@stringsync/splates 0.0.61 → 1.13.3

package/vendor/@stringsync/splates-server/index-7s01973c.js

@@ -0,0 +1,2356 @@
+import {
+  JUDGE_CREDS,
+  judgeFrom,
+  AutoPickStore
+} from "./index-acbcm66f.js";
+import {
+  KIMI_CLI2,
+  AgentStream2,
+  body,
+  refuse,
+  FsStorage2,
+  API_TOKEN2,
+  SavedTunnel2,
+  tunnelSetup2,
+  TOKEN_PERMISSIONS2,
+  TOKENS_PAGE2,
+  tokenInstructions2,
+  SavedPortsHost2,
+  portsHostFlag2,
+  APP_ID2,
+  APP_KEY2,
+  GitHubApp2,
+  githubRepo2,
+  PUSHED_PREFIX2,
+  LOCAL_WORKER2,
+  framed2,
+  Roster2,
+  DEFAULT_AGENTS2,
+  splatesHome2
+} from "./index-caep3sde.js";
+import {
+  fail2
+} from "./index-t9w5a8ed.js";
+import {
+  Git,
+  loadConfig2
+} from "./index-e9z7s5hh.js";
+import {
+  REPLICA_ACCESS_KEY2,
+  REPLICA_SECRET_KEY2
+} from "./index-5axhdy8c.js";
+
+// setup/area-auto-pick.ts
+import { Credentials } from "../../core/creds/index.js";
+var TYPESAFE_KEY = JUDGE_CREDS.jev[0];
+var TYPESAFE = "https://typesafe.ai";
+var AUTO_PICK_AREA = autoPickArea();
+function autoPickArea() {
+  const judgeStep = {
+    id: "auto-pick-judge",
+    title: "Give Auto pick a decision model",
+    why: "Auto pick asks a small decision model what kind of work a task is and how deeply it needs to reason, to start it on the agent, model and thinking level your rules give that. Without one, every Auto pick takes your rule for any kind and depth.",
+    user: `Create a TypeSafe API key and paste it here, for Jev. Clef on Cloudflare works too, with ${JUDGE_CREDS.clef.join(" and ")} kept for this device.`,
+    agent: `Request it with \`splates creds request ${TYPESAFE_KEY} --device\`, with how to get it; or, for Clef, ${JUDGE_CREDS.clef.map((name) => `\`${name}\``).join(" and ")} the same way.`,
+    optional: true,
+    after: [],
+    fields: [
+      {
+        kind: "cred",
+        name: TYPESAFE_KEY,
+        label: "TypeSafe API key",
+        help: `Make one in [TypeSafe](${TYPESAFE}) under API keys. To use Clef instead, keep ${JUDGE_CREDS.clef.map((name) => `\`${name}\``).join(" and ")} for this device on the Creds page and leave this empty.`,
+        optional: true
+      }
+    ],
+    uses: JUDGE_CREDS.clef,
+    check: async ({ device }) => await judgeFrom(new Credentials([device])) !== null,
+    undo: {
+      removes: async ({ device }) => await device.get(TYPESAFE_KEY) === undefined ? [] : ["The TypeSafe API key kept on this device"],
+      leaves: async ({ device }) => {
+        const leaves = [];
+        if (await device.get(TYPESAFE_KEY) !== undefined) {
+          leaves.push(`The key still works: revoke it in [TypeSafe](${TYPESAFE}) under API keys if you no longer want it.`);
+        }
+        if (await clefKept(device)) {
+          leaves.push(`Auto pick still judges with Clef, on ${JUDGE_CREDS.clef.map((name) => `\`${name}\``).join(" and ")}, kept for scry's Workers AI: forget them on the Creds page to stop it.`);
+        }
+        return leaves;
+      },
+      run: async () => {}
+    },
+    notDone: `Paste a TypeSafe API key, or keep ${JUDGE_CREDS.clef.join(" and ")} for this device, then press Next.`
+  };
+  const rulesStep = {
+    id: "auto-pick-rules",
+    title: "Map tasks to models",
+    why: "Auto pick tries your rules from the top, and the first that matches a task's kind and depth picks its agent; a pick whose plan is nearly used up, or used faster than its window goes by, is passed over for the next on its row.",
+    user: "Edit the rules, then press Next to save them. They are kept in `~/.splates/auto-pick.json`, which you can edit by hand too.",
+    agent: "Have the user edit the rules on the page, or edit `~/.splates/auto-pick.json` with them; its last rule must stay kind `*` and depth `*`.",
+    optional: true,
+    after: [],
+    check: async (machine) => machine.fs.exists(rulesPath(machine)),
+    submit: async (machine) => {
+      const store = new AutoPickStore(rulesPath(machine), { fs: machine.fs });
+      if (!await machine.fs.exists(store.path)) {
+        await store.save(await store.rules());
+      }
+    },
+    doing: "Saving your rules…",
+    undo: {
+      removes: async (machine) => [
+        `Your Auto pick rules in \`${rulesPath(machine)}\``
+      ],
+      run: (machine) => new AutoPickStore(rulesPath(machine), { fs: machine.fs }).remove()
+    }
+  };
+  const tryStep = {
+    id: "auto-pick-try",
+    title: "Try it on a task",
+    why: "See what Auto pick would start a task on, and why, without starting it.",
+    user: "Pick a task to see what Auto pick would do with it.",
+    agent: "Have the user pick a task on the page; trying starts nothing and changes no task.",
+    optional: true,
+    after: [rulesStep],
+    check: async (machine) => machine.fs.exists(rulesPath(machine))
+  };
+  return {
+    id: "auto-pick",
+    title: "Auto pick",
+    purpose: "Let a small model pick which agent and model starts each task.",
+    steps: [rulesStep, judgeStep, tryStep]
+  };
+}
+async function clefKept(device) {
+  for (const name of JUDGE_CREDS.clef) {
+    if (await device.get(name) === undefined) {
+      return false;
+    }
+  }
+  return true;
+}
+function rulesPath({ home }) {
+  return `${home}/auto-pick.json`;
+}
+
+// dictate/connection.ts
+import {
+  DictationFailure,
+  DictationRelay
+} from "../../core/dictate/index.js";
+
+// dictate/transcriber.ts
+import { basename } from "node:path";
+import { OpenAiTranscriber } from "../../core/dictate/server.js";
+
+// dictate/personal.ts
+class PersonalWords {
+  path;
+  deps;
+  constructor(path, deps) {
+    this.path = path;
+    this.deps = deps;
+  }
+  saved() {
+    return this.deps.fs.exists(this.path);
+  }
+  async words() {
+    const raw = await this.deps.fs.read(this.path).catch(() => null);
+    if (raw === null) {
+      return [];
+    }
+    let json;
+    try {
+      json = JSON.parse(raw);
+    } catch {
+      fail2("usage", `${this.path} is not JSON: fix or delete it`, {
+        path: this.path
+      });
+    }
+    const words = json?.words;
+    if (!Array.isArray(words) || !words.every((word) => typeof word === "string")) {
+      fail2("usage", `${this.path} has no \`words\` list of strings: fix or delete it`, { path: this.path });
+    }
+    return words;
+  }
+  async save(words) {
+    await this.deps.fs.mkdir(this.path.slice(0, this.path.lastIndexOf("/")), {
+      recursive: true
+    });
+    const tmp = `${this.path}.${crypto.randomUUID()}.tmp`;
+    await this.deps.fs.write(tmp, `${JSON.stringify({ words }, null, "\t")}
+`);
+    await this.deps.fs.rename(tmp, this.path);
+  }
+  async remove() {
+    await this.deps.fs.rm(this.path, { force: true });
+  }
+}
+function personalWordsPath(home) {
+  return `${home}/dictation.json`;
+}
+function parseWords(text) {
+  return text.split(/[,\n]/).map((word) => word.trim()).filter((word) => word !== "");
+}
+
+// dictate/vocabulary.ts
+var MAX_WORDS = 50;
+function words(project, ...lists) {
+  return [...new Set(["splates", project, ...lists.flat()])].slice(0, MAX_WORDS);
+}
+function vocabulary(listed) {
+  return `A developer dictating a prompt for a coding agent. Words that may come up: ${listed.join(", ")}.`;
+}
+
+// dictate/transcriber.ts
+var OPENAI_KEY = "OPENAI_API_KEY";
+var PURPOSE = "The mic in the composer transcribes what you say with OpenAI's `gpt-live-transcribe`, on your key.";
+var INSTRUCTIONS = `1. Open [API keys](https://platform.openai.com/api-keys), then **Create new secret key**.
+2. Give it access to the Realtime API (or all), and create it.
+3. Paste it here.`;
+var transcriberFor = async (project, tick) => {
+  const key = await project.creds.credentials.get(OPENAI_KEY);
+  if (key === undefined) {
+    await project.journal.record("creds request", null, () => project.creds.request(OPENAI_KEY, {
+      scope: "device",
+      purpose: PURPOSE,
+      instructions: INSTRUCTIONS,
+      task: null
+    }), (asked) => ({ name: OPENAI_KEY, asked: asked !== null }));
+    tick();
+    return null;
+  }
+  const root = project.service.git.root;
+  const personal = await new PersonalWords(personalWordsPath(splatesHome2(project.ps)), project).words().catch((error) => {
+    project.log.error(error instanceof Error ? error.message : String(error));
+    return [];
+  });
+  const listed = words(basename(root), project.config.dictationWords, personal);
+  return new OpenAiTranscriber(key, {
+    prompt: vocabulary(listed),
+    keywords: listed
+  });
+};
+
+// dictate/connection.ts
+class DictationConnection {
+  transcriber;
+  relay;
+  constructor(transcriber) {
+    this.transcriber = transcriber;
+  }
+  open(socket) {
+    this.relay = new DictationRelay({
+      send: (message) => socket.send(message),
+      hangUp: () => socket.close()
+    }, this.transcriber.then((transcriber) => {
+      if (transcriber === null) {
+        throw new DictationFailure(`dictation needs ${OPENAI_KEY}: add it on the Creds page`, OPENAI_KEY);
+      }
+      return transcriber;
+    }));
+  }
+  message(_socket, message) {
+    this.relay?.receive(typeof message === "string" ? message : new Uint8Array(message));
+  }
+  closed() {
+    this.relay?.dispose();
+  }
+}
+
+// dictate/dictate.ts
+class Dictations {
+  gate;
+  projects;
+  constructor(gate, projects) {
+    this.gate = gate;
+    this.projects = projects;
+  }
+  open = (request, server) => this.gate.local(this.gate.guarded(async (request2) => {
+    const host = request2.headers.get("host") ?? "";
+    const origin = URL.parse(request2.headers.get("origin") ?? "");
+    if (origin === null || origin.host !== host) {
+      return refuse(403, "forbidden", "a dictation opens only from its own page");
+    }
+    const project = await this.projects.projectFor(request2);
+    const data = new DictationConnection(project.transcriber());
+    return server.upgrade(request2, { data }) ? undefined : refuse(400, "usage", "a dictation is a WebSocket: connect with one");
+  }))(request);
+}
+// setup/area-dictation.ts
+var DICTATION_AREA = dictationArea();
+function dictationArea() {
+  const dictationStep = {
+    id: "dictation",
+    title: "Dictate prompts",
+    why: "The composer's mic transcribes what you say with OpenAI, on a key of your own.",
+    user: "Create an OpenAI API key and paste it here.",
+    agent: `Request it with \`splates creds request ${OPENAI_KEY} --device\`, with how to get it.`,
+    optional: true,
+    after: [],
+    fields: [
+      {
+        kind: "cred",
+        name: OPENAI_KEY,
+        label: "OpenAI API key",
+        help: "Make one at [API keys](https://platform.openai.com/api-keys) with **Create new secret key**, then paste it."
