@intentic/sandbox-contract 1.246.1 → 1.247.0

package/src/schemas/settings.ts

@@ -1,7 +1,8 @@
 // settings: per-sandbox agent settings (.intentic/config/settings.json)
 import { z } from "zod";
 import { CommandJudgeModeSchema } from "../safety-policy.js";
-import { AdmissionPolicySchema, AdmissionRuleSchema, AgentRunPinSchema } from "./agent.js";
+import { ModelRoleSchema } from "../model-roles.js";
+import { AdmissionPolicySchema, AdmissionRuleSchema, ModelPinSchema } from "./agent.js";
 // Which prompt the agent is, before this turn composes anything on top. Two built-in bases and an escape
 // hatch: Intentic's own (the default), Claude Code's preset, or the owner's text. Declared out here rather
 // than inline in the settings object because both sides of the wire branch on it, the daemon to build the
@@ -262,6 +263,8 @@ export const SkillRemoveSchema = z.object({
 //   workspaceMap     , computes an AREA index of the project a run starts in and prepends it to the
 //                        conversation's opening message, so the turn does not have to buy its own orientation
 //                        with a directory listing. Generated from the filesystem every time, never stored.
+//   workspaceMapHoldout, conversation-level measurement control for workspaceMap (UsageTurn.mapArm), judged on
+//                        the directory listings the opening turn ran rather than on its searches.
 //   sidecars         , the background pass converging a markdown shadow of every binary workspace file
 //                        (docx/pdf/images/audio → .intentic/local/cache/derived/) the moment it lands, via
 //                        the baked fileq CLI, so reasoning-time reads are pre-derived. The CLI itself is
@@ -388,6 +391,21 @@ export const SandboxSettingsSchema = z.object({
         .describe(
             "Open every conversation with a map of the project it starts in: what is in it, what each part is for, and where the agent is standing. Worked out fresh each time rather than written down anywhere, because a written layout is wrong within a fortnight. Off by default, since it spends tokens on the first message of every conversation.",
         ),
+    /* Measurement control for the map, at CONVERSATION level for the plainest of reasons: the note is sent on
+     * the opening message, so every later turn of a mapped conversation has a map in its transcript and a
+     * per-turn flip would call eleven treated turns controls.
+     *
+     * Judged on `UsageTurn.openingListings` and read on each conversation's opening turn (usage/turn-experiments.ts),
+     * because that is the turn the note was sent to and averaging it across a long conversation divides the
+     * effect by the conversation's length. 0 ⇒ no measurement and every conversation receives the map. */
+    workspaceMapHoldout: z
+        .number()
+        .min(0)
+        .max(1)
+        .default(0)
+        .describe(
+            "What share of conversations to open without the map, so the two can be compared. Whole conversations rather than individual turns, because the map is sent once and stays in the conversation's history afterwards.",
+        ),
     /* THE MARKDOWN SHADOWS OF BINARY FILES, the eager half of fileq (_sandbox/fileq). The lazy half — the
      * `fileq` CLI an agent runs mid-task — is always on PATH and gated only by its skill; this switch is
      * about the BACKGROUND pass: the daemon watching /work and converging a sidecar under
@@ -441,26 +459,39 @@ export const SandboxSettingsSchema = z.object({
         .max(1)
         .default(0)
         .describe("What share of commands to leave untrimmed, so the saving can be measured against a real comparison rather than estimated."),
-    /* The models behind the small automatic jobs that are not a conversation, today the commit message
-     * written when an agent's work lands. An ORDERED list of `${provider}:${modelId}`, tried top to bottom, or
-     * EMPTY for Auto.
-     *
-     * A LIST rather than a pick, because the single interesting failure of this feature is a model that is
-     * connected and simply will not answer today: the account's allowance went on the chat, and one spent
-     * provider then takes the job down for hours while the others sit idle. Written in order, the daemon steps
-     * over the spent one and the message still gets written (agent/quick-model.ts walks it).
-     *
-     * Empty is the default and still the interesting case: Auto is resolved from whatever accounts are
-     * connected at the moment it is read (resolveQuickModels), so it can never name a provider this sandbox has
-     * no credential for, it improves by itself when one is added, and it is a ladder too, the cheapest rung of
-     * every connected provider, best first. Storing resolved ids here instead would go stale exactly like a
-     * pinned model does. */
-    quickModel: z
-        .array(z.string())
-        .max(10)
-        .default([])
+    /* WHICH MODEL DOES WHICH JOB, one ordered list per ROLE (model-roles.ts declares them all).
+     *
+     * ONE KEY RATHER THAN SEVENTEEN, and the record is keyed by the role catalog rather than by free strings: a
