@shardflux/cli 0.14.5 → 0.15.1

package/dist/account-commands.js

@@ -1,3 +1,5 @@
+import { prepareOnboardingSample } from "./onboarding-sample.js";
+import { onboardingReport, onboardingText } from "./onboarding.js";
 /**
  * The account plane (0.5.0; docs/progress/account-cli.md §5): everything a person does in the web app, from a
  * terminal. Sign-in and the account calls go through the SDK's ShardfluxAccount with the user session (ctx.account());
@@ -13,16 +15,27 @@
  *   setup), else the only one there is; with several the usage error lists them.
  */
 import { chmod, writeFile } from 'node:fs/promises';
+import { readAgentCredentials, syncAgentCredentials } from "./agent-credentials.js";
 import { API_KEY_TOOL_PERMISSIONS, CheckoutTimeoutError, Shardflux, ShardfluxAccount, ShardfluxApiError, codexIdentityProof, fetchBillingCatalog, parseEmailToken } from '@shardflux/sdk';
 import { CLI_VERSION, UUID, parseDuration, parsePositiveInt } from "./args.js";
 import { openUrl } from "./browser.js";
+import { defaultClientName, startDeviceAuthorization, waitForDeviceSession } from "./browser-login.js";
+import { legalFields, requireTermsAcceptance, showLegalNotice } from "./legal.js";
 import { fileExists, oneOf, out, parseSlugVersion, principal, readInput, resolveWorkspace, str, strs, waitTimeout } from "./commands.js";
-import { AuthConfigError, CheckoutEndedError, InterruptedError, MfaPendingError, NotFoundError, UsageError } from "./errors.js";
+import { AuthConfigError, CheckoutEndedError, InterruptedError, MfaPendingError, NotFoundError, UsageError, describeError } from "./errors.js";
 import { apiKeyTable, attachmentTable, auditTable, authSessionTable, billingStatusText, dataExportText, egressVersionTable, invitationTable, invoiceTable, isGrantPlan, kv, memberTable, money, orgTable, overagePolicyText, planTable, projectEgressText, projectTable, table, time, toolsText, volumeDetail, volumeTable, workspaceEgressText, WORKSPACE_HEADERS, workspaceRow, } from "./format.js";
 export const DEFAULT_API_URL = 'https://api.shardflux.dev';
 const TOTP = /^\d{6}$/;
 const ROLES = ['owner', 'admin', 'member', 'billing'];
-const TOOL_NAMES = API_KEY_TOOL_PERMISSIONS;
+/**
+ * Every tool permission a key can carry, `computer` included (0.15.1+): the SDK's list before 0.21.1 left it out, so a
+ * key made by `shard setup` could not watch or use its workspace's desktop (computer stream 403).
+ */
+const TOOL_NAMES = [...new Set([...API_KEY_TOOL_PERMISSIONS, 'computer'])];
+/** What `shard setup` gave a key before 0.15.1: every tool but `computer`. Such a saved key is replaced with a full one. */
+export function outdatedDefaultKey(permissions) {
+    return !permissions.includes('computer') && TOOL_NAMES.every((t) => t === 'computer' || permissions.includes(t));
+}
 const DEFAULT_CHECKOUT_WAIT_MS = 15 * 60_000;
 const CHECKOUT_POLL_MS = 2_000;
 const NEXT_WORKSPACE = 'shard ws open demo --template python-node-browser';
@@ -283,7 +296,7 @@ async function signedInReport(ctx, account, user, session, extra = {}) {
             ['organizations', memberships === null ? '-' : memberships.length === 0 ? 'none yet' : memberships.map((m) => `${m.organization_name} (${m.organization_slug}, ${m.role})`).join(', ')],
         ]) +
         `next: ${next}\n`;
-    out(ctx, human, { status: 'authenticated', user, session: { expires_at: session.expires_at, credentials_file: ctx.store.file }, organizations: memberships, next, ...extra });
+    out(ctx, human, { status: 'authenticated', user, session: { expires_at: session.expires_at, credentials_file: ctx.store.file }, organizations: memberships, next, ...legalFields(), ...extra });
     return 0;
 }
 /** Best effort: ends a replaced session server side so it does not linger for 30 days. */
@@ -302,7 +315,7 @@ async function checkKey(ctx, token) {
         const cloud = new Shardflux({ ...ctx.accountOptions(), apiKey: token });
         const me = await cloud.me();
         if (me.type === 'api_key' && me.api_key)
-            return { ok: true, organizationId: me.api_key.organization_id, projectId: me.api_key.project_id };
+            return { ok: true, organizationId: me.api_key.organization_id, projectId: me.api_key.project_id, toolPermissions: me.api_key.tool_permissions ?? [] };
         return { ok: false, reason: 'not a project API key' };
     }
     catch (err) {
@@ -617,7 +630,12 @@ async function runSetup(ctx, values, account) {
         else
             throw new UsageError(`${org.name} has ${projects.length} projects; pick one with --project <id|slug>:\n${choices(projects)}\n`, 'or save a default first: shard projects use <id|slug>');
     }
-    const keep = keyCheck?.ok === true && profile.api_key?.project_id === project.id;
+    // A key from an earlier `shard setup` (every tool but computer) is replaced unless --tool asks for a set: the desktop
+    // stream and screenshots need `computer`. The old key stays valid until revoked.
