@intentic/sandbox-contract 1.244.0 → 1.246.1

package/src/contracts/claude.contract.ts

@@ -1,71 +0,0 @@
-import { oc } from "@orpc/contract";
-import {
-    AccountIdSchema,
-    AccountListQuerySchema,
-    AccountRenameSchema,
-    AuthorizeChallengeSchema,
-    OauthAccountListSchema,
-    OauthAccountSchema,
-    OauthExchangeSchema,
-} from "../schemas/provider-oauth.js";
-import { OkSchema } from "../schemas/shared.js";
-
-// Claude subscription OAuth, the sandbox owns the credential. `start` hands the browser the authorize URL +
-// PKCE material; `exchange` stores the resulting tokens as a new account and returns it; `accounts` lists the
-// connected accounts; `rename` renames one; `disconnect` clears the one named by id. A sandbox can hold several
-// Claude accounts.
-//
-// The model catalog is NOT here: it is the one thing every provider answers identically, so it lives on the
-// shared /providers/{provider}/models route (providers.contract.ts). What is left is what is genuinely Claude's
-//, an account handshake no other provider has.
-export const claudeContract = {
-    start: oc
-        .route({
-            method: "POST",
-            path: "/claude/oauth/start",
-            summary: "Begin connecting a Claude account",
-            description:
-                "Hands back the address to send somebody to, and the proof this sandbox will need to finish the exchange. The sandbox holds the credential afterwards, not the browser.",
-        })
-        .output(AuthorizeChallengeSchema),
-    exchange: oc
-        .route({
-            method: "POST",
-            path: "/claude/oauth/exchange",
-            summary: "Finish connecting a Claude account",
-            description:
-                "Trades the code from the sign-in for stored tokens and answers with the account it just connected. A sandbox can hold several Claude accounts side by side.",
-        })
-        .input(OauthExchangeSchema)
-        .output(OauthAccountSchema),
-    // Each account carries its plan-limit reading. `force` re-measures before answering, see
-    // AccountListQuerySchema, and USAGE_WAIT_MS in claude.routes.ts for what an ordinary read waits.
-    accounts: oc
-        .route({
-            method: "GET",
-            path: "/claude/accounts",
-            summary: "Connected Claude accounts",
-            description:
-                "Each connected account with how full its plan limits were when last measured. Ask for a fresh measurement and it takes one before answering, which is slower.",
-        })
-        .input(AccountListQuerySchema)
-        .output(OauthAccountListSchema),
-    rename: oc
-        .route({
-            method: "POST",
-            path: "/claude/account/rename",
-            summary: "Rename a Claude account",
-            description: "Changes the label one account shows under, so several are tellable apart.",
-        })
-        .input(AccountRenameSchema)
-        .output(OauthAccountSchema),
-    disconnect: oc
-        .route({
-            method: "POST",
-            path: "/claude/account/disconnect",
-            summary: "Disconnect a Claude account",
-            description: "Clears the stored tokens for one account. The others stay connected.",
-        })
-        .input(AccountIdSchema)
-        .output(OkSchema),
-};

