Err(e) = written {
+        let _ = std::fs::remove_file(&path);
+        return Err(format!("Could not write the install script: {e}"));
+    }
+    let out = Command::new("/usr/bin/open")
+        .args(["-b", "com.apple.Terminal"])
+        .arg(&path)
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::piped())
+        .output();
+    match out {
+        Ok(o) if o.status.success() => Ok(()),
+        Ok(o) => {
+            let _ = std::fs::remove_file(&path);
+            let said = String::from_utf8_lossy(&o.stderr).trim().to_string();
+            Err(if said.is_empty() {
+                "Could not open Terminal.".into()
+            } else {
+                format!("Could not open Terminal: {said}")
+            })
+        }
+        Err(e) => {
+            let _ = std::fs::remove_file(&path);
+            Err(format!("Could not open Terminal: {e}"))
+        }
+    }
+}
+
+#[cfg(not(target_os = "macos"))]
+pub fn open_in_terminal(_name: &str, _script: &str) -> Result<(), String> {
+    let _ = &SCRIPT_COUNTER;
+    Err("Installing from the app is only available on macOS so far.".into())
+}
+
+/// Put `text` on the clipboard (`pbcopy`). The connect page is not a secure
+/// context, so it cannot use the web clipboard API itself.
+pub fn copy_to_clipboard(text: &str) -> Result<(), String> {
+    let mut child = Command::new("/usr/bin/pbcopy")
+        .stdin(Stdio::piped())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .spawn()
+        .map_err(|e| format!("Could not copy: {e}"))?;
+    if let Some(mut stdin) = child.stdin.take() {
+        stdin
+            .write_all(text.as_bytes())
+            .map_err(|e| format!("Could not copy: {e}"))?;
+    }
+    match child.wait() {
+        Ok(s) if s.success() => Ok(()),
+        _ => Err("Could not copy the command.".into()),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn quoting() {
+        assert_eq!(sh_quote("plain"), "'plain'");
+        assert_eq!(sh_quote("it's"), r"'it'\''s'");
+        assert_eq!(sh_quote(""), "''");
+    }
+
+    #[test]
+    fn local_install_flags() {
+        assert_eq!(
+            local_install_args(LocalInstall {
+                port: 3000,
+                network: false
+            }),
+            ["--local", "--service", "--port", "3000"]
+        );
+        assert_eq!(
+            local_install_args(LocalInstall {
+                port: 3007,
+                network: true
+            }),
+            ["--service", "--port", "3007"]
+        );
+    }
+
+    /// Run a script under bash with `curl` and `bash`... replaced, and report
+    /// what it did. The real installer never runs in a test.
+    #[cfg(unix)]
+    fn run_script(script: &str, fakes: &[(&str, &str)]) -> (String, i32, bool) {
+        use std::os::unix::fs::PermissionsExt;
+        let n = SCRIPT_COUNTER.fetch_add(1, Ordering::Relaxed);
+        let dir = std::env::temp_dir().join(format!("codeman-setup-test-{}-{n}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(dir.join("bin")).unwrap();
+        for (name, body) in fakes {
+            let p = dir.join("bin").join(name);
+            std::fs::write(&p, body.replace("DIR", &dir.display().to_string())).unwrap();
+            std::fs::set_permissions(&p, std::fs::Permissions::from_mode(0o755)).unwrap();
+        }
+        let file = dir.join("run.command");
+        std::fs::write(&file, script).unwrap();
+        let out = Command::new("/bin/bash")
+            .arg(&file)
+            .env("PATH", format!("{}:/usr/bin:/bin", dir.join("bin").display()))
+            .env("TMPDIR", &dir)
+            .stdin(Stdio::null())
+            .output()
+            .unwrap();
+        let log = std::fs::read_to_string(dir.join("log")).unwrap_or_default();
+        let self_deleted = !file.exists();
+        let _ = std::fs::remove_dir_all(&dir);
+        (log, out.status.code().unwrap_or(-1), self_deleted)
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn local_script_downloads_then_runs_the_installer_with_its_flags() {
+        let script = local_install_script(LocalInstall {
+            port: 3001,
+            network: false,
+        });
+        let (log, code, self_deleted) = run_script(
+            &script,
+            &[(
+                "curl",
+                r#"#!/bin/sh
+echo "curl $*" >> DIR/log
+out=""
+while [ $# -gt 0 ]; do [ "$1" = -o ] && out="$2"; shift; done
+cat > "$out" <<'INSTALLER'
+for a in "$@"; do printf '[%s]' "$a" >> DIR/log; done
+echo >> DIR/log
+exit 7
+INSTALLER
+"#,
+            )],
+        );
+        assert!(self_deleted, "the script must delete itself");
+        assert!(
+            log.starts_with("curl -fsSL https://getcodeman.com/install -o "),
+            "{log}"
+        );
+        assert!(log.contains("\n[--local][--service][--port][3001]\n"), "{log}");
+        assert_eq!(code, 7, "the installer's exit status is the script's");
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn local_script_stops_when_the_download_fails() {
+        let script = local_install_script(LocalInstall {
+            port: 3000,
+            network: true,
+        });
+        let (log, code, _) = run_script(&script, &[("curl", "#!/bin/sh\necho curl >> DIR/log\nexit 22\n")]);
+        assert_eq!(log, "curl\n");
+        assert_eq!(code, 1);
+    }
+
+    #[test]
+    fn ssh_targets() {
+        assert_eq!(
+            SshTarget::parse(" kay@build-box ").unwrap(),
+            SshTarget {
+                user: Some("kay".into()),
+                host: "build-box".into(),
+                port: None
+            }
+        );
+        assert_eq!(
+            SshTarget::parse("pi@192.168.1.20:2222").unwrap(),
+            SshTarget {
+                user: Some("pi".into()),
+                host: "192.168.1.20".into(),
+                port: Some(2222)
+            }
+        );
+        assert_eq!(SshTarget::parse("macmini").unwrap().destination(), "macmini");
+        assert_eq!(
+            SshTarget::parse("a.b@tnode.tailnet.ts.net").unwrap().destination(),
+            "a.b@tnode.tailnet.ts.net"
+        );
+        for bad in [
+            "",
+            "-oProxyCommand=touch /tmp/x",
+            "kay@-oProxyCommand=x",
+            "-l@host",
+            "kay@host name",
+            "kay@host;rm",
+            "kay@host$(x)",
+            "k'y@host",
+            "kay@",
+            "@host",
+            "kay@host:",
+            "kay@host:0",
+            "kay@host:x",
+            "kay@fe80::1",
+            "kay@[::1]",
+            "a@b@c",
+            ".hidden",
+        ] {
+            assert!(SshTarget::parse(bad).is_err(), "accepted {bad:?}");
+        }
+        assert_eq!(SshTarget::parse("kay@box").unwrap().suggested_url(), "http://box:3000");
+    }
+
+    #[test]
+    fn ssh_arguments() {
+        let t = SshTarget::parse("kay@box:2222").unwrap();
+        let args = ssh_args(&t);
+        assert_eq!(&args[..5], ["-t", "-p", "2222", "--", "kay@box"]);
+        assert_eq!(args.len(), 6);
+        let remote = &args[5];
+        let head = "bash -o pipefail -c '";
+        assert!(remote.starts_with(head) && remote.ends_with('\''));
+        // One word for fish and tcsh: no quote inside, nothing they expand.
+        let inner = &remote[head.len()..remote.len() - 1];
+        assert!(!inner.contains(['\'', '!', '$', '\\', '`']), "{inner}");
+        assert!(inner.contains("curl -fsSL https://getcodeman.com/install | bash"));
+        assert_eq!(ssh_args(&SshTarget::parse("box").unwrap())[..3], ["-t", "--", "box"]);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn remote_script_runs_ssh_with_exactly_those_arguments() {
+        let t = SshTarget::parse("kay@box:2222").unwrap();
+        let (log, code, self_deleted) = run_script(
+            &remote_install_script(&t),
+            &[(
+                "ssh",
+                "#!/bin/sh\nfor a in \"$@\"; do printf '[%s]' \"$a\" >> DIR/log; done\necho >> DIR/log\nexit 3\n",
+            )],
+        );
+        assert!(self_deleted);
+        let expected: String = ssh_args(&t).iter().map(|a| format!("[{a}]")).collect();
+        assert_eq!(log, format!("{expected}\n"));
+        assert_eq!(code, 3);
+    }
+
+    /// The remote command does what it says under a POSIX shell: curl first,
+    /// wget without curl, and a clear error with neither.
+    #[cfg(unix)]
+    #[test]
+    fn remote_command_picks_a_downloader() {
+        use std::os::unix::fs::PermissionsExt;
+        let n = SCRIPT_COUNTER.fetch_add(1, Ordering::Relaxed);
+        let dir = std::env::temp_dir().join(format!("codeman-remote-cmd-{}-{n}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(dir.join("bin")).unwrap();
+        let exe = |name: &str, body: &str| {
+            let p = dir.join("bin").join(name);
+            std::fs::write(&p, body).unwrap();
+            std::fs::set_permissions(&p, std::fs::Permissions::from_mode(0o755)).unwrap();
+        };
+        // The outer `bash -o pipefail` is the real one; the `bash` the
+        // download is piped into only reports what it was fed.
+        exe(
+            "bash",
+            "#!/bin/sh\nif [ \"$1\" = -o ]; then exec /bin/bash \"$@\"; fi\nprintf 'bash got: '; /bin/cat\n",
+        );
+        exe("wget", "#!/bin/sh\necho \"wget $*\"\n");
+        let run = || {
+            let out = Command::new("/bin/sh")
+                .arg("-c")
+                .arg(remote_command())
+                .env("PATH", dir.join("bin"))
+                .output()
+                .unwrap();
+            (
+                String::from_utf8_lossy(&out.stdout).into_owned(),
+                String::from_utf8_lossy(&out.stderr).into_owned(),
+                out.status.code(),
+            )
+        };
+        let (out, _, _) = run();
+        assert_eq!(out, "bash got: wget -qO- https://getcodeman.com/install\n");
+        exe("curl", "#!/bin/sh\necho \"curl $*\"\n");
+        let (out, _, _) = run();
+        assert_eq!(out, "bash got: curl -fsSL https://getcodeman.com/install\n");
+        // A failed download fails the command (pipefail), not "Done".
+        exe(
+            "curl",
+            "#!/bin/sh\necho 'curl: (6) Could not resolve host' >&2\nexit 6\n",
+        );
+        let (_, _, code) = run();
+        assert_ne!(code, Some(0));
+        std::fs::remove_file(dir.join("bin/curl")).unwrap();
+        std::fs::remove_file(dir.join("bin/wget")).unwrap();
+        let (out, err, code) = run();
+        assert_eq!(out, "");
+        assert!(err.contains("needs curl or wget"), "{err}");
+        assert_eq!(code, Some(1));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}

src/local-model/runtime.ts

@@ -808,6 +808,45 @@ export async function removePartialModelBlobs(paths?: LocalModelPaths): Promise<
   return freed;
 }
 
+/** How many files of the blob folder are counted at most: a store holds a few dozen, and a walk must end. */
+const STORE_MEASURE_MAX_FILES = 20_000;
+
+/**
+ * What the model store takes on disk: the sizes of the regular files directly in
+ * `<models>/blobs`, summed. That folder is flat (one file per layer, plus the partial files of
+ * a download), so this is the store's real disk use, shared layers counted once, an
+ * interrupted download included. The manifests beside it are a few kilobytes and are left out.
+ *
+ * One `readdir` and one `lstat` per file, at most `STORE_MEASURE_MAX_FILES` of them. Nothing is
+ * followed: a `root`, a model store or a blob folder that is a symbolic link counts as empty,
+ * and so does a link in the place of a file. Never outside `LocalModelPaths.root`. Resolves 0
+ * when there is no store. Never throws.
+ */
+export async function measureModelStore(paths?: LocalModelPaths): Promise<number> {
+  let total = 0;
+  try {
+    const resolved = paths ?? localModelPaths(OLLAMA_RUNTIME_PIN.version);
+    const blobs = join(resolved.modelsDir, 'blobs');
+    if (!isInsideLocalModelRoot(blobs, resolved.root)) return 0;
+    for (const folder of [resolved.root, resolved.modelsDir, blobs]) {
+      const info = await lstat(folder);
+      if (info.isSymbolicLink() || !info.isDirectory()) return 0;
+    }
+    const names = await readdir(blobs);
+    for (const name of names.slice(0, STORE_MEASURE_MAX_FILES)) {
+      try {
+        const info = await lstat(join(blobs, name));
+        if (info.isFile()) total += info.size;
+      } catch {
+        // Gone between the listing and the look: a download or a delete is under way.
+      }
+    }
+  } catch {
+    // No model store yet.
+  }
+  return total;
+}
+
 // ---------- Port ----------
 
 /** Whether nothing holds `port` on 127.0.0.1, decided by binding it and letting go again. */

src/local-model/state-store.ts

@@ -26,6 +26,7 @@ import {
   type LocalModelErrorCode,
   type LocalModelInstallState,
   type LocalModelInstallStep,
+  type LocalModelLibraryEntry,
   type LocalModelStateFile,
 } from '../types.js';
 import { OLLAMA_RUNTIME_PIN } from './runtime.js';
@@ -153,6 +154,41 @@ function parseConnection(value: unknown): LocalModelStateFile['connection'] {
     : undefined;
 }
 
+/** How many checked models a state file may list: far more than one Mac holds, and a bound on what a damaged file can cost. */
+const MAX_LIBRARY_ENTRIES = 64;
+
+/**
+ * The checked models of a file. An entry without its id, label, context or digest is dropped
+ * (it could never be switched to), and so is a second entry for an id. `undefined` for a file
+ * that has no list, which is what an earlier build wrote.
+ */
+function parseLibrary(value: unknown): LocalModelLibraryEntry[] | undefined {
+  if (!Array.isArray(value)) return undefined;
+  const entries: LocalModelLibraryEntry[] = [];
+  for (const item of value) {
+    if (entries.length >= MAX_LIBRARY_ENTRIES) break;
+    if (!isRecord(item)) continue;
+    const id = text(item.id, 200);
+    const label = text(item.label, 200);
+    const context = count(item.context);
+    const digest = text(item.digest, 200);
+    if (!id || !label || !context || !digest || entries.some((entry) => entry.id === id)) continue;
+    const bytes = count(item.bytes);
+    const cli = parseCli(item.cli);
+    const verifiedAt = text(item.verifiedAt, 64);
+    entries.push({
+      id,
+      label,
+      context,
+      digest,
+      ...(bytes ? { bytes } : {}),
+      ...(cli ? { cli } : {}),
+      ...(verifiedAt ? { verifiedAt } : {}),
+    });
+  }
+  return entries;
+}
+
 /**
  * The state a file's text stands for. Pure and total: text that is not a JSON object of
  * `schema: 1` with a known `state` is `IDLE_LOCAL_MODEL_STATE`. Members it does not know are
@@ -180,6 +216,7 @@ export function parseLocalModelState(raw: string): LocalModelStateFile {
   const connection = parseConnection(parsed.connection);
   const updatedAt = text(parsed.updatedAt, 64);
   const replacedModelId = text(parsed.replacedModelId, 200);
+  const library = parseLibrary(parsed.library);
   if (!model || !cli) return IDLE_LOCAL_MODEL_STATE;
 
   if (state === 'installed') {
@@ -192,6 +229,7 @@ export function parseLocalModelState(raw: string): LocalModelStateFile {
       cli,
       runtime,
       ...(loaded ? { loaded } : {}),
+      ...(library ? { library } : {}),
       ...(connection ? { connection } : {}),
       ...(updatedAt ? { updatedAt } : {}),
     };
@@ -215,6 +253,7 @@ export function parseLocalModelState(raw: string): LocalModelStateFile {
     ...(runtime ? { runtime } : {}),
     ...(progress ? { progress } : {}),
     ...(loaded ? { loaded } : {}),
+    ...(library ? { library } : {}),
     ...(connection ? { connection } : {}),
     ...(replacedModelId ? { replacedModelId } : {}),
     ...(updatedAt ? { updatedAt } : {}),

src/types/local-model-install.ts

@@ -24,7 +24,11 @@
  * | `GET /api/local-model`           | none                        | none (a failed probe is an answer)                    |
  * | `POST /api/local-model/install`  | `LocalModelInstallRequest`  | 400 not a row the server offers, or a saved endpoint  |
  * |                                  |                             | already has the reserved id; 409 `job-running`,       |
- * |                                  |                             | `already-installed`, `size-changed`                   |
+ * |                                  |                             | `already-installed` (this model at this context is    |
+ * |                                  |                             | the one in use), `size-changed`, `sessions-open`      |
+ * | `POST /api/local-model/use`      | `LocalModelUseRequest`      | 400 not a checked model of the library, or no coding  |
+ * |                                  |                             | agent for it is installed; 409 `job-running`,         |
+ * |                                  |                             | `wrong-state`, `already-installed`, `sessions-open`   |
  * | `POST /api/local-model/cancel`   | none                        | 409 `wrong-state` (no job is running)                 |
  * | `POST /api/local-model/resume`   | `LocalModelResumeRequest`   | 409 `job-running`, `wrong-state` (not paused or       |
  * |                                  |                             | failed), `sessions-open` (another port while live     |
@@ -33,6 +37,9 @@
  * |                                  |                             | `sessions-open` (stop, or another port, while live    |
  * |                                  |                             | sessions use the model)                               |
  * | `DELETE /api/local-model`        | `LocalModelRemoveRequest`   | 409 `job-running`, `sessions-open`                    |
+ * | `DELETE /api/local-model/models` | `LocalModelDeleteRequest`   | 400 not a model of this Mac; 409 `job-running`,       |
+ * |                                  |                             | `wrong-state`, `model-active`, `runtime-not-running`; |
+ * |                                  |                             | 500 the runtime did not delete it                     |
  *
  * A 409 is the error envelope plus `data: LocalModelConflict`:
  * `{ success: false, error, errorCode: 'CONFLICT', data: { reason, message, ... } }`. A 409
@@ -141,7 +148,10 @@ export const LOCAL_MODEL_INSTALL_STEPS: readonly LocalModelInstallStep[] = [
  * | `harness-failed`          | the coding agent's install command failed, or its binary is still missing |
  * | `endpoint-id-taken`       | a saved endpoint with our id exists that this feature did not write      |
  * | `connect-failed`          | the endpoint record or the settings flag could not be written            |
- * | `model-changed`           | installed: the model's digest is not the one stored at install time      |
+ * | `model-changed`           | installed: the model's digest is not the one stored at install time. A   |
+ * |                           | switch: the model's digest is not the one it was checked with            |
+ * | `job-unfinished`          | a job that changes the model in use is running or stopped. Only a        |
+ * |                           | refused session start says it: nothing is started until the job ended    |
  * | `internal`                | anything unexpected (the exception text is in `detail`)                  |
  */
 export type LocalModelErrorCode =
@@ -164,6 +174,7 @@ export type LocalModelErrorCode =
   | 'endpoint-id-taken'
   | 'connect-failed'
   | 'model-changed'
+  | 'job-unfinished'
   | 'internal';
 
 /**
@@ -192,12 +203,25 @@ export type LocalModelNextStep = 'retry' | 'other-port' | 'next-model' | 'start'
  *  - `cancel`: `POST /api/local-model/cancel`.
  *  - `resume`: `POST /api/local-model/resume`.
  *  - `start` and `stop`: `POST /api/local-model/runtime`.
- *  - `remove`: `DELETE /api/local-model`.
+ *  - `remove`: `DELETE /api/local-model`. In `idle` it is listed only while the model store
+ *    still holds something (models an earlier Remove kept): it is then what frees that space.
  *  - `start-session`: not a route of this feature: the window starts a session on the endpoint
  *    `endpointId` with the coding agent `cli`. Offered only while the runtime runs and nothing
  *    blocks a session.
+ *  - `use`: `POST /api/local-model/use`. Listed only while a row of `library` offers it.
+ *  - `delete-model`: `DELETE /api/local-model/models`. Listed only while a row of `library`
+ *    offers it.
  */
-export type LocalModelAction = 'install' | 'cancel' | 'resume' | 'start' | 'stop' | 'remove' | 'start-session';
+export type LocalModelAction =
+  | 'install'
+  | 'cancel'
+  | 'resume'
+  | 'start'
+  | 'stop'
+  | 'remove'
+  | 'start-session'
+  | 'use'
+  | 'delete-model';
 
 /** Whether the Mac has the developer tools (git, Python) a coding agent calls. */
 export type LocalModelDeveloperTools =
@@ -225,7 +249,9 @@ export type LocalModelDeveloperTools =
  * | `errHarnessFailed`     | `cli`: the coding agent's label                                      |
  * | `errEndpointIdTaken`   | `id`: the endpoint id this feature uses                              |
  * | `refusedAgentNotInstallable` | `cli`: the coding agent's label                                |
- * | `refusedOtherModel`    | `model`: the label of the model that is installed                    |
+ * | `refusedOtherModel`    | `model`: the label of the model that is in use                       |
+ * | `refusedAgentMissing`  | `cli`: the coding agent's label                                      |
+ * | `conflictModelActive`, `deleteFailed` | `model`: the model's label                            |
  * | `conflictSizeChanged`  | `size`: the server's own total as decimal GB                         |
  * | `conflictSessionsOpen` | `sessions`: the session names, joined with ', '                      |
  *
@@ -259,16 +285,23 @@ export const LOCAL_MODEL_INSTALL_LABELS = {
     'A saved model connection named {id} already exists and was not created here. Rename or delete it in App Settings, then try again.',
   errConnectFailed: 'Codeman could not save the connection to the model.',
   errModelChanged: 'The model on this Mac changed since it was installed. Remove it and install it again.',
+  errJobUnfinished:
+    'The model on this Mac is being changed and is not ready. Finish or undo that in the local model window first.',
   errInternal: 'The install stopped on an unexpected error.',
   conflictJobRunning: 'An install is already running.',
-  conflictAlreadyInstalled: 'A model is already installed on this Mac. Remove it first.',
+  conflictAlreadyInstalled: 'This model is already in use on this Mac.',
+  conflictModelActive: '{model} is the model in use. Switch to another model first, or remove the local model.',
   conflictSizeChanged: 'The download is {size} GB now. Check the sizes and confirm again.',
   conflictSessionsOpen: 'Sessions are still using this model: {sessions}. Close them first.',
   conflictWrongState: 'That is not possible in the current state.',
   refusedModelNotOffered: 'This model at this context is not offered for this Mac right now.',
   refusedAgentNotOffered: 'This coding agent is not offered for this model.',
   refusedAgentNotInstallable: '{cli} is not installed and cannot be installed from here.',
-  refusedOtherModel: 'Only {model} is installed on this Mac. Remove it and install another model first.',
+  refusedOtherModel: 'Only {model} is in use on this Mac. Switch models in the local model window first.',
+  refusedNotInLibrary: 'This model is not one of the checked models on this Mac.',
+  refusedNotOnThisMac: 'This model is not on this Mac.',
+  deleteFailed: '{model} could not be deleted from this Mac.',
+  refusedAgentMissing: '{cli} is not installed on this Mac. Install this model again to choose a coding agent.',
   endpointManaged:
     'This endpoint belongs to the model Codeman runs on this Mac. Change or remove it in the local model window.',
   endpointIdReserved: 'This endpoint id is reserved for the model Codeman runs on this Mac. Pick another id.',
@@ -307,6 +340,7 @@ export const LOCAL_MODEL_ERROR_LABELS: Record<LocalModelErrorCode, LocalModelIns
   'endpoint-id-taken': LOCAL_MODEL_INSTALL_LABELS.errEndpointIdTaken,
   'connect-failed': LOCAL_MODEL_INSTALL_LABELS.errConnectFailed,
   'model-changed': LOCAL_MODEL_INSTALL_LABELS.errModelChanged,
+  'job-unfinished': LOCAL_MODEL_INSTALL_LABELS.errJobUnfinished,
   internal: LOCAL_MODEL_INSTALL_LABELS.errInternal,
 };
 
@@ -331,6 +365,7 @@ export const LOCAL_MODEL_ERROR_NEXT: Record<LocalModelErrorCode, LocalModelNextS
   'endpoint-id-taken': 'retry',
   'connect-failed': 'retry',
   'model-changed': 'remove',
+  'job-unfinished': 'retry',
   internal: 'retry',
 };
 
@@ -426,7 +461,8 @@ export interface LocalModelLoadedFacts {
  * | `port`                            |      | once chosen | once chosen | once chosen | yes |
  * | `loaded`, `endpointId`            |      |            |        |        | yes       |
  *
- * `running`, `developerTools`, `runtime`, `folder` and `actions` are always present.
+ * `running`, `developerTools`, `runtime`, `folder`, `library` and `actions` are always
+ * present. `store` is present once the model store was measured.
  */
 export interface LocalModelInstallView {
   state: LocalModelInstallState;
@@ -454,10 +490,63 @@ export interface LocalModelInstallView {
   loaded?: LocalModelLoadedFacts;
   /** The id of the saved endpoint a session is started on. */
   endpointId?: string;
+  /**
+   * The models on this Mac: every model Codeman checked (`LocalModelStateFile.library`), plus
+   * whatever else the running runtime lists. Empty in `idle` (no runtime is there to ask) and
+   * before anything was downloaded. The model in use comes first.
+   */
+  library: LocalModelLibraryRow[];
+  /** What the model store takes on disk right now. Present in every state once it was measured. */
+  store?: LocalModelStoreView;
   /** What the server accepts right now, see `LocalModelAction`. */
   actions: LocalModelAction[];
 }
 
+/**
+ * How a model of the library stands.
+ *  - `ready`: checked by Codeman, and the runtime (when it was asked) still lists it with the
+ *    digest that was stored.
+ *  - `changed`: checked, but the runtime now lists another digest under the name. It is never
+ *    started: `use` would fail with `model-changed`.
+ *  - `missing`: checked, but the runtime no longer lists it (something deleted it through the
+ *    runtime's port).
+ *  - `unverified`: the runtime lists it and Codeman never checked it: a model an earlier
+ *    Remove kept, the model of a job that has not passed its check yet, or one another program
+ *    pulled through the runtime's port. Never startable.
+ */
+export type LocalModelLibraryStatus = 'ready' | 'changed' | 'missing' | 'unverified';
+
+/** What can be done with one row of `library`: `POST /api/local-model/use` and `DELETE /api/local-model/models`. */
+export type LocalModelLibraryAction = 'use' | 'delete';
+
+/** One model on this Mac. */
+export interface LocalModelLibraryRow {
+  /** The model's name exactly as the runtime lists it (`name:tag`). */
+  id: string;
+  /** Its catalogue label, or `id` for a model the catalogue does not know. */
+  label: string;
+  /** The context it was checked with. Absent for an `unverified` row. */
+  context?: number;
+  /** Its size on disk: what the runtime reports, else what was recorded when it was checked. */
+  sizeBytes?: number;
+  /** `sizeBytes` as decimal GB text, no unit. Present exactly when `sizeBytes` is. */
+  sizeGb?: string;
+  /** It is the model in use: the one of an `installed` state. */
+  active: boolean;
+  /** Codeman checked it (`LocalModelStateFile.library` holds it). */
+  verified: boolean;
+  status: LocalModelLibraryStatus;
+  /** What the server accepts for this row right now. `delete` needs the running runtime. */
+  actions: LocalModelLibraryAction[];
+}
+
+/** The disk use of the model store: the files directly in its blob folder, summed. */
+export interface LocalModelStoreView {
+  bytes: number;
+  /** `bytes` as decimal GB text, no unit. */
+  gb: string;
+}
+
 /** The `data` of `GET /api/local-model`. Admin only in multi-user mode. */
 export interface LocalModelStatus {
   hardware: HardwareFacts;
@@ -511,6 +600,18 @@ export interface LocalModelRemoveRequest {
   removeModel?: boolean;
 }
 
+/** Body of `POST /api/local-model/use`: a checked model of `library` to switch to. Nothing is downloaded. */
+export interface LocalModelUseRequest {
+  /** `LocalModelLibraryRow.id` of a row whose `actions` list `use`. */
+  modelId: string;
+}
+
+/** Body of `DELETE /api/local-model/models`: one model to delete from the store. */
+export interface LocalModelDeleteRequest {
+  /** `LocalModelLibraryRow.id` of a row whose `actions` list `delete`. Never a path. */
+  modelId: string;
+}
+
 /** The `data` of a 400 the service names: its sentence, for the window to print in its own language. */
 export interface LocalModelRefusal {
   message: LocalModelInstallMessage;
@@ -522,20 +623,26 @@ export type LocalModelVerbAnswer = LocalModelInstallView;
 /**
  * Why a verb was refused with 409.
  *  - `job-running`: a job is running (a second install, a resume, a remove or a runtime action).
- *  - `already-installed`: install while a model is installed. Remove it first.
+ *  - `already-installed`: install or use of the model that is already the one in use (at the
+ *    same context).
  *  - `size-changed`: `acknowledgedBytes` is not the server's total; `expectedBytes` and
  *    `expectedGb` carry that total, so the window can show it and ask again.
- *  - `sessions-open`: remove, stop or a change of port while live sessions use the endpoint;
- *    `sessions` names them. Their coding agents were given the runtime's address when they
- *    started, so they would go on calling a port nothing of ours holds.
+ *  - `sessions-open`: remove, stop, a change of port, an install of another model or a switch
+ *    while live sessions use the endpoint; `sessions` names them. Their coding agents were
+ *    given the runtime's address and the model's name when they started, so they would go on
+ *    calling a port nothing of ours holds, or make the runtime swap models on every request.
  *  - `wrong-state`: the verb makes no sense in the current state (see the route table above).
+ *  - `model-active`: a delete of the model the installation or the current job is about.
+ *  - `runtime-not-running`: a delete while the runtime is down: only the runtime deletes a model.
  */
 export type LocalModelConflictReason =
   | 'job-running'
   | 'already-installed'
   | 'size-changed'
   | 'sessions-open'
-  | 'wrong-state';
+  | 'wrong-state'
+  | 'model-active'
+  | 'runtime-not-running';
 
 /** The `data` of a 409 of an install verb. */
 export interface LocalModelConflict {
@@ -622,6 +729,14 @@ export interface LocalModelStateFile {
   progress?: { completedBytes: number; totalBytes: number };
   /** What the runtime reported when the job checked the loaded model. */
   loaded?: { context: number; sizeBytes: number; sizeVramBytes: number };
+  /**
+   * Every model that PASSED the check through Codeman and is believed to be in the store, the
+   * model in use among them. An entry is written when the `verify` step passes and dropped
+   * when the model is deleted; `remove` drops the whole list. An `installed` file an earlier
+   * build wrote has none: its one model then counts as the library (`libraryOf()` in
+   * src/local-model/install-job.ts).
+   */
+  library?: LocalModelLibraryEntry[];
   /**
    * Present once the `connect` step CLAIMED the connection, which it does before its two
    * writes: what uninstall must undo. A claim with nothing behind it (the step was interrupted
@@ -636,3 +751,19 @@ export interface LocalModelStateFile {
   /** ISO time of the last write. */
   updatedAt?: string;
 }
+
+/** One checked model of `LocalModelStateFile.library`. It holds no path. */
+export interface LocalModelLibraryEntry {
+  id: string;
+  label: string;
+  /** The context length in tokens it was checked with. */
+  context: number;
+  /** The digest `/api/tags` reported when it passed the check. A switch to it must find the same one. */
+  digest: string;
+  /** Its size on disk as the runtime reported it then, for a listing while the runtime is stopped. */
+  bytes?: number;
+  /** The coding agent of the job that checked it. A switch back takes it when it is installed. */
+  cli?: { id: string; label: string };
+  /** ISO time of the check. */
+  verifiedAt?: string;
+}

src/types/local-model.ts

@@ -554,6 +554,12 @@ export interface Candidate {
   installBytes: number;
   /** `installBytes` as decimal GB text, no unit. */
   installGb: string;
+  /**
+   * Set by the route, never by `recommend()`: this model at this context is a checked model of
+   * the library on this Mac (`LocalModelInstallView.library`). `active`: it is the model in
+   * use. `ready`: `POST /api/local-model/use` switches to it, and nothing is downloaded.
+   */
+  library?: 'active' | 'ready';
 }
 
 /**

src/web/CLAUDE.md

@@ -48,7 +48,7 @@ Frontend JS modules have `@fileoverview` with `@dependency`/`@loadorder` tags. L
 
 **Opened outside Codeman** (`foreign-sessions.js`, both home screens): the tmux sessions a human started, listed from `GET /api/mux/foreign` (root CLAUDE.md, Adopted tmux sessions). ONE renderer, `renderForeignSessions(container)`, fills the welcome block and the phone overview's, and every row goes through `textContent`, since a session name and a command line come from someone else's process. ⚠️ It polls only while a home screen is up (`startForeignPolling`/`stopForeignPolling` from `showWelcome()`/`hideWelcome()`) and the tab is visible (`_foreignPollTick()` is the one gate, and `visibilitychange` catches up; the cache TTL sits under the poll interval, so one tab's every tick is a full socket sweep), and the poll is local only: the docker and ssh scan costs one connection per target, so it runs once on the toggle and again on Rescan, and its rows and notes are kept apart (`_foreignWideSessions`, `_foreignWideNotes`) or the next local poll would wipe them. ⚠️ A 403 is a non-admin in multi-user mode, an answer and not a failed poll: `_foreignRefused` stops the polling and shows no block. ⚠️ `closeSession()` re-reads the list after an adopted tab's DELETE, since the home screen's own load races it and the row would say `Go to tab` until the next poll. ⚠️ An adopted tab has no kill outcome to offer, so the close dialog hides the red button and always tears the wrapper down. ⚠️ `session.remote` and `session.docker` are undefined on an adopted session, so a check that hides a row for those two usually needs `session.adopt` as well. Tests: `test/foreign-sessions-ui.test.ts`, `test/foreign-sessions-i18n.test.ts` (harvests every string from the real module).
 
