@intentic/sandbox-contract 1.331.0 → 1.333.0

package/src/index.ts

@@ -164,6 +164,8 @@ export * from "./models/agent-catalog.js";
 export * from "./policy/capability-env.js";
 export * from "./policy/command-classes.js";
 export * from "./policy/command-run.js";
+export * from "./policy/device-programs.js";
+export * from "./policy/sandbox-power.js";
 export * from "./policy/safety-policy.js";
 export * from "./policy/reserved-servers.js";
 export * from "./policy/credential-material.js";
@@ -188,6 +190,7 @@ export * from "./models/model-order.js";
 export * from "./models/model-offer.js";
 export * from "./models/model-pins.js";
 export * from "./models/model-roles.js";
+export * from "./models/model-setups.js";
 export * from "./models/plan-pools.js";
 export * from "./text/path-refs.js";
 export * from "./text/archives.js";
@@ -204,6 +207,7 @@ export * from "./policy/persona-home.js";
 export * from "./schemas/agents.js";
 export * from "./schemas/speaker.js";
 export * from "./schemas/speech.js";
+export * from "./schemas/voice.js";
 export * from "./schemas/approvals.js";
 export * from "./schemas/automations.js";
 export * from "./schemas/agents-list.js";
@@ -214,6 +218,7 @@ export * from "./schemas/providers/claude-gate.js";
 export * from "./schemas/codebase-health.js";
 export * from "./schemas/context-trim.js";
 export * from "./schemas/devices.js";
+export * from "./schemas/device-swaps.js";
 export * from "./schemas/project-delivery.js";
 export * from "./schemas/device-artifacts.js";
 export * from "./schemas/run-targets.js";
@@ -224,6 +229,7 @@ export * from "./schemas/extension-updates.js";
 export * from "./schemas/providers/fast-mode.js";
 export * from "./schemas/diff.js";
 export * from "./schemas/git/git.js";
+export * from "./schemas/git/git-scope.js";
 export * from "./schemas/git/git-history.js";
 export * from "./schemas/history.js";
 export * from "./schemas/hosts.js";
@@ -242,7 +248,9 @@ export * from "./schemas/panels.js";
 export * from "./schemas/personas.js";
 export * from "./schemas/privacy.js";
 export * from "./schemas/providers/plan-limits.js";
+export * from "./schemas/providers/handoff.js";
 export * from "./schemas/platform-link.js";
+export * from "./schemas/project-bring-back.js";
 export * from "./schemas/ports.js";
 export * from "./schemas/providers/provider-oauth.js";
 export * from "./schemas/providers/provider-subscriptions.js";
@@ -257,9 +265,11 @@ export * from "./schemas/settings.js";
 export * from "./schemas/settings-history.js";
 export * from "./schemas/share.js";
 export * from "./schemas/shared.js";
+export * from "./schemas/short-codes.js";
 export * from "./schemas/system-prompt.js";
 export * from "./schemas/system.js";
 export * from "./schemas/state-plan.js";
+export * from "./schemas/restart-intent.js";
 export * from "./schemas/updates.js";
 export * from "./schemas/terminal.js";
 export * from "./schemas/turn-break.js";
@@ -275,11 +285,13 @@ export * from "./schemas/workspace/workspace-repos.js";
 export * from "./schemas/workspace/workspace-search.js";
 export * from "./schemas/workspace/workspace-setup.js";
 export * from "./schemas/workspace/workspace-tree.js";
+export * from "./schemas/workspace/workspace-upload.js";
 export * from "./state/arrival.js";
 export * from "./state/definition.js";
 export * from "./policy/search-globs.js";
 export * from "./state/starter.js";
 export * from "./text/title.js";
+export * from "./state/update-probation.js";
 export * from "./state/versions.js";
 export * from "./text/model-answer.js";
 export * from "./text/shell-regions.js";

package/src/models/agent-catalog.test.ts

@@ -29,7 +29,7 @@ describe("every provider/harness pair declares what it can do", () => {
     it.each(pairs)("$provider on the $harness harness", ({ provider, harness }) => {
         const capabilities = capabilitiesOf(provider, harness);
 
