agl 41.0.1 → 41.2.0

package/ts/classes.upgradecoordinator.ts

@@ -85,6 +85,18 @@ interface IUpgradeSemver {
   prerelease: string[];
 }
 
+const upgradeOwnerCommands = [
+  '__serve', '__upgrade-worker', 'upgrade', 'start', 'restart', 'service', 'foreground', 'temp-password', 'config',
+] as const;
+/** The CLI commands this release runs under an upgrade lock or a start lease. */
+type TUpgradeOwnerCommand = (typeof upgradeOwnerCommands)[number];
+const upgradeOwnerCommandSet: ReadonlySet<string> = new Set(upgradeOwnerCommands);
+/**
+ * A command a later release's CLI holds a start lease under (`agl remote` from 42 on), read back after a rollback:
+ * its owner is live while that command runs and stale once it ended, like any other.
+ */
+const laterReleaseStartCommandPattern = /^[a-z][a-z0-9-]{0,31}$/;
+
 interface IUpgradeProcessOwner {
   version: typeof coordinationVersion;
   kind: TUpgradeOwnerKind;
@@ -94,7 +106,8 @@ interface IUpgradeProcessOwner {
   processGroupId: number;
   fingerprint: string;
   cliPath: string;
-  command: '__serve' | '__upgrade-worker' | 'upgrade' | 'start' | 'restart' | 'service' | 'foreground' | 'temp-password' | 'config';
+  /** A `TUpgradeOwnerCommand`, or for a start lease also a later release's command. */
+  command: string;
   createdAt: number;
 }
 
@@ -504,15 +517,11 @@ const parseOwner = (valueArg: unknown): IUpgradeProcessOwner => {
     || value.fingerprint.length > 256
     || typeof value.cliPath !== 'string'
     || !plugins.path.isAbsolute(value.cliPath)
-    || (value.command !== '__serve'
-      && value.command !== '__upgrade-worker'
-      && value.command !== 'start'
-      && value.command !== 'upgrade'
-      && value.command !== 'foreground'
-      && value.command !== 'temp-password'
-      && value.command !== 'config'
-      && value.command !== 'restart'
-      && value.command !== 'service')
+    || typeof value.command !== 'string'
+    || (
+      !upgradeOwnerCommandSet.has(value.command)
+      && (value.kind !== 'start' || !laterReleaseStartCommandPattern.test(value.command))
+    )
   ) {
     throw new Error('Upgrade owner metadata is invalid.');
   }
@@ -1330,7 +1339,7 @@ const ownerForCurrentProcess = async (
   kindArg: TUpgradeOwnerKind,
   tokenArg: string,
   cliPathArg: string,
-  commandArg: IUpgradeProcessOwner['command'],
+  commandArg: TUpgradeOwnerCommand,
 ): Promise<IUpgradeProcessOwner> => {
   const identity = await readControllerProcessIdentity(process.pid);
   if (!identity) throw new Error('Unable to establish upgrade process ownership.');

package/ts/classes.upgradetransaction.ts

@@ -9,6 +9,7 @@ import {
 } from '../ts_interfaces/index.js';
 import { resolveAGLHomePaths } from './classes.aglhome.js';
 import {
+  isControllerManagementProtocolVersion,
   isLoopbackPortListening,
   queryControllerStatus,
   requestControllerUpgradeFinalize,
@@ -144,8 +145,22 @@ export interface IPnpmGlobalInstallation {
   packageDirectory: string;
   cliPath: string;
   packageVersion: string;
+  /**
+   * The management protocol the installed `package.json` declares (`controllerManagementProtocolVersion`), which
+   * decides how the controller this package starts is reached before it reports its status; absent when it declares
+   * none, as every release older than the loopback management endpoint.
+   */
+  managementProtocolVersion?: number;
 }
 
