@intentic/sandbox-contract 1.299.0 → 1.300.1

package/src/models/model-order.test.ts

@@ -1,5 +1,5 @@
 import { expect, test } from "vitest";
-import { compareCheapestFirst, compareModelIds, compareUnrankedModelIds, familyOf, namesThinking, releaseOf, tierRankOf } from "./model-order.js";
+import { compareModelIds, compareUnrankedModelIds, familyOf, namesThinking, releaseOf, tierRankOf } from "./model-order.js";
 
 // The order every provider's catalog is served and browsed in; only Anthropic's catalog arrives ranked, the rest hand
 // back sets, so their registry order is not a preference.
@@ -174,51 +174,6 @@ test("sorts an unversioned rolling alias under the releases that name their vers
     expect(["kimi-latest", "kimi-k2-0711-preview"].toSorted(compareModelIds)).toEqual(["kimi-k2-0711-preview", "kimi-latest"]);
 });
 
-// compareCheapestFirst: what the quick model's one-click helper resolves against, the same tier scale read
-// weakest-first.
-
-test("opens on the efficient rung and buries the frontier one: the exact inverse of the picker's order", () => {
-    const claude = ["claude-opus-5", "claude-sonnet-5", "claude-haiku-4-5-20251001"];
-
-    expect(claude.toSorted(compareCheapestFirst)).toEqual(["claude-haiku-4-5-20251001", "claude-sonnet-5", "claude-opus-5"]);
-    expect(claude.toSorted(compareModelIds)).toEqual(["claude-opus-5", "claude-sonnet-5", "claude-haiku-4-5-20251001"]);
-});
-
-test("keeps an UNRANKED family off the cheap end, where a plain reversal would have seated it first", () => {
-    // An id with no tier word is the provider's baseline, likelier the next flagship than a budget tier.
-    expect(["gpt-5.6", "gpt-5.4-mini"].toSorted(compareCheapestFirst)).toEqual(["gpt-5.4-mini", "gpt-5.6"]);
-    expect(["claude-mythos-1", "claude-haiku-4-5", "claude-sonnet-5"].toSorted(compareCheapestFirst).at(-1)).toBe("claude-mythos-1");
-});
-
-test("takes the NEWEST build of the cheap rung, not merely any of them", () => {
-    // Within one tier the release rule runs unchanged: cheap is a tier, not an excuse to serve a stale model.
-    expect(["claude-haiku-4-5-20251001", "claude-haiku-4-5-20260210"].toSorted(compareCheapestFirst)[0]).toBe("claude-haiku-4-5-20260210");
-    expect(["gemini-3-flash-lite", "gemini-2-flash-lite"].toSorted(compareCheapestFirst)[0]).toBe("gemini-3-flash-lite");
-});
-
-test("finds each vendor's own cheap rung, including a re-served open-weights row", () => {
-    expect(["gemini-3-pro", "gemini-3-flash", "gemini-3-flash-lite"].toSorted(compareCheapestFirst)[0]).toBe("gemini-3-flash-lite");
-    // gpt-oss is Google's cheap option; `oss` is its only tier signal, without it the id would sink instead of lead.
-    expect(["claude-opus-4-6-thinking", "gpt-oss-120b-medium"].toSorted(compareCheapestFirst)[0]).toBe("gpt-oss-120b-medium");
-    expect(["grok-4", "grok-4-fast"].toSorted(compareCheapestFirst)[0]).toBe("grok-4-fast");
-});
-
-test("reads a release-local tier ladder from the cheap end too", () => {
-    expect(["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"].toSorted(compareCheapestFirst)[0]).toBe("gpt-5.6-luna");
-});
-
-test("refuses the thinking variant of a model, however new it is", () => {
-    // A routed channel vends one row per thinking level; the cheapest model's top row must not win here.
-    expect(["gemini-3.6-flash-high", "gemini-3.5-flash-extra-low"].toSorted(compareCheapestFirst)[0]).toBe("gemini-3.5-flash-extra-low");
-    // …and it is the level that decides, not the release: same model, quieter row wins.
-    expect(["gemini-3.5-flash-high", "gemini-3.5-flash-minimal"].toSorted(compareCheapestFirst)[0]).toBe("gemini-3.5-flash-minimal");
-    // Tier still outranks thinking: a cheap thinking model beats a silent expensive one.
-    expect(["gemini-3-pro", "gemini-3.6-flash-high"].toSorted(compareCheapestFirst)[0]).toBe("gemini-3.6-flash-high");
-    // An unannotated id is neither accused of thinking nor credited with silence: it sits between the stated ends.
-    expect(["gemini-3-flash", "gemini-3.5-flash-low"].toSorted(compareCheapestFirst)[0]).toBe("gemini-3.5-flash-low");
-    expect(["gemini-3-flash", "gemini-3.6-flash-high"].toSorted(compareCheapestFirst)[0]).toBe("gemini-3-flash");
-});
-
 test("names the thinking rows, and only those", () => {
     // What a settings row shows beside a pin.
     expect(namesThinking("gemini-3.6-flash-high")).toBe(true);
@@ -231,8 +186,3 @@ test("names the thinking rows, and only those", () => {
     expect(namesThinking("kimi-k2-thinking")).toBe(true);
     expect(namesThinking("kimi-k2")).toBe(false);
 });
-
-test("falls back on the newest release for a catalog that publishes no cheap tier at all", () => {
-    // Kimi names no tier word anywhere; with tier cancelled out, newest is the honest fallback.
-    expect(["kimi-k2-0711-preview", "kimi-k2-0905-preview"].toSorted(compareCheapestFirst)[0]).toBe("kimi-k2-0905-preview");
-});

