@wular/coder 0.4.13 → 0.5.0

package/dist/{index-ChcxzFdB.d.ts → index-ezhbF5wC.d.ts}

@@ -1,195 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import * as z from "zod";
 import * as z$1 from "zod/mini";
-//#region src/core/config.d.ts
-declare const engineSchema: z$1.ZodMiniEnum<{
-  custom: "custom";
-  codex: "codex";
-  claude: "claude";
-}>;
-declare const effortSchema: z$1.ZodMiniEnum<{
-  low: "low";
-  medium: "medium";
-  high: "high";
-}>;
-declare const permissionSchema: z$1.ZodMiniEnum<{
-  "read-only": "read-only";
-  "workspace-write": "workspace-write";
-  auto: "auto";
-}>;
-declare const customModelSchema: z$1.ZodMiniObject<{
-  baseUrl: z$1.ZodMiniURL;
-  model: z$1.ZodMiniString<string>;
-  envKey: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-  wireApi: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-    chat: "chat";
-    responses: "responses";
-  }>>;
-  contextWindow: z$1.ZodMiniOptional<z$1.ZodMiniNumber<number>>;
-  disabled: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
-}, z$1.core.$strict>;
-/** The merged, effective shape (everything present after DEFAULT_CONFIG). */
-declare const mcpEntrySchema: z$1.ZodMiniObject<{
-  connection: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-  command: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-  args: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
-  env: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniString<string>>>;
-  url: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-  type: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-    stdio: "stdio";
-    http: "http";
-  }>>;
-  headers: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniString<string>>>;
-  tools: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
-  description: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-}, z$1.core.$strict>;
-declare const effectiveConfigSchema: z$1.ZodMiniObject<{
-  chain: z$1.ZodMiniArray<z$1.ZodMiniEnum<{
-    custom: "custom";
-    codex: "codex";
-    claude: "claude";
-  }>>;
-  engines: z$1.ZodMiniObject<{
-    codex: z$1.ZodMiniOptional<z$1.ZodMiniObject<{
-      model: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-      effort: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-        low: "low";
-        medium: "medium";
-        high: "high";
-      }>>;
-      permissions: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-        "read-only": "read-only";
-        "workspace-write": "workspace-write";
-        auto: "auto";
-      }>>;
-      network: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
-    }, z$1.core.$strict>>;
-    claude: z$1.ZodMiniOptional<z$1.ZodMiniObject<{
-      model: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-      effort: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-        low: "low";
-        medium: "medium";
-        high: "high";
-      }>>;
-      permissions: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-        "read-only": "read-only";
-        "workspace-write": "workspace-write";
-        auto: "auto";
-      }>>;
-    }, z$1.core.$strict>>;
-    custom: z$1.ZodMiniOptional<z$1.ZodMiniObject<{
-      model: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-      effort: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-        low: "low";
-        medium: "medium";
-        high: "high";
-      }>>;
-      permissions: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-        "read-only": "read-only";
-        "workspace-write": "workspace-write";
-        auto: "auto";
-      }>>;
-    }, z$1.core.$strict>>;
-  }, z$1.core.$strict>;
-  models: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniUnion<readonly [z$1.ZodMiniObject<{
-    baseUrl: z$1.ZodMiniURL;
-    model: z$1.ZodMiniString<string>;
-    envKey: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-    wireApi: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-      chat: "chat";
-      responses: "responses";
-    }>>;
-    contextWindow: z$1.ZodMiniOptional<z$1.ZodMiniNumber<number>>;
-    disabled: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
-  }, z$1.core.$strict>, z$1.ZodMiniObject<{
-    provider: z$1.ZodMiniEnum<{
-      codex: "codex";
-      claude: "claude";
-    }>;
-    model: z$1.ZodMiniString<string>;
-    effort: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-      low: "low";
-      medium: "medium";
-      high: "high";
-    }>>;
-    disabled: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
-  }, z$1.core.$strict>, z$1.ZodMiniObject<{
-    disabled: z$1.ZodMiniBoolean<boolean>;
-  }, z$1.core.$strict>]>>>;
-  agents: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniUnion<readonly [z$1.ZodMiniBoolean<boolean>, z$1.ZodMiniObject<{
-    engine: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-    model: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-    effort: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-      low: "low";
-      medium: "medium";
-      high: "high";
-    }>>;
-    permissions: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-      "read-only": "read-only";
