@open-mercato/cezar 0.9.1 → 0.9.2-pr772.1071

package/dist/contract/workspace.d.ts

@@ -0,0 +1,490 @@
+import { z } from 'zod';
+import { type Runner } from './health.ts';
+/**
+ * The workspace + settings families: `~/.cezar/config.json`'s settings slice, both GUI-pref bags
+ * (per-repo and workspace), the per-repo agent knobs, provider auth status, the host model
+ * catalog, the skills-update state, and the "Open in…" targets.
+ *
+ * Node-free by construction (see README rule 1) — `zod` and the sibling contract modules only.
+ */
+/**
+ * `GET/PUT /api/v1/workspace/config` — the settings slice of `~/.cezar/config.json` (step 2.7).
+ *
+ * Global knobs only: the registry itself is `GET /api/v1/projects`, and `schemaVersion` (a
+ * migration cursor, not a setting) is deliberately absent. `resources` is the workspace's
+ * host-protection budget — the ONLY effective `maxParallel`/`memoryLimitMb` since Phase 2;
+ * `worktreeRetentionDefault` seeds projects that set none.
+ *
+ * `composerDefaults` and every `resources` key are REQUIRED: `workspaceConfigBody`
+ * (src/server/server.ts:1888) materializes all of them from schema defaults on every answer,
+ * including the degraded path. The hand-written DTO declared `composerDefaults`,
+ * `resources.maxMonitoringSessions` and `resources.monitoringWakeIntervalMinutes` optional, which
+ * was wider than the server has ever been.
+ */
+export declare const workspaceConfigResponseSchema: z.ZodObject<{
+    browseRoot: z.ZodString;
+    projectsDir: z.ZodString;
+    skillsAutoUpdate: z.ZodNullable<z.ZodBoolean>;
+    effectiveSkillsAutoUpdate: z.ZodBoolean;
+    composerDefaults: z.ZodObject<{
+        autonomous: z.ZodNullable<z.ZodBoolean>;
+        worktree: z.ZodNullable<z.ZodBoolean>;
+        inheritedAutonomous: z.ZodUnion<readonly [z.ZodBoolean, z.ZodLiteral<"source-dependent">]>;
+        inheritedWorktree: z.ZodBoolean;
+    }, z.core.$strip>;
+    resources: z.ZodObject<{
+        maxParallel: z.ZodNumber;
+        maxMonitoringSessions: z.ZodNumber;
+        monitoringWakeIntervalMinutes: z.ZodNullable<z.ZodNumber>;
+        autoResumeOnUsageLimit: z.ZodBoolean;
+        memoryLimitMb: z.ZodNullable<z.ZodNumber>;
+        worktreeRetentionDefault: z.ZodNumber;
+    }, z.core.$strip>;
+    agentDefaults: z.ZodObject<{
+        runner: z.ZodOptional<z.ZodEnum<{
+            claude: "claude";
+            codex: "codex";
+            opencode: "opencode";
+        }>>;
+        models: z.ZodOptional<z.ZodObject<{
+            claude: z.ZodOptional<z.ZodString>;
+            codex: z.ZodOptional<z.ZodString>;
+            opencode: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type WorkspaceConfigResponse = z.infer<typeof workspaceConfigResponseSchema>;
+/**
+ * `PUT /api/v1/workspace/config` body — partial: absent keys stay untouched. A rejected workspace
+ * root (not writable) 400s with the reason and persists NOTHING, resources included, so callers
+ * may send both in one request only if they want that atomicity. Bounds mirror
+ * `src/workspace/config.ts` exactly, so a value this schema accepts can never be degraded away by
+ * the next load's `.catch`.
