badgr-cli 1.1.5 → 1.1.7

package/src/commands/diagnose.js

@@ -5,10 +5,14 @@ import { ensureLoggedIn } from '../onboarding.js';
 import { webBaseUrl } from '../config.js';
 
 const DIAGNOSE_HELP = `
-Paste anything. This IS the Badgr Smoke Test: free, no GPU, no login.
+Paste anything. This IS Badgr Preflight: free, no GPU, no login.
 Badgr detects the input, resolves a command, and automatically runs every
 applicable free structural check on it. No GPU launches without explicit
---approve, which starts a real Badgr Run.
+--approve, which starts a real Badgr Run (the Smoke Test step below).
+
+  Badgr Preflight
+  -> static checks -> resource fit -> compatibility checks
+  -> optional Smoke Test (a tiny, capped, real GPU run) -> Verdict
 
 Usage:
   badgr diagnose "<input>"
@@ -31,6 +35,12 @@ Flags:
                           browser sign-in automatically if not logged in).
                           This is a real, billable GPU-provisioned execution
                           -- distinct from the free diagnosis above.
+  --paid-ok              Explicit consent to run as a normal paid job when a
+                          free Smoke Test entitlement exists but can't cover
+                          this proof (over the $0.50 cap, or the daily free-
+                          verification budget is exhausted). Without this,
+                          --approve stops and shows the reason instead of
+                          silently charging you.
   --smoke                Deprecated, no-op. The free mechanical checks this
                           used to gate are now always run automatically as
                           part of plain "badgr diagnose" -- kept only so
@@ -44,7 +54,7 @@ Flags:
   --json                 Machine-readable JSON output
   --help, -h             Show this help
 
-Status: every run prints one of NEEDS INFO / READY / SMOKE CHECKED / INVALID / VERIFIED.
+Verdict: every run prints one of NEEDS INFO / READY / SMOKE CHECKED / INVALID / VERIFIED.
         NEEDS INFO    -- cannot yet produce a complete command
         READY         -- complete evidence-backed command, no applicable checks to run
         SMOKE CHECKED -- applicable checks ran; all PASS or SKIPPED
@@ -179,11 +189,11 @@ function detectInput(raw, flags) {
   return { kind: 'text', label: 'Text / conversation', body: classified.body };
 }
 
-// backend/run_issue_routes.py's /extract now returns the canonical
+// the backend's own /extract now returns the canonical
 // "service" (persistent, badgr serve) vs "finite_job" (bounded, badgr
 // run/train/comfyui) classification directly on the extraction as
-// `workload_shape` (_workload_shape, the same predicate
-// _canonical_badgr_command itself uses to pick a subcommand) -- read that
+// `workload_shape` (the same predicate the backend's own
+// command-canonicalization logic uses to pick a subcommand) -- read that
 // instead of re-deriving an approximation here, so the CLI's wording can
 // never drift from what the backend actually decided. The local fallback
 // only matters for a response predating this field (e.g. a cached fixture).
@@ -274,7 +284,7 @@ function _printResult(result, chalk) {
     // verification step below is still capped (it's just a readiness
     // check), but the resulting `badgr serve` endpoint keeps running and
     // billing until stopped, or an explicit --max-cost/--max-runtime is
-    // supplied. See backend/run_issue_routes.py's _canonical_badgr_command.
+    // supplied. See the backend's own command-canonicalization logic.
     console.log(`  ${chalk.bold('Recommended action:')} Open the Run link below to verify readiness and start the service`);
     console.log(`    ${chalk.dim('The service keeps running after verification -- stop it with `badgr down`, or launch it with --max-cost/--persistent.')}`);
   } else {
@@ -332,12 +342,13 @@ function _localPathCandidates(e) {
 // Pure presentation over data /run-issue/extract already returns -- no new
 // endpoint, no new GPU behaviour. Diagnosis alone can reach SMOKE CHECKED
 // or INVALID (never VERIFIED, see AGENTS.md §12 and _printCopySummary
-// below) -- `badgr diagnose` IS the Badgr Smoke Test, so applicable free
-// checks always run and always count toward the printed status; there is
-// no separate opt-in step for them.
+// below) -- `badgr diagnose` IS Badgr Preflight, so applicable free checks
+// always run and always count toward the printed verdict; there is no
+// separate opt-in step for them. The real, bounded GPU run is the distinct
+// "Smoke Test" step (--approve / run_smoke_test), never this free path.
 //
 // The evidence-only judgment (needs_info/invalid/smoke_checked) is computed
-// once, server-side, in `_compute_smoke_status` (backend/run_issue_routes.py)
+// once, server-side, in the backend's own smoke-status computation
 // and read here via `e.smoke_status` -- this and /run-issue's `smokeStatus()`
 // (frontend/app/run-issue/page.tsx) both just render that one backend
 // verdict rather than each re-deriving pass/fail from mechanical_checks, so
@@ -355,7 +366,7 @@ function _localPathCandidates(e) {
 function _statusWord(result) {
   const e = result.extraction || {};
   if (result.static_incompatibilities?.length || e.missing_information?.length) return 'NEEDS INFO';
-  // Mirrors backend/run_issue_routes.py's _compute_smoke_status exactly: a
+  // Mirrors the backend's own smoke-status computation exactly: a
   // mechanical FAIL is invalid; otherwise only real command-scope evidence
   // (smoke_check.proof_level === "smoke_checked" -- the repository/image/
   // service's own documented default, not just a syntax-only pass) earns
@@ -373,24 +384,29 @@ function _statusWord(result) {
 }
 
