@shardflux/cli 0.22.0 → 0.23.0

package/CHANGELOG.md

@@ -1,5 +1,103 @@
 # Changelog
 
+## 0.23.0 (2026-10-14)
+
+- Codex Cloud enable and setup report when a ChatGPT sign-in is required, with `codex login` and `shard setup` as the next steps. Setup offers the sign-in action.
+
+- On macOS, the installed CLI records a matching stable Node.js path for the menu bar, so Homebrew upgrades and
+  cleanup keep its actions available.
+- On Linux, the desktop records the installed Node.js and CLI paths for its actions and existing autostart entry,
+  keeping them available after the launching shell's fnm multishell links expire.
+- Opening a moved Claude or Codex conversation by its full key resolves the conversation from any folder, including
+  `--in auto` in the desktop menus and explicit app/web targets. A computer key opens its bound conversation's session.
+- Move to cloud moves the session's checkout, uncommitted edits included, in any repository: also one with other
+  local branches, other worktrees or a worktree whose folder is gone. Those stay on this computer, so `shard move`,
+  the menu bar's and the Linux app's **Move to cloud** and the MCP tool go straight ahead without a scope choice
+  (`--this-worktree-only` is now the default). When the session also worked in another worktree, the move names it
+  in one line and `--json` lists it as `other_worktrees`. `--preserve-all-worktrees` skips registrations whose folder
+  is gone (`stale_registrations` in `--plan`); their branches move with the other local refs.
+- Open Codex Cloud chats in the browser on every platform. `agents open --original` opens the original history; `--history <thread-id>` opens any earlier linked chat. JSON includes all previous history links.
+
+- Opening a conversation from a coding agent's shell (Codex, Claude Code, Cursor) opens exactly one terminal, and the
+  conversation attaches there. The terminal no longer inherits the agent shell's variables, and a terminal Shardflux
+  opened never opens another, so it no longer reopens terminals in a loop that steals focus. A Codex Cloud conversation
+  opens in Codex before any terminal is considered, also when given its computer's key.
+- Inherits completed forward-helper verification reuse from SDK 0.27.0 on a reused workspace client; each ownership epoch and helper version is verified again.
+- Historical template file-list GETs wait for checksum-verified cache reconstruction, honoring Retry-After within the SDK admission deadline. File history and contents remain stored; POSTs never replay for file_list_indexing.
+
+- Plan-derived API budgets (0.23.0+, SDK 0.27.0): `--json` error output includes `rate_limit` and `retry_after_seconds`; the text hint names the shared scope and delay. API request pacing follows the SDK admission timeout and preserves the request body. Reuse workspace credentials and reduce status polling when the returned budget asks for a delay.
+
+- T3 Code conversations on Shardflux follow your T3 Code proxy setup (CLIProxyAPI, or any Claude- or
+  OpenAI-compatible proxy). What your T3 Code Claude provider runs with (its environment variables, and Claude Code's
+  settings.json `env`: `ANTHROPIC_BASE_URL`, its token, models and headers) reaches the conversation's Claude Code, and
+  your Codex `model_provider` (its `base_url`, `wire_api` and the key `env_key` names) reaches its Codex. CLIProxyAPI
+  on this computer (`127.0.0.1:8317`, or the port it had before `shard cli-proxy import`) is reached through your
+  hosted CLIProxyAPI, as on this computer; a proxy at another address is used as written. A Claude Code conversation
+  that goes through your proxy with its own token starts without a Shardflux Claude sign-in. T3 Code's default
+  provider is the one followed while it is enabled.
+- `shard agents new --in t3` and `shard agents open t3` give the VM's own T3 Code (SSH and the T3 app) the same Claude
+  Code and Codex provider settings, with tokens in its secret store.
+- Sign in on the Shardflux provider in T3 Code (`shard acp --login`) offers to move the CLIProxyAPI your T3 Code setup
+  uses into your account, so cloud conversations use it too. Claude Code that goes through it is connected then.
+- Your hosted CLIProxyAPI routes requests across your logins exactly as its config says (round-robin, fill-first,
+  session affinity): `shard cli-proxy import` brings every login as it is on your computer, enabled or disabled, and
+  nothing changes them afterwards. `shard cli-proxy use <login>` serves a provider with that one login; `shard
+  cli-proxy use --all` uses every login again. `--use` on import is the same choice for a login you move.
+- `ws exec-cancel` displays pending/unverified kernel drain and the follow command; `exec-read` keeps the real foreground state and reason.
