@intentic/sandbox-contract 1.245.0 → 1.247.0

package/dist/schemas/computers.js

@@ -1,135 +0,0 @@
-import { z } from "zod";
-import { HostFactsSchema } from "./hosts.js";
-import { DEV_VERSION } from "../versions.js";
-export const MachineSandboxSchema = z.object({
-    slug: z.string(),
-    container: z.string(),
-    name: z.string().optional(),
-    running: z.boolean(),
-    image: z.string(),
-    tunnelRunning: z.boolean().optional(),
-});
-export const MachineSandboxOpSchema = z.enum([
-    "start",
-    "stop",
-    "restart",
-    "prepare",
-    "update",
-    "rebuild",
-    "rollback",
-    "remove",
-    "logs",
-    "runner-up",
-    "runner-remove",
-]);
-export const MachineSandboxFlowSchema = z.object({
-    op: MachineSandboxOpSchema,
-    slug: z.string().min(1),
-    hash: z.string().optional(),
-    parentUrl: z.string().optional(),
-    pair: z.string().optional().meta({ secret: true }),
-    definition: z.string().optional(),
-    overlay: z.string().optional(),
-    overlayHash: z.string().optional(),
-});
-export const MachineSandboxFlowInputSchema = MachineSandboxFlowSchema.extend({ id: z.string().min(1) });
-export const MachineFlowLineSchema = z.discriminatedUnion("kind", [
-    z.object({ kind: z.literal("line"), text: z.string() }),
-    z.object({ kind: z.literal("result"), message: z.string() }),
-    z.object({ kind: z.literal("error"), message: z.string() }),
-]);
-export const MachineCommandSchema = z.enum(["mirror-off", "mirror-on", "sync-pause", "sync-resume", "sync-unpair"]);
-export const MachineSandboxIdSchema = z
-    .string()
-    .max(200)
-    .regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/);
-export const MachineCommandInputSchema = z.object({
-    id: z.string().min(1),
-    command: MachineCommandSchema,
-    sandboxId: MachineSandboxIdSchema.optional(),
-});
-export const MachineCommandResultSchema = z.object({
-    ok: z.boolean(),
-    message: z.string(),
-    output: z.string().optional(),
-});
-export const MachinePairingSchema = z.object({
-    sandboxId: z.string(),
-    mode: z.enum(["sync", "mirror"]),
-    localDir: z.string().optional(),
-    mirroring: z.enum(["on", "off"]).optional(),
-    mutagenStatus: z.string().optional(),
-    conflicts: z.number().int().nonnegative().optional(),
-    paused: z.boolean().optional(),
-    backupStatus: z.string().optional(),
-});
-export const MachinePortStateSchema = z.enum([
-    "mirrored",
-    "held-by-sandbox",
-    "busy",
-]);
-export const MachinePortSchema = z.object({
-    port: z.number().int().min(1).max(65535),
-    host: z.enum(["127.0.0.1", "::1"]),
-    sandboxId: z.string(),
-    state: MachinePortStateSchema,
-    heldBy: z.string().optional(),
-    command: z.string().optional(),
-});
-export const MachineWatcherSchema = z.object({
-    running: z.boolean(),
-    pid: z.number().int().optional(),
-    build: z.string().optional(),
-    lastTickAt: z.number().optional(),
-});
-export const WATCHER_STALL_AFTER_MS = 60_000;
-export const watcherStalled = (watcher, now) => watcher.running && watcher.lastTickAt !== undefined && now - watcher.lastTickAt > WATCHER_STALL_AFTER_MS;
-export const MachineReportSchema = z.object({
-    hostname: z.string(),
-    os: z.string(),
-    agents: z.object({ sync: z.string().optional(), host: z.string().optional() }),
-    sandboxes: z.array(MachineSandboxSchema),
-    pairings: z.array(MachinePairingSchema),
-    ports: z.array(MachinePortSchema),
-    watcher: MachineWatcherSchema,
-    capturedAt: z.number(),
-});
-export const watcherBuildSkew = (report) => {
-    const running = report.watcher.build;
-    const installed = report.agents.sync;
-    if (!report.watcher.running || installed === undefined || installed === DEV_VERSION || running === installed) {
-        return undefined;
-    }
-    return { running, installed };
-};
-export const ComputerGapSchema = z.enum([
-    "offline",
-    "scope-off",
-    "no-agent",
-    "unreported",
-]);
-export const ComputerSyncSchema = z.object({
-    machine: z.string(),
-    mode: z.enum(["sync", "mirror"]),
-    seenAt: z.number().optional(),
-});
-export const ComputerSchema = z.object({
-    key: z.string(),
-    label: z.string(),
-    sync: ComputerSyncSchema.optional(),
-    hostId: z.string().optional(),
-    online: z.boolean().optional(),
-    platform: z.string().optional(),
-    facts: HostFactsSchema.optional(),
-    hostAgent: z.string().optional(),
-    lastSeen: z.number().optional(),
-    report: MachineReportSchema.optional(),
-    gap: ComputerGapSchema.optional(),
-});
-export const ComputersListSchema = z.object({ computers: z.array(ComputerSchema) });
-export const SyncStatusSchema = z.object({
-    enrolled: z.boolean(),
-    available: z.boolean().optional(),
-    machines: z.array(MachineReportSchema).optional(),
-});
-//# sourceMappingURL=computers.js.map