 const _CHECK_LABELS = {
-  command_syntax:     'command syntax',
-  supported_flags:    'known CLI flags',
-  cli_entrypoint:     'CLI entrypoint',
-  referenced_files:   'referenced repo files',
-  image_availability: 'image exists / accessible',
-  docker_entrypoint:  'Docker metadata',
-  required_env_vars:  'required env vars',
+  command_syntax:               'command syntax',
+  subcommand_exists:            'known subcommand',
+  required_positional_args:     'required positional args',
+  supported_flags:              'known CLI flags',
+  cli_entrypoint:                'CLI entrypoint',
+  referenced_files:             'referenced repo files',
+  dockerfile_expected:          'Dockerfile present',
+  image_availability:           'image exists / accessible',
+  docker_entrypoint:            'Docker metadata',
+  required_env_vars:            'required env vars',
+  required_ports:               'required ports',
+  runtime_workload_compatibility: 'runtime supports workload type',
 };
 
-// Compact, copy-pasteable result -- the literal STATUS word plus just enough
-// to forward to someone else. Additive to the detailed report above it;
-// does not replace it. Never prints "Verified" -- SMOKE CHECKED is the
+// Compact, copy-pasteable result -- the literal Verdict word plus just
+// enough to forward to someone else. Additive to the detailed report above
+// it; does not replace it. Never prints "Verified" -- SMOKE CHECKED is the
 // ceiling for this free path.
 function _printCopySummary(result, chalk, caseData, config) {
   const e = result.extraction || {};
   const status = _statusWord(result);
 
-  console.log(`  ${chalk.bold(`STATUS: ${status}`)}`);
+  console.log(`  ${chalk.bold(`Verdict: ${status}`)}`);
   console.log();
 
   if (status === 'NEEDS INFO') {
@@ -409,7 +425,7 @@ function _printCopySummary(result, chalk, caseData, config) {
   // --approve would run) is preferred over the raw source command --
   // /confirm can only compute it once a case exists (READY/SMOKE CHECKED),
   // and only when there's enough evidence to convert (see
-  // _canonical_badgr_command's docstring, backend/run_issue_routes.py, for
+  // the backend's own command-canonicalization logic for
   // what it can't yet convert, e.g. training/ComfyUI). Falls back to the
   // raw extracted command otherwise -- still true and still runnable input,
   // just not guaranteed to already be `badgr`-shaped.
@@ -441,9 +457,12 @@ function _printCopySummary(result, chalk, caseData, config) {
     if (status === 'INVALID') {
       console.log('  A check above actually failed -- this command is not runnable as-is.');
     } else {
-      console.log('  Not GPU-verified.');
+      console.log(`  ${chalk.bold('Smoke test:')} Not run yet.`);
     }
     console.log();
+  } else if (status === 'READY') {
+    console.log(`  ${chalk.bold('Smoke test:')} Not run yet.`);
+    console.log();
   }
 }
 
@@ -463,9 +482,10 @@ function _printSmokeChecks(result, chalk) {
   // final verdict (_statusWord can land on READY, NEEDS INFO, or INVALID
   // just as easily as SMOKE CHECKED; see its own comment for why a
   // syntax-only pass isn't proof of scope). A fixed "Smoke Checked" header
-  // here previously disagreed with a `STATUS: READY` line printed right
-  // after it -- this section is the free checks themselves, not the verdict.
-  console.log(`  ${chalk.bold('Free checks (no GPU, no login):')}`);
+  // here previously disagreed with a `Verdict: READY` line printed right
+  // after it -- this section is Preflight itself (static + resource checks),
+  // not the verdict, and not the (separate, real-GPU) Smoke Test step.
+  console.log(`  ${chalk.bold('Preflight (no GPU, no login):')}`);
 
   const icon = (status) => (
     status === 'pass' ? chalk.green('✓') : status === 'fail' ? chalk.red('✗') : chalk.dim('-')
@@ -569,7 +589,7 @@ async function _createRunPage(config, e, chalk) {
   }
 }
 
