@sealant/api-contracts-next 0.39.0-next.696 → 0.39.0-next.700

package/dist/core-api/control-plane.d.ts

@@ -855,7 +855,52 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
     readonly email: import("effect/Schema").String;
     readonly name: import("effect/Schema").String;
     readonly createdAt: import("effect/Schema").String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("./users.js").UserNotFoundError | typeof import("./users.js").UserInternalServerError>, never, never>, false> | import("effect/unstable/httpapi/HttpApiGroup").HttpApiGroup<"workspaces", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"bindWorkspace", "POST", "/v1/workspaces/:workspaceId/bind", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("./users.js").UserNotFoundError | typeof import("./users.js").UserInternalServerError>, never, never>, false> | import("effect/unstable/httpapi/HttpApiGroup").HttpApiGroup<"workspaces", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"applyWorkspaceDotfiles", "POST", "/v1/workspaces/:workspaceId/dotfiles", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
+    readonly workspaceId: import("effect/Schema").String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
+    readonly ownerUserId: import("effect/Schema").String;
+    readonly onBehalfOfUserId: import("effect/Schema").String;
+    readonly user: import("effect/Schema").String;
+    readonly home: import("effect/Schema").String;
+    readonly repository: import("effect/Schema").optional<import("effect/Schema").Struct<{
+        readonly url: import("effect/Schema").String;
+        readonly ref: import("effect/Schema").optional<import("effect/Schema").String>;
+        readonly manager: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["auto", "chezmoi", "stow", "copy"]>>;
+        readonly bootstrap: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly bootstrapCommand: import("effect/Schema").optional<import("effect/Schema").String>;
+    }>>;
+    readonly archives: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Struct<{
+        readonly data: import("effect/Schema").String;
+        readonly manager: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["auto", "chezmoi", "stow", "copy"]>>;
+        readonly target: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["home", "config"]>>;
+        readonly bootstrap: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly bootstrapCommand: import("effect/Schema").optional<import("effect/Schema").String>;
+    }>>>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
+    readonly runId: import("effect/Schema").String;
+    readonly workspaceId: import("effect/Schema").String;
+    readonly attemptId: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly ownerUserId: import("effect/Schema").String;
+    readonly harnessId: import("effect/Schema").String;
+    readonly mode: import("effect/Schema").Literals<readonly ["one-shot", "interactive"]>;
+    readonly status: import("effect/Schema").Literals<readonly ["queued", "running", "completed", "failed", "cancelled"]>;
+    readonly prompt: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly command: import("effect/Schema").optional<import("effect/Schema").Struct<{
+        readonly executable: import("effect/Schema").String;
+        readonly args: import("effect/Schema").$Array<import("effect/Schema").String>;
+        readonly cwd: import("effect/Schema").optional<import("effect/Schema").String>;
+        readonly argCount: import("effect/Schema").optional<import("effect/Schema").Number>;
+        readonly argLengths: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Number>>;
+    }>>;
+    readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
+    readonly exitCode: import("effect/Schema").optional<import("effect/Schema").Number>;
+    readonly errorMessage: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly startedAt: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly finishedAt: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly recordDeletedAt: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly createdAt: import("effect/Schema").String;
+    readonly updatedAt: import("effect/Schema").String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("./workspaces.js").WorkspaceBadRequestError | typeof import("./workspaces.js").WorkspaceForbiddenError | typeof import("./workspaces.js").WorkspaceNotFoundError | typeof import("./workspaces.js").WorkspaceConflictError | typeof import("./workspaces.js").WorkspaceBadGatewayError | typeof import("./workspaces.js").WorkspaceServiceUnavailableError | typeof import("./workspaces.js").WorkspaceInternalServerError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"bindWorkspace", "POST", "/v1/workspaces/:workspaceId/bind", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
     readonly workspaceId: import("effect/Schema").String;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
     readonly ownerUserId: import("effect/Schema").String;
@@ -1286,6 +1331,14 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
                 readonly connectedAccountId: import("effect/Schema").String;
                 readonly name: import("effect/Schema").String;
             }>>;
+            readonly pi: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                readonly connectedAccountId: import("effect/Schema").String;
+                readonly name: import("effect/Schema").String;
+            }>>;
+            readonly opencode: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                readonly connectedAccountId: import("effect/Schema").String;
+                readonly name: import("effect/Schema").String;
+            }>>;
         }>;
     }>>;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("./workspaces.js").WorkspaceForbiddenError | typeof import("./workspaces.js").WorkspaceNotFoundError | typeof import("./workspaces.js").WorkspaceConflictError | typeof import("./workspaces.js").WorkspaceInternalServerError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"listWorkspaceEvents", "GET", "/v1/workspaces/:workspaceId/events", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
@@ -1360,6 +1413,9 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
     readonly claude: import("effect/Schema").optional<import("effect/Schema").NullOr<import("effect/Schema").String>>;