+      }
+    ],
+    check: async ({ device }) => await device.get(OPENAI_KEY) !== undefined,
+    undo: {
+      removes: async () => ["The OpenAI API key kept on this device"],
+      leaves: async () => [
+        "The key still works: revoke it at [API keys](https://platform.openai.com/api-keys) if you no longer want it."
+      ],
+      run: async () => {}
+    }
+  };
+  const wordsStep = {
+    id: "dictation-words",
+    title: "Teach it your words",
+    why: "The mic spells splates, the project's name and the project's `dictationWords` as written; add the names you say in every project, such as your tools and the people you mention.",
+    user: "List your words, separated by commas, then press Next. They are kept in `~/.splates/dictation.json`.",
+    agent: 'Have the user list them on the page, or write `~/.splates/dictation.json` as `{ "words": [...] }`. Words for one project go in its `splates.config.ts` as `dictationWords` instead.',
+    optional: true,
+    after: [dictationStep],
+    fields: async (machine) => [
+      {
+        kind: "text",
+        name: "words",
+        label: "Your words",
+        placeholder: "Pulumi, Fly, Ana",
+        value: (await store(machine).words().catch(() => [])).join(", "),
+        optional: true
+      }
+    ],
+    check: (machine) => store(machine).saved(),
+    submit: async (machine, answers) => {
+      const words = answers.words;
+      await store(machine).save(parseWords(typeof words === "string" ? words : ""));
+    },
+    doing: "Saving your words…",
+    undo: {
+      removes: async (machine) => [
+        `Your dictation words in \`${store(machine).path}\``
+      ],
+      run: (machine) => store(machine).remove()
+    }
+  };
+  return {
+    id: "dictation",
+    title: "Dictation",
+    purpose: "Speak prompts instead of typing them.",
+    steps: [dictationStep, wordsStep]
+  };
+}
+function store(machine) {
+  return new PersonalWords(personalWordsPath(machine.home), machine);
+}
+
+// setup/area-droplet.ts
+var DROPLET_AREA = dropletArea();
+function dropletArea() {
+  const keysStep = {
+    id: "replica-keys",
+    title: "Give the server its replica bucket's keys",
+    why: "A server on a Droplet keeps its records in a Spaces bucket beside it, which is what lets it move between machines or come back after its box is lost.",
+    user: "Make a Spaces access key limited to the bucket in the DigitalOcean control panel, then paste its key and its secret here.",
+    agent: `Follow "Server on a Droplet" in setup.md. Request each with \`splates creds request ${REPLICA_ACCESS_KEY2} --device\` and \`splates creds request ${REPLICA_SECRET_KEY2} --device\`, with how to make the key, and \`splates creds wait\` for each. On the Droplet, with \`SPLATES_SECRET_STORE=file\` set, they are kept in files only the user may read.`,
+    optional: true,
+    after: [],
+    fields: [
+      {
+        kind: "cred",
+        name: REPLICA_ACCESS_KEY2,
+        label: "Spaces access key",
+        help: "In DigitalOcean's **API** page, under **Spaces Keys**, **Generate New Key**, limited to the bucket; paste its key id."
+      },
+      {
+        kind: "cred",
+        name: REPLICA_SECRET_KEY2,
+        label: "Spaces secret key",
+        help: "The secret shown once beside that key."
+      }
+    ],
+    check: async ({ device }) => await device.get(REPLICA_ACCESS_KEY2) !== undefined && await device.get(REPLICA_SECRET_KEY2) !== undefined,
+    undo: {
+      removes: async () => [
+        "The Spaces access key and secret kept on this device"
+      ],
+      leaves: async () => [
+        "The key still works: delete it under **Spaces Keys** in DigitalOcean's API page, and the bucket and the Droplet from the dashboard, if you no longer want them."
+      ],
+      run: async () => {}
+    }
+  };
+  return {
+    id: "droplet",
+    title: "Server on a Droplet",
+    purpose: "Run splates server on a DigitalOcean Droplet that keeps working while your computer is off.",
+    steps: [keysStep]
+  };
+}
+
+// setup/area-evals.ts
+var DOCS = "https://github.com/stringsync/splates/blob/main/docs/evals.md";
+var EVALS_AREA = evalsArea();
+function evalsArea() {
+  const resultsStep = {
+    id: "evals-results",
+    title: "Show your evals",
+    why: "Results from any eval framework (promptfoo, Inspect, a script of your own) can show on the Evals page once they are written in the `splates-evals/1` format.",
+    user: `Add \`evals: { results: ".evals" }\` to this project's \`splates.config.ts\` and merge it, as a task, then restart \`splates server\` and press Next. [How to write the results](${DOCS}).`,
+    agent: `In a task of its own, add the \`evals\` the user names to \`splates.config.ts\` and merge it; then have the user restart \`splates server\`, and run \`splates setup evals-results\`. The format is in ${DOCS}.`,
+    notDone: `\`splates.config.ts\` names no \`evals.results\` yet: add it, merge it, then press Next. [The format](${DOCS}).`,
+    optional: true,
+    after: [],
+    detail: async (machine) => {
+      const evals = (await projectOf(machine).config()).evals;
+      return evals === null ? null : `Evals are set up: results are read from \`${evals.results}\`, and show on the Evals page.`;
+    },
+    check: async (machine) => (await projectOf(machine).config()).evals !== null,
+    undo: {
+      removes: async () => [],
+      leaves: async () => [
+        "`evals` in this project's `splates.config.ts`: take it out in a task and merge it, then restart `splates server`.",
+        "The results already written: delete them if you no longer want them."
+      ],
+      run: async () => {}
+    }
+  };
+  return {
+    id: "evals",
+    title: "Evals",
+    purpose: "Show the results of your project's evals on the Evals page.",
+    steps: [resultsStep]
+  };
+}
+var UNREAD = "No project to check: open Setup from a project, or run `splates setup` in its repository.";
+function projectOf(machine) {
+  if (machine.project === undefined) {
+    throw new Error(UNREAD);
+  }
+  return machine.project;
+}
+
+// setup/area-github.ts
+var NEW_APP_PAGE = "https://github.com/settings/apps/new";
+var DEFAULT_REMOTE = "origin";
+var PROBE_BRANCH = "splates-probe/unnamed";
+var PUSH_RULES = ["creation", "update", "deletion"];
+var RULESET_HOW = `In this repository's **Settings → Rules → Rulesets**, add two rulesets that are **Active**, restrict creations, updates and deletions, and let only **Repository admin** bypass them, the role of the account \`splates server\` pushes trunk with. One is a branch ruleset that targets **All branches** but excludes \`${PUSHED_PREFIX2}*\`. The other is a tag ruleset that targets **All tags**, since the App's contents permission would let a token push or move a release tag.`;
+var RULESETS = [
+  {
+    name: "splates",
+    target: "branch",
+    conditions: {
+      ref_name: {
+        include: ["~ALL"],
+        exclude: [`refs/heads/${PUSHED_PREFIX2}*`]
+      }
+    }
+  },
+  {
+    name: "splates-tags",
+    target: "tag",
+    conditions: { ref_name: { include: ["~ALL"], exclude: [] } }
+  }
+].map((each) => ({
+  ...each,
+  enforcement: "active",
+  rules: PUSH_RULES.map((type) => ({ type })),
+  bypass_actors: [
+    { actor_id: 5, actor_type: "RepositoryRole", bypass_mode: "always" }
+  ]
+}));
+var GITHUB_AREA = githubArea();
+function githubArea() {
+  const appStep = {
+    id: "github-app",
+    title: "Make the splates GitHub App",
+    why: "Workers push each task's branch with an hour-long token the App mints for one repository's contents, never with a credential of yours.",
+    user: `[Make a GitHub App](${NEW_APP_PAGE}): any name, Webhook off, Repository permissions **Contents: Read and write** and nothing else, only on this account. Then paste its App ID, and the private key it generates, here.`,
+    agent: `Request both as device creds, \`splates creds request ${APP_ID2} --device\` and \`splates creds request ${APP_KEY2} --device\`, with how to make the App: ${NEW_APP_PAGE}, Webhook off, Contents read and write alone, then the App ID and a generated private key.`,
+    optional: true,
+    after: [],
+    fields: [
+      {
+        kind: "cred",
+        name: APP_ID2,
+        label: "App ID",
+        help: `[Make a GitHub App](${NEW_APP_PAGE}) with Webhook off and Repository permissions **Contents: Read and write** alone, only on this account; its App ID is on its General page.`
+      },
+      {
+        kind: "cred",
+        name: APP_KEY2,
+        label: "Private key",
+        help: "Generate a private key at the foot of its General page, and paste the whole `.pem` file."
