@intentic/sandbox-contract 1.330.0 → 1.332.0

package/src/models/model-setups.test.ts

@@ -0,0 +1,100 @@
+import type { ModelPin } from "../schemas/agent.js";
+import type { ModelSource } from "./model-pins.js";
+import { endpointProvider } from "./agent-catalog.js";
+import type { ModelRole } from "./model-roles.js";
+import { ladderIsEmpty, presetPins, roleLadder, rolePins, roleSetupId, setupsFromRoleLists } from "./model-setups.js";
+
+// What a job runs on is read here by the daemon and the browser alike, so the rules are pinned once: where a job starts,
+// what a preset is worked out from, and what a written setup overrides.
+
+const opus: ModelPin = { provider: `claude`, model: `claude-opus-5-5`, effort: `high` };
+const haiku: ModelPin = { provider: `claude`, model: `claude-haiku-4-5` };
+
+const CLAUDE: ModelSource = { provider: `claude`, ready: true, models: [`claude-haiku-4-5-20251001`, `claude-opus-4-8`, `claude-opus-5`, `claude-sonnet-5`] };
+const CODEX: ModelSource = { provider: `codex`, ready: true, models: [`gpt-5.2-codex`, `gpt-5.6-luna`, `gpt-5.6-sol`, `gpt-5.6-terra`, `gpt-5-mini`] };
+const GEMINI: ModelSource = { provider: `gemini`, ready: true, models: [`gemini-3-flash`, `gemini-3-flash-lite`, `gemini-3-pro`] };
+
+const NOTHING_SET = { modelSetups: [], roleSetups: {} };
+
+describe(`a preset worked out from what is connected`, () => {
+    test(`takes each connected provider's newest model on the preset's rung, in the order they come`, () => {
+        expect(presetPins(`high`, [CLAUDE, CODEX, GEMINI]).map((pin) => pin.model)).toEqual([`claude-opus-5`, `gpt-5.6-sol`, `gemini-3-pro`]);
+        expect(presetPins(`medium`, [CLAUDE, CODEX, GEMINI]).map((pin) => pin.model)).toEqual([`claude-sonnet-5`, `gpt-5.6-terra`, `gemini-3-flash`]);
+        expect(presetPins(`low`, [CLAUDE, CODEX, GEMINI]).map((pin) => pin.model)).toEqual([`claude-haiku-4-5-20251001`, `gpt-5.6-luna`, `gemini-3-flash-lite`]);
+    });
+
+    test(`leaves out a provider that is not connected, a local endpoint, and anything past three`, () => {
+        const local: ModelSource = { provider: endpointProvider(`ollama`), ready: true, models: [`qwen-coder`] };
+        const extra: ModelSource = { provider: `grok`, ready: true, models: [`grok-5-heavy`] };
+        expect(presetPins(`high`, [{ ...CLAUDE, ready: false }, local, CODEX, GEMINI, extra]).map((pin) => pin.provider)).toEqual([`codex`, `gemini`, `grok`]);
+        expect(presetPins(`high`, [CLAUDE, CODEX, GEMINI, extra])).toHaveLength(3);
+    });
+
+    test(`takes a provider's own model over one it serves from another maker`, () => {
+        const google: ModelSource = { provider: `gemini`, ready: true, models: [`claude-opus-4-6-thinking`, `gemini-3-pro`, `gemini-3-flash`] };
+        expect(presetPins(`high`, [google])).toEqual([{ provider: `gemini`, model: `gemini-3-pro` }]);
+        // With none of its own on the rung, the borrowed one still serves.
+        expect(presetPins(`high`, [{ ...google, models: [`claude-opus-4-6-thinking`, `gemini-3-flash`, `gemini-3-flash-lite`] }])).toEqual([
+            { provider: `gemini`, model: `claude-opus-4-6-thinking` },
+        ]);
+    });
+
+    test(`is empty while nothing is connected`, () => {
+        expect(presetPins(`low`, [])).toEqual([]);
+    });
+});
+
+describe(`which setup a job runs on`, () => {
+    test(`a job nobody placed runs on nothing, however much is connected`, () => {
+        expect(roleSetupId(NOTHING_SET, `commit-message`)).toBeUndefined();
+        expect(ladderIsEmpty(roleLadder(NOTHING_SET, `safety-judge`))).toBe(true);
+        expect(rolePins(NOTHING_SET, `pipeline-fix`, [CLAUDE, CODEX, GEMINI])).toEqual([]);
+    });
+
+    test(`a job put on a preset nobody edited runs what is connected, and follows it`, () => {
+        const settings = { modelSetups: [], roleSetups: { "commit-message": `low` } };
+        expect(roleLadder(settings, `commit-message`)).toEqual({ kind: `preset`, preset: `low` });
+        expect(rolePins(settings, `commit-message`, [CLAUDE])).toEqual([{ provider: `claude`, model: `claude-haiku-4-5-20251001` }]);
+    });
+
+    test(`a written preset is run as written, and stops following what is connected`, () => {
+        const settings = { modelSetups: [{ id: `low`, pins: [opus] }], roleSetups: { "commit-message": `low` } };
+        expect(rolePins(settings, `commit-message`, [CLAUDE, CODEX])).toEqual([opus]);
+    });
+
+    test(`a preset that was only renamed still follows what is connected`, () => {
+        const settings = { modelSetups: [{ id: `low`, name: `Cheap` }], roleSetups: { "commit-message": `low` } };
+        expect(roleLadder(settings, `commit-message`)).toEqual({ kind: `preset`, preset: `low` });
+    });
+
+    test(`a job put on a setup of the owner's runs that setup's models`, () => {
+        const settings = { modelSetups: [{ id: `setup-1`, name: `Reviews`, pins: [opus, haiku] }], roleSetups: { "commit-message": `setup-1` } };
+        expect(rolePins(settings, `commit-message`, [CLAUDE])).toEqual([opus, haiku]);
+    });
+
+    test(`a job put on a setup that is gone is on none`, () => {
+        const settings = { modelSetups: [], roleSetups: { "commit-message": `setup-9` } };
+        expect(roleSetupId(settings, `commit-message`)).toBeUndefined();
+    });
+
+    test(`a setup of the owner's with no models is empty, never a preset`, () => {
+        const settings = { modelSetups: [{ id: `setup-1`, name: `Later` }], roleSetups: { "pipeline-fix": `setup-1` } };
+        expect(ladderIsEmpty(roleLadder(settings, `pipeline-fix`))).toBe(true);
+    });
+});
+
+test(`per-job lists become setups every job runs exactly as before on`, () => {
+    const cases = [
+        [`commit-message`, [haiku]],
+        [`session-title`, [haiku]],
+        [`pipeline-fix`, [opus]],
+        [`safety-judge`, []],
+    ] as const satisfies readonly (readonly [ModelRole, readonly ModelPin[]])[];
+    const settings = setupsFromRoleLists(Object.fromEntries(cases));
+
+    for (const [role, pins] of cases) {
+        expect(rolePins(settings, role, [CLAUDE, CODEX])).toEqual(pins);
+    }
+    // A job that never had a list, or had an empty one, ran on nothing and is on none.
+    expect([settings.roleSetups[`loop-iteration`], settings.roleSetups[`safety-judge`]]).toEqual([undefined, undefined]);
+});