+     * job that starts choosing a model tomorrow becomes configurable by adding a row to that table, and the
+     * settings page, the resolver and the daemon's lookup all follow without a schema change. Seventeen named
+     * fields here would be the same table written a fourth time, in the one place where getting it out of step
+     * spends somebody's money.
+     *
+     * IT REPLACED THREE BUNDLED KEYS — `quickModel`, `agentRunModels` and `commandJudgeModels` — and the reason
+     * is worth keeping: the first two were grouped by assumed INTENSITY, not by job. "Quick" covered commit
+     * messages, session titles and loop verdicts at once, so an owner who wanted better commit subjects could
+     * not ask for them without also moving every session title onto the same model; "agent runs" covered a
+     * production incident and a documentation sweep with one tier. An intensity is a guess about work its owner
+     * knows better, and neither the configuration nor the UI was actually saving anyone anything by making it.
+     *
+     * EACH LIST IS AN ORDERED LADDER of pins, tried top to bottom, because the interesting failure is a model
+     * that is connected and will not answer today: the account's allowance went on the chat, and one spent
+     * provider takes that job down for hours while the others sit idle.
+     *
+     * AN ABSENT OR EMPTY LIST IS THE INTERESTING CASE and means the role's declared floor (resolveRoleModels): a
+     * one-shot helper derives an Auto ladder from whatever is connected right now — so it can never name a
+     * provider this sandbox has no credential for, and it improves by itself as accounts are added — while a
+     * whole session falls to the model the owner picked for their own chat, because nothing here can judge what
+     * a session is worth and a wrong guess is billed whole. Storing resolved ids instead would go stale exactly
+     * as a pinned model does. */
+    // `partialRecord`, not `record`: an exhaustive one would make every role a required key, so a settings file
+    // that has never been touched would have to spell out seventeen empty arrays to be valid, and adding a role
+    // would invalidate every settings file in existence. An absent key IS the answer "this role has no list".
+    modelRoles: z
+        .partialRecord(ModelRoleSchema, z.array(ModelPinSchema).max(10))
+        .default({})
         .describe(
-            "Which models do the small automatic jobs that are not a conversation, such as writing a commit message. A list rather than one pick, tried in order, because the interesting failure is a model that is connected and simply will not answer today. Empty means work it out from whatever is connected, which improves by itself as accounts are added.",
+            "Which models do which job, one ordered list per job: commit messages, session titles, the safety judge, pipeline fixes, and every other place this sandbox picks a model for you. Tried in order, so one spent account does not take a job down. A job with no list falls back to its own default: cheapest connected for the one-shot helpers, your own chat model for whole sessions.",
         ),
     /* WHICH REPOS KEEP A CHANGELOG, the repos whose commits carry a `Release-Note:` trailer, written by the
      * same quick model that drafts the subject (git/commit-message.ts) and harvested at release time.
@@ -482,40 +513,6 @@ export const SandboxSettingsSchema = z.object({
         .describe(
             "Which repositories keep a changelog, and so get a user-facing note written alongside each merge. A list rather than a switch, and empty by default, because the commit writer's standing rule is to copy the house style rather than impose one, and a repository that has never written such a note gives it nothing to copy.",
         ),
-    /* WHAT AN AGENT RUN OPENS ON, the tier above quickModel, and the answer for every turn a SURFACE starts
-     * rather than a person at a composer: Fix with agent on a pipeline or a deployment, a Maintenance chore, a
-     * Documentation or Acceptance run, the fix a failed pre-push check proposes. An ORDERED list of PINS, each
-     * naming a provider and model AND how that one is to be run (AgentRunPinSchema); EMPTY ⇒ whatever the chat
-     * composer would have started with, which is the honest floor because it is the model the user already
-     * chose to work with.
-     *
-     * EACH ENTRY CARRIES ITS OWN REASONING AND COST KNOBS, which is why these are objects rather than the
-     * `${provider}:${model}` keys the two lists around them still hold. The effort used to be one field beside
-     * the list, answering for every model in it, and the entries of this list are the least interchangeable
-     * things on the page: the head is the tier the owner wants the work done at and what follows it is the
-     * account that catches it when the first is spent. AgentRunPinSchema has the rest of the argument.
-     *
-     * A LIST, for the reason quickModel is one: the account at the head runs out, and every surface-started run
