@hanzo/build 0.2.0

package/LICENSE-APACHE

@@ -0,0 +1,205 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and
+distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright
+owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities
+that control, are controlled by, or are under common control with that entity.
+For the purposes of this definition, "control" means (i) the power, direct or
+indirect, to cause the direction or management of such entity, whether by
+contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the
+outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including
+but not limited to software source code, documentation source, and configuration
+files.
+
+"Object" form shall mean any form resulting from mechanical transformation or
+translation of a Source form, including but not limited to compiled object code,
+generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form, made
+available under the License, as indicated by a copyright notice that is included
+in or attached to the work (an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that
+is based on (or derived from) the Work and for which the editorial revisions,
+annotations, elaborations, or other modifications represent, as a whole, an
+original work of authorship. For the purposes of this License, Derivative Works
+shall not include works that remain separable from, or merely link (or bind by
+name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version
+of the Work and any modifications or additions to that Work or Derivative Works
+thereof, that is intentionally submitted to Licensor for inclusion in the Work
+by the copyright owner or by an individual or Legal Entity authorized to submit
+on behalf of the copyright owner. For the purposes of this definition,
+"submitted" means any form of electronic, verbal, or written communication sent
+to the Licensor or its representatives, including but not limited to
+communication on electronic mailing lists, source code control systems, and
+issue tracking systems that are managed by, or on behalf of, the Licensor for
+the purpose of discussing and improving the Work, but excluding communication
+that is conspicuously marked or otherwise designated in writing by the copyright
+owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf
+of whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+2. Grant of Copyright License.
+
+Subject to the terms and conditions of this License, each Contributor hereby
+grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,
+irrevocable copyright license to reproduce, prepare Derivative Works of,
+publicly display, publicly perform, sublicense, and distribute the Work and such
+Derivative Works in Source or Object form.
+
+3. Grant of Patent License.
+
+Subject to the terms and conditions of this License, each Contributor hereby
+grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,
+irrevocable (except as stated in this section) patent license to make, have
+made, use, offer to sell, sell, import, and otherwise transfer the Work, where
+such license applies only to those patent claims licensable by such Contributor
+that are necessarily infringed by their Contribution(s) alone or by combination
+of their Contribution(s) with the Work to which such Contribution(s) was
+submitted. If You institute patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Work or a
+Contribution incorporated within the Work constitutes direct or contributory
+patent infringement, then any patent licenses granted to You under this License
+for that Work shall terminate as of the date such litigation is filed.
+
+4. Redistribution.
+
+You may reproduce and distribute copies of the Work or Derivative Works thereof
+in any medium, with or without modifications, and in Source or Object form,
+provided that You meet the following conditions:
+
+You must give any other recipients of the Work or Derivative Works a copy of
+this License; and
+You must cause any modified files to carry prominent notices stating that You
+changed the files; and
+You must retain, in the Source form of any Derivative Works that You distribute,
+all copyright, patent, trademark, and attribution notices from the Source form
+of the Work, excluding those notices that do not pertain to any part of the
+Derivative Works; and
+If the Work includes a "NOTICE" text file as part of its distribution, then any
+Derivative Works that You distribute must include a readable copy of the
+attribution notices contained within such NOTICE file, excluding those notices
+that do not pertain to any part of the Derivative Works, in at least one of the
+following places: within a NOTICE text file distributed as part of the
+Derivative Works; within the Source form or documentation, if provided along
+with the Derivative Works; or, within a display generated by the Derivative
+Works, if and wherever such third-party notices normally appear. The contents of
+the NOTICE file are for informational purposes only and do not modify the
+License. You may add Your own attribution notices within Derivative Works that
+You distribute, alongside or as an addendum to the NOTICE text from the Work,
+provided that such additional attribution notices cannot be construed as
+modifying the License.
+You may add Your own copyright statement to Your modifications and may provide
+additional or different license terms and conditions for use, reproduction, or
+distribution of Your modifications, or for any such Derivative Works as a whole,