+    const outdated = keyCheck?.ok === true && strs(values.tool).length === 0 && values['read-only'] !== true && outdatedDefaultKey(keyCheck.toolPermissions);
+    if (outdated && !ctx.json)
+        ctx.io.stderr.write(`note: the saved API key ${profile.api_key.key_id} cannot use computer use; creating one with every tool.\n`);
+    const keep = keyCheck?.ok === true && profile.api_key?.project_id === project.id && !outdated;
     let key;
     let permissions = tools;
     if (keep)
@@ -644,6 +662,16 @@ async function runSetup(ctx, values, account) {
             permissions = k.tool_permissions;
     }
     const tag = (made) => (made ? 'created' : 'existing');
+    let codex;
+    const credentialHome = ctx.io.env.HOME ?? ctx.io.env.USERPROFILE;
+    if (values.codex !== false && permissions.includes('exec') && credentialHome && (await readAgentCredentials({ home: credentialHome, redact: value => ctx.addSecret(value) })).some(v => v.app === 'codex')) {
+        const cloud = new Shardflux({ apiKey: key.token, baseUrl: ctx.apiUrl });
+        await syncAgentCredentials(cloud, { home: credentialHome, redact: value => ctx.addSecret(value) });
+        await cloud.codex.enable({ signal: ctx.signal });
+        if (!ctx.json)
+            ctx.io.stderr.write('Starting your Codex remote device…\n');
+        codex = { ...await cloud.codex.waitConnector({ timeoutMs: ctx.wakeTimeoutMs, signal: ctx.signal }) };
+    }
     const envNote = ctx.io.env.SHARDFLUX_API_KEY?.trim() ? 'note: SHARDFLUX_API_KEY is set in this environment and wins over the saved key; unset it to use the saved key.\n' : '';
     return {
         text: (keep ? 'Already set up; the saved API key works.\n' : 'Set up.\n') +
@@ -653,28 +681,112 @@ async function runSetup(ctx, values, account) {
                 ['api key', `"${key.name}" ${key.key_id} (tools: ${toolsText(permissions)}) ${keep ? 'saved earlier' : 'created'}, saved in ${ctx.store.file}`],
             ]) +
             envNote +
+            (codex ? 'Codex Cloud is ready. One account executor; no pairing. Its residency is billed as workspace usage.\n' : '') +
             `next: ${NEXT_WORKSPACE}\n`,
         data: {
             organization: org,
             project,
             api_key: { id: key.id, key_id: key.key_id, name: key.name, project_id: key.project_id, tool_permissions: permissions },
             created,
+            ...(codex ? { codex } : {}),
             credentials_file: ctx.store.file,
             next: NEXT_WORKSPACE,
         },
     };
 }
+// ---- browser sign-in (0.15.0+) -----------------------------------------------------------------------------------
+/** One NDJSON line of `auth login --browser --json` (the Mac app reads them). */
+function event(ctx, value) {
+    ctx.io.stdout.write(`${JSON.stringify(value)}\n`);
+}
+/**
+ * The browser sign-in (browser-login.ts): starts the request, opens or prints the page and the code, waits for the
+ * approval and saves the session exactly like `auth login` does. With --json the start is the `open` event; a failure
+ * becomes the `error` event (and is thrown on, for the exit code and stderr).
