@crvouga/dev-fleet 0.1.0 → 0.3.0

package/src/accounts/roster.ts

@@ -0,0 +1,85 @@
+import { createHash } from 'node:crypto';
+import type { Account } from '../agents/accounts';
+
+/** Provider accounts exist only as the CLI proxy's credential files. Every
+ * node and IDE gets a view derived from them; nothing on a node holds a
+ * provider login. See docs/accounts.md.
+ */
+export type AccountState =
+  'usable' | 'cooling-down' | 'needs-login' | 'refresh-failing' | 'removed';
+
+const STATES: AccountState[] = [
+  'usable',
+  'cooling-down',
+  'needs-login',
+  'refresh-failing',
+  'removed',
+];
+
+/** One account as the manager reports it. `index` is opaque: the position of
+ * the account among its provider's, the only way checks name it.
+ */
+export interface RosterAccount {
+  provider: string;
+  index: number;
+  label: string;
+  /** The routing prefix every node offers it under; null if not routed. */
+  prefix: string | null;
+  state: AccountState;
+  /** While cooling down: when it clears (ISO 8601), when known. */
+  until: string | null;
+}
+
+/** What `devfleet cliproxy accounts --json` prints on the manager. */
+export interface ProxyRoster {
+  version: 1;
+  rosterVersion: string;
+  /** Whether the proxy's management API answered: without it, cooldowns and
+   * refresh failures are not known.
+   */
+  managementApi: boolean;
+  accounts: RosterAccount[];
+}
+
+export function parseRoster(text: string): ProxyRoster {
+  const value = JSON.parse(text) as Partial<ProxyRoster>;
+  if (
+    value.version !== 1 ||
+    typeof value.rosterVersion !== 'string' ||
+    !Array.isArray(value.accounts) ||
+    !value.accounts.every(
+      (account) =>
+        typeof account.provider === 'string' &&
+        Number.isInteger(account.index) &&
+        typeof account.label === 'string' &&
+        STATES.includes(account.state)
+    )
+  )
+    throw new Error('The proxy reported an unreadable account roster.');
+  return {
+    version: 1,
+    rosterVersion: value.rosterVersion,
+    managementApi: value.managementApi === true,
+    accounts: value.accounts.map((account) => ({
+      ...account,
+      prefix: account.prefix ?? null,
+      until: account.until ?? null,
+    })),
+  };
+}
+
+/** The roster version: a digest of the routing prefixes of the accounts
+ * every node offers. The manager computes it from the credential files
+ * (cliproxy/scripts/accounts.py) and every node from the proxy's model list;
+ * the two agree exactly when the node offers what the proxy holds.
+ */
+export function rosterVersion(prefixes: Iterable<string>): string {
+  return createHash('sha256')
+    .update([...new Set(prefixes)].sort().join('\n'))
+    .digest('hex')
+    .slice(0, 16);
+}
+
+/** The version of the accounts a node reads from the proxy's model list. */
+export const liveVersion = (accounts: Account[]): string =>
+  rosterVersion(accounts.map((account) => account.prefix));

