@stigmer/cli 3.14.1 → 3.15.0

package/src/resources/run/prepare.test.ts

@@ -149,8 +149,8 @@ function countingClient(preferences: StubPreferences): { client: Stigmer; calls:
   return { client, calls: () => calls };
 }
 
-/** prepareAgentExec options as `run` passes them: cloud + harness opt-in. */
-const CLOUD_RUN_OPTIONS = { cloudBackend: true, applyAccountHarnessDefault: true } as const;
+/** prepareAgentExec options as `run` passes them: the kind is served here + harness opt-in. */
+const SERVED_RUN_OPTIONS = { accountPreferencesAvailable: true, applyAccountHarnessDefault: true } as const;
 
 describe("prepareAgentExec env injection", () => {
   it("injects STIGMER_ORG_ID when absent", async () => {
@@ -193,7 +193,7 @@ describe("prepareAgentExec account-preference model fill (oss#293 Phase 1.5)", (
       clientWithPreference("claude-sonnet-4.6"),
       "acme",
       undefined,
-      { cloudBackend: true },
+      { accountPreferencesAvailable: true },
     );
     expect(prepared.model).toBe("claude-sonnet-4.6");
   });
@@ -204,20 +204,22 @@ describe("prepareAgentExec account-preference model fill (oss#293 Phase 1.5)", (
       clientWithPreference("claude-sonnet-4.6"),
       "acme",
       undefined,
-      { cloudBackend: true },
+      { accountPreferencesAvailable: true },
     );
     expect(prepared.model).toBe("gpt-5.3");
   });
 