+ */
+export declare const setWorkspaceConfigInputSchema: z.ZodObject<{
+    browseRoot: z.ZodOptional<z.ZodString>;
+    projectsDir: z.ZodOptional<z.ZodString>;
+    skillsAutoUpdate: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    composerDefaults: z.ZodOptional<z.ZodObject<{
+        autonomous: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        worktree: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    }, z.core.$strip>>;
+    agentDefaults: z.ZodOptional<z.ZodObject<{
+        runner: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            claude: "claude";
+            codex: "codex";
+            opencode: "opencode";
+        }>>>;
+        models: z.ZodOptional<z.ZodObject<{
+            claude: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            codex: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            opencode: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    resources: z.ZodOptional<z.ZodObject<{
+        maxParallel: z.ZodOptional<z.ZodNumber>;
+        maxMonitoringSessions: z.ZodOptional<z.ZodNumber>;
+        monitoringWakeIntervalMinutes: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        autoResumeOnUsageLimit: z.ZodOptional<z.ZodBoolean>;
+        memoryLimitMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        worktreeRetentionDefault: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type SetWorkspaceConfigInput = z.infer<typeof setWorkspaceConfigInputSchema>;
+/**
+ * `GET/PUT /api/v1/ui-state` — the per-repo GUI prefs in `.ai/cezar/ui-state.json`.
+ *
+ * An OPEN bag on purpose (BACKWARD_COMPATIBILITY.md §3): unknown keys round-trip untouched, so a
+ * newer cockpit's prefs survive an older server and a future pref needs no server change. Hence
+ * `z.looseObject`, not a closed object — the keys below are the ones the server's schema *names*,
+ * never the ones it *permits*. The write side caps the TOP-LEVEL key count at 200 (#429); that cap
+ * is a request-body refinement in `src/server/server.ts` (`capUiStateKeys`, :756) and is not part
+ * of the response shape.
+ *
+ * `notifications` is deliberately NOT here: it moved to `WorkspaceUiState` at step 3.5 and the
+ * per-repo schema (src/server/server.ts:550) has not named it since. The hand-written DTO still
+ * listed it, which made it wider than the route.
+ */
+export declare const uiStateSchema: z.ZodObject<{
+    lastTask: z.ZodOptional<z.ZodObject<{
+        source: z.ZodEnum<{
+            skill: "skill";
+            workflow: "workflow";
+        }>;
+        ref: z.ZodString;
+    }, z.core.$strip>>;
+    recentSources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source: z.ZodEnum<{
+            skill: "skill";
+            workflow: "workflow";
+        }>;
+        ref: z.ZodString;
+    }, z.core.$strip>>>;
+    lastWorktree: z.ZodOptional<z.ZodBoolean>;
+    lastAutonomous: z.ZodOptional<z.ZodBoolean>;
+    lastGenerateFollowups: z.ZodOptional<z.ZodBoolean>;
+    skillUsage: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+    runsView: z.ZodOptional<z.ZodEnum<{
+        list: "list";
+        table: "table";
+    }>>;
+    githubView: z.ZodOptional<z.ZodEnum<{
+        issues: "issues";
+        prs: "prs";
+    }>>;
+    appearance: z.ZodOptional<z.ZodObject<{
+        accent: z.ZodOptional<z.ZodEnum<{
+            lime: "lime";
+            violet: "violet";
+        }>>;
+        density: z.ZodOptional<z.ZodEnum<{
+            comfortable: "comfortable";
+            compact: "compact";
+            ultra: "ultra";
+        }>>;
+    }, z.core.$strip>>;
+    promptTemplates: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        text: z.ZodString;
+        skills: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+    dismissedSkillsBanner: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>;
+export type UiState = z.infer<typeof uiStateSchema>;
+/**
+ * `GET/PUT /api/v1/workspace/ui-state` — cross-project GUI prefs in `~/.cezar/ui-state.json`
+ * (multi-project spec, step 2.7).
+ *
+ * The same open bag as its per-repo twin above, and open for the same reason. The PUT merges
+ * SHALLOWLY at the top level server-side, so a writer must send the whole `sidebar` object (or the
+ * whole `importedSkills` array), never a leaf.