package/src/models/model-order.ts

@@ -97,7 +97,7 @@ const lastRankOf = (family: string, ranks: Readonly<Record<string, number>>): nu
 
 const releaseTierRankOf = (family: string): number => lastRankOf(family, RELEASE_TIER_RANK);
 
-// How hard an id says it will think; ties on tier, so only compareCheapestFirst's tiebreak may read it.
+// How hard an id says it will think; only the quiet-rung rule below reads it, and `namesThinking` for a label.
 const THINKING_RANK: Readonly<Record<string, number>> = {
     minimal: 0,
     none: 0,
@@ -144,28 +144,6 @@ export const compareModelIds = (left: string, right: string): number => {
 // arrival order, since a registry can reorder a tied set between refreshes.
 export const compareUnrankedModelIds = (left: string, right: string): number => compareModelIds(left, right) || left.localeCompare(right);
 
-// The same tier scale read from the weakest end, for the caller that wants the cheapest model, not the strongest. An
-// unranked family still sinks last on both orders; a tier-less catalog (Kimi) falls back to its newest release.
-export const compareCheapestFirst = (left: string, right: string): number => {
-    const leftFamily = familyOf(left);
-    const rightFamily = familyOf(right);
-    return (
-        tierRankOf(rightFamily) - tierRankOf(leftFamily) ||
-        // Before release: two rows differing only by thinking are the same model; recency must not pick between them.
-        thinkingRankOf(leftFamily) - thinkingRankOf(rightFamily) ||
-        compareRelease(releaseOf(left), releaseOf(right)) ||
-        releaseTierRankOf(rightFamily) - releaseTierRankOf(leftFamily)
-    );
-};
-
-// Tier only, not release or thinking level, so a downgrade stays legible as one. An unranked family is false on either
-// side: an unranked candidate might be the next flagship, and an unranked pick's tier is unknown to have been beaten.
-export const isCheaperRung = (candidate: string, pick: string): boolean => {
-    const candidateRank = tierRankOf(familyOf(candidate));
-    const pickRank = tierRankOf(familyOf(pick));
-    return candidateRank !== UNRANKED && pickRank !== UNRANKED && candidateRank > pickRank;
-};
-
 // True only for an id that spells out a level above the quiet end, so an unannotated id is never accused of it.
 // Exported so a settings row can label a pinned thinking variant.
 export const namesThinking = (id: string): boolean => thinkingRankOf(familyOf(id)) > UNSTATED_THINKING;

package/src/models/model-pins.ts

@@ -22,10 +22,10 @@ export interface ModelChoice {
 }
 
 // A (provider, model) pair on the wire: `${provider}:${modelId}`, the same key shape the picker mints. Used to compare
-// entries, dedupe a role list, and store autoFastModels.
+// entries and dedupe a role list.
 export const modelPinKey = (choice: ModelChoice): string => `${choice.provider}:${choice.model}`;
 
-// Splits on the first colon only: a provider id never contains one, a model id might. Exported since autoFastModels
+// Splits on the first colon only: a provider id never contains one, a model id might. Exported since a stored key
 // stores these keys.
 export const parsePinned = (pinned: string): ModelChoice | undefined => {
     const separator = pinned.indexOf(`:`);

package/src/protocol/routes.test.ts

@@ -2,7 +2,7 @@ import { eventIterator, oc } from "@orpc/contract";
 import { describe, expect, it } from "vitest";
 import { z } from "zod";
 import { SANDBOX_ROUTE_NAMES, SANDBOX_ROUTE_SHAPES, SANDBOX_ROUTES, sandboxRouteName } from "../index.js";
-import { contractRoutes, routeNameForRequest, routeShapes } from "./routes.js";
+import { contractRoutes, routeNameForRequest, routeShapes, streamOf } from "./routes.js";
 
 const fixture = {
     vpn: {
@@ -111,18 +111,38 @@ describe(`routeShapes`, () => {
         expect(routeShapes(shaped(z.object({ a: z.string() })))[`vpn.list`]).not.toBe(shapes[`vpn.list`]);
     });
 