+provided Your use, reproduction, and distribution of the Work otherwise complies
+with the conditions stated in this License.
+
+5. Submission of Contributions.
+
+Unless You explicitly state otherwise, any Contribution intentionally submitted
+for inclusion in the Work by You to the Licensor shall be under the terms and
+conditions of this License, without any additional terms or conditions.
+Notwithstanding the above, nothing herein shall supersede or modify the terms of
+any separate license agreement you may have executed with Licensor regarding
+such Contributions.
+
+6. Trademarks.
+
+This License does not grant permission to use the trade names, trademarks,
+service marks, or product names of the Licensor, except as required for
+reasonable and customary use in describing the origin of the Work and
+reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty.
+
+Unless required by applicable law or agreed to in writing, Licensor provides the
+Work (and each Contributor provides its Contributions) on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied,
+including, without limitation, any warranties or conditions of TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are
+solely responsible for determining the appropriateness of using or
+redistributing the Work and assume any risks associated with Your exercise of
+permissions under this License.
+
+8. Limitation of Liability.
+
+In no event and under no legal theory, whether in tort (including negligence),
+contract, or otherwise, unless required by applicable law (such as deliberate
+and grossly negligent acts) or agreed to in writing, shall any Contributor be
+liable to You for damages, including any direct, indirect, special, incidental,
+or consequential damages of any character arising as a result of this License or
+out of the use or inability to use the Work (including but not limited to
+damages for loss of goodwill, work stoppage, computer failure or malfunction, or
+any and all other commercial damages or losses), even if such Contributor has
+been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability.
+
+While redistributing the Work or Derivative Works thereof, You may choose to
+offer, and charge a fee for, acceptance of support, warranty, indemnity, or
+other liability obligations and/or rights consistent with this License. However,
+in accepting such obligations, You may act only on Your own behalf and on Your
+sole responsibility, not on behalf of any other Contributor, and only if You
+agree to indemnify, defend, and hold each Contributor harmless for any liability
+incurred by, or claims asserted against, such Contributor by reason of your
+accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work
+
+To apply the Apache License to your work, attach the following boilerplate
+notice, with the fields enclosed by brackets "[]" replaced with your own
+identifying information. (Don't include the brackets!) The text should be
+enclosed in the appropriate comment syntax for the file format. We also
+recommend that a file or class name and description of purpose be included on
+the same "printed page" as the copyright notice for easier identification within
+third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+   Copyright 2026 Hanzo AI, Inc
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hanzo AI, Inc
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -0,0 +1,37 @@
+Hanzo Build
+Copyright (c) 2026 Hanzo AI, Inc.
+
+Licensed under either of Apache License, Version 2.0 (LICENSE-APACHE) or
+MIT license (LICENSE-MIT) at your option.
+
+Unless you explicitly state otherwise, any contribution intentionally
+submitted for inclusion in this work by you, as defined in the Apache-2.0
+licence, shall be dual licensed as above, without any additional terms or
+conditions.
+
+The builder in this repository was extracted from the Hanzo workspace
+(github.com/hanzoai/app). Its project workspace (src/project.tsx) is a port
+of the Hanzo App v2 editor (github.com/hanzoai/build-v2), which is derived
+from OSW Studio by Otto Stahl (github.com/o-stahl/osw-studio, MIT, Copyright
+(c) 2025 Otto Stahl), itself derived from DeepSite v2 by enzostvs and the
+DeepSite authors (huggingface.co/spaces/enzostvs/deepsite, MIT). Both are
+used under the MIT License; their notices are reproduced here:
+
+  Permission is hereby granted, free of charge, to any person obtaining a
+  copy of this software and associated documentation files (the
+  "Software"), to deal in the Software without restriction, including
+  without limitation the rights to use, copy, modify, merge, publish,
+  distribute, sublicense, and/or sell copies of the Software, and to permit
+  persons to whom the Software is furnished to do so, subject to the
+  following conditions: The above copyright notice and this permission
+  notice shall be included in all copies or substantial portions of the
+  Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.
+
+Bundled at build time, under their own licences:
+  @hanzo/ui, @hanzo/gui       MIT      github.com/hanzoai/ui
+  @hanzo/iam                  MIT      github.com/hanzoai/iam
+  @hanzo/font                 MIT      github.com/hanzoai/font
+  @hanzogui/lucide-icons-2    ISC      github.com/lucide-icons/lucide
+  react, react-dom            MIT      github.com/facebook/react
+  react-router                MIT      github.com/remix-run/react-router
+  next-themes                 MIT      github.com/pacocoursey/next-themes