+ */
+export declare const workspaceLastLocationSchema: z.ZodObject<{
+    projectId: z.ZodString;
+    pathname: z.ZodString;
+    search: z.ZodOptional<z.ZodString>;
+    hash: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type WorkspaceLastLocation = z.infer<typeof workspaceLastLocationSchema>;
+export declare const workspaceUiStateSchema: z.ZodObject<{
+    sidebar: z.ZodOptional<z.ZodObject<{
+        collapsed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
+    }, z.core.$loose>>;
+    dismissedProviderAuthFailures: z.ZodOptional<z.ZodObject<{
+        claude: z.ZodOptional<z.ZodString>;
+        codex: z.ZodOptional<z.ZodString>;
+        opencode: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    appearance: z.ZodOptional<z.ZodObject<{
+        accent: z.ZodOptional<z.ZodEnum<{
+            lime: "lime";
+            violet: "violet";
+        }>>;
+        density: z.ZodOptional<z.ZodEnum<{
+            comfortable: "comfortable";
+            compact: "compact";
+            ultra: "ultra";
+        }>>;
+    }, z.core.$strip>>;
+    notifications: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    lastLocation: z.ZodOptional<z.ZodObject<{
+        projectId: z.ZodString;
+        pathname: z.ZodString;
+        search: z.ZodOptional<z.ZodString>;
+        hash: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    importedSkills: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$loose>;
+export type WorkspaceUiState = z.infer<typeof workspaceUiStateSchema>;
+/** Per-runner default model preset (Settings → Agents): the composer preselects this model id for
+ *  the runner. Absent = auto (the runner decides). Keyed by runner name rather than derived from
+ *  `runnerSchema` because the server's own `defaultModels` object (src/config.ts:92) is spelled
+ *  the same way — one key per runner, each independently optional. */
+export declare const runnerModelsSchema: z.ZodObject<{
+    claude: z.ZodOptional<z.ZodString>;
+    codex: z.ZodOptional<z.ZodString>;
+    opencode: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type RunnerModels = z.infer<typeof runnerModelsSchema>;
+/** `GET /api/v1/config` — every Settings → Agents knob in one read. */
+export declare const configResponseSchema: z.ZodObject<{
+    baseBranch: z.ZodNullable<z.ZodString>;
+    defaultRunner: z.ZodEnum<{
+        claude: "claude";
+        codex: "codex";
+        opencode: "opencode";
+    }>;
+    systemPrompt: z.ZodNullable<z.ZodString>;
+    defaultModels: z.ZodObject<{
+        claude: z.ZodOptional<z.ZodString>;
+        codex: z.ZodOptional<z.ZodString>;
+        opencode: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    modelsLocked: z.ZodBoolean;
+    maxParallel: z.ZodNumber;
+    memoryLimitMb: z.ZodNullable<z.ZodNumber>;
+    worktreeRetention: z.ZodNumber;
+    liveTitleUpdates: z.ZodNullable<z.ZodBoolean>;
+    reviewGate: z.ZodNullable<z.ZodBoolean>;
+}, z.core.$strip>;
+export type ConfigResponse = z.infer<typeof configResponseSchema>;
+/** The `PUT /api/v1/config` answer: the same shape GET serves (`configAnswer` builds both). */
+export declare const setConfigResponseSchema: z.ZodObject<{
+    baseBranch: z.ZodNullable<z.ZodString>;
+    defaultRunner: z.ZodEnum<{
+        claude: "claude";
+        codex: "codex";
+        opencode: "opencode";
+    }>;
+    systemPrompt: z.ZodNullable<z.ZodString>;
+    defaultModels: z.ZodObject<{
+        claude: z.ZodOptional<z.ZodString>;
+        codex: z.ZodOptional<z.ZodString>;
+        opencode: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    modelsLocked: z.ZodBoolean;
+    maxParallel: z.ZodNumber;
+    memoryLimitMb: z.ZodNullable<z.ZodNumber>;
+    worktreeRetention: z.ZodNumber;
+    liveTitleUpdates: z.ZodNullable<z.ZodBoolean>;
+    reviewGate: z.ZodNullable<z.ZodBoolean>;
+}, z.core.$strip>;
+export type SetConfigResponse = z.infer<typeof setConfigResponseSchema>;
+/**
+ * `PUT /api/v1/config` body (Settings → Agents; the Repo tab's base-branch picker).