+/**
+ * What a `package.json` declares as `controllerManagementProtocolVersion`: `undefined` for no declaration, `false`
+ * for one that is not a safe integer of 1 or more, which makes the package metadata incompatible.
+ */
+const readDeclaredManagementProtocolVersion = (valueArg: unknown): number | undefined | false => (
+  valueArg === undefined ? undefined : isControllerManagementProtocolVersion(valueArg) ? valueArg : false
+);
+
 export interface IDetachedUpgradeWorker {
   pid: number;
   processGroupId: number;
@@ -597,15 +612,20 @@ export const resolvePnpmGlobalInstallation = async (): Promise<IPnpmGlobalInstal
     version?: unknown;
     bin?: unknown;
     controllerUpgradeManagementVersion?: unknown;
+    controllerManagementProtocolVersion?: unknown;
   };
   const currentIdentity: { cliName: string; cliRelativePath: string; managementVersion: number } = (
     currentPackageIdentity
   );
+  const managementProtocolVersion = readDeclaredManagementProtocolVersion(
+    packageJson.controllerManagementProtocolVersion,
+  );
   if (
     packageJson.name !== controllerPackageName
     || packageJson.version !== dependency.version
     || packageJson.controllerUpgradeManagementVersion !== currentIdentity.managementVersion
     || Number(controllerUpgradeManagementVersion) !== currentIdentity.managementVersion
+    || managementProtocolVersion === false
     || !declaresControllerCommands(packageJson.bin, currentIdentity)
   ) {
     throw new Error(`The pnpm-global ${controllerPackageName} package metadata is incompatible.`);
@@ -621,6 +641,7 @@ export const resolvePnpmGlobalInstallation = async (): Promise<IPnpmGlobalInstal
     packageDirectory,
     cliPath,
     packageVersion: dependency.version,
+    ...(managementProtocolVersion === undefined ? {} : { managementProtocolVersion }),
   };
 };
 
@@ -749,10 +770,14 @@ const readExactGlobalPackage = async (
   }
   const manifest = packageJson as Record<string, unknown>;
   const bin = manifest.bin;
+  const managementProtocolVersion = readDeclaredManagementProtocolVersion(
+    manifest.controllerManagementProtocolVersion,
+  );
   if (
     manifest.name !== identityArg.packageName
     || manifest.version !== identityArg.version
     || manifest.controllerUpgradeManagementVersion !== identityArg.managementVersion
+    || managementProtocolVersion === false
     || !bin
     || typeof bin !== 'object'
     || Array.isArray(bin)
@@ -772,6 +797,7 @@ const readExactGlobalPackage = async (
     packageDirectory,
     cliPath,
     packageVersion: identityArg.version,
+    ...(managementProtocolVersion === undefined ? {} : { managementProtocolVersion }),
     packageName: identityArg.packageName,
     cliName: identityArg.cliName,
     cliRelativePath: identityArg.cliRelativePath,
@@ -952,11 +978,15 @@ const resolveAuthoritativeRecoveryInstallation = async (
   }
   const manifest = packageJson as Record<string, unknown>;
   const bin = manifest.bin;
+  const managementProtocolVersion = readDeclaredManagementProtocolVersion(
+    manifest.controllerManagementProtocolVersion,
+  );
   if (
     manifest.name !== currentIdentity.packageName
     || typeof manifest.version !== 'string'
     || !currentIdentity.versions.includes(manifest.version)
     || manifest.controllerUpgradeManagementVersion !== currentIdentity.managementVersion
+    || managementProtocolVersion === false
     || !declaresControllerCommands(bin, currentIdentity)
   ) throw new Error('The authoritative recovery package identity is incompatible.');
   if (!(await plugins.fs.promises.stat(cliPath)).isFile()) {
@@ -970,6 +1000,7 @@ const resolveAuthoritativeRecoveryInstallation = async (
     packageDirectory,
     cliPath,
     packageVersion: manifest.version,
+    ...(managementProtocolVersion === undefined ? {} : { managementProtocolVersion }),
   };
 };
 
@@ -1956,6 +1987,10 @@ const grantControllerAction = async (
   },
 });
 
+/**
+ * Reads the status of a controller the upgrade just started from `installationArg`, over the transport that
+ * package's `package.json` declares.
+ */
 const queryUpgradeManagedController = async (
   portArg: number,
   identityArg: {
@@ -1963,10 +1998,12 @@ const queryUpgradeManagedController = async (
     packageVersion: string;
     managementVersion: number;
   },
+  installationArg: IPnpmGlobalInstallation,
 ): Promise<IControllerStatus> => queryControllerStatus(portArg, {
   packageName: identityArg.packageName,
   packageVersion: identityArg.packageVersion,
   upgradeManagementVersion: identityArg.managementVersion,
+  managementProtocolVersion: installationArg.managementProtocolVersion,
 });
 