+      }
+    ],
+    doing: "Asking GitHub for the App…",
+    submit: async (machine) => {
+      const app = await keptApp(machine);
+      if (app === null) {
+        throw new Error("Paste the App ID and its private key first.");
+      }
+      const about = await app.about().catch(() => {
+        throw new Error("GitHub does not know that App ID with that key: paste both again, from the same App.");
+      });
+      const more = Object.keys(about.permissions).filter((each) => each !== "contents" && each !== "metadata");
+      if (more.length > 0) {
+        throw new Error(`The App may do more than push contents (${more.join(", ")}): take those permissions off on its page, then press Next.`);
+      }
+    },
+    check: async ({ device }) => await device.get(APP_ID2) !== undefined && await device.get(APP_KEY2) !== undefined,
+    undo: {
+      removes: async () => [],
+      leaves: async (machine) => [
+        `The App itself: delete it at the foot of ${await appSettings(machine)}.`
+      ],
+      run: async () => {}
+    }
+  };
+  const installStep = {
+    id: "github-install",
+    title: "Install the App on this repository",
+    why: "The App mints tokens only for a repository it is installed on.",
+    user: "Install the App from its page on GitHub, picking **Only select repositories** and this project's repository alone, then press Next, which links the page if it is not installed yet.",
+    agent: "Run `splates setup github-install`, whose problem names the App's install page, and have the user install it there on this repository alone.",
+    notDone: "The App is not installed on this repository yet: install it, then press Next.",
+    optional: true,
+    after: [appStep],
+    check: async (machine) => {
+      const app = await keptApp(machine);
+      if (app === null) {
+        return false;
+      }
+      const repo = await projectRepo(machine);
+      if (await app.installed(repo)) {
+        return true;
+      }
+      const { slug } = await app.about();
+      throw new Error(`Not installed on ${repo.owner}/${repo.name}: install it from https://github.com/apps/${slug}/installations/new`);
+    },
+    undo: {
+      removes: async (machine) => {
+        const { owner, name } = await projectRepo(machine);
+        return [
+          `The App's installation on ${owner}/${name}, and with it every repository it was installed on`
+        ];
+      },
+      run: async (machine) => {
+        const app = await keptApp(machine);
+        if (app !== null) {
+          await app.uninstall(await projectRepo(machine));
+        }
+      }
+    }
+  };
+  const rulesetStep = {
+    id: "github-ruleset",
+    title: "Keep the App to splates branches, and off tags",
+    why: `A ruleset is what keeps the App's tokens, which workers push with, to \`${PUSHED_PREFIX2}*\`: without one they could push trunk or a release tag.`,
+    user: RULESET_HOW,
+    agent: `Once the user agrees, make both with their own GitHub sign-in (\`gh auth status\`): \`gh api --method POST repos/<owner>/<repo>/rulesets --input -\` once with each of ${RULESETS.map((each) => `\`${JSON.stringify(each)}\``).join(" and ")}, the bypass being the Repository admin role. Then run \`splates setup github-ruleset\`.`,
+    notDone: "The rulesets do not cover trunk, every other branch and every tag yet: make them, then press Next.",
+    optional: true,
+    after: [installStep],
+    check: async (machine) => {
+      const app = await keptApp(machine);
+      if (app === null) {
+        return false;
+      }
+      const repo = await projectRepo(machine);
+      const { trunk } = await requireProject(machine).config();
+      const token = await app.token(repo);
+      const kept = async (branch) => {
+        const rules = await app.rules(repo, branch, token);
+        return PUSH_RULES.every((rule) => rules.includes(rule));
+      };
+      if (!await kept(trunk) || !await kept(PROBE_BRANCH)) {
+        return false;
+      }
+      if (await kept(`${PUSHED_PREFIX2}probe`)) {
+        throw new Error(`The ruleset covers \`${PUSHED_PREFIX2}*\` too: exclude it, or workers cannot push their branches.`);
+      }
+      return app.tagsRestricted(repo, PUSH_RULES, token);
+    },
+    undo: {
+      removes: async () => [],
+      leaves: async (machine) => {
+        const repo = await projectRepo(machine);
+        const path = `repos/${repo.owner}/${repo.name}/rulesets`;
+        const found = await keptRulesets(machine, repo).catch(() => []);
+        return found.length > 0 ? found.map(({ id, name }) => `The ruleset \`${name}\`: \`gh api -X DELETE ${path}/${id}\`, or in https://github.com/${repo.owner}/${repo.name}/settings/rules.`) : [
+          `The rulesets keeping the App to \`${PUSHED_PREFIX2}*\`: delete them in https://github.com/${repo.owner}/${repo.name}/settings/rules.`
+        ];
+      },
+      run: async () => {}
+    }
+  };
+  const pushStep = {
+    id: "github-push",
+    title: "Turn pushing on",
+    why: "With a remote named, each task's branch is pushed after every commit and checkpoint, and trunk becomes the remote's, which only `splates server` pushes.",
+    user: 'Add `remote: "origin"` to this project\'s `splates.config.ts` and merge it, as a task, then press Next.',
+    agent: 'In a task of its own, add `remote: "origin"` to `splates.config.ts` and merge it; then run `splates setup github-push`.',
+    notDone: "`splates.config.ts` names no `remote` yet: add it, merge it, then press Next.",
+    optional: true,
+    after: [rulesetStep],
+    check: async (machine) => (await requireProject(machine).config()).remote !== null,
+    undo: {
+      removes: async () => [],
+      leaves: async () => [
+        "`remote` stays in `splates.config.ts`: land a change that takes it out to stop pushing."
+      ],
+      run: async () => {}
+    }
+  };
+  return {
+    id: "github",
+    title: "GitHub pushing",
+    purpose: "Push each landed task to GitHub through a GitHub App.",
+    steps: [appStep, installStep, rulesetStep, pushStep]
+  };
+}
+async function keptApp({
+  device,
+  fetch: fetch2
+}) {
+  const id = await device.get(APP_ID2);
+  const key = await device.get(APP_KEY2);
+  return id === undefined || key === undefined ? null : new GitHubApp2(id, key, { fetch: fetch2 });
+}
+async function appSettings(machine) {
+  const about = await (await keptApp(machine))?.about().catch(() => null);
+  if (about === null || about === undefined) {
+    return "https://github.com/settings/apps";
+  }
+  const owner = about.owner?.type === "Organization" ? `organizations/${about.owner.login}/` : "";
+  return `https://github.com/${owner}settings/apps/${about.slug}/advanced`;
+}
+async function keptRulesets(machine, repo) {
+  const app = await keptApp(machine);
+  if (app === null) {
+    return [];
+  }
+  const names = new Set(RULESETS.map((each) => each.name));
+  const listed = await app.rulesets(repo, await app.token(repo));
+  return listed.flatMap(({ id, name }) => name !== undefined && names.has(name) ? [{ id, name }] : []);
+}
+function requireProject({ project }) {
+  if (project === undefined) {
+    throw new Error("No project to check: open Setup from a project, or run `splates setup` in its repository.");
+  }
+  return project;
+}
+async function projectRepo(machine) {
+  const project = requireProject(machine);
+  const remote = (await project.config()).remote ?? DEFAULT_REMOTE;
+  const url = await project.remoteUrl(remote);
+  if (url === null) {
+    throw new Error(`This repository has no remote \`${remote}\`.`);
+  }
+  const repo = githubRepo2(url);
+  if (repo === null) {
+    throw new Error(`\`${remote}\` is not on github.com, where the App pushes: ${url}`);
+  }
+  return repo;
+}
+
+// setup/area-native.ts
+async function rosterAgents({ fs, home }) {
+  const roster = Roster2.in(new FsStorage2(home, fs));
+  return await fs.exists(`${home}/agents.json`) ? roster.agents() : [];
+}
+var PROBE_MS = 1e4;
+var CLIS = {
+  claude: {
+    name: "Claude",
+    install: "curl -fsSL https://claude.ai/install.sh | bash",
+    signedIn: { args: ["auth", "status"] },
+    signIn: "claude",
+    signOut: "run `claude auth logout`",
+    uninstall: "rm -f ~/.local/bin/claude && rm -rf ~/.local/share/claude"
+  },
+  codex: {
+    name: "Codex",
+    install: "npm install --global @openai/codex",
+    signedIn: { args: ["login", "status"] },
+    signIn: "codex",
+    signOut: "run `codex logout`",
+    uninstall: "npm uninstall --global @openai/codex"
+  },
+  kimi: {
+    name: "Kimi",
+    command: KIMI_CLI2,
+    install: "curl -fsSL https://code.kimi.com/kimi-code/install.sh | bash",
+    signedIn: { args: ["provider", "list"], says: "managed:kimi-code" },
+    signIn: "kimi login",
+    signOut: "run `kimi` and type `/logout` in it",
+    uninstall: "rm -f ~/.kimi-code/bin/kimi"
+  }
+};
+var CLAUDE_AREA = agentJourney("claude");
+var CODEX_AREA = agentJourney("codex");
+var KIMI_AREA = agentJourney("kimi");
+function agentJourney(id) {
+  const { name, install, signIn: login, signOut, uninstall } = CLIS[id];
+  const signIn = {
+    id: `${id}-signin`,
+    title: `Install and sign in to ${name}`,
+    why: `splates starts ${name} through its own CLI, which has to be installed and signed in on this machine.`,
+    user: `Press Next and splates checks that \`${id}\` answers and is signed in. If it is not, install it with \`${install}\`, then run \`${login}\` once to sign in.`,
+    agent: `Help set up only ${name}: check \`${id} --version\` and its sign-in status, install it with \`${install}\` if needed, and have the user run \`${login}\` once to sign in. Never collect credentials in chat or send a test prompt.`,
+    optional: true,
+    after: [],
+    doing: `Checking that ${id} answers and is signed in…`,
+    check: async (machine) => await probe(machine, id) === "ready",
+    submit: async (machine) => {
+      switch (await probe(machine, id)) {
+        case "missing":
+          throw new Error(`${name} is not installed here: install it with ${install}, then run ${login} once to sign in.`);
+        case "signed-out":
+          throw new Error(`${name} is installed but not signed in: run ${login} once to sign in.`);
+        case "ready":
+          return;
+      }
+    },
+    undo: {
+      removes: async () => [],
+      leaves: async () => [
+        `${name} stays signed in: ${signOut} to sign out.`,
+        `${name} stays installed: run \`${uninstall}\` to remove it.`
+      ],
+      run: async () => {}
+    }
+  };
+  const models = {
+    id: `${id}-models`,
+    title: `Choose ${name} models`,
+    why: `splates uses the models ticked here for ${name} when assigning work. Ticking one does not prove your account can run it.`,
+    user: "Tick the models you can use.",
+    agent: `Offer only the default ${id} models; Next writes the ${id} entry of ~/.splates/agents.json, keeping other agents, launch arguments and models. Do not run paid prompts or evals.`,
+    optional: true,
+    after: [signIn],
+    get fields() {
+      return modelFields(id);
+    },
+    check: async (machine) => (await rosterAgents(machine)).some((agent) => agent.id === id && agent.models.length > 0),
+    submit: async ({ fs, home }, answers) => {
+      const chosen = chosenModels(id, answers);
+      if (chosen.length === 0) {
+        throw new Error("Tick at least one model.");
+      }
+      await Roster2.in(new FsStorage2(home, fs)).choose(id, chosen);
+    },
+    undo: {
+      removes: async (machine) => {
+        const agent = (await rosterAgents(machine)).find((each) => each.id === id);
+        const models = (agent?.models ?? []).map((model) => model.name);
+        return [
+          `${name} on the roster in \`${machine.home}/agents.json\`${models.length === 0 ? "" : `, running ${models.join(", ")}`}`
+        ];
+      },
+      run: ({ fs, home }) => Roster2.in(new FsStorage2(home, fs)).remove(id)
+    }
+  };
+  return {
+    id,
+    title: name,
+    purpose: `Run agents on ${name}, signed in on this machine.`,
+    steps: [signIn, models]
+  };
+}
+function modelField(id, model) {
+  return `${id}-model-${model}`;
+}
+function modelFields(id) {
+  const agent = DEFAULT_AGENTS2.find((each) => each.id === id);
+  return (agent?.models ?? []).map((model) => ({
+    kind: "yes-no",
+    name: modelField(id, model.id),
+    label: `${model.name}: ${model.strengths}`
+  }));
+}
+function chosenModels(id, answers) {
+  const agent = DEFAULT_AGENTS2.find((each) => each.id === id);
+  return (agent?.models ?? []).filter((model) => answers[modelField(id, model.id)] === true).map((model) => model.id);
+}
+async function probe({ ps }, id) {
+  if (ps === undefined) {
+    return "missing";
+  }
+  const { command = [id], signedIn } = CLIS[id];
+  const run = (args) => ps.spawnCapture([...command, ...args], { timeoutMs: PROBE_MS }).catch(() => null);
+  if ((await run(["--version"]))?.exitCode !== 0) {
+    return "missing";
+  }
+  const status = await run(signedIn.args);
+  return status?.exitCode === 0 && (signedIn.says === undefined || status.stdout.includes(signedIn.says)) ? "ready" : "signed-out";
+}
+
+// setup/area-opencode.ts
+var OPENCODE_GO_KEY = "OPENCODE_GO_API_KEY";
+var CONSOLE = "https://opencode.ai/auth";
+var UNINSTALL = "npm uninstall --global @opencode/cli";
+var LOGOUT = "opencode auth logout";
+var OPENCODE_AREA = openCodeArea();
+function openCodeArea() {
+  const installStep = {
+    id: "opencode-install",
+    title: "Install OpenCode",
+    why: "OpenCode runs your OpenCode Go models beside the other agents.",
+    user: "OpenCode is not on this machine yet. Next installs it with npm.",
+    agent: "Press Next on the page, or run `npm install --global @opencode/cli@latest`. Do not start a paid conversation or edit the roster.",
+    optional: true,
+    after: [],
+    check: async (machine) => await native(machine).version() !== null,
+    submit: async (machine) => {
+      await native(machine).install();
+    },
+    doing: "Installing OpenCode with npm…",
+    undo: {
+      removes: async () => [],
+      leaves: async () => [
+        `OpenCode stays installed: run \`${UNINSTALL}\` to remove it.`
+      ],
+      run: async () => {}
+    },
+    notDone: "npm installed OpenCode, but splates cannot find it on its PATH. Restart `splates server`, then press Next."