-      "workspace-write": "workspace-write";
-      auto: "auto";
-    }>>;
-    access: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-      read: "read";
-      write: "write";
-    }>>;
-    runner: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-      local: "local";
-      "local-docker": "local-docker";
-      "vercel-sandbox": "vercel-sandbox";
-      "github-actions": "github-actions";
-    }>>;
-    integrations: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniObject<{
-      allowedEvents: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
-    }, z$1.core.$strict>>>;
-    connections: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
-    disabled: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
-  }, z$1.core.$strict>]>>>;
-  mcp: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniObject<{
-    connection: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-    command: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-    args: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
-    env: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniString<string>>>;
-    url: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-    type: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
-      stdio: "stdio";
-      http: "http";
-    }>>;
-    headers: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniString<string>>>;
-    tools: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
-    description: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
-  }, z$1.core.$strict>>>;
-  approvals: z$1.ZodMiniObject<{
-    allowedNetworkHosts: z$1.ZodMiniArray<z$1.ZodMiniString<string>>;
-  }, z$1.core.$strict>;
-}, z$1.core.$strict>;
-type McpConfigEntry = z$1.infer<typeof mcpEntrySchema> & {
-  repository?: boolean;
-};
-type Engine = z$1.infer<typeof engineSchema>;
-type Effort = z$1.infer<typeof effortSchema>;
-type Permission = z$1.infer<typeof permissionSchema>;
-type CustomModelConfig = z$1.infer<typeof customModelSchema>;
-type CoderConfig = z$1.infer<typeof effectiveConfigSchema>;
-declare const config: {
-  /** A config value by dotted key (or the whole effective config). */
-  get: (key?: string, opts?: {
-    cwd?: string;
-  }) => unknown;
-  /** Set a config value; `workspace` targets the repo file instead of the user file. */
-  set: (key: string, value: unknown, opts?: {
-    workspace?: boolean;
-    cwd?: string;
-    unset?: boolean;
-  }) => {
-    file: string;
-    key: string;
-    effective: unknown;
-    value?: unknown;
-    unset?: boolean;
-  };
-};
-//#endregion
 //#region ../node_modules/.bun/@types+unist@3.0.3/node_modules/@types/unist/index.d.ts
 // ## Interfaces
 /**
@@ -1291,8 +1102,9 @@ interface SerializedThread {
 type ChannelVisibility = "private" | "workspace" | "external" | "unknown";
 //#endregion
 //#region src/integrations/types.d.ts
-/** Access modes: read-only tools, or tools that also write. */
-type Preset = 'read' | 'write';
+/** Access: read-only tools, or every tool with the engine's reviewer deciding what leaves the sandbox. */
+declare const ACCESS: readonly ["read-only", "auto"];
+type Access = (typeof ACCESS)[number];
 /** A platform event, typed by its integration. */
 interface PlatformEvent {
   integration: string;
@@ -1310,15 +1122,17 @@ interface PlatformEvent {
   };
   /** Human text attached to the event: mention body, comment, PR title + body. */
   text: string;
-  /** What the platform tells an agent about where the event happened, such as a Linear issue; bounded. */
-  promptContext?: string;
-  /** The covered account it happened in, for an installation that covers several. */
-  within?: string;
+  /** The text @-mentions the app, on an event with no chat message to say so (an opened GitHub issue). */
+  mentioned?: true;
+  /** The platform account it happened in (Slack team, GitHub org), for an installation that covers several. */
+  account?: string;
   /** The Chat SDK thread and message it happened in, without raw platform payloads; replies go to this thread. */
   chat?: {
     thread: SerializedThread;
     message?: SerializedMessage;
   };
+  /** Where it happened and who may see that place; unknown privacy counts as private. */
+  space?: Space;
   repo?: {
     owner: string;
     name: string;
@@ -1326,16 +1140,242 @@ interface PlatformEvent {
     defaultBranch: string;
   };
 }
+/** A place events come from: a channel (DMs too), a repository or a team; `private` is unknown until the platform told it. */
+interface Space {
+  kind: 'channel' | 'repository' | 'team';
+  id: string;
+  private?: boolean;
+}
 /** A message the agent did not get as a turn, as `since` lists it. */
 interface SinceMessage {
-  /** The platform's message id, so a message counts once; not shown to the agent. */
+  /** The platform's message id, so a message counts once. */
   id?: string;
+  /** The id of the thread it was posted in. */
+  thread?: string;
   author: string;
   text: string;
   sentAt: string;
 }
 //#endregion
+//#region src/core/config.d.ts
+/**
+ * Strict schema for a config object (a file's contents or the merged result).