     readonly codex: import("effect/Schema").optional<import("effect/Schema").NullOr<import("effect/Schema").String>>;
     readonly github: import("effect/Schema").optional<import("effect/Schema").NullOr<import("effect/Schema").String>>;
+    readonly pi: import("effect/Schema").optional<import("effect/Schema").NullOr<import("effect/Schema").String>>;
+    readonly opencode: import("effect/Schema").optional<import("effect/Schema").NullOr<import("effect/Schema").String>>;
+    readonly partial: import("effect/Schema").optional<import("effect/Schema").Boolean>;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
     readonly workspaceId: import("effect/Schema").String;
     readonly runId: import("effect/Schema").String;
@@ -1379,8 +1435,21 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
                 readonly connectedAccountId: import("effect/Schema").String;
                 readonly name: import("effect/Schema").String;
             }>>;
+            readonly pi: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                readonly connectedAccountId: import("effect/Schema").String;
+                readonly name: import("effect/Schema").String;
+            }>>;
+            readonly opencode: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                readonly connectedAccountId: import("effect/Schema").String;
+                readonly name: import("effect/Schema").String;
+            }>>;
         }>;
     }>;
+    readonly skipped: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Struct<{
+        readonly provider: import("effect/Schema").Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+        readonly code: import("effect/Schema").Literals<readonly ["connected-account-missing", "connected-account-invalid", "connected-account-unsupported", "login-file-unusable"]>;
+        readonly message: import("effect/Schema").String;
+    }>>>;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("./workspaces.js").WorkspaceBadRequestError | typeof import("./workspaces.js").WorkspaceForbiddenError | typeof import("./workspaces.js").WorkspaceNotFoundError | typeof import("./workspaces.js").WorkspaceConflictError | typeof import("./workspaces.js").WorkspaceBadGatewayError | typeof import("./workspaces.js").WorkspaceServiceUnavailableError | typeof import("./workspaces.js").WorkspaceInternalServerError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"recoverWorkspace", "POST", "/v1/workspaces/:workspaceId/recover", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
     readonly workspaceId: import("effect/Schema").String;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{

package/dist/core-api/workspaces.d.ts

@@ -186,6 +186,95 @@ export declare const execWorkspaceRequestSchema: Schema.Struct<{
     readonly user: Schema.optional<Schema.String>;
 }>;
 export type ExecWorkspaceRequest = typeof execWorkspaceRequestSchema.Type;
+/** The `harnessId` stamped on runs that apply a person's dotfiles (`applyWorkspaceDotfiles`). */
+export declare const dotfilesRunHarnessId = "dotfiles";
+/** How a dotfiles tree is applied: chezmoi and stow layouts are detected by `auto`. */
+export declare const workspaceDotfilesManagerSchema: Schema.Literals<readonly ["auto", "chezmoi", "stow", "copy"]>;
+/**
+ * A dotfiles repository cloned as the person (no credential reaches the workspace: a repository
+ * only the person's own identity can reach is resolved by the caller and sent as an archive).
+ */
+export declare const applyWorkspaceDotfilesRepositorySchema: Schema.Struct<{
+    /** An `https://` clone URL with no credential in it (no `user:token@`). */
+    readonly url: Schema.String;
+    /** Branch or tag; omitted clones the remote's default branch. */
+    readonly ref: Schema.optional<Schema.String>;
+    readonly manager: Schema.optional<Schema.Literals<readonly ["auto", "chezmoi", "stow", "copy"]>>;
+    /** Run the bootstrap command after applying (when the checkout has it). Default true. */
+    readonly bootstrap: Schema.optional<Schema.Boolean>;
+    /** Relative to the checkout; default `./install.sh`. */
+    readonly bootstrapCommand: Schema.optional<Schema.String>;
+}>;
+/** A caller-resolved dotfiles tree, as at create (`spec.runtime.dotfilesArchives`). */
+export declare const applyWorkspaceDotfilesArchiveSchema: Schema.Struct<{
+    /** base64 of a `.tar.gz`; at most 6 MiB of base64 (about 4 MiB decoded). */
+    readonly data: Schema.String;
+    readonly manager: Schema.optional<Schema.Literals<readonly ["auto", "chezmoi", "stow", "copy"]>>;
+    /** Where the tree lands: `home` (default) or `config` (`~/.config`, copy manager only). */
+    readonly target: Schema.optional<Schema.Literals<readonly ["home", "config"]>>;
+    /** Run `./install.sh` (or `bootstrapCommand`) after applying when present. Default true. */
+    readonly bootstrap: Schema.optional<Schema.Boolean>;
+    readonly bootstrapCommand: Schema.optional<Schema.String>;
+}>;
+/**
+ * Apply a person's dotfiles into their home of a RUNNING workspace, as their Linux user
+ * (docs/connected-accounts-design.md §6g; Mend's ADR 0016 decision 11): the same sources as a
+ * create's dotfiles (a repository, archives, or both; the repository first, archives after in
+ * order) and the same applier (sealantd's: chezmoi, stow or copy, then each tree's bootstrap).
+ *
+ * `user` must exist and must not be root or in root's group, and `home` must be its passwd home: an
+ * existing directory of the user's, reached without a symbolic link. The clone, chezmoi, stow and the
+ * bootstrap run as the user; sealantd's archive staging and `copy` manager still run as root inside
+ * the home and follow links the person planted there, until sealantd's fix for it lands (see
+ * docs/connected-accounts-design.md §6g). `onBehalfOfUserId` names whose dotfiles they are: it is
+ * recorded on the run, and a home whose logins another person holds is refused (`home-held`). Answered `202` with a run (`harnessId`
+ * `dotfiles`) once the archives are staged: the run's first `processStarted` is the bootstrap,
+ * started once every file is applied; its output and exit are the run's. The run completes with the
+ * bootstrap's exit code (0 when no tree had one) and fails, with the daemon's words, when the apply
+ * was refused or the bootstrap ran past 30 minutes (it is stopped).