+  };
+  const connectStep = {
+    id: "opencode-connect",
+    title: "Paste your OpenCode Go API key",
+    why: "splates keeps it for this device and hands it to OpenCode, which keeps its own copy.",
+    user: "Paste your OpenCode Go API key.",
+    agent: "Have the user paste the key into the page; never ask for it in chat or read native credential files.",
+    optional: true,
+    after: [installStep],
+    fields: [
+      {
+        kind: "cred",
+        name: OPENCODE_GO_KEY,
+        label: "OpenCode Go API key",
+        help: `Copy it from your Go workspace in the [OpenCode Console](${CONSOLE}).`
+      }
+    ],
+    check: async (machine) => await machine.device.get(OPENCODE_GO_KEY) !== undefined && await native(machine).connected(),
+    submit: async (machine) => {
+      const opencode = native(machine);
+      const key = await machine.device.get(OPENCODE_GO_KEY);
+      if (key !== undefined && !await opencode.connected()) {
+        await opencode.login(key);
+      }
+      await opencode.handshake();
+    },
+    doing: "Connecting OpenCode to Go…",
+    undo: {
+      removes: async () => ["The OpenCode Go API key kept on this device"],
+      leaves: async () => [
+        `OpenCode keeps its own copy of the key: run \`${LOGOUT}\` and pick OpenCode Go to remove it.`,
+        `The key still works: delete it in the [OpenCode Console](${CONSOLE}) if you no longer want it.`
+      ],
+      run: async () => {}
+    },
+    notDone: "OpenCode still lists no Go key. Paste it again, then press Next."
+  };
+  const modelsStep = {
+    id: "opencode-models",
+    title: "Choose your models",
+    why: `Turn **Use balance** off in the [OpenCode Console](${CONSOLE}), so conversations stay on your Go plan.`,
+    user: "Pick a main and an auxiliary model.",
+    agent: "Have the user pick on the page; no prompts or credential exports.",
+    optional: true,
+    after: [connectStep],
+    fields: [
+      {
+        kind: "choice",
+        name: "model",
+        label: "Main model",
+        options: (machine) => models(machine, "model")
+      },
+      {
+        kind: "choice",
+        name: "auxiliary",
+        label: "Auxiliary model, for titles",
+        options: (machine) => models(machine, "auxiliary")
+      },
+      {
+        kind: "yes-no",
+        name: "balanceOff",
+        label: "Use balance is off in my OpenCode Console"
+      }
+    ],
+    check: async (machine) => await native(machine).models.recipes.stored() !== null,
+    submit: async (machine, answers) => {
+      if (answers.balanceOff !== true) {
+        throw new Error("Turn Use balance off in your OpenCode Console first, then say so here.");
+      }
+      await native(machine).choose({
+        model: String(answers.model),
+        auxiliary: String(answers.auxiliary)
+      });
+    },
+    doing: "Saving your models…",
+    undo: {
+      removes: async (machine) => {
+        const recipe = await native(machine).models.recipes.stored().catch(() => null);
+        const models = recipe === null ? "" : `, running ${recipe.model} and ${recipe.auxiliary}`;
+        return [
+          `OpenCode on the roster in \`${machine.home}/agents.json\`${models}`
+        ];
+      },
+      run: (machine) => native(machine).disable()
+    }
+  };
+  const readyStep = {
+    id: "opencode-ready",
+    title: "Check OpenCode",
+    why: "Makes sure OpenCode runs your models before your first conversation.",
+    user: "Next checks your models with OpenCode, without sending a prompt.",
+    agent: "Press Finish on the page. Metadata and ACP initialize only; never send a paid test prompt.",
+    optional: true,
+    after: [modelsStep],
+    check: async (machine) => native(machine).ready(),
+    submit: async (machine) => {
+      await native(machine).verify();
+    },
+    doing: "Checking OpenCode…"
+  };
+  return {
+    id: "opencode",
+    title: "OpenCode",
+    purpose: "Run agents on OpenCode, the cheapest way to start.",
+    steps: [installStep, connectStep, modelsStep, readyStep]
+  };
+}
+function native(machine) {
+  if (machine.opencode === undefined) {
+    throw new Error("OpenCode setup runs only under `splates server`.");
+  }
+  return machine.opencode;
+}
+async function models(machine, which) {
+  const opencode = native(machine);
+  const listed = await opencode.models.catalog();
+  const saved = await opencode.models.recipes.stored().catch(() => null);
+  const first = saved?.[which];
+  return [
+    ...listed.filter((id) => id === first),
+    ...listed.filter((id) => id !== first)
+  ].map((id) => ({ value: id, label: id.replace(/^opencode-go\//, "") }));
+}
+
+// setup/area-remote.ts
+import { Credentials as Credentials2 } from "../../core/creds/index.js";
+import { MemoryLogger } from "../../core/log/index.js";
+var REMOTE_ACCESS_AREA = remoteAccessArea();
+function remoteAccessArea() {
+  const tokenStep = {
+    id: "cloudflare-token",
+    title: "Give splates a Cloudflare API token",
+    why: "To reach `splates server` from your phone or another computer, splates makes a Cloudflare tunnel with Cloudflare Access in front, through Cloudflare's API.",
+    user: `Create a [Cloudflare API token](${TOKENS_PAGE2}) with ${TOKEN_PERMISSIONS2.join(", ")}, for your account and your zone, and paste it here. Skip to keep \`splates server\` on this machine only, or to run your own \`TunnelProvider\` from \`splates.config.ts\`.`,
+    agent: `Request it with \`splates creds request ${API_TOKEN2} --device\`, with how to make it, or let \`splates tunnel setup\` request it.`,
+    optional: true,
+    after: [],
+    fields: [
+      {
+        kind: "cred",
+        name: API_TOKEN2,
+        label: "Cloudflare API token",
+        help: tokenInstructions2("your host")
+      }
+    ],
+    check: async ({ device }) => await device.get(API_TOKEN2) !== undefined,
+    undo: {
+      removes: async () => [],
+      leaves: async () => [
+        `The API token itself: delete it in [Cloudflare's API tokens](${TOKENS_PAGE2}).`,
+        "The account's Zero Trust organization, which `splates tunnel setup` may have made, stays: it costs nothing on its own."
+      ],
+      run: async () => {}
+    }
+  };
+  const tunnelStep = {
+    id: "tunnel",
+    title: "Make the tunnel",
+    why: "The tunnel carries a host name of yours to `splates server`, and Access lets in only the emails you name.",
+    user: "Pick the host name, in a zone of your account, and the emails Access lets in.",
+    agent: "Run `splates tunnel setup <host> --email <emails>`, adding `--team <name>` when the account has no Zero Trust organization yet.",
+    optional: true,
+    after: [tokenStep],
+    uses: [API_TOKEN2],
+    fields: [
+      {
+        kind: "text",
+        name: "host",
+        label: "Host name",
+        placeholder: "splates.example.com"
+      },
+      {
+        kind: "text",
+        name: "email",
+        label: "Emails Access lets in, comma separated",
+        placeholder: "me@example.com"
+      },
+      {
+        kind: "text",
+        name: "team",
+        label: "Zero Trust team name, only if your account has none yet (for <team>.cloudflareaccess.com)",
+        optional: true
+      }
+    ],
+    doing: "Making the tunnel, its DNS record and the Access application in Cloudflare…",
+    submit: async (machine, answers) => {
+      const { fs, home, device } = machine;
+      try {
+        await tunnelSetup2({
+          host: String(answers.host),
+          email: String(answers.email),
+          team: String(answers.team ?? ""),
+          name: "splates",
+          creds: {
+            credentials: new Credentials2([device]),
+            request: async () => null,
+            save: async (name, value) => {
+              await device.set(name, value.trim());
+              return "device";
+            }
+          },
+          task: null,
+          saved: SavedTunnel2.in(new FsStorage2(`${home}`, fs), device),
+          log: new MemoryLogger,
+          fetch: machine.fetch
+        });
+      } catch (error) {
+        throw new Error(plain(error));
+      }
+    },
+    check: async (machine) => await savedTunnel(machine) !== null,
+    undo: {
+      removes: async (machine) => {
+        const host = (await savedTunnel(machine))?.host ?? "the host";
+        return [
+          `The tunnel to ${host}, and the DNS record routing ${host} to it`,
+          `The Access application in front of ${host}, and its policy`,
+          "The workers' Access policy and its service tokens: workers joined through the tunnel lose their access",
+          "Each slot's tunnel, and the Access application in front of every slot"
+        ];
+      },
+      refused: async ({ removeTunnel }) => removeTunnel === undefined ? "Open Setup from a project to remove the tunnel: its API token is read through the project's creds." : null,
+      confirm: async (machine) => (await savedTunnel(machine))?.host ?? null,
+      run: async ({ removeTunnel }) => {
+        if (removeTunnel === undefined) {
+          throw new Error("No project to remove the tunnel from.");
+        }
+        await removeTunnel();
+      }
+    }
+  };
+  const accessStep = {
+    id: "access",
+    title: "Check that Access lets only you in",
+    why: "Access is the one thing between the internet and agents that run commands on this machine.",
+    user: "Open the host on your phone and sign in with an email you named; restart `splates server` first if it ran before the tunnel was made, then press Next.",
+    notDone: "Access did not send a stranger to its sign-in yet: restart `splates server` if it ran before the tunnel was made, then press Next.",
+    agent: "Run `splates tunnel status`, then have the user open the host and sign in, and check this step again.",
+    optional: true,
+    after: [tunnelStep],
+    check: async (machine) => {
+      const saved = await savedTunnel(machine);
+      return saved !== null && guarded(saved, machine.fetch ?? fetch);
+    }
+  };
+  const portsStep = {
+    id: "ports-host",
+    title: "Open a task's ports from anywhere",
+    why: "With a wildcard base host saved, each port a task listens on opens at `https://<task>-<port>.<base>`, behind the same Access, so you can try its server on your phone.",
+    user: "Pick a base host in your zone, such as `ports.example.com`. Routing its wildcard `*.ports.example.com` to `splates server`, its DNS and TLS included, is yours to do; a running server picks the base up only on restart.",
+    agent: "Have the user restart `splates server` with `--ports-host <base>`, which saves the base for this machine, then check this step again.",
+    optional: true,
+    after: [accessStep],
+    fields: [
+      {
+        kind: "text",
+        name: "base",
+        label: "Base host",
+        placeholder: "ports.example.com"
+      }
+    ],
+    submit: async ({ fs, home }, answers) => {
+      let base;
+      try {
+        base = portsHostFlag2(String(answers.base));
+      } catch (error) {
+        throw new Error(plain(error));
+      }
+      if (typeof base !== "string") {
+        throw new Error("Give a base host, such as ports.example.com.");
+      }
+      await SavedPortsHost2.in(new FsStorage2(`${home}`, fs)).save(base);
+    },
+    check: async ({ fs, home }) => await SavedPortsHost2.in(new FsStorage2(`${home}`, fs)).read() !== null,
+    undo: {
+      removes: async ({ fs, home }) => {
+        const base = await SavedPortsHost2.in(new FsStorage2(`${home}`, fs)).read();
+        return [
+          `The saved base host ${base}, which a running \`splates server\` serves until it restarts`
+        ];
+      },
+      leaves: async ({ fs, home }) => {
+        const base = await SavedPortsHost2.in(new FsStorage2(`${home}`, fs)).read();
+        return [
+          `The DNS and TLS routing \`*.${base}\` to \`splates server\`, which you made: remove it where you made it.`
+        ];
+      },
+      run: async ({ fs, home }) => {
+        await SavedPortsHost2.in(new FsStorage2(`${home}`, fs)).save(null);
+      }
+    }
+  };
+  return {
+    id: "remote-access",
+    title: "Remote access",
+    purpose: "Reach splates server from your phone or another computer.",
+    steps: [tokenStep, tunnelStep, accessStep, portsStep]
+  };
+}
+async function savedTunnel({
+  fs,
+  home,
+  device
+}) {
+  const saved = SavedTunnel2.in(new FsStorage2(`${home}`, fs), device);
+  const record = await saved.read();
+  return record !== null && await saved.token() !== undefined ? record : null;
+}
+var ACCESS_TIMEOUT = 5000;
+async function guarded({ host, team }, fetch2) {
+  const response = await fetch2(`https://${host}/`, {
+    redirect: "manual",
+    signal: AbortSignal.timeout(ACCESS_TIMEOUT)
+  }).catch((error) => {
+    throw new Error(`https://${host} did not answer: ${error.message}`);
+  });
+  const location = response.headers.get("location") ?? "";
+  if (location.includes(`${team}.cloudflareaccess.com`)) {
+    return true;
+  }
+  if (response.ok) {
+    throw new Error(`https://${host} served the page without a sign-in: Access is not in front of it`);
+  }
+  return false;
+}
+function plain(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (message.includes("no Zero Trust organization yet")) {
+    return "The account has no Zero Trust organization yet: give a team name below, for <team>.cloudflareaccess.com, to make one.";
+  }
+  return message;
+}
+
+// setup/area-replica.ts
+import { Duration, timeAgo } from "../../core/time/index.js";
+var REPLICA_AREA = replicaArea();
+function replicaArea() {
+  const placeStep = {
+    id: "replica-place",
+    title: "Name a replica",
+    why: "A replica is a copy of this project's records a few seconds behind every change, in a bucket or a folder, so they outlive this machine and can move to another.",
+    user: 'Add a `replica` to this project\'s `splates.config.ts` and merge it, as a task, then restart `splates server` and press Next. For a bucket of any S3-compatible store, `replica: { provider: "s3", endpoint: "https://<region>.digitaloceanspaces.com", bucket: "<bucket>" }`, adding `prefix` for projects that share a bucket; for a folder, `replica: { provider: "dir", path: "/Volumes/Backup/splates" }`.',
+    agent: "In a task of its own, add the `replica` the user names to `splates.config.ts` and merge it; then have the user restart `splates server`, and run `splates setup replica-place`.",
+    notDone: "`splates.config.ts` names no `replica` yet: add it, merge it, then press Next.",
+    optional: true,
+    after: [],
+    detail: async (machine) => {
+      const place = (await projectOf2(machine).config()).replica;
+      return place === null ? null : `Named: \`${whereIs(place)}\`.`;
+    },
+    check: async (machine) => (await projectOf2(machine).config()).replica !== null,
+    undo: {
+      removes: async () => [],
+      leaves: async () => [
+        "`replica` in this project's `splates.config.ts`: take it out in a task and merge it, then restart `splates server`, or it keeps copying.",
+        "The copy already made, in the bucket or folder: delete it there if you no longer want it."
