feat: add optional Pro model version selection in Settings

[JulianZJN]

Summary

Add an optional Settings → Automated Pro model selector: Follow ChatGPT (unchanged default), GPT-5.6 Sol Pro, GPT-5.5 Pro, or GPT-6 Astra Pro.

The existing chatgpt-web/pro route selects the Pro effort but does not pin the underlying model version. This lets users keep Pro reasoning while explicitly choosing an available family.

Related to the explicit model-version selection roadmap in Discussion #309.

Behavior and boundaries

• Persist an optional, strictly validated proModelVersion in the canonical profile config. Follow removes it; existing profiles need no migration.
• Save through a launcher-authorized, idle-checked config-only command. The next automatic Pro request snapshots the setting; no setup transaction, route rewrite, service restart, or tunnel restart is involved.
• Select the exact model first, then Pro effort. Preserve the selected family during lower-effort multipart preparation and verify version/effort again immediately before each send.
• Fail before sending the pending prompt if the version cannot be verified. GPT-6 uses ChatGPT's Latest option only if its live control identifies version 6; a future Latest version cannot silently replace it.
• Keep native passthrough, non-Pro retained-chat identity, manual Zero Risk selection, context limits, and the local-tool/MCP capability contract unchanged. Different Pro pins have separate retained-chat identities.
• Add English, Chinese, and Japanese settings copy and documentation. Busy Pro controls do not disable the existing cancel-turn action.

Selector follow-up — 2026-09-14

Updated in a6918af:

• Reuse only a unique, exact, explicitly checked family row inside the composer-owned menu. Latest rendering 5.6 at lower effort does not prove an explicit 5.6 pin.
• Expand a collapsed model trigger before clicking: its advanced rows can have visible geometry while still being inert. Keep normal Playwright actionability checks; no force-click or global-menu fallback.
• Allow up to one second of read-only settling for checked state and spoken family/effort after changing controls. Immediate pre-send verification remains strict; no accepted-prompt retry or compaction-timeout extension.
• Tighten spoken-state parsing so unrelated Pro instructions, unknown family variants, or contradictory model states cannot authorize a send.

Current branch validation

• bun test ./tests: 768 passed, 5 skipped, 0 failed.
• Selector/model-contract targeted tests: 60 passed, 0 failed.
• Root TypeScript check, runtime bundle build, and relocatable runtime smoke passed.
• Offline Chromium DOM regression: 2 passed, 0 failed on each standalone branch. The test uses a new unauthenticated context, blocks network requests, and is explicitly opt-in via CHATGPT_PICKER_TEST_CHROME.
• No paid ChatGPT prompt, GPT-6 Pro call, launcher replacement, or installed-profile change was made during this follow-up. Launcher packaging and a full authenticated end-to-end run of these standalone branches were not repeated.

Separate earlier installed evidence comes from a local-enhanced integration: an actual 5.6 selector-only probe changed from a five-second intercepted-click failure to success in 2.16 seconds without submitting a prompt; after that installation an ordinary task passed selection and reached submission acceptance. This is not evidence that its entire task completed or that all model versions were live-tested.

The new GitHub CI run still stops at the unchanged root dependency audit: Hono 4.12.34 has three moderate advisories (fixed upstream in 4.13.5). This is separate from the selector tests above. No aggregate bun run verify or cross-platform packaging success is claimed.

Earlier feature validation (before this selector follow-up)

• Root tests: 729 passed, 1 platform skip, 0 failed.
• Launcher tests: 302 passed, 1 platform skip, 0 failed.
• Root/launcher typechecks and renderer build passed.
• Version alignment, relocatable runtime bundle, third-party-notice generation, and release smoke passed.
• Live working-tree DEV, macOS, Chinese ChatGPT UI: selected GPT-5.6 Sol Pro through Settings, verified persistence, selected and verified 5.6 Pro through the real browser worker, sent one browser-only request, and received PRO56_OK (escaped underscore in Markdown transport).
• Initial preflight failures exposed that the hidden numeric slider has no aria-valuetext: the actual version is in its keyboard menuitem's aria-describedby targets. Fixed from observed DOM and added a sanitized fixture plus regression tests. Those failed preflights did not submit prompts.
• No live GPT-5.5 or GPT-6 prompt was sent. Those branches have local regression coverage only. Other ChatGPT UI locales and installed full-harness execution were not live-tested; this patch does not change MCP/local-tool execution.

bun run verify was attempted but stops at pre-existing dependency advisories: root Hono 4.12.34 (three moderate advisories). Running the remaining stages separately also reports the existing launcher js-yaml 4.3.1 high advisory. Dependency changes are intentionally left to #415; no lockfiles or dependencies are changed here.

Sanitized DOM evidence, reproduction command, and live-test boundaries: docs/pro-model-selection.md. No browser state, account information, raw logs, or credentials are included.

[JulianZJN]

Updated this existing PR in a6918af with the installed selector repair, adapted to this branch's own API.

The fix distinguishes an explicitly checked family from Latest's rendered low-effort model, expands collapsed inert model rows before an actionable click, and bounds post-change state settling to one second. Pre-send model/effort checks still fail closed; no force-click, model fallback, accepted-prompt resend, or longer compaction budget was added.

Validation on this branch: 768 root tests passed, 5 skipped, 0 failed; 60 selector/model-contract tests passed; 2 offline real-Chromium DOM tests passed; TypeScript, runtime build, and relocatable smoke passed. The opt-in DOM reproduction and evidence boundaries are documented in the PR.

The earlier live success was on the local-enhanced integration, not a new paid end-to-end run of this standalone branch. No paid prompts or installed app/profile changes were made in this update. I also refreshed the PR description to separate current verification from earlier feature testing. New GitHub CI results remain separate from these local checks.