+ * Unknown keys and out-of-range values are errors, not warnings. These schemas
+ * are the source of truth for the config domain types (types.ts re-exports the
+ * z.infer'd types).
+ */
+declare const engineSchema: z$1.ZodMiniEnum<{
+  custom: "custom";
+  claude: "claude";
+  codex: "codex";
+}>;
+declare const effortSchema: z$1.ZodMiniEnum<{
+  low: "low";
+  medium: "medium";
+  high: "high";
+}>;
+declare const customModelSchema: z$1.ZodMiniObject<{
+  baseUrl: z$1.ZodMiniURL;
+  model: z$1.ZodMiniString<string>;
+  envKey: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+  wireApi: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
+    chat: "chat";
+    responses: "responses";
+  }>>;
+  contextWindow: z$1.ZodMiniOptional<z$1.ZodMiniNumber<number>>;
+  disabled: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
+}, z$1.core.$strict>;
+/** The merged, effective shape (everything present after DEFAULT_CONFIG). */
+declare const mcpEntrySchema: z$1.ZodMiniObject<{
+  connection: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+  command: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+  args: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
+  env: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniString<string>>>;
+  url: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+  type: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
+    stdio: "stdio";
+    http: "http";
+  }>>;
+  headers: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniString<string>>>;
+  tools: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
+  description: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+  connect: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
+    start: "start";
+    "first-use": "first-use";
+  }>>;
+}, z$1.core.$strict>;
+declare const effectiveConfigSchema: z$1.ZodMiniObject<{
+  $schema: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+  version: z$1.ZodMiniLiteral<1>;
+  chain: z$1.ZodMiniArray<z$1.ZodMiniString<string>>;
+  reviewModel: z$1.ZodMiniString<string>;
+  models: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniUnion<readonly [z$1.ZodMiniString<string>, z$1.ZodMiniLiteral<false>, z$1.ZodMiniObject<{
+    baseUrl: z$1.ZodMiniURL;
+    model: z$1.ZodMiniString<string>;
+    envKey: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+    wireApi: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
+      chat: "chat";
+      responses: "responses";
+    }>>;
+    contextWindow: z$1.ZodMiniOptional<z$1.ZodMiniNumber<number>>;
+    disabled: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
+  }, z$1.core.$strict>]>>>;
+  agents: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniUnion<readonly [z$1.ZodMiniBoolean<boolean>, z$1.ZodMiniObject<{
+    model: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+    access: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
+      "read-only": "read-only";
+      auto: "auto";
+    }>>;
+    runner: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
+      local: "local";
+      "local-docker": "local-docker";
+      "vercel-sandbox": "vercel-sandbox";
+      "github-actions": "github-actions";
+    }>>;
+    integrations: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniObject<{
+      allowedEvents: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
+    }, z$1.core.$strict>>>;
+    connections: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
+    disabled: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
+  }, z$1.core.$strict>]>>>;
+  mcp: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniObject<{
+    connection: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+    command: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+    args: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
+    env: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniString<string>>>;
+    url: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+    type: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
