@intentic/sandbox-contract 1.165.0 → 1.167.0

package/src/agent-catalog.ts

@@ -42,7 +42,7 @@ export const PROVIDER_ACCESS: Record<NativeProvider, ProviderAccess> = {
     claude: { kind: "subscription", requirement: "Claude subscription", runs: "Claude Code" },
     codex: { kind: "subscription", requirement: "ChatGPT subscription", runs: "Codex" },
     grok: { kind: "subscription", requirement: "SuperGrok subscription", runs: "Grok" },
-    kimi: { kind: "key", requirement: "Moonshot API key", runs: "Kimi Code" },
+    kimi: { kind: "subscription", requirement: "Kimi Code subscription", runs: "Kimi Code" },
     gemini: { kind: "free", requirement: "Google sign-in", runs: "Gemini, Claude and GPT-OSS under Claude Code" },
 };
 
@@ -71,8 +71,8 @@ export const HARNESSES: readonly { label: string; value: AgentHarness }[] = [
 
 // Whether a turn on this provider/harness pair ACTUALLY runs the Claude Code Agent SDK loop — which is not the
 // same question as `harness === "claude-code"`. Claude is always its own Claude Code loop, and kimi/gemini have
-// no native runtime at all (Moonshot speaks the Anthropic protocol directly; Google is re-served through the
-// translator), so all three run it whatever harness the client happened to send; only codex/grok have a native
+// no native runtime at all (both are re-served through the translator), so all three run it whatever harness the
+// client happened to send; only codex/grok have a native
 // runtime to switch away from. An ACP agent runs its own loop and is never one of these.
 //
 // Everything the SDK loop owns keys off this: the SteeringQueue that makes mid-turn injection possible, and the
@@ -114,13 +114,8 @@ export const modelsFor = (provider: AgentProvider): CatalogOption[] => {
 // the only constrained tier and it fails two ways: no non-Claude scale HAS it, and Claude's API rejects it
 // outright when extended thinking is disabled ("effort 'max' is not supported when thinking is disabled on this
 // model" — a 400 that kills the turn before the model sees it, surfacing only as the SDK's `unknown` error
-// category). Every point where a selection can land on an invalid pair — restore from storage, provider switch,
-// thinking toggle, the picker's own option list — runs the pair through here, so the combination is unreachable
-// rather than merely discouraged.
+// category). It is the one rule a MODEL's published tier list can't express — the daemon reports what a model
+// accepts without knowing this turn's thinking setting — so the consumer that assembles the offered scale
+// (effortsFor, web-side) filters through here, and the clamp over that scale makes the pair unreachable.
 export const effortAllowed = (effort: string, provider: AgentProvider, thinking: boolean): boolean =>
     effort !== "max" || (provider === "claude" && thinking);
-
-// The tier a selection falls back to when effortAllowed rejects it — one rung down from 'max', the top of every
-// scale that excludes it.
-export const clampEffort = (effort: string, provider: AgentProvider, thinking: boolean): string =>
-    effortAllowed(effort, provider, thinking) ? effort : "xhigh";

package/src/contracts/agents.contract.ts

@@ -20,19 +20,21 @@ import {
     OkSchema,
 } from "../schemas.js";
 
-// The fleet: every registered conversation-agent (see AgentSummarySchema). `diff` is the conversation
-// worktree's CUMULATIVE multi-repo delta vs its recorded per-repo bases — one flat change set per repo
+// The fleet: every registered conversation-agent (see AgentSummarySchema). Registry-level actions (read,
+// rename, seen, archive) apply uniformly. For branch-backed conversations, `diff` is the worktree's CUMULATIVE
+// multi-repo delta vs its recorded per-repo bases — one flat change set per repo
 // (AgentChanges), each file flagged `landed` or not, deliberately not the working tree's staged/unstaged
 // shape: a worktree the user never checks out has no index they could stage into. `land` merges the worktree
 // branches into the main tree (per-repo, conflicts reported, nothing lost on failure); `discard` removes
-// worktrees + branches + registry entry. An unknown {id} is NOT_FOUND; land/discard while the turn runs is CONFLICT.
+// worktrees + branches + registry entry. Those branch actions reject workspace conversations explicitly. An
+// unknown {id} is NOT_FOUND; land/discard while the turn runs is CONFLICT.
 // `rename` sets the user-chosen display title — legal mid-turn (it touches no worktree state).
 // `seen`/`seenAll` stamp the read marker behind the cards' unread badge (AgentSummarySchema.seenAt) — also
 // legal mid-turn, and like `rename` they never bump `updatedAt` (reading is not activity).
 //
-// ARCHIVE is the non-destructive counterpart to discard, and the one the board leans on: `archive` commits
-// whatever the worktree still holds onto agent/<id>, drops the CHECKOUT (the expensive part — one file tree
-// per repo per agent) and keeps the branch, the entry, and the transcript. `list` then stops carrying it and
+// ARCHIVE is the non-destructive counterpart to discard, and the one the board leans on: for an isolated
+// conversation, `archive` commits whatever the worktree still holds onto agent/<id> and drops the CHECKOUT;
+// for a workspace conversation it has no git teardown. Both keep the entry and transcript. `list` stops carrying it and
 // `archived` does; `unarchive` puts it back, and either way the next turn re-attaches a worktree from the
 // surviving branch. Archiving a running agent is CONFLICT, same as land/discard.
 //