+ */
+async function browserSignIn(ctx, values, noticeShown = false) {
+    try {
+        const opts = ctx.accountOptions();
+        const clientName = str(values['client-name'])?.trim() || defaultClientName(ctx.hostname());
+        const d = await startDeviceAuthorization(opts, clientName, ctx.signal);
+        // The terms notice comes before the browser opens: a line here, the URLs in the event for an app to show. No
+        // --accept-terms: an account created in the browser agrees to the terms on the sign-up page, which records it.
+        if (ctx.json) {
+            event(ctx, { event: 'open', verification_uri_complete: d.verification_uri_complete, user_code: d.user_code, expires_in: d.expires_in, ...legalFields() });
+        }
+        else if (!noticeShown)
+            showLegalNotice(ctx);
+        const opened = values.open !== false && openUrl(d.verification_uri_complete, ctx.io.env);
+        const minutes = Math.max(1, Math.round(d.expires_in / 60));
+        if (!ctx.json) {
+            ctx.io.stderr.write(`${opened ? 'Opening your browser to sign in' : 'Open this page to sign in'}: ${d.verification_uri_complete}\n` +
+                `Your code: ${d.user_code} (approve only if the page shows the same code)\n` +
+                `Waiting for the approval in the browser (the code expires in ${minutes} minutes; Ctrl-C stops)...\n`);
+        }
+        const sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+        const s = await waitForDeviceSession(opts, d, { signal: ctx.signal, sleep });
+        ctx.addSecret(s.session_token);
+        const replaced = ctx.store.profile(ctx.apiUrl).session?.token ?? null;
+        const saved = { token: s.session_token, expires_at: s.session_expires_at || null, user: { id: s.user.id, email: s.user.email }, state: 'active' };
+        const { switched } = ctx.saveSession(saved, s.user.email);
+        if (replaced && replaced !== saved.token)
+            await endQuietly(ctx, replaced);
+        if (switched && !ctx.json)
+            ctx.io.stderr.write(SWITCHED_NOTE);
+        const account = new ShardfluxAccount({ ...ctx.accountOptions(), sessionToken: s.session_token });
+        return { account, user: s.user, saved };
+    }
+    catch (err) {
+        if (ctx.json) {
+            const info = describeError(err);
+            const interrupted = ctx.signal.aborted;
+            event(ctx, { event: 'error', code: interrupted ? 'interrupted' : info.code, message: interrupted ? 'Interrupted.' : info.message });
+        }
+        throw err;
+    }
+}
+/** `shard signup` on a terminal without a Codex login or --email (0.15.0+): the browser sign-in, then setup like signup. */
+async function browserSignup(ctx, values) {
+    // signup has shown the notice (and asked) already.
+    const { account, user } = await browserSignIn(ctx, values, true);
+    let text = `Signed in as ${userLine(user)} in the browser.\nsession: saved in ${ctx.store.file}\n`;
+    const data = { status: 'authenticated', user, method: 'browser', credentials_file: ctx.store.file };
+    if (values.setup !== false) {
+        const setup = await runSetup(ctx, values, account);
+        text += setup.text;
+        data.setup = setup.data;
+    }
+    else {
+        text += 'next: shard setup\n';
+        data.next = 'shard setup';
+    }
+    out(ctx, text, data);
+    return 0;
+}
+/** auth login: --browser, or on a terminal without --email/--codex. */
+function wantsBrowser(ctx, values) {
+    const email = str(values.email) !== undefined;
+    if (values.browser === true) {
+        if (email || values.codex === true)
+            throw new UsageError('use one of --browser, --email or --codex');
+        return true;
+    }
+    if (values.browser === false || email || values.codex === true)
+        return false;
+    return ctx.input.interactive && !ctx.json;
+}
 // ---- handlers --------------------------------------------------------------------------------------------------
 export const ACCOUNT_HANDLERS = {
     async 'auth register'(ctx, values) {
         const email = emailArg(need(values, 'email', '--email you@example.com'), '--email');
         const name = str(values.name)?.trim();
+        const terms = await requireTermsAcceptance(ctx, values);
         const password = await ctx.input.newPassword(`Choose a password for ${email}: `, 'The password', pipe(`shard auth register --email ${email}`));
-        const r = await ShardfluxAccount.register({ ...ctx.accountOptions(), email, password, ...(name ? { displayName: name } : {}) });
+        const r = await ShardfluxAccount.register({ ...ctx.accountOptions(), email, password, ...(name ? { displayName: name } : {}), ...terms });