-async function _doApprove(config, caseData, chalk) {
+async function _doApprove(config, caseData, chalk, paidFallbackConfirmed) {
   const { case_id: caseId, status, test_plan: plan, workload_plan: workloadPlan, missing_information: missing } = caseData;
 
   if (status === 'incompatible') {
@@ -594,9 +614,9 @@ async function _doApprove(config, caseData, chalk) {
     return;
   }
 
-  // Display the canonical WorkloadPlan (backend/reliability_engine.py) --
-  // the same object creation -> routing -> Jobs -> watchdog all consume --
-  // rather than a second, independently-derived estimate. Falls back to the
+  // Display the canonical WorkloadPlan -- the same object creation ->
+  // routing -> Jobs -> watchdog all consume -- rather than a second,
+  // independently-derived estimate. Falls back to the
   // raw test_plan only for fields the canonical plan doesn't carry
   // (requires_reduced_test / requires_funding_approval are smoke-check-only
   // concerns, never part of WorkloadPlan).
@@ -609,16 +629,16 @@ async function _doApprove(config, caseData, chalk) {
     if (plan?.requires_funding_approval)   console.log(`  ${chalk.yellow('!')} Large download — funding required`);
   }
 
-  await _approveAndRun(config, caseId, plan, chalk);
+  await _approveAndRun(config, caseId, plan, chalk, paidFallbackConfirmed);
 }
 
 // Claim → approve → run for a case that already exists (just created via
 // /confirm above, or resumed via an existing_case input). Auth is required
 // from here on — diagnosis and case creation stay anonymous and free, but a
 // real GPU test needs a signed-in account. The CLI never grants a free-run
-// entitlement (web admin only, see grant_free_run in run_issue_routes.py);
+// entitlement (web admin only, granted server-side);
 // it only redeems one a case already carries, same as normal billing.
-async function _approveAndRun(config, caseId, plan, chalk) {
+async function _approveAndRun(config, caseId, plan, chalk, paidFallbackConfirmed) {
   const printResumeHint = () =>
     console.error(chalk.dim(`  Resume this case: ${webBaseUrl(config)}/run-issue?case_id=${caseId}\n`));
 
@@ -706,7 +726,11 @@ async function _approveAndRun(config, caseId, plan, chalk) {
   let ran;
   try {
     ran = await callApi(`/run-issue/cases/${caseId}/run`, {
-      method: 'POST', apiKey: authConfig.apiKey, baseUrl: authConfig.baseUrl, timeoutMs: 30_000,
+      method: 'POST',
+      apiKey: authConfig.apiKey,
+      baseUrl: authConfig.baseUrl,
+      body: { paid_fallback_confirmed: Boolean(paidFallbackConfirmed) },
+      timeoutMs: 30_000,
     });
   } catch (err) {
     if (err.isPaymentRequired) {
@@ -719,6 +743,29 @@ async function _approveAndRun(config, caseId, plan, chalk) {
     return;
   }
 
+  // The free entitlement existed but couldn't cover this proof (over the
+  // per-proof cap, or the daily subsidy budget exhausted) -- nothing ran
+  // and nothing was charged (the backend's own smoke-test execution
+  // stop-and-ask branch). Never auto-continue as paid: require the caller
+  // to explicitly re-run with --paid-ok once they've seen this and the
+  // real cap, exactly like the reduced-test block above.
+  if (ran?.paid_execution_required && !ran?.free_run_used) {
+    console.log();
+    console.log(chalk.yellow(`  Smoke test not run.`));
+    console.log();
+    console.log(`  ${chalk.bold('Free verification unavailable:')} ${
+      ran.free_run_skipped_reason === 'daily_budget_exhausted'
+        ? 'Daily free-verification budget exhausted.'
+        : 'The smallest useful proof exceeds the free verification limit.'
+    }`);
+    console.log();
+    if (ran.max_cost_usd != null) console.log(`  ${chalk.bold('Max cost:')} $${Number(ran.max_cost_usd).toFixed(2)}`);
+    console.log(chalk.dim(`  Continue with a paid Smoke Test: badgr diagnose ${caseId} --approve --paid-ok`));
+    console.log();
+    process.exitCode = 1;
+    return;
+  }
+
   console.log();
   console.log(chalk.green('  Run started.'));
   console.log(`  ${chalk.bold('Case:')}     ${caseId}`);
@@ -746,7 +793,7 @@ async function _diagnoseExistingCase(config, caseId, flags, chalk) {
 
   if (flags.json) {
     console.log(JSON.stringify(caseData, null, 2));
-    if (flags.approve) await _approveAndRun(config, caseId, caseData.test_plan, chalk);
+    if (flags.approve) await _approveAndRun(config, caseId, caseData.test_plan, chalk, flags.paidOk);
     return;
   }
 