-**Run a model on this Mac** (`local-model-ui.js`; welcome button `#welcomeLocalModelBtn`, chooser window `#localModelModal`, App Settings > Models row `#localModelSettings`; server rules in the root CLAUDE.md, Local model): ONE window does everything (choose, confirm, progress, paused, failed, installed, no recommendation); the button and the Settings row only open it. Which screen shows follows `install.state` of `GET /api/local-model`; the page itself holds only the selection and whether the person is on the chooser or the confirm screen. ⚠️ The window is ONE frame for the whole flow: a fixed height on desktop (`.modal-content.local-model-window`), App Settings' boxed close button, the body scrolling between the header and a foot of its own (`#localModelWindowFoot`): every screen's last part (`.lm-foot`, or the `.lm-remove` question) is moved there by `_renderLocalModelWindow()`, so a button never moves away from under the pointer and is never clipped; a test that looks for a button looks in the frame, not the body. The short screens are centred in that frame on desktop and sit above the buttons on a phone (`data-screen` on the body). ⚠️ The memory bar (`.lm-bar`, `role="meter"`) is the one strong element: filled to the selected row's `budgetShare`, the model at its PEAK (the legend says so, and the installed line uses the same words beside what the model takes now, so the two figures are never read as a contradiction), the memory map (`Candidate.memory`: the model, its context and the brief peaks side by side, each named in the legend, on a track of `--text-muted` at about a third) in the feature's own colours (`--lm-*`: white for the feature, turned over to dark ink on the light skins, blue the context, green good, amber tight, orange slow, rose the brief peaks, deeper on the light skins), never `--accent`, which the owner rejected as too much blue (about 3:1 against the window, so the free part can be seen; a border token is 1.5:1 and the inputs' `--bg-input` is the window's own surface on the dark skins), 10px, no gradient or glow, and its width transition is the only motion (off under `prefers-reduced-motion`); a repaint starts each bar at the last width of its kind, so keep `_settleLocalModelBars()` after every body write. The figure beside it is an estimate and says "about" in whole GB (`localModelWholeGb()` on the server's text); only the download figure keeps tabular figures. ⚠️ The rows are the server's pick first, then the other models by download size, largest first (`localModelCandidates()`): the server's alternatives are its ranking, which no column shows. ⚠️ The download bar means ONE thing, the model download: at the start while the runtime is fetched, gone once the model is in (the step list carries verify, agent and connect); the first paint after an install finished shows "Start a session" alone (`justInstalled`), an error on an installed model is the headline with a grey dot, and Remove is quiet everywhere but red in its own question, never the accent. ⚠️ The window polls the GET once a second WHILE OPEN and never otherwise (no SSE event): `closeLocalModelWindow()` clears the timer, a background tab asks nothing, an unchanged answer repaints nothing, and a tick that moved only the download replaces `.lm-meter` alone, so a button is never swapped out under a click. A read that was already under way when a verb answered is dropped (`_localModelVerbs`), or the old state flashes back. ⚠️ The consent is bound to the size shown: the install request carries the row's `installBytes` as `acknowledgedBytes`, and a 409 `size-changed` shows `expectedGb` and sends `expectedBytes` next; never compute a total here. ⚠️ A button exists only for an action in `install.actions`, and after an error exactly one helpful action (`error.next`, already adapted by the server to the state: `start` on an installed model, `retry` on a job) plus a quiet Remove; an error's text is split after its first sentence (`localModelSentences()`, which knows the ideographic full stop) and only that sentence is the headline. A refusal the server names (a 400, a full disk) carries `data.message` like a 409 and is printed from it, never from the English `error` text. ⚠️ Every dynamic string goes in through `textContent` (model, coding agent and chip names, an error's detail, session names, the folder and the install command are someone else's text); the window body, the button and the row carry `data-i18n-skip` and the module translates its own sentences at render time, so a language or display-name change repaints from the module (the `<html lang>` observer). ⚠️ Labels and sentences come from the payload (`{ text, vars }` through `localModelT`); the module holds no list of models or coding agents, compares no CLI id (the agent select's values are positions in the server's list, the id travels only as data into the install request and `selectCustomModelEntry`) and never contains the word "RecoLine truncated
+**Run a model on this Mac** (`local-model-ui.js`; welcome button `#welcomeLocalModelBtn`, chooser window `#localModelModal`, App Settings > Models row `#localModelSettings`; server rules in the root CLAUDE.md, Local model): ONE window does everything (choose, confirm, progress, paused, failed, installed, no recommendation); the button and the Settings row only open it. ⚠️ The models on this Mac (`install.library`) are ONE list builder, `_localModelLibraryEl()`: on the installed screen always (the model in use first, in the chooser's selected look, each row with the context it was checked with, a state tag and its size on disk), on a paused or failed screen only when a row offers something (the way back to an earlier model), never on the screen that ends an install. A row has "Use" and "Delete" only for what the server lists for THAT row (`row.actions`); Use is a switch with no confirm screen (nothing is downloaded), Delete asks once in place under its row (`.lm-lib-ask`, the one red button, the focus on Cancel), and the asked row keeps its buttons unseen (`.lm-lib-actions-away`) so the sizes do not jump sideways. Under the list: what all downloads take (`install.store`) and "Add a model", which opens the chooser from an installed model; there a row with `candidate.library` says "In use" or "On this Mac" and the main button becomes a disabled "In use" or "Use this model". With nothing installed and a store an earlier Remove kept, the chooser and the nothing-fits screen say what it takes and offer "Delete them" (`_localModelStoreEl()`). ⚠️ A screen that carries the list sets `data-long` on the body, which switches it from the centred short-screen layout (bottom-aligned on a phone) to top-aligned: a centred flex column that overflows cuts off its first lines. ⚠️ The row buttons live in `.lm-lib-actions`, not `.lm-buttons` (the screen's own buttons in the foot), and are a size smaller (`.lm-btn-row`). ⚠️ A job whose steps hold no `model` step is a switch (`localModelIsSwitch()`) and is named one ("Switching to", no download bar). Which screen shows follows `install.state` of `GET /api/local-model`; the page itself holds only the selection and whether the person is on the chooser or the confirm screen. ⚠️ The window is ONE frame for the whole flow: a fixed height on desktop (`.modal-content.local-model-window`), App Settings' boxed close button, the body scrolling between the header and a foot of its own (`#localModelWindowFoot`): every screen's last part (`.lm-foot`, or the `.lm-remove` question) is moved there by `_renderLocalModelWindow()`, so a button never moves away from under the pointer and is never clipped; a test that looks for a button looks in the frame, not the body. The short screens are centred in that frame on desktop and sit above the buttons on a phone (`data-screen` on the body). ⚠️ The memory bar (`.lm-bar`, `role="meter"`) is the one strong element: filled to the selected row's `budgetShare`, the model at its PEAK (the legend says so, and the installed line uses the same words beside what the model takes now, so the two figures are never read as a contradiction), the memory map (`Candidate.memory`: the model, its context and the brief peaks side by side, each named in the legend, on a track of `--text-muted` at about a third) in the feature's own colours (`--lm-*`: white for the feature, turned over to dark ink on the light skins, blue the context, green good, amber tight, orange slow, rose the brief peaks, deeper on the light skins), never `--accent`, which the owner rejected as too much blue (about 3:1 against the window, so the free part can be seen; a border token is 1.5:1 and the inputs' `--bg-input` is the window's own surface on the dark skins), 10px, no gradient or glow, and its width transition is the only motion (off under `prefers-reduced-motion`); a repaint starts each bar at the last width of its kind, so keep `_settleLocalModelBars()` after every body write. The figure beside it is an estimate and says "about" in whole GB (`localModelWholeGb()` on the server's text); only the download figure keeps tabular figures. ⚠️ The rows are the server's pick first, then the other models by download size, largest first (`localModelCandidates()`): the server's alternatives are its ranking, which no column shows. ⚠️ The download bar means ONE thing, the model download: at the start while the runtime is fetched, gone once the model is in (the step list carries verify, agent and connect); the first paint after an install finished shows "Start a session" alone (`justInstalled`), an error on an installed model is the headline with a grey dot, and Remove is quiet everywhere but red in its own question, never the accent. ⚠️ The window polls the GET once a second WHILE OPEN and never otherwise (no SSE event): `closeLocalModelWindow()` clears the timer, a background tab asks nothing, an unchanged answer repaints nothing, and a tick that moved only the download reLine truncated
 
 **Home-screen session order** (`CodemanSessionOrder` in constants.js, pure): BOTH home screens (phone overview, desktop rail) must order rows through this ONE comparator. Rank `needs` → `error` → `waiting` → `working` → `idle` → `done`. ⚠️ The tiebreak flips: states a session is still IN sort oldest-first, states it has STOPPED sort newest-first. ⚠️ The running group keys off `lastSubmitAt`, never `lastActivityAt` (a working pane repaints constantly). ⚠️ A 0 stamp means unknown and sorts last within its state. Final tiebreak is `orderIndex`, so the list never shuffles. The tab strip itself is NOT sorted by this. Test: `test/session-overview-order.test.ts`. → [architecture-invariants#home-screen-session-order](../../docs/architecture-invariants.md#home-screen-session-order)
 

src/web/public/i18n.js

@@ -1434,6 +1434,36 @@
     'Installing {model}': '正在安装 {model}',
     'The install of {model} is paused': '{model} 的安装已暂停',
     'The install of {model} stopped': '{model} 的安装已中止',
+    // A switch to a model that is on this Mac already: nothing is downloaded.
+    'Switching to {model}': '正在切换到 {model}',
+    'The switch to {model} is paused': '切换到 {model} 的操作已暂停',
+    'The switch to {model} stopped': '切换到 {model} 的操作已中止',
+    'The switch waits until you continue.': '切换会等你点击继续后再进行。',
+    'You can close this window. The switch continues while Codeman is running.':
+      '可以关闭此窗口。只要 {name} 在运行，切换就会继续。',
+    // The models on this Mac: the list of the installed screen, its states and its two actions.
+    'Models on this Mac': '此 Mac 上的模型',
+    'On disk': '占用磁盘',
+    '{context} tokens': '{context} 个令牌',
+    'In use': '使用中',
+    Ready: '就绪',
+    Changed: '已变化',
+    Missing: '已缺失',
+    'Not checked': '未检查',
+    'On this Mac': '已在此 Mac 上',
+    Use: '使用',
+    'Use {model}': '使用 {model}',
+    'Use this model': '使用此模型',
+    'Delete {model}': '删除 {model}',
+    'Delete {model} from this Mac?': '要从此 Mac 删除 {model} 吗？',
+    'This frees {size} GB.': '这会释放 {size} GB。',
+    'Downloaded models use {size} GB on this Mac.': '已下载的模型在此 Mac 上占用 {size} GB。',
+    'Press Start to delete a single model.': '点击“启动”后才能删除单个模型。',
+    'Add a model': '添加模型',
+    'Delete the downloaded models from this Mac?': '要从此 Mac 删除已下载的模型吗？',
+    'Models from an earlier install still use {size} GB on this Mac.':
+      '之前安装留下的模型仍在此 Mac 上占用 {size} GB。',
+    'Delete them': '删除它们',
     '{model} is running': '{model} 正在运行',
     '{model} is installed and stopped': '{model} 已安装，当前已停止',
     'Checking this Mac': '正在检查此 Mac',
@@ -1578,9 +1608,13 @@
     'Codeman could not save the connection to the model.': '{name} 无法保存与模型的连接。',
     'The model on this Mac changed since it was installed. Remove it and install it again.':
       '此 Mac 上的模型在安装后发生了变化。请移除后重新安装。',
+    'The model on this Mac is being changed and is not ready. Finish or undo that in the local model window first.':
+      '此 Mac 上的模型正在更换，尚未就绪。请先在本地模型窗口中完成或撤销这一操作。',
     'The install stopped on an unexpected error.': '安装因意外错误而中止。',
     'An install is already running.': '已有一个安装正在进行。',
-    'A model is already installed on this Mac. Remove it first.': '此 Mac 上已安装了一个模型。请先移除它。',
+    'This model is already in use on this Mac.': '此 Mac 已在使用这个模型。',
+    '{model} is the model in use. Switch to another model first, or remove the local model.':
+      '{model} 是正在使用的模型。请先切换到其他模型，或移除本地模型。',
     'The download is {size} GB now. Check the sizes and confirm again.':
       '现在的下载大小为 {size} GB。请核对大小后再次确认。',
     'Sessions are still using this model: {sessions}. Close them first.':
@@ -1590,8 +1624,13 @@
       '目前不为此 Mac 提供这一上下文大小下的该模型。',
     'This coding agent is not offered for this model.': '该模型不提供这个编程智能体。',
     '{cli} is not installed and cannot be installed from here.': '{cli} 尚未安装，也无法从这里安装。',
-    'Only {model} is installed on this Mac. Remove it and install another model first.':
-      '此 Mac 上只安装了 {model}。请先移除它，再安装其他模型。',
+    'Only {model} is in use on this Mac. Switch models in the local model window first.':
+      '此 Mac 目前只使用 {model}。请先在本地模型窗口中切换模型。',
+    'This model is not one of the checked models on this Mac.': '该模型不在此 Mac 上已检查的模型之列。',
+    'This model is not on this Mac.': '此 Mac 上没有这个模型。',
+    '{cli} is not installed on this Mac. Install this model again to choose a coding agent.':
+      '此 Mac 上没有安装 {cli}。请重新安装此模型，以便选择编程智能体。',
+    '{model} could not be deleted from this Mac.': '无法从此 Mac 删除 {model}。',
     // What the endpoint routes answer for the record of the model on this Mac (shown as a toast).
     'This endpoint belongs to the model Codeman runs on this Mac. Change or remove it in the local model window.':
       '此端点属于 {name} 在此 Mac 上运行的模型。请在本地模型窗口中更改或移除它。',

src/web/public/local-model-ui.js

@@ -7,10 +7,12 @@
  * drives the install verbs:
  *
  *   POST   /api/local-model/install   { modelId, cli, context, acknowledgedBytes }
+ *   POST   /api/local-model/use       { modelId }
  *   POST   /api/local-model/cancel
  *   POST   /api/local-model/resume    { newPort? }
  *   POST   /api/local-model/runtime   { action: 'start' | 'stop', newPort? }
  *   DELETE /api/local-model           { removeModel }
+ *   DELETE /api/local-model/models    { modelId }
  *
  * ## Three surfaces, one window
  *
@@ -25,14 +27,17 @@
  *    | Screen      | When                                                              |
  *    |-------------|-------------------------------------------------------------------|
  *    | `choose`    | idle: the memory bar, the models that fit as a radio group, the   |
- *    |             | coding agent, "Install on this Mac"                               |
+ *    |             | coding agent, "Install on this Mac". Also from an installed       |
+ *    |             | model ("Add a model"): a row that is on this Mac already says so  |
+ *    |             | and is switched to without a download                             |
  *    | `confirm`   | after that button: the download as a table with its total, where  |
  *    |             | it goes                                                           |
  *    | `progress`  | installing: the download bar, the steps, Cancel                   |
  *    | `paused`    | paused (Cancel or a server restart): Continue or Remove           |
  *    | `failed`    | failed: the server's sentence and the ONE action that helps       |
- *    | `installed` | installed: running or stopped, Start a session, Stop/Start, Remove |
- *    |             | (right after an install: Start a session alone)                   |
+ *    | `installed` | installed: running or stopped, the models on this Mac with their  |
+ *    |             | size on disk (Use, Delete), Add a model, Start a session,         |
+ *    |             | Stop/Start, Remove (right after an install: Start a session alone) |
  *    | `none`      | idle and nothing fits: the hardware line, the reason, Close       |
  *
  * The memory bar is the one strong element: the memory this Mac can give a model, filled to
@@ -49,6 +54,13 @@
  * size, largest first, which is a column the reader can see. The server's own order of the
  * alternatives is its ranking (what it would offer next), not a reading order.
  *
+ * The models on this Mac (`install.library`) are a list of their own, on the installed screen
+ * and on a paused or failed one that has a model to go back to: the model in use first, each
+ * with its size on disk and the two things a row can offer, "Use" (a switch, nothing is
+ * downloaded) and "Delete" (asked once, in the row). Under it the disk use of all downloaded
+ * models (`install.store`) and "Add a model". A row has a button only for an action the server
+ * lists for THAT row (`row.actions`).
+ *
  * ## Polling
  *
  * The window asks the GET once a second WHILE IT IS OPEN, and never otherwise (there is no SSE
@@ -100,6 +112,9 @@ const LOCAL_MODEL_MAX_AGE_MS = 60000;
 /** How often the open window asks where the install stands. */
 const LOCAL_MODEL_POLL_MS = 1000;
 
+/** What `confirmDelete` holds while the question is about everything an earlier Remove kept. No model id has a space. */
+const LOCAL_MODEL_STORE_KEY = 'the store';
+
 /** The tag kinds of the server's pick (`CandidateTagKind`): the ones drawn in the accent colour. */
 const LOCAL_MODEL_ACCENT_TAGS = ['tested', 'best', 'best-tight'];
 
@@ -202,6 +217,29 @@ function localModelCandidates(status) {
   );
 }
 
+/**
+ * Whether the job of `install` is a switch to a model that is on this Mac already: its steps
+ * hold no download. The steps are the server's; nothing is compared with a model or an agent.
+ */
+function localModelIsSwitch(install) {
+  const steps = Array.isArray(install.steps) ? install.steps : [];
+  return steps.length > 0 && !steps.includes('model');
+}
+
+/** The rows of `install.library`: the models on this Mac. A payload without the list has none. */
+function localModelLibrary(install) {
+  return (Array.isArray(install.library) ? install.library : []).filter((row) => row && typeof row.id === 'string');
+}
+
+/** What a library row's state is called, and the tag class that colours it. */
+function localModelLibraryTag(row) {
+  if (row.active === true) return { text: localModelT('In use'), kind: 'inuse' };
+  if (row.status === 'ready') return { text: localModelT('Ready'), kind: 'ready' };
+  if (row.status === 'changed') return { text: localModelT('Changed'), kind: 'changed' };
+  if (row.status === 'missing') return { text: localModelT('Missing'), kind: 'missing' };
+  return { text: localModelT('Not checked'), kind: 'unverified' };
+}
+
 /**
  * The coding agents a row can run with. A payload without the list means the one agent of the
  * row's flat fields.
@@ -516,6 +554,11 @@ Object.assign(CodemanApp.prototype, {
         /** The Remove question is open, and whether the downloaded model goes too. */
         confirmRemove: false,
         removeModel: true,
+        /**
+         * The Delete question of one row is open: that row's model id, or `LOCAL_MODEL_STORE_KEY`
+         * for the downloaded models an earlier Remove kept.
+         */
+        confirmDelete: null,
         /**
          * The install finished while this window was open: the screen that ends it shows
          * "Start a session" alone. Stop and Remove belong to the window opened later.
@@ -543,9 +586,10 @@ Object.assign(CodemanApp.prototype, {
     const install = localModelInstall(this._localModelStatus);
     const selection = this._localModelSelection();
     if (install.state === 'installing') return 'progress';
-    if (install.state === 'installed') return 'installed';
     const canInstall = install.actions.includes('install') && !!selection;
+    // The chooser is also where a second model is added to an installed one.
     if (canInstall && (ui.view === 'choose' || ui.view === 'confirm')) return ui.view;
+    if (install.state === 'installed') return 'installed';
     if (install.state === 'paused') return 'paused';
     if (install.state === 'failed') return 'failed';
     return selection ? 'choose' : 'none';
@@ -572,6 +616,7 @@ Object.assign(CodemanApp.prototype, {
       notice: null,
       expected: null,
       confirmRemove: false,
+      confirmDelete: null,
       justInstalled: false,
     });
     this._forgetLocalModelPaint();
@@ -690,10 +735,10 @@ Object.assign(CodemanApp.prototype, {
     this.renderLocalModel();
   },
 
-  /** Back to the chooser (from the confirm screen, or to pick another model after a stop). */
+  /** Back to the chooser (from the confirm screen, to pick another model after a stop, or to add one). */
   chooseLocalModel(modelId) {
     const ui = this._localModelWindowState();
-    Object.assign(ui, { view: 'choose', notice: null, expected: null, confirmRemove: false });
+    Object.assign(ui, { view: 'choose', notice: null, expected: null, confirmRemove: false, confirmDelete: null });
     if (typeof modelId === 'string') {
       ui.modelId = modelId;
       ui.cli = null;
@@ -749,6 +794,57 @@ Object.assign(CodemanApp.prototype, {
     this.renderLocalModel();
   },
 
+  /**
+   * "Use": switch to a model that is on this Mac already. Nothing is downloaded, so there is
+   * no confirm screen: the server loads and checks the model again and connects it.
+   */
+  async useLocalModel(modelId) {
+    const ui = this._localModelWindowState();
+    ui.confirmDelete = null;
+    const result = await this._localModelVerb('POST', '/api/local-model/use', { modelId });
+    // Started, or refused with the server's sentence: either way the state's own screen says it.
+    if (result.ok || result.conflict) ui.view = 'auto';
+    this.renderLocalModel();
+  },
+
+  /** "Delete" of one row: first the question in the row, then (with `confirmed`) the delete. */
+  async deleteLocalModelEntry(modelId, { confirmed = false } = {}) {
+    const ui = this._localModelWindowState();
+    if (!confirmed) {
+      Object.assign(ui, { confirmDelete: modelId, confirmRemove: false, notice: null });
+      this.renderLocalModel();
+      // On the safe answer, whatever had the focus (a click does not move it in every browser).
+      this._focusLocalModelWindow('delete-no');
+      return;
+    }
+    await this._localModelVerb('DELETE', '/api/local-model/models', { modelId });
+    ui.confirmDelete = null;
+    this.renderLocalModel();
+  },
+
+  /** "Delete them": the downloaded models an earlier Remove kept, while nothing is installed. */
+  async deleteLocalModelStore({ confirmed = false } = {}) {
+    const ui = this._localModelWindowState();
+    if (!confirmed) {
+      Object.assign(ui, { confirmDelete: LOCAL_MODEL_STORE_KEY, notice: null });
+      this.renderLocalModel();
+      this._focusLocalModelWindow('delete-no');
+      return;
+    }
+    await this._localModelVerb('DELETE', '/api/local-model', { removeModel: true });
+    ui.confirmDelete = null;
+    this.renderLocalModel();
+  },
+
+  /** Leave a Delete question without deleting. The focus goes back to the button that asked. */
+  keepLocalModelEntry() {
+    const ui = this._localModelWindowState();
+    const asked = ui.confirmDelete;
+    Object.assign(ui, { confirmDelete: null, notice: null });
+    this.renderLocalModel();
+    if (asked) this._focusLocalModelWindow(asked === LOCAL_MODEL_STORE_KEY ? 'store-delete' : `delete:${asked}`);
+  },
+
   cancelLocalModelInstall() {
     return this._localModelVerb('POST', '/api/local-model/cancel');
   },
@@ -767,7 +863,7 @@ Object.assign(CodemanApp.prototype, {
   async removeLocalModel({ confirmed = false } = {}) {
     const ui = this._localModelWindowState();
     if (!confirmed) {
-      Object.assign(ui, { confirmRemove: true, notice: null });
+      Object.assign(ui, { confirmRemove: true, confirmDelete: null, notice: null });
       this.renderLocalModel();
       return;
     }
@@ -829,9 +925,20 @@ Object.assign(CodemanApp.prototype, {
     const status = this._localModelStatus;
     const install = localModelInstall(status);
     const model = install.model ? String(install.model.label || install.model.id || '') : '';
-    if (install.state === 'installing') return localModelT('Installing {model}', { model });
-    if (install.state === 'paused') return localModelT('The install of {model} is paused', { model });
-    if (install.state === 'failed') return localModelT('The install of {model} stopped', { model });
+    const switching = localModelIsSwitch(install);
+    if (install.state === 'installing') {
+      return switching ? localModelT('Switching to {model}', { model }) : localModelT('Installing {model}', { model });
+    }
+    if (install.state === 'paused') {
+      return switching
+        ? localModelT('The switch to {model} is paused', { model })
+        : localModelT('The install of {model} is paused', { model });
+    }
+    if (install.state === 'failed') {
+      return switching
+        ? localModelT('The switch to {model} stopped', { model })
+        : localModelT('The install of {model} stopped', { model });
+    }
     if (install.state === 'installed') {
       if (install.running) return localModelT('{model} is running', { model });
       return localModelT('{model} is installed and stopped', { model });
@@ -917,6 +1024,8 @@ Object.assign(CodemanApp.prototype, {
       foot && tail && tail.classList && (tail.classList.contains('lm-foot') || tail.classList.contains('lm-remove'));
     body.dataset.screen = screen;
     body.replaceChildren(...(actions ? parts.slice(0, -1) : parts));
+    // A screen that carries the list of models starts at the top and scrolls (see styles.css).
+    body.dataset.long = body.querySelector('.lm-library') ? 'true' : 'false';
     if (foot) foot.replaceChildren(...(actions ? [tail] : []));
     body.scrollTop = scrolled;
     this._settleLocalModelBars(body);
@@ -1031,6 +1140,12 @@ Object.assign(CodemanApp.prototype, {
       tag.classList.add(`lm-tag-${candidate.tag.kind}`);
       tagSlot.appendChild(tag);
     }
+    // Already on this Mac: choosing it switches to it, and nothing is downloaded.
+    if (candidate.library === 'active') {
+      tagSlot.appendChild(localModelEl('span', 'lm-tag lm-tag-inuse', localModelT('In use')));
+    } else if (candidate.library === 'ready') {
+      tagSlot.appendChild(localModelEl('span', 'lm-tag lm-tag-ready', localModelT('On this Mac')));
+    }
     row.appendChild(tagSlot);
     const speed = localModelEl('span', 'lm-model-speed', localModelSpeedText(candidate));
     const gauge = localModelEl(
@@ -1153,6 +1268,10 @@ Object.assign(CodemanApp.prototype, {
     if (hints.length) runs.appendChild(localModelEl('span', 'lm-runs-hint', hints.join(' ')));
     parts.push(runs);
 
+    // Nothing is installed, and an earlier Remove kept its downloads: what they take, and the way to free it.
+    const leftovers = this._localModelStoreEl(install);
+    if (leftovers) parts.push(leftovers);
+
     const notice = this._localModelNoticeEl();
     if (notice) parts.push(notice);
 
@@ -1160,13 +1279,25 @@ Object.assign(CodemanApp.prototype, {
     const promise = localModelT('No account and no API key. The model runs only on this Mac.');
     foot.appendChild(localModelEl('p', 'lm-foot-note', promise));
     const buttons = localModelEl('div', 'lm-buttons');
-    // Reached from a paused or stopped install: the way back to it.
+    // Reached from a paused or stopped install, or from an installed model: the way back to it.
     if (install.state !== 'idle') {
       buttons.appendChild(
         localModelButton(localModelT('Back'), { key: 'back', onClick: () => this.leaveLocalModelChooser() })
       );
     }
-    if (install.actions.includes('install')) {
+    if (candidate.library === 'active') {
+      // The model that runs now: nothing to do with it here.
+      buttons.appendChild(localModelButton(localModelT('In use'), { key: 'primary', primary: true, disabled: true }));
+    } else if (candidate.library === 'ready' && install.actions.includes('use')) {
+      buttons.appendChild(
+        localModelButton(localModelT('Use this model'), {
+          key: 'primary',
+          primary: true,
+          disabled: ui.busy,
+          onClick: () => void this.useLocalModel(candidate.modelId),
+        })
+      );
+    } else if (install.actions.includes('install')) {
       buttons.appendChild(
         localModelButton(localModelT('Install on this Mac'), {
           key: 'primary',
@@ -1181,6 +1312,189 @@ Object.assign(CodemanApp.prototype, {
     return parts;
   },
 
