@intentic/sandbox-contract 1.176.3 → 1.209.1

package/src/agent-catalog.ts

@@ -1,8 +1,16 @@
-import { type AgentHarness, type AgentProvider, type Model, NATIVE_PROVIDERS, type NativeProvider, type PermissionMode } from "./schemas.js";
+import {
+    type AgentHarness,
+    type AgentProvider,
+    type Model,
+    type ModelBadge,
+    NATIVE_PROVIDERS,
+    type NativeProvider,
+    type PermissionMode,
+} from "./schemas.js";
 
 /* The provider / harness / model catalog every picker shares (the chat menu, the automations dialog) — pure
  * data keyed by the wire vocabulary in schemas.ts, so the surfaces can't drift. Live state stays with the
- * consumer (native Grok's model list is the daemon's /grok/models catalog, layered on top of modelsFor by the
+ * consumer (native Grok's model list is the daemon's own catalog for it, layered on top of modelsFor by the
  * web; ACP providers are merged in from the installed `agent` capabilities). */
 
 export interface CatalogOption {
@@ -46,6 +54,17 @@ export const PROVIDER_ACCESS: Record<NativeProvider, ProviderAccess> = {
     gemini: { kind: "free", requirement: "Google sign-in", runs: "Gemini, Claude and GPT-OSS under Claude Code" },
 };
 
+/* THE PROVIDERS THAT COST NOTHING — derived from the table above rather than named a second time, and read by
+ * every surface that LEADS with a free option instead of merely labelling one.
+ *
+ * The distinction is worth the export. `accessBadge` answers "what does this row cost" for a row the user is
+ * already looking at; this answers "which row should a user who has connected nothing be shown FIRST", which is
+ * the connect gate's whole job. Ranking the one free channel fifth among five equal buttons is how a user with
+ * no subscription concluded the product needed one. Deriving the list keeps that promotion honest: a channel
+ * that stops being free stops being promoted, from one edit to PROVIDER_ACCESS. */
+export const FREE_PROVIDERS: readonly NativeProvider[] = NATIVE_PROVIDERS.filter((provider) => PROVIDER_ACCESS[provider].kind === "free");
+export const isFreeProvider = (provider: AgentProvider): boolean => FREE_PROVIDERS.includes(provider as NativeProvider);
+
 /* WHOSE ALLOWANCE A TURN ON THIS PROVIDER SPENDS, as the subject of a sentence — a third naming of the same
  * five ids, and the third is not redundancy. PROVIDERS names the RUNTIME the user picks ("Claude Code", "Kimi
  * Code") and PROVIDER_ACCESS.requirement names the thing they CONNECT ("Claude subscription", "Google sign-in");
@@ -81,6 +100,26 @@ export const ACCESS_COST: Record<AccessKind, number> = { free: 0, subscription:
  * splits a pinned selection on the FIRST colon. `endpoint:ollama:qwen3` would parse as provider "endpoint" with
  * model "ollama:qwen3" — a pin that silently resolves to nothing. The capability id (entryId) excludes both
  * characters, so `endpoint/<id>` stays unambiguous in either direction. */
+/* THE FREE TRIAL'S ENDPOINT ID IS RESERVED, the way `pi` is — an `endpoint`-kind capability like any model API
+ * the user configured, except that this one is provisioned by the DAEMON rather than added by a person, and it
+ * points at intentic's own pool (see the sandbox's trial/ and the platform's /trial routes).
+ *
+ * Riding the endpoint kind is the entire reason the trial needed no new turn path, no new provider and no new
+ * adapter: the translator already re-serves an OpenAI-compatible upstream to the Claude Code loop, so a trial
+ * turn is an endpoint turn and everything downstream — catalog, picker, routing — works unchanged.
+ *
+ * What the reserved id buys is the part that must NOT look the same. A trial turn passes through intentic's
+ * servers, which no other provider in this product does, and a user cannot consent to something they were not
+ * told. So every surface that names a provider asks `isTrialProvider` and says so, and the id is here — beside
+ * the vocabulary those surfaces already read — rather than spelled out in each of them. */
+export const TRIAL_ENDPOINT_ID = "free-trial";
+export const TRIAL_PROVIDER = "endpoint/free-trial";
+export const isTrialProvider = (provider: AgentProvider): boolean => provider === TRIAL_PROVIDER;
+// What the picker calls it, and the sentence the surfaces put underneath. One wording, so the composer's notice
+// and the picker's row cannot end up describing different bargains.
+export const TRIAL_LABEL = "Free trial";
+export const TRIAL_NOTICE = "Trial messages pass through intentic's servers. Connect an account to chat directly.";
+
 export const ENDPOINT_PROVIDER_PREFIX = "endpoint/";
 export const endpointProvider = (id: string): AgentProvider => `${ENDPOINT_PROVIDER_PREFIX}${id}`;
 export const isEndpointProvider = (provider: AgentProvider): boolean => provider.startsWith(ENDPOINT_PROVIDER_PREFIX);
@@ -119,9 +158,15 @@ export const PLAN_LIMIT_PROVIDERS: readonly NativeProvider[] = ["claude", "codex
 export const reportsPlanLimits = (provider: AgentProvider): boolean => PLAN_LIMIT_PROVIDERS.includes(provider as NativeProvider);
 