package/dist/schemas/computers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"computers.js","sourceRoot":"","sources":["../../src/schemas/computers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAyB7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IAErB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IAGjB,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AA2BH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;IACzC,OAAO;IACP,MAAM;IACN,SAAS;IACT,SAAS;IACT,QAAQ;IACR,SAAS;IACT,UAAU;IACV,QAAQ;IACR,MAAM;IACN,WAAW;IACX,eAAe;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,EAAE,EAAE,sBAAsB;IAG1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAGvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAK3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAUlD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,wBAAwB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAMxG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9D,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACvD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC5D,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CAC9D,CAAC,CAAC;AA8BH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;AASpH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KAClC,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,8BAA8B,CAAC,CAAC;AAC3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,oBAAoB;IAC7B,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACf,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEhC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAa/B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;IAI3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAGpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACpD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAM9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;IAEzC,UAAU;IAGV,iBAAiB;IAGjB,MAAM;CACT,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAElC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,sBAAsB;IAE7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAMhC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAM5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAuB,EAAE,GAAW,EAAW,EAAE,CAC5E,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,GAAG,OAAO,CAAC,UAAU,GAAG,sBAAsB,CAAC;AAC7G,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAKxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IAad,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IAG9E,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;IACjC,OAAO,EAAE,oBAAoB;IAG7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAqBH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAqB,EAAoF,EAAE;IACxI,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,WAAW,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3G,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IAEpC,SAAS;IAGT,WAAW;IAEX,UAAU;IAGV,YAAY;CACf,CAAC,CAAC;AAuBH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IAInB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAGhC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAEnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IAEf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IAGjB,IAAI,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAEnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE7B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAW9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;IAIjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACtC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;AAWpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IAMrB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC"}