package/src/contracts/ci.contract.ts

@@ -1,5 +1,5 @@
 import { oc } from "@orpc/contract";
-import { CiFixResponseSchema, CiJobsResponseSchema, CiRunParamSchema, CiRunsResponseSchema, OkSchema } from "../schemas.js";
+import { CiFixResponseSchema, CiJobsResponseSchema, CiRunParamSchema, CiRunsResponseSchema, CiSeenResponseSchema, OkSchema } from "../schemas.js";
 
 // Pipelines on the workspace repos' github/gitlab remotes. `runs` serves the Pipelines rail view (cache +
 // on-demand backfill; per-repo webhook warnings ride along); `rerun`/`cancel` proxy to the vendor; `fix`
@@ -12,4 +12,8 @@ export const ciContract = {
     cancel: oc.route({ method: "POST", path: "/ci/runs/cancel" }).input(CiRunParamSchema).output(OkSchema),
     jobs: oc.route({ method: "POST", path: "/ci/runs/jobs" }).input(CiRunParamSchema).output(CiJobsResponseSchema),
     fix: oc.route({ method: "POST", path: "/ci/fix" }).input(CiRunParamSchema).output(CiFixResponseSchema),
+    // "I have looked at the pipelines" — what silences the rail badge for breakages already read. No input:
+    // the surface is read as a whole, and the daemon stamps its own clock so a skewed browser can't mark
+    // future failures as already seen.
+    seen: oc.route({ method: "POST", path: "/ci/seen" }).output(CiSeenResponseSchema),
 };

package/src/contracts/gate.contract.ts

@@ -0,0 +1,19 @@
+import { oc } from "@orpc/contract";
+import { GateVerdictSchema, OkSchema } from "../schemas.js";
+
+// The landing gate — the check command run over the composite of landed work once the fleet goes quiet (see
+// GateVerdictSchema for where this sits and why). Four verbs, all about ONE verdict: the gate answers about the
+// main working tree, of which there is exactly one, so nothing here is addressed by id.
+//
+// `verdict` is the one read, and the panel polls it; it recomputes staleness per call, so a passed verdict stops
+// claiming a green light the moment the tree moves under it. The three writes answer `ok` and nothing else —
+// each starts work that outlives the request, so there is no result to return and the poll is what reports.
+// `run` arms nothing and waits for nothing: it starts the check now, the user's own "I'm about to commit, check
+// this". `fix` opens a seeded workspace conversation for a red verdict; it has the same registry lifecycle as
+// /ci/fix, minus the isolated worktree it must not have.
+export const gateContract = {
+    verdict: oc.route({ method: "GET", path: "/gate/verdict" }).output(GateVerdictSchema),
+    run: oc.route({ method: "POST", path: "/gate/run" }).output(OkSchema),
+    cancel: oc.route({ method: "POST", path: "/gate/cancel" }).output(OkSchema),
+    fix: oc.route({ method: "POST", path: "/gate/fix" }).output(OkSchema),
+};

package/src/contracts/kimi.contract.ts

@@ -1,26 +1,9 @@
 import { oc } from "@orpc/contract";
-import {
-    AccountIdSchema,
-    AccountRenameSchema,
-    KimiConnectSchema,
-    ModelsSchema,
-    OauthAccountListSchema,
-    OauthAccountSchema,
-    OkSchema,
-} from "../schemas.js";
+import { ModelsSchema } from "../schemas.js";
 
-// Kimi Code (Moonshot) — the sandbox owns the credential, an API key rather than an OAuth grant. Kimi speaks the
-// Anthropic Messages protocol, so a Kimi turn runs on the SAME Claude Code harness as Claude, with the harness
-// pointed at Moonshot's Anthropic-compatible endpoint and authenticated with the stored key (see agent.routes).
-// `connect` stores a pasted key as a new account and returns it; `models` is the live catalog for the picker;
-// `accounts` lists connected keys (tokens never ride back); `rename` renames one (a pasted key carries no
-// identity to derive a name from, so this is the ONLY way a Kimi row gets a distinguishing name);
-// `disconnect` clears the one named by id.
+// Kimi Code's picker catalog. Authentication and accounts belong to the bundled translator just like the other
+// routed subscriptions (translator.contract.ts); this provider-specific route only projects CLIProxyAPI's Kimi
+// model definitions into the shared picker shape.
 export const kimiContract = {
-    connect: oc.route({ method: "POST", path: "/kimi/account/connect" }).input(KimiConnectSchema).output(OauthAccountSchema),
-    // Kimi/Moonshot's live models for the picker — the source of valid ids (see kimi-models.ts).
     models: oc.route({ method: "GET", path: "/kimi/models" }).output(ModelsSchema),
-    accounts: oc.route({ method: "GET", path: "/kimi/accounts" }).output(OauthAccountListSchema),
-    rename: oc.route({ method: "POST", path: "/kimi/account/rename" }).input(AccountRenameSchema).output(OauthAccountSchema),
-    disconnect: oc.route({ method: "POST", path: "/kimi/account/disconnect" }).input(AccountIdSchema).output(OkSchema),
 };