+  /**
+   * The models on this Mac: one row per model of `install.library` with its name, the context
+   * it was checked with, its state, its size on disk and what the server offers for it. A row
+   * whose Delete was pressed is followed by the question, once, in place. `null` when there is
+   * no row, or (with `onlyWithActions`, for a paused or failed job) no row offers anything.
+   */
+  _localModelLibraryEl(install, { onlyWithActions = false } = {}) {
+    const ui = this._localModelWindowState();
+    const rows = localModelLibrary(install);
+    const offers = (row, action) => Array.isArray(row.actions) && row.actions.includes(action);
+    if (!rows.length) return null;
+    if (onlyWithActions && !rows.some((row) => offers(row, 'use') || offers(row, 'delete'))) return null;
+
+    const section = localModelEl('div', 'lm-library');
+    const list = localModelEl('div', 'lm-lib-list');
+    list.setAttribute('role', 'list');
+    list.setAttribute('aria-labelledby', 'localModelLibraryLabel');
+    const caption = localModelEl('div', 'lm-lib-caption');
+    const label = localModelEl('span', 'lm-lib-caption-label', localModelT('Models on this Mac'));
+    label.id = 'localModelLibraryLabel';
+    caption.appendChild(label);
+    caption.appendChild(localModelEl('span', 'lm-lib-caption-size', localModelT('On disk')));
+    list.appendChild(caption);
+
+    for (const row of rows) {
+      const name = String(row.label || row.id);
+      const item = localModelEl('div', row.active === true ? 'lm-lib-row lm-lib-row-on' : 'lm-lib-row');
+      item.setAttribute('role', 'listitem');
+      const what = localModelEl('div', 'lm-lib-name');
+      what.appendChild(localModelEl('span', 'lm-lib-label', name));
+      if (Number.isFinite(row.context)) {
+        what.appendChild(
+          localModelEl(
+            'span',
+            'lm-lib-meta',
+            localModelT('{context} tokens', { context: localModelCount(row.context) })
+          )
+        );
+      }
+      item.appendChild(what);
+      const tag = localModelLibraryTag(row);
+      const tagSlot = localModelEl('span', 'lm-lib-tag');
+      tagSlot.appendChild(localModelEl('span', `lm-tag lm-tag-${tag.kind}`, tag.text));
+      item.appendChild(tagSlot);
+      item.appendChild(localModelEl('span', 'lm-lib-size', row.sizeGb ? localModelGb(row.sizeGb) : ''));
+
+      const asking = ui.confirmDelete === row.id && offers(row, 'delete');
+      const actions = localModelEl('span', 'lm-lib-actions');
+      // While the row's question is open its buttons keep their place and are out of reach,
+      // so the column of sizes does not move when the question opens.
+      if (asking) {
+        actions.classList.add('lm-lib-actions-away');
+        actions.setAttribute('aria-hidden', 'true');
+      }
+      if (offers(row, 'use')) {
+        const use = localModelButton(localModelT('Use'), {
+          key: `use:${row.id}`,
+          disabled: ui.busy || asking,
+          onClick: () => void this.useLocalModel(row.id),
+        });
+        use.classList.add('lm-btn-row');
+        use.setAttribute('aria-label', localModelT('Use {model}', { model: name }));
+        actions.appendChild(use);
+      }
+      if (offers(row, 'delete')) {
+        const remove = localModelButton(localModelT('Delete'), {
+          key: `delete:${row.id}`,
+          disabled: ui.busy || asking,
+          onClick: () => void this.deleteLocalModelEntry(row.id),
+        });
+        remove.classList.add('lm-btn-row');
+        remove.setAttribute('aria-label', localModelT('Delete {model}', { model: name }));
+        actions.appendChild(remove);
+      }
+      item.appendChild(actions);
+      list.appendChild(item);
+
+      if (asking) {
+        list.appendChild(
+          this._localModelAskEl({
+            question: localModelT('Delete {model} from this Mac?', { model: name }),
+            detail: row.sizeGb ? localModelT('This frees {size} GB.', { size: row.sizeGb }) : '',
+            onYes: () => void this.deleteLocalModelEntry(row.id, { confirmed: true }),
+          })
+        );
+      }
+    }
+    section.appendChild(list);
+
+    const foot = localModelEl('div', 'lm-lib-foot');
+    const notes = localModelEl('div', 'lm-lib-notes');
+    const store = install.store;
+    if (store && Number(store.bytes) > 0 && store.gb) {
+      notes.appendChild(
+        localModelEl('p', 'lm-aside', localModelT('Downloaded models use {size} GB on this Mac.', { size: store.gb }))
+      );
+    }
+    // Only the runtime deletes a model: with it stopped, the rows offer none, and this says why.
+    if (install.state === 'installed' && install.running !== true && rows.length > 1) {
+      notes.appendChild(localModelEl('p', 'lm-aside', localModelT('Press Start to delete a single model.')));
+    }
+    if (notes.childElementCount) foot.appendChild(notes);
+    if (install.state === 'installed' && install.actions.includes('install') && this._localModelSelection()) {
+      const add = localModelButton(localModelT('Add a model'), {
+        key: 'add',
+        disabled: ui.busy,
+        onClick: () => this.chooseLocalModel(),
+      });
+      add.classList.add('lm-btn-row');
+      foot.appendChild(add);
+    }
+    if (foot.childElementCount) section.appendChild(foot);
+    return section;
+  },
+
+  /** A Delete question in place: the question, what it frees, Cancel and the red Delete. */
+  _localModelAskEl({ question, detail, onYes }) {
+    const ui = this._localModelWindowState();
+    const ask = localModelEl('div', 'lm-lib-ask');
+    ask.setAttribute('role', 'group');
+    const text = localModelEl('div', 'lm-lib-ask-text');
+    text.appendChild(localModelEl('p', 'lm-lead', question));
+    if (detail) text.appendChild(localModelEl('p', 'lm-aside', detail));
+    ask.appendChild(text);
+    const buttons = localModelEl('div', 'lm-lib-actions');
+    const no = localModelButton(localModelT('Cancel'), {
+      key: 'delete-no',
+      disabled: ui.busy,
+      onClick: () => this.keepLocalModelEntry(),
+    });
+    no.classList.add('lm-btn-row');
+    const yes = localModelButton(localModelT('Delete'), {
+      key: 'delete-yes',
+      danger: true,
+      disabled: ui.busy,
+      onClick: onYes,
+    });
+    yes.classList.add('lm-btn-row');
+    buttons.appendChild(no);
+    buttons.appendChild(yes);
+    ask.appendChild(buttons);
+    return ask;
+  },
+
+  /**
+   * Nothing is installed and the model store still holds downloads (an earlier Remove kept
+   * them): what they take on disk and "Delete them", asked once in place. `null` unless the
+   * server offers that removal.
+   */
+  _localModelStoreEl(install) {
+    const ui = this._localModelWindowState();
+    const store = install.store;
+    if (install.state !== 'idle' || !install.actions.includes('remove')) return null;
+    if (!store || !(Number(store.bytes) > 0) || !store.gb) return null;
+    if (ui.confirmDelete === LOCAL_MODEL_STORE_KEY) {
+      const box = localModelEl('div', 'lm-leftovers');
+      box.appendChild(
+        this._localModelAskEl({
+          question: localModelT('Delete the downloaded models from this Mac?'),
+          detail: localModelT('This frees {size} GB.', { size: store.gb }),
+          onYes: () => void this.deleteLocalModelStore({ confirmed: true }),
+        })
+      );
+      return box;
+    }
+    const box = localModelEl('div', 'lm-leftovers lm-lib-foot');
+    box.appendChild(
+      localModelEl(
+        'p',
+        'lm-aside',
+        localModelT('Models from an earlier install still use {size} GB on this Mac.', { size: store.gb })
+      )
+    );
+    const remove = localModelButton(localModelT('Delete them'), {
+      key: 'store-delete',
+      disabled: ui.busy,
+      onClick: () => void this.deleteLocalModelStore(),
+    });
+    remove.classList.add('lm-btn-row');
+    box.appendChild(remove);
+    return box;
+  },
+
   /** Arrow keys, Home and End move the selection of the radio group, and the focus with it. */
   _onLocalModelListKey(event) {
     const selection = this._localModelSelection();
@@ -1397,9 +1711,18 @@ Object.assign(CodemanApp.prototype, {
     const paused = screen === 'paused';
     const model = install.model ? String(install.model.label || install.model.id || '') : '';
     const parts = [];
-    const title = paused
-      ? localModelT('The install of {model} is paused', { model })
-      : localModelT('Installing {model}', { model });
+    // A switch to a model that is on this Mac already downloads nothing, and says so in its name.
+    const switching = localModelIsSwitch(install);
+    let title;
+    if (switching) {
+      title = paused
+        ? localModelT('The switch to {model} is paused', { model })
+        : localModelT('Switching to {model}', { model });
+    } else {
+      title = paused
+        ? localModelT('The install of {model} is paused', { model })
+        : localModelT('Installing {model}', { model });
+    }
     parts.push(localModelEl('p', 'lm-title', title));
 
     // The download bar takes the place of the memory bar, for as long as something downloads.
@@ -1414,19 +1737,26 @@ Object.assign(CodemanApp.prototype, {
       return parts;
     }
 
-    // What waits or goes on is the download while there is one, the install after it.
+    // What waits or goes on is the download while there is one, the install (or the switch) after it.
     const downloading = !!meter;
     let note;
-    if (paused) {
+    if (paused && switching) {
+      note = localModelT('The switch waits until you continue.');
+    } else if (paused) {
       note = downloading
         ? localModelT('The download waits until you continue.')
         : localModelT('The install waits until you continue.');
+    } else if (switching) {
+      note = localModelT('You can close this window. The switch continues while Codeman is running.');
     } else {
       note = downloading
         ? localModelT('You can close this window. The download continues while Codeman is running.')
         : localModelT('You can close this window. The install continues while Codeman is running.');
     }
     parts.push(localModelEl('p', 'lm-aside', note));
+    // A paused job that has a checked model beside it: the way back to that model.
+    const library = paused ? this._localModelLibraryEl(install, { onlyWithActions: true }) : null;
+    if (library) parts.push(library);
     const notice = this._localModelNoticeEl();
     if (notice) parts.push(notice);
 
@@ -1548,6 +1878,9 @@ Object.assign(CodemanApp.prototype, {
       parts.push(this._localModelRemoveEl());
       return parts;
     }
+    // A checked model beside the one that stopped: the way back to it.
+    const library = this._localModelLibraryEl(install, { onlyWithActions: true });
+    if (library) parts.push(library);
     const notice = this._localModelNoticeEl();
     if (notice) parts.push(notice);
 
@@ -1641,13 +1974,17 @@ Object.assign(CodemanApp.prototype, {
     const tools = this._localModelDeveloperToolsEl();
     if (tools) parts.push(tools);
     const notice = this._localModelNoticeEl();
-    if (notice) parts.push(notice);
 
     const can = (action) => install.actions.includes(action);
     const next = error ? this._localModelNextButton(install, error) : null;
     // The screen that ends an install has one button. Stop and Remove are for the window
     // opened later (or for this one once anything else was said in it).
     const ending = ui.justInstalled === true && can('start-session') && !error && !notice;
+    // Everything that is on this Mac, what it takes on disk, and the way to another model.
+    // Not on the screen that ends an install: that one says one thing.
+    const library = ending ? null : this._localModelLibraryEl(install);
+    if (library) parts.push(library);
+    if (notice) parts.push(notice);
     const foot = localModelEl('div', 'lm-foot');
     const buttons = localModelEl('div', 'lm-buttons');
     if (!ending && can('remove') && error?.next !== 'remove') {
@@ -1703,6 +2040,8 @@ Object.assign(CodemanApp.prototype, {
     if (hw) parts.push(hw);
     const reason = localModelMessage(status.recommendation.headline);
     if (reason) parts.push(localModelEl('p', 'lm-reason', reason));
+    const leftovers = this._localModelStoreEl(localModelInstall(status));
+    if (leftovers) parts.push(leftovers);
     const notice = this._localModelNoticeEl();
     if (notice) parts.push(notice);
     const foot = localModelEl('div', 'lm-foot');

src/web/public/mobile.css

@@ -1887,6 +1887,11 @@ html.mobile-init .file-browser-panel {
     justify-content: flex-end;
   }
 
+  /* A screen with the list of models scrolls from its top. */
+  .local-model-window > .lm-body[data-long='true'] {
+    justify-content: flex-start;
+  }
+
   /* Ralph wizard responsive */
   .modal-wizard {
     display: flex;
@@ -4339,6 +4344,61 @@ html[data-session-list="sidebar"] .session-sidebar .session-tab .tab-close {
     grid-column: 3;
   }
 
+  /* The models on this Mac: the name and its size, then the state and what can be done. */
+  .lm-lib-list {
+    grid-template-columns: minmax(0, 1fr) auto;
+    column-gap: 0.7rem;
+  }
+
+  .lm-lib-caption-label {
+    grid-column: 1;
+  }
+
+  .lm-lib-caption-size {
+    grid-column: 2;
+  }
+
+  .lm-lib-row {
+    row-gap: 0.15rem;
+    padding-top: 0.45rem;
+    padding-bottom: 0.45rem;
+  }
+
+  .lm-lib-name {
+    grid-row: 1;
+    grid-column: 1;
+    padding: 0;
+  }
+
+  .lm-lib-size {
+    grid-row: 1;
+    grid-column: 2;
+  }
+
+  .lm-lib-tag {
+    grid-row: 2;
+    grid-column: 1;
+  }
+
+  .lm-lib-actions {
+    grid-row: 2;
+    grid-column: 2;
+  }
+
+  .lm-lib-ask {
+    margin-inline: 0.7rem;
+  }
+
+  .lm-lib-foot {
+    flex-wrap: wrap;
+  }
+
+  /* A row's buttons keep their own size: they sit in the row, not under the thumb. */
+  .local-model-window .wt-btn.lm-btn.lm-btn-row {
+    min-height: 36px;
+    font-size: 0.8rem;
+  }
+
   .lm-foot {
     flex-direction: column;
     align-items: stretch;

src/web/public/styles.css

@@ -22467,6 +22467,13 @@ html[data-skin='rose-pine-dawn'] {
   padding-bottom: 2.2rem;
 }
 
+/* A screen that carries the list of models is no short screen: it starts at the
+   top and scrolls, or its first lines would be cut off above the frame. */
+.local-model-window > .lm-body[data-long='true'] {
+  justify-content: flex-start;
+  padding-bottom: 1.2rem;
+}
+
 /* The foot of the frame: the buttons of the screen (or the Remove question),
    outside the part that scrolls. */
 .local-model-window > .lm-foot-slot {
@@ -22808,7 +22815,9 @@ html[data-skin='rose-pine-dawn'] {
 
 .lm-model-tag {
   display: flex;
+  flex-wrap: wrap;
   justify-content: flex-start;
+  gap: 0.25rem;
 }
 
 /* A tag says one thing about a row, in the colour of what it says. */
@@ -22844,6 +22853,29 @@ html[data-skin='rose-pine-dawn'] {
   color: var(--lm-orange);
 }
 
+/* The states of a model that is on this Mac: in use takes the feature's own
+   colour, ready is good, a changed or missing one is a warning. A model that
+   was never checked keeps the quiet tag. */
+.lm-tag-inuse {
+  background: color-mix(in srgb, var(--lm-brand) 20%, transparent);
+  color: var(--lm-brand);
+}
+
+.lm-tag-ready {
+  background: color-mix(in srgb, var(--lm-good) 15%, transparent);
+  color: var(--lm-good);
+}
+
+.lm-tag-changed {
+  background: color-mix(in srgb, var(--lm-amber) 15%, transparent);
+  color: var(--lm-amber);
+}
+
+.lm-tag-missing {
+  background: color-mix(in srgb, var(--lm-orange) 15%, transparent);
+  color: var(--lm-orange);
+}
+
 .lm-model-speed,
 .lm-model-size {
   text-align: end;
@@ -23218,6 +23250,176 @@ html[data-skin='rose-pine-dawn'] {
   accent-color: var(--lm-brand);
 }
 
+/* ── the models on this Mac ───────────────────────────────────────── */
+/* Name with its context, state, size on disk, and what can be done with the
+   row. One grid like the chooser's, so the sizes line up down the list. The
+   model in use wears the chooser's selected look: it is the one that runs. */
+.lm-library {
+  display: flex;
+  flex-direction: column;
+  gap: 0.55rem;
+}
+
+.lm-lib-list {
+  display: grid;
+  grid-template-columns: minmax(0, max-content) minmax(0, 1fr) auto auto;
+  column-gap: 0.75rem;
+  row-gap: 0.1rem;
+  margin-inline: calc(-0.7rem - 2px) -0.7rem;
+}
+
+.lm-lib-caption,
+.lm-lib-row {
+  display: grid;
+  grid-column: 1 / -1;
+  grid-template-columns: subgrid;
+  align-items: center;
+  padding: 0 0.7rem;
+  border-inline-start: 2px solid transparent;
+}
+
+.lm-lib-caption {
+  padding-bottom: 0.3rem;
+  font-size: 0.7rem;
+  color: var(--text-dim);
+}
+
+.lm-lib-caption-label {
+  grid-column: 1 / span 2;
+}
+
+.lm-lib-caption-size {
+  grid-column: 3;
+  text-align: end;
+}
+
+.lm-lib-row {
+  min-height: 2.9rem;
+  border-radius: 9px;
+}
+
+.lm-lib-row-on {
+  border-inline-start-color: var(--lm-brand);
+  background: linear-gradient(
+    90deg,
+    color-mix(in srgb, var(--lm-brand) 17%, transparent),
+    color-mix(in srgb, var(--lm-brand) 4%, transparent)
+  );
+}
+
+.lm-lib-name {
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+  padding: 0.35rem 0;
+}
+
+.lm-lib-label {
+  font-size: 0.86rem;
+  font-weight: 600;
+  line-height: 1.35;
+  color: var(--text);
+  overflow-wrap: anywhere;
+}
+
+.lm-lib-meta {
+  font-size: 0.7rem;
+  line-height: 1.4;
+  color: var(--text-dim);
+  font-variant-numeric: tabular-nums;
+}
+
+.lm-lib-tag {
+  display: flex;
+  justify-content: flex-start;
+}
+
+.lm-lib-size {
+  text-align: end;
+  white-space: nowrap;
+  font-size: 0.8rem;
+  font-weight: 560;
+  color: var(--text);
+  font-variant-numeric: tabular-nums;
+}
+
+.lm-lib-actions {
+  display: flex;
+  flex-shrink: 0;
+  justify-content: flex-end;
+  gap: 0.35rem;
+}
+
+/* While a row's Delete question is open its buttons keep their room, unseen:
+   the sizes above and below must not jump sideways. */
+.lm-lib-actions-away {
+  visibility: hidden;
+}
+
+/* The buttons of a row are a size smaller than the buttons of the screen. */
+.local-model-window .wt-btn.lm-btn.lm-btn-row {
+  padding: 0.28rem 0.65rem;
+  font-size: 0.74rem;
+}
+
+/* The Delete question of one row, in place under it: the row is what it is about. */
+.lm-lib-ask {
+  display: flex;
+  grid-column: 1 / -1;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.5rem 1rem;
+  margin: 0.1rem 0.7rem 0.4rem;
+  padding: 0.6rem 0.75rem;
+  border: 1px solid var(--border);
+  border-radius: 9px;
+}
+
+.lm-lib-ask-text {
+  display: flex;
+  flex-direction: column;
+  gap: 0.1rem;
+  min-width: 0;
+}
+
+/* Under the list: what all downloads take on disk, and the way to another model. */
+.lm-lib-foot {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.5rem 1rem;
+}
+
+.lm-lib-notes {
+  display: flex;
+  flex-direction: column;
+  gap: 0.15rem;
+  min-width: 0;
+}
+
+/* Nothing installed, and an earlier Remove kept its downloads. */
+.lm-leftovers .lm-lib-ask {
+  margin-inline: 0;
+}
+
+/* A browser without subgrid: fixed tracks keep the columns in line. */
+@supports not (grid-template-columns: subgrid) {
+  .lm-lib-list {
+    display: block;
+  }
+
+  .lm-lib-caption,
+  .lm-lib-row {
+    grid-template-columns: minmax(0, 12rem) minmax(0, 1fr) 4.5rem minmax(0, auto);
+    column-gap: 0.75rem;
+  }
+
+  .lm-lib-row {
+    margin-top: 0.1rem;
+  }
+}
+
 /* ── the foot: one promise on the left, the action on the right ──── */
 .lm-foot {
   display: flex;
@@ -23293,6 +23495,10 @@ html[data-skin='rose-pine-dawn'] {
     min-height: 2.9rem;
   }
 
+  .local-model-window .wt-btn.lm-btn.lm-btn-row {
+    min-height: 36px;
+  }
+
   .lm-select {
     min-height: 36px;
   }

src/web/routes/local-model-routes.ts

@@ -6,15 +6,19 @@
  * |----------------------------------|-----------------------------|------------------------------------------------|
  * | `GET /api/local-model`           | none                        | `{ hardware, recommendation, catalogUpdated, install }` |
  * | `POST /api/local-model/install`  | `LocalModelInstallRequest`  | the install view; 400, 409                     |
+ * | `POST /api/local-model/use`      | `LocalModelUseRequest`      | the install view; 400, 409                     |
  * | `POST /api/local-model/cancel`   | none                        | the install view; 409                          |
  * | `POST /api/local-model/resume`   | `LocalModelResumeRequest`   | the install view; 409                          |
  * | `POST /api/local-model/runtime`  | `LocalModelRuntimeRequest`  | the install view; 409                          |
  * | `DELETE /api/local-model`        | `LocalModelRemoveRequest`   | the install view; 409                          |
+ * | `DELETE /api/local-model/models` | `LocalModelDeleteRequest`   | the install view; 400, 409, 500                |
  *
  * The GET is built from the hardware probe, the catalogue, the harness facts and the pure
  * `recommend()`, plus the `install` object of the install service
- * (`LocalModelService.view()`). Nothing is reformatted here: every size text and every
- * sentence in the payload was chosen by the modules that produced it. There is no SSE event:
+ * (`LocalModelService.view()`). The one thing joined here: a row of the recommendation that is
+ * a checked model of the library is marked (`Candidate.library`, by `markLibraryCandidates()`).
+ * Nothing is reformatted: every size text and every sentence in the payload was chosen by the
+ * modules that produced it. There is no SSE event:
  * the window polls the GET once a second while it is open.
  *
  * EXPERIMENTAL (docs/versioning-policy.md, "Experimental local model routes"): the routes and
@@ -45,9 +49,12 @@
  *    or of the endpoint store that was refused (a file that does not parse) is a 409 without
  *    `data`, with the fix.
  *  - The verbs do the work in the install service; this file only gates, parses and maps.
- *    `DELETE`, `runtime` and `resume` look at the live sessions: they hand their names to the
- *    service, which refuses a removal, a stop and a change of port while one of them still
- *    uses the model.
+ *    `DELETE /api/local-model`, `runtime`, `resume`, `install` and `use` look at the live
+ *    sessions: they hand their names to the service, which refuses a removal, a stop, a change
+ *    of port, another model and a switch while one of them still uses the model.
+ *  - `DELETE /api/local-model/models` takes a model NAME in its body, never a path: the schema
+ *    admits only `name:tag`, and the service deletes only a name of its own listing, through
+ *    the runtime.
  *  - Every dependency is injected (`LocalModelRouteDeps`), so a route test spawns nothing and
  *    does not need a Mac: it passes its own hardware, harness facts and service.
  */
@@ -83,16 +90,19 @@ import { buildHarnessFacts } from '../../local-model/harness-facts.js';
 import {
   formatInstallMessage,
   getLocalModelService,
+  markLibraryCandidates,
   type LocalModelActor,
   type LocalModelService,
   type LocalModelVerbResult,
 } from '../../local-model/install-job.js';
 import { recommend } from '../../local-model/recommend.js';
 import {
+  LocalModelDeleteSchema,
   LocalModelInstallSchema,
   LocalModelRemoveSchema,
   LocalModelResumeSchema,
   LocalModelRuntimeSchema,
+  LocalModelUseSchema,
 } from '../schemas.js';
 import { SettingsWriteRefusedError, settingsWriteErrorResponse } from '../settings-writer.js';
 
@@ -156,7 +166,7 @@ export interface LocalModelConflictResponse {
   data: LocalModelConflict;
 }
 
-/** The 400 (or 507) of a verb the service refused with a sentence: the error envelope plus that sentence as `data`. */
+/** The 400 (or 500, or 507) of a verb the service refused with a sentence: the error envelope plus that sentence as `data`. */
 export interface LocalModelRefusalResponse {
   success: false;
   /** The sentence in English, its slots filled. */
@@ -251,8 +261,12 @@ export function registerLocalModelRoutes(
         // The measured budget once the runtime reported it, and the runtime download that an
         // install would still add: what turns the estimate into the figures of the consent.
         const options = await service.recommendOptions();
-        const recommendation = resolved.recommend(hardware, catalog, harnessFacts, options);
         const install = await service.view();
+        // A row that is already a checked model on this Mac says so: choosing it is a switch.
+        const recommendation = markLibraryCandidates(
+          resolved.recommend(hardware, catalog, harnessFacts, options),
+          install
+        );
         return { success: true, data: { hardware, recommendation, catalogUpdated: catalog.updated, install } };
       } catch (err) {
         reply.code(500);
@@ -268,7 +282,17 @@ export function registerLocalModelRoutes(
     const denied = adminOnly(req, reply);
     if (denied) return denied;
     const body = parseBody(LocalModelInstallSchema, req.body);
-    return runVerb(reply, () => resolved.service().install(body, actorOf(req)));
+    // Asked at the moment of the request: another model takes the runtime from a live session.
+    const sessionNames = sessionNamesUsingEndpoint(ctx.sessions.values());
+    return runVerb(reply, () => resolved.service().install(body, actorOf(req), sessionNames));
+  });
+
+  app.post('/api/local-model/use', async (req, reply): Promise<LocalModelVerbResponse> => {
+    const denied = adminOnly(req, reply);
+    if (denied) return denied;
+    const body = parseBody(LocalModelUseSchema, req.body);
+    const sessionNames = sessionNamesUsingEndpoint(ctx.sessions.values());
+    return runVerb(reply, () => resolved.service().use(body, actorOf(req), sessionNames));
   });
 
   app.post('/api/local-model/cancel', async (req, reply): Promise<LocalModelVerbResponse> => {
@@ -303,4 +327,11 @@ export function registerLocalModelRoutes(
     const sessionNames = sessionNamesUsingEndpoint(ctx.sessions.values());
     return runVerb(reply, () => resolved.service().remove(body, sessionNames, actorOf(req)));
   });
+
+  app.delete('/api/local-model/models', async (req, reply): Promise<LocalModelVerbResponse> => {
+    const denied = adminOnly(req, reply);
+    if (denied) return denied;
+    const body = parseBody(LocalModelDeleteSchema, req.body);
+    return runVerb(reply, () => resolved.service().deleteLibraryModel(body, actorOf(req)));
+  });
 }

src/web/schemas.ts

@@ -2505,6 +2505,12 @@ export const LocalModelRuntimeSchema = z
 /** DELETE /api/local-model. The body may be empty. */
 export const LocalModelRemoveSchema = z.object({ removeModel: z.boolean().optional() }).strict();
 