 // The harness (agentic loop) a turn runs on, orthogonal to the provider. `native` = the provider's own runtime;
-// `claude-code` = the Claude Code loop for any provider (codex/grok then route through the translator). Only
-// surfaced for codex/grok — claude is always its own Claude Code loop, and kimi/gemini have no native runtime
-// to switch to (both only exist under this harness). See AgentHarness in schemas.ts.
+// `claude-code` = the Claude Code loop for any provider (codex/grok then route through the translator).
+// Surfaced for codex/grok alone. Claude is always its own Claude Code loop; kimi has no native runtime to switch
+// to (it only exists under this harness); and GEMINI IS THE MIRROR OF KIMI — it only exists under its native
+// one, because Google refuses Claude Code's traffic outright (capabilitiesOf says why). See AgentHarness in
+// schemas.ts.
+//
+// Gemini's `native` is OpenCode rather than a Google CLI: the image ships no Gemini binary, and OpenCode is
+// already here driving Grok. It spends the same translator accounts a routed turn would have — what Google
+// refuses is the loop, never the credential.
 export const HARNESSES: readonly { label: string; value: AgentHarness }[] = [
     { label: "Native", value: "native" },
     { label: "Claude Code", value: "claude-code" },
@@ -129,8 +174,8 @@ export const HARNESSES: readonly { label: string; value: AgentHarness }[] = [
 