+- `shard template save` and `shard template` on your computer use the newest conversation this checkout started whose
+  VM is still there (a restored one too), else the project's workspace from before conversations. They no longer
+  refuse with "Run shard ./ for this project" after `shard ./`.
+- `shard agents logs <conversation>` of a Codex Cloud conversation says its output is in its Codex thread and names
+  the commands that show it: `shard agents open <id>` opens the thread, `shard c wait <id>` waits for its reply and
+  `shard c get <id>` shows it.
+- `shard agents new --in terminal --prompt <text>` (or `--prompt-file`, `--image`) starts a new conversation with that
+  first message, as without `--in`; a new Codex conversation says it opens in Codex Cloud. Before, it was refused
+  with a message that recommended the same command. A first message with `--name`, `--like`, an agent argument or
+  another `--in` target names the option it cannot be combined with.
+- `shard projects sync add <path> --wait` reports a project setup that stopped as `project_setup_failed` (it was
+  `internal_error`): the message names the step and what it needs, such as a lockfile to commit,
+  `details.step` and `details.error_code` identify it, and the hint gives the way forward.
+- `shard agents open` (and Open in the menus) of a Codex Cloud chat that switching the active Codex account or turning
+  Codex Cloud off and on stopped continues it in a new Codex chat of the same conversation, on its computer and branch,
+  instead of reporting that its executor was removed.
+- ACP journal followers retry temporary lifecycle interruptions with bounded backoff and their saved sequence, without resubmitting a turn; permanent loss stops promptly.
+- SSH inherits the SDK cold helper race repair.
+- Inherits SDK 0.27.0 safe replay of truncated JSON lifecycle and exec answers.
+- Uses SDK 0.27.0: workspace exec retries a lost start response with the same session ID.
+
+- A T3 Code (`shard acp`) conversation starts the way a terminal one does: from its prepared revision, sending only
+  what the project cache lacks (nothing for a returning project), so its session is ready ~2.5–3 s sooner. Large files
+  still on their way stay out of the first file reconcile and land by themselves.
+- A T3 Code (`shard acp`) conversation's first prompt reaches the agent ~1 s sooner: the agent's session starts while
+  the project files are reconciled, instead of after. `SHARDFLUX_TRACE_SEED=1` also marks each step of that
+  connection (`acp_*`). Each message to the agent up to 192 KiB (every one but a long prompt) now takes one request
+  to your VM instead of four.
+- `shard agents open t3` and `shard agents new --in t3` with T3 Code 0.0.45 bring T3 up only once the workspace's T3
+  Connect link is linked: T3 lists the project only then. A link in progress is waited for (at most 30 s, within
+  `--wake-timeout`). A refused link is the `t3_link_failed` error with the API's remedy (for T3 Connect's environment
+  limit, Settings → Connections, with `details.recovery`); a link still in progress is `t3_link_pending`. Both carry
+  `workspace_key`, `conversation_id` and any started `t3_thread_id`, so the menu bar and the Linux app offer Open for
+  what exists rather than a new start. Before, `--json` answered `opened: true` with `t3_link.status: linking`.
+- `shard agents open t3 <conversation>` for a Codex Cloud conversation opens its existing Codex chat, as
+  `shard agents open` does, instead of setting its VM up in T3 Code, which cannot show that chat. It neither wakes the
+  VM nor needs T3 Code.
+- The Codex app on Linux: OpenAI's ChatGPT app for Linux (`chatgpt.desktop`) or a community build, found as the desktop
+  entry that handles codex://. `shard agents open <conversation>` and `shard agents open codex-app <conversation>` open
+  a Codex Cloud conversation's existing thread in it, through that entry, and `agents open codex-app` of a Cloud
+  conversation opens its thread on macOS too (it set up an SSH environment before). Its SSH environments stay a macOS
+  target.
+- On a computer without the Codex app, opening or starting a Codex Cloud conversation says where its chat is,
+  whether it is waiting for your answer, and how to answer and follow it from here (`shard conversations send <id>
+  "<answer>"`, `shard conversations get <id>`), instead of failing to open its codex:// link. `--json` adds
+  `codex_app` and `reply_command`.
+- The command center (`shard` with no arguments) lists a Codex Cloud chat as **needs you** or **working** from Codex
+  even while its computer is parked, and Enter opens it in Codex without waking that computer. Includes the Linux
+  desktop 0.1.10 payloads: Codex Cloud chats in the top-bar panel.