-    it(`omits a route whose shape cannot be expressed rather than failing the walk`, () => {
-        // An oRPC event iterator wraps its output in an opaque type with no schema, so `watch` here keeps its name but
-        // no shape.
+    it(`fingerprints a stream through the frames it declares`, () => {
         const withStream = {
+            vpn: {
+                list: fixture.vpn.list,
+                watch: oc.route({ method: "GET", path: "/vpn/watch" }).output(streamOf(z.object({ a: z.string() }))),
+            },
+        };
+        expect(Object.keys(routeShapes(withStream)).toSorted()).toEqual([`vpn.list`, `vpn.watch`]);
+        // A changed frame is a changed route, which is the whole point of reaching past the iterator.
+        const reframed = { vpn: { watch: oc.route({ method: "GET", path: "/vpn/watch" }).output(streamOf(z.object({ a: z.number() }))) } };
+        expect(routeShapes(reframed)[`vpn.watch`]).not.toBe(routeShapes(withStream)[`vpn.watch`]);
+    });
+
+    it(`tells a stream of X apart from a route that answers X`, () => {
+        const frame = z.object({ a: z.string() });
+        const streamed = { vpn: { watch: oc.route({ method: "GET", path: "/vpn/watch" }).output(streamOf(frame)) } };
+        const answered = { vpn: { watch: oc.route({ method: "GET", path: "/vpn/watch" }).output(frame) } };
+        expect(routeShapes(streamed)[`vpn.watch`]).not.toBe(routeShapes(answered)[`vpn.watch`]);
+    });
+
+    it(`omits a route whose shape cannot be expressed rather than failing the walk`, () => {
+        // oRPC's own eventIterator hides its frames, which is why contracts declare streams with streamOf; one that
+        // slipped through keeps its name and loses only its shape, instead of breaking the walk for every other route.
+        const withRawIterator = {
             vpn: {
                 list: fixture.vpn.list,
                 watch: oc.route({ method: "GET", path: "/vpn/watch" }).output(eventIterator(z.object({ a: z.string() }))),
             },
         };
-        expect(Object.keys(routeShapes(withStream)).toSorted()).toEqual([`vpn.list`]);
+        expect(Object.keys(routeShapes(withRawIterator)).toSorted()).toEqual([`vpn.list`]);
         expect(
-            contractRoutes(withStream)
+            contractRoutes(withRawIterator)
                 .map((route) => route.name)
                 .toSorted(),
         ).toEqual([`vpn.list`, `vpn.watch`]);
@@ -130,34 +150,47 @@ describe(`routeShapes`, () => {
 });
 
 describe(`the real sandbox contract`, () => {
-    it(`fingerprints all but the streaming routes`, () => {
-        const unshaped = SANDBOX_ROUTE_NAMES.filter((name) => !(name in SANDBOX_ROUTE_SHAPES));
-        // oRPC gives an event iterator's output no schema, so these can't be fingerprinted; named rather than counted
-        // so a new one added here fails the test.
-        expect(unshaped.toSorted()).toEqual([
+    it(`fingerprints every route, streams included`, () => {
+        // Nothing may opt out: a route with no fingerprint is a route the browser can never tell has drifted, and the
+        // streaming ones (system.events, agent.attach, the exit dials) carry the frames a stale daemon breaks first.
+        expect(SANDBOX_ROUTE_NAMES.filter((name) => !(name in SANDBOX_ROUTE_SHAPES))).toEqual([]);
+    });
+
+    it(`fingerprints the streaming routes eventIterator used to hide`, () => {
+        expect(
+            [
+                `agent.attach`,
+                `capabilities.add`,
+                `exit.rotate`,
+                `exit.start`,
+                `exit.use`,
+                `intentic.applyEvents`,
+                `intentic.run`,
+                `netdisk.mount`,
+                `system.events`,
+                `system.manageDeviceSandbox`,
+                `system.runDeviceAgentFlow`,
+                `vpn.connect`,
+            ].filter((name) => name in SANDBOX_ROUTE_SHAPES).toSorted(),
+        ).toEqual([
             `agent.attach`,
             `capabilities.add`,
-            // The three exit moves stream since bringing an exit up dials and verifies over tens of seconds, failing at
-            // any step.
             `exit.rotate`,
             `exit.start`,
             `exit.use`,
             `intentic.applyEvents`,
             `intentic.run`,
-            // A mount dials a file server and can fail at any step with something to read, like a vpn dial.
             `netdisk.mount`,
             `system.events`,
             `system.manageDeviceSandbox`,
-            // The device agent updates or restarts itself; the stream dies with the process, so lines arrive as they
-            // happen.
             `system.runDeviceAgentFlow`,
             `vpn.connect`,
         ]);
     });
 