package/src/models/model-setups.ts

@@ -0,0 +1,151 @@
+import { z } from "zod";
+import { type ModelPin, ModelPinSchema } from "../schemas/agent.js";
+import { isEndpointProvider } from "./agent-catalog.js";
+import { compareModelIds, modelRungOf } from "./model-order.js";
+import type { ModelSource } from "./model-pins.js";
+import { MODEL_ROLE_IDS, MODEL_ROLES, type ModelRole, PRESET_SETUPS, type PresetSetup } from "./model-roles.js";
+
+// A setup is a named, ordered list of models that any number of jobs run on: edited once, used by every job put there.
+// Every sandbox has three, Low, Medium and High, worked out from the accounts it has connected until the owner edits
+// one; the owner adds any others. A job runs on nothing until someone puts it on a setup: nothing spends an account, and
+// no judge starts holding commands, because an account was connected. Each job's catalog row suggests a preset
+// (model-roles.ts `setup`) for when it is placed. Every reader resolves a job through here, daemon and browser alike, so
+// the settings page shows what will run.
+
+export const MODEL_SETUP_ID = /^[a-z0-9][a-z0-9-]{0,39}$/;
+
+export const ModelSetupSchema = z.object({
+    id: z.string().regex(MODEL_SETUP_ID).describe("Which setup this is. `low`, `medium` and `high` are the three every sandbox has; any other is one you made."),
+    name: z.string().trim().min(1).max(40).optional().describe("What it is called on the settings page. Left out, a preset keeps its own name."),
+    pins: z
+        .array(ModelPinSchema)
+        .max(10)
+        .optional()
+        .describe(
+            "The models it runs on, tried in order, so one spent account does not take its jobs down. Left out on a preset, it is worked out from the accounts this sandbox has connected and follows them as they change; left out on one you made, it has none.",
+        ),
+});
+export type ModelSetup = z.infer<typeof ModelSetupSchema>;
+
+export const isPresetSetup = (id: string): id is PresetSetup => PRESET_SETUPS.some((preset) => preset === id);
+
+// The settings a job's models are read from; a slice, so a caller holding only these two can resolve.
+export interface SetupSettings {
+    readonly modelSetups: readonly ModelSetup[];
+    readonly roleSetups: Partial<Record<ModelRole, string>>;
+}
+
+const SUGGESTED = new Map<ModelRole, PresetSetup>(MODEL_ROLES.map((role) => [role.id, role.setup]));
+
+/** The preset suggested for a job when it is placed. */
+export const suggestedSetup = (role: ModelRole): PresetSetup => SUGGESTED.get(role) ?? `medium`;
+
+// First entry wins: a hand-edited file holding one id twice means the earlier, as everywhere else a list is read.
+export const storedSetup = (settings: Pick<SetupSettings, "modelSetups">, id: string): ModelSetup | undefined =>
+    settings.modelSetups.find((setup) => setup.id === id);
+
+/** The setup a job runs on, or undefined while it is on none (never placed, or placed on a setup that is gone). */
+export const roleSetupId = (settings: SetupSettings, role: ModelRole): string | undefined => {
+    const assigned = settings.roleSetups[role];
+    return assigned !== undefined && (isPresetSetup(assigned) || storedSetup(settings, assigned) !== undefined) ? assigned : undefined;
+};
+
+// What a setup runs on before anything is connected or resolved: a written list, or a preset still to be worked out.
+// A snapshot of this is what a turn carries, so it is judged by one setup however its accounts change mid-turn.
+export type SetupLadder = { readonly kind: `pins`; readonly pins: readonly ModelPin[] } | { readonly kind: `preset`; readonly preset: PresetSetup };
+
+const NO_MODELS: SetupLadder = { kind: `pins`, pins: [] };
+
+export const setupLadder = (settings: Pick<SetupSettings, "modelSetups">, id: string | undefined): SetupLadder => {
+    if (id === undefined) {
+        return NO_MODELS;
+    }
+    const pins = storedSetup(settings, id)?.pins;
+    if (pins !== undefined) {
+        return { kind: `pins`, pins };
+    }
+    return isPresetSetup(id) ? { kind: `preset`, preset: id } : NO_MODELS;
+};
+
+export const roleLadder = (settings: SetupSettings, role: ModelRole): SetupLadder => setupLadder(settings, roleSetupId(settings, role));
+
+/** True only for a ladder that can never name a model, whatever is connected: a written list left empty. */
+export const ladderIsEmpty = (ladder: SetupLadder): boolean => ladder.kind === `pins` && ladder.pins.length === 0;
+
+const PRESET_RUNG = { high: 0, medium: 1, low: 2 } as const satisfies Record<PresetSetup, number>;
+