-  it("never consults identity on a local backend", async () => {
-    // The failing stub doubles as a call detector: local mode must not even
-    // attempt whoAmI, so a rejecting client cannot affect the result.
+  it("never consults identity where the kind is not served", async () => {
+    // The failing stub doubles as a call detector: a backend that does not
+    // serve identity accounts must not even attempt whoAmI, so a rejecting
+    // client cannot affect the result. (20260911.11 A3: the gate is the
+    // kind's tier, not the backend type — client/edition.ts resourceServedOn.)
     const prepared = await prepareAgentExec(
       BASE_FLAGS,
       clientWithFailingWhoAmI(),
       "acme",
       undefined,
-      { cloudBackend: false },
+      { accountPreferencesAvailable: false },
     );
     expect(prepared.model).toBe("");
   });
@@ -228,7 +230,7 @@ describe("prepareAgentExec account-preference model fill (oss#293 Phase 1.5)", (
       clientWithFailingWhoAmI(),
       "acme",
       undefined,
-      { cloudBackend: true },
+      { accountPreferencesAvailable: true },
     );
     expect(prepared.model).toBe("");
   });
@@ -239,7 +241,7 @@ describe("prepareAgentExec account-preference model fill (oss#293 Phase 1.5)", (
       clientWithPreference(""),
       "acme",
       undefined,
-      { cloudBackend: true },
+      { accountPreferencesAvailable: true },
     );
     expect(prepared.model).toBe("");
   });
@@ -252,7 +254,7 @@ describe("prepareAgentExec harness resolution (oss#293)", () => {
       clientWithPreferences({ defaultHarness: "cursor" }),
       "acme",
       undefined,
-      CLOUD_RUN_OPTIONS,
+      SERVED_RUN_OPTIONS,
     );
     expect(prepared.harness).toBe("cursor");
   });
@@ -265,7 +267,7 @@ describe("prepareAgentExec harness resolution (oss#293)", () => {
       clientWithPreferences({ defaultHarness: "cursor" }),
       "acme",
       undefined,
-      CLOUD_RUN_OPTIONS,
+      SERVED_RUN_OPTIONS,
     );
     expect(prepared.harness).toBe("native");
   });
@@ -279,7 +281,7 @@ describe("prepareAgentExec harness resolution (oss#293)", () => {
       clientWithPreferences({ defaultHarness: "cursor" }),
       "acme",
       undefined,
-      { cloudBackend: true },
+      { accountPreferencesAvailable: true },
     );
     expect(prepared.harness).toBe("");
   });
@@ -290,7 +292,7 @@ describe("prepareAgentExec harness resolution (oss#293)", () => {
       STUB_CLIENT,
       "acme",
       undefined,
-      { cloudBackend: false },
+      { accountPreferencesAvailable: false },
     );
     expect(prepared.harness).toBe("cursor");
   });
@@ -303,7 +305,7 @@ describe("prepareAgentExec harness resolution (oss#293)", () => {
       clientWithPreferences({ defaultHarness: "devin" }),
       "acme",
       undefined,
-      CLOUD_RUN_OPTIONS,
+      SERVED_RUN_OPTIONS,
     );
     expect(prepared.harness).toBe("");
   });
@@ -314,7 +316,7 @@ describe("prepareAgentExec harness resolution (oss#293)", () => {
       clientWithFailingWhoAmI(),
       "acme",
       undefined,
-      CLOUD_RUN_OPTIONS,
+      SERVED_RUN_OPTIONS,
     );
     expect(prepared.harness).toBe("");
     expect(prepared.model).toBe("");
@@ -327,7 +329,7 @@ describe("prepareAgentExec harness resolution (oss#293)", () => {
       clientWithFailingWhoAmI(),
       "acme",
       undefined,
-      { cloudBackend: false, applyAccountHarnessDefault: true },
+      { accountPreferencesAvailable: false, applyAccountHarnessDefault: true },
     );
     expect(prepared.harness).toBe("");
   });
@@ -338,7 +340,7 @@ describe("prepareAgentExec harness resolution (oss#293)", () => {
       clientWithPreferences({}),
       "acme",
       undefined,
-      CLOUD_RUN_OPTIONS,
+      SERVED_RUN_OPTIONS,
     );
     expect(prepared.harness).toBe("");
   });
@@ -356,7 +358,7 @@ describe("prepareAgentExec harness-aware model fill (oss#293)", () => {
       clientWithPreferences(BOTH_MODELS),
       "acme",
       undefined,
-      CLOUD_RUN_OPTIONS,
+      SERVED_RUN_OPTIONS,
     );
     expect(prepared.model).toBe("composer-2.5");
   });
@@ -367,7 +369,7 @@ describe("prepareAgentExec harness-aware model fill (oss#293)", () => {
       clientWithPreferences({ ...BOTH_MODELS, defaultHarness: "cursor" }),
       "acme",
       undefined,
-      CLOUD_RUN_OPTIONS,
+      SERVED_RUN_OPTIONS,
     );
     expect(prepared.harness).toBe("cursor");
     expect(prepared.model).toBe("composer-2.5");
@@ -379,7 +381,7 @@ describe("prepareAgentExec harness-aware model fill (oss#293)", () => {
       clientWithPreferences(BOTH_MODELS),
       "acme",
       undefined,
-      CLOUD_RUN_OPTIONS,
+      SERVED_RUN_OPTIONS,
     );
     expect(explicit.model).toBe("claude-sonnet-4.6");
 
@@ -388,7 +390,7 @@ describe("prepareAgentExec harness-aware model fill (oss#293)", () => {
       clientWithPreferences(BOTH_MODELS),
       "acme",
       undefined,
-      CLOUD_RUN_OPTIONS,
+      SERVED_RUN_OPTIONS,
     );
     expect(unset.model).toBe("claude-sonnet-4.6");
   });
@@ -399,7 +401,7 @@ describe("prepareAgentExec harness-aware model fill (oss#293)", () => {
       clientWithPreferences(BOTH_MODELS),
       "acme",
       undefined,
-      CLOUD_RUN_OPTIONS,
+      SERVED_RUN_OPTIONS,
     );
     expect(prepared.model).toBe("gpt-5.3");
   });
@@ -412,7 +414,7 @@ describe("prepareAgentExec harness-aware model fill (oss#293)", () => {
       clientWithPreferences(BOTH_MODELS),
       "acme",
       undefined,
-      { cloudBackend: true },
+      { accountPreferencesAvailable: true },
     );
     expect(prepared.harness).toBe("cursor");
     expect(prepared.model).toBe("composer-2.5");
@@ -420,7 +422,7 @@ describe("prepareAgentExec harness-aware model fill (oss#293)", () => {
 