-    it(`fingerprints every other route exactly once`, () => {
+    it(`fingerprints every route exactly once`, () => {
         expect(Object.keys(SANDBOX_ROUTE_SHAPES).every((name) => SANDBOX_ROUTE_NAMES.includes(name))).toBe(true);
-        expect(Object.keys(SANDBOX_ROUTE_SHAPES).length).toBe(SANDBOX_ROUTE_NAMES.length - 12);
+        expect(Object.keys(SANDBOX_ROUTE_SHAPES).length).toBe(SANDBOX_ROUTE_NAMES.length);
     });
 
     it(`derives a route table with no duplicate names`, () => {

package/src/protocol/routes.ts

@@ -1,9 +1,23 @@
+import { eventIterator } from "@orpc/contract";
 import { z } from "zod";
 
 // Named route surface of the daemon's contract (`<group>.<route>`), derived automatically so nothing here is
 // hand-maintained. The daemon advertises which routes it implements (the /events hello frame); the browser diffs that
 // against its own contract so an old daemon's gap is a named feature check, not a silent 404.
 
+// Every streamed route declares its frames through this, never oRPC's `eventIterator` directly: that returns an opaque
+// standard-schema validator holding no reachable inner schema, so a stream's payload would be unfingerprintable and its
+// drift invisible. The frame schema rides along under a symbol, which oRPC never reads and JSON never serializes.
+// Typed as a plain `symbol`, not the inferred unique one: a unique symbol would ride into every contract's inferred
+// type and break declaration emit on a local name nothing outside can refer to.
+const FRAME: symbol = Symbol.for("intentic.contract.frame");
+
+export const streamOf = <T extends z.ZodType>(frame: T) => Object.assign(eventIterator(frame), { [FRAME]: frame });
+
+// The frame schema behind a streamed route's validator, or undefined for an ordinary request/response schema.
+const frameOf = (schema: unknown): z.ZodType | undefined =>
+    typeof schema === "object" && schema !== null && FRAME in schema ? ((schema as Record<symbol, unknown>)[FRAME] as z.ZodType) : undefined;
+
 // Structural shape of `~orpc.route`, the metadata oRPC attaches to every `oc.route(...)` procedure; read this way since
 // oRPC's internal types aren't public.
 interface ContractProcedureLike {
@@ -85,18 +99,24 @@ const fingerprint = (value: unknown): string => {
     return hash.toString(36);
 };
 
-// One route's wire shape, or undefined if it can't be expressed (a streaming route with no underlying schema). `io`
-// matters: a `.default()` field is optional in and required out, so both directions must be read separately.
+// One side of a route as JSON Schema. A streamed side is read through its frame and tagged, so "answers X" and "streams
+// frames of X" can never fingerprint alike. `io` matters: a `.default()` field is optional in and required out.
+const wireShape = (schema: unknown, io: "input" | "output"): unknown => {
+    if (schema === undefined) {
+        return undefined;
+    }
+    const frame = frameOf(schema);
+    return frame === undefined ? z.toJSONSchema(schema as z.ZodType, { io }) : { stream: z.toJSONSchema(frame, { io }) };
+};
+
+// One route's wire shape, or undefined if it can't be expressed at all.
 const procedureShape = (value: unknown): string | undefined => {
     if (typeof value !== "object" || value === null || !("~orpc" in value)) {
         return undefined;
     }
     const { inputSchema, outputSchema } = (value as ContractSchemasLike)["~orpc"];
     try {
-        return fingerprint({
-            in: inputSchema === undefined ? undefined : z.toJSONSchema(inputSchema as z.ZodType, { io: "input" }),
-            out: outputSchema === undefined ? undefined : z.toJSONSchema(outputSchema as z.ZodType, { io: "output" }),
-        });
+        return fingerprint({ in: wireShape(inputSchema, "input"), out: wireShape(outputSchema, "output") });
     } catch {
         return undefined;
     }

