feat: store workspace preferences and drafts locally

frontend/src/shell/SteerInput.test.tsx

@@ -125,6 +125,10 @@ test("footer shows cumulative k-token counters after workspace and context gauge
       workspace: "psd", provider: "zai", model: "glm-5.2", thinking: "medium",
     })),
     http.get("http://localhost:8787/workspaces", () => HttpResponse.json([{ name: "psd" }])),
+    http.get("http://localhost:8787/workspaces/psd", () => HttpResponse.json({
+      workspace: { llm_policy: { allowed: ["zai/glm-5.2"] } },
+      revision: { id: "psd", commit: "a".repeat(40), blob: "b".repeat(40), snapshotPath: "/snapshot", state: "operational" },
+    })),
     http.get("http://localhost:8787/models", () => HttpResponse.json({
       models: [{ provider: "zai", id: "glm-5.2", name: "GLM-5.2", reasoning: true }],
     })),
@@ -151,6 +155,32 @@ test("footer shows cumulative k-token counters after workspace and context gauge
   expect(thinking.compareDocumentPosition(gauge) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy();
 });
 
+test("footer limits model choices to the selected workspace policy", async () => {
+  server.use(
+    http.get("http://localhost:8787/settings", () => HttpResponse.json({
+      workspace: "psd-clinical", provider: "zai", model: "glm-5.2", thinking: "medium",
+    })),
+    http.get("http://localhost:8787/workspaces", () => HttpResponse.json([{
+      id: "psd-clinical", name: "psd-clinical", file: "psd-clinical.yaml", displayName: "PSD Clinical",
+      revision: { id: "psd-clinical", commit: "a".repeat(40), blob: "b".repeat(40), snapshotPath: "/snapshot", state: "operational" },
+    }])),
+    http.get("http://localhost:8787/workspaces/psd-clinical", () => HttpResponse.json({
+      workspace: { llm_policy: { allowed: ["zai/glm-5.2"] } },
+      revision: { id: "psd-clinical", commit: "a".repeat(40), blob: "b".repeat(40), snapshotPath: "/snapshot", state: "operational" },
+    })),
+    http.get("http://localhost:8787/models", () => HttpResponse.json({ models: [
+      { provider: "zai", id: "glm-5.2", name: "GLM-5.2", reasoning: true },
+      { provider: "deepseek", id: "deepseek-v4-pro", name: "DeepSeek V4 Pro", reasoning: true },
+    ] })),
+  );
+  const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  render(<QueryClientProvider client={client}><ComposerFooter /></QueryClientProvider>);
+
+  const selector = await screen.findByRole("combobox", { name: "Model" });
+  await waitFor(() => expect(selector).toHaveTextContent("GLM-5.2"));
+  await waitFor(() => expect(selector).not.toHaveTextContent("DeepSeek V4 Pro"));
+});
+
 test("pulses the stop dot only while the harness is working", () => {
   const { rerender } = render(<SteerInput sessionId="s1" working />);
   const dot = () =>

frontend/src/shell/SteerInput.tsx

@@ -5,10 +5,10 @@ import { useQuery } from "@tanstack/react-query";
 import { postSteer, createSession } from "../api/sessions";
 import { ApiError } from "../api/client";
 import { getSettings } from "../api/settings";
-import { listWorkspaces } from "../api/workspaces";
+import { getWorkspace, listWorkspaces } from "../api/workspaces";
 import { listModels } from "../api/models";
 import { useSessionStore } from "../store/sessionStore";
-import { workspacePreferences, type WorkspacePreference } from "../workspaces/preferences";
+import { workspacePreferences, type WorkspacePreference } from "../workspaces/drafts";
 
 const THINKING_LEVELS = ["low", "medium", "high"] as const;
 
@@ -84,7 +84,7 @@ export function SteerInput({
     setLastUserEntry({ kind: "input", text: trimmed });
     onSessionCreating?.(trimmed);
     try {
-      const { id } = await createSession({ question: trimmed });
+      const { id } = await createSession({ question: trimmed, ...workspacePreferences.load() });
       onSessionCreated?.(id);
       setText("");
     } catch (error) {
@@ -173,20 +173,33 @@ export function ComposerFooter() {
   }, [settings]);
 
   const workspace = preferences.workspaceId ?? settings?.workspace ?? "";
+  const selectedWorkspace = workspaces.find((candidate) => candidate.id === workspace);
+  const { data: workspaceRecord } = useQuery({
+    queryKey: ["workspace", workspace],
+    queryFn: () => getWorkspace(workspace),
+    // Legacy metadata responses do not carry a registry revision, so retain the
+    // existing selector behavior without issuing an incompatible detail request.
+    enabled: Boolean(selectedWorkspace?.revision),
+  });
   const model = preferences.model ?? settings?.model ?? "";
   const thinking = preferences.thinking ?? settings?.thinking ?? "medium";
 
+  const allowedModels = workspaceRecord?.workspace.llm_policy.allowed;
+  const policyModels = allowedModels
+    ? models.filter((candidate) => allowedModels.includes(`${candidate.provider}/${candidate.id}`))
+    : models;
+
   function update(patch: WorkspacePreference) {
     const next = workspacePreferences.save({ ...preferences, ...patch });
     setPreferences(next);
   }
 
   function onModelChange(id: string) {
-    const m = models.find((x) => x.id === id);
+    const m = policyModels.find((x) => x.id === id);
     update({ model: id, provider: m?.provider });
   }
 
-  const knownModel = models.some((m) => m.id === model);
+  const knownModel = policyModels.some((m) => m.id === model);
   const contextPct = tokenUsage && tokenUsage.contextWindow > 0
     ? tokenUsage.totalTokens / tokenUsage.contextWindow
     : 0;
@@ -215,12 +228,12 @@ export function ComposerFooter() {
 
       <div className="flex items-center gap-2">
         <FooterSelect aria-label="Model" value={model} onChange={onModelChange}>
-          {models.length === 0 ? (
+          {policyModels.length === 0 ? (
             <option value={model}>{model || "— model —"}</option>
           ) : (
             <>
               {!knownModel && <option value={model}>{model || "— model —"}</option>}
-              {models.map((m) => (
+              {policyModels.map((m) => (
                 <option key={`${m.provider}/${m.id}`} value={m.id}>
                   {m.name}
                 </option>