package/README.md

@@ -0,0 +1,120 @@
+# Hanzo Build
+
+Say what you want. Hanzo writes it, runs it, and puts it on a live URL — with
+the database, the sign-in and the storage already there.
+
+The builder is one component with two hosts: this page (hanzo.build), and the
+platform console at platform.hanzo.ai/dev. Both mount `<Builder host={…} />`
+from `@hanzo/build`; neither forks it.
+
+```
+pnpm install
+pnpm dev            # http://localhost:3200
+pnpm test           # the transport contract and the address grammar
+pnpm build:lib      # lib/ — what npm ships
+```
+
+The port is not a preference. `vite.config.ts` pins 3200 for both `dev` and
+`preview`, and IAM lists `http://localhost:3200/auth/callback` among this
+client's redirects — sign in from any other port and the authorize call is
+refused.
+
+`/v1` is proxied to `api.hanzo.ai` from the dev server and from the preview of
+a build: the gateway admits an origin by allowlist and a localhost port is not
+on it.
+
+## Mounting it
+
+```tsx
+import { Builder, type Host } from '@hanzo/build'
+
+<Hanzo theme="dark">
+  <div style={{ height: '100dvh', display: 'flex' }}>
+    <Builder host={host} />
+  </div>
+</Hanzo>
+```
+
+`Host` is everything that differs between hosts: where the platform is
+(`api`), the bearer (`token()`, read at call time), the org (`org`), who is
+signed in (`person`), whether they administer the org (`admin`), the address
+under the mount (`path`) and how to move (`go`), and where to link out
+(`links`, `open`). Peers: `@hanzo/ui`, `@hanzo/gui`, `@hanzogui/lucide-icons-2`,
+`react`.
+
+## Addresses
+
+| path | screen |
+|---|---|
+| `''` | New — the empty state and the composer |
+| `sess_<32 hex>` | one run, live |
+| `-/artifacts` | what the org has built |
+| `-/templates` | the public starters |
+| `<slug>` | a project's workspace |
+
+A project slug holds no `_` and never starts with `-`, so the forms cannot
+collide.
+
+## What is on the screen
+
+**The rail.** New, Artifacts, Customize (the platform's plugins), More
+(Templates, Machines, Docs), then the org's coding runs newest first with a
+live status dot, and the account. Collapse is an explicit toggle kept in this
+browser.
+
+**New.** "What's up next?", and at the foot the composer: where the run runs
+(Default is the platform's sandbox; the org's machines follow), the repository
+and the branch — both searchable, paged popovers opening upward — then the
+ask. Under it: attach (files ride the prompt as text), dictate, Build or Plan,
+and the model and effort. A repository row can be added to a project.
+
+**A run.** The transcript as it streams, steering while it works, Stop, and
+the pull request once it pushes one.
+
+**A project.** The v2 workspace in the same window: its runs as a
+conversation with suggestions and a Build/Plan composer on the left; Preview,
+Files, Code and Layers on the right with desktop/mobile, reload, the page
+picker and open-in-tab; Share and Publish; the console dock under it.
+
+## The contract
+
+| call | what |
+|---|---|
+| `POST /v1/agent/coding` | start a run → 202 `{sessionId, …}` |
+| `GET /v1/agent/sessions?kind=coding` | Recents, and a project's runs |
+| `GET /v1/agent/sessions/{id}` · `GET /v1/agent/sessions/stream?root=` | a run, and its live feed (SSE over fetch) |
+| `POST /v1/agent/sessions/{id}/message` · `/stop` | steer, stop |
+| `GET /v1/agent/targets` | the org's machines |
+| `GET /v1/provider/github/repos` · `…/{owner}/{repo}/branches` | the chips' pagers |
+| `POST /v1/provider/github/user/connect` | connect a person's GitHub |
+| `GET /v1/projects` · `POST /v1/projects/fork` · `GET /v1/templates` | artifacts, templates |
+| `GET /v1/git/repos/{name}/tree` · `/blob` | Files and Code |
+| `POST /v1/platform/apps` · `GET /v1/platform/builds` | Add to project, Publish |
+| `GET /v1/models` · `POST /v1/event` | the model list, a verdict |
+
+`mode`, `model` and `effort` are sent with a run as asked; the platform
+honours them where it does and nothing here simulates them.
+
+## Layout
+
+```
+src/
+  index.ts      the library surface
+  builder.tsx   the rail and the pane the address names
+  landing.tsx   New
+  run.tsx       one run
+  project.tsx   a project's workspace
+  shelf.tsx     Artifacts and Templates
+  publish.tsx   Add to project / Publish
+  account.tsx   the account and find-a-run dialogs
+  data.ts       reads as hooks
+  host.tsx      what a host provides
+  route.ts      the address grammar
+  api/          one typed client per surface, over one call()
+  app/          this page's host: IAM, the router, the mount
+```
+
+## Licence
+
+Apache-2.0 OR MIT, at your option. See `NOTICE` — the project workspace is a
+port of the v2 editor, derived from OSW Studio and DeepSite (MIT).