+      ],
+      run: async () => {}
+    }
+  };
+  const credsStep = {
+    id: "replica-creds",
+    title: "Give splates the bucket's key",
+    why: "splates signs each request to the bucket with a key and secret of yours, kept in the project's creds and never shown again.",
+    user: `In the store's control panel, make an access key limited to the bucket if it can be, and fill \`${REPLICA_ACCESS_KEY2}\` with its key id and \`${REPLICA_SECRET_KEY2}\` with its secret on the [Creds page](#creds). The replica starts as soon as both are saved; then press Next.`,
+    agent: `\`splates server\` asks for \`${REPLICA_ACCESS_KEY2}\` and \`${REPLICA_SECRET_KEY2}\` on the Creds page once it starts the replica: have the user fill both there, then run \`splates setup replica-creds\`.`,
+    notDone: `\`${REPLICA_ACCESS_KEY2}\` and \`${REPLICA_SECRET_KEY2}\` are not both saved yet: fill them on the Creds page, then press Next.`,
+    optional: true,
+    after: [placeStep],
+    shown: async (machine) => (await projectOf2(machine).config()).replica?.provider === "s3",
+    check: async (machine) => {
+      const { kept } = projectOf2(machine);
+      if (kept === undefined) {
+        throw new Error(UNREAD2);
+      }
+      return await kept(REPLICA_ACCESS_KEY2) && await kept(REPLICA_SECRET_KEY2);
+    },
+    undo: {
+      removes: async () => [],
+      leaves: async () => [
+        `\`${REPLICA_ACCESS_KEY2}\` and \`${REPLICA_SECRET_KEY2}\` in the project's creds: forget them on the Creds page, and delete the key in the store's control panel.`
+      ],
+      run: async () => {}
+    }
+  };
+  const statusStep = {
+    id: "replica",
+    title: "Keep the replica caught up",
+    why: "A replica is only as good as the last time it held every change.",
+    user: "Nothing to do while it keeps up: this says where it stands. Restart `splates server` if it ran before the replica was named.",
+    agent: "Run `splates replica status`; when it is failing, put right what it says, then run `splates setup replica`.",
+    notDone: "The replica has not caught up yet: put right what it says, or wait for it, then press Next.",
+    optional: true,
+    after: [placeStep],
+    detail: async (machine) => {
+      const project = projectOf2(machine);
+      const place = (await project.config()).replica;
+      if (place === null) {
+        return null;
+      }
+      return standing(whereIs(place), await project.replica?.() ?? null, Date.now());
+    },
+    warning: async (machine) => {
+      const error = (await projectOf2(machine).replica?.())?.error ?? null;
+      return error === null ? null : failing(error);
+    },
+    check: async (machine) => {
+      const { replica } = projectOf2(machine);
+      if (replica === undefined) {
+        throw new Error(UNREAD2);
+      }
+      const status = await replica();
+      return status?.caughtUpAt != null && status.error === null;
+    }
+  };
+  return {
+    id: "replica",
+    title: "Replica",
+    purpose: "Keep a copy of your tasks and conversations in a bucket you own.",
+    steps: [placeStep, credsStep, statusStep]
+  };
+}
+var UNREAD2 = "No project to check: open Setup from a project, or run `splates setup` in its repository.";
+function projectOf2(machine) {
+  if (machine.project === undefined) {
+    throw new Error(UNREAD2);
+  }
+  return machine.project;
+}
+function whereIs(place) {
+  if (place.provider === "dir") {
+    return place.path;
+  }
+  const prefix = place.prefix?.replace(/^\/+|\/+$/g, "") ?? "";
+  return `s3://${place.bucket}${prefix === "" ? "" : `/${prefix}`}`;
+}
+function standing(where, status, now) {
+  if (status === null) {
+    return `\`${where}\` has not started: \`splates server\` starts it as it serves the project.`;
+  }
+  const ago = (at) => timeAgo(Duration.ms(now - at));
+  const { caughtUpAt, pending, behindSince } = status;
+  const caught = caughtUpAt === null ? "never caught up yet" : `caught up ${ago(caughtUpAt)}`;
+  const behind = behindSince === null ? "nothing waits" : `${pending} change${pending === 1 ? " waits" : "s wait"}, the oldest from ${ago(behindSince)}`;
+  return `\`${status.replica}\`: ${caught}; ${behind}.`;
+}
+function failing(error) {
+  if (error.startsWith(`no ${REPLICA_ACCESS_KEY2}`)) {
+    return `It has no key for the bucket yet: fill \`${REPLICA_ACCESS_KEY2}\` and \`${REPLICA_SECRET_KEY2}\` on the [Creds page](#creds), and it starts at once.`;
+  }
+  if (error.includes("holds the records of another server")) {
+    return `It refuses to write: ${error}.`;
+  }
+  return `The last batch failed: ${error}. It is tried again on its own, waiting up to five minutes.`;
+}
+
+// setup/area-workers.ts
+var WORKERS_AREA = workersArea();
+function workersArea() {
+  const localStep = {
+    id: "local-worker",
+    title: "Make this Mac a worker",
+    why: "Agents run on this Mac's own worker, as many at once as are started.",
+    user: "Press Next: this Mac takes agents unless its worker was removed.",
+    agent: "Run `splates worker drain local --undo`, which turns this Mac's own worker back on if it was removed. Check `splates worker list`.",
+    optional: true,
+    after: [],
+    check: async (machine) => {
+      const local = (await pool(machine)).find((worker) => worker.id === LOCAL_WORKER2);
+      return local !== undefined && !local.draining && !local.removing;
+    },
+    notDone: "This Mac is not taking agents yet: run `splates worker drain local --undo`, then press Next.",
+    undo: {
+      removes: async () => [
+        `This Mac's worker, \`${LOCAL_WORKER2}\`, its agents running to their end first`
+      ],
+      refused: noRemoving,
+      run: (machine) => removeWorkers(machine, (each) => each.id === LOCAL_WORKER2)
+    }
+  };
+  return {
+    id: "workers",
+    title: "Workers",
+    purpose: "Choose which machines run agents.",
+    steps: [localStep]
+  };
+}
+async function pool(machine) {
+  if (machine.workers === undefined) {
+    throw new Error("no `splates server` to ask which workers it has: start one, or give --dev");
+  }
+  return machine.workers();
+}
+async function noRemoving(machine) {
+  return machine.removeWorker === undefined ? "No `splates server` to remove workers from: start one, or give --dev." : null;
+}
+async function removeWorkers(machine, which) {
+  if (machine.removeWorker === undefined) {
+    throw new Error("no `splates server` to remove workers from");
+  }
+  for (const worker of await pool(machine)) {
+    if (which(worker) && !worker.removing) {
+      await machine.removeWorker(worker.id);
+    }
+  }
+}
+
+// setup/areas.ts
+var SETUP_AREAS2 = [
+  OPENCODE_AREA,
+  REMOTE_ACCESS_AREA,
+  WORKERS_AREA,
+  REPLICA_AREA,
+  DICTATION_AREA,
+  DROPLET_AREA,
+  EVALS_AREA,
+  AUTO_PICK_AREA,
+  GITHUB_AREA,
+  CLAUDE_AREA,
+  CODEX_AREA,
+  KIMI_AREA
+];
+// setup/opencode.ts
+import { stripVTControlCharacters } from "node:util";
+import * as acp from "@agentclientprotocol/sdk";
+
+// setup/opencode-model-error.ts
+class OpenCodeModelError extends Error {
+}
+
+// setup/opencode-models.ts
+import { z as z2 } from "zod";
+
+// setup/opencode-recipe.ts
+import { z } from "zod";
+class OpenCodeRecipes {
+  deps;
+  roster;
+  constructor(deps) {
+    this.deps = deps;
+    this.roster = deps.roster ?? Roster2.in(new FsStorage2(deps.home, deps.fs));
+  }
+  async stored() {
+    await this.checkLink();
+    return this.from(await this.roster.read());
+  }
+  from(file) {
+    if (file === null) {
+      return null;
+    }
+    const raw = JSON.stringify(file);
+    const agents = file.agents;
+    const agent = agents.find((entry) => entry.id === "opencode");
+    if (!agent) {
+      return null;
+    }
+    if (!managedArgv(agent.argv) || agent.argv.length !== 5) {
+      throw new OpenCodeModelError("OpenCode has no supported setup recipe. Revisit model selection to repair it; custom commands are left untouched.");
+    }
+    const content = agent.argv[2]?.slice(contentPrefix.length) ?? "";
+    const config = recipeConfig.parse(JSON.parse(content));
+    const selection = {
+      model: config.model,
+      auxiliary: config.agents.title.model
+    };
+    if (Object.entries(config.agents).some(([name, entry]) => entry.model !== (name === "build" || name === "plan" ? selection.model : selection.auxiliary)) || !Object.values(selection).every((id) => agent.models.some((model) => model.id === id))) {
+      throw new OpenCodeModelError("The stored model recipe changed. Revisit model selection and review it again.");
+    }
+    return {
+      ...selection,
+      config,
+      env: {
+        OPENCODE_CONFIG_PROJECT_DISABLE: "1",
+        OPENCODE_CONFIG_CONTENT: content
+      },
+      raw
+    };
+  }
+  async unchanged(recipe, signal) {
+    signal.throwIfAborted();
+    if (await this.rawRoster() !== recipe.raw) {
+      throw new OpenCodeModelError("The roster changed during the check. Check configuration again.");
+    }
+  }
+  async disable(signal) {
+    const recipe = await this.stored();
+    if (!recipe) {
+      return;
+    }
+    await this.roster.update((file) => {
+      signal.throwIfAborted();
+      if (file === null || JSON.stringify(file) !== recipe.raw) {
+        throw new OpenCodeModelError("The roster changed during the check. Check configuration again.");
+      }
+      file.agents = file.agents.filter((entry) => entry.id !== "opencode");
+      return file;
+    });
+  }
+  async rawRoster() {
+    await this.checkLink();
+    const file = await this.roster.read();
+    return file === null ? null : JSON.stringify(file);
+  }
+  async checkLink() {
+    if (!this.deps.roster && await this.deps.fs.isSymlink(`${this.deps.home}/agents.json`)) {
+      throw new OpenCodeModelError("The roster is a symbolic link. Manage its target explicitly before using setup.");
+    }
+  }
+}
+function managedArgv(value) {
+  if (!Array.isArray(value)) {
+    return false;
+  }
+  return JSON.stringify(value) === JSON.stringify(["opencode", "acp"]) || value.length === 5 && value[0] === "env" && value[1] === projectOff && typeof value[2] === "string" && value[2].startsWith(contentPrefix) && value[3] === "opencode" && value[4] === "acp";
+}
+var projectOff = "OPENCODE_CONFIG_PROJECT_DISABLE=1";
+var contentPrefix = "OPENCODE_CONFIG_CONTENT=";
+var id = z.string().max(240).regex(/^opencode-go\/[A-Za-z0-9][A-Za-z0-9._:/-]*$/);
+var recipeConfig = z.object({