-        expect(["claude-code", "codex", "cursor", "opencode", "opencode-gemini", "acp", "pi"]).toContain(capabilities.runtime);
+        expect(["claude-code", "codex", "cursor", "opencode", "opencode-gemini", "acp", "devin", "pi"]).toContain(capabilities.runtime);
         expect(["modes", "plan"]).toContain(capabilities.permissions);
         expect(["full", "tools", "http", "none"]).toContain(capabilities.mcp);
         expect(capabilities.execution).toContain("shell");
@@ -163,11 +163,12 @@ test("every axis a record can lack has words for it", () => {
         rulebook: "none",
         secrets: "none",
         privacy: "none",
+        toolAllowlist: false,
     };
 
-    // Thirteen disclosable axes, thirteen sentences; `fastMode` is disclosed via fastAllowed, and `warm` (keep-warm, off by
+    // Fourteen disclosable axes, fourteen sentences; `fastMode` is disclosed via fastAllowed, and `warm` (keep-warm, off by
     // default) is no limit on the turn itself.
-    expect(limitationsOf(nothing)).toHaveLength(13);
+    expect(limitationsOf(nothing)).toHaveLength(14);
     expect(limitationsOf(nothing).join(" ")).not.toContain("fast");
 });
 

package/src/models/agent-catalog.ts

@@ -106,19 +106,21 @@ export const modesFor = (capabilities: AgentCapabilities): readonly PermissionMo
 export const clampMode = (mode: PermissionMode, capabilities: AgentCapabilities): PermissionMode =>
     modesFor(capabilities).includes(mode) ? mode : "bypassPermissions";
 
+// What each reach of `mcp` leaves out, said once per answer.
+const MCP_LIMITS = {
+    none: ["no MCP tools or plugins"],
+    http: ["MCP servers only, none of the daemon's own tools, no plugins"],
+    tools: ["no plugins"],
+    full: [],
+} as const satisfies Record<AgentCapabilities["mcp"], readonly string[]>;
+
 // What this pair cannot do, phrased for the sender; empty means the full ceiling. `fastMode` is deliberately not
 // disclosed here, since it also depends on the route and model; fastAllowed answers that instead.
 export const limitationsOf = (capabilities: AgentCapabilities): string[] => [
     ...(capabilities.permissions === "plan" ? ["no per-tool approvals"] : []),
     ...(capabilities.questions ? [] : ["no clarifying questions"]),
     ...(capabilities.steering ? [] : ["no mid-turn steering"]),
-    ...(capabilities.mcp === "none"
-        ? ["no MCP tools or plugins"]
-        : capabilities.mcp === "http"
-          ? ["MCP servers only, none of the daemon's own tools, no plugins"]
-          : capabilities.mcp === "tools"
-            ? ["no plugins"]
-            : []),
+    ...MCP_LIMITS[capabilities.mcp],
     ...(capabilities.execution.includes("js") ? [] : ["no code runs, shell only"]),
     ...(capabilities.effort ? [] : ["no effort control"]),
     ...(capabilities.commands ? [] : ["no slash commands"]),
@@ -131,6 +133,7 @@ export const limitationsOf = (capabilities: AgentCapabilities): string[] => [
     ...(capabilities.rulebook === "refuse-only" ? ["command rules can refuse but not hold"] : []),
     ...(capabilities.rulebook === "none" ? ["command rules not applied"] : []),
     ...(capabilities.secrets === "none" ? ["secrets reach the model unmasked"] : []),
+    ...(capabilities.toolAllowlist ? [] : ["no tool lists: an automation limited to some tools won't run here"]),
 ];
 
 // Claude's compile-time model floor, shared by daemon and web pre-load; versioned ids only, never a tier alias.

package/src/models/agent-runtimes.ts

@@ -8,7 +8,7 @@ export type ExecutionBackend = "shell" | "js";
 
 export interface AgentCapabilities {
     // Which loop serves the turn; `opencode-gemini` stays separate since adapter health keys off this field.
-    readonly runtime: "claude-code" | "codex" | "opencode" | "opencode-gemini" | "acp" | "pi" | "cursor";
+    readonly runtime: "claude-code" | "codex" | "opencode" | "opencode-gemini" | "acp" | "devin" | "pi" | "cursor";
     // Mid-turn injection (the SteeringQueue behind /agent/steer); needs the SDK's streaming-input mode.
     readonly steering: boolean;
     // How much of the permission-mode axis the runtime honours: every PermissionMode, or just propose-then-approve.
@@ -59,6 +59,10 @@ export interface AgentCapabilities {
     // configuration the daemon does not own and reads files it never sees. Only a `none` loop on an untrusted provider is
     // refused while the shield is on.
     readonly privacy: "gateway" | "hooks" | "none";
+    // Whether a turn's tool list (TurnPolicy.allowedTools, an automation's `allowedTools`) is a real boundary here:
+    // every tool call the loop makes passes a check the daemon answers, or the loop is built with only the listed tools.
+    // A runtime that runs some tool without asking anyone cannot keep it, so a turn carrying a list never starts on one.
+    readonly toolAllowlist: boolean;
 }
 