         const next = [`shard auth verify-email '<link from the email>'`, `${pipe(`shard auth login --email ${email}`)}`];
         out(ctx, `Registration received for ${email}.\n` +
             `Check that inbox for a verification link (valid 24 hours). If the address already has an account, no new one is created: sign in instead.\n` +
-            `next:\n  1. open the link, or: ${next[0]}\n  2. ${next[1]}\n`, { status: r.status, email, next_steps: next });
+            `next:\n  1. open the link, or: ${next[0]}\n  2. ${next[1]}\n`, { status: r.status, email, next_steps: next, ...legalFields() });
         return 0;
     },
     async 'auth verify-email'(ctx, _values, [link]) {
@@ -711,10 +823,26 @@ export const ACCOUNT_HANDLERS = {
         return 0;
     },
     async 'auth login'(ctx, values) {
+        if (wantsBrowser(ctx, values)) {
+            if (factorFlags(values) !== null)
+                throw new UsageError('--code and --recovery-code go with --email; in the browser the sign-in page asks for your second factor');
+            const { account, user, saved } = await browserSignIn(ctx, values);
+            if (ctx.json) {
+                event(ctx, { event: 'signed_in', email: user.email });
+                return 0;
+            }
+            return signedInReport(ctx, account, user, saved);
+        }
+        if (values.open !== undefined || str(values['client-name']) !== undefined)
+            throw new UsageError('--no-open and --client-name go with --browser', 'shard auth login --browser --no-open');
         if (values.codex === true)
             return ACCOUNT_HANDLERS.signup(ctx, { ...values, setup: false, codex: true, email: undefined }, []);
-        const email = emailArg(need(values, 'email', '--email you@example.com'), '--email');
+        const given = str(values.email)?.trim();
+        if (!given)
+            throw new UsageError('--email is required to sign in with a password, e.g. --email you@example.com', 'or sign in with your browser: shard auth login --browser (or with your Codex login: shard auth login --codex)');
+        const email = emailArg(given, '--email');
         let factor = factorFlags(values);
+        showLegalNotice(ctx);
         const password = await ctx.input.secret(`Password for ${email}: `, 'The password', pipe(`shard auth login --email ${email}`));
         let latest = null;
         const { account, result } = await ShardfluxAccount.login({
@@ -971,8 +1099,18 @@ export const ACCOUNT_HANDLERS = {
         return 0;
     },
     async setup(ctx, values) {
+        if (values['prepare-sample'] === true) {
+            const path = await prepareOnboardingSample(ctx.store.dir);
+            out(ctx, `Daylight is ready at ${path}\n`, { sample_path: path });
+            return 0;
+        }
+        if (values.inspect === true || (ctx.json && ctx.sessionSource() === null)) {
+            const onboarding = await onboardingReport(ctx, values);
+            out(ctx, onboardingText(onboarding), { onboarding });
+            return 0;
+        }
         const r = await runSetup(ctx, values, ctx.account());
-        out(ctx, r.text, r.data);
+        out(ctx, r.text, ctx.json ? { ...r.data, onboarding: await onboardingReport(ctx, values) } : r.data);
         return 0;
     },
     async signup(ctx, values) {
@@ -980,6 +1118,10 @@ export const ACCOUNT_HANDLERS = {
         const name = str(values.name)?.trim();
         let codexNote = null;
         let idToken = null;
+        if (values.codex === false && email === undefined)
+            throw new UsageError('--no-codex needs an email address.', 'shard signup --no-codex --email you@example.com');
+        // Before the Codex login is read (its refresh is a network call) and before the API: the agreement to the terms.
+        const terms = await requireTermsAcceptance(ctx, values);
         if (values.codex !== false) {
             const proof = await codexIdentityProof({ env: ctx.io.env, clientName: 'shard', clientVersion: CLI_VERSION });
             if (proof.ok) {
@@ -990,17 +1132,19 @@ export const ACCOUNT_HANDLERS = {
                 }
             }
             else if (email === undefined) {
-                throw new UsageError(`No Codex login to sign up with: ${proof.message}`, 'shard signup --email you@example.com');
+                if (!ctx.input.interactive || ctx.json)
+                    throw new UsageError(`No Codex login to sign up with: ${proof.message}`, 'shard signup --email you@example.com, or in the browser: shard auth login --browser');
+                // On a terminal (0.15.0+): sign up or sign in on the web page instead, then set up as below.