+- `shard menubar start`, `stop` and `status` act on the Shardflux app for this config directory wherever it runs from
+  (menu bar 0.8.4+, one app per config directory), and an update stops that app before the new one starts, so no
+  older app stays behind. A start that races another one for the same directory hands over without opening the
+  launcher.
+
 ## 0.22.0 (2026-10-13)
 
 - **Starts send only what changed.** A new conversation's project travels as Git packs into a project cache its VMs

package/README.md

@@ -1,5 +1,11 @@
 # @shardflux/cli: `shard`
 
+Historical template file lists: reads queue checksum-verified reconstruction when a cold list is absent from the SQL cache. TypeScript SDK 0.27.0+ / Python 0.23.0+ wait full Retry-After for retryable API 409 file_list_indexing on GET/HEAD within the admission timeout. Template objects and version history stay available.
+
+Plan-derived API budgets (0.23.0+, SDK 0.27.0): `--json` error output includes `rate_limit` and `retry_after_seconds`; the text hint names the shared scope and delay. API request pacing follows the SDK admission timeout and preserves the request body. Reuse workspace credentials and reduce status polling when the returned budget asks for a delay.
+
+Exec survives a dropped connection (0.23.0+): a lost start response is retried with the same session ID and reattaches to the command that already started, and a cut-off JSON answer is retried within the same safe retry boundary.
+
 Suspension controls arrive in 0.22.0 (next coordinated release). `shard operations progress <operation-id>` reads the actual phase, host deadline, cancellation window and safe next action. `shard operations cancel <operation-id>` requests cancellation; `--wait --timeout 5m` waits for confirmed `suspend_canceled` recovery of the original workspace. Asynchronous acceptance is labeled separately. The owning host refuses cancellation outside validated preparation; after capture, wait for the outcome and resume if it succeeded. These commands never reset, replace or launch a provider turn. `--json` preserves the reported values; unavailable progress is explicit.
 
 The command line for [Shardflux](https://shardflux.dev): serverless VMs for AI agents. Open a
@@ -114,9 +120,13 @@ and Codex, skipping every step that is already done (0.15.0+). Editors that laun
 run the same sign-in as `shard --login` (0.22.0+).
 With T3 Code 0.0.45, `shard agents new --in t3` adds the project as an SSH environment instead.
 
+ACP journal read reattachment uses bounded backoff through temporary lifecycle interruptions (0.23.0+). It keeps the saved sequence and never resubmits an uncertain turn.
+
 In CLI 0.22.0+, `shard setup --inspect` shows a stopped T3 Connect workspace link and its remedy without restarting
-the link or replacing your approved sign-in. A full T3 environment allowance needs a free slot: remove an unused
-environment in T3 Connect, then run `shard agents open t3 <workspace>` to request another link.
+the link or replacing your approved sign-in. `shard agents open t3` brings T3 Code up once the workspace is linked
+(0.23.0+): a refused link answers `t3_link_failed` with what to do (for T3 Connect's environment limit, remove an
+environment in T3 Code → Settings → Connections, `details.recovery`), and a link still in progress after 30 seconds
+answers `t3_link_pending`. Both name the workspace and conversation: open it again with `shard agents open t3`.
 
 Start another thread on a computer that is already set up (0.16.0+): it shares that conversation's installed
 packages, caches, running services, ports and files, and works on its own branch and worktree.
@@ -155,18 +165,20 @@ shard move --list                  # the project's sessions, and where moved one
 shard move --session 3d085e35-aa66-4866-9a53-f09719d6767c --detach --json
 ```
 
-CLI 0.22.0+ detects registered worktrees before migration. Inspect the exact paths and file bytes with
-`shard move --last --plan --json`, then choose `--preserve-all-worktrees` to include every registered worktree,
-all local refs, indices and ignored files, or `--this-worktree-only` to leave the others here explicitly.
-Preserve-all includes ignored dependency/build caches; tar headers add to the displayed file bytes and the VM
+The session's checkout moves, uncommitted edits included; the repository's other worktrees and local branches stay
+on this computer (0.23.0+; `--this-worktree-only` says so explicitly). When the session also worked in another
+worktree, the move names it in one line (`other_worktrees` in `--json`). To bring every registered worktree, all
+local refs, indices and ignored files too, inspect the exact paths and file bytes with
+`shard move --last --plan --json`, then move with `--preserve-all-worktrees` (0.22.0+). Preserve-all includes ignored dependency/build caches; tar headers add to the displayed file bytes and the VM
 and project space need free disk for the copies. It never follows symlinks into unrelated sibling folders.