   it("serves both fills from one whoAmI round trip, and none when both flags are explicit", async () => {
     const single = countingClient({ ...BOTH_MODELS, defaultHarness: "cursor" });
-    const filled = await prepareAgentExec(BASE_FLAGS, single.client, "acme", undefined, CLOUD_RUN_OPTIONS);
+    const filled = await prepareAgentExec(BASE_FLAGS, single.client, "acme", undefined, SERVED_RUN_OPTIONS);
     expect(filled.harness).toBe("cursor");
     expect(filled.model).toBe("composer-2.5");
     expect(single.calls(), "harness + model fills share one whoAmI").toBe(1);
@@ -431,7 +433,7 @@ describe("prepareAgentExec harness-aware model fill (oss#293)", () => {
       skipped.client,
       "acme",
       undefined,
-      CLOUD_RUN_OPTIONS,
+      SERVED_RUN_OPTIONS,
     );
     expect(explicit.harness).toBe("native");
     expect(explicit.model).toBe("gpt-5.3");

package/src/resources/run/prepare.ts

@@ -93,18 +93,20 @@ export interface PreparedRun {
 /** Optional behavior switches for {@link prepareAgentExec}. */
 export interface PrepareAgentExecOptions {
   /**
-   * When `true` (the caller's backend is Stigmer Cloud) and `--model` is
-   * omitted, the model is filled from the caller's account preference
-   * (`IdentityAccountPreferences.default_*_model` for the resolved harness)
-   * via `whoAmI()`. Local mode has no IdentityAccount, so callers pass
-   * `false` there and the omitted model keeps resolving to the platform
-   * default.
+   * When `true` and `--model` is omitted, the model is filled from the
+   * caller's account preference (`IdentityAccountPreferences.default_*_model`
+   * for the resolved harness) via `whoAmI()`. The caller answers this from
+   * the connected server's edition and the kind's tier —
+   * `client.isResourceAvailable(ApiResourceKind.identity_account)` — never
+   * from the config's backend type (20260911.11 A3): a server that does not
+   * serve identity accounts is not even asked, and the omitted model keeps
+   * resolving to the platform default.
    */
-  readonly cloudBackend?: boolean;
+  readonly accountPreferencesAvailable?: boolean;
   /**
    * When `true` and `--harness` is omitted, the harness is filled from the
    * caller's account preference (`IdentityAccountPreferences.default_harness`)
-   * on cloud. `run` opts in; `draft` deliberately does not: draft executes the
+   * where the kind is served. `run` opts in; `draft` deliberately does not: draft executes the
    * seedpack's system creator agents (a utility flow, not the user's own
    * conversation), which are built and exercised on the native harness —
    * silently rerouting them onto the cursor engine (different toolset,
@@ -133,27 +135,38 @@ export async function prepareAgentExec(
   validateHarness(flags.harness);
 
   // Layered seeds (oss#293, DD-003): explicit flag > account preference
-  // (cloud only) > platform default. Harness resolves first because the model
+  // (where the server serves identity accounts) > platform default. Harness resolves first because the model
   // fill is harness-aware: a cursor session fills from default_cursor_model,
   // everything else from default_native_model. `run` and `draft` always
   // create a NEW session (threading lives in `resume`, which does not pass
   // through here), so neither fill can ever contradict an existing session's
   // immutable harness. One whoAmI round trip serves both fills, and it is
   // skipped entirely when explicit flags leave nothing to fill.
-  const wantsHarnessFill = flags.harness === "" && options?.applyAccountHarnessDefault === true;
+  const wantsHarnessFill =
+    flags.harness === "" && options?.applyAccountHarnessDefault === true;
   const wantsModelFill = flags.model === "";
   const accountDefaults =
-    options?.cloudBackend === true && (wantsHarnessFill || wantsModelFill)
+    options?.accountPreferencesAvailable === true &&
+    (wantsHarnessFill || wantsModelFill)
       ? await resolveAccountExecutionDefaults(client)
       : NO_ACCOUNT_DEFAULTS;
-  const harness = flags.harness !== "" ? flags.harness : wantsHarnessFill ? accountDefaults.harness : "";
+  const harness =
+    flags.harness !== ""
+      ? flags.harness
+      : wantsHarnessFill
+        ? accountDefaults.harness
+        : "";
   const model = wantsModelFill
     ? harness === "cursor"
       ? accountDefaults.cursorModel
       : accountDefaults.nativeModel
     : flags.model;
 