package/src/agent-run-model.test.ts

@@ -1,76 +0,0 @@
-import { expect, test } from "vitest";
-import { resolveAgentRunModels } from "./agent-run-model.js";
-import type { QuickModelSource } from "./quick-model.js";
-import type { AgentRunPin } from "./schemas/agent.js";
-
-/* Which model a run somebody's BUTTON started opens on. The rule answers the same two surfaces its quick-model
- * sibling does: the daemon walks it, the settings row names it, so what these pin is the pair of properties
- * that separate the two: an account this sandbox cannot reach never sits at the head of the chain, and an empty
- * answer stays empty rather than being filled in with a tier nobody chose.
- *
- * And one property neither of those covers, new with the pins being objects: an entry's own knobs are the
- * entry's, so what survives the walk is the WHOLE pin. A resolver that handed back the pair inside it would run
- * the fallback at the head's effort, which is a tier that appears nowhere on the user's screen. */
-
-const CLAUDE: QuickModelSource = { provider: `claude`, ready: true, models: [`claude-opus-5`, `claude-sonnet-5`] };
-const CODEX: QuickModelSource = { provider: `codex`, ready: true, models: [`gpt-5.6`] };
-const GOOGLE: QuickModelSource = { provider: `gemini`, ready: true, models: [`gemini-3-pro`] };
-
-const offline = (source: QuickModelSource): QuickModelSource => ({ ...source, ready: false });
-
-const pin = (provider: string, model: string, knobs: Partial<AgentRunPin> = {}): AgentRunPin => ({ provider, model, ...knobs });
-
-test("keeps the user's own order, this list is read, never ranked", () => {
-    // The opposite of the quick chain, which sorts by tier and cost. Here the order IS the setting: someone who
-    // put Opus above GPT wants Opus first, and a resolver that knew better would spend the wrong account.
-    expect(resolveAgentRunModels([CLAUDE, CODEX], [pin(`codex`, `gpt-5.6`), pin(`claude`, `claude-opus-5`)])).toEqual([
-        { provider: `codex`, model: `gpt-5.6` },
-        { provider: `claude`, model: `claude-opus-5` },
-    ]);
-});
-
-test("steps over a provider this sandbox has no credential for", () => {
-    // The whole reason the setting is a list. With Claude disconnected the head would otherwise be an account
-    // that fails every Fix with agent, while a perfectly good Codex sits underneath it.
-    expect(resolveAgentRunModels([offline(CLAUDE), CODEX], [pin(`claude`, `claude-opus-5`), pin(`codex`, `gpt-5.6`)])).toEqual([
-        { provider: `codex`, model: `gpt-5.6` },
-    ]);
-});
-
-test("each surviving entry keeps its own knobs, not the head's", () => {
-    // The effort used to be one setting beside the list, so a fallback ran at whatever the head was set to. It
-    // is now a property of the entry that actually answers, which is the only place it was ever true.
-    expect(
-        resolveAgentRunModels(
-            [offline(CODEX), CLAUDE],
-            [pin(`codex`, `gpt-5.6`, { effort: `low` }), pin(`claude`, `claude-opus-5`, { effort: `max`, thinking: true })],
-        ),
-    ).toEqual([{ provider: `claude`, model: `claude-opus-5`, effort: `max`, thinking: true }]);
-});
-
-test("resolves to nothing when no pin is reachable: it does NOT fall back to whatever is connected", () => {
-    // The deliberate difference from resolveQuickModels, which lands on its Auto ladder here. An agent run is
-    // billed in whole sessions, so an unreachable list hands the choice back to the caller's floor (the user's
-    // own composer pick) rather than spending an account they never pointed at.
-    expect(resolveAgentRunModels([offline(CLAUDE), GOOGLE], [pin(`claude`, `claude-opus-5`)])).toEqual([]);
-});
-
-test("an empty list resolves to nothing even with accounts connected", () => {
-    expect(resolveAgentRunModels([CLAUDE, CODEX, GOOGLE], [])).toEqual([]);
-});
-
-test("drops a duplicate rather than spending two attempts proving one account is out, and the first one's knobs are the ones kept", () => {
-    // Two entries can now name one model and disagree about how hard it thinks, which is what reordering a list
-    // by hand produces. The one the user reads first is the one they meant.
-    expect(
-        resolveAgentRunModels([CLAUDE], [pin(`claude`, `claude-opus-5`, { effort: `max` }), pin(`claude`, `claude-opus-5`, { effort: `low` })]),
-    ).toEqual([{ provider: `claude`, model: `claude-opus-5`, effort: `max` }]);
-});
-
-test("carries a model id the static catalog has never heard of", () => {
-    // The picker offers a custom-id escape hatch, so a pin can name a model released after this build. Second-
-    // guessing it here would quietly run something other than what the settings row says.
-    expect(resolveAgentRunModels([CLAUDE], [pin(`claude`, `claude-opus-9-preview`)])).toEqual([
-        { provider: `claude`, model: `claude-opus-9-preview` },
-    ]);
-});