 /* WHAT A PROVIDER/HARNESS PAIR CAN ACTUALLY DO — one declaration, read by both sides of the wire.
  *
- * Four runtimes serve turns behind one seam (AgentRequest in, AgentEvent frames out): the Claude Code Agent SDK
- * loop, Codex's exec surface, OpenCode, and any ACP agent. They do NOT do the same things, and for a long time
+ * Five runtimes serve turns behind one seam (AgentRequest in, AgentEvent frames out): the Claude Code Agent SDK
+ * loop, Codex app-server, OpenCode, any ACP agent, and Pi's RPC surface. They do NOT do the same things, and for a long time
  * the only thing that said so was a comment inside each adapter — "Ignores the Claude-only request fields" —
  * which no surface above it could read. So the composer offered "Ask before each file edit" on a runtime whose
  * every tool call is pre-approved, and offered a reasoning-effort scale to a runtime that drops the field.
@@ -141,13 +186,22 @@ export const HARNESSES: readonly { label: string; value: AgentHarness }[] = [
  *
  * Adding a provider is a row here, not a hunt for literals; agent-catalog.test.ts walks PROVIDERS × HARNESSES
  * and demands one, so a pair can never be silently absent. */
+
+// An execution backend: one way a turn runs work of its own, named for the AgentCapabilities.execution axis
+// and for the persona switch that grants it. Adding a language is a member here and a backend in the daemon's
+// execution/ module — never a new one-off tool wired where nothing else can see it.
+export type ExecutionBackend = "shell" | "js";
+
 export interface AgentCapabilities {
     // Which agentic loop actually serves the turn — the question "is the harness `claude-code`" only looks like.
-    // Claude is always its own Claude Code loop, and kimi/gemini have no native runtime at all (both are
-    // re-served through the translator), so all three run it whatever harness the client sent; only codex/grok
-    // have a native runtime to switch away from. Names the session store a finished conversation's transcript is
-    // backfilled from, too.
-    readonly runtime: "claude-code" | "codex" | "opencode" | "acp";
+    // Claude is always its own Claude Code loop and Kimi has no native runtime, so both run it whatever harness
+    // the client sent; codex/grok/gemini each have a native runtime to switch away from. Names the session store
+    // a finished conversation's transcript is backfilled from, too.
+    //
+    // `opencode-gemini` is the OpenCode loop pointed at Gemini rather than at xAI, and it is a SEPARATE runtime
+    // id from `opencode` on purpose: adapter health is keyed by this field (adapter-health.ts), so sharing one
+    // would make Grok's xAI credential decide whether the picker greys out Gemini, and the reverse.
+    readonly runtime: "claude-code" | "codex" | "opencode" | "opencode-gemini" | "acp" | "pi";
     // Mid-turn injection (the SteeringQueue behind /agent/steer). Needs the SDK's streaming-input mode.
     readonly steering: boolean;
     // How much of the permission-mode axis the runtime honours. "modes" = every PermissionMode, with per-tool
@@ -160,8 +214,26 @@ export interface AgentCapabilities {
     // checkouts + the browser servers; "http" = the http MCP tools alone, and only if the agent advertises http
     // MCP support; "none" = the runtime has no seam for them at all.
     readonly mcp: "full" | "http" | "none";
+    /* WHICH EXECUTION BACKENDS THE RUNTIME HOSTS — the ways a turn RUNS things, as opposed to the tools it is
+     * handed. "shell" is the runtime's own command tool (Bash on the Claude Code loop, each foreign loop's
+     * equivalent); "js" is the sandbox's JavaScript backend (execution/ in the daemon): the model writes a
+     * script instead of a command line, and the daemon runs it in a permission-fenced Node subprocess.
+     *
+     * A first-class axis rather than a corollary of `mcp`, because the two answer different questions: `mcp`
+     * says which TOOLS reach the model's context, this says which ways of EXECUTING the daemon can stand
+     * behind for this runtime — with the same guard, secret and persona seams the shell gets. A runtime that
+     * cannot host a backend simply never shows it, and the persona switch for it (PersonaPowersSchema.code)
+     * then has nothing to grant there. */
+    readonly execution: readonly ExecutionBackend[];
     // Reasoning-effort selection is forwarded to the model.
     readonly effort: boolean;
+    /* The runtime can serve a turn at fast speed when asked (AgentTurn.fast). A statement about the LOOP, not
+     * about the route: the Claude Code loop knows how to ask for it, which is why every provider this record
+     * hands the loop to reads true here — including the ones served through the translator, whose turns the
+     * harness will then refuse fast mode for because a translator endpoint is not first-party. That second
+     * question is answered where the endpoint is decided (planHarnessTurn), because it is a fact about the
+     * CREDENTIAL rather than about the runtime, and this record is a pure function of (provider, harness). */
+    readonly fastMode: boolean;
     // How an isolated conversation's worktree is enforced. "namespace" = the worktree IS /work inside the turn's
     // mount namespace (with the tool-input rewrite as the fallback when the container can't build one); "cwd" =
     // the turn is merely cwd'd into the worktree, so an absolute /work path still reaches the shared checkout —
@@ -174,6 +246,28 @@ export interface AgentCapabilities {
     // Fails with the coded frames the daemon's auto-resume keys off (rate_limit, provider-outage), so a turn the
     // provider killed is re-run once the breaker says the provider is back (turn-resume.ts).
     readonly recovery: boolean;
+    /* HOW MUCH OF ITS STANDING INSTRUCTIONS THIS RUNTIME WILL TAKE FROM US — the axis behind the sandbox's
+     * system-prompt setting (SandboxSettings.systemPromptMode) and the persona's own override.
+     *
+     * It exists because that setting was silently a Claude Code setting. The composer offers Codex, Grok and
+     * Gemini on their own runtimes, and a turn on any of them ignored the prompt the owner had written without
+     * saying so anywhere — the one failure mode a settings page cannot recover from, because nothing on screen
+     * is wrong. Naming it here means every surface reads the same answer and the daemon composes to it
+     * (agent/system-prompt.ts), rather than each learning the exception separately.
+     *
+     *   "replace" — the whole base prompt can be swapped for the owner's text, and extra guidance appended on
+     *               top of whichever base is in force. The Claude Code loop (SDK `systemPrompt`) and native
+     *               Codex (`model_instructions_file` replaces its base; `developer_instructions` adds a
+     *               developer message — both verified on the wire against codex-cli 0.147).
+     *   "append"  — extra system text only; the runtime's own base prompt stands. OpenCode takes one per
+     *               message (`system` on the prompt body), and there is no seam for replacing its base.
+     *   "none"    — no system seam at all. What must still reach the model (the persona note) rides the user
+     *               message instead, which is the door the delegation note already uses.
+     *
+     * The BASE CHOICE — Intentic's prompt or Claude Code's — is a "replace" runtime's question and, of those,
+     * only the Claude Code loop's: Codex's own base describes Codex's own tools, so swapping it for a prompt
+     * written about another harness is the owner's deliberate act (their custom text), never ours. */
+    readonly instructions: "replace" | "append" | "none";
 }
 