package/lib/account.d.ts

@@ -0,0 +1,11 @@
+import type { RailSession } from '@hanzo/ui/chat';
+export declare function Account({ open, onOpenChange }: {
+    open: boolean;
+    onOpenChange: (o: boolean) => void;
+}): import("react").JSX.Element;
+export declare function Find({ open, onOpenChange, recents, onOpen, }: {
+    open: boolean;
+    onOpenChange: (o: boolean) => void;
+    recents: RailSession[];
+    onOpen: (id: string) => void;
+}): import("react").JSX.Element;

package/lib/account.js

@@ -0,0 +1,26 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * The rail's two small dialogs: the account (the caret by the email), and
+ * finding a run by name (the search icon).
+ */
+import { SizableText, XStack, YStack } from '@hanzo/gui';
+import { LogOut, Settings } from '@hanzogui/lucide-icons-2';
+import { Button, Dialog, DialogContent, DialogTitle, Input } from '@hanzo/ui';
+import { useMemo, useState } from 'react';
+import { useHost } from './host.js';
+export function Account({ open, onOpenChange }) {
+    const host = useHost();
+    const who = host.person;
+    return (_jsx(Dialog, { open: open, onOpenChange: onOpenChange, children: _jsxs(DialogContent, { maxW: 360, children: [_jsx(DialogTitle, { children: "Account" }), _jsxs(YStack, { gap: "$1", children: [_jsx(SizableText, { size: "$3", color: "$ink", numberOfLines: 1, children: who?.name || who?.email || 'Signed out' }), who?.email && who.name ? (_jsx(SizableText, { size: "$2", color: "$soft", numberOfLines: 1, children: who.email })) : null, host.org ? (_jsxs(SizableText, { size: "$1", color: "$soft", children: ["Organization: ", host.org] })) : null] }), _jsxs(XStack, { gap: "$2", justify: "flex-end", flexWrap: "wrap", children: [_jsxs(Button, { variant: "outline", size: "sm", onPress: () => host.open(host.links.settings), children: [_jsx(Settings, { size: 14 }), " Settings"] }), host.signOut ? (_jsxs(Button, { variant: "outline", size: "sm", onPress: () => host.signOut?.(), children: [_jsx(LogOut, { size: 14 }), " Sign out"] })) : null] })] }) }));
+}
+export function Find({ open, onOpenChange, recents, onOpen, }) {
+    const [q, setQ] = useState('');
+    const hits = useMemo(() => {
+        const n = q.trim().toLowerCase();
+        return (n ? recents.filter((r) => r.title.toLowerCase().includes(n)) : recents).slice(0, 12);
+    }, [q, recents]);
+    return (_jsx(Dialog, { open: open, onOpenChange: onOpenChange, children: _jsxs(DialogContent, { maxW: 480, children: [_jsx(DialogTitle, { children: "Find a run" }), _jsx(Input, { autoFocus: true, value: q, onChangeText: setQ, placeholder: "Search runs\u2026", "aria-label": "Search runs", onKeyDown: (e) => {
+                        if ((e.key ?? e.nativeEvent?.key) === 'Enter' && hits[0])
+                            onOpen(hits[0].id);
+                    } }), _jsx(YStack, { gap: "$1", role: "list", children: hits.length === 0 ? (_jsx(SizableText, { size: "$2", color: "$soft", children: "No run matches." })) : (hits.map((r) => (_jsx(XStack, { role: "listitem", render: "button", onPress: () => onOpen(r.id), px: "$2", py: "$1.5", rounded: "$3", hoverStyle: { bg: '$hover' }, children: _jsx(SizableText, { size: "$2", color: "$ink", numberOfLines: 1, children: r.title }) }, r.id)))) })] }) }));
+}