+/** POST /api/local-model/use: a checked model of the library to switch to. */
+export const LocalModelUseSchema = z.object({ modelId: localModelId }).strict();
+
+/** DELETE /api/local-model/models: one model of the store, by its name. Never a path. */
+export const LocalModelDeleteSchema = z.object({ modelId: localModelId }).strict();
+
 /**
  * A shell-safe bare word, mirroring `config/cli-registry/schema.ts`'s own `shellToken` —
  * duplicated rather than imported, since the REAL safety boundary for anything built from

test/fixtures/fake-ollama.ts

@@ -18,6 +18,7 @@
  * | `GET /api/ps`                     | the model once a chat loaded it (`size`, `size_vram`, `context_length`) |
  * | `POST /api/pull`                  | NDJSON progress, see `FakePullSwitches`                             |
  * | `DELETE /api/delete`              | 200, or 404 for a model that is not installed                       |
+ * |                                   | (the model, or one of `otherModels`)                                |
  * | `GET /v1/models`                  | the model's id, or `data: null` when none is installed (as the real one) |
  * | `POST /v1/chat/completions`       | a plain answer, or a tool call when the request carries `tools`     |
  * | `GET /download/ollama-darwin.tgz` | a small real `.tgz` with Range support, see `FakeArchiveSwitches`   |
@@ -220,6 +221,14 @@ export interface FakeOllamaOptions {
   spawn?: Partial<FakeSpawnSwitches>;
   /** The files of the fake runtime archive, name to content. Default: one executable `ollama` script. */
   archiveFiles?: Record<string, string>;
+  /**
+   * More models the registry has beside `model`: each can be pulled (a short stream that
+   * succeeds), listed, loaded, checked and deleted on its own. The pull, chat and tool
+   * switches apply to them too, except the pull's failures and shapes, which are `model`'s.
+   */
+  otherModels?: FakeOllamaModel[];
+  /** The ids of `otherModels` that are on disk from the start. */
+  othersInstalled?: string[];
 }
 
 export interface CapturedRequest {
@@ -304,6 +313,10 @@ export interface FakeOllama {
     archiveRequests: number;
     /** Every child `spawn` made, oldest first. */
     children: FakeRuntimeChild[];
+    /** The ids of `otherModels` that are on disk: pulled, or installed from the start. */
+    others: string[];
+    /** The id of the model the last chat loaded. The runtime holds one model at a time. */
+    loadedId?: string;
   };
   /** The fake runtime archive: a real gzipped tar. */
   readonly archive: { readonly body: Buffer; readonly size: number; readonly sha256: string };
@@ -436,7 +449,26 @@ export function createFakeOllama(options: FakeOllamaOptions = {}): FakeOllama {
     pulls: 0,
     archiveRequests: 0,
     children: [],
+    others: [...(options.othersInstalled ?? [])],
   };
+  const otherModels = options.otherModels ?? [];
+  /** One of `otherModels` by its id, whether it is on disk or not. */
+  const otherModel = (id: unknown): FakeOllamaModel | undefined => otherModels.find((other) => other.id === id);
+  /** The model `id` names when it is on disk: `model` or one of the others. */
+  const onDisk = (id: unknown): FakeOllamaModel | undefined => {
+    if (id === model.id) return state.installed ? model : undefined;
+    const other = otherModel(id);
+    return other && state.others.includes(other.id) ? other : undefined;
+  };
+  const tagRow = (entry: FakeOllamaModel): Record<string, unknown> => ({
+    name: entry.id,
+    model: entry.id,
+    modified_at: '2026-11-06T15:10:02.465346347+01:00',
+    size: entry.bytes,
+    digest: entry.digest,
+    details: { ...modelDetails(), format: entry.format, context_length: 262144, runner: entry.runner },
+    capabilities: entry.capabilities,
+  });
   const requests: CapturedRequest[] = [];
   const sockets = new Set<Socket>();
   let server: Server | undefined;
@@ -475,6 +507,18 @@ export function createFakeOllama(options: FakeOllamaOptions = {}): FakeOllama {
     };
 
     if (!(await line({ status: 'pulling manifest' }))) return;
+    // One of the other models: a short stream that succeeds.
+    const other = otherModel(askedId);
+    if (other && pull.fail !== 'not-found') {
+      const layer = { status: 'pulling model', digest: 'sha256:other', total: other.bytes };
+      if (!(await line({ ...layer, completed: 0 }))) return;
+      if (!(await line({ ...layer, completed: other.bytes }))) return;
+      if (!(await line({ status: 'writing manifest' }))) return;
+      if (!state.others.includes(other.id)) state.others.push(other.id);
+      await line({ status: 'success' });
+      res.end();
+      return;
+    }
     // Not captured on a Mac: the wording of the runtime for a tag the registry does not have.
     if (pull.fail === 'not-found' || askedId !== model.id) {
       await line({ error: 'pull model manifest: file does not exist' });
@@ -528,7 +572,8 @@ export function createFakeOllama(options: FakeOllamaOptions = {}): FakeOllama {
 
   function handleChat(res: ServerResponse, body: unknown): void {
     const request = (body as { model?: unknown; tools?: unknown } | undefined) ?? {};
-    if (!state.installed || request.model !== model.id) {
+    const served = onDisk(request.model);
+    if (!served) {
       sendJson(res, 404, {
         error: {
           message: `model '${String(request.model)}' not found`,
@@ -544,7 +589,7 @@ export function createFakeOllama(options: FakeOllamaOptions = {}): FakeOllama {
       id: `chatcmpl-${chatCounter++}`,
       object: 'chat.completion',
       created: 1793968038,
-      model: model.id,
+      model: served.id,
       system_fingerprint: 'fp_ollama',
       choices: [{ index: 0, message: { role: 'assistant', ...message }, finish_reason: finishReason }],
       usage: {
@@ -563,12 +608,18 @@ export function createFakeOllama(options: FakeOllamaOptions = {}): FakeOllama {
         });
         return;
       }
-      if (switches.ps.loaded !== false) state.loaded = true;
+      if (switches.ps.loaded !== false) {
+        state.loaded = true;
+        state.loadedId = served.id;
+      }
       sendJson(res, 200, envelope({ content: 'pong' }, 'stop'));
       return;
     }
 
-    if (switches.ps.loaded !== false) state.loaded = true;
+    if (switches.ps.loaded !== false) {
+      state.loaded = true;
+      state.loadedId = served.id;
+    }
     const fn = (tools[0] as { function?: { name?: unknown; parameters?: { properties?: unknown } } }).function ?? {};
     const name = typeof fn.name === 'string' ? fn.name : 'tool';
     const properties = (fn.parameters?.properties ?? {}) as Record<string, unknown>;
@@ -648,39 +699,31 @@ export function createFakeOllama(options: FakeOllamaOptions = {}): FakeOllama {
     }
     if (path === '/api/version' && method === 'GET') return sendJson(res, 200, { version });
     if (path === '/api/tags' && method === 'GET') {
-      const models = state.installed
-        ? [
-            {
-              name: model.id,
-              model: model.id,
-              modified_at: '2026-11-06T15:10:02.465346347+01:00',
-              size: model.bytes,
-              digest: model.digest,
-              details: { ...modelDetails(), context_length: 262144, runner: model.runner },
-              capabilities: model.capabilities,
-            },
-          ]
-        : [];
+      const models = [
+        ...(state.installed ? [tagRow(model)] : []),
+        ...otherModels.filter((other) => state.others.includes(other.id)).map(tagRow),
+      ];
       return sendJson(res, 200, { models });
     }
     if (path === '/api/ps' && method === 'GET') {
-      const size = switches.ps.size ?? model.bytes + 100_000_000;
-      const models =
-        state.installed && state.loaded && switches.ps.loaded !== false
-          ? [
-              {
-                name: model.id,
-                model: model.id,
-                size,
-                digest: model.digest,
-                details: modelDetails(),
-                expires_at: '2026-11-06T15:20:09.488045+01:00',
-                size_vram: switches.ps.sizeVram ?? size,
-                context_length: switches.ps.contextLength ?? contextLength,
-                runner: model.runner,
-              },
-            ]
-          : [];
+      // The runtime holds ONE model: the one the last chat loaded.
+      const held = state.loaded && switches.ps.loaded !== false ? onDisk(state.loadedId ?? model.id) : undefined;
+      const size = switches.ps.size ?? (held ?? model).bytes + 100_000_000;
+      const models = held
+        ? [
+            {
+              name: held.id,
+              model: held.id,
+              size,
+              digest: held.digest,
+              details: modelDetails(),
+              expires_at: '2026-11-06T15:20:09.488045+01:00',
+              size_vram: switches.ps.sizeVram ?? size,
+              context_length: switches.ps.contextLength ?? contextLength,
+              runner: held.runner,
+            },
+          ]
+        : [];
       return sendJson(res, 200, { models });
     }
     if (path === '/api/pull' && method === 'POST') return handlePull(res, body);
@@ -688,20 +731,35 @@ export function createFakeOllama(options: FakeOllamaOptions = {}): FakeOllama {
       // Not captured: the answers of a delete (200 with no body, 404 with an error text).
       const asked = (body as { model?: unknown; name?: unknown } | undefined) ?? {};
       const askedId = typeof asked.model === 'string' ? asked.model : asked.name;
+      const other = otherModel(askedId);
+      if (other && state.others.includes(other.id)) {
+        state.others = state.others.filter((id) => id !== other.id);
+        if (state.loadedId === other.id) {
+          state.loaded = false;
+          state.loadedId = undefined;
+        }
+        res.writeHead(200);
+        res.end();
+        return;
+      }
       if (!state.installed || askedId !== model.id) {
         return sendJson(res, 404, { error: `model '${String(askedId)}' not found` });
       }
       state.installed = false;
       state.loaded = false;
+      state.loadedId = undefined;
       state.completedBytes = 0;
       res.writeHead(200);
       res.end();
       return;
     }
     if (path === '/v1/models' && method === 'GET') {
-      const data = state.installed
-        ? [{ id: model.id, object: 'model', created: 1793967749, owned_by: 'library' }]
-        : null;
+      const ids = [
+        ...(state.installed ? [model.id] : []),
+        ...otherModels.filter((other) => state.others.includes(other.id)).map((other) => other.id),
+      ];
+      const data =
+        ids.length > 0 ? ids.map((id) => ({ id, object: 'model', created: 1793967749, owned_by: 'library' })) : null;
       return sendJson(res, 200, { object: 'list', data });
     }
     if (path === '/v1/chat/completions' && method === 'POST') return handleChat(res, body);

test/local-model-install-e2e.test.ts

@@ -345,7 +345,7 @@ describe('the install from the first GET to Remove, real modules over a fake run
       endpointId: 'local-ollama',
       folder: world.paths.root,
       loaded: { context: pick.context, onGpu: true },
-      actions: ['start-session', 'stop', 'remove'],
+      actions: ['start-session', 'stop', 'install', 'remove'],
       runtime: { installed: true, downloadBytes: 0, downloadGb: formatGb(0) },
     });
 
@@ -682,6 +682,154 @@ describe('the install from the first GET to Remove, real modules over a fake run
   }, 60_000);
 });
 
+describe('the library: a second model, the switch back, and the delete of one model', () => {
+  it('installs A, adds B beside it, switches back to A, and deletes B, with one model in use throughout', async () => {
+    const { app, get, settled, install: clickInstall } = await routes();
+    const hostsModels = async () =>
+      (await readCustomModelHosts(getDataDir())).find((host) => host.id === 'local-ollama')?.models;
+    const post = (url: string, payload: unknown) => app.inject({ method: 'POST', url, payload: payload as object });
+    const deleteModel = (modelId: string) =>
+      app.inject({ method: 'DELETE', url: '/api/local-model/models', payload: { modelId } });
+
+    // ---- A: the first install ----
+    world.agentInstalled = true;
+    const first = await get();
+    const a = first.recommendation.pick!;
+    const bRow = first.recommendation.alternatives[0];
+    expect(bRow).toBeDefined();
+    expect(bRow.modelId).not.toBe(a.modelId);
+    const B_DIGEST = 'b'.repeat(64);
+    world.runtime = createFakeOllama({
+      model: { id: a.modelId, bytes: a.downloadBytes },
+      contextLength: a.context,
+      otherModels: [
+        {
+          id: bRow.modelId,
+          bytes: bRow.downloadBytes,
+          digest: B_DIGEST,
+          format: 'gguf',
+          runner: 'ggml',
+          quantization: 'Q4_K_M',
+          capabilities: ['completion', 'tools'],
+        },
+      ],
+    });
+    const runtime = world.runtime;
+    expect((await clickInstall(a)).statusCode).toBe(200);
+    expect((await settled()).state).toBe('installed');
+
+    let status = await get();
+    expect(status.install.library).toEqual([
+      {
+        id: a.modelId,
+        label: a.modelLabel,
+        context: a.context,
+        sizeBytes: a.downloadBytes,
+        sizeGb: formatGb(a.downloadBytes),
+        active: true,
+        verified: true,
+        status: 'ready',
+        actions: [],
+      },
+    ]);
+    // The store of the fake runtime writes no blobs: measured, and empty.
+    expect(status.install.store).toEqual({ bytes: 0, gb: '0.0' });
+    // The chooser says the row is the model in use.
+    expect(status.recommendation.pick?.library).toBe('active');
+    expect(status.install.actions).toEqual(['start-session', 'stop', 'install', 'remove']);
+
+    // ---- B: a second model. Refused while a session uses A. ----
+    const b = [status.recommendation.pick!, ...status.recommendation.alternatives].find(
+      (row) => row.modelId === bRow.modelId
+    )!;
+    // The runtime is on disk now, so the server's total for B is the model alone.
+    expect(b.installBytes).toBe(b.downloadBytes);
+    const addB = { modelId: b.modelId, cli: 'opencode', context: b.context, acknowledgedBytes: b.installBytes };
+    world.sessions.set('s1', { name: 'w1-app', customModel: { endpointId: 'local-ollama' } });
+    const busy = await post('/api/local-model/install', addB);
+    expect(busy.statusCode).toBe(409);
+    expect(busy.json().data).toMatchObject({ reason: 'sessions-open', sessions: ['w1-app'] });
+    expect(runtime.state.pulls).toBe(1);
+    world.sessions.clear();
+
+    // The fake runtime reports the context it was "started with": B's from here on.
+    runtime.switches.ps.contextLength = b.context;
+    const started = await post('/api/local-model/install', addB);
+    expect(started.statusCode).toBe(200);
+    expect(started.json().data).toMatchObject({ state: 'installing', model: { id: b.modelId } });
+    const withB = await settled();
+    expect(withB.error).toBeUndefined();
+    expect(withB).toMatchObject({
+      state: 'installed',
+      model: { id: b.modelId, label: b.modelLabel },
+      context: b.context,
+      endpointId: 'local-ollama',
+    });
+    // Both are on disk, A was not deleted, and the ONE endpoint record lists the model in use.
+    expect(runtime.state.installed).toBe(true);
+    expect(runtime.state.others).toEqual([b.modelId]);
+    expect(await hostsModels()).toEqual([b.modelId]);
+    expect(runtime.requests.some((request) => request.path === '/api/delete')).toBe(false);
+    await vi.waitFor(async () => {
+      const library = (await get()).install.library;
+      expect(library.map((row) => [row.id, row.active, row.status, row.actions])).toEqual([
+        [b.modelId, true, 'ready', []],
+        [a.modelId, false, 'ready', ['use', 'delete']],
+      ]);
+    });
+    const stored = await readLocalModelState();
+    expect(stored.library?.map((entry) => [entry.id, entry.context, entry.digest])).toEqual([
+      [a.modelId, a.context, runtime.model.digest],
+      [b.modelId, b.context, B_DIGEST],
+    ]);
+    // Only the model in use may be launched on the endpoint.
+    expect(await world.service.launchRefusalMessage('local-ollama', b.modelId)).toBeUndefined();
+    expect(await world.service.launchRefusalMessage('local-ollama', a.modelId)).toContain('is in use on this Mac');
+
+    // ---- The model in use cannot be deleted ----
+    const active = await deleteModel(b.modelId);
+    expect(active.statusCode).toBe(409);
+    expect(active.json().data).toMatchObject({ reason: 'model-active' });
+    expect(runtime.state.others).toEqual([b.modelId]);
+
+    // ---- Back to A: nothing is downloaded ----
+    status = await get();
+    expect(status.recommendation.pick?.library ?? status.recommendation.alternatives[0].library).toBeDefined();
+    world.sessions.set('s1', { name: 'w1-app', customModel: { endpointId: 'local-ollama' } });
+    const useBusy = await post('/api/local-model/use', { modelId: a.modelId });
+    expect(useBusy.statusCode).toBe(409);
+    expect(useBusy.json().data).toMatchObject({ reason: 'sessions-open' });
+    world.sessions.clear();
+
+    runtime.switches.ps.contextLength = a.context;
+    const pullsBefore = runtime.state.pulls;
+    const switched = await post('/api/local-model/use', { modelId: a.modelId });
+    expect(switched.statusCode).toBe(200);
+    expect(switched.json().data).toMatchObject({ state: 'installing', steps: ['verify', 'connect'] });
+    const backOnA = await settled();
+    expect(backOnA.error).toBeUndefined();
+    expect(backOnA).toMatchObject({ state: 'installed', model: { id: a.modelId }, context: a.context });
+    expect(runtime.state.pulls).toBe(pullsBefore);
+    expect(await hostsModels()).toEqual([a.modelId]);
+    expect(await world.service.launchRefusalMessage('local-ollama', a.modelId)).toBeUndefined();
+
+    // ---- Delete B: through the runtime, by its name ----
+    const notOurs = await deleteModel('someone-else:7b');
+    expect(notOurs.statusCode).toBe(400);
+    const gone = await deleteModel(b.modelId);
+    expect(gone.statusCode).toBe(200);
+    expect(gone.json().data.library.map((row: { id: string }) => row.id)).toEqual([a.modelId]);
+    expect(runtime.state.others).toEqual([]);
+    expect(runtime.state.installed).toBe(true);
+    const deletes = runtime.requests.filter((request) => request.path === '/api/delete');
+    expect(deletes.map((request) => request.body)).toEqual([{ model: b.modelId }]);
+    expect((await readLocalModelState()).library?.map((entry) => entry.id)).toEqual([a.modelId]);
+    expect((await get()).install.actions).toEqual(['start-session', 'stop', 'install', 'remove']);
+    // A is in use: it can only go with the whole installation.
+    expect((await deleteModel(a.modelId)).statusCode).toBe(409);
+  });
+});
+
 describe('a server that is killed leaves its runtime running: the next server never deletes under it', () => {
   /**
    * Installs up to the model download, then "kills" the server: its job stops and it signals

test/local-model-install-job.test.ts

@@ -17,13 +17,18 @@ import {
   allowedActions,
   buildInstallError,
   buildInstallView,
+  buildLibraryRows,
   formatInstallMessage,
   INSTALL_STATE_TABLE,
   INSTALL_STEP_TABLE,
   INSTALL_TRANSITIONS,
   installedBlocker,
   jobSteps,
+  libraryOf,
+  markLibraryCandidates,
   reduceInstallJob,
+  upsertLibraryEntry,
+  USE_JOB_STEPS,
   type InstallJobEvent,
   type InstallJobEventType,
   type InstallLiveFacts,
@@ -38,12 +43,15 @@ import {
   type LocalModelErrorCode,
   type LocalModelInstallState,
   type LocalModelInstallStep,
+  type LocalModelLibraryEntry,
   type LocalModelStateFile,
+  type Recommendation,
 } from '../src/types.js';
 
 const STATES: LocalModelInstallState[] = ['idle', 'installing', 'paused', 'failed', 'installed'];
 const EVENT_TYPES: InstallJobEventType[] = [
   'install',
+  'use',
   'progress',
   'step-done',
   'fail',
@@ -60,6 +68,48 @@ const RUNTIME = { version: '0.40.15', port: 11435, pid: 4711, enabled: true, mea
 const CONNECTION = { endpointId: 'local-ollama', flagWasEnabled: false };
 const LOADED = { context: 131072, sizeBytes: 26_300_000_000, sizeVramBytes: 26_300_000_000 };
 
+/** The model in use as the library lists it, and a second checked model beside it. */
+const ENTRY: LocalModelLibraryEntry = {
+  id: MODEL.id,
+  label: MODEL.label,
+  context: MODEL.context,
+  digest: 'abc123',
+  bytes: 23_105_798_956,
+  cli: CLI,
+};
+const OTHER: LocalModelLibraryEntry = {
+  id: 'qwen3.8:27b-mtp-q4_k_m',
+  label: 'Qwen3.8 27B',
+  context: 65536,
+  digest: 'def456',
+  bytes: 17_741_872_154,
+  cli: CLI,
+};
+
+/** The two as rows of the view, while nothing is known from the runtime. */
+const ENTRY_ROW = {
+  id: ENTRY.id,
+  label: ENTRY.label,
+  context: ENTRY.context,
+  sizeBytes: 23_105_798_956,
+  sizeGb: '23.1',
+  active: true,
+  verified: true,
+  status: 'ready',
+  actions: [],
+};
+const OTHER_ROW = {
+  id: OTHER.id,
+  label: OTHER.label,
+  context: OTHER.context,
+  sizeBytes: 17_741_872_154,
+  sizeGb: '17.7',
+  active: false,
+  verified: true,
+  status: 'ready',
+  actions: ['use'],
+};
+
 const JOB: LocalModelStateFile = {
   schema: 1,
   state: 'installing',
@@ -69,6 +119,8 @@ const JOB: LocalModelStateFile = {
   cli: CLI,
   runtime: RUNTIME,
   progress: { completedBytes: 6_200_000_000, totalBytes: 23_105_798_956 },
+  // An earlier install left one checked model: what `use` can go back to.
+  library: [OTHER],
 };
 
 /** One state file of each state, as the job leaves it. */
@@ -84,6 +136,7 @@ const SAMPLE: Record<LocalModelInstallState, LocalModelStateFile> = {
     cli: CLI,
     runtime: RUNTIME,
     loaded: LOADED,
+    library: [OTHER],
     connection: CONNECTION,
   },
 };
@@ -96,6 +149,11 @@ const EVENT: Record<InstallJobEventType, InstallJobEvent> = {
     cli: { id: 'claude', label: 'Claude Code' },
     steps: ['runtime', 'model', 'verify', 'connect'],
   },
+  use: {
+    type: 'use',
+    model: { id: OTHER.id, label: OTHER.label, context: OTHER.context, digest: OTHER.digest },
+    cli: CLI,
+  },
   progress: { type: 'progress', completedBytes: 7_000_000_000, totalBytes: 23_105_798_956 },
   'step-done': { type: 'step-done' },
   fail: { type: 'fail', code: 'no-tool-call', vars: { model: 'Qwen3.6 35B-A3B' }, nextModelId: 'gpt-oss:20b' },
@@ -151,12 +209,17 @@ describe('the tables', () => {
         cancel: 'paused',
         restart: 'paused',
       },
-      paused: { resume: 'installing', install: 'installing', remove: 'idle', restart: 'paused' },
-      failed: { resume: 'installing', install: 'installing', remove: 'idle', restart: 'failed' },
-      installed: { remove: 'idle', restart: 'installed' },
+      paused: { resume: 'installing', install: 'installing', use: 'installing', remove: 'idle', restart: 'paused' },
+      failed: { resume: 'installing', install: 'installing', use: 'installing', remove: 'idle', restart: 'failed' },
+      installed: { install: 'installing', use: 'installing', remove: 'idle', restart: 'installed' },
     });
   });
 
+  it('a switch is the two steps that load and connect a model, and downloads nothing', () => {
+    expect(USE_JOB_STEPS).toEqual(['verify', 'connect']);
+    for (const step of USE_JOB_STEPS) expect(INSTALL_STEP_TABLE[step].progress).toBe(false);
+  });
+
   it('every step row names error codes that exist, each with a sentence and a next step', () => {
     for (const step of LOCAL_MODEL_INSTALL_STEPS) {
       const row = INSTALL_STEP_TABLE[step];
@@ -221,10 +284,10 @@ describe('reduceInstallJob: every state with every event, from the transition ta
     }
   }
 
-  it('covers all 40 pairs, 18 of them listed', () => {
+  it('covers all 45 pairs, 22 of them listed', () => {
     const listed = STATES.flatMap((state) => Object.keys(INSTALL_TRANSITIONS[state]));
-    expect(STATES.length * EVENT_TYPES.length).toBe(40);
-    expect(listed).toHaveLength(18);
+    expect(STATES.length * EVENT_TYPES.length).toBe(45);
+    expect(listed).toHaveLength(22);
   });
 });
 
@@ -246,11 +309,15 @@ describe('the state table agrees with the reducer and the view', () => {
     const row = INSTALL_STATE_TABLE[state];
     const accepts = (type: InstallJobEventType) => INSTALL_TRANSITIONS[state][type] !== undefined;
     expect(row.actions.includes('install')).toBe(accepts('install'));
+    expect(row.actions.includes('use')).toBe(accepts('use'));
     expect(row.actions.includes('cancel')).toBe(accepts('cancel'));
     expect(row.actions.includes('resume')).toBe(accepts('resume'));
-    // Remove is refused only while a job runs. From idle it only clears leftovers, so the
-    // window offers no button for it there.
-    if (state !== 'idle') expect(row.actions.includes('remove')).toBe(accepts('remove'));
+    // Remove is refused only while a job runs. From idle it only clears what an earlier
+    // Remove kept, and the view lists it there only while the store holds something.
+    expect(row.actions.includes('remove')).toBe(accepts('remove'));
+    // A model is deleted through the runtime, which a state without a job in flight and with
+    // a runtime set up can have: never idle (no runtime), never while a job runs.
+    expect(row.actions.includes('delete-model')).toBe(state !== 'idle' && state !== 'installing');
     // The runtime and a session are things of an installed model only.
     for (const action of ['start', 'stop', 'start-session'] as LocalModelAction[]) {
       expect(row.actions.includes(action)).toBe(state === 'installed');
@@ -292,6 +359,7 @@ describe('reduceInstallJob: what each event writes', () => {
       replacedModelId: 'qwen3.6:35b-a3b',
       cli: { id: 'claude', label: 'Claude Code' },
       runtime: RUNTIME,
+      library: [OTHER],
       connection: CONNECTION,
     });
     // Gone: the error, the progress, what the runtime had loaded.
@@ -421,32 +489,65 @@ describe('reduceInstallJob: what each event writes', () => {
 });
 
 describe('allowedActions', () => {
-  it('outside installed it is the state row, whatever is live', () => {
-    for (const state of ['idle', 'installing', 'paused', 'failed'] as const) {
-      expect(allowedActions(SAMPLE[state], { ...LIVE, running: true, gaveUp: true, portInUse: true })).toEqual([
-        ...INSTALL_STATE_TABLE[state].actions,
-      ]);
-    }
-    expect(allowedActions(SAMPLE.idle, LIVE)).toEqual(['install']);
+  it('outside installed the runtime, the port and the digest narrow nothing', () => {
+    const busy = { ...LIVE, running: true, gaveUp: true, portInUse: true };
+    expect(allowedActions(SAMPLE.installing, busy)).toEqual(['cancel']);
     expect(allowedActions(SAMPLE.installing, LIVE)).toEqual(['cancel']);
-    expect(allowedActions(SAMPLE.paused, LIVE)).toEqual(['resume', 'install', 'remove']);
-    expect(allowedActions(SAMPLE.failed, LIVE)).toEqual(['resume', 'install', 'remove']);
+    for (const state of ['paused', 'failed'] as const) {
+      // `use` because a checked model is there; no delete while nothing is known from the runtime.
+      expect(allowedActions(SAMPLE[state], busy)).toEqual(['resume', 'install', 'use', 'remove']);
+      expect(allowedActions(SAMPLE[state], LIVE)).toEqual(['resume', 'install', 'use', 'remove']);
+    }
   });
 
-  it('installed and running: a session can be started and the runtime stopped', () => {
+  it('idle: Remove is offered only while the model store still holds something', () => {
+    expect(allowedActions(SAMPLE.idle, LIVE)).toEqual(['install']);
+    expect(allowedActions(SAMPLE.idle, { ...LIVE, storeBytes: 0 })).toEqual(['install']);
+    expect(allowedActions(SAMPLE.idle, { ...LIVE, storeBytes: 23_105_798_956 })).toEqual(['install', 'remove']);
+  });
+
+  it('use and delete-model are listed only while a row of the library offers them', () => {
+    // A first job: no checked model yet, so nothing to switch to and nothing to delete.
+    const first: LocalModelStateFile = { ...SAMPLE.paused, library: undefined };
+    expect(allowedActions(first, LIVE)).toEqual(['resume', 'install', 'remove']);
+    // The runtime lists the other model: it can be deleted as well as switched to.
+    const tags = [{ name: OTHER.id, size: 17_741_872_154, digest: OTHER.digest }];
+    expect(allowedActions(SAMPLE.paused, { ...LIVE, running: true, tags })).toEqual([
+      'resume',
+      'install',
+      'use',
+      'delete-model',
+      'remove',
+    ]);
+    // The rows it was given decide, when it is given them.
+    expect(allowedActions(SAMPLE.paused, { ...LIVE, running: true, tags }, [])).toEqual([
+      'resume',
+      'install',
+      'remove',
+    ]);
+  });
+
+  it('installed and running: a session can be started, the runtime stopped, a model added', () => {
     expect(allowedActions(SAMPLE.installed, { ...LIVE, running: true, digest: 'same' })).toEqual([
       'start-session',
       'stop',
+      'install',
+      'use',
       'remove',
     ]);
   });
 
   it('installed and stopped: it can be started, and no session is offered', () => {
-    expect(allowedActions(SAMPLE.installed, LIVE)).toEqual(['start', 'remove']);
+    expect(allowedActions(SAMPLE.installed, LIVE)).toEqual(['start', 'install', 'use', 'remove']);
   });
 
   it('installed and running a model that changed: no session', () => {
-    expect(allowedActions(SAMPLE.installed, { ...LIVE, running: true, digest: 'changed' })).toEqual(['stop', 'remove']);
+    expect(allowedActions(SAMPLE.installed, { ...LIVE, running: true, digest: 'changed' })).toEqual([
+      'stop',
+      'install',
+      'use',
+      'remove',
+    ]);
   });
 
   it('a digest that could not be read does not hide the session button: the launch itself reads it again', () => {
@@ -456,8 +557,8 @@ describe('allowedActions', () => {
 
   it('never returns the table row itself', () => {
     const actions = allowedActions(SAMPLE.idle, LIVE);
-    actions.push('remove');
-    expect(INSTALL_STATE_TABLE.idle.actions).toEqual(['install']);
+    actions.push('cancel');
+    expect(INSTALL_STATE_TABLE.idle.actions).toEqual(['install', 'remove']);
   });
 });
 
@@ -535,10 +636,20 @@ describe('buildInstallView', () => {
         unpackedGb: '0.6',
       },
       folder: '/Users/me/.codeman/local-model',
+      library: [],
       actions: ['install'],
     });
   });
 
+  it('idle with a store an earlier Remove kept: its size, and Remove to free it', () => {
+    const view = buildInstallView(SAMPLE.idle, { ...LIVE, storeBytes: 23_105_798_956 });
+    expect(view.store).toEqual({ bytes: 23_105_798_956, gb: '23.1' });
+    expect(view.library).toEqual([]);
+    expect(view.actions).toEqual(['install', 'remove']);
+    // A store that was measured as empty is said as that, and offers nothing.
+    expect(buildInstallView(SAMPLE.idle, { ...LIVE, storeBytes: 0 }).store).toEqual({ bytes: 0, gb: '0.0' });
+  });
+
   it('once the runtime is unpacked an install downloads nothing for it', () => {
     const view = buildInstallView(SAMPLE.idle, { ...LIVE, runtimeInstalled: true });
     expect(view.runtime).toEqual({
@@ -564,6 +675,8 @@ describe('buildInstallView', () => {
         unpackedGb: '0.6',
       },
       folder: '/Users/me/.codeman/local-model',
+      // The checked model of an earlier install: listed, with nothing to do while a job runs.
+      library: [{ ...OTHER_ROW, actions: [] }],
       actions: ['cancel'],
       model: { id: 'qwen3.6:35b-a3b', label: 'Qwen3.6 35B-A3B' },
       context: 131072,
@@ -593,7 +706,9 @@ describe('buildInstallView', () => {
       completedGb: '6.2',
       totalGb: '23.1',
     });
-    expect(view.actions).toEqual(['resume', 'install', 'remove']);
+    expect(view.actions).toEqual(['resume', 'install', 'use', 'remove']);
+    // The way back from a job that stopped: the model that was checked before.
+    expect(view.library).toEqual([OTHER_ROW]);
   });
 
   it('a speed of zero has no time left, and a download without a total has no progress at all', () => {
@@ -677,7 +792,8 @@ describe('buildInstallView', () => {
       developerTools: 'present',
       runtime: { version: '0.40.15', installed: true, downloadBytes: 0, downloadGb: '0.0', unpackedGb: '0.6' },
       folder: '/Users/me/.codeman/local-model',
-      actions: ['start-session', 'stop', 'remove'],
+      library: [ENTRY_ROW, OTHER_ROW],
+      actions: ['start-session', 'stop', 'install', 'use', 'remove'],
       model: { id: 'qwen3.6:35b-a3b', label: 'Qwen3.6 35B-A3B' },
       context: 131072,
       cli: 'opencode',
@@ -692,7 +808,9 @@ describe('buildInstallView', () => {
     const view = buildInstallView(SAMPLE.installed, { ...LIVE, running: true, digest: 'changed' });
     expect(view.state).toBe('installed');
     expect(view.error?.code).toBe('model-changed');
-    expect(view.actions).toEqual(['stop', 'remove']);
+    expect(view.actions).toEqual(['stop', 'install', 'use', 'remove']);
+    // The row of the model in use says the same thing the error does.
+    expect(view.library[0]).toMatchObject({ id: MODEL.id, active: true, status: 'changed' });
   });
 
   it('a model that was not all on the GPU says so', () => {
@@ -713,6 +831,317 @@ describe('buildInstallView', () => {
   });
 });
 