-     * in the sandbox then fails on a credential the user cannot see from the row they pressed. Written in order,
-     * the next one down catches it (turn-resume.ts walks it).
-     *
-     * PINNED, NOT DERIVED, the deliberate difference from quickModel one line above, and the reason these are
-     * two settings rather than one. A quick helper exists to stay OFF the frontier tier, so cheapest-connected
-     * is the right automatic answer and an empty list resolves to Auto. An agent run has to read a failing
-     * suite, or a container log, or a story, and repair the thing: the tier is a judgement about how much the
-     * job is worth, nothing here can make it, and a wrong guess is billed in whole sessions rather than in
-     * tokens. So an empty list here resolves to NOTHING and the composer's own pick answers instead.
-     *
-     * The daemon applies this to any turn flagged `unattended` that names no model of its own, one rule, so a
-     * surface added tomorrow inherits it by saying what it is instead of re-deriving where models come from. A
-     * surface MAY still name one (the shared run button's caret, Acceptance's per-run pick), and that wins. */
-    agentRunModels: z
-        .array(AgentRunPinSchema)
-        .max(10)
-        .default([])
-        .describe(
-            "Which models run the work a screen starts rather than a person: fixing a red pipeline, a maintenance chore, an acceptance run. Tried in order, so one spent account does not take every such run down, and each entry says how hard that model should think as well as which one it is. Empty falls back to whatever the chat would have used, which is the honest floor because it is the model you already chose to work with.",
-        ),
     /* AUTOMATIC TIER SELECTION: may the daemon run an easy-looking turn on a cheaper rung of the provider the
      * user is already on, instead of on the model they picked?
      *
@@ -558,9 +555,9 @@ export const SandboxSettingsSchema = z.object({
             "How readily a turn counts as simple enough for the cheaper model. It moves only the cutoff: at every setting a turn still has to say something positively easy, so nothing here can downgrade a short vague request.",
         ),
     /* WHICH CHEAP MODEL A DOWNGRADED TURN LANDS ON, an ordered list of `${provider}:${model}` keys
-     * (quickModelKey), or EMPTY for Auto.
+     * (modelPinKey), or EMPTY for Auto.
      *
-     * Empty is the default and the interesting case, exactly as quickModel's is: Auto is the cheapest row the
+     * Empty is the default and the interesting case, exactly as a one-shot role's is: Auto is the cheapest row the
      * turn's own provider publishes, read through the same cheap-end order (compareCheapestFirst), so the two
      * features can never disagree about which rung is the cheap one, and connecting an account tomorrow
      * improves the answer by itself.
@@ -724,35 +721,13 @@ export const SandboxSettingsSchema = z.object({
      * entitled to say so, and before this they could not: the old rulebook could be set to allow everything, and
      * the redesign quietly made itself the one part of the sandbox you could only opt further into.
      *
-     * Judged commands are also the one automatic job whose model choice genuinely differs from the rest of
-     * `quickModel`'s work, which is why the list below exists rather than a line in the comment above it: a
-     * commit message written by a model that misread the diff is a sentence somebody edits, and a verdict
-     * written by a model that misread a command is a card that should not have been raised or, worse, one that
-     * should have been. */
+     * WHICH MODEL judges is not answered here: it is the `safety-judge` role in `modelRoles`, like every other
+     * job in this sandbox that picks one. It used to need its own key, on the argument that a verdict is worth a
+     * different model than a commit message — true, and the fact that it had to be argued for one job at a time
+     * is exactly what the role catalog replaced. */
     commandJudge: CommandJudgeModeSchema.default("on").describe(
         "Whether a model reads your safety policy before a flagged command runs. Off judges nothing and asks about nothing; Watch judges everything and records it without ever interrupting you, which is how you find out what your policy actually does before you let it stop anything; On lets the verdict decide. Wiping a disk or deleting under /history asks at every setting — that rule is typed rather than judged, and cannot be turned off.",
     ),
-    /* WHICH MODEL READS THE POLICY, an ordered list of `${provider}:${modelId}` keys (quickModelKey) walked top
-     * to bottom, or EMPTY for whatever the quick model would be.
-     *
-     * A LIST, for the reason every other model setting here is one: the head runs out and the whole feature goes
-     * with it. Falling back to the quick chain rather than to Auto is deliberate — it is what this did before the
-     * setting existed, so an owner who never opens the row keeps exactly the behaviour they had, and one who
-     * writes an entry is saying that command verdicts are worth a different model than commit messages.