package/src/contracts/system.contract.ts

@@ -2,6 +2,8 @@ import { eventIterator, oc } from "@orpc/contract";
 import { z } from "zod";
 import { SystemEventSchema } from "../events.js";
 import {
+    BrowserNameParamSchema,
+    BrowsersListSchema,
     DaemonSessionSchema,
     HostTunnelInputSchema,
     HostTunnelSchema,
@@ -38,4 +40,11 @@ export const systemContract = {
     // (browser fetch sends the header), unlike the header-less WS route which app.ts exempts.
     terminals: oc.route({ method: "GET", path: "/system/terminals" }).output(TerminalsListSchema),
     killTerminal: oc.route({ method: "DELETE", path: "/system/terminals/{name}" }).input(TerminalNameParamSchema).output(OkSchema),
+    // The agent's live Chromiums and the pages each has open — the Browsers view's roster, polled while it is on
+    // screen and by the rail so its tile can appear the moment a turn starts browsing. The frames are the
+    // separate /system/browser-view WebSocket; this is the control plane, exactly as `terminals` is for tmux.
+    // `closeBrowser` shuts one Chromium down: the agent's next browser tool call then fails as if it had crashed,
+    // which is the honest account of the owner pulling the plug.
+    browsers: oc.route({ method: "GET", path: "/system/browsers" }).output(BrowsersListSchema),
+    closeBrowser: oc.route({ method: "DELETE", path: "/system/browsers/{name}" }).input(BrowserNameParamSchema).output(OkSchema),
 };

package/src/contracts/translator.contract.ts

@@ -7,12 +7,10 @@ import { KeyedProviderSchema, OkSchema, TranslatorAccountsSchema, TranslatorComp
 // than an API key. A provider can hold several accounts side by side (the translator balances across them);
 // `accounts` lists what's connected per provider and `disconnect` clears ONE account by its auth-file `name`.
 //
-// Two login shapes ride one pair of routes. Codex and Grok mint a one-time device `code`: the user enters it at
-// the provider's site and the translator polls to completion in the background, so the UI just polls `accounts`
-// and `complete` is never called. Google has no device flow — it redirects the browser to a loopback URL this
-// sandbox can't receive — so its `connect` returns an EMPTY code, the card asks the user to paste the URL they
-// landed on, and `complete` hands it to the translator to finish the exchange. The card branches on that empty
-// code rather than on the provider id, so a provider that later gains a device flow needs no UI change.
+// Two login shapes ride one pair of routes. Codex, Grok and Kimi use device authorization: the translator polls
+// to completion in the background, so the UI only polls `accounts`. Google redirects the browser to a loopback
+// URL this sandbox can't receive, so `complete` hands the landing URL to the translator. `connect.flow` tells the
+// card which mechanic it received without inferring it from whether an optional device code happened to exist.
 export const translatorContract = {
     accounts: oc.route({ method: "GET", path: "/translator/accounts" }).output(TranslatorAccountsSchema),
     connect: oc

package/src/events.ts

@@ -262,12 +262,14 @@ export const AgentEventSchema = z.discriminatedUnion("kind", [
      * actually loses the work — so the wait has to be visible, with its own next-attempt clock.
      *
      * `attempt`/`maxAttempts` are the harness's own counters; `nextAttemptAt` (epoch ms) is when it will try
-     * again, so the readout counts down instead of freezing on a number nobody can interpret. */
+     * again, so the readout counts down instead of freezing on a number nobody can interpret. Optional because
+     * only Claude's harness reports the delay: Codex says which attempt it is on and nothing else
+     * (codex-agent.ts), and inventing a countdown for it would be a clock the retry never keeps. */
     z.object({
         kind: z.literal("provider_retry"),
         attempt: z.number(),
         maxAttempts: z.number(),
-        nextAttemptAt: z.number(),
+        nextAttemptAt: z.number().optional(),
         // The HTTP status behind it when there was one (529 reads as capacity, 500 as a fault — the client says
         // which). Absent for a transport failure that never got a response.
         status: z.number().optional(),
@@ -348,7 +350,8 @@ export const AgentEventSchema = z.discriminatedUnion("kind", [
         // provider outage, because the client's reading of them is the same: "scheduled" = the resume is armed
         // and this turn comes back by itself; "available" = the daemon remembered the failed turn and turning
         // the setting on (autoResumeOnLimit / resumeAfterOutage) arms that same resume, which is what the
-        // chat's offer banner hangs off. Absent ⇒ there is nothing to resume.
+        // chat's offer banner hangs off. Absent normally means there is nothing automatic to resume; the
+        // usage-limit feature gate also leaves it absent while preserving the explicit account-switch path.
         autoResume: z.enum(["scheduled", "available"]).optional(),
         /* provider-outage only: the shape of the wait. `retryAt` (epoch seconds) is when the next attempt is
          * due — not a fixed cadence, because an outage has no reset instant to aim at and hammering a provider
@@ -395,19 +398,63 @@ export type IntenticLine = z.infer<typeof IntenticLineSchema>;
 export const HeartbeatSchema = z.object({ kind: z.literal("heartbeat") });
 export type Heartbeat = z.infer<typeof HeartbeatSchema>;
 