+describe('reduceInstallJob: the library', () => {
+  it('libraryOf: the list of the file, and for an installed file without one its model', () => {
+    expect(libraryOf(SAMPLE.idle)).toEqual([]);
+    expect(libraryOf(SAMPLE.paused)).toEqual([OTHER]);
+    // A file an earlier build wrote: the model in use is the library.
+    const old: LocalModelStateFile = { ...SAMPLE.installed, library: undefined };
+    expect(libraryOf(old)).toEqual([ENTRY]);
+    // The model in use is always one of them, first, also when the list does not name it.
+    expect(libraryOf(SAMPLE.installed)).toEqual([ENTRY, OTHER]);
+    // Never twice, and the list's own entry wins.
+    const listed: LocalModelStateFile = { ...SAMPLE.installed, library: [OTHER, { ...ENTRY, context: 65536 }] };
+    expect(libraryOf(listed)).toEqual([OTHER, { ...ENTRY, context: 65536 }]);
+    // A model without a stored digest could never be compared: it is not one of them.
+    const noDigest: LocalModelStateFile = { ...SAMPLE.installed, library: undefined, model: MODEL };
+    expect(libraryOf(noDigest)).toEqual([]);
+    // A job's model is not in the library before it was checked.
+    expect(libraryOf({ ...SAMPLE.installing, library: undefined })).toEqual([]);
+  });
+
+  it('libraryOf hands out a list of its own', () => {
+    const list = libraryOf(SAMPLE.paused);
+    list.pop();
+    expect(SAMPLE.paused.library).toEqual([OTHER]);
+  });
+
+  it('upsertLibraryEntry replaces the entry with the same id in place, else adds at the end', () => {
+    const next = { ...OTHER, digest: 'fff', context: 131072 };
+    expect(upsertLibraryEntry([ENTRY, OTHER], next)).toEqual([ENTRY, next]);
+    expect(upsertLibraryEntry([ENTRY], OTHER)).toEqual([ENTRY, OTHER]);
+    expect(upsertLibraryEntry([], OTHER)).toEqual([OTHER]);
+  });
+
+  it('an install from installed adds a model: the model in use stays in the library and is NOT deleted', () => {
+    const next = reduceInstallJob(SAMPLE.installed, EVENT.install);
+    expect(next).toEqual({
+      schema: 1,
+      state: 'installing',
+      step: 'runtime',
+      steps: ['runtime', 'model', 'verify', 'connect'],
+      model: { id: 'gpt-oss:20b', label: 'GPT-OSS 20B', context: 65536 },
+      cli: { id: 'claude', label: 'Claude Code' },
+      runtime: RUNTIME,
+      // The model that was in use is written into the list: its state member is the new job's now.
+      library: [ENTRY, OTHER],
+      connection: CONNECTION,
+    });
+    expect(next).not.toHaveProperty('replacedModelId');
+    expect(next).not.toHaveProperty('loaded');
+  });
+
+  it('an install from an installed file of an earlier build keeps its one model too', () => {
+    const old: LocalModelStateFile = { ...SAMPLE.installed, library: undefined };
+    const next = reduceInstallJob(old, EVENT.install);
+    expect(next.library).toEqual([ENTRY]);
+    expect(next).not.toHaveProperty('replacedModelId');
+  });
+
+  it('a replaced job deletes its model only when that model was never checked', () => {
+    // The stopped job's model is a checked one (it failed after its check): it stays.
+    const checked: LocalModelStateFile = { ...SAMPLE.failed, library: [OTHER, ENTRY] };
+    expect(reduceInstallJob(checked, EVENT.install)).not.toHaveProperty('replacedModelId');
+    // Not checked: what it left is deleted, as before.
+    expect(reduceInstallJob(SAMPLE.failed, EVENT.install).replacedModelId).toBe(MODEL.id);
+    // A leftover that is waiting to be deleted is dropped from the wait once it is a checked model.
+    const waiting: LocalModelStateFile = { ...SAMPLE.paused, replacedModelId: OTHER.id };
+    expect(reduceInstallJob(waiting, { ...EVENT.install, model: MODEL } as InstallJobEvent)).not.toHaveProperty(
+      'replacedModelId'
+    );
+  });
+
+  it('use from installed: the two steps for the checked model, with its stored digest', () => {
+    expect(reduceInstallJob(SAMPLE.installed, EVENT.use)).toEqual({
+      schema: 1,
+      state: 'installing',
+      step: 'verify',
+      steps: ['verify', 'connect'],
+      model: { id: OTHER.id, label: OTHER.label, context: OTHER.context, digest: OTHER.digest },
+      cli: CLI,
+      runtime: RUNTIME,
+      library: [ENTRY, OTHER],
+      connection: CONNECTION,
+    });
+  });
+
+  it('use from a stopped job replaces it, and deletes what that job left of an unchecked model', () => {
+    for (const state of ['paused', 'failed'] as const) {
+      const next = reduceInstallJob(SAMPLE[state], EVENT.use);
+      expect(next.state).toBe('installing');
+      expect(next.step).toBe('verify');
+      expect(next.model?.id).toBe(OTHER.id);
+      expect(next.replacedModelId).toBe(MODEL.id);
+      expect(next).not.toHaveProperty('error');
+      expect(next).not.toHaveProperty('progress');
+      expect(next.library).toEqual([OTHER]);
+    }
+  });
+
+  it('refuses a use it cannot apply: a model that is not in the library, a state without a runtime', () => {
+    const unknown = { ...EVENT.use, model: { id: 'gpt-oss:20b', label: 'GPT-OSS 20B', context: 65536, digest: 'x' } };
+    expect(reduceInstallJob(SAMPLE.installed, unknown as InstallJobEvent)).toBe(SAMPLE.installed);
+    const noRuntime: LocalModelStateFile = { ...SAMPLE.paused, runtime: undefined };
+    expect(reduceInstallJob(noRuntime, EVENT.use)).toBe(noRuntime);
+  });
+
+  it('every event but remove carries the library', () => {
+    const job = SAMPLE.installing;
+    expect(reduceInstallJob(job, EVENT.progress).library).toEqual([OTHER]);
+    expect(reduceInstallJob(job, EVENT['step-done']).library).toEqual([OTHER]);
+    expect(reduceInstallJob(job, EVENT.fail).library).toEqual([OTHER]);
+    expect(reduceInstallJob(job, EVENT.cancel).library).toEqual([OTHER]);
+    expect(reduceInstallJob(job, EVENT.restart).library).toEqual([OTHER]);
+    expect(reduceInstallJob(SAMPLE.failed, EVENT.resume).library).toEqual([OTHER]);
+    const last: LocalModelStateFile = { ...job, step: 'connect', library: [OTHER, ENTRY], connection: CONNECTION };
+    expect(reduceInstallJob(last, EVENT['step-done'])).toMatchObject({ state: 'installed', library: [OTHER, ENTRY] });
+    expect(reduceInstallJob(SAMPLE.installed, EVENT.remove)).toEqual({ schema: 1, state: 'idle' });
+  });
+});
+
+describe('buildLibraryRows', () => {
+  const tagOf = (entry: LocalModelLibraryEntry, extra: Partial<{ size: number; digest: string }> = {}) => ({
+    name: entry.id,
+    size: entry.bytes ?? 0,
+    digest: entry.digest,
+    ...extra,
+  });
+
+  it('is empty in idle, whatever is live', () => {
+    expect(buildLibraryRows(SAMPLE.idle, { ...LIVE, running: true, tags: [tagOf(OTHER)] })).toEqual([]);
+  });
+
+  it('the runtime stopped: the checked models as they were recorded, a switch, and no delete', () => {
+    expect(buildLibraryRows(SAMPLE.installed, LIVE)).toEqual([ENTRY_ROW, OTHER_ROW]);
+    // A listing that is still around from before the stop is not trusted.
+    expect(buildLibraryRows(SAMPLE.installed, { ...LIVE, running: false, tags: [] })).toEqual([ENTRY_ROW, OTHER_ROW]);
+  });
+
+  it('the runtime running: its sizes, and a delete for every model but the one in use', () => {
+    const rows = buildLibraryRows(SAMPLE.installed, {
+      ...LIVE,
+      running: true,
+      tags: [tagOf(ENTRY, { size: 23_105_800_000 }), tagOf(OTHER)],
+    });
+    expect(rows).toEqual([
+      { ...ENTRY_ROW, sizeBytes: 23_105_800_000 },
+      { ...OTHER_ROW, actions: ['use', 'delete'] },
+    ]);
+  });
+
+  it('the model in use comes first, wherever the list has it', () => {
+    const state: LocalModelStateFile = { ...SAMPLE.installed, library: [OTHER, ENTRY] };
+    expect(buildLibraryRows(state, LIVE).map((row) => row.id)).toEqual([ENTRY.id, OTHER.id]);
+  });
+
+  it('a checked model whose digest the runtime no longer reports: changed, never switched to, deletable', () => {
+    const rows = buildLibraryRows(SAMPLE.installed, {
+      ...LIVE,
+      running: true,
+      tags: [tagOf(ENTRY), tagOf(OTHER, { digest: 'somethingelse' })],
+    });
+    expect(rows[1]).toMatchObject({ id: OTHER.id, status: 'changed', verified: true, actions: ['delete'] });
+    // The digest is compared without its prefix and its case, like everywhere else.
+    const same = buildLibraryRows(SAMPLE.installed, {
+      ...LIVE,
+      running: true,
+      tags: [tagOf(ENTRY), tagOf(OTHER, { digest: 'sha256:DEF456' })],
+    });
+    expect(same[1].status).toBe('ready');
+  });
+
+  it('a checked model the runtime no longer lists: missing, with its recorded size, and its entry can be dropped', () => {
+    const rows = buildLibraryRows(SAMPLE.installed, { ...LIVE, running: true, tags: [tagOf(ENTRY)] });
+    expect(rows[1]).toEqual({ ...OTHER_ROW, status: 'missing', actions: ['delete'] });
+  });
+
+  it('what the runtime lists beside the checked models: not checked, deletable, never switched to', () => {
+    const rows = buildLibraryRows(SAMPLE.installed, {
+      ...LIVE,
+      running: true,
+      labels: { 'mimo-v2.6:9b-q4_k_m': 'MiMo V2.6 9B' },
+      tags: [
+        tagOf(ENTRY),
+        tagOf(OTHER),
+        { name: 'zeta:1b', size: 900_000_000, digest: 'z' },
+        { name: 'mimo-v2.6:9b-q4_k_m', size: 6_550_811_033, digest: 'm' },
+      ],
+    });
+    expect(rows.slice(2)).toEqual([
+      {
+        id: 'mimo-v2.6:9b-q4_k_m',
+        // The catalogue knows it, so it is named as the chooser names it.
+        label: 'MiMo V2.6 9B',
+        sizeBytes: 6_550_811_033,
+        sizeGb: '6.6',
+        active: false,
+        verified: false,
+        status: 'unverified',
+        actions: ['delete'],
+      },
+      {
+        id: 'zeta:1b',
+        label: 'zeta:1b',
+        sizeBytes: 900_000_000,
+        sizeGb: '0.9',
+        active: false,
+        verified: false,
+        status: 'unverified',
+        actions: ['delete'],
+      },
+    ]);
+  });
+
+  it('a name that is not a plain name:tag is listed with its size and offers nothing', () => {
+    const rows = buildLibraryRows(SAMPLE.installed, {
+      ...LIVE,
+      running: true,
+      tags: [tagOf(ENTRY), { name: 'hf.co/someone/model:Q4', size: 1_000_000_000, digest: 'h' }],
+    });
+    expect(rows.find((row) => row.id === 'hf.co/someone/model:Q4')).toMatchObject({
+      status: 'unverified',
+      sizeGb: '1.0',
+      actions: [],
+    });
+  });
+
+  it('the model of a stopped job: listed once it is on disk, and neither switched to nor deleted', () => {
+    const rows = buildLibraryRows(SAMPLE.failed, {
+      ...LIVE,
+      running: true,
+      tags: [tagOf(OTHER), { name: MODEL.id, size: 23_105_798_956, digest: 'abc123' }],
+    });
+    expect(rows).toEqual([
+      { ...OTHER_ROW, actions: ['use', 'delete'] },
+      {
+        id: MODEL.id,
+        label: MODEL.label,
+        sizeBytes: 23_105_798_956,
+        sizeGb: '23.1',
+        active: false,
+        verified: false,
+        status: 'unverified',
+        actions: [],
+      },
+    ]);
+  });
+
+  it('while a job runs nothing is offered on any row', () => {
+    const rows = buildLibraryRows(SAMPLE.installing, { ...LIVE, running: true, tags: [tagOf(OTHER)] });
+    expect(rows.map((row) => row.actions)).toEqual([[]]);
+  });
+
+  it('a row without a known size has neither size member', () => {
+    const state: LocalModelStateFile = { ...SAMPLE.paused, library: [{ ...OTHER, bytes: undefined }] };
+    const [row] = buildLibraryRows(state, LIVE);
+    expect(row).not.toHaveProperty('sizeBytes');
+    expect(row).not.toHaveProperty('sizeGb');
+  });
+});
+
+describe('markLibraryCandidates', () => {
+  const candidate = (modelId: string, context: number) => ({ modelId, context }) as Recommendation['alternatives'][0];
+  const view = buildInstallView(SAMPLE.installed, { ...LIVE, running: true });
+
+  it('marks the model in use and a model a switch can take, at the context they were checked with', () => {
+    const recommendation = {
+      verdict: 'ok',
+      pick: candidate(MODEL.id, MODEL.context),
+      alternatives: [candidate(OTHER.id, OTHER.context), candidate('gpt-oss:20b', 65536)],
+    } as unknown as Recommendation;
+    const marked = markLibraryCandidates(recommendation, view);
+    expect(marked.pick?.library).toBe('active');
+    expect(marked.alternatives[0].library).toBe('ready');
+    expect(marked.alternatives[1]).not.toHaveProperty('library');
+    // The input is not written to.
+    expect(recommendation.pick).not.toHaveProperty('library');
+  });
+
+  it('a row at another context than the one that was checked is an install like any other', () => {
+    const recommendation = {
+      verdict: 'ok',
+      pick: candidate(MODEL.id, 65536),
+      alternatives: [candidate(OTHER.id, 131072)],
+    } as unknown as Recommendation;
+    expect(markLibraryCandidates(recommendation, view)).toBe(recommendation);
+  });
+
+  it('hands back the same object when there is nothing to mark', () => {
+    const none = { verdict: 'none', alternatives: [] } as unknown as Recommendation;
+    expect(markLibraryCandidates(none, view)).toBe(none);
+    const idle = buildInstallView(SAMPLE.idle, LIVE);
+    const recommendation = { verdict: 'ok', pick: candidate(MODEL.id, MODEL.context), alternatives: [] };
+    expect(markLibraryCandidates(recommendation as unknown as Recommendation, idle)).toBe(recommendation);
+  });
+
+  it('a checked model that changed is not marked ready', () => {
+    const changed = buildInstallView(SAMPLE.installed, {
+      ...LIVE,
+      running: true,
+      tags: [
+        { name: MODEL.id, size: 1, digest: 'abc123' },
+        { name: OTHER.id, size: 1, digest: 'other' },
+      ],
+    });
+    const recommendation = {
+      verdict: 'ok',
+      pick: candidate(OTHER.id, OTHER.context),
+      alternatives: [],
+    } as unknown as Recommendation;
+    expect(markLibraryCandidates(recommendation, changed).pick).not.toHaveProperty('library');
+  });
+});
+
 describe('formatInstallMessage', () => {
   it('fills the slots of a sentence', () => {
     expect(formatInstallMessage({ text: LOCAL_MODEL_INSTALL_LABELS.errPortInUse, vars: { port: '11435' } })).toBe(

test/local-model-install-service.test.ts

@@ -13,7 +13,9 @@
  * Cancel in every step; Resume; a job a server restart interrupted comes back paused and
  * waits for a click; every failure is a state with a code and a next step; the coding agent
  * install (the stock command, the audit line, the resolver caches forgotten, still missing is
- * a failure); the digest that refuses a changed model; the runtime verbs; Remove.
+ * a failure); the digest that refuses a changed model; the runtime verbs; Remove; and the
+ * library: a second model beside the first, the switch between checked models, the delete of
+ * one model, what a stopped job leaves to go back to, and the two cached listings of the view.
  *
  * Port: N/A (nothing listens).
  */
@@ -259,6 +261,10 @@ function setup(
     running: false,
     gaveUp: false,
     pid: 5000,
+    /** What the runtime lists on disk. Default: the model of the state, as it was pulled. */
+    tags: undefined as { name: string; size: number; digest: string }[] | undefined,
+    /** What the model store takes on disk. */
+    storeBytes: 0,
   };
   const calls: string[] = [];
 
@@ -325,14 +331,20 @@ function setup(
       { name: 'qwen3.6:35b-a3b', size: 26_300_000_000, sizeVram: 26_300_000_000, contextLength: 32768 },
     ]),
     getRuntimeVersion: vi.fn(async () => '0.40.15' as string | undefined),
-    deleteModel: vi.fn(async () => {
+    deleteModel: vi.fn(async (_target: unknown, _id: string) => {
       calls.push('deleteModel');
       return true;
     }),
+    listTags: vi.fn(async () => {
+      if (world.tags) return world.tags;
+      const model = store.get().model;
+      return model ? [{ name: model.id, size: PULL_BYTES, digest: DIGEST }] : [];
+    }),
     removePartialModelBlobs: vi.fn(async () => {
       calls.push('removePartialModelBlobs');
       return 0;
     }),
+    measureModelStore: vi.fn(async () => world.storeBytes),
     checkDeveloperTools: vi.fn(async () => 'missing' as const),
     stockInstallCommand: vi.fn((id: string) => (id === FACTS[0].cli ? INSTALL_COMMAND : undefined)),
     tryBeginCliInstall: vi.fn((): (() => void) | null => () => {
@@ -470,7 +482,7 @@ describe('a job from the click to installed', () => {
       port: 11435,
       loaded: { context: 131072, memoryBytes: 26_300_000_000, memoryGb: '26.3', onGpu: true },
       endpointId: 'local-ollama',
-      actions: ['start-session', 'stop', 'remove'],
+      actions: ['start-session', 'stop', 'install', 'remove'],
       folder: '/data/local-model',
       runtime: { version: '0.40.15', installed: true, downloadBytes: 0 },
     });
@@ -699,6 +711,8 @@ describe('one job at a time', () => {
     const jobRunning = { ok: false, status: 409, conflict: { reason: 'job-running' } };
     expect(await h.service.install(REQUEST, ADMIN)).toMatchObject(jobRunning);
     expect(await h.service.resume({}, ADMIN)).toMatchObject(jobRunning);
+    expect(await h.service.use({ modelId: 'gpt-oss:20b' }, ADMIN)).toMatchObject(jobRunning);
+    expect(await h.service.deleteLibraryModel({ modelId: 'gpt-oss:20b' }, ADMIN)).toMatchObject(jobRunning);
     expect(await h.service.runtime({ action: 'stop' })).toMatchObject(jobRunning);
     expect(await h.service.remove({}, [])).toMatchObject(jobRunning);
     expect(h.deps.ensureRuntimeInstalled).toHaveBeenCalledTimes(1);
@@ -718,7 +732,7 @@ describe('one job at a time', () => {
     expect(h.deps.ensureRuntimeInstalled).toHaveBeenCalledTimes(1);
   });
 
-  it('install while a model is installed is 409 already-installed: remove it first', async () => {
+  it('an install of the model that is in use, at its context, is 409 already-installed', async () => {
     const h = setup({ state: INSTALLED });
     expect(await h.service.install(REQUEST, ADMIN)).toEqual({
       ok: false,
@@ -1073,7 +1087,11 @@ describe('boot with a model installed', () => {
     // The pid of the child that runs now replaces the stored one.
     expect(h.store.get().runtime?.pid).toBe(5000);
     const view = await h.service.view();
-    expect(view).toMatchObject({ state: 'installed', running: true, actions: ['start-session', 'stop', 'remove'] });
+    expect(view).toMatchObject({
+      state: 'installed',
+      running: true,
+      actions: ['start-session', 'stop', 'install', 'remove'],
+    });
     expect(view).not.toHaveProperty('error');
   });
 
@@ -1107,7 +1125,7 @@ describe('boot with a model installed', () => {
     await h.service.boot();
     expect(h.supervisor.start).not.toHaveBeenCalled();
     const view = await h.service.view();
-    expect(view).toMatchObject({ state: 'installed', running: false, actions: ['start', 'remove'] });
+    expect(view).toMatchObject({ state: 'installed', running: false, actions: ['start', 'install', 'remove'] });
     // A stopped runtime is not an error.
     expect(view).not.toHaveProperty('error');
   });
@@ -1124,7 +1142,7 @@ describe('boot with a model installed', () => {
       message: { text: 'The model on this Mac changed since it was installed. Remove it and install it again.' },
       next: 'remove',
     });
-    expect(view.actions).toEqual(['stop', 'remove']);
+    expect(view.actions).toEqual(['stop', 'install', 'remove']);
     expect(h.store.get().state).toBe('installed');
     expect(h.store.get()).not.toHaveProperty('error');
   });
@@ -1140,7 +1158,7 @@ describe('boot with a model installed', () => {
       message: { text: 'Port {port} is in use by another program.', vars: { port: '11435' } },
       next: 'other-port',
     });
-    expect(view.actions).toEqual(['start', 'remove']);
+    expect(view.actions).toEqual(['start', 'install', 'remove']);
   });
 
   it('never throws, whatever the runtime does', async () => {
@@ -1536,7 +1554,7 @@ describe('launchRefusal: the digest and the runtime decide whether a session sta
       'The model on this Mac changed since it was installed. Remove it and install it again.'
     );
     // And the window stops offering a session.
-    expect((await h.service.view()).actions).toEqual(['stop', 'remove']);
+    expect((await h.service.view()).actions).toEqual(['stop', 'install', 'remove']);
   });
 
   it('a digest with the sha256 prefix some listings add is the same digest', async () => {
@@ -1602,7 +1620,7 @@ describe('launchRefusal: the digest and the runtime decide whether a session sta
   it('only the model that was installed and checked may be started on the managed endpoint', async () => {
     const h = await installed();
     expect(await h.service.launchRefusalMessage('local-ollama', 'someone-else:7b')).toBe(
-      'Only Qwen3.6 35B-A3B is installed on this Mac. Remove it and install another model first.'
+      'Only Qwen3.6 35B-A3B is in use on this Mac. Switch models in the local model window first.'
     );
   });
 
@@ -1641,7 +1659,7 @@ describe('the runtime verbs', () => {
     expect(stopped.ok && stopped.view).toMatchObject({
       state: 'installed',
       running: false,
-      actions: ['start', 'remove'],
+      actions: ['start', 'install', 'remove'],
     });
     expect(h.supervisor.stop).toHaveBeenCalledTimes(1);
     expect(h.store.get().runtime?.enabled).toBe(false);
@@ -1652,7 +1670,10 @@ describe('the runtime verbs', () => {
     expect(next.supervisor.start).not.toHaveBeenCalled();
 
     const started = await h.service.runtime({ action: 'start' });
-    expect(started.ok && started.view).toMatchObject({ running: true, actions: ['start-session', 'stop', 'remove'] });
+    expect(started.ok && started.view).toMatchObject({
+      running: true,
+      actions: ['start-session', 'stop', 'install', 'remove'],
+    });
     expect(h.store.get().runtime?.enabled).toBe(true);
   });
 
@@ -1747,10 +1768,13 @@ describe('Remove', () => {
         unpackedGb: '0.6',
       },
       folder: '/data/local-model',
+      library: [],
+      // Measured again after the Remove: the store is empty here.
+      store: { bytes: 0, gb: '0.0' },
       actions: ['install'],
     });
     expect(h.store.get()).toMatchObject({ schema: 1, state: 'idle' });
-    for (const key of ['model', 'cli', 'runtime', 'connection', 'loaded'])
+    for (const key of ['model', 'cli', 'runtime', 'connection', 'loaded', 'library'])
       expect(h.store.get()).not.toHaveProperty(key);
     expect(h.deps.audit).toHaveBeenCalledWith({
       admin: 'root',
@@ -1938,6 +1962,57 @@ describe('view()', () => {
     await h.service.cancel();
   });
 