 const finalizeControllerUpgrade = async (
@@ -1980,7 +2017,7 @@ const finalizeControllerUpgrade = async (
   try {
     response = await requestControllerUpgradeFinalize(statusArg.controllerPid > 0
       ? (await coordinatorArg.readTransaction(tokenArg)).port
-      : 0, tokenArg, modeArg);
+      : 0, statusArg, tokenArg, modeArg);
   } finally {
     await coordinatorArg.removeControllerActionGrant('finalize', tokenArg);
   }
@@ -2103,6 +2140,7 @@ export const prepareAndStopRunningController = async (
   try {
     await (dependenciesArg.requestPrepareBegin ?? requestControllerUpgradePrepareBegin)(
       optionsArg.port,
+      optionsArg.runningStatus,
       optionsArg.token,
       optionsArg.targetVersion,
       optionsArg.gracePeriodMs,
@@ -2323,6 +2361,7 @@ const runPackageTransitionUpgradeWorker = async (optionsArg: {
       packageVersion: initialTransaction.sourceVersion,
       protocolVersion: controllerProtocolVersion,
       upgradeManagementVersion: initialTransaction.sourceManagementVersion,
+      managementProtocolVersion: currentInstallation.managementProtocolVersion,
     });
     assertExpectedController(runningStatus, payload.expectedController);
     if (
@@ -2470,6 +2509,7 @@ const runPackageTransitionUpgradeWorker = async (optionsArg: {
         const restoredStatus = await queryUpgradeManagedController(
           payload.port,
           sourceControllerIdentity(initialTransaction),
+          sourceTopology.source,
         );
         await finalizeControllerUpgrade(
           coordinator,
@@ -2520,6 +2560,7 @@ const runPackageTransitionUpgradeWorker = async (optionsArg: {
     const targetStatus = await queryUpgradeManagedController(
       payload.port,
       targetControllerIdentity(initialTransaction),
+      targetInstallation,
     );
     await updateWorkerProgress(
       coordinator,
@@ -2728,6 +2769,7 @@ export async function runUpgradeWorker(
         packageVersion: currentInstallation.packageVersion,
         protocolVersion: controllerProtocolVersion,
         upgradeManagementVersion: controllerUpgradeManagementVersion,
+        managementProtocolVersion: currentInstallation.managementProtocolVersion,
       });
       assertExpectedController(runningStatus, payloadArg.expectedController);
       if (
@@ -2812,6 +2854,7 @@ export async function runUpgradeWorker(
               packageVersion: restored.packageVersion,
               managementVersion: controllerUpgradeManagementVersion,
             },
+            restored,
           );
           await finalizeControllerUpgrade(
             coordinator,
@@ -2851,7 +2894,7 @@ export async function runUpgradeWorker(
         packageName: controllerPackageName,
         packageVersion: latestVersion,
         managementVersion: controllerUpgradeManagementVersion,
-      });
+      }, upgradedInstallation);
       await updateWorkerProgress(
         coordinator,
         payloadArg.token,
@@ -2997,6 +3040,7 @@ const recoverPackageTransition = async (optionsArg: {
         packageName: current.targetPackageName,
         packageVersion: upgradeTransactionTargetVersion(current)!,
         upgradeManagementVersion: current.targetManagementVersion,
+        managementProtocolVersion: targetInstallation.managementProtocolVersion,
       }).catch(() => undefined);
       if (!status) {
         if (await retainedUpgradeTargetIsAuthoritative({
@@ -3019,6 +3063,7 @@ const recoverPackageTransition = async (optionsArg: {
         status = await queryUpgradeManagedController(
           current.port,
           targetControllerIdentity(current),
+          targetInstallation,
         );
       }
       await finalizeControllerUpgrade(
@@ -3051,6 +3096,7 @@ const recoverPackageTransition = async (optionsArg: {
       packageName: transaction.sourcePackageName,
       packageVersion: transaction.sourceVersion,
       upgradeManagementVersion: transaction.sourceManagementVersion,
+      managementProtocolVersion: sourceInstallation.managementProtocolVersion,
     }).catch(() => undefined);
     if (!status) {
       await startRestoredController(
@@ -3062,6 +3108,7 @@ const recoverPackageTransition = async (optionsArg: {
       status = await queryUpgradeManagedController(
         transaction.port,
         sourceControllerIdentity(transaction),
+        sourceInstallation,
       );
     }
     await finalizeControllerUpgrade(
@@ -3130,6 +3177,7 @@ const recoverStalledUpgradeUnderLock = async (optionsArg: {
         packageName: controllerPackageName,
         packageVersion: targetInstallation.packageVersion,
         upgradeManagementVersion: controllerUpgradeManagementVersion,
+        managementProtocolVersion: targetInstallation.managementProtocolVersion,
       }).catch(() => undefined);
       if (!status) {
         if (await retainedUpgradeTargetIsAuthoritative({
@@ -3156,6 +3204,7 @@ const recoverStalledUpgradeUnderLock = async (optionsArg: {
             packageVersion: targetInstallation.packageVersion,
             managementVersion: controllerUpgradeManagementVersion,
           },
+          targetInstallation,
         );
       }
       await finalizeControllerUpgrade(
@@ -3187,6 +3236,7 @@ const recoverStalledUpgradeUnderLock = async (optionsArg: {
       packageName: controllerPackageName,
       packageVersion: sourceInstallation.packageVersion,
       upgradeManagementVersion: controllerUpgradeManagementVersion,
+      managementProtocolVersion: sourceInstallation.managementProtocolVersion,
     }).catch(() => undefined);
     if (!status) {
       await startRestoredController(
@@ -3202,6 +3252,7 @@ const recoverStalledUpgradeUnderLock = async (optionsArg: {
           packageVersion: sourceInstallation.packageVersion,
           managementVersion: controllerUpgradeManagementVersion,
         },
+        sourceInstallation,
       );
     }
     await finalizeControllerUpgrade(