+// Enough to step over one spent account and then another; a preset longer than this would mostly be read, not tried.
+const PRESET_LENGTH = 3;
+
+// The first segment most of a catalog's ids share (`gemini`, `gpt`, `claude`): the provider's own family, as opposed to
+// a model it also serves from someone else, which Google's catalog does with Claude's.
+const ownPrefix = (models: readonly string[]): string | undefined => {
+    const counts = new Map<string, number>();
+    for (const model of models) {
+        const prefix = model.split(/[-_]/)[0] ?? model;
+        counts.set(prefix, (counts.get(prefix) ?? 0) + 1);
+    }
+    return [...counts].toSorted(([, a], [, b]) => b - a)[0]?.[0];
+};
+
+// A provider's pick for a rung: its own newest there, or a borrowed one only when it has none of its own.
+const newestOnRung = (models: readonly string[], rung: number): string | undefined => {
+    const own = ownPrefix(models);
+    const onRung = models.filter((model) => modelRungOf(model) === rung).toSorted(compareModelIds);
+    return onRung.find((model) => model.split(/[-_]/)[0] === own) ?? onRung[0];
+};
+
+/**
+ * A preset's models, from what is connected: each connected provider's newest model of its own on the preset's rung, in
+ * the order the sources come in, at most three. `models` must hold only models that can run a turn, since a preset feeds whole
+ * sessions as well as one-shot jobs. Local endpoints are left out: what someone installed for themselves is theirs to
+ * put on a setup, not a suggestion.
+ */
+export const presetPins = (preset: PresetSetup, sources: readonly ModelSource[]): readonly ModelPin[] =>
+    sources
+        .filter((source) => source.ready && !isEndpointProvider(source.provider))
+        .flatMap((source) => {
+            const newest = newestOnRung(source.models, PRESET_RUNG[preset]);
+            return newest === undefined ? [] : [{ provider: source.provider, model: newest }];
+        })
+        .slice(0, PRESET_LENGTH);
+
+export const ladderPins = (ladder: SetupLadder, sources: readonly ModelSource[]): readonly ModelPin[] =>
+    ladder.kind === `pins` ? ladder.pins : presetPins(ladder.preset, sources);
+
+/** The models a job runs on, in try order, before readiness filters them (model-pins.ts `readyChain`). */
+export const rolePins = (settings: SetupSettings, role: ModelRole, sources: readonly ModelSource[]): readonly ModelPin[] =>
+    ladderPins(roleLadder(settings, role), sources);
+
+/**
+ * Setups for a set of per-job lists, the shape settings had before setups (2026-10-12): jobs holding the same list share
+ * one setup, a list most of whose jobs are suggested one preset becomes that preset while it is free, and the rest are
+ * new setups. A job with no list, or an empty one, ran on nothing and is left on none. Exported for the settings
+ * history and for tests that want a job on exact models.
+ */
+export const setupsFromRoleLists = (lists: Partial<Record<ModelRole, readonly ModelPin[]>>): SetupSettings & { modelSetups: ModelSetup[] } => {
+    const modelSetups: ModelSetup[] = [];
+    const roleSetups: Partial<Record<ModelRole, string>> = {};
+    const groups = new Map<string, ModelRole[]>();
+    for (const role of MODEL_ROLE_IDS) {
+        const list = lists[role];
+        if (list !== undefined && list.length > 0) {
+            const key = JSON.stringify(list);
+            groups.set(key, [...(groups.get(key) ?? []), role]);
+        }
+    }
+    let made = 0;
+    for (const roles of groups.values()) {
+        const pins = lists[roles[0]!] ?? [];
+        // The preset most of these jobs are suggested; a tie goes to the first job's, the table's own order.
+        const votes = roles.map(suggestedSetup);
+        const preset = votes.toSorted((a, b) => votes.filter((vote) => vote === b).length - votes.filter((vote) => vote === a).length)[0]!;
+        const free = storedSetup({ modelSetups }, preset) === undefined;
+        const id = free ? preset : `setup-${++made}`;
+        modelSetups.push(free ? { id, pins: [...pins] } : { id, name: `Setup ${made}`, pins: [...pins] });
+        for (const role of roles) {
+            roleSetups[role] = id;
+        }
+    }
+    return { modelSetups, roleSetups };
+};

package/src/models/plan-pools.test.ts

@@ -1,5 +1,6 @@
 import {
     bindingWindow,
+    currentWindows,
     gatesModel,
     gatingWindows,
     headroomState,
@@ -116,6 +117,38 @@ test("a reading is live until its reset, or, with none published, for one window
     expect(windowLive(window({ kind: "claude:tangelo" }), NOW - 400 * HOUR, NOW)).toBe(true);
 });
 