package/src/schemas/agent.ts

@@ -260,8 +260,6 @@ export const AgentTurnSchema = z
             .describe(
                 "Ask for the same work at a higher rate for a higher price. A request rather than a promise: the answer says what actually happened.",
             ),
-        // Vetoes automatic tier selection for this turn; the judge still runs and records its verdict, but nothing is
-        // substituted.
         // Set by the composer on the one turn whose model the Auto judge chose; the daemon only records it.
         autoPicked: z
             .boolean()
@@ -269,12 +267,6 @@ export const AgentTurnSchema = z
             .describe(
                 "Whether this turn's model was chosen for you by reading the conversation's opening message, rather than picked by hand. Recorded so the choice can be judged later against what you did next.",
             ),
-        tierHold: z
-            .boolean()
-            .optional()
-            .describe(
-                "Run exactly the model that was picked, even when the turn looks simple enough for a cheaper one. The judgement is still recorded; nothing is substituted.",
-            ),
         // The opt-in editor context chip: what the user is looking at, folded into the prompt daemon-side.
         editorContext: EditorContextSchema.optional().describe(
             'What the user has open in their editor, folded into the prompt so that pointing words like "this" resolve.',

package/src/schemas/agents.ts

@@ -241,17 +241,6 @@ export const AgentSummarySchema = z.object({
     effort: z.string().optional().describe("How hard that turn was told to think."),
     thinking: z.boolean().optional().describe("Whether that turn showed its reasoning."),
     fast: z.boolean().optional().describe("Whether that turn asked for higher speed. What was asked for, not what was served."),
-    // The judge's verdict on the last turn, not what actually ran: seeds tomorrow's composer preview, absent means
-    // nothing judged yet.
-    tier: z
-        .enum(["fast", "standard"])
-        .optional()
-        .describe("How hard its last turn looked to the complexity judge. What the next turn's preview needs, not what actually ran."),
-    // Standing per-conversation choice, restored into the composer on open and sent back every turn, like `fast` above.
-    tierHold: z
-        .boolean()
-        .optional()
-        .describe("Whether this conversation is pinned to the picked model, so a turn that looks simple is never moved to a cheaper one."),
     account: z.string().optional().describe("Which connected account paid for it."),
     // The worktree branch (agent/<id>); absent for a non-isolated (main-tree) conversation.
     branch: z.string().optional().describe("The branch its private copy works on. Absent for a conversation that works directly in the shared tree."),

package/src/schemas/capabilities.ts

@@ -420,5 +420,8 @@ export const CapabilityProbeSchema = z.object({
     message: z
         .string()
         .describe("What happened, in the words a person standing in front of the form needs: the service's own answer, or its refusal."),
+    // The account the credential turned out to be: a login, an org slug, a project name. Only when the card declares
+    // where to read it and the service answered with one; a form offers it as the connection's name.
+    who: z.string().optional().describe("Who the service said the credential belongs to, when it said."),
 });
 export type CapabilityProbe = z.infer<typeof CapabilityProbeSchema>;

package/src/schemas/devices.ts

@@ -1,6 +1,6 @@
 // What one of the user's own machines is running.
 import { z } from "zod";
-import { type HostFacts, HostFactsSchema, WslEnvironmentSchema } from "./hosts.js";
+import { hostCardOf, hostEnvironmentOf, type HostFacts, HostFactsSchema, WslEnvironmentSchema } from "./hosts.js";
 import { DEV_VERSION } from "../state/versions.js";
 // Desktop-sync report shape shared by the agent, daemon and browser, produced only by `intentic-machine status --json`.
 // The agent never reports `sandboxes`; the docker half is filled in by whoever reads the report, scoped to the reader's
@@ -451,54 +451,100 @@ export type DevicesList = z.infer<typeof DevicesListSchema>;
 // The physical computer a device is an environment of. Windows and every WSL distro on it are one machine with one
 // Docker engine, one screen and one set of disks, each environment holding its own agent and its own door.
 export interface Machine {
-    /** A lone device's own key, so its address does not change; a folded machine's is the hostname its doors share. */
+    /** The card its doors hang off, else the hostname they share, else a lone uncarded device's own key. */
     readonly key: string;
     readonly label: string;
-    /** Windows first, then distros by label: the side that owns the screen leads. */
+    /** Windows first, then distros by the name WSL registered: the side that owns the screen leads. */
     readonly environments: readonly Device[];
 }
 
 export const deviceHostname = (device: Device): string | undefined => device.facts?.hostname ?? device.report?.hostname;
-export const deviceEnvironment = (device: Device): string | undefined => environmentOf(device.facts, device.report);
-export const isWslDevice = (device: Device): boolean => deviceEnvironment(device)?.startsWith("wsl:") === true;
 