+  it('a view whose read began while the job ran shows how the job ended, never paused', async () => {
+    // The window polls every second, so a read of the state file can be under way while the
+    // job writes its last state and lets go. That read returns the old `installing`, and
+    // settling it with no job in this process read it as an interrupted job: the window (and
+    // the e2e test, under CI load) saw `paused` with Resume for one tick instead of `failed`.
+    const slow = {
+      read: undefined as undefined | (() => Promise<LocalModelStateFile>),
+      hold: undefined as undefined | Promise<void>,
+      entered: undefined as undefined | (() => void),
+    };
+    const h = setup({
+      overrides: {
+        readState: async () => {
+          const snapshot = await slow.read!();
+          const hold = slow.hold;
+          slow.hold = undefined;
+          if (hold) {
+            slow.entered?.();
+            await hold;
+          }
+          return snapshot;
+        },
+      },
+    });
+    slow.read = h.store.readState;
+    let failVerify!: () => void;
+    const verifying = new Promise<void>((resolve) => (failVerify = resolve));
+    h.deps.verifyModel.mockImplementationOnce(async () => {
+      await verifying;
+      return { ok: false, code: 'no-tool-call' } as never;
+    });
+
+    await h.service.install(REQUEST, ADMIN);
+    await vi.waitFor(() => expect(h.deps.verifyModel).toHaveBeenCalled());
+
+    // A view starts reading while the job is still in the verify step...
+    let releaseRead!: () => void;
+    slow.hold = new Promise<void>((resolve) => (releaseRead = resolve));
+    const entered = new Promise<void>((resolve) => (slow.entered = resolve));
+    const viewing = h.service.view();
+    await entered;
+    // ...the job fails, writes it and ends while that read is still out...
+    failVerify();
+    await h.service.idle();
+    expect(h.store.get().state).toBe('failed');
+    // ...and only then does the read come back, with the file as it was before.
+    releaseRead();
+    const view = await viewing;
+    expect(view).toMatchObject({ state: 'failed', step: 'verify', error: { code: 'no-tool-call' } });
+  });
+
   it('names the model to try next only when the catalogue still has it', async () => {
     const state: LocalModelStateFile = {
       ...jobAt('verify', 'paused'),
@@ -2291,7 +2366,7 @@ describe('an installed model whose runtime does not start', () => {
     h.world.startResult = { ok: false, code: 'runtime-start-failed', detail: 'spawn ENOENT' };
     await h.service.boot();
     const view = await h.service.view();
-    expect(view).toMatchObject({ state: 'installed', running: false, actions: ['start', 'remove'] });
+    expect(view).toMatchObject({ state: 'installed', running: false, actions: ['start', 'install', 'remove'] });
     expect(view.error).toEqual({
       code: 'runtime-start-failed',
       message: { text: 'The runtime did not start on this Mac.' },
@@ -2345,7 +2420,11 @@ describe('a later build with another runtime pin', () => {
     // The stored version stays what runs, so the next start finds it again.
     expect(h.store.get().runtime?.version).toBe(OLD);
     const view = await h.service.view();
-    expect(view).toMatchObject({ state: 'installed', running: true, actions: ['start-session', 'stop', 'remove'] });
+    expect(view).toMatchObject({
+      state: 'installed',
+      running: true,
+      actions: ['start-session', 'stop', 'install', 'remove'],
+    });
     expect(view.error).toBeUndefined();
     // A NEW install would still download the pinned build.
     expect(view.runtime).toMatchObject({ version: OLLAMA_RUNTIME_PIN.version, installed: false });
@@ -2588,3 +2667,688 @@ describe('Stop and "Use another port" while live sessions use the model', () =>
     expect(h.store.get().runtime?.port).toBe(11435);
   });
 });
+
+// ---------- The library ----------
+
+const GPT = { id: 'gpt-oss:20b', label: 'GPT-OSS 20B', context: 131072 };
+const GPT_BYTES = 13_793_441_427;
+const QWEN_ENTRY = {
+  id: 'qwen3.6:35b-a3b',
+  label: 'Qwen3.6 35B-A3B',
+  context: 131072,
+  digest: DIGEST,
+  bytes: PULL_BYTES,
+  cli: { id: 'opencode', label: 'OpenCode' },
+};
+const GPT_ENTRY = {
+  id: GPT.id,
+  label: GPT.label,
+  context: 65536,
+  digest: DIGEST,
+  bytes: GPT_BYTES,
+  cli: { id: 'opencode', label: 'OpenCode' },
+};
+/** Two checked models, the Qwen one in use. */
+const TWO_MODELS: LocalModelStateFile = { ...INSTALLED, library: [QWEN_ENTRY, GPT_ENTRY] };
+const BOTH_TAGS = [
+  { name: QWEN_ENTRY.id, size: PULL_BYTES, digest: DIGEST },
+  { name: GPT_ENTRY.id, size: GPT_BYTES, digest: DIGEST },
+];
+const ADD_GPT: LocalModelInstallRequest = {
+  modelId: GPT.id,
+  cli: 'opencode',
+  context: GPT.context,
+  acknowledgedBytes: GPT_BYTES + RUNTIME_BYTES,
+};
+
+describe('the first install starts the library', () => {
+  it('the model that passed its check is the one checked model, with its digest, size and coding agent', async () => {
+    const h = setup();
+    await installAndWait(h.service);
+    expect(h.store.get().library).toEqual([{ ...QWEN_ENTRY, verifiedAt: new Date(1_000_000).toISOString() }]);
+    const view = await h.service.view();
+    expect(view.library).toEqual([
+      {
+        id: QWEN_ENTRY.id,
+        label: QWEN_ENTRY.label,
+        context: 131072,
+        sizeBytes: PULL_BYTES,
+        sizeGb: '23.1',
+        active: true,
+        verified: true,
+        status: 'ready',
+        actions: [],
+      },
+    ]);
+  });
+
+  it('the entry is written when the check passes, before the coding agent is installed', async () => {
+    const h = setup({
+      overrides: {
+        runInstallCommand: vi.fn(async () => ({ code: 1, output: 'no network\n', timedOut: false, aborted: false })),
+      },
+    });
+    await installAndWait(h.service);
+    expect(h.store.get()).toMatchObject({ state: 'failed', step: 'agent', library: [{ id: QWEN_ENTRY.id }] });
+    // It is the model of the stopped job: Resume goes on with it, so no switch is offered.
+    const view = await h.service.view();
+    expect(view.library.map((row) => row.actions)).toEqual([[]]);
+    expect(view.actions).toEqual(['resume', 'install', 'remove']);
+  });
+
+  it('a size the runtime does not report falls back to what the pull counted', async () => {
+    const h = setup();
+    h.world.tags = [];
+    await installAndWait(h.service);
+    expect(h.store.get().library?.[0].bytes).toBe(PULL_BYTES);
+  });
+});
+
+describe('adding a model to an installed one', () => {
+  it('downloads, checks and connects it, and keeps the earlier model in the library', async () => {
+    const h = setup({ state: INSTALLED, runtimeOnDisk: true, agentInstalled: true });
+    await h.service.boot();
+    h.calls.length = 0;
+    h.world.tags = BOTH_TAGS;
+
+    const started = await h.service.install(ADD_GPT, ADMIN);
+    expect(started.ok && started.view.state).toBe('installing');
+    await h.service.idle();
+
+    expect(h.calls).toEqual([
+      'ensureRuntimeInstalled',
+      'supervisor.start',
+      'supervisor.start',
+      'pullModel',
+      'supervisor.start',
+      'verifyModel',
+      'supervisor.start',
+      'connectLocalModel',
+    ]);
+    // Nothing of the earlier model was deleted: it was checked, and it stays.
+    expect(h.deps.deleteModel).not.toHaveBeenCalled();
+    expect(h.deps.removePartialModelBlobs).not.toHaveBeenCalled();
+    // The runtime is started for the new model's context.
+    expect(h.supervisor.start).toHaveBeenLastCalledWith(
+      expect.objectContaining({ port: 11435, contextLength: 131072 })
+    );
+    // The one endpoint record is rewritten for the new model; it stays ours.
+    expect(h.deps.connectLocalModel).toHaveBeenCalledWith({
+      port: 11435,
+      modelId: GPT.id,
+      context: GPT.context,
+      ours: true,
+      flagWasEnabled: false,
+    });
+    expect(h.store.get()).toMatchObject({
+      state: 'installed',
+      model: { id: GPT.id, context: GPT.context, digest: DIGEST },
+      connection: { endpointId: 'local-ollama', flagWasEnabled: false },
+      library: [QWEN_ENTRY, { id: GPT.id, context: GPT.context, digest: DIGEST, bytes: GPT_BYTES }],
+    });
+    expect(h.store.get()).not.toHaveProperty('replacedModelId');
+
+    const view = await h.service.view();
+    expect(view.model).toEqual({ id: GPT.id, label: GPT.label });
+    expect(view.library.map((row) => [row.id, row.active, row.status, row.actions])).toEqual([
+      [GPT.id, true, 'ready', []],
+      [QWEN_ENTRY.id, false, 'ready', ['use', 'delete']],
+    ]);
+    expect(view.actions).toEqual(['start-session', 'stop', 'install', 'use', 'delete-model', 'remove']);
+    // Only the model in use may be launched.
+    expect(await h.service.launchRefusalMessage('local-ollama', GPT.id)).toBeUndefined();
+    expect(await h.service.launchRefusalMessage('local-ollama', QWEN_ENTRY.id)).toBe(
+      'Only GPT-OSS 20B is in use on this Mac. Switch models in the local model window first.'
+    );
+  });
+
+  it('is refused while live sessions use the model, before anything is asked or started', async () => {
+    const h = setup({ state: INSTALLED, runtimeOnDisk: true, agentInstalled: true });
+    await h.service.boot();
+    h.calls.length = 0;
+    const refused = await h.service.install(ADD_GPT, ADMIN, ['w1-app', 'w2-api']);
+    expect(refused).toMatchObject({
+      ok: false,
+      status: 409,
+      conflict: {
+        reason: 'sessions-open',
+        sessions: ['w1-app', 'w2-api'],
+        message: { text: LOCAL_MODEL_INSTALL_LABELS.conflictSessionsOpen, vars: { sessions: 'w1-app, w2-api' } },
+      },
+    });
+    expect(h.calls).toEqual([]);
+    expect(h.deps.readHardware).not.toHaveBeenCalled();
+    expect(h.store.get().state).toBe('installed');
+  });
+
+  it('a first install is not held up by sessions elsewhere: no connection of ours exists yet', async () => {
+    const h = setup();
+    const started = await h.service.install(REQUEST, ADMIN, ['w1-app']);
+    expect(started.ok).toBe(true);
+    await h.service.cancel();
+  });
+
+  it('the model in use at ANOTHER context is an install like any other: it is checked again at that context', async () => {
+    const h = setup({ state: INSTALLED, runtimeOnDisk: true, agentInstalled: true });
+    h.deps.recommend.mockReturnValue({
+      ...recommendation(true),
+      pick: candidate('qwen3.6:35b-a3b', 'Qwen3.6 35B-A3B', 65536, PULL_BYTES, true),
+    });
+    await h.service.boot();
+    const started = await h.service.install({ ...REQUEST, context: 65536 }, ADMIN);
+    expect(started.ok).toBe(true);
+    await h.service.idle();
+    expect(h.store.get()).toMatchObject({
+      state: 'installed',
+      model: { id: 'qwen3.6:35b-a3b', context: 65536 },
+      library: [{ id: 'qwen3.6:35b-a3b', context: 65536 }],
+    });
+    expect(h.store.get().library).toHaveLength(1);
+  });
+
+  it('a job that stops leaves the earlier model to go back to, and no session until then', async () => {
+    const h = setup({ state: INSTALLED, runtimeOnDisk: true, agentInstalled: true });
+    await h.service.boot();
+    h.world.tags = BOTH_TAGS;
+    h.deps.verifyModel.mockResolvedValueOnce({ ok: false, code: 'no-tool-call' } as never);
+    await h.service.install(ADD_GPT, ADMIN);
+    await h.service.idle();
+
+    expect(h.store.get()).toMatchObject({ state: 'failed', step: 'verify', model: { id: GPT.id } });
+    // The endpoint record still names the earlier model, and nothing may be started on it.
+    expect(await h.service.launchRefusal('local-ollama')).toEqual({
+      code: 'job-unfinished',
+      message: { text: LOCAL_MODEL_INSTALL_LABELS.errJobUnfinished },
+      next: 'retry',
+    });
+    expect(await h.service.launchRefusalMessage('local-ollama', QWEN_ENTRY.id)).toBe(
+      'The model on this Mac is being changed and is not ready. Finish or undo that in the local model window first.'
+    );
+    const view = await h.service.view();
+    expect(view.actions).toEqual(['resume', 'install', 'use', 'delete-model', 'remove']);
+    expect(view.library.map((row) => [row.id, row.status, row.actions])).toEqual([
+      [QWEN_ENTRY.id, 'ready', ['use', 'delete']],
+      // Downloaded and not checked: the model of the stopped job, so nothing is offered on it.
+      [GPT.id, 'unverified', []],
+    ]);
+
+    // The way back. The model that never passed its check goes: it is what the job left behind.
+    h.calls.length = 0;
+    const back = await h.service.use({ modelId: QWEN_ENTRY.id }, ADMIN);
+    expect(back.ok).toBe(true);
+    await h.service.idle();
+    expect(h.deps.deleteModel).toHaveBeenCalledWith(expect.anything(), GPT.id, expect.anything());
+    expect(h.calls).toContain('removePartialModelBlobs');
+    expect(h.store.get()).toMatchObject({ state: 'installed', model: { id: QWEN_ENTRY.id, digest: DIGEST } });
+    expect(h.store.get()).not.toHaveProperty('replacedModelId');
+    expect(h.store.get()).not.toHaveProperty('error');
+    expect(await h.service.launchRefusalMessage('local-ollama', QWEN_ENTRY.id)).toBeUndefined();
+  });
+});
+
+describe('use: the switch to a checked model', () => {
+  it('loads and checks it again, connects it, and downloads nothing', async () => {
+    const h = setup({ state: TWO_MODELS, runtimeOnDisk: true, agentInstalled: true });
+    await h.service.boot();
+    h.calls.length = 0;
+    h.world.tags = BOTH_TAGS;
+
+    const started = await h.service.use({ modelId: GPT.id }, ADMIN);
+    expect(started.ok && started.view).toMatchObject({
+      state: 'installing',
+      step: 'verify',
+      steps: ['verify', 'connect'],
+      model: { id: GPT.id, label: GPT.label },
+      context: 65536,
+    });
+    await h.service.idle();
+
+    expect(h.calls).toEqual([
+      'recheckCliInstalled',
+      'supervisor.start',
+      'verifyModel',
+      'supervisor.start',
+      'connectLocalModel',
+    ]);
+    expect(h.deps.pullModel).not.toHaveBeenCalled();
+    expect(h.deps.ensureRuntimeInstalled).not.toHaveBeenCalled();
+    expect(h.deps.deleteModel).not.toHaveBeenCalled();
+    // The runtime is restarted for the context the model was checked with.
+    expect(h.supervisor.start).toHaveBeenLastCalledWith(expect.objectContaining({ contextLength: 65536 }));
+    expect(h.deps.verifyModel).toHaveBeenCalledWith(expect.anything(), GPT.id, 65536, expect.anything());
+    expect(h.deps.connectLocalModel).toHaveBeenCalledWith(
+      expect.objectContaining({ modelId: GPT.id, context: 65536, ours: true })
+    );
+    expect(h.store.get()).toMatchObject({
+      state: 'installed',
+      model: { id: GPT.id, context: 65536, digest: DIGEST },
+      cli: { id: 'opencode', label: 'OpenCode' },
+      library: [QWEN_ENTRY, { id: GPT.id, digest: DIGEST }],
+    });
+    expect(h.deps.audit).toHaveBeenCalledWith({
+      admin: 'root',
+      action: 'local_model_use',
+      target: GPT.id,
+      ip: '127.0.0.1',
+      detail: { cli: 'opencode', context: 65536 },
+    });
+  });
+
+  it('is refused for a model that is not one of the checked ones, and for the one in use', async () => {
+    const h = setup({ state: TWO_MODELS, runtimeOnDisk: true, agentInstalled: true });
+    await h.service.boot();
+    h.calls.length = 0;
+    expect(await h.service.use({ modelId: 'someone-else:7b' }, ADMIN)).toEqual({
+      ok: false,
+      status: 400,
+      message: { text: LOCAL_MODEL_INSTALL_LABELS.refusedNotInLibrary },
+    });
+    expect(await h.service.use({ modelId: QWEN_ENTRY.id }, ADMIN)).toMatchObject({
+      ok: false,
+      status: 409,
+      conflict: { reason: 'already-installed' },
+    });
+    expect(h.calls).toEqual([]);
+    expect(h.store.get().state).toBe('installed');
+  });
+
+  it('is refused while live sessions use the model', async () => {
+    const h = setup({ state: TWO_MODELS, runtimeOnDisk: true, agentInstalled: true });
+    await h.service.boot();
+    h.calls.length = 0;
+    expect(await h.service.use({ modelId: GPT.id }, ADMIN, ['w1-app'])).toMatchObject({
+      ok: false,
+      status: 409,
+      conflict: { reason: 'sessions-open', sessions: ['w1-app'] },
+    });
+    expect(h.calls).toEqual([]);
+  });
+
+  it('is 409 wrong-state where there is nothing to switch: idle', async () => {
+    const h = setup();
+    expect(await h.service.use({ modelId: GPT.id }, ADMIN)).toMatchObject({
+      ok: false,
+      status: 409,
+      conflict: { reason: 'wrong-state' },
+    });
+  });
+
+  it('a model whose digest is no longer the stored one is not loaded: model-changed, and the way back stays', async () => {
+    const h = setup({ state: TWO_MODELS, runtimeOnDisk: true, agentInstalled: true });
+    await h.service.boot();
+    h.world.tags = [BOTH_TAGS[0], { ...BOTH_TAGS[1], digest: 'ffff00000000' }];
+    h.deps.readModelDigest.mockImplementation(async (_target: unknown, id: string) =>
+      id === GPT.id ? 'ffff00000000' : DIGEST
+    );
+    h.calls.length = 0;
+    await h.service.use({ modelId: GPT.id }, ADMIN);
+    await h.service.idle();
+
+    expect(h.deps.verifyModel).not.toHaveBeenCalled();
+    expect(h.deps.connectLocalModel).not.toHaveBeenCalled();
+    const view = await h.service.view();
+    expect(view.state).toBe('failed');
+    expect(view.error).toMatchObject({
+      code: 'model-changed',
+      detail: 'The runtime reports another digest for the model.',
+    });
+    expect(view.library.map((row) => [row.id, row.status, row.actions])).toEqual([
+      [QWEN_ENTRY.id, 'ready', ['use', 'delete']],
+      [GPT.id, 'changed', []],
+    ]);
+    // The changed model stays a library entry until the person deletes it; it is never deleted as a leftover.
+    await h.service.use({ modelId: QWEN_ENTRY.id }, ADMIN);
+    await h.service.idle();
+    expect(h.deps.deleteModel).not.toHaveBeenCalled();
+    expect(h.store.get()).toMatchObject({ state: 'installed', model: { id: QWEN_ENTRY.id } });
+  });
+
+  it('a model the runtime no longer lists is model-changed too, said as that', async () => {
+    const h = setup({ state: TWO_MODELS, runtimeOnDisk: true, agentInstalled: true });
+    await h.service.boot();
+    h.deps.readModelDigest.mockImplementation(async (_target: unknown, id: string) =>
+      id === GPT.id ? undefined : DIGEST
+    );
+    await h.service.use({ modelId: GPT.id }, ADMIN);
+    await h.service.idle();
+    expect((await h.service.view()).error).toMatchObject({
+      code: 'model-changed',
+      detail: 'The runtime no longer lists the model.',
+    });
+  });
+
+  it('takes the coding agent the model was checked with when it is installed, else the one of the state', async () => {
+    const pi = { id: 'pi', label: 'Pi' };
+    const state: LocalModelStateFile = { ...TWO_MODELS, library: [QWEN_ENTRY, { ...GPT_ENTRY, cli: pi }] };
+    const withPi = setup({ state, runtimeOnDisk: true });
+    withPi.deps.recheckCliInstalled.mockImplementation(async () => true);
+    await withPi.service.boot();
+    await withPi.service.use({ modelId: GPT.id }, ADMIN);
+    await withPi.service.idle();
+    expect(withPi.store.get().cli).toEqual(pi);
+
+    const withoutPi = setup({ state, runtimeOnDisk: true });
+    withoutPi.deps.recheckCliInstalled.mockImplementation((async (id: string) => id === 'opencode') as never);
+    await withoutPi.service.boot();
+    await withoutPi.service.use({ modelId: GPT.id }, ADMIN);
+    await withoutPi.service.idle();
+    expect(withoutPi.store.get().cli).toEqual({ id: 'opencode', label: 'OpenCode' });
+  });
+
+  it('with no coding agent of the two installed it is refused, in one sentence, and nothing starts', async () => {
+    const h = setup({ state: TWO_MODELS, runtimeOnDisk: true, agentInstalled: false });
+    await h.service.boot();
+    expect(await h.service.use({ modelId: GPT.id }, ADMIN)).toEqual({
+      ok: false,
+      status: 400,
+      message: { text: LOCAL_MODEL_INSTALL_LABELS.refusedAgentMissing, vars: { cli: 'OpenCode' } },
+    });
+    expect(h.store.get().state).toBe('installed');
+  });
+
+  it('a switch or a new model from a stopped model starts the runtime and undoes the Stop', async () => {
+    const stopped: LocalModelStateFile = { ...TWO_MODELS, runtime: { ...INSTALLED.runtime!, enabled: false } };
+    const switched = setup({ state: stopped, runtimeOnDisk: true, agentInstalled: true });
+    await switched.service.boot();
+    expect(switched.supervisor.start).not.toHaveBeenCalled();
+    await switched.service.use({ modelId: GPT.id }, ADMIN);
+    await switched.service.idle();
+    // The model is in use and running now, so it starts with the server again, like after Start.
+    expect(switched.store.get()).toMatchObject({ state: 'installed', runtime: { enabled: true } });
+    expect((await switched.service.view()).running).toBe(true);
+
+    const added = setup({ state: { ...INSTALLED, runtime: { ...INSTALLED.runtime!, enabled: false } } });
+    added.world.runtimeOnDisk = true;
+    added.world.agentInstalled = true;
+    await added.service.boot();
+    await added.service.install(ADD_GPT, ADMIN);
+    await added.service.idle();
+    expect(added.store.get()).toMatchObject({ state: 'installed', model: { id: GPT.id }, runtime: { enabled: true } });
+
+    // A switch that was refused changed nothing: the model stays stopped.
+    const refused = setup({ state: stopped, runtimeOnDisk: true, agentInstalled: true });
+    await refused.service.use({ modelId: 'someone-else:7b' }, ADMIN);
+    expect(refused.store.get().runtime?.enabled).toBe(false);
+  });
+
+  it('Cancel pauses a switch like any job, and Resume goes on with it', async () => {
+    const h = setup({
+      state: TWO_MODELS,
+      runtimeOnDisk: true,
+      agentInstalled: true,
+      overrides: {
+        verifyModel: vi
+          .fn()
+          .mockImplementationOnce(async (_t: unknown, _id: string, _c: number, signal?: AbortSignal) => {
+            await untilAborted(signal);
+            return { ok: false as const, code: 'cancelled' as const };
+          })
+          .mockResolvedValue({
+            ok: true as const,
+            loaded: { context: 65536, sizeBytes: 15_000_000_000, sizeVramBytes: 15_000_000_000 },
+          }),
+      },
+    });
+    await h.service.boot();
+    await h.service.use({ modelId: GPT.id }, ADMIN);
+    await vi.waitFor(() => expect(h.deps.verifyModel).toHaveBeenCalled());
+    const paused = await h.service.cancel();
+    expect(paused.ok && paused.view).toMatchObject({ state: 'paused', step: 'verify', steps: ['verify', 'connect'] });
+    await h.service.resume({}, ADMIN);
+    await h.service.idle();
+    expect(h.store.get()).toMatchObject({ state: 'installed', model: { id: GPT.id } });
+  });
+});
+
+describe('deleteLibraryModel: one model out of the store', () => {
+  async function twoModelsRunning() {
+    const h = setup({ state: TWO_MODELS, runtimeOnDisk: true, agentInstalled: true });
+    await h.service.boot();
+    h.world.tags = [...BOTH_TAGS];
+    h.deps.deleteModel.mockImplementation(async (_target: unknown, id: string) => {
+      h.calls.push('deleteModel');
+      h.world.tags = (h.world.tags ?? []).filter((tag) => tag.name !== id);
+      return true;
+    });
+    h.calls.length = 0;
+    return h;
+  }
+
+  it('deletes it through the runtime, drops its entry and writes the audit line', async () => {
+    const h = await twoModelsRunning();
+    const result = await h.service.deleteLibraryModel({ modelId: GPT.id }, ADMIN);
+    expect(h.deps.deleteModel).toHaveBeenCalledTimes(1);
+    expect(h.deps.deleteModel).toHaveBeenCalledWith({ baseUrl: 'http://127.0.0.1:11435' }, GPT.id, expect.anything());
+    expect(h.store.get().library).toEqual([QWEN_ENTRY]);
+    expect(h.store.get().state).toBe('installed');
+    // The answer is the view after the delete: the runtime was asked again.
+    expect(result.ok && result.view.library.map((row) => row.id)).toEqual([QWEN_ENTRY.id]);
+    expect(h.deps.audit).toHaveBeenCalledWith({
+      admin: 'root',
+      action: 'local_model_delete',
+      target: GPT.id,
+      ip: '127.0.0.1',
+      detail: { verified: true, bytes: GPT_BYTES },
+    });
+    // Nothing else of the feature was touched.
+    expect(h.calls).toEqual(['deleteModel']);
+  });
+
+  it('refuses the model in use: switch first, or remove', async () => {
+    const h = await twoModelsRunning();
+    expect(await h.service.deleteLibraryModel({ modelId: QWEN_ENTRY.id }, ADMIN)).toEqual({
+      ok: false,
+      status: 409,
+      conflict: {
+        reason: 'model-active',
+        message: { text: LOCAL_MODEL_INSTALL_LABELS.conflictModelActive, vars: { model: 'Qwen3.6 35B-A3B' } },
+      },
+    });
+    expect(h.deps.deleteModel).not.toHaveBeenCalled();
+  });
+
+  it('refuses while the runtime is down or does not answer: only the runtime deletes a model', async () => {
+    const stopped = setup({ state: TWO_MODELS });
+    expect(await stopped.service.deleteLibraryModel({ modelId: GPT.id }, ADMIN)).toMatchObject({
+      ok: false,
+      status: 409,
+      conflict: { reason: 'runtime-not-running', message: { text: LOCAL_MODEL_INSTALL_LABELS.errRuntimeNotRunning } },
+    });
+    const silent = await twoModelsRunning();
+    silent.deps.getRuntimeVersion.mockResolvedValue(undefined);
+    expect(await silent.service.deleteLibraryModel({ modelId: GPT.id }, ADMIN)).toMatchObject({
+      ok: false,
+      status: 409,
+      conflict: { reason: 'runtime-not-running' },
+    });
+    expect(silent.deps.deleteModel).not.toHaveBeenCalled();
+    expect(silent.store.get().library).toHaveLength(2);
+  });
+
+  it('refuses a name that is neither a checked model nor one the runtime lists, and anything that is not name:tag', async () => {
+    const h = await twoModelsRunning();
+    const refused = { ok: false, status: 400, message: { text: LOCAL_MODEL_INSTALL_LABELS.refusedNotOnThisMac } };
+    expect(await h.service.deleteLibraryModel({ modelId: 'someone-else:7b' }, ADMIN)).toEqual(refused);
+    for (const modelId of ['../../etc/passwd', '/Users/me/models', 'hf.co/someone/model:Q4', 'NoTag', '']) {
+      expect(await h.service.deleteLibraryModel({ modelId }, ADMIN)).toEqual(refused);
+    }
+    expect(h.deps.deleteModel).not.toHaveBeenCalled();
+  });
+
+  it('is 409 wrong-state in idle: there is no runtime to ask', async () => {
+    const h = setup();
+    expect(await h.service.deleteLibraryModel({ modelId: GPT.id }, ADMIN)).toMatchObject({
+      ok: false,
+      status: 409,
+      conflict: { reason: 'wrong-state' },
+    });
+  });
+
+  it('a runtime that does not delete it: said as that, and the entry stays', async () => {
+    const h = await twoModelsRunning();
+    h.deps.deleteModel.mockResolvedValue(false);
+    expect(await h.service.deleteLibraryModel({ modelId: GPT.id }, ADMIN)).toEqual({
+      ok: false,
+      status: 500,
+      message: { text: LOCAL_MODEL_INSTALL_LABELS.deleteFailed, vars: { model: 'GPT-OSS 20B' } },
+    });
+    expect(h.store.get().library).toEqual([QWEN_ENTRY, GPT_ENTRY]);
+    expect(h.deps.audit).not.toHaveBeenCalled();
+  });
+
+  it('a model the runtime lists and Codeman never checked can be deleted too', async () => {
+    const h = await twoModelsRunning();
+    h.world.tags = [...BOTH_TAGS, { name: 'leftover:9b', size: 6_000_000_000, digest: 'aa' }];
+    const before = await h.service.view();
+    expect(before.library.find((row) => row.id === 'leftover:9b')).toMatchObject({
+      status: 'unverified',
+      sizeGb: '6.0',
+      actions: ['delete'],
+    });
+    const result = await h.service.deleteLibraryModel({ modelId: 'leftover:9b' }, ADMIN);
+    expect(result.ok && result.view.library.map((row) => row.id)).toEqual([QWEN_ENTRY.id, GPT.id]);
+    expect(h.store.get().library).toEqual([QWEN_ENTRY, GPT_ENTRY]);
+    expect(h.deps.audit).toHaveBeenCalledWith(
+      expect.objectContaining({ action: 'local_model_delete', detail: { verified: false, bytes: 6_000_000_000 } })
+    );
+  });
+
+  it('a checked model the runtime no longer lists: its entry is dropped once the runtime says it is gone', async () => {
+    const h = await twoModelsRunning();
+    h.world.tags = [BOTH_TAGS[0]];
+    const result = await h.service.deleteLibraryModel({ modelId: GPT.id }, ADMIN);
+    expect(result.ok).toBe(true);
+    // Asked of the runtime all the same: its "not found" is what says the model is gone.
+    expect(h.deps.deleteModel).toHaveBeenCalledWith(expect.anything(), GPT.id, expect.anything());
+    expect(h.store.get().library).toEqual([QWEN_ENTRY]);
+  });
+
+  it('works from a stopped job too, for any model but the one of that job', async () => {
+    const state: LocalModelStateFile = {
+      ...jobAt('verify', 'paused'),
+      model: { ...GPT },
+      library: [QWEN_ENTRY],
+      connection: { endpointId: 'local-ollama', flagWasEnabled: false },
+    };
+    const h = setup({ state, runtimeOnDisk: true });
+    h.world.running = true;
+    h.world.tags = BOTH_TAGS;
+    expect(await h.service.deleteLibraryModel({ modelId: GPT.id }, ADMIN)).toMatchObject({
+      ok: false,
+      conflict: { reason: 'model-active' },
+    });
+    const result = await h.service.deleteLibraryModel({ modelId: QWEN_ENTRY.id }, ADMIN);
+    expect(result.ok).toBe(true);
+    expect(h.store.get().library).toEqual([]);
+    expect(h.store.get().state).toBe('paused');
+  });
+});
+
+describe('the model store in idle: what an earlier Remove kept', () => {
+  it('shows what it takes, offers Remove, and Remove with the models frees it', async () => {
+    const h = setup();
+    h.world.storeBytes = PULL_BYTES;
+    const view = await h.service.view();
+    expect(view).toMatchObject({
+      state: 'idle',
+      library: [],
+      store: { bytes: PULL_BYTES, gb: '23.1' },
+      actions: ['install', 'remove'],
+    });
+
+    h.deps.removeLocalModelFiles.mockImplementation(async () => {
+      h.calls.push('removeLocalModelFiles');
+      h.world.storeBytes = 0;
+    });
+    const removed = await h.service.remove({ removeModel: true }, [], ADMIN);
+    expect(h.deps.removeLocalModelFiles).toHaveBeenCalledWith({ models: true, paths: PATHS });
+    expect(removed.ok && removed.view).toMatchObject({
+      state: 'idle',
+      store: { bytes: 0, gb: '0.0' },
+      actions: ['install'],
+    });
+  });
+
+  it('Remove that keeps the models leaves them there: the next view says how much', async () => {
+    const h = setup({ state: TWO_MODELS, runtimeOnDisk: true });
+    h.world.storeBytes = PULL_BYTES + GPT_BYTES;
+    const removed = await h.service.remove({}, [], ADMIN);
+    expect(removed.ok && removed.view).toMatchObject({
+      state: 'idle',
+      library: [],
+      store: { bytes: PULL_BYTES + GPT_BYTES, gb: '36.9' },
+      actions: ['install', 'remove'],
+    });
+    expect(h.store.get()).not.toHaveProperty('library');
+  });
+});
+
+describe('the view does not ask the runtime or the disk on every poll', () => {
+  it('reads the list and the store once, then again only when they are stale', async () => {
+    const h = setup({ state: TWO_MODELS, runtimeOnDisk: true });
+    await h.service.boot();
+    h.world.tags = BOTH_TAGS;
+    h.deps.listTags.mockClear();
+    for (let i = 0; i < 5; i++) await h.service.view();
+    expect(h.deps.listTags).toHaveBeenCalledTimes(1);
+    expect(h.deps.measureModelStore).toHaveBeenCalledTimes(1);
+
+    // Five seconds on: the list is read again, in the background. The view does not wait for
+    // a runtime that is slow to answer: it is built from the list it has.
+    h.world.clock += 5_000;
+    let answer: (tags: typeof BOTH_TAGS) => void = () => {};
+    h.deps.listTags.mockImplementationOnce(() => new Promise((resolve) => (answer = resolve)));
+    const stale = await h.service.view();
+    expect(stale.library.map((row) => row.status)).toEqual(['ready', 'ready']);
+    await vi.waitFor(() => expect(h.deps.listTags).toHaveBeenCalledTimes(2));
+    // A second poll while that read is out starts no second one.
+    await h.service.view();
+    expect(h.deps.listTags).toHaveBeenCalledTimes(2);
+    answer([BOTH_TAGS[0]]);
+    await vi.waitFor(async () =>
+      expect((await h.service.view()).library.map((row) => row.status)).toEqual(['ready', 'missing'])
+    );
+    expect(h.deps.measureModelStore).toHaveBeenCalledTimes(1);
+
+    // Thirty seconds on: the store is measured again.
+    h.world.clock += 30_000;
+    await h.service.view();
+    await vi.waitFor(() => expect(h.deps.measureModelStore).toHaveBeenCalledTimes(2));
+  });
+
+  it('a runtime that does not answer keeps the last list: no model reads as missing for a moment', async () => {
+    const h = setup({ state: TWO_MODELS, runtimeOnDisk: true });
+    await h.service.boot();
+    h.world.tags = BOTH_TAGS;
+    await h.service.view();
+    h.deps.getRuntimeVersion.mockResolvedValue(undefined);
+    h.deps.listTags.mockClear();
+    h.world.clock += 5_000;
+    await h.service.view();
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    expect(h.deps.listTags).not.toHaveBeenCalled();
+    expect((await h.service.view()).library.map((row) => row.status)).toEqual(['ready', 'ready']);
+  });
+
+  it('a stopped runtime is not asked at all, and offers no delete', async () => {
+    const h = setup({ state: { ...TWO_MODELS, runtime: { ...INSTALLED.runtime!, enabled: false } } });
+    await h.service.boot();
+    const view = await h.service.view();
+    expect(h.deps.listTags).not.toHaveBeenCalled();
+    expect(view.library.map((row) => [row.id, row.sizeGb, row.actions])).toEqual([
+      [QWEN_ENTRY.id, '23.1', []],
+      [GPT.id, '13.8', ['use']],
+    ]);
+  });
+
+  it('a listing or a measurement that fails is not an error of the view', async () => {
+    const h = setup({ state: TWO_MODELS, runtimeOnDisk: true });
+    await h.service.boot();
+    h.deps.listTags.mockRejectedValue(new Error('socket hang up'));
+    h.deps.measureModelStore.mockRejectedValue(new Error('EIO'));
+    const view = await h.service.view();
+    expect(view.state).toBe('installed');
+    expect(view).not.toHaveProperty('store');
+    expect(view.library.map((row) => row.id)).toEqual([QWEN_ENTRY.id, GPT.id]);
+  });
+});