 // The Claude Code Agent SDK loop — the ceiling every other runtime is measured against, and the only one that
@@ -185,41 +279,78 @@ const CLAUDE_CODE: AgentCapabilities = {
     permissions: "modes",
     questions: true,
     mcp: "full",
+    // The one loop with a seam the daemon can put its own backend through — so it hosts the JS backend beside
+    // its Bash. Every other runtime below hosts only its own shell.
+    execution: ["shell", "js"],
     effort: true,
+    fastMode: true,
     isolation: "namespace",
     commands: true,
     terminals: true,
     recovery: true,
+    instructions: "replace",
 };
 
-// Codex's exec surface: item-level events, no approval channel, no MCP seam through the SDK constructor we use.
-// Reasoning effort IS forwarded (modelReasoningEffort). `codex app-server` is the upgrade path for the first two.
+// Codex app-server: item-level events plus richer request/MCP channels. This client deliberately declines
+// server-initiated approvals and has not connected questions or MCP to Intentic's policy seams, so only the
+// item stream, reasoning effort and the instruction seam are claimed here.
 const CODEX: AgentCapabilities = {
     runtime: "codex",
     steering: false,
     permissions: "plan",
     questions: false,
     mcp: "none",
+    execution: ["shell"],
     effort: true,
+    fastMode: false,
     isolation: "cwd",
     commands: false,
     terminals: false,
     recovery: false,
+    /* Both halves, through the per-thread `config` block the adapter already sends: `model_instructions_file`
+     * takes the place of Codex's own base prompt, `developer_instructions` arrives as an extra developer
+     * message ahead of its skills and team blocks. Verified against codex-cli 0.147 by reading what actually
+     * reached the wire — the keys are undocumented, and a strings dump proves only that they parse. */
+    instructions: "replace",
 };
 
-// OpenCode (the Grok runtime): its own agentic loop, its own tools, allow-all permissions. It takes a model id
-// and a prompt — no effort scale, no tools of ours, no command list.
+// OpenCode (the Grok runtime): its own agentic loop, its own tools, allow-all permissions. It takes a model id,
+// a prompt and one system message of ours — no effort scale, no tools of ours, no command list.
 const OPENCODE: AgentCapabilities = {
     runtime: "opencode",
     steering: false,
     permissions: "plan",
     questions: false,
     mcp: "none",
+    execution: ["shell"],
     effort: false,
+    fastMode: false,
     isolation: "cwd",
     commands: false,
     terminals: false,
     recovery: false,
+    // `system` on the prompt body, per message. It ADDS to OpenCode's own prompt — there is no seam for
+    // replacing that — so a custom prompt lands here as extra instructions, and the settings page says so
+    // rather than letting "replaces everything" quietly mean something else on two providers.
+    instructions: "append",
+};
+
+/* The same OpenCode loop, serving Gemini instead of xAI — identical abilities, which is the point of giving it
+ * its own row rather than its own record shape.
+ *
+ * It exists because the alternative was Gemini's ONLY route being the Claude Code loop, and that loop announces
+ * itself to whatever it is pointed at: the CLI prepends its own "You are a Claude agent, built on Anthropic's
+ * Claude Agent SDK." to every request, baked into the binary with no option to suppress it. Google's Antigravity
+ * channel matches that exact sentence and refuses the request — reported as a quota error, which sent the
+ * translator walking all 31 connected accounts looking for one with room, ~60s per attempt, none of which could
+ * ever have answered. Under this runtime the request carries OpenCode's own prompt, so the turn is simply not
+ * Claude Code traffic and the block has nothing to match.
+ *
+ * The credential is unchanged: both harnesses reach Google through the translator and the same auth files. Only
+ * the loop around the model differs. */
+const OPENCODE_GEMINI: AgentCapabilities = {
+    ...OPENCODE,
+    runtime: "opencode-gemini",
 };
 