 // The Claude Code Agent SDK loop, the ceiling every other runtime is measured against: the only one that owns the whole
@@ -85,6 +89,9 @@ export const CLAUDE_CODE: AgentCapabilities = {
     secrets: "masked",
     // Every request goes to ANTHROPIC_BASE_URL, which the daemon sets per turn.
     privacy: "gateway",
+    // A PreToolUse hook refuses every call off the list, under bypassPermissions and in subagents too
+    // (agent/tools/tool-allowlist.ts).
+    toolAllowlist: true,
 };
 
 // Codex app-server: item-level events, the turn's remote MCP servers over http, and four seams (steer, a question
@@ -112,6 +119,9 @@ export const CODEX: AgentCapabilities = {
     secrets: "none",
     // Its model provider's base_url is the daemon's, written into the per-thread config.
     privacy: "gateway",
+    // Codex runs the commands it judges read-only without asking (its known-safe list), and every tool it has is the
+    // shell, so no answer the daemon gives can keep a call off a list.
+    toolAllowlist: false,
 };
 
 // OpenCode (the Grok runtime): its own agentic loop and tools, with the turn's remote MCP servers mounted on the shared
@@ -140,6 +150,10 @@ export const OPENCODE: AgentCapabilities = {
     secrets: "none",
     // The shared server's provider baseURLs are written by the daemon at spawn.
     privacy: "gateway",
+    // Its session rules could deny every action off the list, but they apply after the server's and the last match wins,
+    // so allowing a listed shell command there would override the owner's rulebook asking about it. Not kept until the
+    // permission judge (opencode-permissions.ts) checks the list on every call instead.
+    toolAllowlist: false,
 };
 
 // The same OpenCode loop, serving Gemini instead of xAI, identical abilities. The Claude Code loop announces itself in
@@ -173,6 +187,16 @@ export const ACP: AgentCapabilities = {
     secrets: "none",
     // The agent picks its own provider and endpoint from its own login and environment.
     privacy: "none",
+    // Which calls the agent asks permission for is its own choice, and most run reads without asking.
+    toolAllowlist: false,
+};
+
+// Devin's own CLI (`devin acp`), the ACP floor with one seam an installed agent lacks: the daemon picks the model, from
+// the account's own list, through the session's model option. Its own runtime name, as OpenCode's Gemini twin has, since
+// adapter health keys off this field and Devin's readiness is an account and an engine, not an installed card.
+export const DEVIN: AgentCapabilities = {
+    ...ACP,
+    runtime: "devin",
 };
 
 // Pi driven over its RPC mode: above the ACP floor and below the Claude Code ceiling. Real mid-turn steering, an effort
@@ -199,6 +223,8 @@ export const PI: AgentCapabilities = {
     secrets: "none",
     // Pi calls its provider from its own login; the daemon names no endpoint.
     privacy: "none",
+    // No seam before a tool runs.
+    toolAllowlist: false,
 };
 
 // Cursor's own runtime, driven through `@cursor/sdk` from this daemon's process; an embedding surface, so most seams
@@ -242,4 +268,7 @@ export const CURSOR: AgentCapabilities = {
     // to mask the output, the tools that read past both (grep, ls, glob, semantic search, fetch, lints) are withheld,
     // and MCP goes through the masking proxy (runtimes/cursor/cursor-shield.ts).
     privacy: "hooks",
+    // Its hooks are installed only for a shielded turn, and a hook that cannot tell which turn is asking allows; the
+    // built-in tool set is withheld by name, not granted. None of that is a list nothing gets past.
+    toolAllowlist: false,
 };

package/src/models/capability-ledger.test.ts

@@ -37,6 +37,10 @@ const LEDGER: Record<keyof AgentCapabilities, Backing> = {
     // agent/run/decide/turn-decision.ts refuses a "none" runtime on an untrusted provider while the privacy shield is
     // on; "gateway" runtimes get the daemon's gateway as their base URL (privacy/gateway).
     privacy: "enforced",
+    // agent/run/decide/turn-decision.ts refuses a turn carrying a tool list on a runtime that cannot keep one, the
+    // automation ladder passes such rungs over, and agent/tools/tool-allowlist.ts refuses every off-list call on the
+    // Claude Code loop.
+    toolAllowlist: "enforced",
 