-// Two native installs that merely share a name stay two machines; only a distro joins the machine whose hostname it
-// carries, which is the one fact that makes the name safe to join on.
-const byEnvironment = (a: Device, b: Device): number => Number(isWslDevice(a)) - Number(isWslDevice(b)) || a.label.localeCompare(b.label);
+// Which side of a machine a device is. Its door id names the environment it connected under (`<card>::wsl:<distro>`),
+// and that is all an environment nobody has reached since this daemon booted can say about itself: liveness resets on
+// restart, so facts and reports are absent on a side that is merely asleep.
+export const deviceEnvironment = (device: Device): string | undefined =>
+    environmentOf(device.facts, device.report) ?? (device.hostId === undefined ? undefined : hostEnvironmentOf(device.hostId));
+
+const WSL_PREFIX = "wsl:";
+export const isWslDevice = (device: Device): boolean => deviceEnvironment(device)?.startsWith(WSL_PREFIX) === true;
+// The distro a device runs, by whatever evidence it holds; absent on a native install and on one that has said nothing.
+export const deviceDistro = (device: Device): string | undefined => {
+    const environment = deviceEnvironment(device);
+    return environment?.startsWith(WSL_PREFIX) === true ? environment.slice(WSL_PREFIX.length) : undefined;
+};
+
+// Native first, then distros by the name WSL registered them under rather than by their door id, which is that same
+// name behind a card's and so would order a PC's distros by which card each was connected through.
+const byEnvironment = (a: Device, b: Device): number =>
+    Number(isWslDevice(a)) - Number(isWslDevice(b)) || (deviceDistro(a) ?? a.label).localeCompare(deviceDistro(b) ?? b.label);
 
 const hostnameKey = (device: Device): string | undefined => deviceHostname(device)?.toLowerCase();
 
-const siblingsOf = (device: Device, devices: readonly Device[]): Device[] => {
-    const key = hostnameKey(device);
-    const shared = key === undefined ? [device] : devices.filter((candidate) => hostnameKey(candidate) === key);
-    return shared.length > 1 && shared.some(isWslDevice) ? shared.toSorted(byEnvironment) : [device];
+// The card a device's door hangs off: one card is one computer, so two doors naming the same card are one machine
+// whatever either has said about itself — which is the whole of what an environment that has never connected says.
+const cardKey = (device: Device): string | undefined => (device.hostId === undefined ? undefined : hostCardOf(device.hostId));
+
+// What makes two devices one computer: a shared card, or a shared hostname where a distro answers to it, since WSL
+// hands a distro the Windows machine's name. Two native installs that merely share a name stay two machines.
+const tokensOf = (device: Device, distroNames: ReadonlySet<string>): string[] => {
+    const card = cardKey(device);
+    const hostname = hostnameKey(device);
+    return [
+        ...(card === undefined ? [] : [`card:${card.toLowerCase()}`]),
+        ...(hostname !== undefined && distroNames.has(hostname) ? [`host:${hostname}`] : []),
+    ];
 };
 
-const machineOf = (device: Device, environments: readonly Device[]): Machine => {
-    if (environments.length === 1) {
-        return { key: device.key, label: device.label, environments };
-    }
-    // Folding needs a hostname, so it is present here; the fallback only keeps the type honest.
-    const hostname = deviceHostname(device) ?? device.key;
-    return { key: hostname, label: hostname, environments };
-};
+// Components over both joins at once: a device holding a card token and a hostname token is the evidence that merges
+// the machines those tokens named, so a distro connected under a card of its own still lands on the PC it runs on.
+interface Component {
+    readonly tokens: Set<string>;
+    readonly devices: Device[];
+}
 
-export const machinesOf = (devices: readonly Device[]): Machine[] => {
-    const folded = new Set<Device>();
-    const machines: Machine[] = [];
+const componentsOf = (devices: readonly Device[]): Component[] => {
+    const distroNames = new Set(devices.filter(isWslDevice).map(hostnameKey).filter((name) => name !== undefined));
+    const components: Component[] = [];
     for (const device of devices) {
-        if (folded.has(device)) {
+        const tokens = tokensOf(device, distroNames);
+        const [head, ...merged] = components.filter((component) => tokens.some((token) => component.tokens.has(token)));
+        if (head === undefined) {
+            components.push({ tokens: new Set(tokens), devices: [device] });
             continue;
         }
-        const environments = siblingsOf(device, devices);
-        for (const environment of environments) {
-            folded.add(environment);
+        for (const other of merged) {
+            other.tokens.forEach((token) => head.tokens.add(token));
+            head.devices.push(...other.devices);
+            components.splice(components.indexOf(other), 1);
         }
-        machines.push(machineOf(device, environments));
+        for (const token of tokens) {
+            head.tokens.add(token);
+        }
+        head.devices.push(device);
     }
-    return machines;
+    return components;
 };
 