+ */
+export declare const applyWorkspaceDotfilesRequestSchema: Schema.Struct<{
+    /** The workspace's owner (owner scope; uniform 404 otherwise). */
+    readonly ownerUserId: Schema.String;
+    /** The Sealant user whose dotfiles these are: recorded on the run (`metadata.dotfiles`). */
+    readonly onBehalfOfUserId: Schema.String;
+    /** The Linux user to apply as (a login name or a uid); never root. */
+    readonly user: Schema.String;
+    /** The user's passwd home: absolute, normalised, never under `/workspace`. */
+    readonly home: Schema.String;
+    readonly repository: Schema.optional<Schema.Struct<{
+        /** An `https://` clone URL with no credential in it (no `user:token@`). */
+        readonly url: Schema.String;
+        /** Branch or tag; omitted clones the remote's default branch. */
+        readonly ref: Schema.optional<Schema.String>;
+        readonly manager: Schema.optional<Schema.Literals<readonly ["auto", "chezmoi", "stow", "copy"]>>;
+        /** Run the bootstrap command after applying (when the checkout has it). Default true. */
+        readonly bootstrap: Schema.optional<Schema.Boolean>;
+        /** Relative to the checkout; default `./install.sh`. */
+        readonly bootstrapCommand: Schema.optional<Schema.String>;
+    }>>;
+    readonly archives: Schema.optional<Schema.$Array<Schema.Struct<{
+        /** base64 of a `.tar.gz`; at most 6 MiB of base64 (about 4 MiB decoded). */
+        readonly data: Schema.String;
+        readonly manager: Schema.optional<Schema.Literals<readonly ["auto", "chezmoi", "stow", "copy"]>>;
+        /** Where the tree lands: `home` (default) or `config` (`~/.config`, copy manager only). */
+        readonly target: Schema.optional<Schema.Literals<readonly ["home", "config"]>>;
+        /** Run `./install.sh` (or `bootstrapCommand`) after applying when present. Default true. */
+        readonly bootstrap: Schema.optional<Schema.Boolean>;
+        readonly bootstrapCommand: Schema.optional<Schema.String>;
+    }>>>;
+}>;
+export type ApplyWorkspaceDotfilesRequest = typeof applyWorkspaceDotfilesRequestSchema.Type;
+/**
+ * Stable `code`s of the `WorkspaceConflictError` a dotfiles apply answers, nothing applied:
+ * `workspace-not-running` (no ready executor), `dotfiles-user-unsupported` (the workspace's
+ * sealantd cannot apply dotfiles as a user), `user-unknown` (no such user: make it first),
+ * `user-root` (the user is root or in root's group), `home-mismatch` (the home is not the user's
+ * passwd home), `home-unusable` (the home is missing, not a directory, not the user's, or reached
+ * through a symbolic link), `home-held` (another person's logins are held in the home).
+ */
+export declare const workspaceDotfilesConflictCodes: readonly ["workspace-not-running", "dotfiles-user-unsupported", "user-unknown", "user-root", "home-mismatch", "home-unusable", "home-held"];
+export type WorkspaceDotfilesConflictCode = (typeof workspaceDotfilesConflictCodes)[number];
 /**
  * Bind a standby workspace's working directory, or a bindable extra mount, to one subdirectory of
  * its root (sealantd ADR-0014). `mountPath` defaults to the working directory; an empty `subpath`
@@ -618,9 +707,26 @@ export declare const inspectWorkspaceImageResponseSchema: Schema.Struct<{
     }>;
 }>;
 export type InspectWorkspaceImageResponse = typeof inspectWorkspaceImageResponseSchema.Type;
-/** The providers a home holds logins for (docs/connected-accounts-design.md §6c). */
-export declare const workspaceCredentialHomeProviders: readonly ["claude", "codex", "github"];
+/**
+ * Stable codes of a refused connected account, carried with the account's `provider` by the error
+ * that refuses it (a create's or a credentials put's): `connected-account-missing`
+ * (`WorkspaceNotFoundError`, 404: the person has no such account, or it is archived or someone
+ * else's) and `connected-account-invalid` (`WorkspaceConflictError`, 409: the account is marked
+ * invalid, or holds an unusable credential; reconnect it) and `connected-account-unsupported`
+ * (`WorkspaceConflictError`, 409: the account cannot serve what was asked, as a Codex API key cannot
+ * be pi's or opencode's ChatGPT login). Nothing was written either way.
+ */
+export declare const connectedAccountRefusalCodes: readonly ["connected-account-missing", "connected-account-invalid", "connected-account-unsupported"];
+export type ConnectedAccountRefusalCode = (typeof connectedAccountRefusalCodes)[number];
+/**
+ * The providers a home holds logins for (docs/connected-accounts-design.md §6c). `pi` and
+ * `opencode` are the person's ChatGPT login (a Codex connected account), written into each tool's
+ * own `auth.json`.
+ */
+export declare const workspaceCredentialHomeProviders: readonly ["claude", "codex", "github", "pi", "opencode"];
 export type WorkspaceCredentialHomeProvider = (typeof workspaceCredentialHomeProviders)[number];
+/** The connected account's provider each home provider's login is made from. */
+export declare const workspaceCredentialHomeAccountProvider: Readonly<Record<WorkspaceCredentialHomeProvider, "claude" | "codex" | "github">>;
 /**
  * Put one person's logins into one home of a RUNNING workspace (docs/connected-accounts-design.md
  * §6c). A home holds one person's logins while it is held: the first put names its person, a put
@@ -652,6 +758,25 @@ export declare const putWorkspaceCredentialsRequestSchema: Schema.Struct<{
     readonly claude: Schema.optional<Schema.NullOr<Schema.String>>;
     readonly codex: Schema.optional<Schema.NullOr<Schema.String>>;
     readonly github: Schema.optional<Schema.NullOr<Schema.String>>;
+    /**
+     * pi's ChatGPT login, made from a Codex account of `onBehalfOfUserId` (an id or a Codex account
+     * name), as the `openai-codex` entry of `<home>/.pi/agent/auth.json`. The file is merged: its
+     * other entries stay, and an `openai-codex` login the person made in pi is never replaced.
+     */
+    readonly pi: Schema.optional<Schema.NullOr<Schema.String>>;
+    /**
+     * opencode's ChatGPT login, made the same way, as the `openai` entry of opencode's `auth.json`
+     * (`<home>/.local/share/opencode/auth.json`, followed through links to where it really is, which
+     * must be inside the home). A login the person made in opencode is never replaced or removed.
+     */
+    readonly opencode: Schema.optional<Schema.NullOr<Schema.String>>;
+    /**
+     * Write what the person has connected and leave out the rest: a provider whose account is refused
+     * (`connected-account-missing`, `-invalid` or `-unsupported`) is not written, its login is removed
+     * from the home as `null` would remove it, and the answer's `skipped` says which and why, instead
+     * of the whole put failing. Every other refusal still fails the put. Default false.