+// One step of the daemon's boot chain. `key` is the stable id the daemon declares it under, `label` the words
+// the browser shows. A step that FAILED is still a step that finished — the boot chain is log-and-continue by
+// design (see main.ts), so a failure degrades one subsystem rather than holding the gate closed forever.
+export const BootStepSchema = z.object({
+    key: z.string(),
+    label: z.string(),
+    state: z.enum(["pending", "running", "done", "failed"]),
+    // Elapsed ms, once the step has finished.
+    ms: z.number().optional(),
+});
+export type BootStep = z.infer<typeof BootStepSchema>;
+
+/* WHERE THE DAEMON IS IN ITS BOOT. The listeners come up before the state they serve has converged (main.ts:
+ * "listen first, converge behind the gate"), which is what stops a restart from reading as an outage — but it
+ * also means the daemon spends the first seconds of every boot both reachable and unable to answer, and until
+ * this frame existed the browser had no way to tell that apart from a healthy sandbox. It painted an operable
+ * workspace off its persisted cache and then parked every request the user made against the readiness gate.
+ *
+ * The step list is declared UP FRONT and sent whole, pending entries included, so the browser can say "4 of 11,
+ * loading the conversation registry" rather than "something is happening" — a boot that takes minutes has one
+ * slow step, and naming it is the whole point. Snapshot-not-diff, like every other roster on this stream. */
+export const BootProgressSchema = z.object({
+    // False only while the chain is still converging. The browser holds every daemon read until this is true.
+    ready: z.boolean(),
+    // Epoch ms the daemon started converging, so the browser can show a total elapsed that survives a reconnect.
+    startedAt: z.number(),
+    steps: z.array(BootStepSchema),
+});
+export type BootProgress = z.infer<typeof BootProgressSchema>;
+
+// Pushed on every step transition and once more when the gate opens. Rides /events, which answers before the
+// gate precisely so this can be delivered while everything else waits.
+export const BootSchema = z.object({ kind: z.literal("boot"), ...BootProgressSchema.shape });
+export type Boot = z.infer<typeof BootSchema>;
+
 // The stream's first frame: the workspace's stable identity, minted at the first boot of an empty /work. The
 // browser remembers it per sandbox id and drops that sandbox's persisted query cache when it changes — a wiped
 // and recreated workspace (cleanup.sh + reconnect keeps the same sandbox id) must not be painted from the
-// previous workspace's cache.
+// previous workspace's cache. `build` is the same guard against a different axis: the daemon's own compiled
+// tree, so an image update (or a `pnpm build:sandbox` swap in dev) drops what the browser cached from the
+// PREVIOUS build instead of hydrating payloads the new one no longer shapes that way.
 //
 // It also advertises `routes` — the contract route names (`vpn.list`, `kimi.models`) this daemon actually
 // implements, from ITS build of the contract. A browser is routinely newer than the daemon it talks to (a
 // released app plane serves whatever image each user last pulled; in local dev the web app is always ahead of
 // the last `pnpm build:sandbox`), and that stays fully supported — the browser just compares the two sets so a
 // route the daemon predates surfaces as a named, explained gap instead of a bare 404 nobody can attribute.
-// Optional: a daemon built before this field simply advertises nothing, and every route is assumed present,
-// which is exactly the pre-existing behaviour.
-export const HelloSchema = z.object({ kind: z.literal("hello"), workspaceId: z.string(), routes: z.array(z.string()).optional() });
+//
+// Every added field is optional: a daemon built before one simply says nothing, and the browser's fallback is
+// the pre-existing behaviour — routes all assumed present, the daemon assumed ready, the cache left alone.
+export const HelloSchema = z.object({
+    kind: z.literal("hello"),
+    workspaceId: z.string(),
+    routes: z.array(z.string()).optional(),
+    build: z.string().optional(),
+    boot: BootProgressSchema.optional(),
+});
 export type Hello = z.infer<typeof HelloSchema>;
 
 // The FULL discovered repo set (sorted root-relative ids), pushed whenever it changes — a clone, a scaffold,
@@ -457,12 +504,13 @@ export type Presence = z.infer<typeof PresenceSchema>;
 export const AgentsSchema = z.object({ kind: z.literal("agents"), agents: z.array(AgentSummarySchema), rev: z.number() });
 export type Agents = z.infer<typeof AgentsSchema>;
 