package/lib/api/call.d.ts

@@ -0,0 +1,38 @@
+/**
+ * One request path to the platform.
+ *
+ * Every typed op below goes through `call`, so the bearer, the org scope, the
+ * no-store cache rule and the reading of a refusal are decided once. The
+ * platform answers a refusal as RFC 9457 problem details; older handlers still
+ * answer `{error:{message}}` or `{msg}`, and all three read the same way here.
+ */
+/** Where the platform is and who is asking. The host supplies it. */
+export interface Target {
+    /** The platform origin, no trailing slash: calls are `${api}/v1/…`. */
+    api: string;
+    /** The signed-in person's bearer, or null for nobody. */
+    token: () => string | null;
+    /** The org every call is scoped to, sent as `X-Org-Id`. */
+    org: string | null;
+}
+/** A refusal: the status, and the platform's own sentence for it. */
+export declare class Refusal extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export type Query = Record<string, string | number | boolean | null | undefined>;
+/** `?a=1&b=2` from the defined, non-empty entries of `q`, or ''. */
+export declare function query(q?: Query): string;
+/** The headers every call carries: the bearer and the org, when there are ones. */
+export declare function headers(t: Target, extra?: HeadersInit): Headers;
+/** The sentence a refusal carries, whichever envelope it arrived in. */
+export declare function reason(res: Response): Promise<string>;
+/** A path segment, escaped. Ids and names from a row never compose a path raw. */
+export declare const seg: (s: string) => string;
+/**
+ * One JSON call. Throws `Refusal` on any non-2xx, with the platform's reason, or
+ * the status when it gave none. A 204 answers `undefined`.
+ */
+export declare function call<T>(t: Target, method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', path: string, body?: unknown, init?: {
+    signal?: AbortSignal;
+}): Promise<T>;

package/lib/api/call.js

@@ -0,0 +1,75 @@
+/**
+ * One request path to the platform.
+ *
+ * Every typed op below goes through `call`, so the bearer, the org scope, the
+ * no-store cache rule and the reading of a refusal are decided once. The
+ * platform answers a refusal as RFC 9457 problem details; older handlers still
+ * answer `{error:{message}}` or `{msg}`, and all three read the same way here.
+ */
+/** A refusal: the status, and the platform's own sentence for it. */
+export class Refusal extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = 'Refusal';
+    }
+}
+/** `?a=1&b=2` from the defined, non-empty entries of `q`, or ''. */
+export function query(q = {}) {
+    const s = new URLSearchParams();
+    for (const [k, v] of Object.entries(q)) {
+        if (v === undefined || v === null || v === '')
+            continue;
+        s.set(k, String(v));
+    }
+    const out = s.toString();
+    return out ? `?${out}` : '';
+}
+/** The headers every call carries: the bearer and the org, when there are ones. */
+export function headers(t, extra) {
+    const h = new Headers(extra);
+    const token = t.token();
+    if (token && !h.has('Authorization'))
+        h.set('Authorization', `Bearer ${token}`);
+    if (t.org && !h.has('X-Org-Id'))
+        h.set('X-Org-Id', t.org);
+    return h;
+}
+/** The sentence a refusal carries, whichever envelope it arrived in. */
+export async function reason(res) {
+    try {
+        const body = (await res.json());
+        const err = typeof body.error === 'string' ? body.error : body.error?.message;
+        return body.detail || err || body.msg || body.message || body.title || '';
+    }
+    catch {
+        return '';
+    }
+}
+/** A path segment, escaped. Ids and names from a row never compose a path raw. */
+export const seg = (s) => encodeURIComponent(s);
+/**
+ * One JSON call. Throws `Refusal` on any non-2xx, with the platform's reason, or
+ * the status when it gave none. A 204 answers `undefined`.
+ */
+export async function call(t, method, path, body, init) {
+    const h = headers(t, body === undefined ? undefined : { 'Content-Type': 'application/json' });
+    const res = await fetch(`${t.api}${path}`, {
+        method,
+        headers: h,
+        body: body === undefined ? undefined : JSON.stringify(body),
+        // A run, a repo list and a status are facts about now. A cached refusal
+        // outlives the fix.
+        cache: 'no-store',
+        signal: init?.signal,
+    });
+    if (!res.ok) {
+        const why = await reason(res);
+        throw new Refusal(res.status, why || `${method} ${path.split('?')[0]} answered ${res.status}`);
+    }
+    if (res.status === 204)
+        return undefined;
+    const text = await res.text();
+    return (text ? JSON.parse(text) : undefined);
+}