+test("a pool whose window closed since its reading stays on the account, at the floor and marked lapsed, not dropped", () => {
+    const NOW = 1_700_000_000_000;
+    const HOUR = 3_600_000;
+    // The case that lost the five-hour row: re-reads failing for hours, the weekly pools still current.
+    const stale: AccountUsage = {
+        measuredAt: NOW - 8 * HOUR,
+        windows: [
+            window({ kind: "five_hour", utilization: 63, resetsAt: (NOW - 5 * HOUR) / 1_000, rounded: true }),
+            window({ kind: "seven_day", utilization: 42, resetsAt: NOW / 1_000 + 100 * 3_600 }),
+            window({ kind: "model:Fable", label: "Fable", utilization: 0, resetsAt: NOW / 1_000 + 100 * 3_600, gates: { models: ["Fable"] } }),
+        ],
+    };
+    const current = currentWindows(stale, NOW);
+    expect(current.map((pool) => pool.kind)).toEqual(["five_hour", "seven_day", "model:Fable"]);
+    expect(current[0]).toEqual({ kind: "five_hour", utilization: 0, gates: "all", lapsedAt: (NOW - 5 * HOUR) / 1_000 });
+    expect(current.slice(1)).toEqual(stale.windows.slice(1));
+    // The floor binds nothing: the weekly pool is still the one that gates the next turn.
+    expect(bindingWindow({ ...stale, windows: current })?.kind).toBe("seven_day");
+    // Applying it again changes nothing, so a surface may run it over rows the daemon already ran it over.
+    expect(currentWindows({ ...stale, windows: current }, NOW)).toEqual(current);
+
+    // An idle pool published with no reset lapses at the end of its own length.
+    const idle: AccountUsage = {
+        measuredAt: NOW - 6 * HOUR,
+        windows: [window({ kind: "five_hour", utilization: 0 }), window({ kind: "seven_day", utilization: 5, resetsAt: NOW / 1_000 + 3_600 })],
+    };
+    expect(currentWindows(idle, NOW)[0]?.lapsedAt).toBe((NOW - HOUR) / 1_000);
+
+    // A reading with nothing current left says nothing about now: the account reads as unmeasured.
+    expect(currentWindows({ measuredAt: NOW - 8 * HOUR, windows: stale.windows.slice(0, 1) }, NOW)).toEqual([]);
+});
+
 // Serviceability: the one verdict on whether an account can serve a turn.
 
 const at = (measuredAt: number, ...windows: UsageWindow[]): AccountUsage => ({ windows, measuredAt });
@@ -132,6 +165,22 @@ test("spent is the contract's one line: 99.5% still has room, 100% is spent unti
     expect(headroomState(CLAUDE, { id: "claude-opus-4-6" })).toEqual({ kind: "spent" });
 });
 
+// Anthropic reports whole percents: an account read at 100 kept serving turns for hours, so that reading is the line,
+// not proof. Only the provider's refusal makes such a pool spent.
+test("a pool read at 100 in whole percents is at the line with no room, until a refusal proves it empty", () => {
+    const week = window({ kind: "seven_day", utilization: 100, resetsAt: 900, rounded: true });
+    const atLine = usage(window({ kind: "five_hour", utilization: 75, rounded: true }), week);
+    expect(headroomState(atLine)).toEqual({ kind: "ready", room: 0 });
+    expect(headroomState(atLine, { id: "claude-opus-5-5" })).toEqual({ kind: "ready", room: 0 });
+    // A precise 100 is still spent.
+    expect(headroomState(usage(window({ kind: "seven_day", utilization: 100, resetsAt: 900 })))).toEqual({ kind: "spent", reopensAt: 900 });
+    // The provider refused it: spent until the pool reopens, and a reading still at the line does not answer that.
+    const facts = { account: "a", usage: { ...atLine, measuredAt: 2_000 } };
+    const refused = refusal({ kind: "limit", account: "a" });
+    expect(refusalVerdict(refused, [facts])).toBe("standing");
+    expect(serviceStates([facts], refused).get("a")).toEqual({ kind: "spent", reopensAt: 900 });
+});
+
 test("with no model named, an account is spent only when no model can run on it", () => {
     // A full Opus slice leaves every other model the room of the fullest pool still open.
     expect(headroomState(CLAUDE)).toEqual({ kind: "ready", room: 70 });
@@ -232,6 +281,31 @@ test("a provider's accounts are judged together: a standing refusal lands only o
     expect(answered.get("a")).toEqual({ kind: "ready", room: 60 });
 });
 