+ * `baseBranch: null` clears the setting back to "follow checked-out branch"; `systemPrompt` and
+ * per-runner `defaultModels` entries clear on `null` (or `''`) too. Merged into the raw
+ * config.json server-side — `defaultModels` merges per runner, so one write never clobbers
+ * another runner's preset.
+ */
+export declare const setConfigInputSchema: z.ZodObject<{
+    baseBranch: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    defaultRunner: z.ZodOptional<z.ZodEnum<{
+        claude: "claude";
+        codex: "codex";
+        opencode: "opencode";
+    }>>;
+    systemPrompt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    defaultModels: z.ZodOptional<z.ZodObject<{
+        claude: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        codex: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        opencode: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+    maxParallel: z.ZodOptional<z.ZodNumber>;
+    memoryLimitMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    worktreeRetention: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    liveTitleUpdates: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    reviewGate: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+}, z.core.$strip>;
+export type SetConfigInput = z.infer<typeof setConfigInputSchema>;
+export declare const skillsUpdateStatusSchema: z.ZodEnum<{
+    available: "available";
+    checking: "checking";
+    current: "current";
+    error: "error";
+    idle: "idle";
+    unavailable: "unavailable";
+    updating: "updating";
+}>;
+export type SkillsUpdateStatus = z.infer<typeof skillsUpdateStatusSchema>;
+export declare const skillsUpdateScopeStateSchema: z.ZodObject<{
+    scope: z.ZodEnum<{
+        global: "global";
+        project: "project";
+    }>;
+    status: z.ZodEnum<{
+        available: "available";
+        checking: "checking";
+        current: "current";
+        error: "error";
+        idle: "idle";
+        unavailable: "unavailable";
+        updating: "updating";
+    }>;
+    available: z.ZodBoolean;
+    skills: z.ZodArray<z.ZodString>;
+    checkedAt: z.ZodNullable<z.ZodString>;
+    updatedAt: z.ZodNullable<z.ZodString>;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SkillsUpdateScopeState = z.infer<typeof skillsUpdateScopeStateSchema>;
+/** `GET /api/v1/workspace/skills-update` (and the check/apply POSTs) — the merged project+global
+ *  skills-update state. `autoUpdateEnabled`/`inherited` are re-stamped from the workspace config
+ *  on the way out (`skillsUpdateResponse`, src/server/server.ts:1818). */
+export declare const skillsUpdateStateSchema: z.ZodObject<{
+    status: z.ZodEnum<{
+        available: "available";
+        checking: "checking";
+        current: "current";
+        error: "error";
+        idle: "idle";
+        unavailable: "unavailable";
+        updating: "updating";
+    }>;
+    available: z.ZodBoolean;
+    autoUpdateEnabled: z.ZodBoolean;
+    inherited: z.ZodBoolean;
+    checkedAt: z.ZodNullable<z.ZodString>;
+    updatedAt: z.ZodNullable<z.ZodString>;
+    scopes: z.ZodArray<z.ZodObject<{
+        scope: z.ZodEnum<{
+            global: "global";
+            project: "project";
+        }>;
+        status: z.ZodEnum<{
+            available: "available";
+            checking: "checking";
+            current: "current";
+            error: "error";
+            idle: "idle";
+            unavailable: "unavailable";
+            updating: "updating";
+        }>;
+        available: z.ZodBoolean;
+        skills: z.ZodArray<z.ZodString>;
+        checkedAt: z.ZodNullable<z.ZodString>;
+        updatedAt: z.ZodNullable<z.ZodString>;
+        reason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    needsUpgradeNotes: z.ZodBoolean;
+}, z.core.$strip>;
+export type SkillsUpdateState = z.infer<typeof skillsUpdateStateSchema>;
+/** The agent backends are the providers — one alias, never a second enum. */
+export declare const providerIdSchema: z.ZodEnum<{
+    claude: "claude";
+    codex: "codex";
+    opencode: "opencode";
+}>;
+export type ProviderId = Runner;
+/** Coarse host authentication state. Credentials, account identity, and raw CLI output never
+ *  cross this boundary. */
+export declare const providerConnectionStateSchema: z.ZodEnum<{
+    connected: "connected";
+    disconnected: "disconnected";
+    "not-installed": "not-installed";
+    unknown: "unknown";
+}>;
+export type ProviderConnectionState = z.infer<typeof providerConnectionStateSchema>;
+/**
+ * One provider row.