package/lib/api/coding.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Starting a coding run.
+ *
+ *   POST /v1/agent/coding → 202 {sessionId, repo, branch, project, routed, targetId}
+ *
+ * 202 is ADMITTED, not finished: the answer is the session the run narrates
+ * itself in, and the session stream is how it is watched.
+ *
+ * Where it runs is one field. No `targetId` is the platform's sandbox; a target
+ * id routes it to one of the org's machines, and `routed` says whether it got
+ * there.
+ *
+ * `mode`, `model` and `effort` are this surface's asks of the contract: `plan`
+ * is a run that plans and writes nothing, `build` edits, commits and pushes.
+ * They are sent as asked and never simulated here — a run the platform has not
+ * been told how to plan is not made to look like one.
+ */
+import { type Target } from './call.ts';
+export type Mode = 'build' | 'plan';
+/**
+ * The modes the platform honours today. `CodingStartIn` takes no `mode` yet, so
+ * a plan run would edit, commit and push like any other — on a machine, with
+ * that machine's credentials. Until the platform takes `plan`, a plan ask is
+ * refused here rather than sent to become a build.
+ */
+export declare const HONOURED: readonly Mode[];
+/** Why a mode cannot be asked for yet, or '' when it can. */
+export declare const unhonoured: (mode: Mode | undefined) => string;
+export interface Ask {
+    /** The task, in the words you would use with a colleague. */
+    prompt: string;
+    /** `owner/name`. Omitted starts something new, in a repository named for it. */
+    repo?: string;
+    /** The branch to start from. Omitted takes the repository's default. */
+    base?: string;
+    /** One of the org's machines. Omitted is the sandbox. */
+    targetId?: string;
+    /** The project slug the run works on. */
+    project?: string;
+    /** An earlier run's session to continue from, on the branch it pushed. */
+    after?: string;
+    mode?: Mode;
+    model?: string;
+    effort?: string;
+}
+export interface Run {
+    session: string;
+    repo: string;
+    branch: string;
+    project: string;
+    routed: boolean;
+    target: string;
+}
+/** The request body: only what was asked, with no empty strings sent as values. */
+export declare function body(ask: Ask): Record<string, string>;
+export declare function start(t: Target, ask: Ask): Promise<Run>;

package/lib/api/coding.js

@@ -0,0 +1,58 @@
+/**
+ * Starting a coding run.
+ *
+ *   POST /v1/agent/coding → 202 {sessionId, repo, branch, project, routed, targetId}
+ *
+ * 202 is ADMITTED, not finished: the answer is the session the run narrates
+ * itself in, and the session stream is how it is watched.
+ *
+ * Where it runs is one field. No `targetId` is the platform's sandbox; a target
+ * id routes it to one of the org's machines, and `routed` says whether it got
+ * there.
+ *
+ * `mode`, `model` and `effort` are this surface's asks of the contract: `plan`
+ * is a run that plans and writes nothing, `build` edits, commits and pushes.
+ * They are sent as asked and never simulated here — a run the platform has not
+ * been told how to plan is not made to look like one.
+ */
+import { call, Refusal } from './call.js';
+/**
+ * The modes the platform honours today. `CodingStartIn` takes no `mode` yet, so
+ * a plan run would edit, commit and push like any other — on a machine, with
+ * that machine's credentials. Until the platform takes `plan`, a plan ask is
+ * refused here rather than sent to become a build.
+ */
+export const HONOURED = ['build'];
+/** Why a mode cannot be asked for yet, or '' when it can. */
+export const unhonoured = (mode) => mode && !HONOURED.includes(mode)
+    ? 'Plan needs the platform’s plan mode, which the coding API does not take yet — this ask would build. Switch to Build, or wait for Plan.'
+    : '';
+/** The request body: only what was asked, with no empty strings sent as values. */
+export function body(ask) {
+    const out = { prompt: ask.prompt.trim() };
+    for (const k of ['repo', 'base', 'targetId', 'project', 'after', 'mode', 'model', 'effort']) {
+        const v = ask[k]?.trim();
+        if (v)
+            out[k] = v;
+    }
+    return out;
+}
+export async function start(t, ask) {
+    if (!ask.prompt.trim())
+        throw new Refusal(400, 'Say what the run should do');
+    const why = unhonoured(ask.mode);
+    if (why)
+        throw new Refusal(400, why);
+    const r = await call(t, 'POST', '/v1/agent/coding', body(ask));
+    const s = (k) => (typeof r?.[k] === 'string' ? r[k] : '');
+    if (!s('sessionId'))
+        throw new Refusal(502, 'The run was admitted but named no session');
+    return {
+        session: s('sessionId'),
+        repo: s('repo'),
+        branch: s('branch'),
+        project: s('project'),
+        routed: r?.routed === true,
+        target: s('targetId'),
+    };
+}