package/src/accounts/selection.ts

@@ -0,0 +1,67 @@
+import type { AccountSelection } from '../definition';
+
+/** Which account an unpinned request goes to first, per the policy the fleet
+ * declares for the provider. The order is deterministic: the accounts the
+ * policy names, in its order, then the others in the order of their routing
+ * prefix. Accounts cooling down are skipped while any other is left.
+ */
+export class AccountSelector {
+  private readonly cooling = new Map<string, number>();
+  private readonly limitedAt = new Map<string, number>();
+  private turn = 0;
+  readonly order: string[];
+
+  constructor(
+    prefixes: string[],
+    private readonly policy: AccountSelection,
+    private readonly now: () => number = Date.now
+  ) {
+    const label = (prefix: string) => prefix.slice(prefix.indexOf('-') + 1);
+    const named = policy.order ?? [];
+    const rank = (prefix: string) => {
+      const position = named.indexOf(label(prefix));
+      return position < 0 ? named.length : position;
+    };
+    this.order = [...new Set(prefixes)].sort(
+      (a, b) => rank(a) - rank(b) || a.localeCompare(b)
+    );
+  }
+
+  /** The accounts to try for the next request, in order. */
+  candidates(): string[] {
+    const now = this.now();
+    let order = [...this.order];
+    if (this.policy.strategy === 'round-robin' && order.length) {
+      const start = this.turn++ % order.length;
+      order = [...order.slice(start), ...order.slice(0, start)];
+    }
+    if (this.policy.strategy === 'least-recently-limited')
+      order.sort(
+        (a, b) => (this.limitedAt.get(a) ?? 0) - (this.limitedAt.get(b) ?? 0)
+      );
+    return order.filter((prefix) => (this.cooling.get(prefix) ?? 0) <= now);
+  }
+
+  /** The provider limited this account; `seconds` from its Retry-After. */
+  limited(prefix: string, seconds = 60): void {
+    const now = this.now();
+    this.limitedAt.set(prefix, now);
+    this.cooling.set(prefix, now + seconds * 1000);
+  }
+
+  /** When this account's cooldown clears, if it is cooling down. */
+  coolingUntil(prefix: string): number | null {
+    const until = this.cooling.get(prefix) ?? 0;
+    return until > this.now() ? until : null;
+  }
+}
+
+/** A quota or authentication answer: the next account may still serve. */
+export const accountRefused = (status: number): boolean =>
+  status === 429 || status === 401 || status === 403;
+
+/** Seconds a refused account cools down for: its Retry-After, or a minute. */
+export function retryAfter(headers: Headers): number {
+  const value = Number(headers.get('retry-after'));
+  return Number.isFinite(value) && value > 0 ? Math.min(value, 3600) : 60;
+}

package/src/accounts/sessions.ts

@@ -0,0 +1,120 @@
+import { readFile } from 'node:fs/promises';
+import type { Account } from '../agents/accounts';
+import type { Check } from '../types';
+
+/** The tools T3 offers once per proxy account, by T3 driver. */
+const DRIVERS: Record<string, string> = {
+  claudeAgent: 'claude',
+  codex: 'codex',
+  opencode: 'opencode',
+};
+
+/** One per-account instance a node offers: its tool and account. */
+export interface Instance {
+  tool: string;
+  account: string;
+}
+
+/** The per-account instances this node's T3 settings offer, read from the
+ * account each one pins (WS_AGENT_ACCOUNT). An unreadable file offers none.
+ */
+export async function exposedInstances(settings: string): Promise<Instance[]> {
+  try {
+    const parsed = JSON.parse(await readFile(settings, 'utf8')) as {
+      providerInstances?: Record<
+        string,
+        {
+          driver?: unknown;
+          environment?: { name?: unknown; value?: unknown }[];
+        }
+      >;
+    };
+    return Object.values(parsed.providerInstances ?? {}).flatMap((instance) => {
+      const tool = DRIVERS[String(instance.driver)];
+      const account = (instance.environment ?? []).find(
+        (variable) => variable.name === 'WS_AGENT_ACCOUNT'
+      )?.value;
+      return tool && typeof account === 'string' ? [{ tool, account }] : [];
+    });
+  } catch {
+    return [];
+  }
+}
+
+export type SessionResult = 'ok' | 'cooling-down' | 'failed';
+
+/** Runs one real, cheap session through the instance's launcher. */
+export type Session = (instance: Instance) => Promise<SessionResult>;
+
+/** `agent:<tool>:account-<index>:session`, one per account instance: the
+ * accounts the proxy holds and any instance the node still offers. An
+ * instance whose account the proxy no longer holds fails without being run;
+ * a rate-limited account is `cooling-down`, a warning and never a pass. The
+ * index is the account's position among its provider's, never its name.
+ */
+export async function accountSessionChecks(
+  live: Account[],
+  exposed: Instance[],
+  session: Session
+): Promise<Check[]> {
+  const key = (instance: Instance) => `${instance.tool}\0${instance.account}`;
+  const held = new Set(
+    live.map((account) => key({ tool: account.tool, account: account.email }))
+  );
+  const index = (instance: Instance) =>
+    live
+      .filter((account) => account.tool === instance.tool)
+      .findIndex((account) => account.email === instance.account) + 1;
+  const removed = exposed.filter((instance) => !held.has(key(instance)));
+  const checks = await Promise.all(
+    live.map(async (account): Promise<Check> => {
+      const instance = { tool: account.tool, account: account.email };
+      const id = `agent:${account.tool}:account-${index(instance)}:session`;
+      const result = await session(instance);
+      if (result === 'ok')
+        return {
+          id,
+          status: 'pass',
+          summary: `${account.tool} account ${index(instance)} runs a session through its T3 launcher.`,
+        };
+      if (result === 'cooling-down')
+        return {
+          id,
+          status: 'warn',
+          summary: `AGENT_ACCOUNT_COOLING_DOWN: ${account.tool} account ${index(instance)} is rate limited; checked again on the next status.`,
+        };
+      return {
+        id,
+        status: 'fail',
+        summary: `AGENT_ACCOUNT_SESSION_FAILED: ${account.tool} account ${index(instance)} did not run a session.`,
+        remedy: {
+          action: 'Check this account on the proxy.',
+          command: 'devfleet fleet-accounts',
+        },
+      };
+    })
+  );
+  const byTool = new Map<string, number>();
+  for (const instance of removed) {
+    const count = (byTool.get(instance.tool) ?? 0) + 1;
+    byTool.set(instance.tool, count);
+    checks.push({
+      id: `agent:${instance.tool}:removed-${count}:session`,
+      status: 'fail',
+      summary: `AGENT_ACCOUNT_REMOVED: this node still offers a ${instance.tool} instance for an account the proxy no longer holds.`,
+      remedy: {
+        action: 'Propagate the accounts to every node.',
+        command: 'devfleet fleet-sync --only accounts',
+      },
+    });
+  }
+  return checks;
+}
+
+/** What a session's output says about its account. */
+export function sessionResult(ok: boolean, output: string): SessionResult {
+  if (ok && /\bOK\b/.test(output)) return 'ok';
+  if (/cooling down until|rate[ _-]?limit|\b429\b|quota/i.test(output))
+    return 'cooling-down';
+  return 'failed';
+}