+     */
+    readonly partial: Schema.optional<Schema.Boolean>;
 }>;
 export type PutWorkspaceCredentialsRequest = typeof putWorkspaceCredentialsRequestSchema.Type;
 /** One account whose copy a home holds. */
@@ -683,9 +808,33 @@ export declare const workspaceCredentialHomeSchema: Schema.Struct<{
             /** The account's name under its provider, as it is now. */
             readonly name: Schema.String;
         }>>;
+        /** The Codex account pi's ChatGPT login is made from. */
+        readonly pi: Schema.optional<Schema.Struct<{
+            readonly connectedAccountId: Schema.String;
+            /** The account's name under its provider, as it is now. */
+            readonly name: Schema.String;
+        }>>;
+        /** The Codex account opencode's ChatGPT login is made from. */
+        readonly opencode: Schema.optional<Schema.Struct<{
+            readonly connectedAccountId: Schema.String;
+            /** The account's name under its provider, as it is now. */
+            readonly name: Schema.String;
+        }>>;
     }>;
 }>;
 export type WorkspaceCredentialHome = typeof workspaceCredentialHomeSchema.Type;
+/** A provider a partial put left out, and why (its account's refusal). */
+export declare const workspaceCredentialSkipSchema: Schema.Struct<{
+    readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+    /**
+     * The account's refusal, or `login-file-unusable`: pi's or opencode's `auth.json` in the home
+     * cannot be written there (not a regular file, or really outside the home).
+     */
+    readonly code: Schema.Literals<readonly ["connected-account-missing", "connected-account-invalid", "connected-account-unsupported", "login-file-unusable"]>;
+    /** The refusal's words, as a whole put would have answered them. */
+    readonly message: Schema.String;
+}>;
+export type WorkspaceCredentialSkip = typeof workspaceCredentialSkipSchema.Type;
 export declare const putWorkspaceCredentialsResponseSchema: Schema.Struct<{
     readonly workspaceId: Schema.String;
     /** The launch attempt whose executor was written. */
@@ -712,8 +861,31 @@ export declare const putWorkspaceCredentialsResponseSchema: Schema.Struct<{
                 /** The account's name under its provider, as it is now. */
                 readonly name: Schema.String;
             }>>;
+            /** The Codex account pi's ChatGPT login is made from. */
+            readonly pi: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
+            /** The Codex account opencode's ChatGPT login is made from. */
+            readonly opencode: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
         }>;
     }>;
+    /** A partial put's left-out providers, in the order named (empty when all were written). */
+    readonly skipped: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+        /**
+         * The account's refusal, or `login-file-unusable`: pi's or opencode's `auth.json` in the home
+         * cannot be written there (not a regular file, or really outside the home).
+         */
+        readonly code: Schema.Literals<readonly ["connected-account-missing", "connected-account-invalid", "connected-account-unsupported", "login-file-unusable"]>;
+        /** The refusal's words, as a whole put would have answered them. */
+        readonly message: Schema.String;
+    }>>>;
 }>;
 export type PutWorkspaceCredentialsResponse = typeof putWorkspaceCredentialsResponseSchema.Type;
 /** Release one home: its login files are removed and its record deleted. */
@@ -759,6 +931,18 @@ export declare const listWorkspaceCredentialsResponseSchema: Schema.Struct<{
                 /** The account's name under its provider, as it is now. */
                 readonly name: Schema.String;
             }>>;
+            /** The Codex account pi's ChatGPT login is made from. */
+            readonly pi: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
+            /** The Codex account opencode's ChatGPT login is made from. */
+            readonly opencode: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
         }>;
     }>>;
 }>;
@@ -766,13 +950,15 @@ export type ListWorkspaceCredentialsResponse = typeof listWorkspaceCredentialsRe
 /**
  * Stable `code`s of the `WorkspaceConflictError` the credential routes answer:
  * `workspace-not-running` (no ready executor), `connected-account-invalid` (a named account is
- * marked invalid: reconnect it), `home-held` (the home holds another person's logins: release it
+ * marked invalid or unusable: reconnect it; `provider` names its provider),
+ * `connected-account-unsupported` (a Codex account named for pi or opencode is not a ChatGPT
+ * login), `home-held` (the home holds another person's logins: release it
  * first; `/root` while the launch's own logins are at `$HOME`, or for anyone but the workspace's
  * owner), `home-unusable` (the home does not exist, is not a directory, is reached through a
  * symbolic link, or a login directory in it links outside it), `home-busy` (another write into the
  * home, or too many into this workspace, is still running: nothing was done, try again).
  */
-export declare const workspaceCredentialsConflictCodes: readonly ["workspace-not-running", "connected-account-invalid", "home-held", "home-unusable", "home-busy"];
+export declare const workspaceCredentialsConflictCodes: readonly ["workspace-not-running", "connected-account-invalid", "connected-account-unsupported", "home-held", "home-unusable", "home-busy"];
 export type WorkspaceCredentialsConflictCode = (typeof workspaceCredentialsConflictCodes)[number];
 export declare const expireWorkspaceRequestSchema: Schema.Struct<{
     readonly ownerUserId: Schema.String;
@@ -1419,6 +1605,10 @@ export declare class WorkspaceForbiddenError extends WorkspaceForbiddenError_bas
 }
 declare const WorkspaceNotFoundError_base: Schema.Class<WorkspaceNotFoundError, Schema.TaggedStruct<"WorkspaceNotFoundError", {
     readonly message: Schema.String;
+    /** A stable reason, where one applies (`connected-account-missing`). */
+    readonly code: Schema.optional<Schema.String>;
+    /** The provider of the connected account the reason is about. */
+    readonly provider: Schema.optional<Schema.Literals<readonly ["claude", "codex", "github"]>>;
 }>, import("effect/Cause").YieldableError>;
 export declare class WorkspaceNotFoundError extends WorkspaceNotFoundError_base {
 }
@@ -1426,6 +1616,8 @@ declare const WorkspaceConflictError_base: Schema.Class<WorkspaceConflictError,