     // Descriptive: true of the runtime but nothing consults these; wiring one up moves it to enforced.
     questions: "descriptive",

package/src/models/model-order.ts

@@ -147,3 +147,16 @@ export const compareUnrankedModelIds = (left: string, right: string): number =>
 // True only for an id that spells out a level above the quiet end, so an unannotated id is never accused of it.
 // Exported so a settings row can label a pinned thinking variant.
 export const namesThinking = (id: string): boolean => thinkingRankOf(familyOf(id)) > UNSTATED_THINKING;
+
+// Which of three rungs an id stands on: 0 the frontier, 1 the everyday workhorse, 2 the cheap end. A tier word decides
+// where there is one, a release-local ladder (sol, terra, luna) where there is not, and an id with neither is read as
+// the frontier, as the catalog order already leads with it. What the preset setups are worked out from.
+export const modelRungOf = (id: string): number => {
+    const family = familyOf(id);
+    const tier = tierRankOf(family);
+    if (tier !== UNRANKED) {
+        return tier;
+    }
+    const release = releaseTierRankOf(family);
+    return release === UNRANKED ? 0 : release;
+};

package/src/models/model-pins.ts

@@ -1,8 +1,8 @@
 import type { AgentProvider, ModelPin } from "../schemas/agent.js";
 
-// The order to try models in for a role or job (settings.modelRoles), shared by daemon and browser so both agree what a
-// job will spend before it runs. An empty list resolves to nothing for every role: nothing is derived or auto-selected.
-// The caller decides what an empty answer means (a helper is off; a run falls back to the chat's own pick).
+// The order to try models in for a job's setup (model-setups.ts), shared by daemon and browser so both agree what a job
+// will spend before it runs. An empty list resolves to nothing: the caller decides what that means (a helper is off; a
+// run falls back to the chat's own pick).
 
 // One provider's standing in the decision: can a turn go, and what its catalog holds. ACP agents have no rung here (an
 // empty model id), but endpoint/<id> providers must be included, matching the picker's own options.
@@ -11,7 +11,8 @@ export interface ModelSource {
     readonly provider: AgentProvider;
     // Same connection predicate every surface gates on; a nonempty catalog does not imply ready to send.
     readonly ready: boolean;
-    // Nothing here reads this (a pin is verbatim); kept because it's what a source is, and callers still gather it.
+    // The models it can run a turn on, newest-first order not assumed. readyChain never reads it (a pin is verbatim);
+    // a preset setup is worked out from it (model-setups.ts `presetPins`), so a helper-only model is left out.
     readonly models: readonly string[];
 }
 

package/src/models/model-roles.test.ts

@@ -1,37 +1,15 @@
-import { MODEL_ROLE_BLOCKS, MODEL_ROLES, type ModelRoleSpec } from "./model-roles.js";
+import { MODEL_ROLES, PRESET_SETUPS } from "./model-roles.js";
 
-// The catalog draws the settings page directly, so its properties (every role in one block) must hold of the table
-// itself, not be remembered by whoever adds a row.
+// The catalog draws the settings page directly, so its properties must hold of the table itself, not be remembered by
+// whoever adds a row.
 
-// Typed at its declared width, not the literal tuple: trigger is absent from a helper's type, under test here.
-const roles: readonly ModelRoleSpec[] = MODEL_ROLES;
+test("the page reads one-shots first, then whole sessions, in the table's own order", () => {
+    const kinds = MODEL_ROLES.map((role) => role.kind);
 