+ *
+ * `enabled` is OPTIONAL: `ProviderAuth.status()` (src/core/provider-auth.ts:12) builds rows
+ * without it and only `applyProviderEnablement` stamps it in, so the type the routes answer keeps
+ * the key optional. The hand-written DTO declared it required — narrower than the route.
+ */
+export declare const providerStatusSchema: z.ZodObject<{
+    provider: z.ZodEnum<{
+        claude: "claude";
+        codex: "codex";
+        opencode: "opencode";
+    }>;
+    status: z.ZodEnum<{
+        connected: "connected";
+        disconnected: "disconnected";
+        "not-installed": "not-installed";
+        unknown: "unknown";
+    }>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    hint: z.ZodOptional<z.ZodString>;
+    authFailureId: z.ZodOptional<z.ZodString>;
+    profileId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ProviderStatus = z.infer<typeof providerStatusSchema>;
+/** `GET /api/v1/providers/status`, and the answer of the enabled/retry mutators. */
+export declare const providerStatusResponseSchema: z.ZodObject<{
+    providers: z.ZodArray<z.ZodObject<{
+        provider: z.ZodEnum<{
+            claude: "claude";
+            codex: "codex";
+            opencode: "opencode";
+        }>;
+        status: z.ZodEnum<{
+            connected: "connected";
+            disconnected: "disconnected";
+            "not-installed": "not-installed";
+            unknown: "unknown";
+        }>;
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        hint: z.ZodOptional<z.ZodString>;
+        authFailureId: z.ZodOptional<z.ZodString>;
+        profileId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ProviderStatusResponse = z.infer<typeof providerStatusResponseSchema>;
+/** `POST /api/v1/providers/connect` — either a terminal was handed the login command, or the
+ *  provider turned out to be connected already. Every other outcome is a 409/500 carrying the
+ *  same `command` for the clipboard fallback. */
+export declare const providerConnectResponseSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    opened: z.ZodLiteral<true>;
+    command: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    opened: z.ZodLiteral<false>;
+    connected: z.ZodLiteral<true>;
+    command: z.ZodString;
+}, z.core.$strip>], "opened">;
+export type ProviderConnectResponse = z.infer<typeof providerConnectResponseSchema>;
+export declare const runnerModelOptionSchema: z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    description: z.ZodString;
+}, z.core.$strip>;
+export type RunnerModelOption = z.infer<typeof runnerModelOptionSchema>;
+/** `GET /api/v1/models?runner=codex` — discovered models, plus how fresh the answer is. Never an
+ *  error: an unavailable CLI degrades to `source: 'unavailable'` with a `reason`. */
+export declare const runnerModelCatalogResponseSchema: z.ZodObject<{
+    runner: z.ZodEnum<{
+        claude: "claude";
+        codex: "codex";
+        opencode: "opencode";
+    }>;
+    models: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        description: z.ZodString;
+    }, z.core.$strip>>;
+    source: z.ZodEnum<{
+        cache: "cache";
+        live: "live";
+        unavailable: "unavailable";
+    }>;
+    stale: z.ZodBoolean;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type RunnerModelCatalogResponse = z.infer<typeof runnerModelCatalogResponseSchema>;
+/** A local app a worktree can be opened in (#open-in): editor, file manager, or terminal. */
+export declare const openTargetSchema: z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    icon: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type OpenTarget = z.infer<typeof openTargetSchema>;
+/** `GET /api/v1/open-targets` — the detected local apps; empty in hosted mode (CEZ_REMOTE). */
+export declare const openTargetsResponseSchema: z.ZodObject<{
+    targets: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        icon: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type OpenTargetsResponse = z.infer<typeof openTargetsResponseSchema>;
+/**
+ * `POST /api/v1/open-in` — open THIS PROJECT'S root in a detected app (Settings → the project
+ * folder row). The path is never sent: it is the scoped project's own registered root, resolved
+ * server-side, so the route has no traversal surface at all. `target` is an
+ * `/api/v1/open-targets` id; unlike the run route there is no `default`/`cli:` handling, because
+ * a repo root is a directory and an agent CLI belongs in a task worktree.