     readonly message: Schema.String;
     /** A stable reason, where one applies (`create-cancelled`: the create's key was cancelled). */
     readonly code: Schema.optional<Schema.String>;
+    /** The provider of the connected account the reason is about (`connected-account-invalid`). */
+    readonly provider: Schema.optional<Schema.Literals<readonly ["claude", "codex", "github"]>>;
 }>, import("effect/Cause").YieldableError>;
 export declare class WorkspaceConflictError extends WorkspaceConflictError_base {
 }
@@ -1444,7 +1636,63 @@ declare const WorkspaceInternalServerError_base: Schema.Class<WorkspaceInternalS
 }>, import("effect/Cause").YieldableError>;
 export declare class WorkspaceInternalServerError extends WorkspaceInternalServerError_base {
 }
-export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", HttpApiEndpoint.HttpApiEndpoint<"bindWorkspace", "POST", "/:workspaceId/bind", HttpApiEndpoint.StringTree<Schema.Struct<{
+export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", HttpApiEndpoint.HttpApiEndpoint<"applyWorkspaceDotfiles", "POST", "/:workspaceId/dotfiles", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    /** The workspace's owner (owner scope; uniform 404 otherwise). */
+    readonly ownerUserId: Schema.String;
+    /** The Sealant user whose dotfiles these are: recorded on the run (`metadata.dotfiles`). */
+    readonly onBehalfOfUserId: Schema.String;
+    /** The Linux user to apply as (a login name or a uid); never root. */
+    readonly user: Schema.String;
+    /** The user's passwd home: absolute, normalised, never under `/workspace`. */
+    readonly home: Schema.String;
+    readonly repository: Schema.optional<Schema.Struct<{
+        /** An `https://` clone URL with no credential in it (no `user:token@`). */
+        readonly url: Schema.String;
+        /** Branch or tag; omitted clones the remote's default branch. */
+        readonly ref: Schema.optional<Schema.String>;
+        readonly manager: Schema.optional<Schema.Literals<readonly ["auto", "chezmoi", "stow", "copy"]>>;
+        /** Run the bootstrap command after applying (when the checkout has it). Default true. */
+        readonly bootstrap: Schema.optional<Schema.Boolean>;
+        /** Relative to the checkout; default `./install.sh`. */
+        readonly bootstrapCommand: Schema.optional<Schema.String>;
+    }>>;
+    readonly archives: Schema.optional<Schema.$Array<Schema.Struct<{
+        /** base64 of a `.tar.gz`; at most 6 MiB of base64 (about 4 MiB decoded). */
+        readonly data: Schema.String;
+        readonly manager: Schema.optional<Schema.Literals<readonly ["auto", "chezmoi", "stow", "copy"]>>;
+        /** Where the tree lands: `home` (default) or `config` (`~/.config`, copy manager only). */
+        readonly target: Schema.optional<Schema.Literals<readonly ["home", "config"]>>;
+        /** Run `./install.sh` (or `bootstrapCommand`) after applying when present. Default true. */
+        readonly bootstrap: Schema.optional<Schema.Boolean>;
+        readonly bootstrapCommand: Schema.optional<Schema.String>;
+    }>>>;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly runId: Schema.String;
+    readonly workspaceId: Schema.String;
+    readonly attemptId: Schema.optional<Schema.String>;
+    readonly ownerUserId: Schema.String;
+    readonly harnessId: Schema.String;
+    readonly mode: Schema.Literals<readonly ["one-shot", "interactive"]>;
+    readonly status: Schema.Literals<readonly ["queued", "running", "completed", "failed", "cancelled"]>;
+    readonly prompt: Schema.optional<Schema.String>;
+    readonly command: Schema.optional<Schema.Struct<{
+        readonly executable: Schema.String;
+        readonly args: Schema.$Array<Schema.String>;
+        readonly cwd: Schema.optional<Schema.String>;
+        readonly argCount: Schema.optional<Schema.Number>;
+        readonly argLengths: Schema.optional<Schema.$Array<Schema.Number>>;
+    }>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly exitCode: Schema.optional<Schema.Number>;
+    readonly errorMessage: Schema.optional<Schema.String>;
+    readonly startedAt: Schema.optional<Schema.String>;
+    readonly finishedAt: Schema.optional<Schema.String>;
+    readonly recordDeletedAt: Schema.optional<Schema.String>;
+    readonly createdAt: Schema.String;
+    readonly updatedAt: Schema.String;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceForbiddenError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceBadGatewayError | typeof WorkspaceServiceUnavailableError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"bindWorkspace", "POST", "/:workspaceId/bind", HttpApiEndpoint.StringTree<Schema.Struct<{
     readonly workspaceId: Schema.String;
 }>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly ownerUserId: Schema.String;
@@ -2154,6 +2402,18 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
                 /** The account's name under its provider, as it is now. */
                 readonly name: Schema.String;
             }>>;
+            /** The Codex account pi's ChatGPT login is made from. */
+            readonly pi: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
+            /** The Codex account opencode's ChatGPT login is made from. */
+            readonly opencode: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
         }>;
     }>>;
 }>>, HttpApiEndpoint.Json<typeof WorkspaceForbiddenError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"listWorkspaceEvents", "GET", "/:workspaceId/events", HttpApiEndpoint.StringTree<Schema.Struct<{
@@ -2262,6 +2522,25 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
     readonly claude: Schema.optional<Schema.NullOr<Schema.String>>;
     readonly codex: Schema.optional<Schema.NullOr<Schema.String>>;
     readonly github: Schema.optional<Schema.NullOr<Schema.String>>;
+    /**
+     * pi's ChatGPT login, made from a Codex account of `onBehalfOfUserId` (an id or a Codex account
+     * name), as the `openai-codex` entry of `<home>/.pi/agent/auth.json`. The file is merged: its
+     * other entries stay, and an `openai-codex` login the person made in pi is never replaced.
+     */
+    readonly pi: Schema.optional<Schema.NullOr<Schema.String>>;
+    /**
+     * opencode's ChatGPT login, made the same way, as the `openai` entry of opencode's `auth.json`
+     * (`<home>/.local/share/opencode/auth.json`, followed through links to where it really is, which
+     * must be inside the home). A login the person made in opencode is never replaced or removed.