package/src/agent-run-model.ts

@@ -1,65 +0,0 @@
-import { quickModelKey, type QuickModelSource } from "./quick-model.js";
-import type { AgentRunPin } from "./schemas/agent.js";
-
-/* WHAT A SURFACE-STARTED AGENT RUN OPENS ON, the resolver for `agentRunModels`, sibling to resolveQuickModels
- * and deliberately not the same function.
- *
- * BOTH ARE ORDERED LISTS, FOR THE SAME REASON. One connected account whose allowance went on the chat this
- * morning is enough to take every one of these down: the user presses Fix with agent on a red pipeline, an
- * isolated session opens, and it dies on a credential error they cannot see from the row. Written in order, the
- * next entry catches it.
- *
- * THEY DIFFER ON WHAT AN EMPTY LIST MEANS, and that difference is the whole reason this is its own file rather
- * than a flag on the other one. A quick helper exists to stay OFF the frontier tier, so "work it out from what
- * is connected" is a good answer and quickModel's empty list resolves to a derived Auto ladder. An agent run is
- * a full session with a worktree, billed whole: nothing here can judge whether a job is worth the frontier tier,
- * so an empty list resolves to NOTHING and the caller falls back to the model the user picked for their own
- * chat, a choice they made, rather than one this file guessed for them. For the same reason there is no Auto
- * ladder underneath a list that has been emptied by disconnection: it would spend an account the user never
- * pointed at, on the most expensive kind of run this app starts.
- *
- * WHAT "STEPPED OVER" MEANS HERE IS NARROWER than the quick chain's, and worth being exact about. The quick
- * chain re-asks the next rung when a call comes back refused, because a one-shot that failed has cost nothing
- * and can simply be run again. An agent session cannot be replayed that way, by the time a provider refuses
- * mid-turn the agent may have already edited files, so this list is read ONCE, at the moment the turn is
- * composed, and steps over exactly one thing: an account that is not connected. A model that accepts the turn
- * and fails later is a failed run the user reads on the card, like any other. */
-
-/* The pins that could actually be started right now, in the user's own order.
- *
- * `sources` is the same readiness view resolveQuickModels takes, so both settings rows agree about which
- * accounts this sandbox can send to, a pin greyed as "Not connected" in one row and silently spent by the
- * other would be the worst of both.
- *
- * A pin whose provider is gone is DROPPED rather than held: it would otherwise sit at the head of the chain
- * failing every run, which is exactly what the list exists to prevent. It stays on SCREEN, greyed, the settings
- * row renders the stored list, not this one, because a setting that vanished from view would look like the app
- * had eaten it.
- *
- * THE WHOLE PIN SURVIVES, not the pair inside it: the entry's own effort, harness and cost knobs are what the
- * turn is composed from (turn-resume.ts), so a resolver that handed back a bare (provider, model) would silently
- * run the head of the list at the provider's defaults. Nothing here reads or judges those fields, which is the
- * point of carrying them whole.
- *
- * Empty out means nobody has pinned anything this sandbox can reach, and the caller's floor takes over. */
-export const resolveAgentRunModels = (sources: readonly QuickModelSource[], pinned: readonly AgentRunPin[]): readonly AgentRunPin[] => {
-    const ready = new Set(sources.filter((source) => source.ready).map((source) => source.provider));
-    // Taken verbatim, unvalidated against the catalog, the same reading resolveQuickModels gives its keys and
-    // for the same reason: the picker offers a custom-id escape hatch for a model the static catalog has not
-    // caught up with, and second-guessing the id here would run a different model than the settings row names.
-    const requested = pinned.filter((pin) => ready.has(pin.provider));
-    /* The same model twice would spend two attempts proving the same account is out. Hand-edited list, so this
-     * is a real state rather than a defensive branch.
-     *
-     * THE FIRST OF A PAIR WINS, WHOLE. Two entries can now name one model and differ in their knobs (the same
-     * Sonnet at Max and again at Low, written while reordering the list), and the one the user reads first is
-     * the one they meant; keeping the earlier position with the later entry's effort would run a tier that
-     * appears nowhere the pin does. */
-    const chain: AgentRunPin[] = [];
-    for (const pin of requested) {
-        if (!chain.some((held) => quickModelKey(held) === quickModelKey(pin))) {
-            chain.push(pin);
-        }
-    }
-    return chain;
-};