-     *
-     * THE ARGUMENT FOR SETTING IT AT ALL, since the cheapest connected rung is the default: this prompt is the
-     * one quick job that is genuinely adversarial. Its input includes text the agent is about to run, which may
-     * have arrived from a stranger's web page, and a small model can be talked round by it (command-judge.ts is
-     * candid about that). It is also the job where being WRONG is expensive in both directions — a needless card
-     * teaches the owner to click through the next one. Neither is a reason for us to spend somebody's frontier
-     * allowance by default; both are reasons for them to be able to. */
-    commandJudgeModels: z
-        .array(z.string())
-        .max(10)
-        .default([])
-        .describe(
-            "Which models decide whether a flagged command should run, tried in order so one spent account does not take the gate down. Empty uses whatever the quick model is, which is what this did before the setting existed.",
-        ),
     /* HOW MUCH AN AGENT MAY DELEGATE, the three ceilings the Claude Code harness enforces on its own Agent
      * tool, surfaced here because their defaults are tuned for a laptop and this is a container the owner sized.
      *
@@ -836,10 +811,15 @@ export const SavingsArmSchema = z.object({ turns: z.number(), mean: z.number() }
  * `metric` says what `mean` counts and what `deltaPct` is a delta in, and choosing it is most of the work.
  *   searchCalls    , the search teaching: the searches a turn ran, which the teaching directly changes.
  *   openingSearches, the same, narrower: the searches before the turn first touched a file.
- * Search mechanisms must not be judged on COST. Cost is a whole turn's work, a search mechanism moves one part
- * of it, and the part sits inside the noise of the rest. */
+ *   openingListings   , the project map: the directory listings a turn ran to work out where it was, which is
+ *                      what the map hands over and what its note tells the turn not to go and fetch.
+ *   callsBeforeTarget, the map again, on value rather than compliance: how far the turn walked before
+ *                      touching a file it went on to edit.
+ * Neither mechanism may be judged on COST. Cost is a whole turn's work, both of these move one part of it, and
+ * the part sits inside the noise of the rest. The map's whole payload is about 200 tokens, so a cost reading
+ * would be measuring a quantity two orders of magnitude under its own error bar. */
 export const TurnMetricReadingSchema = z.object({
-    metric: z.enum(["searchCalls", "openingSearches"]),
+    metric: z.enum(["searchCalls", "openingSearches", "openingListings", "callsBeforeTarget"]),
     on: SavingsArmSchema,
     off: SavingsArmSchema,
     /* HOW MUCH LONGER, when the margin spans zero and the honest answer is "keep collecting": the additional
@@ -896,9 +876,14 @@ export const TurnExperimentSchema = z.object({
     // counts toward the daemon's real threshold instead of a number the browser guessed. Shared by every
     // reading: they are the same turns counted differently, so they clear it together.
     minTurns: z.number(),
-    // The randomized unit behind the arm counts. Turn mechanisms default to turns; teaching loaded into a
-    // provider session randomizes and analyzes whole conversations so repeated turns are not false replicas.
-    sampleUnit: z.enum(["turns", "conversations"]).optional(),
+    /* The randomized unit behind the arm counts. Turn mechanisms default to turns. Teaching loaded into a
+     * provider session randomizes and analyzes whole conversations, so repeated turns are not false replicas.
+     *
+     * "opening turns" is the third case and belongs to a treatment sent ONCE: the project map rides the first
+     * message and nothing after it, so the sample is one turn per conversation rather than an average over
+     * the conversation's turns. The distinction is not cosmetic. Averaging a first-turn treatment across a
+     * twelve-turn conversation divides its effect by twelve and reports the remainder as noise. */
+    sampleUnit: z.enum(["turns", "conversations", "opening turns"]).optional(),
     // Content-addressed treatment version. Present where mixing rows from two instruction revisions would turn
     // one experiment into two unnamed ones; the reader filters to this (latest) cohort.
     cohort: z.string().optional(),
@@ -942,6 +927,10 @@ export type TierReport = z.infer<typeof TierReportSchema>;
 export const SavingsReportSchema = z.object({
     input: InputSavingsSchema,
     search: TurnExperimentSchema.optional(),
+    /* The project map's arms, read on opening turns (see TurnExperimentSchema.sampleUnit). Absent under the
+     * same rule as `search`: the switch is off, or no holdout is set, and a section that is not there reads as
+     * "not measured", which is the truth, where zeros would read as "measured, worth nothing". */
+    map: TurnExperimentSchema.optional(),
     // Automatic tier selection's readout, see TierReportSchema. Absent ⇒ nothing was judged in the window.
     tier: TierReportSchema.optional(),
 });