-// The /events stream union: the hello identity frame, then liveness heartbeats interleaved with
+// The /events stream union: the hello identity frame, then liveness heartbeats interleaved with boot progress,
 // workspace-change batches, repo-set snapshots, and presence + fleet roster snapshots. oRPC validates every
 // yielded frame against this, so all kinds must live here.
 export const SystemEventSchema = z.discriminatedUnion("kind", [
     HelloSchema,
     HeartbeatSchema,
+    BootSchema,
     WorkspaceChangedSchema,
     ReposChangedSchema,
     PresenceSchema,

package/src/index.ts

@@ -10,6 +10,7 @@ import { claudeContract } from "./contracts/claude.contract.js";
 import { codexContract } from "./contracts/codex.contract.js";
 import { draftsContract } from "./contracts/drafts.contract.js";
 import { extensionsContract } from "./contracts/extensions.contract.js";
+import { gateContract } from "./contracts/gate.contract.js";
 import { geminiContract } from "./contracts/gemini.contract.js";
 import { gitContract } from "./contracts/git.contract.js";
 import { grokContract } from "./contracts/grok.contract.js";
@@ -41,6 +42,7 @@ export { claudeContract } from "./contracts/claude.contract.js";
 export { codexContract } from "./contracts/codex.contract.js";
 export { draftsContract } from "./contracts/drafts.contract.js";
 export { extensionsContract } from "./contracts/extensions.contract.js";
+export { gateContract } from "./contracts/gate.contract.js";
 export { geminiContract } from "./contracts/gemini.contract.js";
 export { gitContract } from "./contracts/git.contract.js";
 export { grokContract } from "./contracts/grok.contract.js";
@@ -92,6 +94,7 @@ export const sandboxContract = {
     settings: settingsContract,
     intentic: intenticContract,
     gemini: geminiContract,
+    gate: gateContract,
     git: gitContract,
     grok: grokContract,
     kimi: kimiContract,

package/src/model-order.test.ts

@@ -7,37 +7,42 @@ import { compareCheapestFirst, compareModelIds, compareUnrankedModelIds, familyO
  * conversations on whichever id sorted first. */
 
 // A Codex catalog exactly as an OpenAI-compatible /v1/models hands it over: alphabetical, i.e. meaningless.
-const CODEX = ["gpt-5.1-codex", "gpt-5.4-mini", "gpt-5.5", "gpt-5.6-sol", "gpt-5.6-terra"];
+const CODEX = ["gpt-5.1-codex", "gpt-5.4-mini", "gpt-5.5", "gpt-5.6-luna", "gpt-5.6-sol", "gpt-5.6-terra"];
 
 test("ranks the frontier line above the cheap one and the newest release above its predecessors", () => {
     // The base line (no tier word) leads, newest first; the mini rung sinks under all of it regardless of how
     // recently it shipped — which is the whole decision a user makes in this list.
-    expect(CODEX.toSorted(compareModelIds)).toEqual(["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.5", "gpt-5.1-codex", "gpt-5.4-mini"]);
+    expect(CODEX.toSorted(compareModelIds)).toEqual(["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.5", "gpt-5.1-codex", "gpt-5.4-mini"]);
 });
 
-test("lands the same models at the head and the tail whichever order the endpoint listed them in", () => {
-    // Arrival order survives only as the tiebreak between two ids the rule ranks equally (the 5.6 siblings), so
-    // an alphabetical registry and a reversed one can no longer disagree about which model the group opens on.
+test("orders a release's named tiers strongest-first whichever order the endpoint listed them in", () => {
     for (const arrival of [CODEX.toSorted(), CODEX.toReversed()]) {
         const ordered = arrival.toSorted(compareModelIds);
 
-        expect(ordered.slice(0, 2).toSorted()).toEqual(["gpt-5.6-sol", "gpt-5.6-terra"]);
+        expect(ordered.slice(0, 3)).toEqual(["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"]);
         expect(ordered.at(-1)).toBe("gpt-5.4-mini");
     }
 });
 
-test("an unranked catalog settles its own ties, so the SAME sibling opens the group on every refresh", () => {
-    // The measured failure: the translator's /v1/models hands sol/terra/luna back in a different order per
-    // request, and the rule above ranks all three equally — same tier, same 5.6 release. Under plain stability
-    // the catalog's head (i.e. the model a fresh conversation starts on) followed that reshuffling.
+test("keeps release-local tiers below the next generation and above the previous one", () => {
+    expect(["gpt-5.6-luna", "gpt-5.5", "gpt-5.7", "gpt-5.6-sol"].toSorted(compareModelIds)).toEqual([
+        "gpt-5.7",
+        "gpt-5.6-sol",
+        "gpt-5.6-luna",
+        "gpt-5.5",
+    ]);
+});
+
+test("the Codex release-tier order is stable across catalog refreshes", () => {
     const arrivals = [
         ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"],
         ["gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.6-sol"],
         ["gpt-5.6-luna", "gpt-5.6-sol", "gpt-5.6-terra"],
     ];
-    const heads = arrivals.map((arrival) => arrival.toSorted(compareUnrankedModelIds)[0]);
 