-test("every whole session says what starts it, and it is the block it is drawn in", () => {
-    const blockOf = new Map(MODEL_ROLE_BLOCKS.flatMap((block) => block.roles.map((role) => [role.id, block.id] as const)));
-
-    for (const role of roles) {
-        expect(role.kind === `run` ? role.trigger : role.kind, role.id).toBe(blockOf.get(role.id));
-    }
-});
-
-test("a one-shot declares no trigger at all: nothing presses a commit subject into being", () => {
-    for (const helper of roles.filter((role) => role.kind === `helper`)) {
-        expect(Object.keys(helper), helper.id).not.toContain(`trigger`);
-    }
-});
-
-test("the blocks hold every role once, in the table's own order", () => {
-    const blocked = MODEL_ROLE_BLOCKS.flatMap((block) => block.roles.map((role) => role.id));
-
-    expect(blocked.toSorted()).toEqual(MODEL_ROLES.map((role) => role.id).toSorted());
-    // The block order mirrors reach ordering (unpicked jobs, then click-started sessions, then auto-started ones).
-    expect(blocked).toEqual(MODEL_ROLES.map((role) => role.id));
+    expect(kinds.indexOf(`run`)).toBe(kinds.lastIndexOf(`helper`) + 1);
 });
 
-test("each block says what it is, so the page keeps no headings of its own", () => {
-    for (const block of MODEL_ROLE_BLOCKS) {
-        expect(block.label, block.id).toMatch(/\S/);
-        // A block with nothing in it would draw a heading over an empty surface.
-        expect(block.roles.length, block.id).toBeGreaterThan(1);
-    }
+test("every job is suggested a preset, and the cheap one is never suggested for a whole session", () => {
+    expect(MODEL_ROLES.every((role) => PRESET_SETUPS.includes(role.setup))).toBe(true);
+    expect(new Set<string>(MODEL_ROLES.filter((role) => role.kind === `run`).map((role) => role.setup)).has(`low`)).toBe(false);
 });

package/src/models/model-roles.ts

@@ -1,15 +1,17 @@
 import { z } from "zod";
 
-// Every job that picks a model, one row per job; the unit is the role, not a difficulty tier. Each list is an ordered
-// fallback ladder; empty means the job is off (helper) or falls back to the caller's own chat model (run). Adding a
-// role is one row here, settings, resolver and daemon all read this table.
+// Every job that picks a model, one row per job; the unit is the role, not a difficulty tier. A job runs on the setup it
+// was put on (model-setups.ts), an ordered fallback ladder it shares with every other job put there; a job on none, or
+// on an empty one, is off (helper) or falls back to the caller's own chat model (run). Adding a role is one row here, settings, resolver
+// and daemon all read this table.
 
 export const ModelRoleKindSchema = z.enum(["helper", "run"]);
 export type ModelRoleKind = z.infer<typeof ModelRoleKindSchema>;
 
-// Which block a run role sorts into on the settings page: pressed by the owner, or started unprompted; helpers declare
-// none.
-export type ModelRoleTrigger = "pressed" | "unprompted";
+// The three setups every sandbox has, cheapest first: worked out from what is connected until the owner edits one
+// (model-setups.ts `presetPins`). Ids are stored, so they are wire-stable.
+export const PRESET_SETUPS = ["low", "medium", "high"] as const;
+export type PresetSetup = (typeof PRESET_SETUPS)[number];
 
 // `id` is a bare string here; narrowed to the role union on `ModelRoleSpec` below, since that union derives from this
 // table via `satisfies`.
@@ -20,13 +22,14 @@ interface ModelRoleRow {
     // Must add information beyond the label, not restate it.
     readonly blurb: string;
     readonly kind: ModelRoleKind;
-    /** Required when `kind` is "run"; unset for helpers. */
-    readonly trigger?: ModelRoleTrigger;
     // Icon name from the shared icon set; kept here, not in a separate web-side map keyed by id.
     readonly icon: string;
+    // The preset suggested for this job, offered when it is placed: what the work needs, not what it costs today. Only
+    // a suggestion: a job runs on nothing until someone puts it on a setup.
+    readonly setup: PresetSetup;
 }
 