+ */
+export declare const openProjectInSchema: z.ZodObject<{
+    target: z.ZodString;
+}, z.core.$strip>;
+export type OpenProjectInRequest = z.infer<typeof openProjectInSchema>;
+/** The 200 for the above — `opened` is a literal because every failure is a 409 with `{ error }`,
+ *  so a `false` would be unreachable and would only invite a client to branch on it. */
+export declare const openProjectInResponseSchema: z.ZodObject<{
+    opened: z.ZodLiteral<true>;
+    path: z.ZodString;
+}, z.core.$strip>;
+export type OpenProjectInResponse = z.infer<typeof openProjectInResponseSchema>;

package/dist/core/agent-env.d.ts

@@ -15,7 +15,7 @@
  *   - `CEZ_ENV_PASSTHROUGH=A,B,C` forwards those extra named vars;
  *   - `CEZ_AGENT_ENV_FULL=1` restores the legacy full-`process.env` behavior.
  */
-import type { AgentBackend } from './agent-runner.js';
+import type { AgentBackend } from './agent-runner.ts';
 export declare function looksSecret(name: string): boolean;
 export interface BuildChildEnvOptions {
     backend: AgentBackend;

package/dist/core/agent-model-policy.d.ts

@@ -0,0 +1,10 @@
+/** The server-side switch that makes native agent settings authoritative. */
+export declare const AGENT_MODELS_LOCKED_ENV = "CEZ_AGENT_MODELS_LOCKED";
+/**
+ * Only the exact environment value `1` enables the process-wide lock. The
+ * global workspace config or one repository may additionally opt in with
+ * `"modelsLocked": true`; missing, unreadable, malformed, and false values
+ * preserve ordinary model selection unless another source enables the lock.
+ */
+export declare function agentModelsLocked(repoRoot?: string, env?: NodeJS.ProcessEnv): boolean;
+export declare const AGENT_MODELS_LOCKED_ERROR = "agent models are locked \u2014 configure the model in the native coding-agent settings";

package/dist/core/agent-model-policy.js

@@ -0,0 +1,36 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { workspaceConfigPath } from '../paths.js';
+/** The server-side switch that makes native agent settings authoritative. */
+export const AGENT_MODELS_LOCKED_ENV = 'CEZ_AGENT_MODELS_LOCKED';
+const modelPolicyConfigSchema = z.object({
+    modelsLocked: z.boolean().optional(),
+}).passthrough();
+/**
+ * Only the exact environment value `1` enables the process-wide lock. The
+ * global workspace config or one repository may additionally opt in with
+ * `"modelsLocked": true`; missing, unreadable, malformed, and false values
+ * preserve ordinary model selection unless another source enables the lock.
+ */
+export function agentModelsLocked(repoRoot, env = process.env) {
+    if (env[AGENT_MODELS_LOCKED_ENV] === '1')
+        return true;
+    const paths = [
+        workspaceConfigPath(env),
+        ...(repoRoot ? [join(repoRoot, '.ai', 'cezar', 'config.json')] : []),
+    ];
+    for (const path of paths) {
+        try {
+            const parsed = modelPolicyConfigSchema.safeParse(JSON.parse(readFileSync(path, 'utf8')));
+            if (parsed.success && parsed.data.modelsLocked === true)
+                return true;
+        }
+        catch {
+            // Each source is optional and independently degradable.
+        }
+    }
+    return false;
+}
+export const AGENT_MODELS_LOCKED_ERROR = 'agent models are locked — configure the model in the native coding-agent settings';
+//# sourceMappingURL=agent-model-policy.js.map

package/dist/core/agent-model-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-model-policy.js","sourceRoot":"","sources":["../../src/core/agent-model-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjB;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAiB,EACjB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,GAAG,CAAC,uBAAuB,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,KAAK,GAAG;QACZ,mBAAmB,CAAC,GAAG,CAAC;QACxB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAC9C,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CACvC,CAAC;YACF,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GACpC,mFAAmF,CAAC"}

package/dist/core/agent-profiles.d.ts

@@ -0,0 +1,59 @@
+import type { ProviderId } from './provider-auth.ts';
+/**
+ * Agent profiles — a second (third, …) login of the SAME agent CLI.