-    expect(new Set(heads).size).toBe(1);
+    for (const arrival of arrivals) {
+        expect(arrival.toSorted(compareUnrankedModelIds)).toEqual(["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"]);
+    }
     // Same rule, so ranking still outranks the tiebreak: the mini rung stays at the tail, under every sibling.
     expect(["gpt-5.4-mini", ...arrivals[0]!].toSorted(compareUnrankedModelIds).at(-1)).toBe("gpt-5.4-mini");
 });
@@ -68,6 +73,14 @@ test("reads each vendor's tier vocabulary, not just Claude's", () => {
     ]);
 });
 
+test("reads Kimi's k-prefixed generation so K3 leads the K2.x catalog", () => {
+    const catalog = ["kimi-k2.6", "kimi-k2.7-code-highspeed", "kimi-k3", "kimi-k2.7-code"];
+
+    expect(releaseOf("kimi-k3")).toEqual({ version: [3], date: 0 });
+    expect(familyOf("kimi-k3")).toBe(familyOf("kimi-k2.6"));
+    expect(catalog.toSorted(compareUnrankedModelIds)).toEqual(["kimi-k3", "kimi-k2.7-code", "kimi-k2.7-code-highspeed", "kimi-k2.6"]);
+});
+
 test("the rightmost tier word wins, because tier words compose", () => {
     // flash-lite is the cheap end of Flash, codex-max the frontier end of Codex — reading the leftmost word
     // instead would file both under the tier they modify.
@@ -169,6 +182,10 @@ test("finds each vendor's own cheap rung, including a re-served open-weights row
     expect(["grok-4", "grok-4-fast"].toSorted(compareCheapestFirst)[0]).toBe("grok-4-fast");
 });
 
+test("reads a release-local tier ladder from the cheap end too", () => {
+    expect(["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"].toSorted(compareCheapestFirst)[0]).toBe("gpt-5.6-luna");
+});
+
 test("falls back on the newest release for a catalog that publishes no cheap tier at all", () => {
     // Kimi names no tier word anywhere, so every row is UNRANKED and the tier term cancels. Serving the newest
     // of what it does publish is the honest answer — there is no cheaper rung to find.

package/src/model-order.ts

@@ -3,7 +3,7 @@
  *
  * Anthropic's REST /v1/models answers newest-first: that IS a provider opinion, and Claude's catalog rides it
  * (claude-models.ts). Every other provider here is read through an OpenAI-compatible /v1/models — Codex and
- * Gemini via the bundled translator, Kimi via Moonshot — or out of xAI's "Did you mean" rejection, and those
+ * Gemini and Kimi via the bundled translator — or out of xAI's "Did you mean" rejection, and those
  * endpoints publish a SET, not a ranking: they hand the ids back in whatever order their registry iterates,
  * which in practice is alphabetical. Reading that as a preference is what put "GPT 5.4 Mini" at the head of the
  * Codex group with GPT 5.6 below it, and what made a fresh Codex conversation start on whichever id happened to
@@ -14,9 +14,11 @@
  * every vendor names its models the same way — which is what lets the daemon's four catalog services and the
  * web's picker share one rule instead of each inventing a local one. */
 
-// A version-ish segment: digits and dots, optionally v-prefixed (`4`, `5.1`, `v2`, `20251001`). Everything else
-// is a NAME segment and belongs to the family — which is what makes the split below exhaustive.
-const VERSION_SEGMENT = /^v?[\d.]+$/;
+// A version-ish segment: digits and dots, optionally prefixed by the vendor's version marker (`4`, `5.1`, `v2`,
+// `k3`, `k2.7`, `20251001`). Kimi is the one provider that fuses the marker with the generation; treating `k3`
+// as a name made the current flagship look unversioned, so K2.x sorted above it. Everything else is a NAME
+// segment and belongs to the family — which is what makes the split below exhaustive.
+const VERSION_SEGMENT = /^(?:v|k)?[\d.]+$/i;
 
 // A date stamp rather than a version component: six digits or more (20251001, 250514). The distinction is not
 // cosmetic — claude-opus-4-1-20250805 (Opus 4.1) and claude-opus-4-20250514 (Opus 4.0) compare as (4,1) vs (4)
@@ -48,7 +50,7 @@ export interface ModelRelease {
 export const releaseOf = (id: string): ModelRelease => {
     const numeric = segmentsOf(id)
         .filter((segment) => VERSION_SEGMENT.test(segment))
-        .map((segment) => segment.replace(/^v/, ""));
+        .map((segment) => segment.replace(/^[vk]/i, ""));
     const stamps = numeric.filter((segment) => DATE_SEGMENT.test(segment)).map(Number);
     return {
         version: numeric
@@ -109,12 +111,21 @@ const TIER_RANK: Readonly<Record<string, number>> = {
 
 const UNRANKED = -1;
 