test/local-model-runtime.test.ts

@@ -37,6 +37,7 @@ import {
   OLLAMA_RUNTIME_PIN,
   parseInferenceComputeTotal,
   removeLocalModelFiles,
+  measureModelStore,
   removePartialModelBlobs,
   RUNTIME_CTX_CHECKPOINTS,
   RUNTIME_DOWNLOAD_RETRIES,
@@ -1103,3 +1104,56 @@ describe('removePartialModelBlobs', () => {
     expect(existsSync(join(outside, 'sha256-eee-partial'))).toBe(true);
   });
 });
+
+describe('measureModelStore', () => {
+  const blob = (name: string): string => join(paths.modelsDir, 'blobs', name);
+
+  it('is the sizes of the files in the blob folder, a download that was interrupted included', async () => {
+    await mkdir(join(paths.modelsDir, 'blobs'), { recursive: true });
+    await mkdir(join(paths.modelsDir, 'manifests', 'registry.ollama.ai'), { recursive: true });
+    await writeFile(blob('sha256-aaa'), 'x'.repeat(1000));
+    await writeFile(blob('sha256-bbb'), 'y'.repeat(250));
+    await writeFile(blob('sha256-ccc-partial'), 'z'.repeat(40));
+    // The manifests are a few kilobytes beside gigabytes of layers: left out.
+    await writeFile(join(paths.modelsDir, 'manifests', 'registry.ollama.ai', 'latest'), '{"layers":[]}');
+    expect(await measureModelStore(paths)).toBe(1290);
+  });
+
+  it('is 0 without a model store, without a blob folder and for an empty one, and never throws', async () => {
+    expect(await measureModelStore(paths)).toBe(0);
+    await mkdir(paths.modelsDir, { recursive: true });
+    expect(await measureModelStore(paths)).toBe(0);
+    await mkdir(join(paths.modelsDir, 'blobs'), { recursive: true });
+    expect(await measureModelStore(paths)).toBe(0);
+  });
+
+  it('reads nothing and changes nothing: the store is as it was afterwards', async () => {
+    await mkdir(join(paths.modelsDir, 'blobs'), { recursive: true });
+    await writeFile(blob('sha256-aaa'), 'weights');
+    await writeFile(blob('sha256-bbb-partial'), 'half');
+    await measureModelStore(paths);
+    expect(await readFile(blob('sha256-aaa'), 'utf8')).toBe('weights');
+    expect(await readFile(blob('sha256-bbb-partial'), 'utf8')).toBe('half');
+  });
+
+  it('counts only regular files directly in the blob folder, and follows no link', async () => {
+    const outside = await outsideDir();
+    await writeFile(join(outside, 'huge'), 'h'.repeat(5000));
+    await mkdir(join(paths.modelsDir, 'blobs', 'a-folder'), { recursive: true });
+    await writeFile(join(paths.modelsDir, 'blobs', 'a-folder', 'inside'), 'i'.repeat(700));
+    await symlink(join(outside, 'huge'), blob('sha256-link'));
+    await writeFile(blob('sha256-aaa'), 'x'.repeat(10));
+    // The folder's file and the link's target are somebody else's: not counted.
+    expect(await measureModelStore(paths)).toBe(10);
+  });
+
+  it('a blob folder, a model store or a root that is a symlink counts as empty', async () => {
+    const outside = await outsideDir();
+    await writeFile(join(outside, 'sha256-eee'), 'e'.repeat(900));
+    await mkdir(paths.modelsDir, { recursive: true });
+    await symlink(outside, join(paths.modelsDir, 'blobs'));
+    expect(await measureModelStore(paths)).toBe(0);
+    // A path that is not inside the local model folder is refused before anything is read.
+    expect(await measureModelStore({ ...paths, modelsDir: outside })).toBe(0);
+  });
+});

test/local-model-state-store.test.ts

@@ -196,6 +196,89 @@ describe('parseLocalModelState', () => {
   });
 });
 
+describe('parseLocalModelState: the library', () => {
+  const QWEN = {
+    id: 'qwen3.6:35b-a3b',
+    label: 'Qwen3.6 35B-A3B',
+    context: 131072,
+    digest: '0ce5ff81f9ffdf89dd8192ca7b5d34cefd8996a875b3aaaaafaf5c4813569eba',
+    bytes: 23_105_798_956,
+    cli: { id: 'opencode', label: 'OpenCode' },
+    verifiedAt: '2026-11-10T09:00:00.000Z',
+  };
+  const MIMO = { id: 'mimo-v2.6:9b-q4_k_m', label: 'MiMo V2.6 9B', context: 65536, digest: 'abc123' };
+  const read = (state: unknown) => parseLocalModelState(JSON.stringify(state));
+
+  it('reads back the checked models of an installed state and of a job, in their order', () => {
+    expect(read({ ...INSTALLED, library: [QWEN, MIMO] })).toEqual({ ...INSTALLED, library: [QWEN, MIMO] });
+    expect(read({ ...PAUSED, library: [MIMO] })).toEqual({ ...PAUSED, library: [MIMO] });
+    expect(read({ ...FAILED, library: [MIMO, QWEN] }).library).toEqual([MIMO, QWEN]);
+  });
+
+  it('a file an earlier build wrote has no list, and reads back without one', () => {
+    expect(read(INSTALLED)).toEqual(INSTALLED);
+    expect(read(INSTALLED)).not.toHaveProperty('library');
+    expect(read(PAUSED)).not.toHaveProperty('library');
+  });
+
+  it('an empty list stays an empty list: every checked model was deleted', () => {
+    expect(read({ ...PAUSED, library: [] }).library).toEqual([]);
+  });
+
+  it('a list that is not a list is dropped, the state is kept', () => {
+    for (const library of ['qwen', 7, { 0: QWEN }, null, true]) {
+      const state = read({ ...INSTALLED, library });
+      expect(state.state).toBe('installed');
+      expect(state).not.toHaveProperty('library');
+    }
+  });
+
+  it('drops an entry that could never be switched to: without its id, label, context or digest', () => {
+    const library = [
+      { ...QWEN, id: '' },
+      { ...QWEN, label: 7 },
+      { ...QWEN, context: 0 },
+      { ...QWEN, context: '131072' },
+      { ...QWEN, digest: undefined },
+      'qwen3.6:35b-a3b',
+      null,
+      ['qwen3.6:35b-a3b'],
+      MIMO,
+    ];
+    expect(read({ ...INSTALLED, library }).library).toEqual([MIMO]);
+  });
+
+  it('keeps one entry per model: the first', () => {
+    const library = [QWEN, { ...QWEN, context: 65536 }, MIMO];
+    expect(read({ ...INSTALLED, library }).library).toEqual([QWEN, MIMO]);
+  });
+
+  it('drops what it does not know inside an entry, and a member of the wrong type: an entry holds no path', () => {
+    const library = [
+      {
+        ...QWEN,
+        path: '/Users/me/.codeman/local-model/models',
+        blobs: ['/etc/passwd'],
+        bytes: -5,
+        cli: { id: 'opencode' },
+        verifiedAt: 7,
+      },
+    ];
+    const [entry] = read({ ...INSTALLED, library }).library ?? [];
+    expect(entry).toEqual({ id: QWEN.id, label: QWEN.label, context: QWEN.context, digest: QWEN.digest });
+    expect(JSON.stringify(read({ ...INSTALLED, library }))).not.toContain('/');
+  });
+
+  it('reads at most 64 entries of a list, however long it is', () => {
+    const library = Array.from({ length: 500 }, (_unused, i) => ({ ...MIMO, id: `model-${i}:9b` }));
+    expect(read({ ...INSTALLED, library }).library).toHaveLength(64);
+  });
+
+  it('an idle file has no list, whatever it says', () => {
+    expect(read({ schema: 1, state: 'idle', library: [QWEN] })).toEqual(IDLE_LOCAL_MODEL_STATE);
+  });
+});
+
 describe('readLocalModelState', () => {
   it('is idle when the file is missing, and never throws', async () => {
     expect(existsSync(FILE())).toBe(false);

test/local-model-ui.browser.test.ts

@@ -11,7 +11,11 @@
  *    the fill follows the selection;
  *  - the selected row carries the feature's colour on its reading edge;
  *  - the welcome button is really gone while it is `hidden`, and the window paints above App
- *    Settings.
+ *    Settings;
+ *  - the models on this Mac: the sizes on disk end on one edge under their caption, a row's
+ *    buttons end on the list's edge, the sizes do not move when a row's Delete question opens,
+ *    a long list scrolls from its top (it is never cut off above the frame), and under 560px a
+ *    row is two lines with nothing running off the side.
  *
  * The REAL index.html is served with its scripts taken out and the two shipping stylesheets
  * inlined (mobile.css under the media query its `<link>` carries); the real module runs on a
@@ -124,10 +128,54 @@ const STATUS = {
     developerTools: 'present',
     runtime: { version: '0.40.15', installed: false, downloadBytes: RUNTIME, downloadGb: '0.2', unpackedGb: '0.6' },
     folder: '/Users/sam/.codeman/local-model',
+    library: [],
     actions: ['install'],
   },
 };
 
+const libraryRow = (id: string, label: string, sizeGb: string, over: object = {}) => ({
+  id,
+  label,
+  context: 131072,
+  sizeBytes: Number(sizeGb) * 1e9,
+  sizeGb,
+  active: false,
+  verified: true,
+  status: 'ready',
+  actions: ['use', 'delete'],
+  ...over,
+});
+
+/** An installed model with two more models beside it: one checked, one the runtime lists and Codeman never checked. */
+const INSTALLED = {
+  ...STATUS,
+  install: {
+    ...STATUS.install,
+    state: 'installed',
+    running: true,
+    runtime: { version: '0.40.15', installed: true, downloadBytes: 0, downloadGb: '0.0', unpackedGb: '0.6' },
+    model: { id: 'qwen3.6:35b-a3b', label: 'Qwen3.6 35B-A3B' },
+    cli: 'opencode',
+    cliLabel: 'OpenCode',
+    context: 131072,
+    port: 11435,
+    endpointId: 'local-ollama',
+    loaded: { context: 131072, memoryBytes: 26300000000, memoryGb: '26.3', onGpu: true },
+    library: [
+      libraryRow('qwen3.6:35b-a3b', 'Qwen3.6 35B-A3B', '23.1', { active: true, actions: [] }),
+      libraryRow('qwen3.8:27b-mtp-q4_k_m', 'Qwen3.8 27B', '17.7'),
+      libraryRow('mimo-v2.6:9b-q4_k_m', 'MiMo V2.6 9B', '6.6', {
+        context: undefined,
+        verified: false,
+        status: 'unverified',
+        actions: ['delete'],
+      }),
+    ],
+    store: { bytes: 47400000000, gb: '47.4' },
+    actions: ['start-session', 'stop', 'install', 'use', 'delete-model', 'remove'],
+  },
+};
+
 type Box = { left: number; right: number; top: number; bottom: number; width: number; height: number };
 
 /** What the page holds once the module ran on the stand-in class. */
@@ -160,7 +208,7 @@ describe('the local model window (real Chromium)', () => {
   });
 
   /** The real page at a width, the module loaded, the answer in, the window closed. */
-  async function load(width: number, height = 900) {
+  async function load(width: number, height = 900, answer: object = STATUS) {
     p = await browser.newPage({ viewport: { width, height }, deviceScaleFactor: 1 });
     // No motion: the bar is at its width as soon as it is painted, so nothing here waits on a clock.
     await p.emulateMedia({ reducedMotion: 'reduce' });
@@ -178,7 +226,7 @@ describe('the local model window (real Chromium)', () => {
       w.app = new w.CodemanApp();
       w.app._api = async () => ({ ok: true, status: 200, json: async () => ({ success: true, data: status }) });
       await w.app.loadLocalModel();
-    }, STATUS);
+    }, answer);
   }
 
   /** Two animation frames: whatever was just written is laid out and painted. */
@@ -343,6 +391,125 @@ describe('the local model window (real Chromium)', () => {
     expect(overflow).toBeLessThanOrEqual(0);
   });
 
+  it('the models on this Mac: sizes on one edge, a row one line, its buttons on the list edge', async () => {
+    await load(1440, 900, INSTALLED);
+    await open();
+    const rows = await boxes('.lm-lib-row');
+    expect(rows).toHaveLength(3);
+    const names = await boxes('.lm-lib-name');
+    const tags = await boxes('.lm-lib-tag');
+    const sizes = await boxes('.lm-lib-size');
+    const [caption] = await boxes('.lm-lib-caption-size');
+    expect(same(sizes.map((box) => box.right))).toBe(true);
+    expect(same([caption.right, sizes[0].right])).toBe(true);
+    expect(same(names.map((box) => box.left))).toBe(true);
+    expect(same(tags.map((box) => box.left))).toBe(true);
+    // One line a row: the name, the tag, the size and the buttons share its middle.
+    const middle = (box: Box) => (box.top + box.bottom) / 2;
+    const actions = await boxes('.lm-lib-row .lm-lib-actions');
+    for (let i = 0; i < rows.length; i++) {
+      expect(Math.abs(middle(names[i]) - middle(sizes[i]))).toBeLessThan(3);
+      expect(Math.abs(middle(tags[i]) - middle(sizes[i]))).toBeLessThan(3);
+      expect(names[i].right).toBeLessThanOrEqual(tags[i].left + 0.6);
+      expect(sizes[i].right).toBeLessThanOrEqual(actions[i].left + 0.6);
+    }
+    // The last button of a row ends where every line of the window ends: on "Add a model"'s edge.
+    const rowButtons = await boxes('.lm-lib-row .lm-lib-actions button:last-child');
+    const [add] = await boxes('.lm-lib-foot button');
+    expect(same([...rowButtons.map((box) => box.right), add.right])).toBe(true);
+    // The model in use carries the feature's colour on its reading edge; the others do not.
+    const paint = await p.evaluate(() => {
+      const probe = document.body.appendChild(document.createElement('i'));
+      probe.style.color = 'var(--lm-brand)';
+      const brand = getComputedStyle(probe).color;
+      probe.remove();
+      const edge = (sel: string) => getComputedStyle(document.querySelector(sel)!).borderLeftColor;
+      return { brand, on: edge('.lm-lib-row-on'), off: edge('.lm-lib-row:not(.lm-lib-row-on)') };
+    });
+    expect(paint.on).toBe(paint.brand);
+    expect(paint.off).not.toBe(paint.brand);
+    // The screen starts at the top of the frame, right under the header.
+    const [body] = await boxes('#localModelWindowBody');
+    const [title] = await boxes('.lm-title');
+    expect(title.top - body.top).toBeLessThan(40);
+  });
+
+  it('the Delete question opens under its row without moving the sizes', async () => {
+    await load(1440, 900, INSTALLED);
+    await open();
+    const before = await boxes('.lm-lib-size');
+    await p.click('.lm-lib-row:nth-of-type(3) .lm-lib-actions button:last-child');
+    await painted();
+    const [ask] = await boxes('.lm-lib-ask');
+    const rows = await boxes('.lm-lib-row');
+    const after = await boxes('.lm-lib-size');
+    // Sideways nothing moved; the rows after the question moved down by it.
+    expect(after.map((box) => Math.round(box.right))).toEqual(before.map((box) => Math.round(box.right)));
+    expect(ask.top).toBeGreaterThanOrEqual(rows[1].bottom - 1);
+    expect(rows[2].top).toBeGreaterThanOrEqual(ask.bottom - 1);
+    // The row's own buttons are unseen while it is asked about, and the red button is the question's.
+    const seen = await p.evaluate(() => ({
+      away: getComputedStyle(document.querySelector('.lm-lib-actions-away')!).visibility,
+      red: [...document.querySelectorAll('.local-model-window .wt-btn-danger')].map((el) => el.textContent),
+      focus: document.activeElement?.textContent,
+    }));
+    expect(seen).toEqual({ away: 'hidden', red: ['Delete'], focus: 'Cancel' });
+  });
+
+  it('a long list of models scrolls from its top: the first lines are never cut off above the frame', async () => {
+    const many = Array.from({ length: 14 }, (_unused, i) => libraryRow(`model-${i}:9b`, `Model ${i}`, '6.6'));
+    const answer = {
+      ...INSTALLED,
+      install: { ...INSTALLED.install, library: [...INSTALLED.install.library, ...many] },
+    };
+    for (const [width, height] of [
+      [1440, 900],
+      [390, 844],
+    ]) {
+      await load(width, height, answer);
+      await open();
+      const scroll = await p.evaluate(() => {
+        const body = document.getElementById('localModelWindowBody')!;
+        const title = body.querySelector('.lm-title')!.getBoundingClientRect();
+        const box = body.getBoundingClientRect();
+        return {
+          overflows: body.scrollHeight > body.clientHeight,
+          top: body.scrollTop,
+          titleInside: title.top >= box.top - 0.5,
+          sideways: body.scrollWidth - body.clientWidth,
+        };
+      });
+      expect(scroll).toEqual({ overflows: true, top: 0, titleInside: true, sideways: 0 });
+      // The buttons of the screen stay in the frame's foot, under the part that scrolls.
+      const [foot] = await boxes('#localModelWindowFoot');
+      const [win] = await boxes('.local-model-window');
+      expect(foot.bottom).toBeLessThanOrEqual(win.bottom + 0.6);
+      await p.close();
+    }
+  });
+
+  it('the models on this Mac under 560px: two lines a row, nothing off the side', async () => {
+    await load(390, 844, INSTALLED);
+    await open();
+    const names = await boxes('.lm-lib-name');
+    const tags = await boxes('.lm-lib-tag');
+    const sizes = await boxes('.lm-lib-size');
+    for (let i = 0; i < names.length; i++) {
+      // The name and its size, then the state and what can be done.
+      expect(tags[i].top).toBeGreaterThanOrEqual(names[i].bottom - 1);
+      expect(sizes[i].top).toBeLessThan(names[i].bottom);
+      expect(same([names[i].left, tags[i].left])).toBe(true);
+    }
+    expect(same(sizes.map((box) => box.right))).toBe(true);
+    const buttons = await boxes('.lm-lib-row .lm-lib-actions button');
+    for (const button of buttons) expect(button.height).toBeGreaterThanOrEqual(36);
+    const overflow = await p.evaluate(() => {
+      const body = document.getElementById('localModelWindowBody')!;
+      return body.scrollWidth - body.clientWidth;
+    });
+    expect(overflow).toBeLessThanOrEqual(0);
+  });
+
   it('paints above App Settings when it is opened from there', async () => {
     await load(1440);
     await p.evaluate(() => document.getElementById('appSettingsModal')!.classList.add('active'));

test/local-model-ui.test.ts

@@ -18,6 +18,10 @@
  *    screen, and a 409 `size-changed` shows the new total and sends that one next;
  *  - the poll: once a second while the window is open, never after it closes, and a tick that
  *    moved only the download leaves the buttons in place;
+ *  - the models on this Mac: the list with its sizes, the state of each row, "Use" (a switch
+ *    with no confirm screen), "Delete" (asked once, in the row), "Add a model" (the chooser,
+ *    where a row that is on this Mac already is switched to), the way back from a stopped job,
+ *    and what an earlier Remove left on disk;
  *  - every payload string lands as text: an `<img onerror>` in a model, agent or chip name, an
  *    error's detail, a session name, a folder or a command creates no element;
  *  - a button exists only for an action the server lists.
@@ -48,6 +52,7 @@ import type {
   LocalModelConflict,
   LocalModelErrorCode,
   LocalModelInstallView,
+  LocalModelLibraryRow,
   LocalModelMessage,
   LocalModelStatus,
   NoneReason,
@@ -383,11 +388,26 @@ function install(over: Partial<LocalModelInstallView> = {}): LocalModelInstallVi
     developerTools: 'present',
     runtime: RUNTIME_MISSING,
     folder: FOLDER,
+    library: [],
     actions: ['install'],
     ...over,
   };
 }
 
+/** The installed model as the row of the library it is: in use, checked, with nothing to do on it. */
+const QWEN_ROW: LocalModelLibraryRow = {
+  id: 'qwen3.6:35b-a3b',
+  label: 'Qwen3.6 35B-A3B',
+  context: 131072,
+  sizeBytes: 23105798956,
+  sizeGb: '23.1',
+  active: true,
+  verified: true,
+  status: 'ready',
+  actions: [],
+};
+const STORE_ONE = { bytes: 23105798956, gb: '23.1' };
+
 /** The members a job carries from `installing` on. */
 const JOB: Partial<LocalModelInstallView> = {
   model: { id: 'qwen3.6:35b-a3b', label: 'Qwen3.6 35B-A3B' },
@@ -453,7 +473,9 @@ const INSTALLED = status(
     running: true,
     endpointId: 'local-ollama',
     loaded: { context: 131072, memoryBytes: 26300000000, memoryGb: '26.3', onGpu: true },
-    actions: ['start-session', 'stop', 'remove'],
+    library: [QWEN_ROW],
+    store: STORE_ONE,
+    actions: ['start-session', 'stop', 'install', 'remove'],
   }
 );
 const STOPPED = status(
@@ -464,7 +486,9 @@ const STOPPED = status(
     running: false,
     endpointId: 'local-ollama',
     loaded: { context: 131072, memoryBytes: 26300000000, memoryGb: '26.3', onGpu: true },
-    actions: ['start', 'remove'],
+    library: [QWEN_ROW],
+    store: STORE_ONE,
+    actions: ['start', 'install', 'remove'],
   }
 );
 