 The source checkout stays untouched. Cloud worktrees keep their staged/unstaged state; the selected tree runs on
 the conversation's branch while its original branch and HEAD remain in the recovery archive. Git location
 pointers are repaired for the VM. The result's `preserved.snapshot` names an immutable migration-time snapshot
 in the project space. Its `restore.py manifest.json <empty-folder>` command restores the original repository
 state into a new folder and refuses to overwrite continued work. It is a recovery snapshot, not an ongoing
-backup of later edits in other worktrees. Missing registrations, external object alternates, nested repositories
-and special files need resolution before preserve-all can upload.
+backup of later edits in other worktrees. External object alternates, nested repositories and special files need
+resolution before preserve-all can upload; a registration whose folder is gone has nothing to copy and is listed as
+`stale_registrations`.
 
 A running turn finishes here first. Uncommitted edits come along, and your working tree, index and branch stay as
 they are. The cloud work comes back to your checkout by itself, and typing in the local Claude Code copy shows one line
@@ -187,7 +199,8 @@ The first message becomes a T3 thread and T3 comes to the front. With the Shardf
 cloud VM; with T3 Code 0.0.45 it runs on the T3 server in the project's VM, or with `--on` on that computer's.
 `--image` attaches images. `shard agents targets --json` shows T3 Code's mode, where each app's new conversations
 open, and every place each app can open (`open_in_targets`, 0.22.0+); `shard agents open t3 <conversation>` brings its
-thread back. Codex opens in a terminal app on macOS too (0.22.0+): `shard agents targets --open-in codex=terminal`.
+thread back, and a Codex Cloud conversation's chat opens in your browser (0.23.0+). Answer a Codex Cloud
+conversation with `shard conversations send <id> "<answer>"` (0.23.0+ names it when you open one). Codex opens in a terminal app on macOS too (0.22.0+): `shard agents targets --open-in codex=terminal`.
 
 `shard settings --title-prefix <text|none|default>` (0.22.0+) sets the marker your Claude conversations' titles start
 with in claude.ai and the Claude app (default `☁`: "☁ Fix login bug · todo-app"); `shard settings` shows it with where
@@ -317,7 +330,8 @@ answer) or their product (it runs VMs for its customers through the API, SDK or
 
 2. **Connect Claude and Codex.** Ask which they use (Claude Code and Codex / Claude Code / Codex). `shard agents
    credentials login claude --json` opens the claude.ai sign-in and a page for its code in their browser (0.22.0+);
-   Codex uses this computer's login (`codex login`). `shard setup --inspect --connect --json --apps claude,codex`
+   Codex Cloud uses this computer's ChatGPT sign-in (`codex login`); copy it with `shard setup`.
+   `shard setup --inspect --connect --json --apps claude,codex`
    (0.15.0+) checks both live, copies the Codex login and starts the account's Codex remote device.
 3. **Set up the machine** every conversation starts from: ask "Set up your cloud machine from this computer?" (Yes /
    Not now), then `shard machine setup --from-this-computer --json` (0.20.0+): this computer's Claude Code or Codex
@@ -1596,3 +1610,16 @@ Explicit `agents new --in terminal`, `--in t3`, and `--like` launches keep their
 Save progress (0.22.0+): Machine and template saves show source size and an estimated duration, then queued/build state and phase updates immediately. With `--json`, progress events go to stderr and the final stdout document includes `preflight` and `phases`. Failure and timeout output retain the latest counters and `details.last_progress`, with the build id and recovery action. If an older API cannot expose the build, JSON stderr emits `save_started` with the version/build id and leaves the phase unknown. Missing final host reports preserve the last observed progress.
 
 Desktop launch cards (0.22.0+): the bundled desktop apps clear and close the launcher on submission, then show each pending start in a layered card stack near the top of the display. **Show all launches** expands individual statuses and recovery.
+
+
+### Pending execution cancellation (0.23.0+)
+
+On guests advertising `exec_cancel_pending.v1`, successful cancellation can return the actual `running` state
+with `canceled: true` while the kernel holds a killed process. The execution's `error` explains pending drain,
+and becomes unverified after 30 seconds without claiming an exit or freeing ownership. Read/follow that
+session until its real final status; repeat cancellation is idempotent. An already exited foreground keeps
+its result while descendant drain can remain pending. TS/Python agent tools and MCP expose the reason as
+`status_reason` and keep the exit code null while active. CLI prints the reason and follow command.