+  model: id,
+  default_agent: z.literal("build"),
+  warming: z.literal(false),
+  policies: z.tuple([
+    z.object({
+      action: z.literal("provider.use"),
+      resource: z.literal("*"),
+      effect: z.literal("deny")
+    }).strict(),
+    z.object({
+      action: z.literal("provider.use"),
+      resource: z.literal("opencode-go"),
+      effect: z.literal("allow")
+    }).strict()
+  ]),
+  agents: z.record(z.string(), z.object({ model: id }).strict()).and(z.object({
+    build: z.object({ model: id }),
+    title: z.object({ model: id })
+  }))
+}).strict();
+
+// setup/opencode-models.ts
+class OpenCodeModels {
+  deps;
+  metadata;
+  #catalog = null;
+  recipes;
+  constructor(deps, metadata) {
+    this.deps = deps;
+    this.metadata = metadata;
+    this.recipes = new OpenCodeRecipes(deps);
+  }
+  catalog() {
+    if (this.#catalog === null || Date.now() - this.#catalog.at > CATALOG_TTL) {
+      const models = this.discover(AbortSignal.timeout(15000)).then((models) => {
+        if (!models.length) {
+          throw new OpenCodeModelError("OpenCode lists no Go models.");
+        }
+        return models;
+      });
+      models.catch(() => {
+        this.#catalog = null;
+      });
+      this.#catalog = { models, at: Date.now() };
+    }
+    return this.#catalog.models;
+  }
+  invalidate() {
+    this.#catalog = null;
+  }
+  async save(selection, signal) {
+    if (this.deps.ps.platform === "win32") {
+      throw new OpenCodeModelError("This experiment launch recipe requires macOS or Linux.");
+    }
+    openCodeSelection.parse(selection);
+    this.invalidate();
+    const models = await this.catalog();
+    if (!models.includes(selection.model) || !models.includes(selection.auxiliary)) {
+      throw new OpenCodeModelError("A chosen model is no longer listed. Pick again.");
+    }
+    const config = recipeOf(selection);
+    const env = {
+      OPENCODE_CONFIG_PROJECT_DISABLE: "1",
+      OPENCODE_CONFIG_CONTENT: JSON.stringify(config)
+    };
+    await this.verify(selection, config, signal, env);
+    await this.recipes.rawRoster();
+    await this.recipes.roster.update((current) => {
+      const after = this.roster(current, selection, env);
+      signal.throwIfAborted();
+      return after;
+    });
+  }
+  async verifyStored(recipe, cwd, signal) {
+    const models = await this.discover(signal, recipe.env, cwd);
+    if (!models.includes(recipe.model) || !models.includes(recipe.auxiliary)) {
+      throw new OpenCodeModelError("A saved Go model is no longer listed. Go back to the models and pick again.");
+    }
+    await this.verify(recipe, recipe.config, signal, recipe.env, cwd);
+    await this.recipes.unchanged(recipe, signal);
+  }
+  async discover(signal, env, cwd) {
+    const text = await this.metadata.run(["models", "--standalone"], signal, env, cwd);
+    const lines = text.trim() ? text.trim().split(/\r?\n/) : [];
+    if (lines.length > 1e4 || lines.some((line) => !/^[A-Za-z0-9._-]+\/[A-Za-z0-9][A-Za-z0-9._:/-]*$/.test(line))) {
+      throw new OpenCodeModelError("unknown catalog");
+    }
+    if (env && lines.some((line) => !id.safeParse(line).success)) {
+      throw new OpenCodeModelError("OpenCode did not enforce the Go-only provider policy. Resolve its managed provider configuration, then press Try again.");
+    }
+    return [...new Set(lines.filter((line) => id.safeParse(line).success))];
+  }
+  async verify(selection, config, signal, env, cwd = `${this.deps.home}/setup-opencode`) {
+    const sources = entries.parse(JSON.parse(await this.metadata.run(["api", "config.get", "--standalone", "--param", `directory=${cwd}`], signal, env, cwd)));
+    let found = false;
+    for (const source of sources) {
+      if (source.type !== "document") {
+        continue;
+      }
+      const info = source.info;
+      if (JSON.stringify(info.policies) === JSON.stringify(config.policies) && sameModel(info.model, selection.model) && info.warming === false && info.default_agent === "build" && sameAgents(info.agents, config.agents) && !(typeof info.providers === "object" && info.providers !== null && ("opencode-go" in info.providers))) {
+        found = true;
+        continue;
+      }
+      const policies = info.policies;
+      const providers = info.providers;
+      if (Array.isArray(policies) && policies.some((policy) => typeof policy === "object" && policy !== null && ("action" in policy) && policy.action === "provider.use") || typeof providers === "object" && providers !== null && "opencode-go" in providers || found && (("model" in info) || ("agents" in info) || ("warming" in info) || ("default_agent" in info))) {
+        throw new OpenCodeModelError("Your own OpenCode configuration sets providers or models that override this setup. Remove them, then press Try again.");
+      }
+    }
+    if (!found) {
+      throw new OpenCodeModelError("OpenCode did not confirm the configuration. Update OpenCode, then press Try again.");
+    }
+  }
+  roster(current, selection, env) {
+    const value = current ?? {
+      format: 1,
+      agents: structuredClone(DEFAULT_AGENTS2)
+    };
+    const agents = value.agents;
+    let agent = agents.find((entry) => entry.id === "opencode");
+    if (agent && !managedArgv(agent.argv)) {
+      throw new OpenCodeModelError("Your roster's OpenCode entry has a launch command of its own, which Setup leaves alone. Remove it from agents.json, then press Try again.");
+    }
+    if (!agent) {
+      agent = { id: "opencode", name: "OpenCode Go", argv: [], models: [] };
+      agents.push(agent);
+    }
+    agent.argv = [
+      "env",
+      projectOff,
+      `${contentPrefix}${env.OPENCODE_CONFIG_CONTENT}`,
+      "opencode",
+      "acp"
+    ];
+    const models = agent.models;
+    for (const model of new Set([selection.model, selection.auxiliary])) {
+      if (!models.some((entry) => entry.id === model)) {
+        models.push({
+          id: model,
+          name: model,
+          strengths: "Explicit OpenCode Go selection",
+          cost: "Go subscription; access and billing confirmed in Console"
+        });
+      }
+    }
+    return value;
+  }
+}
+var CATALOG_TTL = 60000;
+var RECIPE_AGENTS = {
+  build: "model",
+  plan: "model",
+  title: "auxiliary"
+};
+function recipeOf(selection) {
+  return {
+    model: selection.model,
+    default_agent: "build",
+    warming: false,
+    policies: [
+      { action: "provider.use", resource: "*", effect: "deny" },
+      { action: "provider.use", resource: "opencode-go", effect: "allow" }
+    ],
+    agents: Object.fromEntries(Object.entries(RECIPE_AGENTS).map(([name, which]) => [
+      name,
+      { model: selection[which] }
+    ]))
+  };
+}
+function sameAgents(value, expected) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const echoed = value;
+  return Object.keys(echoed).length === Object.keys(expected).length && Object.entries(expected).every(([name, { model }]) => {
+    const agent = echoed[name];
+    return typeof agent === "object" && agent !== null && "model" in agent && sameModel(agent.model, model);
+  });
+}
+function sameModel(value, expected) {
+  return value === expected || typeof value === "object" && value !== null && "providerID" in value && "model" in value && `${value.providerID}/${value.model}` === expected;
+}
+var openCodeSelection = z2.object({ model: id, auxiliary: id });
+var entries = z2.array(z2.union([
+  z2.object({ type: z2.literal("directory"), path: z2.string() }),
+  z2.object({
+    type: z2.literal("document"),
+    info: z2.record(z2.string(), z2.unknown())
+  })
+]));
+
+// setup/opencode.ts
+var OPENCODE_INSTALL = [
+  "npm",
+  "install",
+  "--global",
+  "@opencode/cli@latest"
+];
+var OPENCODE_LOGIN = [
+  "opencode",
+  "auth",
+  "login",
+  "opencode-go",
+  "--method",
+  "key",
+  "--standalone"
+];
+
+class OpenCodeSetup2 {
+  deps;
+  models;
+  #verified = null;
+  constructor(deps) {
+    this.deps = deps;
+    this.models = new OpenCodeModels({ ...deps, roster: deps.agents }, {
+      run: (args, signal, env, cwd) => this.command(args, signal, env, cwd)
+    });
+  }
+  get cwd() {
+    return `${this.deps.home}/setup-opencode`;
+  }
+  async version() {
+    const output = await this.command(["--version"], AbortSignal.timeout(15000)).catch(() => null);
+    const version = output?.trim().replace(/^opencode v/, "") ?? "";
+    return /^\d+\.\d+\.\d+(?:[-+][\w.-]+)?$/.test(version) ? version : null;
+  }
+  async install() {
+    const result = await this.deps.ps.spawnCapture(OPENCODE_INSTALL, {
+      cwd: await this.prepare(),
+      timeoutMs: 10 * 60000,
+      stdin: ""
+    }).catch(() => null);
+    if (result === null) {
+      throw new Error("Could not run npm. Install Node.js, then press Try again.");
+    }
+    if (result.exitCode !== 0) {
+      throw new Error(`npm could not install OpenCode. Run \`${OPENCODE_INSTALL.join(" ")}\` in a terminal to see why.`);
+    }
+  }
+  async connected() {
+    const output = await this.command(["auth", "list", "--format", "json", "--standalone"], AbortSignal.timeout(15000)).catch(() => null);
+    try {
+      return output !== null && storedGo(JSON.parse(output));
+    } catch {
+      return false;
+    }
+  }
+  async login(key) {
+    const child = this.deps.ps.startOnTerminal([...OPENCODE_LOGIN], {
+      cwd: await this.prepare(),
+      cols: 120,
+      rows: 30,
+      env: { TERM: "xterm-256color" }
+    });
+    const decoder = new TextDecoder;
+    let screen = "";
+    let typed = false;
+    const timer = setTimeout(() => child.kill("SIGHUP"), 60000);
+    try {
+      (async () => {
+        for await (const bytes of child.output) {
+          screen += decoder.decode(bytes, { stream: true });
+          if (!typed && /API key/i.test(stripVTControlCharacters(screen))) {
+            typed = true;
+            child.write(new TextEncoder().encode(`${key}\r`));
+          }
+        }
+      })().catch(() => {});
+      const code = await child.exited;
+      if (code !== 0 || !typed) {
+        throw new Error("OpenCode did not take the key. Check it, then press Try again.");
+      }
+    } finally {
+      clearTimeout(timer);
+      child.close();
+    }
+    this.models.invalidate();
+  }
+  async handshake(cwd, env) {
+    const signal = AbortSignal.timeout(15000);
+    const child = this.deps.ps.start(["opencode", "acp"], {
