@intentic/sandbox-contract 1.159.0 → 1.161.0

package/src/quick-model.ts

@@ -0,0 +1,103 @@
+import { ACCESS_COST, accessFor, PROVIDERS } from "./agent-catalog.js";
+import { compareCheapestFirst, familyOf, tierRankOf } from "./model-order.js";
+import type { NativeProvider } from "./schemas.js";
+
+/* THE QUICK MODEL — the cheap, fast model a one-click helper spends instead of the frontier model the chat runs
+ * on. Today that is the commit box's autofill; anything else of that shape (a branch name, a PR description)
+ * reads the same answer, which is the reason this is a `quickModel` setting rather than a commit-message one.
+ *
+ * The rule lives in the contract because BOTH sides need the same answer for different jobs: the daemon runs
+ * the model, and the browser has to NAME it — in the sparkle's tooltip and in the settings row's "Auto (…)"
+ * label — before anything has been run. Two implementations would drift precisely where it matters most, since
+ * a tooltip promising Haiku while the daemon bills Opus is worse than no tooltip.
+ *
+ * The default is DERIVED, NEVER STORED. `quickModel` ships as "" and that empty string means "work it out from
+ * whatever is connected right now", so connecting a Google account tomorrow improves the default by itself and
+ * disconnecting the pinned provider degrades to Auto instead of to a dead button. Same instinct as the rest of
+ * this repo's model handling: model-order.ts derives tier and recency from the id and curates nothing, and the
+ * web's defaultModelFor reads the live catalog rather than naming an id that a release will falsify. */
+
+// One provider's standing in the decision: whether a turn on it can be sent at all, and what its catalog holds.
+// ACP agents are deliberately not expressible here — an ACP row's model id is empty because the agent owns its
+// own model, so there is no cheap rung to point it at.
+export interface QuickModelSource {
+    readonly provider: NativeProvider;
+    // The same connection predicate every other surface gates on (access.ts web-side, the daemon's own account
+    // stores daemon-side). A catalog is never empty by construction, so "has rows" says nothing about "can send".
+    readonly ready: boolean;
+    readonly models: readonly string[];
+}
+
+export interface QuickModelChoice {
+    readonly provider: NativeProvider;
+    readonly model: string;
+}
+
+// A pinned selection on the wire: `${provider}:${modelId}`, the same key shape the model picker already mints
+// for its entries (PickerEntry.key). Empty ⇒ Auto.
+export const quickModelKey = (choice: QuickModelChoice): string => `${choice.provider}:${choice.model}`;
+
+// Split on the FIRST colon only: a provider id never contains one and a model id might.
+const parsePinned = (pinned: string): QuickModelChoice | undefined => {
+    const separator = pinned.indexOf(`:`);
+    if (separator <= 0 || separator === pinned.length - 1) {
+        return undefined;
+    }
+    return { provider: pinned.slice(0, separator) as NativeProvider, model: pinned.slice(separator + 1) };
+};
+
+// The cheapest row a provider publishes — its whole catalog read from the cheap end. Undefined for a catalog
+// that hasn't loaded yet, which is a real state: every provider serves a floor, but only once something has
+// asked it.
+const cheapestOf = (source: QuickModelSource): string | undefined => source.models.toSorted(compareCheapestFirst)[0];
+
+// Where a provider's cheapest row sits on the shared tier scale, and therefore how well it answers the question
+// this whole module asks. UNRANKED (-1) is a genuine last place: it means the id carries no tier word we know,
+// so the row is the provider's base line rather than its budget one.
+const tierOf = (model: string): number => tierRankOf(familyOf(model));
+
+// PROVIDERS order, as the final tiebreak. Arbitrary, but the SAME arbitrary answer on every read — the property
+// compareUnrankedModelIds exists to guarantee, and the one a default actually needs.
+const providerOrder = (provider: NativeProvider): number => PROVIDERS.findIndex((entry) => entry.value === provider);
+
+// How much a call on this provider costs at the margin. Every native provider declares an access kind, so the
+// fallback is unreachable — it exists because AgentProvider is a bare string on the wire.
+const costOf = (provider: NativeProvider): number => {
+    const access = accessFor(provider);
+    return access === undefined ? ACCESS_COST.key : ACCESS_COST[access.kind];
+};
+
+/* Which model a quick helper runs, given what this sandbox has connected. `pinned` is the stored setting.
+ *
+ * A pin only holds while its provider is READY: an account the user disconnected would otherwise leave the
+ * button failing on every click with a credential error, when the sandbox can plainly still answer. Auto taking
+ * over is the same move the composer already makes when a live catalog stops offering the selected model.
+ *
+ * Auto ranks candidates on TIER FIRST, then cost. That order is the point of the feature: the helper exists to
+ * not be the frontier model, so a free flagship is still the wrong tool, while a free Haiku-class row and a
+ * subscription Haiku-class row differ only in whose quota they spend. Cost then breaks that tie towards the
+ * channel the user is not paying per token for — and against the one they are.
+ *
+ * Undefined when nothing is connected: the caller renders a disabled control that says so, rather than a live
+ * button that fails on click. */
+export const resolveQuickModel = (sources: readonly QuickModelSource[], pinned: string): QuickModelChoice | undefined => {
+    const requested = parsePinned(pinned);
+    if (requested !== undefined && sources.some((source) => source.provider === requested.provider && source.ready)) {
+        // Taken verbatim, unvalidated against the catalog on purpose: the picker already offers a custom-id
+        // escape hatch for a model a catalog hasn't caught up with, and second-guessing the user's own id here
+        // would silently run a different model than the settings row names.
+        return requested;
+    }
+    const candidates = sources
+        .filter((source) => source.ready)
+        .flatMap((source) => {
+            const model = cheapestOf(source);
+            return model === undefined ? [] : [{ provider: source.provider, model }];
+        });
+    return candidates.toSorted(
+        (left, right) =>
+            tierOf(right.model) - tierOf(left.model) ||
+            costOf(left.provider) - costOf(right.provider) ||
+            providerOrder(left.provider) - providerOrder(right.provider),
+    )[0];
+};