+Older clients read the same session response fields.
+
+Cloud history (0.23.0+): `shard agents open <conversation-id> --original` opens the original chat; `--history <thread-id>` opens an earlier linked chat. `--json` includes `previous_threads` with each history URL. Sign in with the Codex account that owns the selected chat.

package/dist/acp-journal.js

@@ -1,6 +1,18 @@
 import { randomUUID } from 'node:crypto';
 import { StringDecoder } from 'node:string_decoder';
+import { setTimeout as delay } from 'node:timers/promises';
+import { ShardfluxApiError, ShardfluxProtocolError } from '@shardflux/sdk';
 import { AcpRpc } from "./acp-rpc.js";
+import { reattachDelayMs } from "./agent-terminal.js";
+const RECONNECT_BUDGET_MS = 120_000;
+function retryableRead(error) {
+    if (error instanceof ShardfluxApiError)
+        return error.retryable || ['stale_epoch', 'token_expired', 'workspace_not_running', 'workspace_busy'].includes(error.code);
+    return error instanceof TypeError || error instanceof ShardfluxProtocolError && error.status === 0;
+}
+// An input this small (every RPC but a long prompt) travels in its command's start request: one request instead of a
+// start, a stdin frame, an output stream and a cancel (0.23.0+).
+const ONE_SHOT_INPUT = 192 << 10;
 // InputACP's private, same-uid socket receipt protocol. Stdin avoids Linux's 128 KiB per-argument limit.
 export const ACP_INPUT_SCRIPT = `import json, os, socket, sys
 payload = sys.stdin.buffer.readline((2 << 20) + 1024)
@@ -70,6 +82,19 @@ export class AcpJournal {
     async #deliver(inputId, message) {
         const dir = `/home/user/.local/share/shardflux/acp/${this.#conversation}`;
         const payload = Buffer.from(`{"mode":"input","input_id":${JSON.stringify(inputId)},"message":${message}}\n`);
+        if (payload.length <= ONE_SHOT_INPUT) {
+            const r = await this.#cell.exec.run(['python3', '-c', ACP_INPUT_SCRIPT, dir], { cwd: this.#cwd, stdin: payload, timeoutMs: 15_000, maxOutputBytes: 65536, signal: this.#signal });
+            let receipt;
+            try {
+                receipt = JSON.parse(r.stdout);
+            }
+            catch {
+                receipt = undefined;
+            }
+            if (r.exitCode !== 0 || receipt?.accepted !== true)
+                throw new Error('ACP delivery is unverified; load this session before continuing.');
+            return;
+        }
         const session = await this.#cell.exec.start({ argv: ['python3', '-c', ACP_INPUT_SCRIPT, dir], cwd: this.#cwd, stdin_open: true, timeout_ms: 15_000 }, this.#signal);
         let offset = 0, stdout = '';
         try {
@@ -167,17 +192,22 @@ export class AcpJournal {
         const signal = AbortSignal.any([this.#signal, reader.signal]);
         try {
             let failures = 0;
+            let outageStarted;
             while (this.#wanted() && !signal.aborted) {
                 const decoder = new StringDecoder('utf8');
                 let tail = '', offset = 0;
+                let interruption;
                 try {
                     const session = await this.#cell.exec.start({ argv: ['sf-agent', 'acp', 'attach', '--conversation', this.#conversation, '--from-seq', String(this.#cursor.from_seq), '--follow'], cwd: this.#cwd, timeout_ms: 0 }, signal);
                     this.#follower = session.session_id;
                     for await (const event of await this.#cell.exec.output(session.session_id, { follow: true, signal })) {
-                        if (event.type === 'error')
-                            throw new Error(event.error?.error.message ?? 'ACP journal failed');
+                        if (event.type === 'error') {
+                            if (event.error)
+                                throw new ShardfluxApiError(502, event.error, 'cell');
+                            throw new Error('ACP journal failed without an error envelope');
+                        }
                         if (event.type === 'exit')
-                            throw new Error('ACP journal detached');
+                            throw new ShardfluxProtocolError('ACP journal detached', 0, 'cell');
                         if (event.type !== 'output' || event.stream !== 'stdout' || !event.data)
                             continue;
                         const bytes = Buffer.from(event.data, 'base64'), at = event.offset ?? offset;
@@ -189,8 +219,12 @@ export class AcpJournal {
                         for (let newline; (newline = tail.indexOf('\n')) >= 0;) {
                             const line = tail.slice(0, newline);
                             tail = tail.slice(newline + 1);
+                            const before = this.#cursor.from_seq;
                             await this.#entry(line);
-                            failures = 0;
+                            if (this.#cursor.from_seq > before) {
+                                failures = 0;
+                                outageStarted = undefined;
+                            }
                         }
                         if (Buffer.byteLength(tail) > 4 << 20)
                             throw new Error('ACP journal frame exceeds 4 MiB');
@@ -198,17 +232,35 @@ export class AcpJournal {
                             return;
                     }
                     if (!signal.aborted)
-                        throw new Error('ACP journal connection ended');
+                        throw new ShardfluxProtocolError('ACP journal connection ended', 0, 'cell');
                 }
                 catch (error) {
                     if (signal.aborted)
                         break;
-                    if (++failures > 3)
+                    if (!retryableRead(error))
                         throw error;
+                    outageStarted ??= performance.now();
+                    if (performance.now() - outageStarted >= RECONNECT_BUDGET_MS)
+                        throw new Error('ACP journal reconnect timed out; load this session to continue.', { cause: error });
+                    failures++;
+                    interruption = error;
                 }
                 finally {
                     await this.#detach();
                 }
+                // Retrying only the read follower cannot submit a second turn. Keep
+                // the original sequence/prompt cursor and stop waits on editor exit.