package/src/agents/account-relay.ts

@@ -1,19 +1,38 @@
+import {
+  AccountSelector,
+  accountRefused,
+  retryAfter,
+} from '../accounts/selection';
+
 /** Pins one agent process to one provider account. The proxy routes a model
  * named `<prefix>/<model>` only to the credential that owns the prefix, but
  * agents send whichever model the user picked. This loopback relay lives only
  * as long as the agent it was started for: it adds the prefix to each request
  * and forwards everything else (credentials, streaming) unchanged.
+ *
+ * With an empty prefix it pins nothing: every launch goes through a relay, so
+ * every launch rides out a proxy restart the same way. `selector` then picks
+ * the account of each request by the fleet's selection policy.
  */
 export function startAccountRelay(
   endpoint: string,
-  prefix: string
+  prefix: string,
+  options: Pick<RelayOptions, 'selector' | 'alternatives'> = {}
 ): { url: string; stop: () => void } {
+  const pinned =
+    prefix && !options.selector
+      ? new AccountSelector([prefix], { strategy: 'fill-first' })
+      : options.selector;
   const server = Bun.serve({
     hostname: '127.0.0.1',
     port: 0,
     // Model streams are idle for as long as a model thinks.
     idleTimeout: 0,
-    fetch: (request) => forward(request, endpoint, prefix),
+    fetch: (request) =>
+      forward(request, endpoint, prefix, {
+        ...options,
+        ...(pinned ? { selector: pinned } : {}),
+      }),
   });
   return {
     url: `http://127.0.0.1:${server.port}`,
@@ -24,6 +43,11 @@ export function startAccountRelay(
 type RelayOptions = {
   send?: typeof fetch;
   pause?: (seconds: number) => Promise<void>;
+  /** Unpinned: the accounts to try in turn. Pinned: remembers cooldowns. */
+  selector?: AccountSelector;
+  /** Pinned: the other instances of the provider, named in its error. */
+  alternatives?: string[];
+  now?: () => number;
 };
 const sleep = (seconds: number) =>
   new Promise<void>((done) => setTimeout(done, seconds * 1000));
@@ -32,33 +56,54 @@ export async function forward(
   request: Request,
   endpoint: string,
   prefix: string,
-  { send = fetch, pause = sleep }: RelayOptions = {}
+  options: RelayOptions = {}
 ): Promise<Response> {
   const url = new URL(request.url);
   const headers = new Headers(request.headers);
   // fetch sets these for the upstream request and decodes its response.
   for (const name of ['host', 'content-length', 'accept-encoding'])
     headers.delete(name);
-  let body: string | undefined;
-  if (request.body) {
-    // An unreadable body could not be pinned; never forward it to the pool.
-    if (headers.has('content-encoding'))
-      return new Response('The account relay needs an uncompressed request.', {
-        status: 415,
-      });
-    body = pinModel(await request.text(), prefix);
-  }
-  const attempt = () =>
-    send(endpoint + url.pathname + url.search, {
-      method: request.method,
-      headers,
-      ...(body === undefined ? {} : { body }),
-      redirect: 'error',
-      signal: request.signal,
+  // An unreadable body could not be pinned; never forward it to the pool.
+  if (request.body && headers.has('content-encoding'))
+    return new Response('The account relay needs an uncompressed request.', {
+      status: 415,
     });
-  const upstream = await reachProxy(attempt, request.signal, pause);
-  if (!upstream)
-    return new Response('The CLI proxy is unreachable.', { status: 502 });
+  const raw = request.body ? await request.text() : undefined;
+  const reach = reacher(
+    request,
+    headers,
+    endpoint + url.pathname + url.search,
+    options
+  );
+  const { selector } = options;
+  const reached =
+    !prefix && selector && raw !== undefined
+      ? await failOver(selector, raw, reach)
+      : await pinnedReach(prefix, raw, reach, options);
+  if (reached instanceof Response) return reached;
+  return answer(reached);
+}
+
+/** Sends one body to the proxy, retrying while the route is down. */
+function reacher(
+  request: Request,
+  headers: Headers,
+  target: string,
+  { send = fetch, pause = sleep, now = Date.now }: RelayOptions
+): (body: string | undefined) => Promise<Reached> {
+  return (body) =>
+    reachProxy(
+      () => send(target, upstreamInit(request, headers, body)),
+      request.signal,
+      pause,
+      now
+    );
+}
+
+/** The proxy's answer, decoded, or the distinct "unreachable" error. */
+function answer(reached: Reached): Response {
+  const upstream = reached.response;
+  if (!upstream) return unreachable(reached.since);
   const answered = new Headers(upstream.headers);
   answered.delete('content-encoding');
   answered.delete('content-length');
@@ -68,6 +113,109 @@ export async function forward(
   });
 }
 