package/src/contracts/claude.contract.ts

@@ -1,71 +0,0 @@
-import { oc } from "@orpc/contract";
-import {
-    AccountIdSchema,
-    AccountListQuerySchema,
-    AccountRenameSchema,
-    AuthorizeChallengeSchema,
-    OauthAccountListSchema,
-    OauthAccountSchema,
-    OauthExchangeSchema,
-} from "../schemas/provider-oauth.js";
-import { OkSchema } from "../schemas/shared.js";
-
-// Claude subscription OAuth, the sandbox owns the credential. `start` hands the browser the authorize URL +
-// PKCE material; `exchange` stores the resulting tokens as a new account and returns it; `accounts` lists the
-// connected accounts; `rename` renames one; `disconnect` clears the one named by id. A sandbox can hold several
-// Claude accounts.
-//
-// The model catalog is NOT here: it is the one thing every provider answers identically, so it lives on the
-// shared /providers/{provider}/models route (providers.contract.ts). What is left is what is genuinely Claude's
-//, an account handshake no other provider has.
-export const claudeContract = {
-    start: oc
-        .route({
-            method: "POST",
-            path: "/claude/oauth/start",
-            summary: "Begin connecting a Claude account",
-            description:
-                "Hands back the address to send somebody to, and the proof this sandbox will need to finish the exchange. The sandbox holds the credential afterwards, not the browser.",
-        })
-        .output(AuthorizeChallengeSchema),
-    exchange: oc
-        .route({
-            method: "POST",
-            path: "/claude/oauth/exchange",
-            summary: "Finish connecting a Claude account",
-            description:
-                "Trades the code from the sign-in for stored tokens and answers with the account it just connected. A sandbox can hold several Claude accounts side by side.",
-        })
-        .input(OauthExchangeSchema)
-        .output(OauthAccountSchema),
-    // Each account carries its plan-limit reading. `force` re-measures before answering, see
-    // AccountListQuerySchema, and USAGE_WAIT_MS in claude.routes.ts for what an ordinary read waits.
-    accounts: oc
-        .route({
-            method: "GET",
-            path: "/claude/accounts",
-            summary: "Connected Claude accounts",
-            description:
-                "Each connected account with how full its plan limits were when last measured. Ask for a fresh measurement and it takes one before answering, which is slower.",
-        })
-        .input(AccountListQuerySchema)
-        .output(OauthAccountListSchema),
-    rename: oc
-        .route({
-            method: "POST",
-            path: "/claude/account/rename",
-            summary: "Rename a Claude account",
-            description: "Changes the label one account shows under, so several are tellable apart.",
-        })
-        .input(AccountRenameSchema)
-        .output(OauthAccountSchema),
-    disconnect: oc
-        .route({
-            method: "POST",
-            path: "/claude/account/disconnect",
-            summary: "Disconnect a Claude account",
-            description: "Clears the stored tokens for one account. The others stay connected.",
-        })
-        .input(AccountIdSchema)
-        .output(OkSchema),
-};