package/ts/classes.usagefeed.ts

@@ -68,7 +68,8 @@ const bucketOrder = (leftArg: IControllerUsageBucket, rightArg: IControllerUsage
 
 const sameCounts = (leftArg: IControllerUsageBucket, rightArg: IControllerUsageBucket): boolean => leftArg.calls === rightArg.calls
   && leftArg.inputTokens === rightArg.inputTokens && leftArg.outputTokens === rightArg.outputTokens
-  && leftArg.cacheReadTokens === rightArg.cacheReadTokens && leftArg.cacheWriteTokens === rightArg.cacheWriteTokens;
+  && leftArg.cacheReadTokens === rightArg.cacheReadTokens && leftArg.cacheWriteTokens === rightArg.cacheWriteTokens
+  && leftArg.cacheReadUnknownCalls === rightArg.cacheReadUnknownCalls && leftArg.cacheWriteUnknownCalls === rightArg.cacheWriteUnknownCalls;
 
 /**
  * The metrics board's usage feed in the controller. The proxy keeps the token usage and has no push, so the feed reads

package/ts/functions.controllermanagementsurface.ts

@@ -0,0 +1,149 @@
+import * as plugins from './plugins.js';
+import {
+  controllerManagementMethods,
+  controllerManagementRequestMaximumBodyBytes,
+  controllerManagementTypedRequestPath,
+} from '../ts_interfaces/index.js';
+
+/** The direct peer addresses the management endpoint answers: this host's loopback, as Node reports it. */
+const loopbackPeerAddresses = new Set(['127.0.0.1', '::ffff:127.0.0.1', '::1']);
+
+/**
+ * Headers a forwarding proxy adds, and the transport secret a trusted TLS proxy injects. A request that carries one
+ * came through a proxy, even one on this host whose connection is loopback, so it is not a local caller's.
+ */
+const forwardingHeaders = [
+  'forwarded',
+  'x-forwarded-for',
+  'x-forwarded-host',
+  'x-forwarded-proto',
+  'x-real-ip',
+  'x-harness-controller-proxy-secret',
+] as const;
+
+const envelopeKeys = new Set(['method', 'request', 'response', 'correlation', 'requestInstanceId']);
+
+/**
+ * The connection a management request arrived on, granted to its handler as `localData.peer`: one per request, so
+ * the handlers' per-peer operation and preflight budgets count it as a connection of its own.
+ */
+export interface IControllerManagementPeer {
+  id: string;
+  context: {
+    headers: Headers;
+    state: Record<string, unknown>;
+  };
+}
+
+export const isLoopbackPeerAddress = (addressArg: string | undefined): boolean => (
+  addressArg !== undefined && loopbackPeerAddresses.has(addressArg)
+);
+
+/**
+ * Admits a request to the management endpoint before its body is read: from a loopback peer, a POST of
+ * `application/json` to the exact path, addressed to `127.0.0.1:<port>`, with no `Origin` (a browser always sends
+ * one with a POST) and no forwarding header. Anything else is refused; nothing about the request is logged.
+ */
+export const admitControllerManagementRequest = (
+  contextArg: plugins.smartserve.IRequestContext,
+  portArg: number,
+): true | Response => {
+  if (!isLoopbackPeerAddress(contextArg.connectionInfo?.remoteAddr)) {
+    return new Response('Forbidden', { status: 403 });
+  }
+  const url = contextArg.url;
+  if (
+    url.pathname !== controllerManagementTypedRequestPath
+    || url.search !== ''
+    || url.hash !== ''
+    || url.username !== ''
+    || url.password !== ''
+    || url.hostname !== '127.0.0.1'
+    || url.port !== String(portArg)
+    || contextArg.headers.get('host') !== `127.0.0.1:${portArg}`
+  ) {
+    return new Response('Not Found', { status: 404 });
+  }
+  if (
+    contextArg.headers.has('origin')