+/** A pinned account (or no pinning at all). A pinned account the provider
+ * limited answers at once, until its cooldown clears, with the time and the
+ * other instances of its provider.
+ */
+async function pinnedReach(
+  prefix: string,
+  raw: string | undefined,
+  reach: (body: string | undefined) => Promise<Reached>,
+  { selector, alternatives = [] }: RelayOptions
+): Promise<Reached | Response> {
+  const cooling = prefix && selector ? selector.coolingUntil(prefix) : null;
+  if (cooling !== null) return coolingDown(cooling, alternatives);
+  const reached = await reach(
+    raw !== undefined && prefix ? pinModel(raw, prefix) : raw
+  );
+  if (!prefix || !selector || reached.response?.status !== 429) return reached;
+  selector.limited(prefix, retryAfter(reached.response.headers));
+  await reached.response.body?.cancel().catch(() => undefined);
+  return coolingDown(selector.coolingUntil(prefix)!, alternatives);
+}
+
+type Reached = { response: Response | null; since: number };
+
+function upstreamInit(
+  request: Request,
+  headers: Headers,
+  body: string | undefined
+): RequestInit {
+  return {
+    method: request.method,
+    headers,
+    ...(body === undefined ? {} : { body }),
+    redirect: 'error',
+    signal: request.signal,
+  };
+}
+
+/** An unpinned request goes to the first usable account by the fleet's
+ * policy; a quota or authentication refusal sends it on to the next. With
+ * every account cooling down, the proxy's own pool serves it.
+ */
+async function failOver(
+  selector: AccountSelector,
+  raw: string,
+  reach: (body: string | undefined) => Promise<Reached>
+): Promise<Reached> {
+  const candidates = selector.candidates();
+  if (candidates.length === 0) return reach(raw);
+  let reached!: Reached;
+  for (const [position, candidate] of candidates.entries()) {
+    reached = await reach(pinModel(raw, candidate));
+    const status = reached.response?.status;
+    if (status === undefined || !accountRefused(status)) return reached;
+    selector.limited(candidate, retryAfter(reached.response!.headers));
+    if (position < candidates.length - 1)
+      await reached.response!.body?.cancel().catch(() => undefined);
+  }
+  return reached;
+}
+
+/** One error both Anthropic and OpenAI clients show as a message. */
+function agentError(
+  status: number,
+  type: string,
+  message: string,
+  retry: number
+) {
+  return new Response(
+    JSON.stringify({ type: 'error', error: { type, message } }),
+    {
+      status,
+      headers: {
+        'content-type': 'application/json',
+        'retry-after': String(Math.max(1, Math.ceil(retry))),
+      },
+    }
+  );
+}
+
+function coolingDown(until: number, alternatives: string[]): Response {
+  const others = alternatives.length
+    ? ` Pick another instance of this provider in T3: ${alternatives.join(', ')}.`
+    : '';
+  return agentError(
+    429,
+    'rate_limit_error',
+    `This account is cooling down until ${new Date(until).toISOString()}.${others}`,
+    (until - Date.now()) / 1000
+  );
+}
+
+/** The proxy did not answer within the retry window: a distinct, retryable
+ * error that says since when, never a provider's error.
+ */
+function unreachable(since: number): Response {
+  return agentError(
+    503,
+    'proxy_unreachable',
+    `The CLI proxy has been unreachable since ${new Date(since).toISOString()}. This is retryable; nothing is wrong with the account.`,
+    30
+  );
+}
+
 /** Seconds to wait before each further attempt (about a minute in total). */
 export const RETRY_DELAYS = [1, 2, 4, 8, 15, 30];
 /** The route to the proxy answered instead of the proxy: its connector or the
@@ -83,13 +231,15 @@ const routeDown = (status: number) =>
 async function reachProxy(
   attempt: () => Promise<Response>,
   signal: AbortSignal,
-  pause: (seconds: number) => Promise<void>
-): Promise<Response | null> {
+  pause: (seconds: number) => Promise<void>,
+  now: () => number
+): Promise<Reached> {
+  const since = now();
   for (let tries = 0; ; tries++) {
     const delay = RETRY_DELAYS[tries];
     const response = await attempt().catch(() => null);
-    if (response && !routeDown(response.status)) return response;
-    if (delay === undefined || signal.aborted) return response;
+    if (response && !routeDown(response.status)) return { response, since };
+    if (delay === undefined || signal.aborted) return { response, since };
     await response?.body?.cancel().catch(() => undefined);
     await pause(delay);
   }