package/src/schemas/usage.ts

@@ -119,6 +119,65 @@ export const UsageTurnSchema = z.object({
      *
      * Absent ⇒ as for `searchCalls`. */
     openingSearches: z.number().optional(),
+    /* THE LISTINGS THIS TURN RAN TO WORK OUT WHERE IT WAS, `ls`, `ls /work`, `tree intentic`, the LS tool
+     * aimed at the same places (isRootListing owns the rule). What the project map is judged on, and the
+     * reason it could not be judged before.
+     *
+     * `searchCalls` counts a directory listing and a ripgrep as one event, deliberately, so that a taxonomy
+     * cannot report whichever spelling of a search the model happened to reach for. That is right for the
+     * search teaching and blind to the map: measured over 468 mapped sessions of this workspace against 497
+     * unmapped ones, searches before the first file moved +7.6% with a margin of ±17.6pp, while the share of
+     * sessions opening with a directory listing fell from 46.3% to 32.1%. The map does not shorten the
+     * orientation burst, it changes what the burst is made of, and only this counts the difference.
+     *
+     * UP TO THE FIRST FILE, exactly like `openingSearches`, which took the corpus to settle. Counted over the
+     * whole turn instead, the same sessions give 66.4% against 73.3%, a gap of 6.9pp where the orientation
+     * window gives 14.2pp. The dilution is not noise: a turn already at work lists the directory it has
+     * narrowed to, and no map could have answered that. The shape of the listing cannot tell the two apart,
+     * because it is the same shape; only when it happened can.
+     *
+     * Absent ⇒ the turn predates this being measured, never a turn that listed nothing. */
+    openingListings: z.number().optional(),
+    /* TOOL CALLS BEFORE THE TURN FIRST TOUCHED A FILE IT WENT ON TO EDIT: how far it walked before reaching
+     * the thing it turned out to be looking for. The corpus study this map was designed from measured the
+     * same quantity by hand (the workspace's docs/agent-exploration-patterns.md §4: median 4, mean 8.2) and called it the one
+     * honest reading of whether orientation got better.
+     *
+     * IT CAN ONLY BE KNOWN AT THE END, which is why it is recorded here and computed nowhere else: whether a
+     * file was the target is a fact about the turn's edits, and the turn has to finish before that is
+     * decided. The route keeps the first call index per path and intersects it with the edit ledger.
+     *
+     * Absent on a turn that edited nothing, which is most short turns, and NOT zero: a turn with no target
+     * never reached one, and averaging that in as "reached it immediately" would report the turns that did
+     * no work as the best targeted. That absence costs the reading three quarters of the population, so it
+     * is a metric to accumulate for months rather than a gate to wait on. */
+    callsBeforeTarget: z.number().optional(),
+    /* WHICH ARM OF THE PROJECT MAP EXPERIMENT this conversation ran (settings.workspaceMapHoldout), and how
+     * many characters the note actually cost when it was sent.
+     *
+     * CONVERSATION-STABLE, and for a plainer reason than the search teaching's: the map is sent once, on the
+     * opening message, so every later turn of a mapped conversation is a turn whose transcript holds a map.
+     * A per-turn flip would label eleven treated turns as controls.
+     *
+     * `mapChars` rather than a token estimate, because characters are what the renderer's budget is in
+     * (workspace-map.ts caps the note at 2,800) and a tokenizer's answer would vary by model. Present only on
+     * the turn that actually sent one, so the ledger says what the feature costs instead of assuming it: the
+     * median note over this workspace's own corpus is 795 characters against a ceiling of 2,800.
+     *
+     * Absent ⇒ no measurement (the holdout is zero, or the row predates it); true/false ⇒ mapped/unmapped. */
+    mapArm: z.boolean().optional(),
+    mapChars: z.number().optional(),
+    /* WHICH TURN OF ITS CONVERSATION THIS WAS, counting from zero, so an opening turn can be recognised from
+     * one row instead of inferred from the rows around it.
+     *
+     * The inference it replaces is wrong at exactly one place and it is the place that matters: a reader
+     * windowed to the last seven days would take each conversation's earliest row IN THE WINDOW as its
+     * opening turn, so every conversation that started the week before would contribute a mid-conversation
+     * turn to a reading about first turns. The project map is sent on turn zero and nowhere else, so that
+     * misreading is not an edge case for it, it is the measurement.
+     *
+     * Absent ⇒ the row predates this, or the turn belonged to no conversation at all. */
+    turnIndex: z.number().optional(),
     /* DID THIS TURN FINISH, OR DID IT STOP TALKING. The fields that tell the two apart, and the reason
      * `outcome` alone could never.
      *