 // Any agent speaking the Agent Client Protocol: a documented floor rather than the native ceiling. It publishes
@@ -231,17 +362,53 @@ const ACP: AgentCapabilities = {
     permissions: "plan",
     questions: false,
     mcp: "http",
+    execution: ["shell"],
     effort: false,
+    fastMode: false,
     isolation: "cwd",
     commands: true,
     terminals: true,
     recovery: false,
+    // ACP's `session/new` and `session/prompt` carry no system field: the agent owns its own instructions the
+    // same way it owns its model and its permission posture. The persona note takes the user message instead.
+    instructions: "none",
+};
+
+/* THE PI CAPABILITY ID IS RESERVED, the same way the five native ids are: an `agent`-kind capability installed
+ * under it is served over Pi's own RPC protocol rather than ACP — Pi closed ACP support deliberately (its RPC
+ * mode is the embedding surface), and the two want different records. A bare id rather than a namespace like
+ * `endpoint/`, because there is exactly one Pi runtime to name; capabilitiesOf still answers from the id alone,
+ * which is what keeps it a pure function of (provider, harness). */
+export const PI_PROVIDER = "pi";
+
+// Pi driven over its RPC mode (`pi --mode rpc`, strict-LF JSONL over stdio): above the ACP floor and below the
+// Claude Code ceiling. Its `steer` command is real mid-turn injection; `set_thinking_level` takes the effort
+// tiers; `get_commands` publishes its extension/skill commands. It has no MCP seam (Pi's own extensions are its
+// tool surface), no approval channel (plan is the shared two-phase emulation), and runs bash in-process — no
+// tmux session for the terminal panel to attach to.
+const PI: AgentCapabilities = {
+    runtime: "pi",
+    steering: true,
+    permissions: "plan",
+    questions: false,
+    mcp: "none",
+    execution: ["shell"],
+    effort: true,
+    fastMode: false,
+    isolation: "cwd",
+    commands: true,
+    terminals: false,
+    recovery: false,
+    // Pi's RPC opens a session with a prompt and steers it; nothing in that protocol sets standing
+    // instructions, so like ACP it hears the persona note through the user message.
+    instructions: "none",
 };
 
 // The pair → its record. An `endpoint/<id>` provider is a model API the user configured, driven BY the Claude
 // Code loop on either harness — so it gets that loop's full ceiling, which is the entire point of routing a
-// model through it rather than adopting a second runtime. Any other id that names no native provider is an
-// installed `agent`-kind capability, served over ACP.
+// model through it rather than adopting a second runtime. The reserved `pi` id is the Pi coding agent on its
+// own RPC runtime (harness doesn't apply — Pi is its own loop, like ACP). Any other id that names no native
+// provider is an installed `agent`-kind capability, served over ACP.
 export const capabilitiesOf = (provider: AgentProvider, harness: AgentHarness): AgentCapabilities => {
     if (provider === "codex") {
         return harness === "claude-code" ? CLAUDE_CODE : CODEX;
@@ -249,9 +416,24 @@ export const capabilitiesOf = (provider: AgentProvider, harness: AgentHarness):
     if (provider === "grok") {
         return harness === "claude-code" ? CLAUDE_CODE : OPENCODE;
     }
+    /* GEMINI IGNORES THE HARNESS, and it is the only routed provider that does. The Claude Code loop announces
+     * itself in every request it sends and Google refuses on that announcement (see OPENCODE_GEMINI), so
+     * "Gemini under Claude Code" was never a slower or poorer option — it was one that could not complete a
+     * single turn, on any of the connected accounts, ever.
+     *
+     * Answering OPENCODE_GEMINI whatever the caller asked for is what makes that structural rather than a rule
+     * each surface has to remember. Everything downstream reads the runtime off this record — the adapter that
+     * serves a turn, the transcript store, the quick helper's choice of loop — so there is exactly one place
+     * where Gemini's loop is decided, and no way left to route Claude Code traffic at Google by asking for it. */
+    if (provider === "gemini") {
+        return OPENCODE_GEMINI;
+    }
     if (isEndpointProvider(provider)) {
         return CLAUDE_CODE;
     }
+    if (provider === PI_PROVIDER) {
+        return PI;
+    }
     return (NATIVE_PROVIDERS as readonly string[]).includes(provider) ? CLAUDE_CODE : ACP;
 };
 
@@ -265,18 +447,30 @@ export const modesFor = (capabilities: AgentCapabilities): readonly PermissionMo
 export const clampMode = (mode: PermissionMode, capabilities: AgentCapabilities): PermissionMode =>
     modesFor(capabilities).includes(mode) ? mode : "bypassPermissions";
 