+      stdio: "stdio";
+      http: "http";
+    }>>;
+    headers: z$1.ZodMiniOptional<z$1.ZodMiniRecord<z$1.ZodMiniString<string>, z$1.ZodMiniString<string>>>;
+    tools: z$1.ZodMiniOptional<z$1.ZodMiniArray<z$1.ZodMiniString<string>>>;
+    description: z$1.ZodMiniOptional<z$1.ZodMiniString<string>>;
+    connect: z$1.ZodMiniOptional<z$1.ZodMiniEnum<{
+      start: "start";
+      "first-use": "first-use";
+    }>>;
+  }, z$1.core.$strict>>>;
+  network: z$1.ZodMiniObject<{
+    allowedHosts: z$1.ZodMiniArray<z$1.ZodMiniString<string>>;
+    readOnlyTasks: z$1.ZodMiniOptional<z$1.ZodMiniBoolean<boolean>>;
+  }, z$1.core.$strict>;
+}, z$1.core.$strict>;
+type McpConfigEntry = z$1.infer<typeof mcpEntrySchema> & {
+  repository?: boolean;
+};
+type Engine = z$1.infer<typeof engineSchema>;
+type Effort = z$1.infer<typeof effortSchema>;
+type CustomModelConfig = z$1.infer<typeof customModelSchema>;
+type CoderConfig = z$1.infer<typeof effectiveConfigSchema>;
+declare const config: {
+  /** A config value by dotted key (or the whole effective config). */
+  get: (key?: string, opts?: {
+    cwd?: string;
+  }) => unknown;
+  /** Set a config value; `workspace` targets the repo file instead of the user file. */
+  set: (key: string, value: unknown, opts?: {
+    workspace?: boolean;
+    cwd?: string;
+    unset?: boolean;
+  }) => {
+    file: string;
+    key: string;
+    effective: unknown;
+    value?: unknown;
+    unset?: boolean;
+  };
+};
+//#endregion
 //#region src/client/types.d.ts
+/** The parts of `agent.json` the dashboard shows or edits against. */
+interface AgentDefinition {
+  name?: string;
+  description?: string;
+  model?: string;
+  access?: Access;
+  integrations?: Record<string, {
+    events?: string[] | Record<string, unknown>;
+  }>;
+}
+/** Organization overrides for one agent (`AgentUsage` on the server). */
+interface AgentSettings {
+  engine?: string;
+  model?: string;
+  effort?: string;
+  /** A registered runner id; unset follows the requester's default. */
+  runner?: string;
+  access?: Access;
+  integrations?: Record<string, {
+    allowedEvents?: string[];
+  }>;
+  /** Connections its tasks may use, by id; absent allows every granted one. */
+  connections?: string[];
+  /** Off in this workspace: no platform events, no new tasks. */
+  disabled?: boolean;
+}
+interface AgentRow {
+  id: string;
+  name: string;
+  description?: string;
+  source: string;
+  /** The agent a task runs when it names none. */
+  default?: true;
+  repo?: string;
+  path?: string;
+  /** Browser address of the tracked folder, for repository agents. */
+  sourceUrl?: string;
+  currentVersion: number;
+  /** A local server's agent, which keeps no versions; `commit` is its folder's last commit. */
+  local?: true;
+  commit?: string;
+  updatedAt?: number;
+  definition?: AgentDefinition;
+  systemPrompt?: string;
+  files?: Record<string, string>;
+  settings?: AgentSettings;
+  versions?: VersionRow[];
+  /** The names it answers to, one per app that wakes on mentions, with the platform's display name. */
+  handles?: Array<{
+    name: string;
+    integration: string;
+    platform: string;
+  }>;
+  /** Where its apps are installed: the platform, the account and the app's name. */
+  installations?: Array<{
+    integration: string;
+    account: string;
+    app: string;
+  }>;
+  /** Platform events it failed to handle in the last day, with the newest; absent when none. */
+  deliveries?: {
+    failed: number;
+    recent: FailedDeliveryRow[];
+  };
+  /** The model it runs first for the caller, by name, and where its list runs for them. */
+  model?: string;
+  runsOn?: string;
+  /** Nothing can run any of its models for the caller: no credential of theirs or the workspace's, no sign-in on this machine. */
+  needsModel?: true;
+  /** Engines, and custom models as `custom/<name>`, that no workspace credential runs, so its settings can't pick them. */