+                ctx.io.stderr.write(`No Codex login on this computer (${proof.message}); continuing in the browser.\n`);
+                return browserSignup(ctx, values);
             }
         }
-        else if (email === undefined) {
-            throw new UsageError('--no-codex needs an email address.', 'shard signup --no-codex --email you@example.com');
-        }
         let latest = null;
         const { account, result } = await ShardfluxAccount.signup({
             ...ctx.accountOptions(),
             ...(idToken !== null ? { codexIdToken: idToken } : { email: email }),
             ...(name ? { displayName: name } : {}),
+            ...terms,
             onSessionToken: (s) => {
                 ctx.addSecret(s.token);
                 latest = s;
@@ -1040,7 +1184,7 @@ export const ACCOUNT_HANDLERS = {
                 ? 'email not verified yet: workspaces run on the Free plan now; verify to start the trial: shard verify'
                 : 'email not verified yet: verify it to run workspaces: shard verify';
         let text = `${result.created ? 'Signed up' : 'Signed in'} as ${userLine(user)} (${how}).\nsession: saved in ${ctx.store.file}\n`;
-        const data = { status: 'authenticated', created: result.created, access, user, method: idToken !== null ? 'codex' : 'email', credentials_file: ctx.store.file };
+        const data = { status: 'authenticated', created: result.created, access, user, method: idToken !== null ? 'codex' : 'email', credentials_file: ctx.store.file, ...legalFields() };
         if (access !== 'verification_required' && values.setup !== false) {
             const setup = await runSetup(ctx, values, account);
             text += setup.text;

package/dist/acp-catalog.js

@@ -2,8 +2,8 @@ import { objectValue } from "./acp-rpc.js";
 // T3's installation probe works offline, without a VM. These are harness
 // labels only. Real sessions always replace them with guest metadata.
 export const ACP_PROBE_CATALOG = {
-    claude: { models: { currentModelId: 'default', availableModels: [{ modelId: 'default', name: 'Claude Code' }] } },
-    codex: { models: { currentModelId: 'default', availableModels: [{ modelId: 'default', name: 'Codex' }] } },
+    claude: { models: { currentModelId: 'default', availableModels: [{ modelId: 'default', name: 'Default' }] } },
+    codex: { models: { currentModelId: 'default', availableModels: [{ modelId: 'default', name: 'Default' }] } },
 };
 export function nativeModelOptions(session) {
     const configs = Array.isArray(session.configOptions) ? session.configOptions.map(objectValue) : [];

package/dist/acp-login.d.ts

@@ -0,0 +1,20 @@
+import type { Ctx } from './commands.js';
+/**
+ * The ACP terminal sign-in method. An editor (T3 Code) runs `shard acp --login` in its own terminal when the user
+ * chooses it, then reconnects; ACP appends these args to the configured `shard acp` invocation.
+ */
+export declare const ACP_LOGIN_METHOD: {
+    readonly id: "shardflux-login";
+    readonly name: "Sign in to Shardflux";
+    readonly description: "Create or sign in to your Shardflux account and connect Claude Code and Codex.";
+    readonly type: "terminal";
+    readonly args: readonly ["--login"];
+};
+/** Whether an API key is configured (no request; a revoked key surfaces as auth_required on its first call). */
+export declare function acpSignedIn(ctx: Ctx): boolean;
+/**
+ * `shard acp --login`: everything a first conversation needs, each step skipped when it is already done: the
+ * account (signed up or in with this Mac's Codex login, else an email), its API key, the Codex login copy and the
+ * cloud Claude sign-in.
+ */
+export declare function runAcpLogin(ctx: Ctx): Promise<number>;

package/dist/acp-login.js

@@ -0,0 +1,122 @@
+import { existsSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { describeError } from "./errors.js";
+import { cloudClaudeLogin, loginClaudeInWorkspace } from "./claude-cloud-login.js";
+import { syncAgentCredentials } from "./agent-credentials.js";
+/**
+ * The ACP terminal sign-in method. An editor (T3 Code) runs `shard acp --login` in its own terminal when the user
+ * chooses it, then reconnects; ACP appends these args to the configured `shard acp` invocation.