+    || forwardingHeaders.some((headerArg) => contextArg.headers.has(headerArg))
+  ) {
+    return new Response('Forbidden', { status: 403 });
+  }
+  if (contextArg.method !== 'POST') {
+    return new Response('Method Not Allowed', { status: 405, headers: { Allow: 'POST' } });
+  }
+  if (contextArg.headers.get('content-type') !== 'application/json') {
+    return new Response('Unsupported Media Type', { status: 415 });
+  }
+  return true;
+};
+
+/**
+ * Admits one envelope: exactly the keys a TypedRequest client sends, a management method, a request object and a
+ * request-phase correlation. It grants the request its own peer and nothing else: every upgrade method still
+ * authorises itself against the upgrade token it is handed, as it does over the controller socket.
+ */
+export const admitControllerManagementTypedRequest = (
+  requestArg: plugins.typedrequestInterfaces.ITypedRequest,
+  contextArg: plugins.smartserve.IRequestContext,
+): { trustedLocalData: { peer: IControllerManagementPeer } } | Response => {
+  const envelope: unknown = requestArg;
+  if (
+    typeof envelope !== 'object'
+    || envelope === null
+    || Array.isArray(envelope)
+    || !Object.keys(envelope).every((keyArg) => envelopeKeys.has(keyArg))
+  ) return new Response('Invalid request', { status: 400 });
+  const { method, request, correlation, requestInstanceId } = envelope as Record<string, unknown>;
+  if (
+    !controllerManagementMethods.some((methodArg) => methodArg === method)
+    || typeof request !== 'object'
+    || request === null
+    || Array.isArray(request)
+    || typeof correlation !== 'object'
+    || correlation === null
+    || (correlation as Record<string, unknown>).phase !== 'request'
+    || typeof (correlation as Record<string, unknown>).id !== 'string'
+    || typeof requestInstanceId !== 'string'
+    || requestInstanceId.length === 0
+  ) return new Response('Invalid request', { status: 400 });
+  return {
+    trustedLocalData: {
+      peer: {
+        id: `management:${plugins.crypto.randomUUID()}`,
+        context: { headers: contextArg.headers, state: {} },
+      },
+    },
+  };
+};
+
+/**
+ * The management endpoint as a surface of the controller's listener: it matches only the exact host and path, so
+ * every other request on the port keeps reaching the browser surface.
+ */
+export const createControllerManagementSurface = (optionsArg: {
+  port: number;
+  router: plugins.typedrequest.TypedRouter;
+}): plugins.typedserver.ITypedServerSurface => ({
+  name: 'controller-management',
+  match: { hostnames: ['127.0.0.1'], pathPrefixes: [controllerManagementTypedRequestPath] },
+  httpTypedRouter: optionsArg.router,
+  typedRequestPath: controllerManagementTypedRequestPath,
+  typedRequestMaxBodyBytes: controllerManagementRequestMaximumBodyBytes,
+  includeBuiltinTypedHandlers: false,
+  serveDir: null,
+  spaFallback: false,
+  healthzEndpoint: false,
+  cors: false,
+  noCache: true,
+  requestAdmission: (contextArg) => admitControllerManagementRequest(contextArg, optionsArg.port),
+  typedRequestAdmission: admitControllerManagementTypedRequest,
+  securityHeaders: {
+    xFrameOptions: 'DENY',
+    xContentTypeOptions: true,
+    referrerPolicy: 'no-referrer',
+    crossOriginOpenerPolicy: 'same-origin',
+    crossOriginResourcePolicy: 'same-origin',
+  },
+});

package/ts/functions.inferencecli.ts

@@ -19,12 +19,15 @@ type TAccountPlacementKey = 'lifecycle' | 'lapsesAt' | 'placementScore' | 'place
 