-// Ids are wire-stable (`AgentTurn.runRole`); order matches the settings page's block grouping below.
+// Ids are wire-stable (`AgentTurn.runRole`); order is the settings page's: one-shot helpers first, then whole sessions.
 export const MODEL_ROLES = [
     {
         id: "commit-message",
@@ -34,6 +37,7 @@ export const MODEL_ROLES = [
         blurb: "The subject written when an agent's work lands, and the release note under it.",
         kind: "helper",
         icon: "file-edit",
+        setup: "low",
     },
     {
         id: "session-title",
@@ -41,6 +45,7 @@ export const MODEL_ROLES = [
         blurb: "The name a conversation wears on the board, written a second into its first turn.",
         kind: "helper",
         icon: "pencil",
+        setup: "low",
     },
     {
         // Prompt includes the command about to run, which may be attacker-controlled; a small model can be swayed.
@@ -49,6 +54,7 @@ export const MODEL_ROLES = [
         blurb: "Which model reads your safety policy before a flagged command runs.",
         kind: "helper",
         icon: "shield",
+        setup: "medium",
     },
     {
         id: "loop-verdict",
@@ -56,6 +62,26 @@ export const MODEL_ROLES = [
         blurb: "Whether a loop's iteration met the goal, or the loop goes round again.",
         kind: "helper",
         icon: "check-square",
+        setup: "medium",
+    },
+    {
+        // Reads a whole conversation (capped tool output) once, so a small model with a large window suits it best.
+        id: "handoff-summary",
+        label: "Hand-off summaries",
+        blurb: "The summary a fresh session opens with when you choose to summarise a long conversation that hit a usage limit, instead of re-reading it all.",
+        kind: "helper",
+        icon: "align-left",
+        setup: "low",
+    },
+    {
+        // Reads one finished reply (and the ask it answered) and writes what a person hears in hands-free voice: a few
+        // short sentences, never markdown. A fast model matters more than a strong one, since the person is waiting.
+        id: "spoken-reply",
+        label: "Spoken replies",
+        blurb: "The few sentences you hear when you talk to the agent hands-free: what it did and what it needs from you, while the full reply stays on screen.",
+        kind: "helper",
+        icon: "volume-up",
+        setup: "low",
     },
     {
         // One reading answering both halves of "what does this chat open on": an offered `provider:model` line with an
@@ -67,79 +93,79 @@ export const MODEL_ROLES = [
         blurb: "Which model reads a new chat's first message and picks what it opens on: the model, effort and account, and the persona.",
         kind: "helper",
         icon: "sparkles",
+        setup: "low",
     },
     {
         id: "pipeline-fix",
         label: "Pipeline fixes",
         blurb: "The agent started by Fix on a failed pipeline.",
         kind: "run",
-        trigger: "pressed",
         icon: "wave-pulse",
+        setup: "high",
     },
     {
         id: "deployment-fix",
         label: "Deployment fixes",
         blurb: "The agent started by Fix on a deployment that is down.",
         kind: "run",
-        trigger: "pressed",
         icon: "server",
+        setup: "high",
     },
     {
         id: "maintenance-chore",
         label: "Maintenance chores",
         blurb: "A chore run started from the Maintenance board.",
         kind: "run",
-        trigger: "pressed",
         icon: "wrench",
+        setup: "medium",
     },
     {
         id: "refactor-run",
         label: "Refactors",
         blurb: "The agent started from a hotspot or key module on a repository's Health tab.",
         kind: "run",
-        trigger: "pressed",
         icon: "hammer",
+        setup: "high",
     },
     {
         id: "documentation-run",
         label: "Documentation runs",
         blurb: "A pass over a repo's own documentation.",
         kind: "run",
-        trigger: "pressed",
         icon: "book",
+        setup: "medium",
     },
     {
         id: "acceptance-run",
         label: "Acceptance runs",
         blurb: "One session per story in an acceptance fan-out.",
         kind: "run",
-        trigger: "pressed",
         icon: "list-check",
+        setup: "high",
     },
     {
-        // Pressed trigger: the owner's approval click starts this turn; the queue between is just machinery.
         id: "approval-queue",
         label: "Approvals queue",
         blurb: "The turn that publishes or acts on what you approved.",
         kind: "run",
-        trigger: "pressed",
         icon: "check-circle",
+        setup: "medium",
     },
     {
         id: "extension-review",
         label: "Extension update reviews",
         blurb: "The agent that reads an extension update before it is applied.",
         kind: "run",
-        trigger: "unprompted",
         icon: "box",
+        setup: "medium",
     },
     {
         id: "loop-iteration",
         label: "Loop iterations",
         blurb: "Each round of a loop working towards its goal.",
         kind: "run",
-        trigger: "unprompted",
         icon: "repeat",
+        setup: "high",
     },
 ] as const satisfies readonly ModelRoleRow[];
 
@@ -150,34 +176,3 @@ export const MODEL_ROLE_IDS = MODEL_ROLES.map((role) => role.id) as readonly Mod
 