-// The LAST recognized word wins, because tier words compose and the rightmost is the most specific one:
-// gemini-flash-lite is the cheap end of Flash, gpt-codex-max the frontier end of Codex.
-export const tierRankOf = (family: string): number => {
+/* Some providers name a capability ladder INSIDE one release instead of using the cross-release adjectives
+ * above. Codex 5.6's Sol/Terra/Luna rows are that shape: they must remain together ahead of the older 5.5 line,
+ * but their order is not an arbitrary id tiebreak — Sol is the strongest, followed by Terra, then Luna. Keeping
+ * this as a separate rank lets release recency still win across generations (a future GPT 5.7 base model must
+ * not be buried under a recognized 5.6 suffix), while the three siblings sort by their real tier. */
+const RELEASE_TIER_RANK: Readonly<Record<string, number>> = {
+    sol: 0,
+    terra: 1,
+    luna: 2,
+};
+
+const lastRankOf = (family: string, ranks: Readonly<Record<string, number>>): number => {
     let rank = UNRANKED;
     for (const segment of family.split("-")) {
-        const found = TIER_RANK[segment];
+        const found = ranks[segment];
         if (found !== undefined) {
             rank = found;
         }
@@ -122,18 +133,32 @@ export const tierRankOf = (family: string): number => {
     return rank;
 };
 
-// The canonical order of two model ids: tier first, then release. Hand it straight to Array#toSorted — that sort
-// is stable, so two ids this rule cannot separate keep the order they arrived in (for Claude, the provider's own).
-export const compareModelIds = (left: string, right: string): number =>
-    tierRankOf(familyOf(left)) - tierRankOf(familyOf(right)) || compareRelease(releaseOf(left), releaseOf(right));
+const releaseTierRankOf = (family: string): number => lastRankOf(family, RELEASE_TIER_RANK);
+
+// The LAST recognized word wins, because tier words compose and the rightmost is the most specific one:
+// gemini-flash-lite is the cheap end of Flash, gpt-codex-max the frontier end of Codex.
+export const tierRankOf = (family: string): number => lastRankOf(family, TIER_RANK);
+
+// The canonical order of two model ids: broad tier first, then release, then a tier declared within that release.
+// Hand it straight to Array#toSorted — that sort is stable, so two ids this rule cannot separate keep the order
+// they arrived in (for Claude, the provider's own).
+export const compareModelIds = (left: string, right: string): number => {
+    const leftFamily = familyOf(left);
+    const rightFamily = familyOf(right);
+    return (
+        tierRankOf(leftFamily) - tierRankOf(rightFamily) ||
+        compareRelease(releaseOf(left), releaseOf(right)) ||
+        releaseTierRankOf(leftFamily) - releaseTierRankOf(rightFamily)
+    );
+};
 
 /* The order for a catalog its endpoint published as a SET — Codex, Gemini, Kimi and Grok, i.e. everything but
  * Anthropic's ranked list. Falling back on arrival order is what the rule above does with a tie, and for a RANKED
  * catalog that is exactly right: the tie is the provider's own opinion, so claude-opus-5 stays ahead of
  * claude-fable-5. For a set there is no opinion to keep, and the header of this file assumed the leftover order
- * was at least alphabetical — it is not. A subscription vending sol/terra/luna (same tier, same 5.6 release, three
- * ids this rule cannot separate) hands its rows back in whatever order its registry iterated THIS request, so the
- * tie decided which model a fresh conversation opened on AND flipped between catalog refreshes.
+ * was at least alphabetical — it is not. A subscription can hand tied rows back in whatever order its registry
+ * iterated THIS request, so the tie decides which model a fresh conversation opens on and can flip between
+ * catalog refreshes.
  *
  * So a set breaks its own ties on the id. Which sibling that seats first is arbitrary — but it is the same
  * arbitrary answer every refresh, which is the property `default` actually needs. */
@@ -151,5 +176,12 @@ export const compareUnrankedModelIds = (left: string, right: string): number =>
  * not the efficient rung — and the cheap end is only ever a family whose tier word is actually recognized.
  * Falling off the end of a catalog with no efficient tier at all (Kimi publishes none) is then honest: the
  * newest of what it does publish, chosen by the release tiebreak below. */
-export const compareCheapestFirst = (left: string, right: string): number =>
-    tierRankOf(familyOf(right)) - tierRankOf(familyOf(left)) || compareRelease(releaseOf(left), releaseOf(right));
+export const compareCheapestFirst = (left: string, right: string): number => {
+    const leftFamily = familyOf(left);
+    const rightFamily = familyOf(right);
+    return (
+        tierRankOf(rightFamily) - tierRankOf(leftFamily) ||
+        compareRelease(releaseOf(left), releaseOf(right)) ||
+        releaseTierRankOf(rightFamily) - releaseTierRankOf(leftFamily)
+    );
+};