-// What this pair does NOT do, phrased for the person about to send a message to it — the honest half of the
-// picker, and the reason the record carries axes the daemon itself never branches on. Empty ⇒ the full ceiling.
+/* What this pair does NOT do, phrased for the person about to send a message to it — the honest half of the
+ * picker, and the reason the record carries axes the daemon itself never branches on. Empty ⇒ the full ceiling.
+ *
+ * `fastMode` is deliberately NOT disclosed here, and it is the one axis that can't be: every other axis is fully
+ * determined by the record, while fast mode also depends on the route and the model. The record says true for
+ * every provider the Claude Code loop serves — including the ones routed through the translator, which can never
+ * go fast — so a sentence derived from it would stay silent for exactly the turns that most need to hear it.
+ * fastAllowed answers the real question, and the `fast_mode` frame reports what the turn actually got. */
 export const limitationsOf = (capabilities: AgentCapabilities): string[] => [
     ...(capabilities.permissions === "plan" ? ["no per-tool approvals"] : []),
     ...(capabilities.questions ? [] : ["no clarifying questions"]),
     ...(capabilities.steering ? [] : ["no mid-turn steering"]),
     ...(capabilities.mcp === "none" ? ["no MCP tools or plugins"] : capabilities.mcp === "http" ? ["MCP tools only — no plugins or browser"] : []),
+    ...(capabilities.execution.includes("js") ? [] : ["no code runs — its shell is the one way to execute"]),
     ...(capabilities.effort ? [] : ["no effort control"]),
     ...(capabilities.commands ? [] : ["no slash commands"]),
     ...(capabilities.terminals ? [] : ["no terminal panel"]),
     ...(capabilities.isolation === "namespace" ? [] : ["worktree by working directory only"]),
     ...(capabilities.recovery ? [] : ["no auto-resume after an outage"]),
+    /* The two weaker answers on the instruction axis, and only those: "replace" is the ceiling this list
+     * measures against, so it has nothing to disclose. Both phrasings name the OWNER'S prompt rather than the
+     * mechanism, because that is the thing they wrote and the thing that will or will not be in force. */
+    ...(capabilities.instructions === "append" ? ["your system prompt is added to theirs, not replacing it"] : []),
+    ...(capabilities.instructions === "none" ? ["your system prompt isn't applied"] : []),
 ];
 
 // Claude's compile-time model floor, shared by the daemon's catalog (claude-models.ts — its last rung, reached
@@ -293,7 +487,7 @@ export const CLAUDE_SEED_MODELS: readonly Model[] = [
 ];
 
 // The STATIC floor of the model catalog, harness-independent: every provider's real list is the daemon's live
-// catalog (/claude/models · /codex/models · /grok/models — discovery with a persisted/seed floor, never empty),
+// catalog (/providers/{provider}/models — discovery with a persisted/seed floor, never empty),
 // which consumers layer on top. Codex/grok are empty here (nothing sensible to offer before the live load — and
 // under the Claude Code harness they route through the translator, which serves the SAME subscription model ids
 // as the native catalog, so the harness no longer changes the list).
@@ -329,3 +523,21 @@ export const effortAllowed = (effort: string, provider: AgentProvider, thinking:
  * 400 by spending the user's money. */
 export const sendableEffort = (effort: string | undefined, thinking: boolean | undefined): string | undefined =>
     effort === "max" && thinking !== true ? "high" : effort;
+
+/* WHETHER FAST SPEED CAN BE OFFERED for a provider/harness/model triple — the picker-side filter, the same
+ * shape and the same reason as effortAllowed: the composer must not show a control that does nothing.
+ *
+ * Three conditions, each answering a different question, and all three are load-bearing:
+ *
+ *   - the RUNTIME has to know how to ask (capabilities.fastMode). Only the Claude Code loop does.
+ *   - the ROUTE has to be first-party. Every non-Claude provider the Claude Code loop serves is served through
+ *     the sandbox's translator, and the harness refuses fast mode on a non-Anthropic endpoint ("not_first_party")
+ *     — so a `grok` turn on the claude-code harness reads true on the capability and still cannot go fast.
+ *   - the MODEL has to publish it, which is the `fast` badge Anthropic's own catalog reports per model
+ *     (claude-models.ts maps supportsFastMode onto it). Curating a list of ids here instead is what this repo
+ *     deliberately does not do — a model that gains or loses fast mode moves the badge, and this follows.
+ *
+ * `badges` absent ⇒ false. That is the honest reading: a catalog row that published no capabilities said
+ * nothing about fast mode, and the seed floor a picker shows before its first live load is exactly that row. */
+export const fastAllowed = (capabilities: AgentCapabilities, provider: AgentProvider, badges: readonly ModelBadge[] | undefined): boolean =>
+    capabilities.fastMode && provider === "claude" && (badges ?? []).includes("fast");