+     */
+    readonly opencode: Schema.optional<Schema.NullOr<Schema.String>>;
+    /**
+     * Write what the person has connected and leave out the rest: a provider whose account is refused
+     * (`connected-account-missing`, `-invalid` or `-unsupported`) is not written, its login is removed
+     * from the home as `null` would remove it, and the answer's `skipped` says which and why, instead
+     * of the whole put failing. Every other refusal still fails the put. Default false.
+     */
+    readonly partial: Schema.optional<Schema.Boolean>;
 }>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly workspaceId: Schema.String;
     /** The launch attempt whose executor was written. */
@@ -2288,8 +2567,31 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
                 /** The account's name under its provider, as it is now. */
                 readonly name: Schema.String;
             }>>;
+            /** The Codex account pi's ChatGPT login is made from. */
+            readonly pi: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
+            /** The Codex account opencode's ChatGPT login is made from. */
+            readonly opencode: Schema.optional<Schema.Struct<{
+                readonly connectedAccountId: Schema.String;
+                /** The account's name under its provider, as it is now. */
+                readonly name: Schema.String;
+            }>>;
         }>;
     }>;
+    /** A partial put's left-out providers, in the order named (empty when all were written). */
+    readonly skipped: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly provider: Schema.Literals<readonly ["claude", "codex", "github", "pi", "opencode"]>;
+        /**
+         * The account's refusal, or `login-file-unusable`: pi's or opencode's `auth.json` in the home
+         * cannot be written there (not a regular file, or really outside the home).
+         */
+        readonly code: Schema.Literals<readonly ["connected-account-missing", "connected-account-invalid", "connected-account-unsupported", "login-file-unusable"]>;
+        /** The refusal's words, as a whole put would have answered them. */
+        readonly message: Schema.String;
+    }>>>;
 }>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceForbiddenError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceBadGatewayError | typeof WorkspaceServiceUnavailableError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"recoverWorkspace", "POST", "/:workspaceId/recover", HttpApiEndpoint.StringTree<Schema.Struct<{
     readonly workspaceId: Schema.String;
 }>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{

package/dist/core-api/workspaces.js

@@ -1,6 +1,7 @@
 import { Schema } from "effect";
 import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/unstable/httpapi";
 import { BudgetExceededError } from "./budgets.js";
+import { connectedAccountProviderSchema } from "./connected-accounts.js";
 import { runCommandSchema, runSchema } from "./runs.js";
 import { workspaceProcessUserSchema } from "./sessions.js";
 const NonEmptyString = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed());
@@ -169,6 +170,82 @@ export const execWorkspaceRequestSchema = Schema.Struct({
     /** Run every command as this Linux user (see `workspaceProcessUserSchema`). */
     user: Schema.optional(workspaceProcessUserSchema),
 });
+/** The `harnessId` stamped on runs that apply a person's dotfiles (`applyWorkspaceDotfiles`). */
+export const dotfilesRunHarnessId = "dotfiles";
+/** How a dotfiles tree is applied: chezmoi and stow layouts are detected by `auto`. */
+export const workspaceDotfilesManagerSchema = Schema.Literals(["auto", "chezmoi", "stow", "copy"]);
+/**
+ * A dotfiles repository cloned as the person (no credential reaches the workspace: a repository
+ * only the person's own identity can reach is resolved by the caller and sent as an archive).
+ */
+export const applyWorkspaceDotfilesRepositorySchema = Schema.Struct({
+    /** An `https://` clone URL with no credential in it (no `user:token@`). */
+    url: NonEmptyString.check(Schema.isPattern(/^https:\/\/[^\s'"\\]+$/)),
+    /** Branch or tag; omitted clones the remote's default branch. */
+    ref: Schema.optional(NonEmptyString),
+    manager: Schema.optional(workspaceDotfilesManagerSchema),
+    /** Run the bootstrap command after applying (when the checkout has it). Default true. */
+    bootstrap: Schema.optional(Schema.Boolean),
+    /** Relative to the checkout; default `./install.sh`. */
+    bootstrapCommand: Schema.optional(NonEmptyString),
+});
+/** A caller-resolved dotfiles tree, as at create (`spec.runtime.dotfilesArchives`). */
+export const applyWorkspaceDotfilesArchiveSchema = Schema.Struct({
+    /** base64 of a `.tar.gz`; at most 6 MiB of base64 (about 4 MiB decoded). */
+    data: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(6 * 1024 * 1024), Schema.isPattern(/^[A-Za-z0-9+/]+={0,2}$/)),
+    manager: Schema.optional(workspaceDotfilesManagerSchema),
+    /** Where the tree lands: `home` (default) or `config` (`~/.config`, copy manager only). */
+    target: Schema.optional(Schema.Literals(["home", "config"])),
+    /** Run `./install.sh` (or `bootstrapCommand`) after applying when present. Default true. */
+    bootstrap: Schema.optional(Schema.Boolean),
+    bootstrapCommand: Schema.optional(NonEmptyString),
+});
+/**
+ * Apply a person's dotfiles into their home of a RUNNING workspace, as their Linux user
+ * (docs/connected-accounts-design.md §6g; Mend's ADR 0016 decision 11): the same sources as a
+ * create's dotfiles (a repository, archives, or both; the repository first, archives after in
+ * order) and the same applier (sealantd's: chezmoi, stow or copy, then each tree's bootstrap).
+ *
+ * `user` must exist and must not be root or in root's group, and `home` must be its passwd home: an
+ * existing directory of the user's, reached without a symbolic link. The clone, chezmoi, stow and the
+ * bootstrap run as the user; sealantd's archive staging and `copy` manager still run as root inside
+ * the home and follow links the person planted there, until sealantd's fix for it lands (see
+ * docs/connected-accounts-design.md §6g). `onBehalfOfUserId` names whose dotfiles they are: it is
+ * recorded on the run, and a home whose logins another person holds is refused (`home-held`). Answered `202` with a run (`harnessId`
+ * `dotfiles`) once the archives are staged: the run's first `processStarted` is the bootstrap,
+ * started once every file is applied; its output and exit are the run's. The run completes with the
+ * bootstrap's exit code (0 when no tree had one) and fails, with the daemon's words, when the apply
+ * was refused or the bootstrap ran past 30 minutes (it is stopped).