+  unrunnable?: string[];
+  /** Why its definition is invalid; it answers no events until fixed. */
+  problems?: string[];
+  /** Keys its definition has that Coder renamed, with their new name, or no longer reads. */
+  stale?: {
+    renamed?: Record<string, string>;
+    unknown?: string[];
+  };
+}
+/** A platform event Coder failed to handle. */
+interface FailedDeliveryRow {
+  at: number;
+  platform: string;
+  type?: string;
+  error: string;
+  /** The thread or issue it came from. */
+  url?: string;
+}
 /** What publishing did to one of the agent's apps: pushed it, failed to, or found it needs changes on the platform. */
 interface AppSync {
   id: string;
@@ -1345,6 +1385,31 @@ interface AppSync {
   error?: string;
   drift?: true;
 }
+interface VersionRow {
+  version: number;
+  createdAt: number;
+  importedFrom?: string;
+  commit?: string;
+}
+/** An alias's model spec, false for a name turned off, or a custom endpoint. */
+type ModelEntry = string | false | {
+  baseUrl: string;
+  model: string;
+  envKey?: string;
+  wireApi?: 'chat' | 'responses';
+  contextWindow?: number;
+  disabled?: boolean;
+};
+type Config = {
+  version?: number;
+  chain?: string[];
+  reviewModel?: string;
+  models?: Record<string, ModelEntry>;
+  network?: {
+    allowedHosts?: string[];
+    readOnlyTasks?: boolean;
+  };
+};
 type RunnerKind = 'local' | 'local-docker' | 'vercel-sandbox' | 'github-actions' | 'http';
 interface RunnerSpec {
   kind: RunnerKind;
@@ -1396,6 +1461,13 @@ interface RunnerTest {
   detail: string;
   ms: number;
 }
+type ModelsShape = {
+  /** Built-in aliases, name -> model spec. */
+  builtin: Record<string, string>;
+  models: Record<string, ModelEntry>;
+  /** Where each chain model and the review model run for the caller, by spec. */
+  runsOn?: Record<string, string>;
+};
 interface ProbeResult {
   reachable: boolean;
   modelListed: boolean | null;
@@ -1411,11 +1483,17 @@ interface ConnectionRow {
   name: string;
   /** `mcp`, `env` for an API key tasks read from `env`, or the integration id whose API it reaches. */
   provider: string;
-  /** Set on a member's own connection; `mine` when that member is the viewer. */
-  owner?: string;
-  mine?: true;
-  /** Absent follows the mode of the agent whose task uses it. */
-  access?: 'read' | 'write';
+  scope: 'personal' | 'workspace';
+  /** Set on a member's own connection; `asker` when that member is the one asking. */
+  owner?: {
+    id: string;
+    name?: string;
+  };
+  asker?: true;
+  /** Set on an agent's app installation, managed on that agent's Platforms tab. */
+  agent?: string;
+  /** `read-only` exposes only its read-only tools; absent or `auto` follows the task. */
+  access?: Access;
   auth: 'none' | 'key' | 'oauth';
   /** The remote server, or the stdio command, it is bound to. */
   url?: string;
@@ -1423,8 +1501,10 @@ interface ConnectionRow {
   /** The environment variable an `env` connection's key is in. */
   env?: string;
   account?: string;
-  /** `authorize`: OAuth not finished yet; `reconnect`: its secret stopped working. */
-  status: 'ok' | 'authorize' | 'reconnect';
+  /** `needs-auth`: its sign-in is unfinished or its secret stopped working; `disabled`: not granted to the task listing it. */
+  status: 'connected' | 'needs-auth' | 'disabled';
+  /** The task's tool search name for it, when the task has it. */
+  server?: string;
   createdAt: number;
 }
 interface LocalFolder {
@@ -1455,7 +1535,7 @@ interface TaskTurn {
   approval?: string;
 }
 //#endregion
-//#region src/core/task/log-view.d.ts
+//#region src/core/task/view.d.ts
 interface TaskLogEntry {
   at?: string;
   message?: string;
@@ -1486,16 +1566,10 @@ interface AgentPromptParts {
   };
   /** Conversation tasks: the events the agent subscribes to. */
   events?: string[];
-  /** The agent's access mode. */
-  access?: 'read' | 'write';
+  /** The agent's access. */