package/src/contracts/cursor.contract.ts

@@ -1,74 +0,0 @@
-import { oc } from "@orpc/contract";
-import {
-    AccountIdSchema,
-    AccountListQuerySchema,
-    AccountRenameSchema,
-    CursorLoginCancelSchema,
-    CursorLoginStartSchema,
-    OauthAccountListSchema,
-    OauthAccountSchema,
-} from "../schemas/provider-oauth.js";
-import { OkSchema } from "../schemas/shared.js";
-
-/* Cursor subscription sign-in, the sandbox owns the credential and the platform never sees it, the same bargain
- * claude.contract.ts strikes. What differs is who finishes the handshake.
- *
- * Claude's flow is start → the browser gets a code → `exchange` hands it back. Cursor's PKCE verifier is
- * redeemable on its own, so it never leaves the daemon: `start` begins the flow, keeps the verifier in memory,
- * polls Cursor until the browser completes the sign-in, mints a 90-day user key and writes it as an account.
- * The caller opens the URL and then watches `accounts`, exactly as it does for a device login, which is why
- * there is no `exchange` route here and a `cancel` one instead.
- *
- * The model catalog is deliberately absent, as it is for every provider: it is the one question they all answer
- * identically, so it lives on the shared /providers/{provider}/models route (providers.contract.ts). */
-export const cursorContract = {
-    start: oc
-        .route({
-            method: "POST",
-            path: "/cursor/login/start",
-            summary: "Begin connecting a Cursor account",
-            description:
-                "Hands back the page to sign in on. The sandbox finishes the handshake itself and stores the credential, so nothing has to be pasted back: watch the account list instead.",
-        })
-        .output(CursorLoginStartSchema),
-    cancel: oc
-        .route({
-            method: "POST",
-            path: "/cursor/login/cancel",
-            summary: "Abandon a Cursor sign-in",
-            description: "Stops waiting on a sign-in nobody completed. An abandoned attempt also expires on its own.",
-        })
-        .input(CursorLoginCancelSchema)
-        .output(OkSchema),
-    // Shaped like Claude's, including `force`, so the two account lists render through one component. Cursor
-    // publishes no account-wide headroom today, so `usage` stays absent on these rows and they draw a dot rather
-    // than a ring, which is what an unmeasured account has always meant here.
-    accounts: oc
-        .route({
-            method: "GET",
-            path: "/cursor/accounts",
-            summary: "Connected Cursor accounts",
-            description:
-                "Each connected account, and whether its stored key is still good. Cursor publishes no plan-wide allowance, so these rows carry no usage reading.",
-        })
-        .input(AccountListQuerySchema)
-        .output(OauthAccountListSchema),
-    rename: oc
-        .route({
-            method: "POST",
-            path: "/cursor/account/rename",
-            summary: "Rename a Cursor account",
-            description: "Changes the label one account shows under, so several are tellable apart.",
-        })
-        .input(AccountRenameSchema)
-        .output(OauthAccountSchema),
-    disconnect: oc
-        .route({
-            method: "POST",
-            path: "/cursor/account/disconnect",
-            summary: "Disconnect a Cursor account",
-            description: "Clears the stored key for one account. The others stay connected.",
-        })
-        .input(AccountIdSchema)
-        .output(OkSchema),
-};

package/src/contracts/grok.contract.ts

@@ -1,41 +0,0 @@
-import { oc } from "@orpc/contract";
-import { AccountIdSchema, DeviceStartSchema, OauthAccountListSchema } from "../schemas/provider-oauth.js";
-import { OkSchema } from "../schemas/shared.js";
-
-// xAI Grok (via OpenCode) uses subscription OAuth, the sandbox owns the credential (OpenCode persists the
-// tokens and refreshes them). `start` authorizes xAI's headless device-code method and returns the verification
-// URL + instructions (which carry the one-time code the user enters at x.ai); OpenCode then polls to completion
-//, there is no paste-back, and the UI polls `accounts` until connected. `disconnect` clears the tokens.
-// ponytail: OpenCode holds one xAI auth per data dir, so `accounts` is 0 or 1, the list shape matches the
-// other providers without paying for per-account OpenCode servers yet.
-//
-// Like Claude's, this contract is now the account handshake alone, the model catalog answers on the shared
-// /providers/{provider}/models route (providers.contract.ts).
-export const grokContract = {
-    start: oc
-        .route({
-            method: "POST",
-            path: "/grok/oauth/start",
-            summary: "Begin connecting a Grok account",
-            description:
-                "Hands back the page to open and the one-time code to type there. Nothing is pasted back afterwards: the sandbox waits for the sign-in to complete on its own, so poll the accounts call until it appears.",
-        })
-        .output(DeviceStartSchema),
-    accounts: oc
-        .route({
-            method: "GET",
-            path: "/grok/accounts",
-            summary: "Connected Grok account",
-            description: "What is signed in. A list for consistency with the other providers, though there is at most one.",
-        })
-        .output(OauthAccountListSchema),
-    disconnect: oc
-        .route({
-            method: "POST",
-            path: "/grok/account/disconnect",
-            summary: "Disconnect the Grok account",
-            description: "Clears the stored tokens.",
-        })
-        .input(AccountIdSchema)
-        .output(OkSchema),
-};