package/src/schemas.test.ts

@@ -18,7 +18,18 @@ test("a payload from a build that predates a toggle parses, with the new toggle
         outputCleaners: "-cap",
         outputHoldout: 0.1,
     };
-    expect(SandboxSettingsSchema.parse(older)).toEqual({ ...older, filterBackend: "native", agentRetentionDays: 3 });
+    expect(SandboxSettingsSchema.parse(older)).toEqual({
+        ...older,
+        terseHoldout: 0,
+        filterBackend: "native",
+        systemPromptMode: "intentic",
+        systemPrompt: "",
+        quickModel: "",
+        agentRetentionDays: 3,
+        autoLand: true,
+        autoResumeOnLimit: false,
+        resumeAfterOutage: true,
+    });
 });
 
 test("an empty object is the full default settings object", () => {
@@ -27,17 +38,35 @@ test("an empty object is the full default settings object", () => {
         skills: [],
         hashlineEdits: false,
         terseOutput: false,
+        // Off: the steer's turn-level control spends the tokens it measures, so measuring is opt-in.
+        terseHoldout: 0,
         iqSearch: false,
         outputCleaners: "off",
         outputHoldout: 0,
         filterBackend: "native",
+        // The default base is Intentic's own prompt; the text field is only read under "custom".
+        systemPromptMode: "intentic",
+        systemPrompt: "",
+        // Empty is not "no quick model" — it is Auto, resolved from the connected accounts on every read
+        // (quick-model.ts). Storing a resolved id as the default would name a provider a fresh sandbox has no
+        // credential for, and would go stale the moment one is connected.
+        quickModel: "",
         // The one default that isn't "off": the fleet board's Finished lane has no exit of its own, and each
         // card it holds is a worktree checkout. Opting INTO cleanup would mean shipping a leak by default.
         agentRetentionDays: 3,
+        // On because it is the historical behaviour — defaulting off would silently hold every existing
+        // sandbox's finished work on branches nobody is watching.
+        autoLand: true,
+        autoResumeOnLimit: false,
+        // On, unlike the limit resume beside it: an outage resume spends nothing the dead turn hadn't already
+        // committed, and the turns it saves are the unattended ones nobody is watching to restart by hand.
+        resumeAfterOutage: true,
     });
 });
 
 test("a key of the wrong type is still a parse failure — tolerance is for absence, not for garbage", () => {
     expect(SandboxSettingsSchema.safeParse({ iqSearch: "yes" }).success).toBe(false);
     expect(SandboxSettingsSchema.safeParse({ outputHoldout: 4 }).success).toBe(false);
+    // The prompt cap is a real bound, not advice: the text IS the system prompt, and every turn pays for it.
+    expect(SandboxSettingsSchema.safeParse({ systemPrompt: "x".repeat(20001) }).success).toBe(false);
 });