+  access?: Access;
 }
 interface SystemPromptParts extends AgentPromptParts {
-  /** The task's MCP servers as the worker renders them on each turn. */
-  servers?: string;
-  /** Who loads their tools on demand: the engine's tool search, or Coder's find_tools and call_tool. */
-  toolSearch?: 'native' | 'coder';
-  /** Coder's task tools this turn has, as the worker serves them. */
-  tools?: string[];
   cwd?: string;
   /** A platform event's task, whose final message is a reply in a thread; otherwise a general task. */
   conversation?: boolean;
@@ -1505,14 +1579,14 @@ interface SystemPromptParts extends AgentPromptParts {
   scratch?: string;
   /** Sandboxed commands reach only the hosts they declare (Claude auto). */
   declareHosts?: boolean;
-  /** The exact actions the user approved for the rest of the task. */
-  approved?: string[];
-  /** The task may write (workspace-write or auto). */
+  /** The task may write (auto). */
   writes?: boolean;
   /** `coder task run --append-system` text and flow instructions. */
   appendSystem?: string;
   /** The final message is JSON for a schema, not a summary. */
   structured?: boolean;
+  /** The turn has platform servers, which act as the app or as the person asking. */
+  connections?: boolean;
 }
 //#endregion
 //#region src/core/types.d.ts
@@ -1537,18 +1611,31 @@ interface McpServerSpec {
     env?: string;
     header?: string;
   };
+  /** Where `connection`'s token goes; the tool search asks for it on first use. */
+  credentialOnUse?: {
+    env?: string;
+    header?: string;
+  };
+  /** When `connection` was created; its token is given only to the same row at the same `url`. */
+  connectionCreatedAt?: number;
   /** Tool allowlist; omit or empty for every tool the server offers. */
   tools?: string[];
   /** Schemas load before the first prompt instead of behind tool search or the hub. */
   alwaysLoad?: boolean;
+  /** When the tool search connects it: at turn start, its instructions and tool names in the prompt, or on first use (default). */
+  connect?: 'start' | 'first-use';
   /** Only tools the server marks read-only may be called. */
   readOnly?: boolean;
   /** The integration a platform tool server reaches, and the account of its installation. */
   integration?: string;
   account?: string;
-  /** What the server reaches and the access it allows, as the prompt lists it. */
+  /** A personal connection's member, as `Connection.owner`; its first use asks them. */
+  owner?: string;
+  /** One line naming the server's identity and what it reaches, as the tool search lists it. */
   description?: string;
-  access?: 'read' | 'write';
+  /** What the server's tools do; shown before the server's own instructions. On an `alwaysLoad` server, the instructions it serves. */
+  instructions?: string;
+  access?: Access;
 }
 type TaskStatus = 'queued' | 'running' | 'completed' | 'failed' | 'cancelled';
 /** A persisted task record (task.json). Most fields accrete over the lifecycle. */
@@ -1563,11 +1650,11 @@ interface Task {
   outputSchema?: object;
   currentPrompt?: string | null;
   appendSystem?: string | null;
-  promptParts?: Omit<SystemPromptParts, 'servers'>;
+  promptParts?: SystemPromptParts;
   systemPrompt?: string;
   model?: string | null;
   effort?: Effort | null;
-  permissions?: Permission;
+  access?: Access;
   resumeThreadId?: string | null;
   cwd?: string;
   pid?: number | null;
@@ -1586,9 +1673,9 @@ interface Task {
   resumedAt?: string;
   error?: string;
   fallbacks?: Array<{
-    engine: Engine;
+    model: string;
     detail: string;
-    next: Engine;
+    next: string;
   }>;
   archived?: boolean;
   archivedAt?: string;
@@ -1605,6 +1692,14 @@ interface Task {
   nativeMcp?: boolean;
   addDirs?: string[];
 }
+/** Task options after resolving CLI flags against config defaults. */
+interface ResolvedTaskOptions {
+  /** codex, claude, or custom. */
+  engine: Engine;