package/src/contracts/keys.contract.ts

@@ -1,79 +0,0 @@
-import { oc } from "@orpc/contract";
-import { z } from "zod";
-import { KeyProviderParamSchema } from "../schemas/agent.js";
-import { AccountIdSchema, AccountRenameSchema, OauthAccountListSchema, OauthAccountSchema } from "../schemas/provider-oauth.js";
-import { OkSchema } from "../schemas/shared.js";
-
-/* THE PROVIDERS YOU CONNECT BY PASTING A KEY (Sandbox ▸ Agent), on four routes with the provider as a PARAMETER
- * rather than four routes each.
- *
- * The lesson providers.contract.ts already learned about model catalogs: five identical route files differing
- * only in a name is a shape that costs a vertical slice through the contract, the router, the service container
- * and every test double every time a provider is added. Here the providers genuinely are identical — a keyed
- * provider is a base URL, a catalog URL and a store — so the id is a parameter and adding one is a spec row.
- *
- * WHY NOT THE OAUTH ROUTES. Claude and Cursor connect through a handshake this daemon runs: a `start` that
- * returns something to open and an `exchange`/poll that completes it. There is no handshake here at all — the
- * user already has the credential and hands it over — so `connect` takes the key and answers with the account
- * it became. Sharing a route family with the OAuth providers would have meant a `start` that returns nothing
- * and an `exchange` whose "code" is really a secret, which is a worse lie than two families.
- *
- * WHY NOT THE TRANSLATOR ROUTES. Those address subscriptions CLIProxyAPI holds; these credentials live in this
- * daemon's own auth tree, and a disconnect here removes a file rather than asking a proxy to forget one.
- *
- * THE PATHS MIRROR THE OAUTH PROVIDERS' (`<base>/accounts`, `<base>/account/rename`,
- * `<base>/account/disconnect`) with `/keys/<provider>` as the base, so the browser's account helpers reach
- * these rows with the same three URLs they already build for Claude, Grok and Cursor. Only `connect`
- * differs, because only `connect` is a different act.
- *
- * THE KEY TRAVELS IN, NEVER OUT. `connect` takes it and every answer on this contract is an OauthAccount, whose
- * shape has no field a credential could ride in — which is what makes "does this leak the key" a question you
- * answer by reading the schema instead of the handler. */
-export const keysContract = {
-    accounts: oc
-        .route({
-            method: "GET",
-            path: "/keys/{provider}/accounts",
-            summary: "Connected accounts for a key-based provider",
-            description: "Which keys are connected for this provider. The keys themselves never travel: being in this list is what connected means.",
-        })
-        .input(KeyProviderParamSchema)
-        .output(OauthAccountListSchema),
-    connect: oc
-        .route({
-            method: "POST",
-            path: "/keys/{provider}/connect",
-            summary: "Connect an API key",
-            description:
-                "Stores an API key for this provider and answers with the account it became. A sandbox can hold several keys for one provider side by side.",
-        })
-        .input(
-            KeyProviderParamSchema.extend({
-                apiKey: z.string().min(1).describe("The key, as the provider issued it. Stored in this sandbox and never sent back out."),
-                label: z
-                    .string()
-                    .max(80)
-                    .optional()
-                    .describe("What to call it. Blank falls back to the provider's own name, which is all a pasted key can say about itself."),
-            }),
-        )
-        .output(OauthAccountSchema),
-    rename: oc
-        .route({
-            method: "POST",
-            path: "/keys/{provider}/account/rename",
-            summary: "Rename one connected key",
-            description: "Nothing in a pasted key says whose it is, so naming it is the only way to tell two of them apart.",
-        })
-        .input(KeyProviderParamSchema.extend(AccountRenameSchema.shape))
-        .output(OkSchema),
-    disconnect: oc
-        .route({
-            method: "POST",
-            path: "/keys/{provider}/account/disconnect",
-            summary: "Disconnect one key",
-            description: "Removes a single stored key. Any others under the same provider stay connected.",
-        })
-        .input(KeyProviderParamSchema.extend(AccountIdSchema.shape))
-        .output(OkSchema),
-};