+                // A stopped reader (pause, idle) ends the wait as it ends an attach:
+                // the loop exits without closing the editor's connection.
+                if (this.#wanted() && !signal.aborted && interruption !== undefined) {
+                    try {
+                        await delay(Math.min(reattachDelayMs(interruption, failures), RECONNECT_BUDGET_MS - (performance.now() - outageStarted)), undefined, { signal });
+                    }
+                    catch (error) {
+                        if (!signal.aborted)
+                            throw error;
+                    }
+                }
             }
         }
         catch (error) {

package/dist/acp-login.d.ts

@@ -1,4 +1,5 @@
 import type { Ctx } from './commands.js';
+import type { ImportResult, LocalCliProxy } from './cli-proxy.js';
 /**
  * The ACP terminal sign-in method. An editor runs it in its own terminal when the user chooses it, then reconnects:
  * T3 Code appends these args to the configured `shard acp` (`shard acp --login`); ACP registry clients run the agent
@@ -13,9 +14,15 @@ export declare const ACP_LOGIN_METHOD: {
 };
 /** Whether an API key is configured (no request; a revoked key surfaces as auth_required on its first call). */
 export declare function acpSignedIn(ctx: Ctx): boolean;
+/** How the sign-in finds and moves this computer's CLIProxyAPI (tests replace both). */
+export interface AcpLoginDeps {
+    detect?: (env: Record<string, string | undefined>) => Promise<LocalCliProxy | null>;
+    move?: (ctx: Ctx) => Promise<ImportResult>;
+}
 /**
  * `shard acp --login`: everything a first conversation needs, each step skipped when it is already done: the
- * account (signed up or in with this computer's Codex login, else an email), its API key, the Codex login copy and the
- * cloud Claude sign-in.
+ * account (signed up or in with this computer's Codex login, else an email), its API key, the Codex login copy, the
+ * user's T3 Code proxy setup (a CLIProxyAPI on this computer, moved into the account when they say so) and the cloud
+ * Claude sign-in (not needed when Claude Code goes through that proxy with its own token).
  */
-export declare function runAcpLogin(ctx: Ctx): Promise<number>;
+export declare function runAcpLogin(ctx: Ctx, deps?: AcpLoginDeps): Promise<number>;

package/dist/acp-login.js

@@ -6,6 +6,8 @@ import { describeError } from "./errors.js";
 import { cloudClaudeLogin, loginClaudeInWorkspace } from "./claude-cloud-login.js";
 import { syncAgentCredentials } from "./agent-credentials.js";
 import { thisComputer } from "./this-computer.js";
+import { detectLocalCliProxy, importCliProxy } from "./cli-proxy.js";
+import { accountVmProxy, readT3ProxySetup } from "./t3-proxy.js";
 /**
  * The ACP terminal sign-in method. An editor runs it in its own terminal when the user chooses it, then reconnects:
  * T3 Code appends these args to the configured `shard acp` (`shard acp --login`); ACP registry clients run the agent
@@ -46,10 +48,11 @@ async function accountReady(ctx) {
 const say = (ctx, text) => { ctx.io.stderr.write(text); };
 /**
  * `shard acp --login`: everything a first conversation needs, each step skipped when it is already done: the
- * account (signed up or in with this computer's Codex login, else an email), its API key, the Codex login copy and the
- * cloud Claude sign-in.