+  model: string | null;
+  effort: Effort | null;
+  access: Access;
+}
 /** The outcome of running one engine turn. status 0 == success. */
 interface TurnResult {
   status: number;
@@ -1664,10 +1759,8 @@ interface GateResult {
 }
 /** Options shared with `coder run`, plus `returns`. */
 interface FlowTaskOptions<T = unknown> {
-  engine?: string;
   model?: string;
-  effort?: string;
-  permissions?: string;
+  access?: Access;
   mcp?: string | McpServerSpec[];
   name?: string;
   appendSystem?: string;
@@ -1678,8 +1771,7 @@ interface FlowTaskOptions<T = unknown> {
 /** Overrides for one more turn, as `coder task steer` takes them. */
 interface FlowSteerOptions {
   model?: string;
-  effort?: string;
-  permissions?: string;
+  access?: Access;
 }
 type FlowRunStatus = 'running' | 'completed' | 'failed' | 'stopped';
 /** An event recorded by the flow runtime and delivered to its hooks and followers. */
@@ -1766,7 +1858,7 @@ interface DiscoveredFlow {
   scope: 'workspace' | 'global' | 'builtin';
 }
 //#endregion
-//#region src/flow/journal.d.ts
+//#region src/flow/runtime.d.ts
 /**
  * Prefix-order replay. A call matches the first unconsumed recorded entry with
  * an identical fingerprint (fingerprint match rather than strict positional
@@ -1784,8 +1876,6 @@ declare class Journal {
   replay(...fps: string[]): JournalEntry | null;
   record(entry: Omit<JournalEntry, 'seq'>): void;
 }
-//#endregion
-//#region src/flow/runtime.d.ts
 /** Progress callbacks a foreground caller can attach to a run. */
 interface FlowHooks {
   /** Fired once the run is armed, with a stop handle for a SIGINT handler. */
@@ -1795,6 +1885,8 @@ interface FlowHooks {
     runningIds: () => string[];
   }) => void;
   onEvent?: (event: FlowEvent) => void;
+  /** A cloud runner's credentials for one model, best first; none skips the model. Unset runs on the process's own logins. */
+  onModel?: (model: ResolvedTaskOptions) => Promise<NodeJS.ProcessEnv[]>;
 }
 interface RunContext {
   runId: string;
@@ -1818,10 +1910,9 @@ interface RunContext {
     env: Record<string, string>;
     ids: string[];
   };
-  ceiling?: {
-    agent: string;
-    permissions: string;
-  };
+  access?: Access;
+  /** The credential each of its tasks runs on, by task id, so a steer resumes on it. */
+  credentialEnv?: Map<string, NodeJS.ProcessEnv>;
 }
 declare class Semaphore {
   limit: number;
@@ -1886,6 +1977,12 @@ interface TurnResultEntry {
   [key: string]: unknown;
 }
 declare function readTurnResults(cwd: string, taskId: string): TurnResultEntry[];
+interface CacheMigration {
+  cache: string;
+  tasks: number;
+  flows: number;
+  files: number;
+}
 //#endregion
 //#region src/flow/executor.d.ts
 interface RunOptions {
@@ -1898,11 +1995,8 @@ interface RunOptions {
   /** Platform credential for built-in integrations; never persisted with the run. */
   integrationToken?: string;
   connections?: RunContext['connections'];
-  /** The agent whose permissions cap every task this run starts. */
-  ceiling?: {
-    agent: string;
-    permissions: string;
-  };
+  /** The agent's access, which caps every task this run starts. */
+  access?: Access;
 }
 interface RunSummary {
   runId: string;
@@ -1975,7 +2069,7 @@ interface FallbackPayload {
   fallback: {
     action: 'run-native-subagent';
     reason: 'no-engine-available';
-    permissions: string;
+    access: string;
     instructions: string;
     note: string;
     appendSystem?: string;
@@ -2075,9 +2169,8 @@ declare const args: z.ZodObject<{
   author: z.ZodOptional<z.ZodString>;
   path: z.ZodOptional<z.ZodArray<z.ZodString>>;
   exclude: z.ZodOptional<z.ZodArray<z.ZodString>>;
-  engine: z.ZodOptional<z.ZodString>;
   model: z.ZodOptional<z.ZodString>;
-  effort: z.ZodOptional<z.ZodEnum<{
+  depth: z.ZodOptional<z.ZodEnum<{
     low: "low";
     medium: "medium";
     high: "high";
@@ -2180,8 +2273,6 @@ interface ReviewAuth {
   token?: string;
   exec?: ReviewExec;
 }