+ */
+export const applyWorkspaceDotfilesRequestSchema = Schema.Struct({
+    /** The workspace's owner (owner scope; uniform 404 otherwise). */
+    ownerUserId: NonEmptyString,
+    /** The Sealant user whose dotfiles these are: recorded on the run (`metadata.dotfiles`). */
+    onBehalfOfUserId: NonEmptyString,
+    /** The Linux user to apply as (a login name or a uid); never root. */
+    user: workspaceProcessUserSchema,
+    /** The user's passwd home: absolute, normalised, never under `/workspace`. */
+    home: NonEmptyString,
+    repository: Schema.optional(applyWorkspaceDotfilesRepositorySchema),
+    archives: Schema.optional(Schema.Array(applyWorkspaceDotfilesArchiveSchema).check(Schema.isMaxLength(4))),
+});
+/**
+ * Stable `code`s of the `WorkspaceConflictError` a dotfiles apply answers, nothing applied:
+ * `workspace-not-running` (no ready executor), `dotfiles-user-unsupported` (the workspace's
+ * sealantd cannot apply dotfiles as a user), `user-unknown` (no such user: make it first),
+ * `user-root` (the user is root or in root's group), `home-mismatch` (the home is not the user's
+ * passwd home), `home-unusable` (the home is missing, not a directory, not the user's, or reached
+ * through a symbolic link), `home-held` (another person's logins are held in the home).
+ */
+export const workspaceDotfilesConflictCodes = [
+    "workspace-not-running",
+    "dotfiles-user-unsupported",
+    "user-unknown",
+    "user-root",
+    "home-mismatch",
+    "home-unusable",
+    "home-held",
+];
 /**
  * Bind a standby workspace's working directory, or a bindable extra mount, to one subdirectory of
  * its root (sealantd ADR-0014). `mountPath` defaults to the working directory; an empty `subpath`
@@ -517,8 +594,34 @@ export const inspectWorkspaceImageResponseSchema = Schema.Struct({
     /** The image's per-person capability (`unknown` when none has been built yet). */
     personLayout: workspaceImagePersonLayoutSchema,
 });
-/** The providers a home holds logins for (docs/connected-accounts-design.md §6c). */
-export const workspaceCredentialHomeProviders = ["claude", "codex", "github"];
+/**
+ * Stable codes of a refused connected account, carried with the account's `provider` by the error
+ * that refuses it (a create's or a credentials put's): `connected-account-missing`
+ * (`WorkspaceNotFoundError`, 404: the person has no such account, or it is archived or someone
+ * else's) and `connected-account-invalid` (`WorkspaceConflictError`, 409: the account is marked
+ * invalid, or holds an unusable credential; reconnect it) and `connected-account-unsupported`
+ * (`WorkspaceConflictError`, 409: the account cannot serve what was asked, as a Codex API key cannot
+ * be pi's or opencode's ChatGPT login). Nothing was written either way.
+ */
+export const connectedAccountRefusalCodes = [
+    "connected-account-missing",
+    "connected-account-invalid",
+    "connected-account-unsupported",
+];
+/**
+ * The providers a home holds logins for (docs/connected-accounts-design.md §6c). `pi` and
+ * `opencode` are the person's ChatGPT login (a Codex connected account), written into each tool's
+ * own `auth.json`.
+ */
+export const workspaceCredentialHomeProviders = [
+    "claude",
+    "codex",
+    "github",
+    "pi",
+    "opencode",
+];
+/** The connected account's provider each home provider's login is made from. */
+export const workspaceCredentialHomeAccountProvider = { claude: "claude", codex: "codex", github: "github", pi: "codex", opencode: "codex" };
 /**
  * Put one person's logins into one home of a RUNNING workspace (docs/connected-accounts-design.md
  * §6c). A home holds one person's logins while it is held: the first put names its person, a put
@@ -550,6 +653,25 @@ export const putWorkspaceCredentialsRequestSchema = Schema.Struct({
     claude: Schema.optional(Schema.NullOr(NonEmptyString)),
     codex: Schema.optional(Schema.NullOr(NonEmptyString)),
     github: Schema.optional(Schema.NullOr(NonEmptyString)),
+    /**
+     * pi's ChatGPT login, made from a Codex account of `onBehalfOfUserId` (an id or a Codex account
+     * name), as the `openai-codex` entry of `<home>/.pi/agent/auth.json`. The file is merged: its
+     * other entries stay, and an `openai-codex` login the person made in pi is never replaced.
+     */
+    pi: Schema.optional(Schema.NullOr(NonEmptyString)),
+    /**
+     * opencode's ChatGPT login, made the same way, as the `openai` entry of opencode's `auth.json`
+     * (`<home>/.local/share/opencode/auth.json`, followed through links to where it really is, which
+     * must be inside the home). A login the person made in opencode is never replaced or removed.
+     */
+    opencode: Schema.optional(Schema.NullOr(NonEmptyString)),
+    /**
+     * Write what the person has connected and leave out the rest: a provider whose account is refused
+     * (`connected-account-missing`, `-invalid` or `-unsupported`) is not written, its login is removed
+     * from the home as `null` would remove it, and the answer's `skipped` says which and why, instead
+     * of the whole put failing. Every other refusal still fails the put. Default false.
+     */
+    partial: Schema.optional(Schema.Boolean),
 });
 /** One account whose copy a home holds. */
 export const workspaceHomeAccountSchema = Schema.Struct({
@@ -567,14 +689,31 @@ export const workspaceCredentialHomeSchema = Schema.Struct({
         claude: Schema.optional(workspaceHomeAccountSchema),
         codex: Schema.optional(workspaceHomeAccountSchema),
         github: Schema.optional(workspaceHomeAccountSchema),
+        /** The Codex account pi's ChatGPT login is made from. */
+        pi: Schema.optional(workspaceHomeAccountSchema),
+        /** The Codex account opencode's ChatGPT login is made from. */
+        opencode: Schema.optional(workspaceHomeAccountSchema),
     }),
 });
+/** A provider a partial put left out, and why (its account's refusal). */
+export const workspaceCredentialSkipSchema = Schema.Struct({
+    provider: Schema.Literals(workspaceCredentialHomeProviders),
+    /**
+     * The account's refusal, or `login-file-unusable`: pi's or opencode's `auth.json` in the home
+     * cannot be written there (not a regular file, or really outside the home).