package/src/contracts/cursor.contract.ts

@@ -1,74 +0,0 @@
-import { oc } from "@orpc/contract";
-import {
-    AccountIdSchema,
-    AccountListQuerySchema,
-    AccountRenameSchema,
-    CursorLoginCancelSchema,
-    CursorLoginStartSchema,
-    OauthAccountListSchema,
-    OauthAccountSchema,
-} from "../schemas/provider-oauth.js";
-import { OkSchema } from "../schemas/shared.js";
-
-/* Cursor subscription sign-in, the sandbox owns the credential and the platform never sees it, the same bargain
- * claude.contract.ts strikes. What differs is who finishes the handshake.
- *
- * Claude's flow is start → the browser gets a code → `exchange` hands it back. Cursor's PKCE verifier is
- * redeemable on its own, so it never leaves the daemon: `start` begins the flow, keeps the verifier in memory,
- * polls Cursor until the browser completes the sign-in, mints a 90-day user key and writes it as an account.
- * The caller opens the URL and then watches `accounts`, exactly as it does for a device login, which is why
- * there is no `exchange` route here and a `cancel` one instead.
- *
- * The model catalog is deliberately absent, as it is for every provider: it is the one question they all answer
- * identically, so it lives on the shared /providers/{provider}/models route (providers.contract.ts). */
-export const cursorContract = {
-    start: oc
-        .route({
-            method: "POST",
-            path: "/cursor/login/start",
-            summary: "Begin connecting a Cursor account",
-            description:
-                "Hands back the page to sign in on. The sandbox finishes the handshake itself and stores the credential, so nothing has to be pasted back: watch the account list instead.",
-        })
-        .output(CursorLoginStartSchema),
-    cancel: oc
-        .route({
-            method: "POST",
-            path: "/cursor/login/cancel",
-            summary: "Abandon a Cursor sign-in",
-            description: "Stops waiting on a sign-in nobody completed. An abandoned attempt also expires on its own.",
-        })
-        .input(CursorLoginCancelSchema)
-        .output(OkSchema),
-    // Shaped like Claude's, including `force`, so the two account lists render through one component. Cursor
-    // publishes no account-wide headroom today, so `usage` stays absent on these rows and they draw a dot rather
-    // than a ring, which is what an unmeasured account has always meant here.
-    accounts: oc
-        .route({
-            method: "GET",
-            path: "/cursor/accounts",
-            summary: "Connected Cursor accounts",
-            description:
-                "Each connected account, and whether its stored key is still good. Cursor publishes no plan-wide allowance, so these rows carry no usage reading.",
-        })
-        .input(AccountListQuerySchema)
-        .output(OauthAccountListSchema),
-    rename: oc
-        .route({
-            method: "POST",
-            path: "/cursor/account/rename",
-            summary: "Rename a Cursor account",
-            description: "Changes the label one account shows under, so several are tellable apart.",
-        })
-        .input(AccountRenameSchema)
-        .output(OauthAccountSchema),
-    disconnect: oc
-        .route({
-            method: "POST",
-            path: "/cursor/account/disconnect",
-            summary: "Disconnect a Cursor account",
-            description: "Clears the stored key for one account. The others stay connected.",
-        })
-        .input(AccountIdSchema)
-        .output(OkSchema),
-};

package/src/contracts/grok.contract.ts

@@ -1,41 +0,0 @@
-import { oc } from "@orpc/contract";
-import { AccountIdSchema, DeviceStartSchema, OauthAccountListSchema } from "../schemas/provider-oauth.js";
-import { OkSchema } from "../schemas/shared.js";
-
-// xAI Grok (via OpenCode) uses subscription OAuth, the sandbox owns the credential (OpenCode persists the
-// tokens and refreshes them). `start` authorizes xAI's headless device-code method and returns the verification
-// URL + instructions (which carry the one-time code the user enters at x.ai); OpenCode then polls to completion
-//, there is no paste-back, and the UI polls `accounts` until connected. `disconnect` clears the tokens.
-// ponytail: OpenCode holds one xAI auth per data dir, so `accounts` is 0 or 1, the list shape matches the
-// other providers without paying for per-account OpenCode servers yet.
-//
-// Like Claude's, this contract is now the account handshake alone, the model catalog answers on the shared
-// /providers/{provider}/models route (providers.contract.ts).
-export const grokContract = {
-    start: oc
-        .route({
-            method: "POST",
-            path: "/grok/oauth/start",
-            summary: "Begin connecting a Grok account",
-            description:
-                "Hands back the page to open and the one-time code to type there. Nothing is pasted back afterwards: the sandbox waits for the sign-in to complete on its own, so poll the accounts call until it appears.",
-        })
-        .output(DeviceStartSchema),
-    accounts: oc
-        .route({
-            method: "GET",
-            path: "/grok/accounts",
-            summary: "Connected Grok account",
-            description: "What is signed in. A list for consistency with the other providers, though there is at most one.",
-        })
-        .output(OauthAccountListSchema),
-    disconnect: oc
-        .route({
-            method: "POST",
-            path: "/grok/account/disconnect",
-            summary: "Disconnect the Grok account",
-            description: "Clears the stored tokens.",
-        })
-        .input(AccountIdSchema)
-        .output(OkSchema),
-};