package/src/agents/fleet-verify.ts

@@ -135,6 +135,14 @@ const UPSTREAM: Record<string, string> = {
     'The provider did not answer within the bounded verification deadline. Retry later.',
 };
 
+/** The declared route cannot work as it is: it fails, and stays failed,
+ * until the route is changed. Retrying or signing in again changes nothing.
+ */
+const INCOMPATIBLE: Record<string, string> = {
+  PROVIDER_PROTOCOL_INCOMPATIBLE:
+    'The gateway does not serve the protocol this route uses (no such endpoint, method or media type). Nothing on this machine can fix it: change the route in agents/registry.json to one listed under "Supported alternatives" in agents/setup.md, then run fleet-sync.',
+};
+
 export function inferenceFailure(provider: string, code: string): Check {
   if (QUOTA.has(code))
     return {
@@ -150,6 +158,7 @@ export function inferenceFailure(provider: string, code: string): Check {
     remedy: {
       action:
         upstream ??
+        INCOMPATIBLE[code] ??
         `Verify unattended Vault access and the declared ${provider} model on the singleton gateway. Preserve OAuth state; do not log native auth on proxy clients.`,
     },
   };

package/src/agents/launch.ts

@@ -6,6 +6,9 @@ import { accountPrefix, accountSlug, discoverAccounts } from './accounts';
 import { startAccountRelay } from './account-relay';
 import { proxyKey } from './secrets';
 import { pinnedBinary, pinnedPath } from './toolchain';
+import { AccountSelector } from '../accounts/selection';
+import { fleet } from '../fleet-config';
+import type { AccountSelection } from '../definition';
 