+     */
+    code: Schema.Literals([...connectedAccountRefusalCodes, "login-file-unusable"]),
+    /** The refusal's words, as a whole put would have answered them. */
+    message: Schema.String,
+});
 export const putWorkspaceCredentialsResponseSchema = Schema.Struct({
     workspaceId: NonEmptyString,
     /** The launch attempt whose executor was written. */
     runId: NonEmptyString,
     /** The home as it is after the put. */
     home: workspaceCredentialHomeSchema,
+    /** A partial put's left-out providers, in the order named (empty when all were written). */
+    skipped: Schema.optional(Schema.Array(workspaceCredentialSkipSchema)),
 });
 /** Release one home: its login files are removed and its record deleted. */
 export const releaseWorkspaceCredentialsQuerySchema = Schema.Struct({
@@ -600,7 +739,9 @@ export const listWorkspaceCredentialsResponseSchema = Schema.Struct({
 /**
  * Stable `code`s of the `WorkspaceConflictError` the credential routes answer:
  * `workspace-not-running` (no ready executor), `connected-account-invalid` (a named account is
- * marked invalid: reconnect it), `home-held` (the home holds another person's logins: release it
+ * marked invalid or unusable: reconnect it; `provider` names its provider),
+ * `connected-account-unsupported` (a Codex account named for pi or opencode is not a ChatGPT
+ * login), `home-held` (the home holds another person's logins: release it
  * first; `/root` while the launch's own logins are at `$HOME`, or for anyone but the workspace's
  * owner), `home-unusable` (the home does not exist, is not a directory, is reached through a
  * symbolic link, or a login directory in it links outside it), `home-busy` (another write into the
@@ -609,6 +750,7 @@ export const listWorkspaceCredentialsResponseSchema = Schema.Struct({
 export const workspaceCredentialsConflictCodes = [
     "workspace-not-running",
     "connected-account-invalid",
+    "connected-account-unsupported",
     "home-held",
     "home-unusable",
     "home-busy",
@@ -907,12 +1049,18 @@ export class WorkspaceForbiddenError extends Schema.TaggedErrorClass()("Workspac
 }
 export class WorkspaceNotFoundError extends Schema.TaggedErrorClass()("WorkspaceNotFoundError", {
     message: Schema.String,
+    /** A stable reason, where one applies (`connected-account-missing`). */
+    code: Schema.optional(NonEmptyString),
+    /** The provider of the connected account the reason is about. */
+    provider: Schema.optional(connectedAccountProviderSchema),
 }, { httpApiStatus: 404 }) {
 }
 export class WorkspaceConflictError extends Schema.TaggedErrorClass()("WorkspaceConflictError", {
     message: Schema.String,
     /** A stable reason, where one applies (`create-cancelled`: the create's key was cancelled). */
     code: Schema.optional(NonEmptyString),
+    /** The provider of the connected account the reason is about (`connected-account-invalid`). */
+    provider: Schema.optional(connectedAccountProviderSchema),
 }, { httpApiStatus: 409 }) {
 }
 export class WorkspaceBadGatewayError extends Schema.TaggedErrorClass()("WorkspaceBadGatewayError", {
@@ -1041,6 +1189,27 @@ HttpApiEndpoint.post("execWorkspace", "/:workspaceId/exec", {
     ],
 }))
     .add(
+// Async like exec: 202 + the queued run once the archives are staged; poll `GET /v1/runs/:runId`.
+HttpApiEndpoint.post("applyWorkspaceDotfiles", "/:workspaceId/dotfiles", {
+    params: workspaceIdParams,
+    payload: applyWorkspaceDotfilesRequestSchema,
+    success: runSchema.pipe(HttpApiSchema.status(202)),
+    error: [
+        // Root, a malformed home, a URL with a credential, or nothing to apply.
+        WorkspaceBadRequestError,
+        // Only a service key may apply a person's dotfiles.
+        WorkspaceForbiddenError,
+        WorkspaceNotFoundError,
+        // See `workspaceDotfilesConflictCodes`.
+        WorkspaceConflictError,
+        // The executor did not confirm the staging.
+        WorkspaceBadGatewayError,
+        // Core cannot reach the executor.
+        WorkspaceServiceUnavailableError,
+        WorkspaceInternalServerError,
+    ],
+}))
+    .add(
 // Async: 202 = the stop was accepted and enqueued; the worker removes the container and the
 // workspace transitions to "stopped". Idempotent — stopping a stopped workspace is a no-op 202.
 HttpApiEndpoint.post("stopWorkspace", "/:workspaceId/stop", {
@@ -1106,7 +1275,7 @@ HttpApiEndpoint.post("putWorkspaceCredentials", "/:workspaceId/credentials", {
         WorkspaceBadRequestError,
         // The caller may not act for the people named (only a service key may).
         WorkspaceForbiddenError,
-        // The workspace or a named account (unknown, someone else's, archived).
+        // The workspace, or a named account (`connected-account-missing` with its `provider`).
         WorkspaceNotFoundError,
         // See `workspaceCredentialsConflictCodes`.
         WorkspaceConflictError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/api-contracts-next",
-  "version": "0.39.0-next.696",
+  "version": "0.39.0-next.700",
   "description": "Contract-first HTTP API definitions for Sealant services",
   "license": "Apache-2.0",
   "repository": {
@@ -32,7 +32,7 @@
   "peerDependencies": {
     "effect": ">=4.0.0-beta.85 <5"
   },
-  "gitHead": "55326dd1cfb131e4324cecc5cd896f5bee35980c",
+  "gitHead": "78e1763231f005b670f7291cfb86917cec639598",
   "publishConfig": {
     "access": "public"
   }