 /**
  * The status a running proxy answers with: one started from an AGL before 38.3.0 reports no accounts and no usage
- * observations, one before 38.4.0 no lifecycle, placement or placement journal, and one before confined runs neither
- * its confined listener nor its runs.
+ * observations, one before 38.4.0 no lifecycle, placement or placement journal, one before confined runs neither
+ * its confined listener nor its runs, and one before ChatGPT-pool confined runs no run's pool: its runs are all of the
+ * Claude pool.
  */
 export type TReportedProxyStatus = Omit<IAglProxyStatus, 'accounts' | 'usageObservations' | 'nextPlacement'
   | 'recentPlacements' | 'confinedSocketPath' | 'confinedRuns'>
-  & Partial<Pick<IAglProxyStatus, 'usageObservations' | 'nextPlacement' | 'recentPlacements' | 'confinedSocketPath' | 'confinedRuns'>>
+  & Partial<Pick<IAglProxyStatus, 'usageObservations' | 'nextPlacement' | 'recentPlacements' | 'confinedSocketPath'>>
+  & { confinedRuns?: Array<Omit<IAglProxyStatus['confinedRuns'][number], 'provider'>
+    & Partial<Pick<IAglProxyStatus['confinedRuns'][number], 'provider'>>> }
   & { accounts?: Array<Omit<IAglProxyStatus['accounts'][number], TAccountPlacementKey>
     & Partial<Pick<IAglProxyStatus['accounts'][number], TAccountPlacementKey>>> };
 
@@ -73,7 +76,8 @@ export const formatProxyStatus = (unitArg: string, statusArg: TReportedProxyStat
   if (statusArg.confinedSocketPath !== undefined) {
     lines.push(`Confined listener: ${statusArg.confinedSocketPath ?? 'none'}`);
     for (const run of statusArg.confinedRuns ?? []) {
-      lines.push(`Confined run ${run.id}: issued ${run.createdAt}`
+      // An older proxy names no run's pool: it issues Claude-pool runs alone.
+      lines.push(`Confined run ${run.id}: ${run.provider === 'openai' ? 'ChatGPT pool' : 'Claude pool'}, issued ${run.createdAt}`
         + `${run.held ? '' : ', waiting for its launcher to take it back after a proxy restart'}`
         + ` (end it with \`agl proxy confined end ${run.id}\`)`);
     }
@@ -213,13 +217,17 @@ const run = (optionsArg: IInferenceCliArguments): Promise<void> => withSignals(a
 const confinedRun = (optionsArg: IInferenceCliArguments): Promise<void> => withSignals(async (signalArg) => {
   await preflightAGLHomeMigration();
   const paths = resolveAGLHomePaths();
-  const run = await AglProxyConfinedHolder.take({ socketPath: paths.proxySocket }, AbortSignal.any([signalArg, AbortSignal.timeout(90_000)]));
+  const run = await AglProxyConfinedHolder.take({ socketPath: paths.proxySocket, provider: optionsArg.provider ?? 'anthropic' },
+    AbortSignal.any([signalArg, AbortSignal.timeout(90_000)]));
   let lost: AglProxyLeaseLostError | undefined;
   try {
     const launch = confinedDockerLaunch({ args: optionsArg.args, socketPath: run.confinedSocketPath, baseUrl: run.baseUrl,
-      token: run.token, environment: process.env });
+      token: run.token, environment: process.env,
+      pool: run.provider === 'anthropic' ? { provider: 'anthropic' } : { provider: 'openai', models: run.models } });
+    // A Claude-pool run says what it said before ChatGPT-pool runs; a ChatGPT-pool run says so.
     process.stderr.write(`AGL proxy confined run ${run.id}: ${plugins.path.dirname(run.confinedSocketPath)} is mounted read-only `
-      + `at ${aglProxyConfinedMountPoint}; end it at once with \`agl proxy confined end ${run.id}\`.\n`);
+      + `at ${aglProxyConfinedMountPoint}${run.provider === 'openai' ? ', served from the ChatGPT pool' : ''}; `
+      + `end it at once with \`agl proxy confined end ${run.id}\`.\n`);
     signalArg.throwIfAborted();
     const child = plugins.childProcess.spawn(launch.command, launch.args, { env: launch.environment, stdio: 'inherit', shell: false });
     let killTimer: ReturnType<typeof setTimeout> | undefined;