 // Enum, not a string: an id outside this table names nothing, so it should fail loudly rather than be ignored.
 export const ModelRoleSchema = z.enum(MODEL_ROLE_IDS as [ModelRole, ...ModelRole[]]);
-
-// Groups MODEL_ROLES for the settings page by kind and trigger; each role belongs to exactly one block, in table order.
-export type ModelRoleBlockId = "helper" | "pressed" | "unprompted";
-
-export interface ModelRoleBlock {
-    readonly id: ModelRoleBlockId;
-    /** Heading shown on the settings page. */
-    readonly label: string;
-    /** Its roles, in MODEL_ROLES order. */
-    readonly roles: readonly ModelRoleSpec[];
-}
-
-const rolesWhere = (match: (role: ModelRoleSpec) => boolean): readonly ModelRoleSpec[] => MODEL_ROLES.filter((role) => match(role));
-
-export const MODEL_ROLE_BLOCKS: readonly ModelRoleBlock[] = [
-    {
-        id: "helper",
-        label: "Automatic helpers",
-        roles: rolesWhere((role) => role.kind === "helper"),
-    },
-    {
-        id: "pressed",
-        label: "Runs you start",
-        roles: rolesWhere((role) => role.kind === "run" && role.trigger === "pressed"),
-    },
-    {
-        id: "unprompted",
-        label: "Runs that start themselves",
-        roles: rolesWhere((role) => role.kind === "run" && role.trigger === "unprompted"),
-    },
-];