+ * account (signed up or in with this computer's Codex login, else an email), its API key, the Codex login copy, the
+ * user's T3 Code proxy setup (a CLIProxyAPI on this computer, moved into the account when they say so) and the cloud
+ * Claude sign-in (not needed when Claude Code goes through that proxy with its own token).
  */
-export async function runAcpLogin(ctx) {
+export async function runAcpLogin(ctx, deps = {}) {
     const { HANDLERS } = await import("./handlers.js");
     const home = ctx.io.env.HOME ?? homedir();
     const codex = existsSync(join(home, '.codex', 'auth.json'));
@@ -99,7 +102,31 @@ export async function runAcpLogin(ctx) {
         await syncAgentCredentials(ctx.cloud(), { home, redact: (value) => ctx.addSecret(value) });
         say(ctx, `Codex: connected with the login on ${thisComputer()}.\n`);
     }
-    if (await cloudClaudeLogin(ctx))
+    // T3 Code's own providers go through CLIProxyAPI on this computer: cloud threads follow once it is in the account.
+    let plan = accountVmProxy(ctx);
+    if (plan.importable.length) {
+        const local = await (deps.detect ?? ((env) => detectLocalCliProxy({ env })))(ctx.io.env).catch(() => null);
+        if (local?.logins.length) {
+            const answer = (await ctx.input.answer('\nYour T3 Code setup uses CLIProxyAPI on this computer. Move it into your Shardflux account so cloud conversations use it too? Your logins and routing come along, and this computer keeps http://127.0.0.1:8317. [Y/n] '))?.trim().toLowerCase() ?? 'n';
+            if (answer === '' || answer.startsWith('y')) {
+                try {
+                    // The answer above is the consent to stop the local copy too.
+                    const moved = await (deps.move ?? ((c) => importCliProxy(c, { values: { yes: true } })))(ctx);
+                    plan = accountVmProxy(ctx);
+                    say(ctx, `CLIProxyAPI: in your account, ${moved.logins.active.length} login${moved.logins.active.length === 1 ? '' : 's'} serving. Cloud conversations use it.\n`);
+                }
+                catch (error) {
+                    say(ctx, `CLIProxyAPI: ${describeError(error).message} Run: shard cli-proxy import\n`);
+                }
+            }
+            else
+                say(ctx, 'CLIProxyAPI: stays on this computer; cloud conversations use your Shardflux sign-ins. Move it any time: shard cli-proxy import\n');
+        }
+    }
+    const claude = readT3ProxySetup({ env: ctx.io.env }).claude;
+    if (plan.claudeCredential && claude)
+        say(ctx, `Claude Code: connected through ${claude.local ? 'your CLIProxyAPI' : new URL(claude.url).host}.\n`);
+    else if (await cloudClaudeLogin(ctx))
         say(ctx, 'Claude Code: connected.\n');
     else {
         const answer = (await ctx.input.answer('\nConnect Claude Code now? It opens a Claude sign-in page. [Y/n] '))?.trim().toLowerCase() ?? 'n';

package/dist/acp-models.d.ts

@@ -24,11 +24,16 @@ export declare class AcpModelCache {
     read(scope: AcpScope): AcpCatalog;
     write(scope: AcpScope, catalog: AcpCatalog): void;
 }
-export declare function discoverAcpCatalog(ctx: Ctx, ws: Workspace, root: string): Promise<AcpCatalog>;
+export declare function discoverAcpCatalog(ctx: Ctx, ws: Workspace, root: string, env?: Record<string, string>): Promise<AcpCatalog>;
 export interface AcpPreparation {
     allocated(conversation: Conversation, workspace: WorkspaceView): void;
     ready(workspace: Workspace): void;
     prepared(): void;
+    /** The user's T3 Code proxy setup (t3-proxy.ts): the adapters' variables, and the VM files they read, placed first. */
+    proxy?: {
+        env: Record<string, string>;
+        ready(workspace: Workspace): Promise<void>;
+    };
 }
 export interface AcpLifecycle {
     prepare(ctx: Ctx, folder: string, name: string, callbacks: AcpPreparation): Promise<AcpCatalog>;

package/dist/acp-models.js

@@ -1,13 +1,13 @@
 import { createHash } from 'node:crypto';
 import { existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, posix } from 'node:path';
 import { projectIdentity } from "./project-identity.js";
-import { localChanges, seedAgentRepository } from "./agent-repository.js";
-import { checkoutConversationBranch, createConversationRecord, conversationWorkspace } from "./conversations.js";