+      cwd: cwd ?? await this.prepare(),
+      env,
+      signal,
+      timeoutMs: 15000
+    });
+    let aborted;
+    (async () => {
+      for await (const _bytes of child.stderr) {}
+    })().catch(() => {});
+    try {
+      const connection = new acp.ClientSideConnection(() => ({
+        sessionUpdate: async () => {},
+        requestPermission: async () => ({
+          outcome: { outcome: "cancelled" }
+        })
+      }), new AgentStream2({
+        pid: child.pid,
+        input: child.stdin,
+        output: framed2(child.stdout),
+        ack: () => {},
+        handle: null,
+        stderr: () => "",
+        exited: child.exited,
+        kill: () => child.kill()
+      }));
+      const response = await Promise.race([
+        connection.initialize({
+          protocolVersion: acp.PROTOCOL_VERSION,
+          clientCapabilities: {}
+        }),
+        child.exited.then(() => {
+          throw new Error("exited");
+        }),
+        new Promise((_, reject) => {
+          aborted = () => reject(signal.reason);
+          signal.addEventListener("abort", aborted, { once: true });
+        })
+      ]);
+      if (response.protocolVersion !== acp.PROTOCOL_VERSION) {
+        throw new Error("protocol version");
+      }
+    } catch {
+      throw new Error("OpenCode did not answer splates over ACP. Update OpenCode, then press Try again.");
+    } finally {
+      if (aborted !== undefined) {
+        signal.removeEventListener("abort", aborted);
+      }
+      child.kill();
+    }
+  }
+  async choose(selection) {
+    await this.prepare();
+    await this.models.save(selection, AbortSignal.timeout(60000));
+    await this.deps.roster?.();
+  }
+  async verify(cwd) {
+    const where = cwd ?? await this.prepare();
+    const recipe = await this.models.recipes.stored();
+    if (recipe === null) {
+      throw new OpenCodeModelError("Choose the models first.");
+    }
+    try {
+      const signal = AbortSignal.timeout(60000);
+      await this.models.verifyStored(recipe, where, signal);
+      await this.handshake(where, recipe.env);
+      await this.models.recipes.unchanged(recipe, signal);
+    } catch (error) {
+      throw error instanceof OpenCodeModelError ? error : new Error("OpenCode could not check the saved models. Press Try again.");
+    }
+    this.#verified = recipe.raw;
+    return { model: recipe.model, auxiliary: recipe.auxiliary };
+  }
+  async ready() {
+    return this.#verified !== null && await this.models.recipes.rawRoster() === this.#verified;
+  }
+  async disable() {
+    await this.models.recipes.disable(AbortSignal.timeout(15000));
+    this.models.invalidate();
+    this.#verified = null;
+    await this.deps.roster?.();
+  }
+  async prepare() {
+    await this.deps.fs.mkdir(this.cwd, { recursive: true });
+    return this.cwd;
+  }
+  async command(args, signal, env, cwd) {
+    signal.throwIfAborted();
+    const result = await this.deps.ps.spawnCapture(["opencode", ...args], {
+      cwd: cwd ?? await this.prepare(),
+      env,
+      signal,
+      timeoutMs: 15000,
+      stdin: ""
+    });
+    if (result.exitCode !== 0) {
+      throw new Error("command failed");
+    }
+    return stripVTControlCharacters(result.stdout);
+  }
+}
+function storedGo(value) {
+  return Array.isArray(value) && value.some((item) => typeof item === "object" && item !== null && item.id === "opencode-go" && Array.isArray(item.connections) && item.connections.some((entry) => typeof entry === "object" && entry !== null && ("type" in entry) && entry.type === "credential"));
+}
+// setup/opencode-routes.ts
+class OpenCodeSetupRoutes2 {
+  setup;
+  constructor(setup) {
+    this.setup = setup;
+  }
+  async conversation(cwd, start) {
+    let selection;
+    try {
+      selection = await this.setup.verify(cwd);
+    } catch (error) {
+      return refuse(400, "setup", problemOf(error));
+    }
+    return start(selection);
+  }
+  disable = async () => {
+    try {
+      await this.setup.disable();
+      return Response.json({});
+    } catch {
+      return refuse(400, "setup", "Could not turn OpenCode off: the roster's OpenCode entry was changed by hand, so Setup leaves it alone.");
+    }
+  };
+}
+function problemOf(error) {
+  return error instanceof OpenCodeModelError || error instanceof Error ? error.message : "OpenCode could not check the saved models.";
+}
+// setup/project.ts
+function setupProjectAt2(root, { fs, ps }, records = {}) {
+  const git = new Git(root, { fs, ps });
+  return {
+    ...records,
+    root,
+    config: () => loadConfig2(root, { fs, git }),
+    remoteUrl: (remote) => git.remoteUrl(remote)
+  };
+}
+// setup/step-problem.ts
+class StepProblem extends Error {
+}
+
+// setup/routes.ts
+class SetupRoutes2 {
+  #setupFor;
+  constructor(setupFor) {
+    this.#setupFor = setupFor;
+  }
+  read = async (request) => Response.json(await (await this.#setupFor(request)).read());
+  see = async (request) => {
+    const setup = await this.#setupFor(request);
+    await setup.see();
+    return Response.json(await setup.read());
+  };
+  next = async (request) => {
+    const step = idOf(request);
+    const { answers = {} } = await body(request);
+    if (!isAnswers(answers)) {
+      fail2("usage", "send the page's answers: { answers: { [field]: string | boolean } }", {
+        step
+      });
+    }
+    try {
+      return Response.json(await (await this.#setupFor(request)).submit(step, answers));
+    } catch (error) {
+      if (error instanceof StepProblem) {
+        return refuse(422, "step", error.message);
+      }
+      throw error;
+    }
+  };
+  undoPlan = async (request) => Response.json(await (await this.#setupFor(request)).undoPlan(idOf(request)));
+  undo = async (request) => {
+    const area = idOf(request);
+    const { confirm = null } = await body(request);
+    if (confirm !== null && typeof confirm !== "string") {
+      fail2("usage", "send { confirm: string } or nothing", { area });
+    }
+    try {
+      return Response.json(await (await this.#setupFor(request)).undo(area, confirm));
+    } catch (error) {
+      if (error instanceof StepProblem) {
+        return refuse(422, "undo", error.message);
+      }
+      throw error;
+    }
+  };
+}
+function idOf(request) {
+  return decodeURIComponent(new URL(request.url).pathname.split("/")[3] ?? "");
+}
+function isAnswers(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((each) => typeof each === "string" || typeof each === "boolean");
+}
+// setup/setup.ts
+import { z as z3 } from "zod";
+
+// setup/checks.ts
+async function listed(step, machine) {
+  return await step.shown?.(machine).catch(() => false) ?? true;
+}
+async function checked(step, machine) {
+  try {
+    return { done: await step.check(machine), problem: null };
+  } catch (error) {
+    return {
+      done: false,
+      problem: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+
+// setup/fields.ts
+async function fieldsOf(step, machine) {
+  const fields = [];
+  for (const field of await fieldsIn(step, machine).catch(() => [])) {
+    switch (field.kind) {
+      case "cred": {
+        const { optional: _, ...rest } = field;
+        fields.push({
+          ...rest,
+          help: field.help ?? null,
+          saved: await machine.device.get(field.name) !== undefined
+        });
+        break;
+      }
+      case "text":
+        fields.push({
+          ...field,
+          placeholder: field.placeholder ?? null,
+          value: field.value ?? null,
+          optional: field.optional ?? false
+        });
+        break;
+      case "yes-no":
+        fields.push(field);
+        break;
+      case "choice": {
+        const { options, ...rest } = field;
+        const listed = await options(machine).catch(() => []);
+        fields.push({ ...rest, options: [...listed] });
+        break;
+      }
+    }
+  }
+  return fields;
+}
+async function fieldsIn(step, machine) {
+  const { fields } = step;
+  return typeof fields === "function" ? fields(machine) : fields ?? [];
+}
+
+// setup/undo.ts
+class SetupUndo {
+  #areas;
+  #machine;
+  constructor(machine, areas) {
+    this.#areas = areas;
+    this.#machine = machine;
+  }
+  async plan(id) {
+    const area = this.#area(id);
+    const machine = this.#machine;
+    const done = await this.#done();
+    const undone = await this.#undone(area, done);
+    const keeps = await this.#keeps(undone, done);
+    const kept = keptOf(keeps);
+    const steps = [];
+    const refusals = [];
+    let confirm = null;
+    for (const step of undone) {
+      const undo = step.undo;
+      const refused = await undo?.refused?.(machine) ?? null;
+      if (refused !== null) {
+        refusals.push(refused);
+      }
+      confirm = confirm ?? await undo?.confirm?.(machine) ?? null;
+      steps.push({
+        id: step.id,
+        title: step.title,
+        done: done.has(step),
+        removes: [...await undo?.removes(machine, kept) ?? []],
+        leaves: [...await undo?.leaves?.(machine) ?? []]
+      });
+    }
+    const needing = this.#needing(area, undone, done);
+    if (needing !== null) {
+      refusals.unshift(needing);
+    }
+    return {
+      area: area.id,
+      title: area.title,
+      steps,
+      creds: await this.#creds(keeps),
+      confirm,
+      refused: refusals[0] ?? null
+    };
+  }
+  async run(id, confirm) {
+    const plan = await this.plan(id);
+    if (plan.refused !== null) {
+      throw new StepProblem(plan.refused);
+    }
+    if (plan.confirm !== null && confirm?.trim() !== plan.confirm) {
+      throw new StepProblem(`Type ${plan.confirm} to undo ${plan.title}.`);
+    }
+    const area = this.#area(id);
+    const done = await this.#done();
+    const undone = await this.#undone(area, done);
+    const kept = keptOf(await this.#keeps(undone, done));
+    for (const step of undone) {
+      try {
+        await step.undo?.run(this.#machine, kept);
+      } catch (error) {
+        throw new StepProblem(`Undoing "${step.title}" failed: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+    for (const cred of plan.creds) {
+      if (cred.keptFor === null) {
+        await this.#machine.device.delete(cred.name);
+      }
+    }
+  }
+  #area(id) {
+    const area = this.#areas.find((each) => each.id === id);
+    if (area === undefined) {
+      fail2("not_found", `no setup area '${id}': \`splates setup\` lists them`, {
+        area: id