+ */
+export const ACP_LOGIN_METHOD = {
+    id: 'shardflux-login',
+    name: 'Sign in to Shardflux',
+    description: 'Create or sign in to your Shardflux account and connect Claude Code and Codex.',
+    type: 'terminal',
+    args: ['--login'],
+};
+/** Whether an API key is configured (no request; a revoked key surfaces as auth_required on its first call). */
+export function acpSignedIn(ctx) {
+    try {
+        ctx.cloud();
+        return true;
+    }
+    catch (error) {
+        // Only a missing or malformed key means signed out; anything else surfaces on the call that needs the API.
+        return describeError(error).code !== 'unauthenticated';
+    }
+}
+/** The sign-in flow checks the key against the API, so a revoked one is replaced. */
+async function accountReady(ctx) {
+    if (!acpSignedIn(ctx))
+        return false;
+    try {
+        await ctx.cloud().agentCredentials.list();
+        return true;
+    }
+    catch (error) {
+        if (describeError(error).code === 'unauthenticated')
+            return false;
+        throw error;
+    }
+}
+const say = (ctx, text) => { ctx.io.stderr.write(text); };
+/**
+ * `shard acp --login`: everything a first conversation needs, each step skipped when it is already done: the
+ * account (signed up or in with this Mac's Codex login, else an email), its API key, the Codex login copy and the
+ * cloud Claude sign-in.
+ */
+export async function runAcpLogin(ctx) {
+    const { HANDLERS } = await import("./handlers.js");
+    const home = ctx.io.env.HOME ?? homedir();
+    const codex = existsSync(join(home, '.codex', 'auth.json'));
+    // The account commands' own reports (paths, next steps) are for the shard terminal, not an editor's sign-in panel.
+    const quiet = { ...ctx, io: { ...ctx.io, stdout: { write: () => true } } };
+    // An editor's conversations need no Codex Cloud executor; setup here makes the account, project and key only.
+    const setup = () => HANDLERS.setup(quiet, { codex: false }, []);
+    say(ctx, 'Shardflux sign-in\n\n');
+    if (!await accountReady(ctx)) {
+        const session = ctx.store.profile(ctx.apiUrl).session;
+        if (session?.state === 'active') {
+            say(ctx, 'Creating your API key…\n');
+            await setup();
+        }
+        else if (codex) {
+            say(ctx, 'Signing in with the Codex login on this Mac…\n');
+            await HANDLERS.signup(quiet, { setup: false }, []);
+            await setup();
+        }
+        else {
+            const email = (await ctx.input.answer('Email: '))?.trim();
+            if (!email) {
+                say(ctx, 'An email address is needed to create your account.\n');
+                return 1;
+            }
+            try {
+                await HANDLERS.signup(quiet, { email, codex: false, setup: false }, []);
+            }
+            catch (error) {
+                // An existing account signs in with its password instead.
+                if (describeError(error).code !== 'conflict')
+                    throw error;
+                await HANDLERS['auth login'](quiet, { email }, []);
+            }
+            await setup();
+        }
+        if (!await accountReady(ctx)) {
+            say(ctx, '\nThe account is not ready yet. Finish the step above, then choose Sign in again.\n');
+            return 1;
+        }
+        const user = ctx.store.profile(ctx.apiUrl).session?.user;
+        say(ctx, user?.email ? `Signed in as ${user.email}.\n` : 'Signed in.\n');
+    }
+    else
+        say(ctx, 'Already signed in.\n');
+    if (codex) {
+        await syncAgentCredentials(ctx.cloud(), { home, redact: (value) => ctx.addSecret(value) });
+        say(ctx, 'Codex: connected with the login on this Mac.\n');
+    }
+    if (await cloudClaudeLogin(ctx))
+        say(ctx, 'Claude Code: connected.\n');
+    else {
+        const answer = (await ctx.input.answer('\nConnect Claude Code now? It opens a Claude sign-in page. [Y/n] '))?.trim().toLowerCase() ?? 'n';
+        if (answer === '' || answer.startsWith('y')) {
+            // A session workspace exists only for this sign-in and is deleted with it.