package/src/quick-model.test.ts

@@ -9,7 +9,7 @@ import { type QuickModelSource, quickModelKey, resolveQuickModel } from "./quick
 const CLAUDE: QuickModelSource = { provider: `claude`, ready: true, models: [`claude-opus-5`, `claude-sonnet-5`, `claude-haiku-4-5-20251001`] };
 const GOOGLE: QuickModelSource = { provider: `gemini`, ready: true, models: [`gemini-3-flash`, `gemini-3-flash-lite`, `gemini-3-pro`] };
 const CODEX: QuickModelSource = { provider: `codex`, ready: true, models: [`gpt-5.4-mini`, `gpt-5.6`] };
-const KIMI: QuickModelSource = { provider: `kimi`, ready: true, models: [`kimi-k2-0711-preview`, `kimi-k2-0905-preview`] };
+const KIMI: QuickModelSource = { provider: `kimi`, ready: true, models: [`kimi-k2.6`, `kimi-k2.7-code`, `kimi-k3`] };
 
 const offline = (source: QuickModelSource): QuickModelSource => ({ ...source, ready: false });
 
@@ -31,7 +31,7 @@ test("puts tier ahead of cost — a free frontier model is still the wrong tool
     expect(resolveQuickModel([CLAUDE, proOnly], ``)).toEqual({ provider: `claude`, model: `claude-haiku-4-5-20251001` });
 });
 
-test("prefers a subscription to a metered key at equal tier, since only one of them charges per click", () => {
+test("uses stable provider order when two subscriptions offer the same tier", () => {
     const kimiCheap: QuickModelSource = { provider: `kimi`, ready: true, models: [`kimi-k2-mini`] };
     const claudeCheap: QuickModelSource = { provider: `claude`, ready: true, models: [`claude-haiku-4-5`] };
 
@@ -72,7 +72,7 @@ test("ignores a malformed pin instead of running an empty model id", () => {
 
 test("serves the newest of a catalog that publishes no cheap tier at all", () => {
     // Kimi names no tier word anywhere. There is no cheaper rung to find, so the newest row is the honest answer.
-    expect(resolveQuickModel([KIMI], ``)).toEqual({ provider: `kimi`, model: `kimi-k2-0905-preview` });
+    expect(resolveQuickModel([KIMI], ``)).toEqual({ provider: `kimi`, model: `kimi-k3` });
 });
 
 test("reports nothing when no account is connected, so the button can say so instead of failing on click", () => {

package/src/schemas.test.ts

@@ -21,6 +21,8 @@ test("a payload from a build that predates a toggle parses, with the new toggle
     expect(SandboxSettingsSchema.parse(older)).toEqual({
         ...older,
         terseHoldout: 0,
+        iqContext: false,
+        iqContextHoldout: 0,
         filterBackend: "native",
         systemPromptMode: "intentic",
         systemPrompt: "",
@@ -30,6 +32,10 @@ test("a payload from a build that predates a toggle parses, with the new toggle
         autoResumeOnLimit: false,
         resumeAfterOutage: true,
         autoResumeOnRestart: true,
+        gateCommand: "",
+        gateQuietMs: 20_000,
+        gateTimeoutMs: 900_000,
+        gateAutoFix: true,
     });
 });
 
@@ -42,6 +48,10 @@ test("an empty object is the full default settings object", () => {
         // Off: the steer's turn-level control spends the tokens it measures, so measuring is opt-in.
         terseHoldout: 0,
         iqSearch: false,
+        // Off, and its holdout with it: pre-injection spends input tokens on every eligible turn, and the
+        // control that would tell you whether they paid for themselves costs the turns it measures.
+        iqContext: false,
+        iqContextHoldout: 0,
         outputCleaners: "off",
         outputHoldout: 0,
         filterBackend: "native",
@@ -65,6 +75,12 @@ test("an empty object is the full default settings object", () => {
         // On: a daemon restart is usually intentic's own doing (an image update, an approved environment
         // change), not the user's decision, so the turn it interrupted resumes rather than staying stuck.
         autoResumeOnRestart: true,
+        // Empty disables the landing gate until the owner supplies this workspace's verification command.
+        gateCommand: "",
+        gateQuietMs: 20_000,
+        gateTimeoutMs: 900_000,
+        // Once a gate is configured, a red verdict wakes one fixer by default.
+        gateAutoFix: true,
     });
 });
 
@@ -74,3 +90,7 @@ test("a key of the wrong type is still a parse failure — tolerance is for abse
     // The prompt cap is a real bound, not advice: the text IS the system prompt, and every turn pays for it.
     expect(SandboxSettingsSchema.safeParse({ systemPrompt: "x".repeat(20001) }).success).toBe(false);
 });
+
+test("usage-limit auto-resume stays off while the feature is disabled, including for an older saved true value", () => {
+    expect(SandboxSettingsSchema.parse({ autoResumeOnLimit: true }).autoResumeOnLimit).toBe(false);
+});