+// The provider's last refusal moves on to whichever account says no next; an account's own refusal on file stays true of
+// it. A pool Anthropic reads at a rounded 100 is only proven empty by that refusal.
+test("each account answers to the newest refusal on file that still stands over it", () => {
+    const line = at(5_000, window({ kind: "seven_day", utilization: 100, rounded: true, resetsAt: 20 }));
+    // Read before its sign-in was refused, so nothing has answered that refusal yet.
+    const room = at(2_000, window({ kind: "seven_day", utilization: 30 }));
+    const own = refusal({ kind: "limit", account: "a", resetsAt: 20, at: 1_000 });
+    const elsewhere = refusal({ kind: "auth", account: "b", at: 3_000 });
+    const accounts = [
+        { account: "a", usage: line },
+        { account: "b", usage: room },
+    ];
+    expect(Object.fromEntries(serviceStates(accounts, [elsewhere, own], undefined, 9_999))).toEqual({
+        a: { kind: "spent", reopensAt: 20 },
+        b: { kind: "blocked", fix: "reconnect", reason: "no." },
+    });
+    // Only the provider's last one: the first account is back at the line, no room but not proven spent.
+    expect(serviceStates(accounts, elsewhere, undefined, 9_999).get("a")).toEqual({ kind: "ready", room: 0 });
+    // Past the instant the provider named, its refusal is over and the reading speaks alone.
+    expect(serviceStates(accounts, [elsewhere, own], undefined, 20_000).get("a")).toEqual({ kind: "ready", room: 0 });
+    // A newer refusal on the same account outranks the older one.
+    const revoked = refusal({ kind: "auth", account: "a", at: 6_000 });
+    expect(serviceStates(accounts, [own, revoked], undefined, 9_999).get("a")).toEqual({ kind: "blocked", fix: "reconnect", reason: "no." });
+});
+
 test("an unnamed turn takes the most room, then an unmeasured account, then a spent one, and a blocked one only when that is all", () => {
     const entry = (id: string, state: AccountState) => ({ id, state });
     const blocked: AccountState = { kind: "blocked", fix: "admin", reason: "no seat" };
@@ -243,3 +317,14 @@ test("an unnamed turn takes the most room, then an unmeasured account, then a sp
     expect(roomiestAccount([entry("seatless", blocked), entry("unread", { kind: "unknown" })])).toBeUndefined();
     expect(roomiestAccount([entry("low", { kind: "ready", room: 5 }), entry("high", { kind: "ready", room: 60 })])?.id).toBe("high");
 });
+
+test("an account at the line is tried after an unmeasured one and before a spent one, and never a move's destination", () => {
+    const entry = (id: string, state: AccountState) => ({ id, state });
+    const atLine: AccountState = { kind: "ready", room: 0 };
+    expect(preferredAccount([entry("line", atLine), entry("low", { kind: "ready", room: 2 })])?.id).toBe("low");
+    expect(preferredAccount([entry("line", atLine), entry("unread", { kind: "unknown" })])?.id).toBe("unread");
+    expect(preferredAccount([entry("spent", { kind: "spent" }), entry("line", atLine)])?.id).toBe("line");
+    // A move lands only on proven room: two accounts at the line would otherwise hand a refused turn back and forth.
+    expect(roomiestAccount([entry("line", atLine), entry("spent", { kind: "spent" })])).toBeUndefined();
+    expect(roomiestAccount([entry("line", atLine), entry("low", { kind: "ready", room: 2 })])?.id).toBe("low");
+});

package/src/models/plan-pools.ts

@@ -8,6 +8,18 @@ import type { AccountState, AccountUsage, ProviderRefusal, UsageWindow, WindowGa
 // anything short of it still has room.
 export const SPENT_UTILIZATION = 100;
 
+// Whether a reading proves its pool empty. A pool read at the line by a provider that rounds to whole percents
+// (`rounded`) does not: Anthropic reports 99.5% as 100 and keeps serving turns on it, so treating that as spent strands
+// the last of an allowance (and turns a plain send into one scheduled for the reset). Such a pool is at the line, with
+// no room to rank by; only the provider's refusal (pinnedFull) proves it empty.
+export const provenFull = (window: UsageWindow): boolean => window.utilization >= SPENT_UTILIZATION && window.rounded !== true;
+
+// A pool a standing limit refusal shows full: at the line, and proven so whatever the provider's rounding.
+export const pinnedFull = (window: UsageWindow): UsageWindow => {
+    const { rounded: _rounded, ...pool } = window;
+    return { ...pool, utilization: Math.max(window.utilization, SPENT_UTILIZATION) };
+};
+
 export interface ModelRef {
     // Wire model id.
     readonly id: string;
@@ -134,6 +146,28 @@ export const windowLive = (window: UsageWindow, measuredAt: number, now: number)
     return period === undefined || measuredAt + period.seconds * 1000 > now;
 };
 