+            const ws = await ctx.cloud().workspaces.open({ key: `shardflux-sign-in/${randomBytes(4).toString('hex')}`, template: 'coding', lifetime: 'session',
+                wait: { signal: ctx.signal, timeoutMs: ctx.wakeTimeoutMs } });
+            try {
+                await loginClaudeInWorkspace(ctx, ws);
+            }
+            finally {
+                await ws.close().catch(() => { });
+            }
+            say(ctx, 'Claude Code: connected.\n');
+        }
+        else if (!codex) {
+            say(ctx, 'Claude Code: not connected. Choose Sign in again to connect it.\n');
+        }
+    }
+    say(ctx, '\nShardflux is ready. Return to your editor and start a conversation.\n');
+    return 0;
+}

package/dist/acp.js

@@ -12,6 +12,7 @@ import { describeError, ownHint } from "./errors.js";
 import { serveAcpDeviceApprovals } from "./device-bridge.js";
 import { syncAgentCredentials } from "./agent-credentials.js";
 import { cloudClaudeLogin } from "./claude-cloud-login.js";
+import { ACP_LOGIN_METHOD, acpSignedIn } from "./acp-login.js";
 import { ensureMenubar, MenubarManager } from "./menubar.js";
 const PREFIX = 'shardflux:';
 export function acpModel(app, id) { return `${PREFIX}${app}:${id}`; }
@@ -23,21 +24,30 @@ export function parseAcpModel(value) {
         throw new RpcError(-32602, 'Choose a model from Shardflux.');
     return { app: match[1], id: match[2] };
 }
+/** An editor's first choice comes from the probe (`<app>:default`); every conversation keeps it valid as the app's own default model. */
+const DEFAULT_MODEL = 'default';
+const hasNativeDefault = (native) => nativeModelOptions(native).some(o => o.value === DEFAULT_MODEL);
 export function acpModelOptions(catalog) {
     return ['claude', 'codex'].flatMap(app => {
-        return nativeModelOptions(catalog[app] ?? {}).map((option) => {
+        const native = nativeModelOptions(catalog[app] ?? {});
+        if (!native.length)
+            return [];
+        const options = hasNativeDefault(catalog[app] ?? {}) ? native : [{ value: DEFAULT_MODEL, name: 'Default' }, ...native];
+        return options.map((option) => {
             return { ...option, value: acpModel(app, option.value), name: `${app === 'claude' ? 'Claude Code' : 'Codex'} · ${option.name}` };
         });
     });
 }
+const SIGN_IN = 'Sign in to Shardflux from your editor (or run shard acp --login).';
 export function acpError(error) {
     if (error instanceof RpcError) {
         if (error.code === -32000 && /authentication required|oauth.*(?:revoked|expired)|not (?:signed|logged) in/i.test(error.message))
-            return new RpcError(-32000, `${error.message} Run shard setup.`, { code: 'unauthenticated', fix: 'Run shard setup.' });
+            return new RpcError(-32000, `${error.message.replace(/[.!]?$/, '.')} ${SIGN_IN}`, { code: 'unauthenticated', fix: SIGN_IN });
         return error;
     }
     const info = describeError(error);
-    const fix = info.code === 'unauthenticated' ? 'Run shard setup.' : info.code === 'not_found' || info.details?.reason === 'workspace_deleted' ? 'Open a new conversation.' : ownHint(error) ?? (info.code === 'quota_exceeded' || info.code === 'allowance_exhausted' ? 'Run shard billing plans.' : 'Try the message again.');
+    // ACP `auth_required` (-32000) with an unauthenticated code makes the editor offer the advertised sign-in method.
+    const fix = info.code === 'unauthenticated' ? SIGN_IN : info.code === 'not_found' || info.details?.reason === 'workspace_deleted' ? 'Open a new conversation.' : ownHint(error) ?? (info.code === 'quota_exceeded' || info.code === 'allowance_exhausted' ? 'Run shard billing plans.' : 'Try the message again.');
     return new RpcError(-32000, `${info.message} ${fix}`, { code: info.code, fix, ...(info.details?.reason ? { reason: info.details.reason } : {}) });
 }
 /** Rewrite structural session/file references, never the agent's prose or command output. */
@@ -94,8 +104,9 @@ export class ShardfluxAcp {
             if (params.protocolVersion !== 1 && params.protocolVersion !== 2)
                 throw new RpcError(-32602, 'Unsupported protocol version');
             this.#initialized = true;
-            this.#probe = objectValue(params.clientInfo).name === 't3-code-provider-test';
-            return { protocolVersion: 1, agentInfo: { name: 'shardflux', title: 'Shardflux', version: CLI_VERSION }, authMethods: [],
+            // T3 Code's model probe and its post-sign-in check open a session to test the provider; neither gets a VM.