 /** `account` (its email) pins a proxy launch to one signed-in proxy account. */
 export async function launchProfile(
@@ -43,9 +46,11 @@ export async function launchProfile(
   }
   toolEnvironment(env, selection, directory);
   const pinned =
-    account && selection.profile === 'proxy'
-      ? await pinAccount(env, selection, { account, directory })
-      : null;
+    selection.profile !== 'proxy'
+      ? null
+      : account
+        ? await pinAccount(env, selection, { account, directory })
+        : await routeThroughRelay(env, selection);
   try {
     return await spawnAgent(selection, directory, env, [
       pinned?.args ?? [],
@@ -96,9 +101,14 @@ export async function pinAccount(
 ): Promise<{ args: string[]; stop: () => void }> {
   const prefix = accountPrefix(selection.tool, account);
   // What the account serves right now, preferred default first.
-  const served = (await discover(env['CLIPROXY_API_KEY'] ?? '')).find(
+  const roster = await discover(env['CLIPROXY_API_KEY'] ?? '');
+  const served = roster.find(
     (entry) => entry.tool === selection.tool && entry.email === account
   );
+  // Named in this account's "cooling down" error, so the person can switch.
+  const alternatives = roster
+    .filter((entry) => entry.tool === selection.tool && entry.email !== account)
+    .map((entry) => entry.email);
   if (!served)
     throw new AgentConfigurationError(
       'This account is not signed in on the CLI proxy.'
@@ -108,7 +118,9 @@ export async function pinAccount(
     env['OPENCODE_CONFIG_CONTENT'] = JSON.stringify(accountOpenCode(served));
     return { args: [], stop: () => {} };
   }
-  const { url, stop } = relay(registry.proxy.endpoint, prefix);
+  const { url, stop } = relay(registry.proxy.endpoint, prefix, {
+    alternatives,
+  });
   if (selection.tool === 'claude') {
     env['ANTHROPIC_BASE_URL'] = url;
     // Aliases and the default must name models a Claude account serves.
@@ -146,6 +158,73 @@ export async function pinAccount(
   };
 }
 
+/** Which tools reach the proxy through an address this wrapper sets, and so
+ * can be sent through a relay. OpenCode and Grok read theirs from rendered
+ * configuration and still go to the proxy directly.
+ */
+const RELAYED = new Set(['claude', 'codex', 'gemini', 'antigravity']);
+
+/** An unpinned launch goes through a relay as well: it retries a proxy that
+ * is restarting exactly as a pinned one does, reports "proxy unreachable"
+ * when it stays down, and picks each request's account by the fleet's
+ * selection policy when it declares one for the provider.
+ */
+export async function routeThroughRelay(
+  env: NodeJS.ProcessEnv,
+  selection: Selection,
+  {
+    relay = startAccountRelay,
+    discover = discoverAccounts,
+    policy = selectionPolicy,
+  } = {}
+): Promise<{ args: string[]; stop: () => void } | null> {
+  if (!RELAYED.has(selection.tool)) return null;
+  const selector = await policySelector(env, selection, discover, policy);
+  const { url, stop } = relay(
+    registry.proxy.endpoint,
+    '',
+    selector ? { selector } : {}
+  );
+  if (selection.tool === 'claude') env['ANTHROPIC_BASE_URL'] = url;
+  if (selection.tool === 'gemini' || selection.tool === 'antigravity')
+    env['GOOGLE_GEMINI_BASE_URL'] = url;
+  const args =
+    selection.tool === 'codex'
+      ? [
+          '-c',
+          `model_providers.personal_proxy.base_url=${JSON.stringify(`${url}/v1`)}`,
+        ]
+      : [];
+  return { args, stop };
+}
+
+/** The fleet's selection policy for the tool's provider, over the accounts
+ * the proxy lists. The list is read only when a policy needs it; an
+ * unreadable list leaves the choice to the proxy's own pool.
+ */
+async function policySelector(
+  env: NodeJS.ProcessEnv,
+  selection: Selection,
+  discover: typeof discoverAccounts,
+  policy: (provider: string) => AccountSelection | undefined
+): Promise<AccountSelector | undefined> {
+  const route = (
+    registry.proxy.accounts as Record<string, { provider: string }>
+  )[selection.tool];
+  const declared = route ? policy(route.provider) : undefined;
+  if (!declared) return undefined;
+  const accounts = await discover(env['CLIPROXY_API_KEY'] ?? '').catch(
+    () => []
+  );
+  const prefixes = accounts
+    .filter((account) => account.tool === selection.tool)
+    .map((account) => account.prefix);
+  return prefixes.length ? new AccountSelector(prefixes, declared) : undefined;
+}
+
+const selectionPolicy = (provider: string): AccountSelection | undefined =>
+  fleet.services.proxy.accounts?.selection?.[provider];
+
 /** OpenCode configuration that offers only one account's models. */
 function accountOpenCode(route: { prefix: string; models: string[] }) {
   const models = route.models.map((model) => `${route.prefix}/${model}`);