+// Addressed by the card of the side that owns the screen, an address that does not change when a second environment
+// connects — unlike a row key, which is a hostname another environment can take first. An uncarded fold has only the
+// hostname its doors share, and an uncarded lone device its own key. Called what the owner calls it: the name the
+// leading environment carries, unless that is nothing but its door id, which reads as a PC named after one of its
+// own sides.
+const machineOf = (environments: readonly Device[]): Machine => {
+    const [first, ...rest] = environments;
+    // A component holds the device that made it; the empty case only keeps the type honest.
+    if (first === undefined) {
+        return { key: "", label: "", environments };
+    }
+    const named = environments.map(cardKey).find((key) => key !== undefined) ?? (rest.length === 0 ? undefined : deviceHostname(first));
+    const label = first.label === first.hostId ? (cardKey(first) ?? first.label) : first.label;
+    return { key: named ?? first.key, label, environments };
+};
+
+export const machinesOf = (devices: readonly Device[]): Machine[] =>
+    componentsOf(devices).map((component) => machineOf(component.devices.toSorted(byEnvironment)));
+
 // Every door whose docker reports a given sandbox slug, in list order. More than one is the ordinary case, not a
 // conflict: Windows and the WSL distros on it share one engine, so each door answers for the same containers.
 const doorsRunningSandbox = (devices: readonly Device[], slug: string | undefined): Device[] =>

package/src/schemas/model-route.ts

@@ -2,7 +2,7 @@ import { z } from "zod";
 import { AgentProviderSchema } from "./agent.js";
 
 // Asked once per chat, on the message it opens with; answers with the model, effort and account that whole
-// conversation runs on. Distinct from prompt-complexity.ts, which judges a turn at a time and may only ever name a
+// conversation runs on. The one place a model is chosen for a chat, and it runs once: from turn two the pick is an
 // cheaper rung of the provider already picked: this one chooses freely, and only before anything has run.
 
 export const ModelRouteAskSchema = z.object({

package/src/schemas/providers/usage.ts

@@ -91,17 +91,6 @@ export const UsageTurnSchema = z.object({
     compactions: z.number().optional(),
     contextTokens: z.number().optional(),
     contextWindow: z.number().optional(),
-    // tierScore (0..1 from judgeComplexity, vs FAST_CEILING) absent means the judge did not run. tierRules is which
-    // named features fired. tierRouted is whether it actually ran on the cheap rung, not implied by the score.
-    tierScore: z.number().optional(),
-    tierRules: z.array(z.string()).optional(),
-    tierRouted: z.boolean().optional(),
-    // The verdict and the cutoff it was judged against (settings.autoTierEagerness); absent rows predate the knob and
-    // fall back to FAST_CEILING.
-    tierFast: z.boolean().optional(),
-    tierCeiling: z.number().optional(),
-    // The turn carried AgentTurn.tierHold: the user vetoed a fast verdict. Absent means no veto.
-    tierDenied: z.boolean().optional(),
     // This turn's model was chosen by the Auto judge reading the conversation's opening message, not picked by hand.
     // Marked on that one turn only; a later row of the same conversation naming a different model is the user
     // overruling it, which is the escalation rate this feature has to be able to answer for.