-  const workspaceEntries = parseWorkspaceEntries(flags.workspace, flags.branch, flags.commit);
+  const workspaceEntries = parseWorkspaceEntries(
+    flags.workspace,
+    flags.branch,
+    flags.commit,
+  );
 
   const runtimeEnv = loadAndMergeEnv({
     envFlags: flags.env,
@@ -197,7 +210,11 @@ interface AccountExecutionDefaults {
   readonly cursorModel: string;
 }
 
-const NO_ACCOUNT_DEFAULTS: AccountExecutionDefaults = { harness: "", nativeModel: "", cursorModel: "" };
+const NO_ACCOUNT_DEFAULTS: AccountExecutionDefaults = {
+  harness: "",
+  nativeModel: "",
+  cursorModel: "",
+};
 
 /**
  * Best-effort read of the caller's execution defaults
@@ -206,12 +223,19 @@ const NO_ACCOUNT_DEFAULTS: AccountExecutionDefaults = { harness: "", nativeModel
  * IdentityAccount — resolves to no defaults and the run proceeds exactly as
  * unfilled flags do today: a missing preference must never fail a run.
  *
+ * This reads `whoAmI` directly and never the SDK's ensureMyIdentityAccount:
+ * a run must not create an account as a side effect, so NOT_FOUND here means
+ * "no preferences yet". Provisioning belongs to `auth login` and `auth
+ * whoami`, the commands whose purpose is the caller's identity.
+ *
  * The persisted harness value is allowlist-guarded to the shipped engines
  * (the same guard the web launcher's useAccountExecutionDefaults applies):
  * a client must not trust stored data it did not write, so anything outside
  * native/cursor is treated as undeclared rather than stamped on the wire.
  */
-async function resolveAccountExecutionDefaults(client: Stigmer): Promise<AccountExecutionDefaults> {
+async function resolveAccountExecutionDefaults(
+  client: Stigmer,
+): Promise<AccountExecutionDefaults> {
   try {
     const account = await client.identityAccount.whoAmI();
     const prefs = account.spec?.preferences;
@@ -257,7 +281,9 @@ export function parseApprovalAction(value: string): ApprovalAction {
  */
 export function validateMode(mode: string): asserts mode is RunMode {
   if (mode !== "" && mode !== "agent" && mode !== "plan") {
-    throw new UsageError(`invalid --mode value "${mode}": must be "agent" or "plan"`);
+    throw new UsageError(
+      `invalid --mode value "${mode}": must be "agent" or "plan"`,
+    );
   }
 }
 
@@ -267,7 +293,9 @@ export function validateMode(mode: string): asserts mode is RunMode {
  * server refuses fast on models without a registry fast variant; this check
  * only catches spelling errors before a network round trip.
  */
-export function validateServiceTier(tier: string): asserts tier is ServiceTierFlag {
+export function validateServiceTier(
+  tier: string,
+): asserts tier is ServiceTierFlag {
   if (tier !== "" && tier !== "standard" && tier !== "fast") {
     throw new UsageError(
       `invalid --service-tier value "${tier}": must be "standard" or "fast"`,
@@ -298,7 +326,9 @@ export function validateThinking(mode: string): asserts mode is ThinkingFlag {
  * them here is honest, and this check catches spelling errors before a
  * network round trip.
  */
-export function validateHarness(harness: string): asserts harness is HarnessFlag {
+export function validateHarness(
+  harness: string,
+): asserts harness is HarnessFlag {
   if (harness !== "" && harness !== "native" && harness !== "cursor") {
     throw new UsageError(
       `invalid --harness value "${harness}": must be "native" or "cursor"`,