+            this.#probe = ['t3-code-provider-test', 't3-code-provider-auth'].includes(String(objectValue(params.clientInfo).name));
+            return { protocolVersion: 1, agentInfo: { name: 'shardflux', title: 'Shardflux', version: CLI_VERSION }, authMethods: [ACP_LOGIN_METHOD],
                 agentCapabilities: { loadSession: true, promptCapabilities: { image: true, embeddedContext: true }, sessionCapabilities: { list: {}, resume: {}, close: {} } } };
         }
         if (!this.#initialized)
@@ -105,6 +116,9 @@ export class ShardfluxAcp {
             return { sessions: sessions.map(r => ({ sessionId: r.id, cwd: r.folder, updatedAt: r.updatedAt })) };
         }
         if (method === 'session/new') {
+            // Signed out, the editor gets ACP auth_required and offers the sign-in method, even on its model probe.
+            if (!acpSignedIn(this.#ctx))
+                throw new RpcError(-32000, 'Authentication required', { code: 'unauthenticated', fix: SIGN_IN });
             if (this.#probe)
                 return this.#configuration(acpModel('claude', 'default'), { sessionId: 'shardflux-probe' }, ACP_PROBE_CATALOG);
             if (typeof params.cwd !== 'string' || !isAbsolute(params.cwd))
@@ -163,12 +177,17 @@ export class ShardfluxAcp {
             if (!acpModelOptions(record.catalog ?? {}).some(o => o.value === model))
                 throw new RpcError(-32602, 'This model is no longer available. Choose a model from this conversation.');
             let result;
-            try {
-                result = objectValue(await session.transport.rpc.request('session/set_config_option', { sessionId: record.nativeId, configId: 'model', value: selected.id }));
-            }
-            catch (e) {
-                await this.#rejectModel(session, selected.id, e);
-                throw e;
+            // Our own default keeps the app's current model; there is nothing to tell the native session.
+            if (selected.id === DEFAULT_MODEL && !hasNativeDefault(record.catalog?.[selected.app] ?? {}))
+                result = objectValue(record.setup);
+            else {
+                try {
+                    result = objectValue(await session.transport.rpc.request('session/set_config_option', { sessionId: record.nativeId, configId: 'model', value: selected.id }));
+                }
+                catch (e) {
+                    await this.#rejectModel(session, selected.id, e);
+                    throw e;
+                }
             }
             record.model = model;
             this.#save(record);
@@ -327,7 +346,7 @@ export class ShardfluxAcp {
         await session.transport?.close();
         await syncAgentCredentials(ctx.cloud(), { home: ctx.io.env.HOME, redact: value => ctx.addSecret(value) });
         if (app === 'claude' && !(await cloudClaudeLogin(ctx)))
-            throw new RpcError(-32000, 'Sign in to Claude Code with shard agents credentials login claude.', { code: 'unauthenticated', fix: 'Run shard agents credentials login claude.' });
+            throw new RpcError(-32000, 'Authentication required: connect Claude Code.', { code: 'unauthenticated', fix: SIGN_IN });
         if (!record.conversationId) {
             this.#prepare(session);
             await session.prepared;
@@ -366,8 +385,12 @@ export class ShardfluxAcp {
             throw new Error('ACP supervisor identity does not match this conversation.');
         const owner = `${session.ws.id}:${status.pid}:${status.start}`;
         const initialize = !record.nativeId || record.owner !== owner;
-        if (record.workspaceId !== session.ws.id)
+        // A cold restore can replace the journal owner without changing the VM id.
+        // Its sequence starts at zero; an old cursor would drop initialize/load replies.
+        if (record.workspaceId !== session.ws.id || record.owner !== owner) {
             record.from_seq = 0;
+            delete record.prompt_id;
+        }
         record.workspaceId = session.ws.id;
         const transport = new AcpJournal(cell, c.id, app, c.worktree_path, record, () => this.#save(record), ctx.signal);
         transport.rpc.handler = async (method, params, request) => {