Three things asked for, plus the plumbing they needed.

OPENING A CHAT LANDS AT THE BOTTOM. It used to open at the top of the transcript
and leave you scrolling to reach the newest message. It jumps rather than
animates, so a long history does not scroll past before settling.

MODEL AND EFFORT NOW STICK. The composer's pick was held only in widget state,
so it was lost on the next rebuild and every following message silently reverted
to Auto. A choice now writes through to the chat itself and survives leaving the
screen and restarting the app.

AUTO ACTUALLY CHOOSES, AND SAYS WHY. Auto used to mean "send no flag". It now
routes per message from the prompt, and every message shows the model, the
effort, and the reason — "opus · xhigh · auto: complex task". That visibility is
the point: routing nobody can see is routing nobody can correct, and the
thresholds are meant to be tuned against real use.

  What is this repo about              -> fable · low     (lookup)
  add a null check to line 42          -> sonnet · medium (code change)
  Refactor billing, migrate the schema -> opus · xhigh    (complex task)

Bias is toward the cheaper option: under-serving a hard prompt costs one visible
retry, over-serving every trivial one quietly burns the subscription all day.

CAPROVER TAB. See what is deployed, what it deploys from, redeploy, repoint an
app at a different repo/branch, and read the build log — without leaving the
phone. Deliberately scoped:

- The phone never holds the CapRover password. It authenticates to DevPilot,
  which holds that credential server-side, so a lost device is a token change
  here rather than a password rotation across everything.
- Env var VALUES never leave the server — the app shows which keys exist, not
  what they hold. Those are database passwords and API keys for 54 apps.
- Creating and deleting apps are not exposed at all. Irreversible actions
  against live client deployments belong at a desk, not one mis-tap away.
- Redeploy is confirmed, because it restarts a live service and you are by
  definition not at a desk when you press it.
- Changing the deploy source reads the whole app definition and sends it back
  with only the repo altered: CapRover's update endpoint replaces the object, so
  a partial body silently drops volumes and env vars.

Verified against the real CapRover: 54 apps enumerated with versions, images and
git sources.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>