+      });
+    }
+    return area;
+  }
+  async undoable(id, done) {
+    return (await this.#undone(this.#area(id), done)).length > 0;
+  }
+  async#done() {
+    const done = new Set;
+    for (const step of this.#areas.flatMap((area) => area.steps)) {
+      if (await listed(step, this.#machine) && (await checked(step, this.#machine)).done) {
+        done.add(step);
+      }
+    }
+    return done;
+  }
+  async#undone(area, done) {
+    const undone = [];
+    for (const step of area.steps) {
+      if (done.has(step) || await listed(step, this.#machine) && await this.#started(step, area, done)) {
+        undone.push(step);
+      }
+    }
+    return undone.reverse();
+  }
+  async#started(step, area, done) {
+    const fields = await fieldsIn(step, this.#machine).catch(() => []);
+    for (const field of fields) {
+      if (field.kind === "cred" && await this.#machine.device.get(field.name) !== undefined && this.#keptFor(field.name, done, area.steps) === null) {
+        return true;
+      }
+    }
+    return false;
+  }
+  #needing(area, undone, done) {
+    for (const other of this.#areas) {
+      if (other === area) {
+        continue;
+      }
+      for (const step of other.steps) {
+        const needs = step.after.find((each) => undone.includes(each));
+        if (needs !== undefined && done.has(step)) {
+          return `Undo ${other.title} first: its "${step.title}" needs "${needs.title}".`;
+        }
+      }
+    }
+    return null;
+  }
+  async#keeps(undone, done) {
+    const machine = this.#machine;
+    const names = new Set((await Promise.all(undone.map((step) => sharedOf(step, machine)))).flat());
+    return new Map([...names].map((name) => [name, this.#keptFor(name, done, undone)]));
+  }
+  #keptFor(name, done, besides) {
+    const user = [...done].find((step) => !besides.includes(step) && (step.uses ?? []).includes(name));
+    return OUTSIDE[name] ?? user?.title ?? null;
+  }
+  async#creds(keeps) {
+    const creds = [];
+    for (const [name, keptFor] of keeps) {
+      if (await this.#machine.device.get(name) !== undefined) {
+        creds.push({ name, keptFor });
+      }
+    }
+    return creds;
+  }
+}
+var OUTSIDE = {
+  CLOUDFLARE_API_TOKEN: "scry's Workers AI",
+  CLOUDFLARE_ACCOUNT_ID: "scry's Workers AI"
+};
+function keptOf(keeps) {
+  return new Set([...keeps].filter(([, keptFor]) => keptFor !== null).map(([name]) => name));
+}
+async function sharedOf(step, machine) {
+  const fields = await fieldsIn(step, machine).catch(() => []);
+  return [
+    ...fields.flatMap((field) => field.kind === "cred" ? [field.name] : []),
+    ...step.uses ?? []
+  ];
+}
+
+// setup/setup.ts
+class Setup2 {
+  #areas;
+  #machine;
+  #undo;
+  constructor(machine, areas) {
+    checkRoster(areas);
+    this.#areas = areas;
+    this.#machine = machine;
+    this.#undo = new SetupUndo(machine, areas);
+  }
+  get #file() {
+    return new FsStorage2(this.#machine.home, this.#machine.fs).document("setup.json");
+  }
+  async step(id) {
+    for (const area of this.#areas) {
+      for (const step of await this.#stepsOf(area)) {
+        if (step.id === id) {
+          return step;
+        }
+      }
+    }
+    fail2("not_found", `no setup step '${id}': \`splates setup\` lists them`, {
+      step: id
+    });
+  }
+  async submit(id, answers) {
+    const step = await this.step(id);
+    for (const before of step.after) {
+      if (!(await checked(before, this.#machine)).done) {
+        throw new StepProblem(`Do "${before.title}" first.`);
+      }
+    }
+    for (const field of await fieldsIn(step, this.#machine)) {
+      const answer = answers[field.name];
+      if (field.kind === "yes-no") {
+        if (typeof answer !== "boolean") {
+          throw new StepProblem(`Say yes or no to "${field.label}".`);
+        }
+        continue;
+      }
+      if (field.kind === "cred") {
+        if (!field.optional && await this.#machine.device.get(field.name) === undefined) {
+          throw new StepProblem(`Paste the ${field.label} first.`);
+        }
+        continue;
+      }
+      const text = typeof answer === "string" ? answer.trim() : "";
+      if (text === "" && field.kind === "text" && field.optional) {
+        continue;
+      }
+      if (text === "") {
+        throw new StepProblem(`Fill in "${field.label}" first.`);
+      }
+      if (field.kind === "choice" && !(await field.options(this.#machine)).some((option) => option.value === text)) {
+        throw new StepProblem(`Pick one of the choices for "${field.label}".`);
+      }
+    }
+    try {
+      await step.submit?.(this.#machine, answers);
+    } catch (error) {
+      throw new StepProblem(error instanceof Error ? error.message : String(error));
+    }
+    const { done, problem } = await checked(step, this.#machine);
+    if (!done) {
+      throw new StepProblem(problem ?? step.notDone ?? NOT_DONE);
+    }
+    return this.read();
+  }
+  async read() {
+    const skipped = new Set(await this.#skipped());
+    const statuses = new Map;
+    const areas = [];
+    for (const area of this.#areas) {
+      const steps = [];
+      for (const step of await this.#stepsOf(area, true)) {
+        if (step.each !== undefined) {
+          statuses.set(step, await this.#standInStatus(step, statuses));
+          continue;
+        }
+        if (!await listed(step, this.#machine)) {
+          continue;
+        }
+        const { done, problem } = await checked(step, this.#machine);
+        const before = step.after.map((each) => statuses.get(each));
+        const status = done ? "done" : skipped.has(step.id) || before.includes("skipped") ? "skipped" : before.every((each) => each === "done") ? "ready" : "waiting";
+        statuses.set(step, status);
+        steps.push({
+          id: step.id,
+          title: step.title,
+          why: step.why,
+          user: step.user,
+          agent: step.agent,
+          optional: step.optional,
+          after: step.after.map((each) => each.id),
+          status,
+          problem,
+          cred: (await fieldsIn(step, this.#machine).catch(() => [])).find((field) => field.kind === "cred")?.name ?? null,
+          fields: await fieldsOf(step, this.#machine),
+          doing: step.doing ?? null,
+          detail: await step.detail?.(this.#machine).catch(() => null) ?? null,
+          warning: await step.warning?.(this.#machine).catch(() => null) ?? null,
+          data: await step.data?.(this.#machine).catch(() => null) ?? null
+        });
+      }
+      areas.push({
+        id: area.id,
+        title: area.title,
+        purpose: area.purpose,
+        optional: steps.every((step) => step.optional),
+        done: steps.filter((step) => step.status === "done").length,
+        skipped: steps.filter((step) => step.status === "skipped").length,
+        left: steps.filter((step) => step.status === "ready" || step.status === "waiting").length,
+        undoable: false,
+        steps
+      });
+    }
+    const done = new Set([...statuses].flatMap(([step, status]) => status === "done" ? [step] : []));
+    for (const area of areas) {
+      area.undoable = await this.#undo.undoable(area.id, done);
+    }
+    const all = areas.flatMap((area) => area.steps);
+    const ready = all.filter((step) => step.status === "ready");
+    const next = ready.find((step) => !step.optional) ?? ready[0] ?? null;
+    return {
+      areas,
+      next: next?.id ?? null,
+      fresh: await this.#file.read() === null,
+      required: all.some((step) => !step.optional && (step.status === "ready" || step.status === "waiting"))
+    };
+  }
+  async skip(id) {
+    await this.step(id);
+    const skipped = await this.#skipped();
+    if (!skipped.includes(id)) {
+      await this.#save([...skipped, id]);
+    }
+  }
+  async unskip(id) {
+    await this.step(id);
+    const skipped = await this.#skipped();
+    if (skipped.includes(id)) {
+      await this.#save(skipped.filter((each) => each !== id));
+    }
+  }
+  async see() {
+    if (await this.#file.read() === null) {
+      await this.#save([]);
+    }
+  }
+  undoPlan(id) {
+    return this.#undo.plan(id);
+  }
+  async undo(id, confirm) {
+    await this.#undo.run(id, confirm);
+    return this.read();
+  }
+  async#stepsOf(area, standIns = false) {
+    const steps = [];
+    for (const step of area.steps) {
+      if (step.each === undefined) {
+        steps.push(step);
+        continue;
+      }
+      steps.push(...await step.each(this.#machine).catch(() => []));
+      if (standIns) {
+        steps.push(step);
+      }
+    }
+    return steps;
+  }
+  async#standInStatus(step, statuses) {
+    if ((await checked(step, this.#machine)).done) {
+      return "done";
+    }
+    const each = [...statuses].flatMap(([one, status]) => one.of === step ? [status] : []);
+    return each.includes("skipped") && each.every((status) => status === "done" || status === "skipped") ? "skipped" : "waiting";
+  }
+  async#skipped() {
+    const raw = await this.#file.read();
+    if (raw === null) {
+      return [];
+    }
+    const parsed = SKIPS.safeParse(raw);
+    if (!parsed.success) {
+      throw new Error(`${this.#file.key} is not what splates saved: remove it to ask every step again`);
+    }
+    return parsed.data.format > FORMAT ? [] : parsed.data.skipped;
+  }
+  async#save(skipped) {
+    await this.#file.write({ format: FORMAT, skipped });
+  }
+}
+var FORMAT = 1;
+var SKIPS = z3.object({
+  format: z3.number(),
+  skipped: z3.array(z3.string())
+});
+var NOT_DONE = "This step is not done yet: do it, then press Next.";
+function checkRoster(areas) {
+  const seen = new Set;
+  const ids = new Set;
+  for (const area of areas) {
+    if (ids.has(area.id)) {
+      throw new Error(`setup names '${area.id}' twice`);
+    }
+    ids.add(area.id);
+  }
+  const steps = new Set;
+  for (const step of areas.flatMap((area) => area.steps)) {
+    if (steps.has(step.id)) {
+      throw new Error(`setup names step '${step.id}' twice`);
+    }
+    for (const before of step.after) {
+      if (!seen.has(before)) {
+        throw new Error(`setup step '${step.id}' waits on '${before.id}', which is not on the roster before it`);
+      }
+    }
+    steps.add(step.id);
+    seen.add(step);
+  }
+}
+export { transcriberFor, Dictations, SETUP_AREAS2, OpenCodeSetup2, OpenCodeSetupRoutes2, setupProjectAt2, SetupRoutes2, Setup2 };