package/src/agent-run-model.test.ts

@@ -0,0 +1,60 @@
+import { expect, test } from "vitest";
+import { resolveAgentRunModels } from "./agent-run-model.js";
+import type { QuickModelSource } from "./quick-model.js";
+
+/* Which model a run somebody's BUTTON started opens on. The rule answers the same two surfaces its quick-model
+ * sibling does — the daemon walks it, the settings row names it — so what these pin is the pair of properties
+ * that separate the two: an account this sandbox cannot reach never sits at the head of the chain, and an empty
+ * answer stays empty rather than being filled in with a tier nobody chose. */
+
+const CLAUDE: QuickModelSource = { provider: `claude`, ready: true, models: [`claude-opus-5`, `claude-sonnet-5`] };
+const CODEX: QuickModelSource = { provider: `codex`, ready: true, models: [`gpt-5.6`] };
+const GOOGLE: QuickModelSource = { provider: `gemini`, ready: true, models: [`gemini-3-pro`] };
+
+const offline = (source: QuickModelSource): QuickModelSource => ({ ...source, ready: false });
+
+test("keeps the user's own order — this list is read, never ranked", () => {
+    // The opposite of the quick chain, which sorts by tier and cost. Here the order IS the setting: someone who
+    // put Opus above GPT wants Opus first, and a resolver that knew better would spend the wrong account.
+    expect(resolveAgentRunModels([CLAUDE, CODEX], [`codex:gpt-5.6`, `claude:claude-opus-5`])).toEqual([
+        { provider: `codex`, model: `gpt-5.6` },
+        { provider: `claude`, model: `claude-opus-5` },
+    ]);
+});
+
+test("steps over a provider this sandbox has no credential for", () => {
+    // The whole reason the setting is a list. With Claude disconnected the head would otherwise be an account
+    // that fails every Fix with agent, while a perfectly good Codex sits underneath it.
+    expect(resolveAgentRunModels([offline(CLAUDE), CODEX], [`claude:claude-opus-5`, `codex:gpt-5.6`])).toEqual([
+        { provider: `codex`, model: `gpt-5.6` },
+    ]);
+});
+
+test("resolves to nothing when no pin is reachable — it does NOT fall back to whatever is connected", () => {
+    // The deliberate difference from resolveQuickModels, which lands on its Auto ladder here. An agent run is
+    // billed in whole sessions, so an unreachable list hands the choice back to the caller's floor (the user's
+    // own composer pick) rather than spending an account they never pointed at.
+    expect(resolveAgentRunModels([offline(CLAUDE), GOOGLE], [`claude:claude-opus-5`])).toEqual([]);
+});
+
+test("an empty list resolves to nothing even with accounts connected", () => {
+    expect(resolveAgentRunModels([CLAUDE, CODEX, GOOGLE], [])).toEqual([]);
+});
+
+test("drops a duplicate rather than spending two attempts proving one account is out", () => {
+    expect(resolveAgentRunModels([CLAUDE], [`claude:claude-opus-5`, `claude:claude-opus-5`])).toEqual([
+        { provider: `claude`, model: `claude-opus-5` },
+    ]);
+});
+
+test("drops a malformed key instead of sending it to a provider", () => {
+    expect(resolveAgentRunModels([CLAUDE], [`claude-opus-5`, `claude:`, `:claude-opus-5`, `claude:claude-sonnet-5`])).toEqual([
+        { provider: `claude`, model: `claude-sonnet-5` },
+    ]);
+});
+
+test("carries a model id the static catalog has never heard of", () => {
+    // The picker offers a custom-id escape hatch, so a pin can name a model released after this build. Second-
+    // guessing it here would quietly run something other than what the settings row says.
+    expect(resolveAgentRunModels([CLAUDE], [`claude:claude-opus-9-preview`])).toEqual([{ provider: `claude`, model: `claude-opus-9-preview` }]);
+});