+import { localChanges } from "./agent-repository.js";
+import { createConversationRecord, conversationWorkspace, seedConversation } from "./conversations.js";
+import { seedPhase } from "./seed-phases.js";
 import { AgentStateStore } from "./agent-state.js";
 import { objectValue } from "./acp-rpc.js";
 import { nativeCurrentModel, nativeModelOptions } from "./acp-catalog.js";
-import { sendTwinSeed } from "./worktree-twin.js";
 /** No prompts, login, logout or credential writes. Every child process group is
  * terminated, including initialization failures and interrupted clients. */
 export const ACP_MODELS_SCRIPT = String.raw `
@@ -115,9 +115,9 @@ export class AcpModelCache {
         });
     }
 }
-export async function discoverAcpCatalog(ctx, ws, root) {
+export async function discoverAcpCatalog(ctx, ws, root, env = {}) {
     const result = await ws.cell().exec.run(['node', '-e', ACP_MODELS_SCRIPT], { cwd: root, timeoutMs: 55_000,
-        signal: ctx.signal, maxOutputBytes: 1 << 20, env: { SF_ACP_MODEL_DISCOVERY: '1' } });
+        signal: ctx.signal, maxOutputBytes: 1 << 20, env: { ...env, SF_ACP_MODEL_DISCOVERY: '1' } });
     if (result.exitCode !== 0)
         throw new Error(`Guest model discovery failed: ${result.stderr.trim()}`);
     const discovered = JSON.parse(result.stdout), catalog = {};
@@ -140,25 +140,30 @@ export const ACP_LIFECYCLE = { async prepare(ctx, folder, name, callbacks) {
         const changes = localChanges(folder, ctx.signal);
         changes.catch(() => undefined);
         const ws = await conversationWorkspace(ctx, c);
+        seedPhase('vm_running');
         callbacks.ready(ws);
-        await ws.cell().files.mkdir(c.worktree_path, { parents: true });
-        const background = [];
         let initialReady, initialFailed;
         const initialFiles = new Promise((resolve, reject) => { initialReady = resolve; initialFailed = reject; });
         // The adapters read the project's own agent settings when it has any: discovery then waits for those files. A
-        // project without them is discovered while it seeds (0.21.1+): the catalog depends on the account, not the files.
+        // project without them is discovered while it seeds (0.21.1+), beside the worktree rather than in it (a prepared
+        // worktree is moved into place whole): the catalog depends on the account, not the files.
         const projectSettings = ACP_INITIAL_FILES.some(path => existsSync(join(folder, path)));
+        // The same seed as a terminal start (0.22.0+): the prepared revision, only what the project cache lacks, or the copy
+        // seed. Media land before the reply and those still on their way stay out of the first file reconcile (acp.ts).
         const seeded = (async () => {
-            await seedAgentRepository(ctx, ws, folder, { root: c.worktree_path, populate: true, changes, background: started => background.push(started),
-                initialFiles: ACP_INITIAL_FILES, onInitialFiles: initialReady });
-            await sendTwinSeed(ctx.store.dir, ws.cell(), c, folder, ctx.signal);
-            await checkoutConversationBranch(ctx, ws.cell(), c);
-            await Promise.all(background);
+            await seedConversation(ctx, c, ws, folder, undefined, changes, undefined, { initialFiles: ACP_INITIAL_FILES, onInitialFiles: initialReady, landNow: true });
             callbacks.prepared();
         })();
         void seeded.catch(initialFailed);
-        const models = (async () => { if (projectSettings)
-            await initialFiles; return discoverAcpCatalog(ctx, ws, c.worktree_path); })();
+        const proxied = callbacks.proxy?.ready(ws) ?? Promise.resolve();
+        const models = (async () => {
+            await proxied;
+            if (projectSettings) {
+                await initialFiles;
+                return discoverAcpCatalog(ctx, ws, c.worktree_path, callbacks.proxy?.env);
+            }
+            return discoverAcpCatalog(ctx, ws, posix.dirname(c.worktree_path), callbacks.proxy?.env);
+        })();
         // Observe both failures immediately. Never start a second VM, and never delete
         // the user's conversation VM as catalog cleanup.
         const results = await Promise.allSettled([seeded, models]);