+// A pool whose reading belongs to a window that has since closed: still the account's pool, at the floor any new window
+// starts from, and marked with when the old window closed so a surface can say it has not been re-read since.
+const lapsedWindow = (window: UsageWindow, measuredAt: number): UsageWindow => {
+    const { resetsAt, rounded: _rounded, utilization: _utilization, ...pool } = window;
+    // Only reached for a window windowLive retired, so with no published reset its length is known.
+    const closedAt = resetsAt ?? Math.floor((measuredAt + (windowPeriod(window)?.seconds ?? 0) * 1000) / 1000);
+    return { ...pool, utilization: 0, lapsedAt: closedAt };
+};
+
+// What a reading says about each of the account's pools now. A window past its reset is kept rather than dropped, as a
+// lapsed pool (lapsedWindow): dropping it made a reading whose re-reads were failing lose its five-hour row within hours
+// while the weekly rows stayed, a partial card that reads as complete. The floor of 0 is what dropping it already meant
+// to every verdict (an absent pool binds nothing). A reading with no window still current says nothing about now and
+// answers none, so the account reads as unmeasured. Idempotent: a pool already lapsed stays as it is.
+export const currentWindows = (usage: AccountUsage, now: number): UsageWindow[] => {
+    const live = (window: UsageWindow): boolean => window.lapsedAt === undefined && windowLive(window, usage.measuredAt, now);
+    if (!usage.windows.some(live)) {
+        return [];
+    }
+    return usage.windows.map((window) => (window.lapsedAt !== undefined || live(window) ? window : lapsedWindow(window, usage.measuredAt)));
+};
+
 // Whether an account can serve a turn: the one rule every picker and surface reads (AccountState). The daemon runs it and
 // publishes the verdict on each account row; the editor runs it only on a row from a daemon older than that field.
 
@@ -210,15 +244,15 @@ export const headroomState = (usage: AccountUsage | undefined, model?: ModelRef)
     if (windows.length === 0) {
         return { kind: "unknown" };
     }
-    const full = windows.filter((window) => window.utilization >= SPENT_UTILIZATION);
-    const open = windows.filter((window) => window.utilization < SPENT_UTILIZATION);
+    const full = windows.filter(provenFull);
+    const open = windows.filter((window) => !provenFull(window));
     if (model !== undefined || full.some((window) => window.gates === "all") || open.length === 0) {
         const holding = model !== undefined ? full : full.some((window) => window.gates === "all") ? full.filter((window) => window.gates === "all") : full;
         if (holding.length > 0) {
             return spent(reopening(holding, model === undefined && !holding.some((window) => window.gates === "all")));
         }
     }
-    return { kind: "ready", room: SPENT_UTILIZATION - Math.max(...open.map((window) => window.utilization)) };
+    return { kind: "ready", room: Math.max(0, SPENT_UTILIZATION - Math.max(...open.map((window) => window.utilization))) };
 };
 
 // A standing limit refusal reads its pool as full, since a polled reading freezes the moment a pool actually empties: the
@@ -231,7 +265,7 @@ const refusedPool = (usage: AccountUsage | undefined, refusal: ProviderRefusal,
         const sameModel = refusal.model === undefined || model === undefined || refusal.model === model.id;
         return sameModel ? spent(refusal.resetsAt) : headroomState(usage, model);
     }
-    const pinned = usage.windows.map((window) => (window === binding ? { ...window, utilization: Math.max(window.utilization, SPENT_UTILIZATION) } : window));
+    const pinned = usage.windows.map((window) => (window === binding ? pinnedFull(window) : window));
     const state = headroomState({ ...usage, windows: pinned }, model);
     // The provider's own "try again at" is when it reopens, over whatever the polled pool last said.
     return state.kind === "spent" && refusal.resetsAt !== undefined ? spent(refusal.resetsAt) : state;
@@ -271,35 +305,60 @@ export const serviceState = (facts: ServiceFacts, refusal?: ProviderRefusal, mod
     return refusal?.kind === "limit" ? refusedPool(facts.usage, refusal, model) : headroomState(facts.usage, model);
 };
 
-/** Every account of one provider, judged together, since a refusal naming no account is answered by any of them. */
+/** The refusals a provider's accounts are judged against: its last one, or every one on file (each account's own beside it). */
+export type RefusalsOnFile = ProviderRefusal | readonly ProviderRefusal[] | undefined;
+
+const refusalList = (refusals: RefusalsOnFile): readonly ProviderRefusal[] =>
+    refusals === undefined ? [] : "kind" in refusals ? [refusals] : refusals;
+
+/**
+ * Every account of one provider, judged together, since a refusal naming no account is answered by any of them. Each
+ * account answers to the newest refusal that still stands over it: the provider's last one moves on to whichever account
+ * said no next, and an account's own refusal on file stays true of it until something answers it.
+ */
 export const serviceStates = (
     accounts: readonly ServiceFacts[],
-    refusal: ProviderRefusal | undefined,
+    refusals: RefusalsOnFile,
     model?: ModelRef,
     now: number = Date.now(),
 ): ReadonlyMap<string, AccountState> => {
-    const standing = refusal !== undefined && refusalVerdict(refusal, accounts, now) === "standing" ? refusal : undefined;
+    const standing = refusalList(refusals)
+        .filter((refusal) => refusalVerdict(refusal, accounts, now) === "standing")
+        .toSorted((left, right) => right.at - left.at);
     return new Map(
-        accounts.map((facts) => [
-            facts.account,
-            serviceState(facts, standing !== undefined && (standing.account ?? facts.account) === facts.account ? standing : undefined, model, now),
-        ]),
+        accounts.map((facts) => [facts.account, serviceState(facts, standing.find((refusal) => (refusal.account ?? facts.account) === facts.account), model, now)]),
     );
 };
 