package/dist/agent-run-model.d.ts

@@ -1,4 +0,0 @@
-import { type QuickModelSource } from "./quick-model.js";
-import type { AgentRunPin } from "./schemas/agent.js";
-export declare const resolveAgentRunModels: (sources: readonly QuickModelSource[], pinned: readonly AgentRunPin[]) => readonly AgentRunPin[];
-//# sourceMappingURL=agent-run-model.d.ts.map

package/dist/agent-run-model.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-run-model.d.ts","sourceRoot":"","sources":["../src/agent-run-model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA2CtD,eAAO,MAAM,qBAAqB,YAAa,SAAS,gBAAgB,EAAE,UAAU,SAAS,WAAW,EAAE,KAAG,SAAS,WAAW,EAoBhI,CAAC"}

package/dist/agent-run-model.js

@@ -1,13 +0,0 @@
-import { quickModelKey } from "./quick-model.js";
-export const resolveAgentRunModels = (sources, pinned) => {
-    const ready = new Set(sources.filter((source) => source.ready).map((source) => source.provider));
-    const requested = pinned.filter((pin) => ready.has(pin.provider));
-    const chain = [];
-    for (const pin of requested) {
-        if (!chain.some((held) => quickModelKey(held) === quickModelKey(pin))) {
-            chain.push(pin);
-        }
-    }
-    return chain;
-};
-//# sourceMappingURL=agent-run-model.js.map

package/dist/agent-run-model.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-run-model.js","sourceRoot":"","sources":["../src/agent-run-model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAyB,MAAM,kBAAkB,CAAC;AA4CxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAAoC,EAAE,MAA8B,EAA0B,EAAE;IAClI,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAIjG,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAQlE,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACpE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC"}

package/dist/quick-model.d.ts

@@ -1,15 +0,0 @@
-import type { AgentProvider } from "./schemas/agent.js";
-export interface QuickModelSource {
-    readonly provider: AgentProvider;
-    readonly ready: boolean;
-    readonly models: readonly string[];
-}
-export interface QuickModelChoice {
-    readonly provider: AgentProvider;
-    readonly model: string;
-}
-export declare const quickModelKey: (choice: QuickModelChoice) => string;
-export declare const parsePinned: (pinned: string) => QuickModelChoice | undefined;
-export declare const pinnedModelLabel: (choice: QuickModelChoice) => string;
-export declare const resolveQuickModels: (sources: readonly QuickModelSource[], pinned: readonly string[]) => readonly QuickModelChoice[];
-//# sourceMappingURL=quick-model.d.ts.map

package/dist/quick-model.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"quick-model.d.ts","sourceRoot":"","sources":["../src/quick-model.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA+BxD,MAAM,WAAW,gBAAgB;IAM7B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IAGjC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CAC1B;AAID,eAAO,MAAM,aAAa,WAAY,gBAAgB,KAAG,MAA8C,CAAC;AASxG,eAAO,MAAM,WAAW,WAAY,MAAM,KAAG,gBAAgB,GAAG,SAM/D,CAAC;AAOF,eAAO,MAAM,gBAAgB,WAAY,gBAAgB,KAAG,MACyC,CAAC;AAuEtG,eAAO,MAAM,kBAAkB,YAAa,SAAS,gBAAgB,EAAE,UAAU,SAAS,MAAM,EAAE,KAAG,SAAS,gBAAgB,EAa7H,CAAC"}

package/dist/quick-model.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"quick-model.js","sourceRoot":"","sources":["../src/quick-model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAoD9E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAwB,EAAU,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;AASxG,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAc,EAAgC,EAAE;IACxE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;AACxF,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAwB,EAAU,EAAE,CACjE,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;AAKtG,MAAM,UAAU,GAAG,CAAC,MAAwB,EAAsB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;AAKrH,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAKtE,MAAM,aAAa,GAAG,CAAC,QAAuB,EAAU,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;AAQpH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC;AAIjE,MAAM,MAAM,GAAG,CAAC,QAAuB,EAAU,EAAE;IAC/C,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1E,CAAC,CAAC;AAYF,MAAM,UAAU,GAAG,CAAC,OAAoC,EAA+B,EAAE,CACrF,OAAO;KACF,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;KAChC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;IAChB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7E,CAAC,CAAC;KACD,QAAQ,CACL,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACZ,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IACxC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC9C,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnE,CAAC;AAiBV,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAoC,EAAE,MAAyB,EAA+B,EAAE;IAC/H,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QAIrC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAGH,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAChG,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC1D,CAAC,CAAC"}