package/src/models/model-setups.test.ts

@@ -0,0 +1,100 @@
+import type { ModelPin } from "../schemas/agent.js";
+import type { ModelSource } from "./model-pins.js";
+import { endpointProvider } from "./agent-catalog.js";
+import type { ModelRole } from "./model-roles.js";
+import { ladderIsEmpty, presetPins, roleLadder, rolePins, roleSetupId, setupsFromRoleLists } from "./model-setups.js";
+
+// What a job runs on is read here by the daemon and the browser alike, so the rules are pinned once: where a job starts,
+// what a preset is worked out from, and what a written setup overrides.
+
+const opus: ModelPin = { provider: `claude`, model: `claude-opus-5-5`, effort: `high` };
+const haiku: ModelPin = { provider: `claude`, model: `claude-haiku-4-5` };
+
+const CLAUDE: ModelSource = { provider: `claude`, ready: true, models: [`claude-haiku-4-5-20251001`, `claude-opus-4-8`, `claude-opus-5`, `claude-sonnet-5`] };
+const CODEX: ModelSource = { provider: `codex`, ready: true, models: [`gpt-5.2-codex`, `gpt-5.6-luna`, `gpt-5.6-sol`, `gpt-5.6-terra`, `gpt-5-mini`] };
+const GEMINI: ModelSource = { provider: `gemini`, ready: true, models: [`gemini-3-flash`, `gemini-3-flash-lite`, `gemini-3-pro`] };
+
+const NOTHING_SET = { modelSetups: [], roleSetups: {} };
+
+describe(`a preset worked out from what is connected`, () => {
+    test(`takes each connected provider's newest model on the preset's rung, in the order they come`, () => {
+        expect(presetPins(`high`, [CLAUDE, CODEX, GEMINI]).map((pin) => pin.model)).toEqual([`claude-opus-5`, `gpt-5.6-sol`, `gemini-3-pro`]);
+        expect(presetPins(`medium`, [CLAUDE, CODEX, GEMINI]).map((pin) => pin.model)).toEqual([`claude-sonnet-5`, `gpt-5.6-terra`, `gemini-3-flash`]);
+        expect(presetPins(`low`, [CLAUDE, CODEX, GEMINI]).map((pin) => pin.model)).toEqual([`claude-haiku-4-5-20251001`, `gpt-5.6-luna`, `gemini-3-flash-lite`]);
+    });
+
+    test(`leaves out a provider that is not connected, a local endpoint, and anything past three`, () => {
+        const local: ModelSource = { provider: endpointProvider(`ollama`), ready: true, models: [`qwen-coder`] };
+        const extra: ModelSource = { provider: `grok`, ready: true, models: [`grok-5-heavy`] };
+        expect(presetPins(`high`, [{ ...CLAUDE, ready: false }, local, CODEX, GEMINI, extra]).map((pin) => pin.provider)).toEqual([`codex`, `gemini`, `grok`]);
+        expect(presetPins(`high`, [CLAUDE, CODEX, GEMINI, extra])).toHaveLength(3);
+    });
+
+    test(`takes a provider's own model over one it serves from another maker`, () => {
+        const google: ModelSource = { provider: `gemini`, ready: true, models: [`claude-opus-4-6-thinking`, `gemini-3-pro`, `gemini-3-flash`] };
+        expect(presetPins(`high`, [google])).toEqual([{ provider: `gemini`, model: `gemini-3-pro` }]);
+        // With none of its own on the rung, the borrowed one still serves.
+        expect(presetPins(`high`, [{ ...google, models: [`claude-opus-4-6-thinking`, `gemini-3-flash`, `gemini-3-flash-lite`] }])).toEqual([
+            { provider: `gemini`, model: `claude-opus-4-6-thinking` },
+        ]);
+    });
+
+    test(`is empty while nothing is connected`, () => {
+        expect(presetPins(`low`, [])).toEqual([]);
+    });
+});
+
+describe(`which setup a job runs on`, () => {
+    test(`a job nobody placed runs on nothing, however much is connected`, () => {
+        expect(roleSetupId(NOTHING_SET, `commit-message`)).toBeUndefined();
+        expect(ladderIsEmpty(roleLadder(NOTHING_SET, `safety-judge`))).toBe(true);
+        expect(rolePins(NOTHING_SET, `pipeline-fix`, [CLAUDE, CODEX, GEMINI])).toEqual([]);
+    });
+
+    test(`a job put on a preset nobody edited runs what is connected, and follows it`, () => {
+        const settings = { modelSetups: [], roleSetups: { "commit-message": `low` } };
+        expect(roleLadder(settings, `commit-message`)).toEqual({ kind: `preset`, preset: `low` });
+        expect(rolePins(settings, `commit-message`, [CLAUDE])).toEqual([{ provider: `claude`, model: `claude-haiku-4-5-20251001` }]);
+    });
+
+    test(`a written preset is run as written, and stops following what is connected`, () => {
+        const settings = { modelSetups: [{ id: `low`, pins: [opus] }], roleSetups: { "commit-message": `low` } };
+        expect(rolePins(settings, `commit-message`, [CLAUDE, CODEX])).toEqual([opus]);
+    });
+
+    test(`a preset that was only renamed still follows what is connected`, () => {
+        const settings = { modelSetups: [{ id: `low`, name: `Cheap` }], roleSetups: { "commit-message": `low` } };
+        expect(roleLadder(settings, `commit-message`)).toEqual({ kind: `preset`, preset: `low` });
+    });
+
+    test(`a job put on a setup of the owner's runs that setup's models`, () => {
+        const settings = { modelSetups: [{ id: `setup-1`, name: `Reviews`, pins: [opus, haiku] }], roleSetups: { "commit-message": `setup-1` } };
+        expect(rolePins(settings, `commit-message`, [CLAUDE])).toEqual([opus, haiku]);
+    });
+
+    test(`a job put on a setup that is gone is on none`, () => {
+        const settings = { modelSetups: [], roleSetups: { "commit-message": `setup-9` } };
+        expect(roleSetupId(settings, `commit-message`)).toBeUndefined();
+    });
+
+    test(`a setup of the owner's with no models is empty, never a preset`, () => {
+        const settings = { modelSetups: [{ id: `setup-1`, name: `Later` }], roleSetups: { "pipeline-fix": `setup-1` } };
+        expect(ladderIsEmpty(roleLadder(settings, `pipeline-fix`))).toBe(true);
+    });
+});
+
+test(`per-job lists become setups every job runs exactly as before on`, () => {
+    const cases = [
+        [`commit-message`, [haiku]],
+        [`session-title`, [haiku]],
+        [`pipeline-fix`, [opus]],
+        [`safety-judge`, []],
+    ] as const satisfies readonly (readonly [ModelRole, readonly ModelPin[]])[];
+    const settings = setupsFromRoleLists(Object.fromEntries(cases));
+
+    for (const [role, pins] of cases) {
+        expect(rolePins(settings, role, [CLAUDE, CODEX])).toEqual(pins);
+    }
+    // A job that never had a list, or had an empty one, ran on nothing and is on none.
+    expect([settings.roleSetups[`loop-iteration`], settings.roleSetups[`safety-judge`]]).toEqual([undefined, undefined]);
+});