+ *
+ * The binary never changes; only the environment does. `CLAUDE_CONFIG_DIR=~/.claude-klaudiusz claude`
+ * is the same Claude Code talking to a different account, because that one variable relocates the
+ * agent's ENTIRE per-user home: credentials, settings, projects and — the part that bites —
+ * `sessions/`, so a session id only means something inside the dir it was created in.
+ *
+ * This module is the single maintenance surface for that vendor knowledge, and it is deliberately
+ * the SIBLING of `src/agent-config/catalog.ts` rather than part of it: the catalog owns config
+ * *file* knowledge (paths, formats, verbatim precedence strings), this owns the *home-relocation*
+ * variable. Splitting them also keeps the layering honest — `agent-config/` may import `paths.ts`,
+ * while this is imported BY the runners, provider auth and the terminal handoff.
+ *
+ * Pure by construction: no filesystem, no `process.env`, nothing to stub. Resolution against the
+ * workspace config lives in `src/workspace/agent-profiles.ts`.
+ *
+ * Facts verified against the shipped CLIs on 2026-07-29.
+ */
+/**
+ * Which env var relocates each agent's whole per-user home.
+ *
+ * `null` means the agent has no such variable and therefore cannot carry profiles:
+ *
+ * - **claude** → `CLAUDE_CONFIG_DIR`. Documented; moves credentials, settings, projects, sessions.
+ * - **codex** → `CODEX_HOME`. Documented; `auth.json` lives inside it, so identity moves too.
+ * - **opencode** → nothing usable. `OPENCODE_CONFIG_DIR`/`OPENCODE_CONFIG` move CONFIG ONLY;
+ *   credentials live in `~/.local/share/opencode/opencode.db`, behind a separate `OPENCODE_DB`.
+ *   A config-dir-only profile would swap settings while still billing the other account — the UI
+ *   would say "Work" and the run would not be — so OpenCode is unsupported until it documents a
+ *   single home variable. `XDG_CONFIG_HOME` is rejected regardless: it is machine-wide and would
+ *   relocate every other XDG-aware tool the agent's own Bash calls touch.
+ */
+export declare const PROFILE_ENV_VAR: Record<ProviderId, string | null>;
+/** Providers that can carry more than one account — what the UI offers "Add account" for. */
+export declare const PROFILE_CAPABLE_PROVIDERS: readonly ProviderId[];
+export declare function supportsProfiles(provider: ProviderId): boolean;
+/**
+ * The env a spawned agent needs to run under `configDir`, or `{}` for the default profile.
+ *
+ * `{}` is load-bearing, not a convenience: `buildChildEnv` applies `extraEnv` AFTER its allowlist
+ * and so bypasses it entirely, which makes this function the only thing standing between a
+ * profile and the child environment. Returning nothing for the zero-config case means the
+ * overwhelmingly common path adds literally no variable — the same environment cezar has always
+ * spawned. It also means this can never emit one provider's variable for another provider's
+ * process: the name comes from `PROFILE_ENV_VAR[provider]` and nowhere else.
+ */
+export declare function profileEnv(provider: ProviderId, configDir: string | null | undefined): Record<string, string>;
+/**
+ * Does `entries` look like a config dir this provider actually wrote?
+ *
+ * ADVISORY, never a gate. The honest first-run flow for a second account is *add the profile →
+ * Connect → the CLI creates the dir on login*, so refusing an unrecognized directory would break
+ * the very case the feature exists for. The answer drives a warning line in the UI, nothing more.
+ *
+ * Takes the directory listing rather than a path so it stays pure; the caller reads the dir.
+ */
+export declare function looksLikeProfileDir(provider: ProviderId, entries: readonly string[]): boolean;