package/src/agent-run-model.test.ts

@@ -1,76 +0,0 @@
-import { expect, test } from "vitest";
-import { resolveAgentRunModels } from "./agent-run-model.js";
-import type { QuickModelSource } from "./quick-model.js";
-import type { AgentRunPin } from "./schemas/agent.js";
-
-/* Which model a run somebody's BUTTON started opens on. The rule answers the same two surfaces its quick-model
- * sibling does: the daemon walks it, the settings row names it, so what these pin is the pair of properties
- * that separate the two: an account this sandbox cannot reach never sits at the head of the chain, and an empty
- * answer stays empty rather than being filled in with a tier nobody chose.
- *
- * And one property neither of those covers, new with the pins being objects: an entry's own knobs are the
- * entry's, so what survives the walk is the WHOLE pin. A resolver that handed back the pair inside it would run
- * the fallback at the head's effort, which is a tier that appears nowhere on the user's screen. */
-
-const CLAUDE: QuickModelSource = { provider: `claude`, ready: true, models: [`claude-opus-5`, `claude-sonnet-5`] };
-const CODEX: QuickModelSource = { provider: `codex`, ready: true, models: [`gpt-5.6`] };
-const GOOGLE: QuickModelSource = { provider: `gemini`, ready: true, models: [`gemini-3-pro`] };
-
-const offline = (source: QuickModelSource): QuickModelSource => ({ ...source, ready: false });
-
-const pin = (provider: string, model: string, knobs: Partial<AgentRunPin> = {}): AgentRunPin => ({ provider, model, ...knobs });
-
-test("keeps the user's own order, this list is read, never ranked", () => {
-    // The opposite of the quick chain, which sorts by tier and cost. Here the order IS the setting: someone who
-    // put Opus above GPT wants Opus first, and a resolver that knew better would spend the wrong account.
-    expect(resolveAgentRunModels([CLAUDE, CODEX], [pin(`codex`, `gpt-5.6`), pin(`claude`, `claude-opus-5`)])).toEqual([
-        { provider: `codex`, model: `gpt-5.6` },
-        { provider: `claude`, model: `claude-opus-5` },
-    ]);
-});
-
-test("steps over a provider this sandbox has no credential for", () => {
-    // The whole reason the setting is a list. With Claude disconnected the head would otherwise be an account
-    // that fails every Fix with agent, while a perfectly good Codex sits underneath it.
-    expect(resolveAgentRunModels([offline(CLAUDE), CODEX], [pin(`claude`, `claude-opus-5`), pin(`codex`, `gpt-5.6`)])).toEqual([
-        { provider: `codex`, model: `gpt-5.6` },
-    ]);
-});
-
-test("each surviving entry keeps its own knobs, not the head's", () => {
-    // The effort used to be one setting beside the list, so a fallback ran at whatever the head was set to. It
-    // is now a property of the entry that actually answers, which is the only place it was ever true.
-    expect(
-        resolveAgentRunModels(
-            [offline(CODEX), CLAUDE],
-            [pin(`codex`, `gpt-5.6`, { effort: `low` }), pin(`claude`, `claude-opus-5`, { effort: `max`, thinking: true })],
-        ),
-    ).toEqual([{ provider: `claude`, model: `claude-opus-5`, effort: `max`, thinking: true }]);
-});
-
-test("resolves to nothing when no pin is reachable: it does NOT fall back to whatever is connected", () => {
-    // The deliberate difference from resolveQuickModels, which lands on its Auto ladder here. An agent run is
-    // billed in whole sessions, so an unreachable list hands the choice back to the caller's floor (the user's
-    // own composer pick) rather than spending an account they never pointed at.
-    expect(resolveAgentRunModels([offline(CLAUDE), GOOGLE], [pin(`claude`, `claude-opus-5`)])).toEqual([]);
-});
-
-test("an empty list resolves to nothing even with accounts connected", () => {
-    expect(resolveAgentRunModels([CLAUDE, CODEX, GOOGLE], [])).toEqual([]);
-});
-
-test("drops a duplicate rather than spending two attempts proving one account is out, and the first one's knobs are the ones kept", () => {
-    // Two entries can now name one model and disagree about how hard it thinks, which is what reordering a list
-    // by hand produces. The one the user reads first is the one they meant.
-    expect(
-        resolveAgentRunModels([CLAUDE], [pin(`claude`, `claude-opus-5`, { effort: `max` }), pin(`claude`, `claude-opus-5`, { effort: `low` })]),
-    ).toEqual([{ provider: `claude`, model: `claude-opus-5`, effort: `max` }]);
-});
-
-test("carries a model id the static catalog has never heard of", () => {
-    // The picker offers a custom-id escape hatch, so a pin can name a model released after this build. Second-
-    // guessing it here would quietly run something other than what the settings row says.
-    expect(resolveAgentRunModels([CLAUDE], [pin(`claude`, `claude-opus-9-preview`)])).toEqual([
-        { provider: `claude`, model: `claude-opus-9-preview` },
-    ]);
-});