-// Worst last: proven room, no reading either way, known spent, and nothing a turn can run on.
-const PREFERENCE: Record<AccountState["kind"], number> = { ready: 0, unknown: 1, spent: 2, blocked: 3 };
+// Worst last: proven room, no reading either way, a pool at the line (it may hold a sliver, or nothing), known spent,
+// and nothing a turn can run on.
+const preference = (state: AccountState): number => {
+    switch (state.kind) {
+        case "ready":
+            return state.room > 0 ? 0 : 2;
+        case "unknown":
+            return 1;
+        case "spent":
+            return 3;
+        case "blocked":
+            return 4;
+    }
+};
 
-/** The account an unnamed turn runs on: ready by most room, then unmeasured, then spent, blocked only when that is all there is. Ties keep the caller's order. */
+/** The account an unnamed turn runs on: ready by most room, then unmeasured, then at the line, then spent, blocked only when that is all there is. Ties keep the caller's order. */
 export const preferredAccount = <T extends { readonly state: AccountState }>(entries: readonly T[]): T | undefined =>
     entries.reduce<T | undefined>((best, next) => {
         if (best === undefined) {
             return next;
         }
-        const tier = PREFERENCE[next.state.kind] - PREFERENCE[best.state.kind];
+        const tier = preference(next.state) - preference(best.state);
         return tier < 0 || (tier === 0 && next.state.kind === "ready" && best.state.kind === "ready" && next.state.room > best.state.room) ? next : best;
     }, undefined);
 
-/** The roomiest account with proven room, or none: what a move off a refused account may land on. Ties keep the caller's order. */
+/**
+ * The roomiest account with proven room, or none: what a move off a refused account may land on. Ties keep the caller's
+ * order. An account at the line is left out: a move there could be refused in turn, and with one refusal remembered per
+ * provider, two such accounts would hand the turn back and forth.
+ */
 export const roomiestAccount = <T extends { readonly state: AccountState }>(entries: readonly T[]): T | undefined =>
-    preferredAccount(entries.filter((entry) => entry.state.kind === "ready"));
+    preferredAccount(entries.filter((entry) => entry.state.kind === "ready" && entry.state.room > 0));

package/src/models/provider-specs.ts

@@ -1,5 +1,5 @@
 import type { ProviderBrand } from "@intentic/constants";
-import { type AgentCapabilities, CLAUDE_CODE, CODEX, CURSOR, OPENCODE, OPENCODE_GEMINI } from "./agent-runtimes.js";
+import { type AgentCapabilities, CLAUDE_CODE, CODEX, CURSOR, DEVIN, OPENCODE, OPENCODE_GEMINI } from "./agent-runtimes.js";
 
 // Every fact about a provider more than one surface needs, one row each, replacing lists that drifted out of sync.
 // `access` (cost) and `auth` (connection) stay separate: conflating them mis-describes Z.ai, a prepaid plan spent
@@ -150,6 +150,24 @@ export const PROVIDER_SPECS = [
         // Cursor ignores harness too: there is no route to it but its own SDK.
         runtimes: { native: CURSOR, claudeCode: CURSOR },
     },
+    {
+        // Cognition's Devin through its own CLI (`devin acp`); labelled for the account, since it vends many vendors'
+        // models (SWE, Claude, GPT, Gemini…) under one Devin plan.
+        id: "devin",
+        label: "Devin",
+        vendor: "Devin",
+        accountLabel: "Devin",
+        destination: "Devin",
+        brand: "devin",
+        // Free is a real tier here: a free Devin account runs turns, on the smaller list of models its plan offers.
+        access: { kind: "free", requirement: "Devin account", runs: "Devin's agent on the models your plan offers" },
+        // The daemon drives the CLI's own sign-in and holds the key it hands back, one per account.
+        auth: { kind: "oauth" },
+        // Devin publishes its quota only on its own pages and in its CLI's interactive view, nothing a key can read.
+        planLimits: false,
+        // The CLI is the only door, so harness is not a choice: both axes are Devin's own runtime.
+        runtimes: { native: DEVIN, claudeCode: DEVIN },
+    },
     // The two minted providers need no new runtime or translator hop: each has its own Anthropic Messages endpoint.
     {
         id: "meta",
@@ -223,7 +241,7 @@ export const PROVIDER_SPECS = [
 type Spec = (typeof PROVIDER_SPECS)[number];
 
 // The agent runtimes the daemon can serve; a native id is reserved, `endpoint/<id>` or any other value names an
-// installed capability instead. Derived from the table and a union of six names, so the wire vocabulary can't drift.
+// installed capability instead. Derived from the table and a union of its ids, so the wire vocabulary can't drift.
 export type NativeProvider = Spec["id"];
 export const NATIVE_PROVIDERS: readonly NativeProvider[] = PROVIDER_SPECS.map((spec) => spec.id);
 

package/src/policy/command-classes.ts

@@ -1,5 +1,6 @@
 import { HISTORY_ROOT, WORKSPACE_ROOT } from "@intentic/constants";
 import { type CommandClass, CommandClassSchema, type CommandLocus } from "../schemas/agent.js";
+import { SECRET_REFERENCE } from "../schemas/needs.js";
 import { inertRegions, isLive } from "../text/shell-regions.js";
 
 // Classifies a shell command, shared by the sandbox gate and the machine agent's shell tool so they can't drift on what
@@ -72,7 +73,7 @@ const GIT_DESTRUCTIVE = [
 const GIT_BRANCH_SWITCH = [/\bgit\s+switch\b/, /\bgit\s+checkout\b(?![^|;&]*\s--\s)(?![^|;&]*\s\.(?:\s|$))/];
 