@@ -1705,6 +1729,8 @@ describe('an installed model', () => {
     // row's own estimate, so the two figures are never read as a contradiction.
     expect(texts(body, '.lm-aside')).toEqual([
       'Runs with OpenCode. Context 131,072 tokens. Takes 26.3 GB of memory now, and up to about 36 GB at its peak, with all of the context in use. All of it is on the GPU.',
+      // Under the list of models: what the downloads take on disk.
+      'Downloaded models use 23.1 GB on this Mac.',
     ]);
     expect(buttons(body)).toEqual(['Remove', 'Stop', 'Start a session']);
     // One main action.
@@ -2369,3 +2395,536 @@ describe('an installed model whose runtime did not start', () => {
     expect(verbs(app)).toEqual([['POST', '/api/local-model/runtime', { action: 'start' }]]);
   });
 });
+
+// ---------- The models on this Mac ----------
+
+const GPT_ROW: LocalModelLibraryRow = {
+  id: 'gpt-oss:20b',
+  label: 'GPT-OSS 20B',
+  context: 65536,
+  sizeBytes: 13793441427,
+  sizeGb: '13.8',
+  active: false,
+  verified: true,
+  status: 'ready',
+  actions: ['use', 'delete'],
+};
+const STORE_TWO = { bytes: 36899240383, gb: '36.9' };
+
+/** Two models on this Mac, the Qwen one in use and running. */
+const TWO = status(
+  { budgetBytes: 40157944217, budgetGb: '40.2', budgetSource: 'measured' },
+  {
+    ...INSTALLED.install,
+    library: [QWEN_ROW, GPT_ROW],
+    store: STORE_TWO,
+    actions: ['start-session', 'stop', 'install', 'use', 'delete-model', 'remove'],
+  }
+);
+
+/** The buttons of the rows of the list (not the buttons of the screen), by their label. */
+const rowButtons = (page: Mounted) => texts(page.body, '.lm-lib-row .lm-lib-actions:not(.lm-lib-actions-away) button');
+
+function pressIn(page: Mounted, selector: string, label: string) {
+  const found = [...page.frame.querySelectorAll<HTMLButtonElement>(`${selector} button`)].find(
+    (el) => el.textContent === label
+  );
+  expect(found, `no button "${label}" in ${selector}`).toBeTruthy();
+  found!.click();
+}
+
+describe('the models on this Mac', () => {
+  it('lists the one installed model with its context, its state and its size on disk, and offers another', async () => {
+    const page = mount();
+    await opened(page, INSTALLED);
+    const { body } = page;
+    expect(texts(body, '.lm-lib-caption-label')).toEqual(['Models on this Mac']);
+    expect(texts(body, '.lm-lib-caption-size')).toEqual(['On disk']);
+    expect(texts(body, '.lm-lib-label')).toEqual(['Qwen3.6 35B-A3B']);
+    expect(texts(body, '.lm-lib-meta')).toEqual(['131,072 tokens']);
+    expect(texts(body, '.lm-lib-tag .lm-tag')).toEqual(['In use']);
+    expect(texts(body, '.lm-lib-size')).toEqual(['23.1 GB']);
+    // The model in use wears the selected look, and nothing can be done ON it here.
+    expect(body.querySelector('.lm-lib-row')!.classList.contains('lm-lib-row-on')).toBe(true);
+    expect(rowButtons(page)).toEqual([]);
+    expect(texts(body, '.lm-lib-foot button')).toEqual(['Add a model']);
+    // A real list for assistive technology, named by its caption.
+    const list = body.querySelector('.lm-lib-list')!;
+    expect(list.getAttribute('role')).toBe('list');
+    expect(list.getAttribute('aria-labelledby')).toBe('localModelLibraryLabel');
+    expect(body.querySelectorAll('[role="listitem"]')).toHaveLength(1);
+    // The screen scrolls from its top: it is no short screen any more.
+    expect(body.dataset.long).toBe('true');
+    // The buttons of the screen are what they were.
+    expect(buttons(body)).toEqual(['Remove', 'Stop', 'Start a session']);
+  });
+
+  it('two models: the one in use first, the other with Use and Delete, and what both take on disk', async () => {
+    const page = mount();
+    await opened(page, TWO);
+    const { body } = page;
+    expect(texts(body, '.lm-lib-label')).toEqual(['Qwen3.6 35B-A3B', 'GPT-OSS 20B']);
+    expect(texts(body, '.lm-lib-meta')).toEqual(['131,072 tokens', '65,536 tokens']);
+    expect(texts(body, '.lm-lib-tag .lm-tag')).toEqual(['In use', 'Ready']);
+    expect(texts(body, '.lm-lib-size')).toEqual(['23.1 GB', '13.8 GB']);
+    expect(rowButtons(page)).toEqual(['Use', 'Delete']);
+    // A short label on screen, the model's name for a screen reader.
+    const [use, remove] = [...body.querySelectorAll('.lm-lib-row .lm-lib-actions button')];
+    expect(use.getAttribute('aria-label')).toBe('Use GPT-OSS 20B');
+    expect(remove.getAttribute('aria-label')).toBe('Delete GPT-OSS 20B');
+    // Quiet buttons: the screen keeps its one main action, and nothing here is red yet.
+    expect(body.querySelectorAll('.lm-library .wt-btn-primary, .lm-library .wt-btn-danger')).toHaveLength(0);
+    expect(texts(body, '.lm-lib-notes .lm-aside')).toEqual(['Downloaded models use 36.9 GB on this Mac.']);
+  });
+
+  it('a row has a button only for an action the server lists for THAT row', async () => {
+    const page = mount();
+    const rows: LocalModelLibraryRow[] = [
+      QWEN_ROW,
+      { ...GPT_ROW, actions: ['use'] },
+      { ...GPT_ROW, id: 'a:1b', label: 'A', status: 'changed', actions: ['delete'] },
+      { ...GPT_ROW, id: 'b:1b', label: 'B', status: 'missing', actions: ['delete'] },
+      { ...GPT_ROW, id: 'c:1b', label: 'C', context: undefined, verified: false, status: 'unverified', actions: [] },
+      { id: 'd:1b', label: 'D', active: false, verified: false, status: 'unverified', actions: ['delete'] },
+    ];
+    await opened(page, status({}, { ...TWO.install, library: rows }));
+    const perRow = [...page.body.querySelectorAll('.lm-lib-row')].map((row) => [
+      row.querySelector('.lm-lib-label')!.textContent,
+      row.querySelector('.lm-tag')!.textContent,
+      texts(row, '.lm-lib-actions button').join('+'),
+    ]);
+    expect(perRow).toEqual([
+      ['Qwen3.6 35B-A3B', 'In use', ''],
+      ['GPT-OSS 20B', 'Ready', 'Use'],
+      ['A', 'Changed', 'Delete'],
+      ['B', 'Missing', 'Delete'],
+      ['C', 'Not checked', ''],
+      ['D', 'Not checked', 'Delete'],
+    ]);
+    // A row without a context or a size prints neither: no "undefined", no empty unit.
+    const last = [...page.body.querySelectorAll('.lm-lib-row')].at(-1)!;
+    expect(last.querySelector('.lm-lib-meta')).toBeNull();
+    expect(last.querySelector('.lm-lib-size')!.textContent).toBe('');
+    expect(page.body.textContent).not.toContain('undefined');
+    // Each state has a colour of its own.
+    expect([...page.body.querySelectorAll('.lm-lib-tag .lm-tag')].map((tag) => tag.className)).toEqual([
+      'lm-tag lm-tag-inuse',
+      'lm-tag lm-tag-ready',
+      'lm-tag lm-tag-changed',
+      'lm-tag lm-tag-missing',
+      'lm-tag lm-tag-unverified',
+      'lm-tag lm-tag-unverified',
+    ]);
+  });
+
+  it('Use switches at once: no confirm screen, and the screen says a switch is running', async () => {
+    const page = mount();
+    const switching: LocalModelInstallView = {
+      ...TWO.install,
+      state: 'installing',
+      step: 'verify',
+      steps: ['verify', 'connect'],
+      model: { id: 'gpt-oss:20b', label: 'GPT-OSS 20B' },
+      context: 65536,
+      library: [
+        { ...QWEN_ROW, active: false },
+        { ...GPT_ROW, actions: [] },
+      ],
+      actions: ['cancel'],
+    };
+    const { app } = await opened(page, TWO, () => ok(switching));
+    pressIn(page, '.lm-lib-row', 'Use');
+    await settle();
+    expect(verbs(app)).toEqual([['POST', '/api/local-model/use', { modelId: 'gpt-oss:20b' }]]);
+    expect(page.body.dataset.screen).toBe('progress');
+    expect(texts(page.body, '.lm-title')).toEqual(['Switching to GPT-OSS 20B']);
+    // Nothing is downloaded: no download bar, and the two steps of a switch.
+    expect(page.body.querySelector('.lm-meter')).toBeNull();
+    expect(texts(page.body, '.lm-step-label')).toEqual(['Loading and checking', 'Connecting']);
+    expect(texts(page.body, '.lm-aside')).toEqual([
+      'You can close this window. The switch continues while Codeman is running.',
+    ]);
+    expect(buttons(page.body)).toEqual(['Cancel']);
+  });
+
+  it('a switch that is refused keeps the screen and prints the server sentence with the session names', async () => {
+    const page = mount();
+    const { app } = await opened(page, TWO, () =>
+      conflict({
+        reason: 'sessions-open',
+        message: { text: LOCAL_MODEL_INSTALL_LABELS.conflictSessionsOpen, vars: { sessions: 'w1-app, w2-api' } },
+        sessions: ['w1-app', 'w2-api'],
+      })
+    );
+    pressIn(page, '.lm-lib-row', 'Use');
+    await settle();
+    expect(page.body.dataset.screen).toBe('installed');
+    expect(texts(page.body, '.lm-notice-text')).toEqual([
+      'Sessions are still using this model: w1-app, w2-api. Close them first.',
+    ]);
+    expect(verbs(app)).toHaveLength(1);
+    expect(rowButtons(page)).toEqual(['Use', 'Delete']);
+  });
+
+  it('Delete asks once, in the row, and sends nothing until the red button is pressed', async () => {
+    const page = mount();
+    const after: LocalModelInstallView = {
+      ...TWO.install,
+      library: [QWEN_ROW],
+      store: STORE_ONE,
+      actions: ['start-session', 'stop', 'install', 'remove'],
+    };
+    const { app } = await opened(page, TWO, () => ok(after));
+    pressIn(page, '.lm-lib-row', 'Delete');
+    await settle();
+    expect(verbs(app)).toEqual([]);
+    const ask = page.body.querySelector('.lm-lib-ask')!;
+    expect(texts(ask, '.lm-lead')).toEqual(['Delete GPT-OSS 20B from this Mac?']);
+    expect(texts(ask, '.lm-aside')).toEqual(['This frees 13.8 GB.']);
+    expect(texts(ask, 'button')).toEqual(['Cancel', 'Delete']);
+    // Red only here, in its own question.
+    expect(page.frame.querySelectorAll('.wt-btn-danger')).toHaveLength(1);
+    expect(ask.querySelector('.wt-btn-danger')!.textContent).toBe('Delete');
+    // The question sits right under the row it is about. That row's own buttons keep their
+    // room (the sizes must not jump) and are out of reach: unseen, disabled, hidden from a reader.
+    const asked = ask.previousElementSibling!;
+    expect(asked.querySelector('.lm-lib-label')!.textContent).toBe('GPT-OSS 20B');
+    expect(rowButtons(page)).toEqual([]);
+    const away = asked.querySelector('.lm-lib-actions')!;
+    expect(away.classList.contains('lm-lib-actions-away')).toBe(true);
+    expect(away.getAttribute('aria-hidden')).toBe('true');
+    expect([...away.querySelectorAll('button')].every((button) => button.disabled)).toBe(true);
+    // The focus is on the safe answer.
+    expect((page.document.activeElement as HTMLElement).textContent).toBe('Cancel');
+
+    pressIn(page, '.lm-lib-ask', 'Cancel');
+    await settle();
+    expect(page.body.querySelector('.lm-lib-ask')).toBeNull();
+    expect(rowButtons(page)).toEqual(['Use', 'Delete']);
+    expect(verbs(app)).toEqual([]);
+    // Back on the button that asked.
+    expect((page.document.activeElement as HTMLElement).dataset.lmKey).toBe('delete:gpt-oss:20b');
+
+    pressIn(page, '.lm-lib-row', 'Delete');
+    await settle();
+    pressIn(page, '.lm-lib-ask', 'Delete');
+    await settle();
+    expect(verbs(app)).toEqual([['DELETE', '/api/local-model/models', { modelId: 'gpt-oss:20b' }]]);
+    expect(texts(page.body, '.lm-lib-label')).toEqual(['Qwen3.6 35B-A3B']);
+    expect(page.body.querySelector('.lm-lib-ask')).toBeNull();
+    expect(texts(page.body, '.lm-lib-notes .lm-aside')).toEqual(['Downloaded models use 23.1 GB on this Mac.']);
+  });
+
+  it('a delete the server refuses leaves the row and prints why', async () => {
+    const page = mount();
+    await opened(page, TWO, () =>
+      conflict({
+        reason: 'model-active',
+        message: { text: LOCAL_MODEL_INSTALL_LABELS.conflictModelActive, vars: { model: 'GPT-OSS 20B' } },
+      })
+    );
+    pressIn(page, '.lm-lib-row', 'Delete');
+    await settle();
+    pressIn(page, '.lm-lib-ask', 'Delete');
+    await settle();
+    expect(texts(page.body, '.lm-notice-text')).toEqual([
+      'GPT-OSS 20B is the model in use. Switch to another model first, or remove the local model.',
+    ]);
+    expect(texts(page.body, '.lm-lib-label')).toEqual(['Qwen3.6 35B-A3B', 'GPT-OSS 20B']);
+  });
+
+  it('the Delete question of a row and the Remove question are never open together', async () => {
+    const page = mount();
+    await opened(page, TWO);
+    pressIn(page, '.lm-lib-row', 'Delete');
+    await settle();
+    expect(page.body.querySelector('.lm-lib-ask')).not.toBeNull();
+    press(page.body, 'Remove');
+    await settle();
+    expect(page.frame.querySelector('.lm-remove')).not.toBeNull();
+    expect(page.frame.querySelector('.lm-lib-ask')).toBeNull();
+  });
+
+  it('with the runtime stopped a row offers no delete, and one line says how to get it', async () => {
+    const page = mount();
+    const stopped = status(
+      {},
+      {
+        ...STOPPED.install,
+        library: [QWEN_ROW, { ...GPT_ROW, actions: ['use'] }],
+        store: STORE_TWO,
+        actions: ['start', 'install', 'use', 'remove'],
+      }
+    );
+    await opened(page, stopped);
+    expect(rowButtons(page)).toEqual(['Use']);
+    expect(texts(page.body, '.lm-lib-notes .lm-aside')).toEqual([
+      'Downloaded models use 36.9 GB on this Mac.',
+      'Press Start to delete a single model.',
+    ]);
+    // With one model there is no single model to delete, so the line is not there.
+    const one = mount();
+    await opened(one, STOPPED);
+    expect(one.body.textContent).not.toContain('Press Start to delete');
+  });
+
+  it('the screen that ends an install says one thing: no list, one button', async () => {
+    const page = mount();
+    const { app, serve } = await opened(page, INSTALLING);
+    serve(TWO);
+    await app.loadLocalModel({ force: true });
+    expect(page.body.dataset.screen).toBe('installed');
+    expect(page.body.querySelector('.lm-library')).toBeNull();
+    expect(page.body.dataset.long).toBe('false');
+    expect(buttons(page.body)).toEqual(['Start a session']);
+  });
+
+  it('"Add a model" opens the chooser on an installed model, and Back returns to it', async () => {
+    const page = mount();
+    const { app } = await opened(page, TWO);
+    pressIn(page, '.lm-lib-foot', 'Add a model');
+    await settle();
+    expect(page.body.dataset.screen).toBe('choose');
+    expect(page.body.querySelectorAll('[role="radio"]').length).toBeGreaterThan(1);
+    expect(buttons(page.body)).toEqual(['Back', 'Install on this Mac']);
+    press(page.body, 'Back');
+    await settle();
+    expect(page.body.dataset.screen).toBe('installed');
+    expect(verbs(app)).toEqual([]);
+    // No button without the server offering an install (no row fits, or it is not listed).
+    const none = mount();
+    await opened(none, status({}, { ...TWO.install, actions: ['start-session', 'stop', 'remove'] }));
+    expect(texts(none.body, '.lm-lib-foot button')).toEqual([]);
+  });
+
+  it('in the chooser a model that is on this Mac says so, and is switched to without a download', async () => {
+    const page = mount();
+    const answer = status(
+      {
+        pick: { ...PICK, library: 'active' },
+        alternatives: [{ ...ALT_SLOW, library: 'ready' }, ALT_SMALL],
+      },
+      TWO.install
+    );
+    const { app } = await opened(page, answer, () => ok({ ...TWO.install, state: 'installing', step: 'verify' }));
+    pressIn(page, '.lm-lib-foot', 'Add a model');
+    await settle();
+    const rows = [...page.body.querySelectorAll('.lm-model')];
+    const tagsOf = (row: Element) => texts(row, '.lm-tag');
+    // The model in use: its own tag beside the server's, and nothing to do with it here.
+    expect(tagsOf(rows[0])).toContain('In use');
+    const primary = () => page.frame.querySelector<HTMLButtonElement>('.lm-buttons .wt-btn-primary')!;
+    expect(primary().textContent).toBe('In use');
+    expect(primary().disabled).toBe(true);
+
+    // A model that is on this Mac and checked: one click switches to it.
+    const ready = rows.find((row) => tagsOf(row).includes('On this Mac'))!;
+    expect(ready).toBeTruthy();
+    (ready as HTMLElement).click();
+    await settle();
+    expect(primary().textContent).toBe('Use this model');
+    expect(primary().disabled).toBe(false);
+    primary().click();
+    await settle();
+    expect(verbs(app)).toEqual([['POST', '/api/local-model/use', { modelId: ALT_SLOW.modelId }]]);
+    // No confirm screen was shown on the way.
+    expect(page.body.dataset.screen).toBe('progress');
+  });
+
+  it('in the chooser a model that is not on this Mac is installed the usual way, with its sizes confirmed', async () => {
+    const page = mount();
+    const answer = status({ pick: { ...PICK, library: 'active' }, alternatives: [ALT_SMALL] }, TWO.install);
+    const { app } = await opened(page, answer, () => ok({ ...TWO.install, state: 'installing', step: 'model' }));
+    pressIn(page, '.lm-lib-foot', 'Add a model');
+    await settle();
+    const other = [...page.body.querySelectorAll<HTMLElement>('.lm-model')].find(
+      (row) => row.dataset.modelId === ALT_SMALL.modelId
+    )!;
+    other.click();
+    await settle();
+    press(page.body, 'Install on this Mac');
+    await settle();
+    expect(page.body.dataset.screen).toBe('confirm');
+    press(page.body, 'Download and install');
+    await settle();
+    expect(verbs(app)).toEqual([
+      [
+        'POST',
+        '/api/local-model/install',
+        {
+          modelId: ALT_SMALL.modelId,
+          cli: ALT_SMALL.harnesses[0].cli,
+          context: ALT_SMALL.context,
+          acknowledgedBytes: ALT_SMALL.installBytes,
+        },
+      ],
+    ]);
+  });
+
+  it('a job that stopped beside a checked model shows the way back to that model', async () => {
+    const back: LocalModelLibraryRow = { ...QWEN_ROW, active: false, actions: ['use', 'delete'] };
+    for (const first of [
+      status(
+        {},
+        { ...PAUSED.install, library: [back], actions: ['resume', 'install', 'use', 'delete-model', 'remove'] }
+      ),
+      status(
+        {},
+        {
+          ...failed('no-tool-call', { model: 'GPT-OSS 20B' }).install,
+          library: [back],
+          actions: ['resume', 'install', 'use', 'delete-model', 'remove'],
+        }
+      ),
+    ]) {
+      const page = mount();
+      const { app } = await opened(page, first, () => ok({ ...TWO.install, state: 'installing', step: 'verify' }));
+      expect(texts(page.body, '.lm-lib-label')).toEqual(['Qwen3.6 35B-A3B']);
+      expect(texts(page.body, '.lm-lib-tag .lm-tag')).toEqual(['Ready']);
+      expect(rowButtons(page)).toEqual(['Use', 'Delete']);
+      // No "Add a model" here: the job's own buttons offer another model.
+      expect(texts(page.body, '.lm-lib-foot button')).toEqual([]);
+      pressIn(page, '.lm-lib-row', 'Use');
+      await settle();
+      expect(verbs(app)).toEqual([['POST', '/api/local-model/use', { modelId: 'qwen3.6:35b-a3b' }]]);
+    }
+  });
+
+  it('a first job that stopped has nothing to go back to, and shows no list', async () => {
+    const page = mount();
+    // Its own model is on disk and checked, with nothing offered on it: Resume goes on with it.
+    await opened(page, status({}, { ...PAUSED.install, library: [{ ...QWEN_ROW, active: false }] }));
+    expect(page.body.querySelector('.lm-library')).toBeNull();
+    expect(page.body.dataset.long).toBe('false');
+    const stopped = mount();
+    await opened(stopped, failed('load-failed', { model: 'Qwen3.6 35B-A3B' }));
+    expect(stopped.body.querySelector('.lm-library')).toBeNull();
+  });
+
+  it('a paused switch says so, and waits', async () => {
+    const page = mount();
+    await opened(
+      page,
+      status({}, { ...PAUSED.install, step: 'verify', steps: ['verify', 'connect'], progress: undefined })
+    );
+    expect(texts(page.body, '.lm-title')).toEqual(['The switch to Qwen3.6 35B-A3B is paused']);
+    expect(texts(page.body, '.lm-aside')).toEqual(['The switch waits until you continue.']);
+    expect(page.body.querySelector('.lm-meter')).toBeNull();
+  });
+
+  it('the App Settings row names a switch as a switch', async () => {
+    const page = mount();
+    const job = { ...JOB, steps: ['verify', 'connect'] as LocalModelInstallView['steps'], step: 'verify' as const };
+    for (const [state, text] of [
+      ['installing', 'Switching to Qwen3.6 35B-A3B'],
+      ['paused', 'The switch to Qwen3.6 35B-A3B is paused'],
+      ['failed', 'The switch to Qwen3.6 35B-A3B stopped'],
+    ] as const) {
+      const app = page.newApp(ok(status({}, { ...job, state, actions: [] })));
+      await app.loadLocalModel({ force: true });
+      expect(texts(page.row, '.set-row-label')).toEqual([text]);
+    }
+  });
+});
+
+describe('what an earlier Remove left on disk', () => {
+  const LEFT = status({}, { store: STORE_ONE, actions: ['install', 'remove'] });
+
+  it('the chooser says what the downloads still take, and deletes them after one question', async () => {
+    const page = mount();
+    const { app } = await opened(page, LEFT, () => ok(install({ store: { bytes: 0, gb: '0.0' } })));
+    expect(texts(page.body, '.lm-leftovers .lm-aside')).toEqual([
+      'Models from an earlier install still use 23.1 GB on this Mac.',
+    ]);
+    pressIn(page, '.lm-leftovers', 'Delete them');
+    await settle();
+    expect(verbs(app)).toEqual([]);
+    expect(texts(page.body, '.lm-leftovers .lm-lead')).toEqual(['Delete the downloaded models from this Mac?']);
+    expect(texts(page.body, '.lm-leftovers .lm-lib-ask .lm-aside')).toEqual(['This frees 23.1 GB.']);
+    expect(page.body.querySelector('.lm-leftovers .wt-btn-danger')!.textContent).toBe('Delete');
+    pressIn(page, '.lm-leftovers', 'Cancel');
+    await settle();
+    expect(texts(page.body, '.lm-leftovers button')).toEqual(['Delete them']);
+    pressIn(page, '.lm-leftovers', 'Delete them');
+    await settle();
+    pressIn(page, '.lm-leftovers', 'Delete');
+    await settle();
+    expect(verbs(app)).toEqual([['DELETE', '/api/local-model', { removeModel: true }]]);
+    expect(page.body.querySelector('.lm-leftovers')).toBeNull();
+    // Still the chooser: installing is what this screen is for.
+    expect(page.body.dataset.screen).toBe('choose');
+    expect(buttons(page.body)).toEqual(['Install on this Mac']);
+  });
+
+  it('is not there without something on disk, or without the server offering the removal', async () => {
+    for (const first of [
+      IDLE,
+      status({}, { store: { bytes: 0, gb: '0.0' }, actions: ['install', 'remove'] }),
+      status({}, { store: STORE_ONE, actions: ['install'] }),
+    ]) {
+      const page = mount();
+      await opened(page, first);
+      expect(page.body.querySelector('.lm-leftovers')).toBeNull();
+    }
+  });
+
+  it('shows on a Mac no model fits too: the space can still be freed', async () => {
+    const page = mount();
+    const answer = none('memory');
+    await opened(page, { ...answer, install: install({ store: STORE_ONE, actions: ['remove'] }) });
+    expect(page.body.dataset.screen).toBe('none');
+    expect(texts(page.body, '.lm-leftovers .lm-aside')).toEqual([
+      'Models from an earlier install still use 23.1 GB on this Mac.',
+    ]);
+  });
+});
+
+describe('the models on this Mac: text of someone else, another language, an unchanged answer', () => {
+  it('a model name is text, in the row, in its question and in the labels of its buttons', async () => {
+    const HOSTILE = '<img src=x onerror="window.__pwned=1">';
+    const page = mount();
+    const rows: LocalModelLibraryRow[] = [QWEN_ROW, { ...GPT_ROW, id: `evil:1b`, label: `Model ${HOSTILE}` }];
+    await opened(page, status({}, { ...TWO.install, library: rows, folder: `/tmp/${HOSTILE}` }));
+    pressIn(page, '.lm-lib-row', 'Delete');
+    await settle();
+    expect(page.document.querySelectorAll('img, script, iframe')).toHaveLength(0);
+    expect((page.win as unknown as { __pwned?: number }).__pwned).toBeUndefined();
+    expect(texts(page.body, '.lm-lib-ask .lm-lead')).toEqual([`Delete Model ${HOSTILE} from this Mac?`]);
+  });
+
+  it('is translated when the language changes, the names staying as sent', async () => {
+    const page = mount({ i18n: true });
+    page.win.CodemanI18n.start();
+    await opened(page, TWO);
+    page.win.CodemanI18n.configure({ language: 'zh-CN' });
+    await settle();
+    expect(texts(page.body, '.lm-lib-caption-label')).toEqual(['此 Mac 上的模型']);
+    expect(texts(page.body, '.lm-lib-tag .lm-tag')).toEqual(['使用中', '就绪']);
+    expect(rowButtons(page)).toEqual(['使用', '删除']);
+    expect(texts(page.body, '.lm-lib-label')).toEqual(['Qwen3.6 35B-A3B', 'GPT-OSS 20B']);
+    expect(texts(page.body, '.lm-lib-notes .lm-aside')).toEqual(['已下载的模型在此 Mac 上占用 36.9 GB。']);
+    expect(texts(page.body, '.lm-lib-foot button')).toEqual(['添加模型']);
+  });
+
+  it('a poll that changes nothing leaves the rows and their buttons in place', async () => {
+    const page = mount();
+    await opened(page, TWO);
+    const before = page.body.querySelector('.lm-lib-row .lm-lib-actions button');
+    await page.tick();
+    await page.tick();
+    expect(page.body.querySelector('.lm-lib-row .lm-lib-actions button')).toBe(before);
+  });
+
+  it('the focus stays on the row button it was on when the list is repainted', async () => {
+    const page = mount();
+    const { app, serve } = await opened(page, TWO);
+    const remove = [...page.body.querySelectorAll<HTMLButtonElement>('.lm-lib-row .lm-lib-actions button')][1];
+    remove.focus();
+    serve(status({}, { ...TWO.install, store: { bytes: 36899240384, gb: '36.9' }, port: 11436 }));
+    await app.loadLocalModel({ force: true });
+    const active = page.document.activeElement as HTMLElement;
+    expect(active.textContent).toBe('Delete');
+    expect(active.dataset.lmKey).toBe('delete:gpt-oss:20b');
+    expect(active).not.toBe(remove);
+  });
+});

test/routes/local-model-routes.test.ts

@@ -155,6 +155,7 @@ const IDLE_VIEW: LocalModelInstallView = {
   developerTools: 'missing',
   runtime: { version: '0.40.15', installed: false, downloadBytes: 185971671, downloadGb: '0.2', unpackedGb: '0.6' },
   folder: '/Users/me/.codeman/local-model',
+  library: [],
   actions: ['install'],
 };
 
@@ -182,6 +183,8 @@ function fakeService(): ServiceMock {
     launchRefusalMessage: vi.fn(async () => undefined),
     recommendOptions: vi.fn(async () => ({ runtimeDownloadBytes: 185971671 })),
     install: vi.fn(async () => OK_RESULT),
+    use: vi.fn(async () => OK_RESULT),
+    deleteLibraryModel: vi.fn(async () => OK_RESULT),
     cancel: vi.fn(async () => OK_RESULT),
     resume: vi.fn(async () => OK_RESULT),
     runtime: vi.fn(async () => OK_RESULT),
@@ -555,6 +558,13 @@ describe('the install verbs', () => {
   /** Every verb as a request, with a body the route accepts. */
   const VERBS = [
     { name: 'install', method: 'POST', url: '/api/local-model/install', payload: INSTALL_BODY },
+    { name: 'use', method: 'POST', url: '/api/local-model/use', payload: { modelId: 'qwen3.8:27b' } },
+    {
+      name: 'deleteLibraryModel',
+      method: 'DELETE',
+      url: '/api/local-model/models',
+      payload: { modelId: 'qwen3.8:27b' },
+    },
     { name: 'cancel', method: 'POST', url: '/api/local-model/cancel', payload: undefined },
     { name: 'resume', method: 'POST', url: '/api/local-model/resume', payload: {} },
     { name: 'runtime', method: 'POST', url: '/api/local-model/runtime', payload: { action: 'stop' } },
@@ -654,7 +664,18 @@ describe('the install verbs', () => {
       const f = fakes();
       const { app } = await harness(f.deps, { username: 'alice', role: 'admin' });
       await app.inject({ method: 'POST', url: '/api/local-model/install', payload: INSTALL_BODY });
-      expect(f.service.install).toHaveBeenCalledWith(INSTALL_BODY, { username: 'alice', ip: '127.0.0.1' });
+      expect(f.service.install).toHaveBeenCalledWith(INSTALL_BODY, { username: 'alice', ip: '127.0.0.1' }, []);
+    });
+
+    it('hands the service the names of the live sessions on the model: another model would take the runtime from them', async () => {
+      const f = fakes();
+      const { app } = await harness(f.deps, undefined, [
+        { name: 'w1-app', customModel: { endpointId: 'local-ollama' } },
+        { name: 'w2-app' },
+        { name: 'w3-lib', customModel: { endpointId: 'office-gpu' } },
+      ]);
+      await app.inject({ method: 'POST', url: '/api/local-model/install', payload: INSTALL_BODY });
+      expect(f.service.install.mock.calls[0][2]).toEqual(['w1-app']);
     });
 
     it('a row the server does not offer is a 400 with the service own sentence, as text and as data', async () => {
@@ -925,6 +946,177 @@ describe('the install verbs', () => {
   });
 });
 
+describe('the library verbs', () => {
+  const SESSIONS: SessionLike[] = [
+    { name: 'w1-app', customModel: { endpointId: 'local-ollama' } },
+    { name: 'w2-app' },
+    { name: 'w3-lib', customModel: { endpointId: 'office-gpu' } },
+  ];
+
+  describe('POST /api/local-model/use', () => {
+    it('hands the service the model, who asked and the live sessions on the model', async () => {
+      const f = fakes();
+      const { app } = await harness(f.deps, { username: 'alice', role: 'admin' }, SESSIONS);
+      await app.inject({ method: 'POST', url: '/api/local-model/use', payload: { modelId: 'gpt-oss:20b' } });
+      expect(f.service.use).toHaveBeenCalledWith({ modelId: 'gpt-oss:20b' }, { username: 'alice', ip: '127.0.0.1' }, [
+        'w1-app',
+      ]);
+    });
+
+    it('a model that is not one of the checked ones is a 400 with the sentence, as text and as data', async () => {
+      const f = fakes();
+      f.service.use.mockResolvedValue({
+        ok: false,
+        status: 400,
+        message: { text: LOCAL_MODEL_INSTALL_LABELS.refusedNotInLibrary },
+      });
+      const { app } = await harness(f.deps);
+      const res = await app.inject({ method: 'POST', url: '/api/local-model/use', payload: { modelId: 'x:1b' } });
+      expect(res.statusCode).toBe(400);
+      expect(res.json()).toEqual({
+        success: false,
+        error: 'This model is not one of the checked models on this Mac.',
+        errorCode: 'INVALID_INPUT',
+        data: { message: { text: 'This model is not one of the checked models on this Mac.' } },
+      });
+    });
+
+    it.each([
+      ['no body', undefined],
+      ['no model', {}],
+      ['a path', { modelId: '../../etc/passwd' }],
+      ['another registry', { modelId: 'hf.co/someone/model:Q4' }],
+      ['a member it does not know', { modelId: 'gpt-oss:20b', context: 65536 }],
+    ])('refuses %s before the service is asked', async (_name, payload) => {
+      const f = fakes();
+      const { app } = await harness(f.deps);
+      const res = await app.inject({ method: 'POST', url: '/api/local-model/use', ...(payload ? { payload } : {}) });
+      expect(res.statusCode).toBe(400);
+      expect(f.service.use).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('DELETE /api/local-model/models', () => {
+    it('hands the service the model name and who asked', async () => {
+      const f = fakes();
+      const { app } = await harness(f.deps, { username: 'alice', role: 'admin' });
+      await app.inject({ method: 'DELETE', url: '/api/local-model/models', payload: { modelId: 'gpt-oss:20b' } });
+      expect(f.service.deleteLibraryModel).toHaveBeenCalledWith(
+        { modelId: 'gpt-oss:20b' },
+        { username: 'alice', ip: '127.0.0.1' }
+      );
+      // The whole installation is another route: it was not asked.
+      expect(f.service.remove).not.toHaveBeenCalled();
+    });
+
+    it.each([
+      ['no body', undefined],
+      ['a path', { modelId: '/Users/me/.codeman/local-model/models' }],
+      ['a path that climbs', { modelId: '../../etc/passwd' }],
+      ['a name with a slash', { modelId: 'library/qwen3.8:27b' }],
+      ['a name without a tag', { modelId: 'qwen3.8' }],
+      ['a path member', { modelId: 'gpt-oss:20b', path: '/' }],
+    ])('takes a model name and nothing else: refuses %s', async (_name, payload) => {
+      const f = fakes();
+      const { app } = await harness(f.deps);
+      const res = await app.inject({
+        method: 'DELETE',
+        url: '/api/local-model/models',
+        ...(payload ? { payload } : {}),
+      });
+      expect(res.statusCode).toBe(400);
+      expect(f.service.deleteLibraryModel).not.toHaveBeenCalled();
+    });
+
+    it('the model in use: 409 with the reason and the sentence', async () => {
+      const f = fakes();
+      f.service.deleteLibraryModel.mockResolvedValue({
+        ok: false,
+        status: 409,
+        conflict: {
+          reason: 'model-active',
+          message: { text: LOCAL_MODEL_INSTALL_LABELS.conflictModelActive, vars: { model: 'Qwen3.8 27B' } },
+        },
+      });
+      const { app } = await harness(f.deps);
+      const res = await app.inject({
+        method: 'DELETE',
+        url: '/api/local-model/models',
+        payload: { modelId: 'qwen3.8:27b' },
+      });
+      expect(res.statusCode).toBe(409);
+      expect(res.json()).toEqual({
+        success: false,
+        error: 'Qwen3.8 27B is the model in use. Switch to another model first, or remove the local model.',
+        errorCode: 'CONFLICT',
+        data: {
+          reason: 'model-active',
+          message: {
+            text: '{model} is the model in use. Switch to another model first, or remove the local model.',
+            vars: { model: 'Qwen3.8 27B' },
+          },
+        },
+      });
+    });
+
+    it('a runtime that did not delete it: 500 with the sentence, as text and as data', async () => {
+      const f = fakes();
+      f.service.deleteLibraryModel.mockResolvedValue({
+        ok: false,
+        status: 500,
+        message: { text: LOCAL_MODEL_INSTALL_LABELS.deleteFailed, vars: { model: 'GPT-OSS 20B' } },
+      });
+      const { app } = await harness(f.deps);
+      const res = await app.inject({
+        method: 'DELETE',
+        url: '/api/local-model/models',
+        payload: { modelId: 'gpt-oss:20b' },
+      });
+      expect(res.statusCode).toBe(500);
+      expect(res.json()).toEqual({
+        success: false,
+        error: 'GPT-OSS 20B could not be deleted from this Mac.',
+        errorCode: 'OPERATION_FAILED',
+        data: { message: { text: '{model} could not be deleted from this Mac.', vars: { model: 'GPT-OSS 20B' } } },
+      });
+    });
+  });
+
+  describe('GET /api/local-model marks the rows that are already on this Mac', () => {
+    it('the model in use and a model a switch can take, at the context they were checked with', async () => {
+      const second = { ...OK.pick!, modelId: 'gpt-oss:20b', modelLabel: 'GPT-OSS 20B', context: 65536 };
+      const third = { ...OK.pick!, modelId: 'mimo-v2.6:9b-q4_k_m', modelLabel: 'MiMo V2.6 9B' };
+      const f = fakes(MAC, { ...OK, alternatives: [second, third] });
+      const row = (id: string, context: number, active: boolean) => ({
+        id,
+        label: id,
+        context,
+        active,
+        verified: true,
+        status: 'ready' as const,
+        actions: active ? [] : ['use' as const],
+      });
+      f.service.view.mockResolvedValue({
+        ...IDLE_VIEW,
+        state: 'installed',
+        library: [row(OK.pick!.modelId, OK.pick!.context, true), row('gpt-oss:20b', 65536, false)],
+        actions: ['start-session', 'stop', 'install', 'use', 'remove'],
+      });
+      const data = (await get(f.deps)).json().data;
+      expect(data.recommendation.pick.library).toBe('active');
+      expect(data.recommendation.alternatives[0].library).toBe('ready');
+      expect(data.recommendation.alternatives[1]).not.toHaveProperty('library');
+      // What recommend() answered is not written to.
+      expect(OK.pick).not.toHaveProperty('library');
+    });
+
+    it('with nothing on this Mac no row carries the mark', async () => {
+      const data = (await get(fakes().deps)).json().data;
+      expect(data.recommendation.pick).not.toHaveProperty('library');
+    });
+  });
+});
+
 describe('the routes over the real install service', () => {
   const STATE = () => dataPath('local-model.json');