-/** The platform reviews post to; its tool server holds the token. */
-declare const REVIEW_PLATFORM = "github";
 interface ReviewComment {
   id: number;
   body?: string | null;
@@ -2210,4 +2301,4 @@ declare function resolveReviewTarget(input: ReviewTargetInput, auth?: ReviewAuth
 /** Post unseen findings and upsert the sticky summary through GitHub's integration. */
 declare function postReview(input: ReviewPostInput, auth?: ReviewAuth): number;
 //#endregion
-export { type FlowTaskOptions as $, type flowSdk as A, type review$1 as B, renderReviewMarkdown as C, SinceMessage as Ct, type reviewCli as D, McpConfigEntry as Dt, type review as E, Effort as Et, type archiveRuns as F, type pipeline as G, type flow as H, type deleteRuns as I, type DiscoveredFlow as J, type steer as K, type RunOptions as L, readTask as M, type CoderError as N, type reviewFingerprints as O, Permission as Ot, type RunResult as P, type FlowStep as Q, type RunSummary as R, type postReview as S, Preset as St, type resolveReviewTarget as T, CustomModelConfig as Tt, type gate as U, type readTurnResults as V, type log as W, type FlowRecord as X, type FlowEvent as Y, type FlowSteerOptions as Z, type description as _, RunnerSpec as _t, type ReviewExec as a, type TurnResult as at, type ownReviewComments as b, TaskTurn as bt, type ReviewPostSummary as c, AppSync as ct, type ReviewSummary as d, LocalFolders as dt, FlowTaskResult as et, type ReviewTarget as f, ProbeResult as ft, type concurrency as g, RunnerRow as gt, type changedLines as h, RunnerPairing as ht, type ReviewAuth as i, Task as it, type TaskResult as j, type args$1 as k, config as kt, type ReviewResult as l, ConnectionRow as lt, args as m, RunnerKind as mt, type REVIEW_PLATFORM as n, Approval as nt, ReviewPostFinding as o, TaskLogEntry as ot, ReviewTargetInput as p, RunnerInput as pt, task as q, ReviewArgs as r, Availability as rt, ReviewPostInput as s, TokenUsage as st, Finding as t, GateResult as tt, ReviewServices as u, LocalFolder as ut, fingerprint as v, RunnerTest as vt, type repositoryRules as w, CoderConfig as wt, type parseGithubPr as x, PlatformEvent as xt, type lastReviewSummary as y, RunnerUpdate as yt, type StopSummary as z };
+export { type FlowTaskOptions as $, type TaskResult as A, PlatformEvent as At, type CacheMigration as B, repositoryRules as C, TaskTurn as Ct, type reviewFingerprints as D, McpConfigEntry as Dt, type reviewCli as E, Effort as Et, type deleteRuns as F, type pipeline as G, type flow as H, type RunOptions as I, type DiscoveredFlow as J, type steer as K, type RunSummary as L, CoderError as M, type RunResult as N, type args$1 as O, config as Ot, type archiveRuns as P, type FlowStep as Q, type StopSummary as R, type renderReviewMarkdown as S, RunnerUpdate as St, type review as T, CustomModelConfig as Tt, type gate as U, type readTurnResults as V, type log as W, type FlowRecord as X, type FlowEvent as Y, type FlowSteerOptions as Z, type fingerprint as _, RunnerKind as _t, type ReviewPostFinding as a, type TurnResult as at, type parseGithubPr as b, RunnerSpec as bt, type ReviewResult as c, AgentRow as ct, type ReviewTarget as d, ConnectionRow as dt, FlowTaskResult as et, type ReviewTargetInput as f, LocalFolder as ft, type description as g, RunnerInput as gt, type concurrency as h, ProbeResult as ht, type ReviewExec as i, Task as it, type readTask as j, SinceMessage as jt, type flowSdk as k, Access as kt, type ReviewServices as l, AppSync as lt, changedLines as m, ModelsShape as mt, type ReviewArgs as n, Approval as nt, ReviewPostInput as o, TaskLogEntry as ot, args as p, LocalFolders as pt, task as q, ReviewAuth as r, Availability as rt, ReviewPostSummary as s, TokenUsage as st, Finding as t, GateResult as tt, ReviewSummary as u, Config as ut, lastReviewSummary as v, RunnerPairing as vt, type resolveReviewTarget as w, CoderConfig as wt, type postReview as x, RunnerTest as xt, type ownReviewComments as y, RunnerRow as yt, type review$1 as z };