 // The credential is IN the command, not in a file; there is nothing for a filesystem to fact-check here.
-const SECRET_REFERENCES = [/\{\{secret:[A-Za-z0-9_./-]+\}\}/];
+const SECRET_REFERENCES = [SECRET_REFERENCE];
 
 // A path that usually holds a credential, a guess about a FILE, so every entry here is subject to holdsSecret.
 // The directory in front of a filename, so a pattern spans the whole path, not just the file inside it.
@@ -404,6 +405,23 @@ const findAndXargsDeletes = (command: string): CommandSpan[] => [
     ...spansOf([XARGS_RM], command),
 ];
 
+// The same tree delete in Windows' own shells, which is what a device's run_command runs there: PowerShell's
+// Remove-Item (and its aliases) with -Recurse, which it answers without asking, and cmd's rd/rmdir /s and del /s. Only
+// PowerShell's own names are read with a bare -r (any prefix of -Recurse, which PowerShell accepts), since `rm -r` is
+// also POSIX rm, whose bare -r asks before anything write-protected and is left to the rm rule above. And .NET's
+// Directory.Delete(path, true), the same delete from a script.
+const POWERSHELL_RECURSE = String.raw`\s-r(?:e(?:c(?:u(?:r(?:s(?:e)?)?)?)?)?)?(?::\$true)?(?![\w-])`;
+const WINDOWS_RECURSIVE_DELETES = [
+    new RegExp(String.raw`(?<![\w-])(?:Remove-Item|ri|rd|rmdir|del|erase)\b[^|;&\n]*?${POWERSHELL_RECURSE}`, "i"),
+    new RegExp(String.raw`(?<![\w-])rm\b[^|;&\n]*?\s-recurse(?![\w-])`, "i"),
+    /(?<![\w-])(?:rd|rmdir|del|erase)\b[^|;&\n]*?\s\/s\b/i,
+    /\[(?:System\.)?IO\.Directory\]::Delete\s*\([^)]*,\s*\$true\s*\)/i,
+];
+const windowsDeletes = (command: string): CommandSpan[] => spansOf(globally(WINDOWS_RECURSIVE_DELETES), command);
+
+// A disk wiped by Windows' own tools: a volume formatted, a disk cleared, from PowerShell or cmd.
+const WINDOWS_DISK_WIPES = [/(?<![\w-])(?:Format-Volume|Clear-Disk)\b/i, /(?<![\w-])format(?:\.com)?\s+[A-Za-z]:/i];
+
 // What cuts a checkout off from its repository's history: deleting its `.git` (for a worktree, a one-line pointer
 // whose loss strands every commit the checkout was reading), or `git init` over the folder it stands in, which makes
 // a standalone repository sharing nothing with the one it came from. A `git init <new-dir>` for a new project is not
@@ -500,8 +518,17 @@ const MATCHES: Readonly<Record<CommandClass, (command: string, context: CommandC
     "git.destructive": (command) => [...spansOf(GIT_DESTRUCTIVE_G, command), ...checkoutUnlinks(command)],
     // The only class that can answer "not here": in its own copy a conversation's checkout is its own to move.
     "git.branch-switch": (command, context) => (context.ownCheckout === true ? [] : spansOf(GIT_BRANCH_SWITCH_G, command)),
-    "files.destructive": (command) => [...recursiveForceRms(command), ...recursiveDeletes(command), ...findAndXargsDeletes(command)],
-    "system.destructive": (command, context) => [...spansOf(BLOCK_DEVICE_G, command), ...rootDeletes(command, context.locus)],
+    "files.destructive": (command) => [
+        ...recursiveForceRms(command),
+        ...recursiveDeletes(command),
+        ...findAndXargsDeletes(command),
+        ...windowsDeletes(command),
+    ],
+    "system.destructive": (command, context) => [
+        ...spansOf(BLOCK_DEVICE_G, command),
+        ...spansOf(globally(WINDOWS_DISK_WIPES), command),
+        ...rootDeletes(command, context.locus),
+    ],
     "container.state": (command) => spansOf(CONTAINER_STATE_G, command),
     "secrets.access": credentialReads,
     "package.publish": (command) => spansOf(PACKAGE_PUBLISH_G, command),
@@ -565,6 +592,9 @@ export const COMMAND_CLASS_PATTERNS: Readonly<Record<CommandClass, readonly Comm
         { code: "rimraf(<path>)" },
         { code: "find <path> -delete", qualifier: "also -exec rm and -execdir rm" },
         { code: "xargs rm" },
+        { code: "Remove-Item -Recurse <path>", qualifier: "also its aliases ri, rd, rmdir, del, erase, and rm -Recurse" },
+        { code: "rd /s <path>", qualifier: "also rmdir /s and del /s" },
+        { code: "[IO.Directory]::Delete(<path>, $true)" },
     ],
     "system.destructive": [
         { code: "mkfs" },
@@ -574,6 +604,7 @@ export const COMMAND_CLASS_PATTERNS: Readonly<Record<CommandClass, readonly Comm
         { code: "dd of=/dev/…" },
         { code: "shred /dev/…" },
         { code: "> /dev/sda" },
+        { code: "Format-Volume", qualifier: "also Clear-Disk, and format C:" },
         { code: "rm -rf /", qualifier: "also find / -delete; only when the target is a root, listed below" },
     ],
     "container.state": [