package/src/agent-run-model.ts

@@ -1,65 +0,0 @@
-import { quickModelKey, type QuickModelSource } from "./quick-model.js";
-import type { AgentRunPin } from "./schemas/agent.js";
-
-/* WHAT A SURFACE-STARTED AGENT RUN OPENS ON, the resolver for `agentRunModels`, sibling to resolveQuickModels
- * and deliberately not the same function.
- *
- * BOTH ARE ORDERED LISTS, FOR THE SAME REASON. One connected account whose allowance went on the chat this
- * morning is enough to take every one of these down: the user presses Fix with agent on a red pipeline, an
- * isolated session opens, and it dies on a credential error they cannot see from the row. Written in order, the
- * next entry catches it.
- *
- * THEY DIFFER ON WHAT AN EMPTY LIST MEANS, and that difference is the whole reason this is its own file rather
- * than a flag on the other one. A quick helper exists to stay OFF the frontier tier, so "work it out from what
- * is connected" is a good answer and quickModel's empty list resolves to a derived Auto ladder. An agent run is
- * a full session with a worktree, billed whole: nothing here can judge whether a job is worth the frontier tier,
- * so an empty list resolves to NOTHING and the caller falls back to the model the user picked for their own
- * chat, a choice they made, rather than one this file guessed for them. For the same reason there is no Auto
- * ladder underneath a list that has been emptied by disconnection: it would spend an account the user never
- * pointed at, on the most expensive kind of run this app starts.
- *
- * WHAT "STEPPED OVER" MEANS HERE IS NARROWER than the quick chain's, and worth being exact about. The quick
- * chain re-asks the next rung when a call comes back refused, because a one-shot that failed has cost nothing
- * and can simply be run again. An agent session cannot be replayed that way, by the time a provider refuses
- * mid-turn the agent may have already edited files, so this list is read ONCE, at the moment the turn is
- * composed, and steps over exactly one thing: an account that is not connected. A model that accepts the turn
- * and fails later is a failed run the user reads on the card, like any other. */
-
-/* The pins that could actually be started right now, in the user's own order.
- *
- * `sources` is the same readiness view resolveQuickModels takes, so both settings rows agree about which
- * accounts this sandbox can send to, a pin greyed as "Not connected" in one row and silently spent by the
- * other would be the worst of both.
- *
- * A pin whose provider is gone is DROPPED rather than held: it would otherwise sit at the head of the chain
- * failing every run, which is exactly what the list exists to prevent. It stays on SCREEN, greyed, the settings
- * row renders the stored list, not this one, because a setting that vanished from view would look like the app
- * had eaten it.
- *
- * THE WHOLE PIN SURVIVES, not the pair inside it: the entry's own effort, harness and cost knobs are what the
- * turn is composed from (turn-resume.ts), so a resolver that handed back a bare (provider, model) would silently
- * run the head of the list at the provider's defaults. Nothing here reads or judges those fields, which is the
- * point of carrying them whole.
- *
- * Empty out means nobody has pinned anything this sandbox can reach, and the caller's floor takes over. */
-export const resolveAgentRunModels = (sources: readonly QuickModelSource[], pinned: readonly AgentRunPin[]): readonly AgentRunPin[] => {
-    const ready = new Set(sources.filter((source) => source.ready).map((source) => source.provider));
-    // Taken verbatim, unvalidated against the catalog, the same reading resolveQuickModels gives its keys and
-    // for the same reason: the picker offers a custom-id escape hatch for a model the static catalog has not
-    // caught up with, and second-guessing the id here would run a different model than the settings row names.
-    const requested = pinned.filter((pin) => ready.has(pin.provider));
-    /* The same model twice would spend two attempts proving the same account is out. Hand-edited list, so this
-     * is a real state rather than a defensive branch.
-     *
-     * THE FIRST OF A PAIR WINS, WHOLE. Two entries can now name one model and differ in their knobs (the same
-     * Sonnet at Max and again at Low, written while reordering the list), and the one the user reads first is
-     * the one they meant; keeping the earlier position with the later entry's effort would run a tier that
-     * appears nowhere the pin does. */
-    const chain: AgentRunPin[] = [];
-    for (const pin of requested) {
-        if (!chain.some((held) => quickModelKey(held) === quickModelKey(pin))) {
-            chain.push(pin);
-        }
-    }
-    return chain;
-};