package/src/contracts/keys.contract.ts

@@ -1,79 +0,0 @@
-import { oc } from "@orpc/contract";
-import { z } from "zod";
-import { KeyProviderParamSchema } from "../schemas/agent.js";
-import { AccountIdSchema, AccountRenameSchema, OauthAccountListSchema, OauthAccountSchema } from "../schemas/provider-oauth.js";
-import { OkSchema } from "../schemas/shared.js";
-
-/* THE PROVIDERS YOU CONNECT BY PASTING A KEY (Sandbox ▸ Agent), on four routes with the provider as a PARAMETER
- * rather than four routes each.
- *
- * The lesson providers.contract.ts already learned about model catalogs: five identical route files differing
- * only in a name is a shape that costs a vertical slice through the contract, the router, the service container
- * and every test double every time a provider is added. Here the providers genuinely are identical — a keyed
- * provider is a base URL, a catalog URL and a store — so the id is a parameter and adding one is a spec row.
- *
- * WHY NOT THE OAUTH ROUTES. Claude and Cursor connect through a handshake this daemon runs: a `start` that
- * returns something to open and an `exchange`/poll that completes it. There is no handshake here at all — the
- * user already has the credential and hands it over — so `connect` takes the key and answers with the account
- * it became. Sharing a route family with the OAuth providers would have meant a `start` that returns nothing
- * and an `exchange` whose "code" is really a secret, which is a worse lie than two families.
- *
- * WHY NOT THE TRANSLATOR ROUTES. Those address subscriptions CLIProxyAPI holds; these credentials live in this
- * daemon's own auth tree, and a disconnect here removes a file rather than asking a proxy to forget one.
- *
- * THE PATHS MIRROR THE OAUTH PROVIDERS' (`<base>/accounts`, `<base>/account/rename`,
- * `<base>/account/disconnect`) with `/keys/<provider>` as the base, so the browser's account helpers reach
- * these rows with the same three URLs they already build for Claude, Grok and Cursor. Only `connect`
- * differs, because only `connect` is a different act.
- *
- * THE KEY TRAVELS IN, NEVER OUT. `connect` takes it and every answer on this contract is an OauthAccount, whose
- * shape has no field a credential could ride in — which is what makes "does this leak the key" a question you
- * answer by reading the schema instead of the handler. */
-export const keysContract = {
-    accounts: oc
-        .route({
-            method: "GET",
-            path: "/keys/{provider}/accounts",
-            summary: "Connected accounts for a key-based provider",
-            description: "Which keys are connected for this provider. The keys themselves never travel: being in this list is what connected means.",
-        })
-        .input(KeyProviderParamSchema)
-        .output(OauthAccountListSchema),
-    connect: oc
-        .route({
-            method: "POST",
-            path: "/keys/{provider}/connect",
-            summary: "Connect an API key",
-            description:
-                "Stores an API key for this provider and answers with the account it became. A sandbox can hold several keys for one provider side by side.",
-        })
-        .input(
-            KeyProviderParamSchema.extend({
-                apiKey: z.string().min(1).describe("The key, as the provider issued it. Stored in this sandbox and never sent back out."),
-                label: z
-                    .string()
-                    .max(80)
-                    .optional()
-                    .describe("What to call it. Blank falls back to the provider's own name, which is all a pasted key can say about itself."),
-            }),
-        )
-        .output(OauthAccountSchema),
-    rename: oc
-        .route({
-            method: "POST",
-            path: "/keys/{provider}/account/rename",
-            summary: "Rename one connected key",
-            description: "Nothing in a pasted key says whose it is, so naming it is the only way to tell two of them apart.",
-        })
-        .input(KeyProviderParamSchema.extend(AccountRenameSchema.shape))
-        .output(OkSchema),
-    disconnect: oc
-        .route({
-            method: "POST",
-            path: "/keys/{provider}/account/disconnect",
-            summary: "Disconnect one key",
-            description: "Removes a single stored key. Any others under the same provider stay connected.",
-        })
-        .input(KeyProviderParamSchema.extend(AccountIdSchema.shape))
-        .output(OkSchema),
-};