package/ts/functions.inferencecliarguments.ts

@@ -26,7 +26,7 @@ export const inferenceCliHelp = `Usage:
   agl proxy status [--json]
   agl proxy credential <client> [--provider openai|anthropic] [--delivery file|none] [--write <path>] [--rotate] | --version
   agl proxy run codex|claude|opencode [--provider openai|anthropic] [--account <id>] [--plan <name>] [--model <id>] -- [harness arguments]
-  agl proxy confined run -- docker run [docker options] <image> [command]
+  agl proxy confined run [--provider anthropic|openai] -- docker run [docker options] <image> [command]
   agl proxy confined end <run id>
 
 The proxy runs as the ${aglProxyUnitName} user unit (serve runs it in a terminal instead).
@@ -40,12 +40,15 @@ client starts on Claude accounts, every other client on ChatGPT accounts; --prov
 Run gives one child a private credential that ends when the child exits; run claude uses Claude accounts
 unless --provider openai asks for ChatGPT models behind Claude Code.
 confined run starts Claude Code's container on a credential of its own, accepted only on the proxy's confined
-listener: a Unix socket whose directory the run mounts read-only at ${aglProxyConfinedMountPoint}, served the Claude pool's
-three Claude Code endpoints alone. It adds the mount and Claude Code's settings (ANTHROPIC_UNIX_SOCKET, ANTHROPIC_BASE_URL,
-ANTHROPIC_AUTH_TOKEN) right after docker run, prints the run's id on standard error, and ends the credential when the
+listener: a Unix socket whose directory the run mounts read-only at ${aglProxyConfinedMountPoint}, served Claude Code's
+three endpoints of the run's pool alone: Claude accounts unless --provider openai asks for the ChatGPT pool, whose
+ChatGPT accounts answer it translated, as for run claude --provider openai. It adds the mount and Claude Code's settings
+(ANTHROPIC_UNIX_SOCKET, ANTHROPIC_BASE_URL, ANTHROPIC_AUTH_TOKEN, and on the ChatGPT pool the model variables run claude
+--provider openai sets) right after docker run, prints the run's id on standard error, and ends the credential when the
 container exits. The socket is the proxy user's (0600): run the container as that uid (--user), or as root under
 rootless Docker. Root of a rootful daemon connects as well while it keeps CAP_DAC_OVERRIDE (--cap-drop ALL takes it).
-confined end ends a run's credential at once, and its launcher stops the container; agl proxy status lists the runs.
+confined end ends a run's credential at once, and its launcher stops the container; agl proxy status lists the runs
+with their pools.
 Repeat --account or --plan to restrict automatic routing. Only accounts the account service holds are eligible.
 ChatGPT pools: /openai/v1/responses, /anthropic/v1/messages (translated), and each prefix's /models.
 Claude pools: /anthropic/v1/messages, /anthropic/v1/messages/count_tokens and /anthropic/v1/models, sent on as Claude Code sent them.
@@ -124,7 +127,14 @@ export const parseInferenceCliArguments = (argvArg: readonly string[]): IInferen
       result.confinedId = id;
       return result;
     }
-    if (action !== 'run' || argv.shift() !== '--' || !argv.length) throw new Error(inferenceCliHelp);
+    if (action !== 'run') throw new Error(inferenceCliHelp);
+    if (argv[0] === '--provider') {
+      argv.shift();
+      const value = argv.shift();
+      if (!inferenceProviders.includes(value as TInferenceProvider)) throw new Error('--provider is openai or anthropic.');
+      result.provider = value as TInferenceProvider;
+    }
+    if (argv.shift() !== '--' || !argv.length) throw new Error(inferenceCliHelp);
     result.confinedAction = 'run';
     result.args = argv;
     return result;