package/src/agent-run-model.ts

@@ -0,0 +1,51 @@
+import { parsePinned, type QuickModelChoice, quickModelKey, type QuickModelSource } from "./quick-model.js";
+
+/* WHAT A SURFACE-STARTED AGENT RUN OPENS ON — the resolver for `agentRunModels`, sibling to resolveQuickModels
+ * and deliberately not the same function.
+ *
+ * BOTH ARE ORDERED LISTS, FOR THE SAME REASON. One connected account whose allowance went on the chat this
+ * morning is enough to take every one of these down: the user presses Fix with agent on a red pipeline, an
+ * isolated session opens, and it dies on a credential error they cannot see from the row. Written in order, the
+ * next entry catches it.
+ *
+ * THEY DIFFER ON WHAT AN EMPTY LIST MEANS, and that difference is the whole reason this is its own file rather
+ * than a flag on the other one. A quick helper exists to stay OFF the frontier tier, so "work it out from what
+ * is connected" is a good answer and quickModel's empty list resolves to a derived Auto ladder. An agent run is
+ * a full session with a worktree, billed whole: nothing here can judge whether a job is worth the frontier tier,
+ * so an empty list resolves to NOTHING and the caller falls back to the model the user picked for their own
+ * chat — a choice they made, rather than one this file guessed for them. For the same reason there is no Auto
+ * ladder underneath a list that has been emptied by disconnection: it would spend an account the user never
+ * pointed at, on the most expensive kind of run this app starts.
+ *
+ * WHAT "STEPPED OVER" MEANS HERE IS NARROWER than the quick chain's, and worth being exact about. The quick
+ * chain re-asks the next rung when a call comes back refused, because a one-shot that failed has cost nothing
+ * and can simply be run again. An agent session cannot be replayed that way — by the time a provider refuses
+ * mid-turn the agent may have already edited files — so this list is read ONCE, at the moment the turn is
+ * composed, and steps over exactly one thing: an account that is not connected. A model that accepts the turn
+ * and fails later is a failed run the user reads on the card, like any other. */
+
+/* The pins that could actually be started right now, in the user's own order.
+ *
+ * `sources` is the same readiness view resolveQuickModels takes, so both settings rows agree about which
+ * accounts this sandbox can send to — a pin greyed as "Not connected" in one row and silently spent by the
+ * other would be the worst of both.
+ *
+ * A pin whose provider is gone is DROPPED rather than held: it would otherwise sit at the head of the chain
+ * failing every run, which is exactly what the list exists to prevent. It stays on SCREEN, greyed — the settings
+ * row renders the stored list, not this one — because a setting that vanished from view would look like the app
+ * had eaten it.
+ *
+ * Empty out means nobody has pinned anything this sandbox can reach, and the caller's floor takes over. */
+export const resolveAgentRunModels = (sources: readonly QuickModelSource[], pinned: readonly string[]): readonly QuickModelChoice[] => {
+    const ready = new Set(sources.filter((source) => source.ready).map((source) => source.provider));
+    const requested = pinned.flatMap((key) => {
+        // Verbatim, unvalidated against the catalog — the same call resolveQuickModels makes and for the same
+        // reason: the picker offers a custom-id escape hatch for a model the static catalog has not caught up
+        // with, and second-guessing the id here would run a different model than the settings row names.
+        const choice = parsePinned(key);
+        return choice === undefined || !ready.has(choice.provider) ? [] : [choice];
+    });
+    // The same model twice would spend two attempts proving the same account is out. Hand-edited list, so this
+    // is a real state rather than a defensive branch.
+    return [...new Map(requested.map((choice) => [quickModelKey(choice), choice])).values()];
+};

package/src/capability-env.ts

@@ -0,0 +1,10 @@
+/* HOW A CLI CAPABILITY'S ENV VARS ARE NAMED — the one rule both ends of that wire have to apply.
+ *
+ * The daemon writes the agent's shell env by suffixing every var a cli connector declares with the instance id
+ * (cli-env.ts), so two connections of the same provider coexist on one flat environment. A connector's own
+ * TOOL then has to read them back, and an extension may not import daemon internals — so without this the
+ * rule would be spelled twice, and a change to it would silently split the writer from the reader. */
+
+// `analytics` → `POSTGRES_URL_ANALYTICS`; the default-named `github` → `GITHUB_TOKEN_GITHUB`.
+// ponytail: ids differing only by case or `-`/`_` (my-db vs my_db) map to the same suffix — last wins.
+export const envSuffix = (id: string): string => id.toUpperCase().replaceAll("-", "_");