package/src/schemas/settings.ts

@@ -314,35 +314,6 @@ export const SandboxSettingsSchema = z.object({
         .describe(
             "Which repositories keep a changelog, and so get a user-facing note written alongside each merge. A list rather than a switch, and empty by default, because the commit writer's standing rule is to copy the house style rather than impose one, and a repository that has never written such a note gives it nothing to copy.",
         ),
-    // off: the judge never runs.
-    // shadow (default): the judge scores every turn to the ledger; nothing is routed.
-    // on: a turn judged fast runs on the cheap rung, where the provider publishes one.
-    // judge: the deterministic scorer keeps writing shadow rows but routes nothing; the Auto picker row is offered
-    // instead, and a model reads a new chat's opening message once to choose what the whole conversation runs on.
-    // Exclusive with `on` because the two answer the same question at different moments, and a per-turn downgrade
-    // underneath a picked-by-model conversation would be overruling a choice already made about this chat.
-    autoTier: z
-        .enum(["off", "shadow", "on", "judge"])
-        .default("shadow")
-        .describe(
-            "Whether an easy-looking turn may run on a cheaper model from the same provider. Three states rather than a switch, because the middle one is the only honest road to the third: it scores every turn and routes nothing, so the guess can become a measurement before it changes anything. It can only ever route down, so the worst case is one turn's quality rather than a bill nobody asked for. The fourth, Auto, answers a different question: rather than downgrading turns one by one, it offers an Auto row in the model picker and has a model read a new chat's first message to choose what that whole conversation runs on.",
-        ),
-    // `balanced` is what every verdict recorded before this setting existed was judged against, so shadow history stays
-    // comparable.
-    autoTierEagerness: z
-        .enum(["cautious", "balanced", "eager"])
-        .default("balanced")
-        .describe(
-            "How readily a turn counts as simple enough for the cheaper model. It moves only the cutoff: at every setting a turn still has to say something positively easy, so nothing here can downgrade a short vague request.",
-        ),
-    // Auto uses the same cheap-end order as this list (`compareCheapestFirst`), so the two can never disagree.
-    autoFastModels: z
-        .array(z.string())
-        .max(10)
-        .default([])
-        .describe(
-            "Which cheaper model a downgraded turn lands on. A list so a sandbox spanning providers can name a rung on each, but not a fallback ladder: an entry naming a different provider than the turn is on is skipped rather than tried, because switching provider retires the conversation and starting over to save a fraction of a penny is not a saving. Empty picks the cheapest the turn's own provider publishes.",
-        ),
     agentRetentionDays: z
         .number()
         .min(0)
@@ -522,27 +493,6 @@ export const TurnExperimentSchema = z.object({
     cohort: z.string().optional(),
 });
 export type TurnExperiment = z.infer<typeof TurnExperimentSchema>;
-// Absent when the experiment isn't running (flag off, or no holdout set); absence reads as "not measured", not as zero.
-// Read off the spend ledger's tier fields over the window; no counterfactual $ saved, since the ledger holds only what
-// turns cost. Not a `TurnExperiment`: there's no randomized control, routing follows the settings mode over time, not a
-// coin flip. Absent (no turn judged, autoTier off) reads as "not measured", not "measured, found nothing".
-export const TierReportSchema = z.object({
-    // Turns the judge ran on in the window, the denominator under everything below.
-    judged: z.number(),
-    // …of which landed at or below FAST_CEILING: the turns that looked simple. fast ÷ judged is the fast share.
-    fast: z.number(),
-    // Upper bound on any saving, never an estimate: moving these turns to the cheap rung would have cost something too.
-    atStakeUsd: z.number(),
-    // Turns that actually ran the cheap rung, and what they cost there. Realized, not projected.
-    routed: z.number(),
-    routedUsd: z.number(),
-    // The guardrail: fast-judged turns whose very next ledger row asked for a dearer model. Past a few percent of
-    // `fast`, the judge costs more in trust than it saves.
-    escalated: z.number(),
-    // Fast-judged turns the user vetoed outright (UsageTurn.tierDenied): the same signal, said even louder.
-    denied: z.number(),
-});
-export type TierReport = z.infer<typeof TierReportSchema>;
 // One dependency version or library improvement suggested or pinned.
 export const DependencyImprovementSchema = z.object({
     prevented: z.string(),
@@ -564,8 +514,6 @@ export const SavingsReportSchema = z.object({
     search: TurnExperimentSchema.optional(),
     // Same absence rule as `search`: not measured, never zero.
     map: TurnExperimentSchema.optional(),
-    // Automatic tier selection's readout, see TierReportSchema. Absent ⇒ nothing was judged in the window.
-    tier: TierReportSchema.optional(),
     dependencies: DependencySavingsSchema.optional(),
 });
 export type SavingsReport = z.infer<typeof SavingsReportSchema>;

package/src/schemas/workspace/workspace-search.ts

@@ -11,6 +11,13 @@ export const WorkspaceSearchQuerySchema = z.object({
             "Narrow the search to one kind: plain text, filenames, definitions, references, symbols, or code structure. Leave it out to blend them, which also answers a question asked in words.",
         ),
     includeIgnored: z.stringbool().optional().describe("Search inside installed packages and other ignored folders too."),
+    // One subtree, root-relative, no trailing slash: the caller's own scope (a UI narrowed to one project) rather than a
+    // pattern. Unlike `include` it is a prefix, so it composes with whatever globs the user typed.
+    dir: z
+        .string()
+        .max(512)
+        .optional()
+        .describe("Only look inside this folder, given as a path from the workspace root. Leave it out to search everything."),
     // The three switches every search box has; caseSensitive off means case-insensitive, not ripgrep's smart case.
     literal: z.stringbool().optional().describe("Treat the query as fixed text rather than a pattern."),
     word: z.stringbool().optional().describe("Match whole words only."),

package/src/state/history-state.ts

@@ -32,6 +32,9 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
     { path: "provider-refusals.json", portability: "carry" },
     // Models refused to this sandbox's credentials; expires daily, same subscriptions apply elsewhere.
     { path: "model-refusals.json", portability: "carry" },
+    // What each account has run out of, for a plan publishing no allowance to poll — the refusal is the reading.
+    // Carried like the refusals above: an allowance belongs to the account, not to the machine that spent it.
+    { path: "observed-limits.json", portability: "carry" },
     // First-time dependency setup requests; carried so an interrupted queue survives export, entries self-remove.
     { path: "dependency-requests.json", portability: "carry" },
     // Which device cards were already offered; carry, not identity, since it holds ids, never a token.