@@ -770,7 +817,7 @@ async function _diagnoseExistingCase(config, caseId, flags, chalk) {
     || caseData.status === 'verified' || caseData.status === 'completed'
     ? 'VERIFIED'
     : (caseData.missing_information || []).length ? 'NEEDS INFO' : 'READY';
-  console.log(`  ${chalk.bold(`STATUS: ${existingStatus}`)}`);
+  console.log(`  ${chalk.bold(`Verdict: ${existingStatus}`)}`);
   if (existingStatus === 'VERIFIED') {
     console.log();
     console.log(`  ${chalk.bold('Command:')}`);
@@ -798,7 +845,7 @@ async function _diagnoseExistingCase(config, caseId, flags, chalk) {
   console.log();
 
   if (flags.approve) {
-    await _approveAndRun(config, caseId, caseData.test_plan, chalk);
+    await _approveAndRun(config, caseId, caseData.test_plan, chalk, flags.paidOk);
   } else {
     console.log(`  ${chalk.bold('Resume:')} badgr diagnose ${caseId} --approve`);
     console.log();
@@ -829,6 +876,7 @@ export async function diagnoseCommand(config, args, chalk) {
     if (a === '--comfyui')  { flags.comfyui = args[++i]; i++; continue; }
     if (a === '--github')   { flags.github  = args[++i]; i++; continue; }
     if (a === '--approve')  { flags.approve = true;  i++; continue; }
+    if (a === '--paid-ok')  { flags.paidOk  = true;  i++; continue; }
     if (a === '--smoke')    { flags.smoke   = true;  i++; continue; }
     if (a === '--json')     { flags.json    = true;  i++; continue; }
     if (!a.startsWith('-')) positionalParts.push(a);
@@ -952,7 +1000,7 @@ export async function diagnoseCommand(config, args, chalk) {
         console.error(chalk.yellow('\n  Cannot approve — missing information above.\n'));
         return;
       }
-      await _doApprove(config, caseData, chalk);
+      await _doApprove(config, caseData, chalk, flags.paidOk);
     }
     return;
   }
@@ -982,6 +1030,6 @@ export async function diagnoseCommand(config, args, chalk) {
       console.log(chalk.yellow('\n  Cannot approve — missing information above.\n'));
       return;
     }
-    await _doApprove(config, caseData, chalk);
+    await _doApprove(config, caseData, chalk, flags.paidOk);
   }
 }

package/src/commands/down.js

@@ -1,6 +1,6 @@
 import { ensureLoggedInReady, withReauthRetry } from '../onboarding.js';
 import { findDeployment, removeDeployment, addReceipt, generateReceiptId } from '../store.js';
-import { terminateDeployment, listDeployments, adminTerminateDeployment } from '../api.js';
+import { terminateDeployment, listDeployments } from '../api.js';
 
 function formatRuntime(minutes) {
   if (minutes < 60) return `${minutes}m`;
@@ -32,13 +32,22 @@ export async function downCommand(config, args, chalk) {
 
   config = await ensureLoggedInReady(config, chalk);
 
-  // --admin bypasses per-user ownership (michaelhireitem@gmail.com only --
-  // see deployment_routes.py's DELETE /v1/admin/deployments/{id}) so a
-  // deployment found via `badgr status --admin` (owned by a different
-  // account) can actually be stopped. Local name lookup only applies to the
-  // caller's own deployments, so it's skipped here -- an admin shutdown
-  // always targets a real deployment_id from `badgr status --admin`.
+  // --admin bypasses per-user ownership (gated server-side by an internal
+  // admin allowlist) so a deployment found via `badgr status --admin`
+  // (owned by a different account) can actually be stopped. Local name
+  // lookup only applies to the caller's own deployments, so it's skipped
+  // here -- an admin shutdown always targets a real deployment_id from
+  // `badgr status --admin`. See ../admin.js for why this is a separate,
+  // never-publicly-exported module.
   if (isAdmin) {
+    let adminTerminateDeployment;
+    try {
+      ({ adminTerminateDeployment } = await import('../admin.js')); // oss-safe: guarded by try/catch, no-ops when admin.js is absent from a public export
+    } catch {
+      console.error(chalk.red('\n  Admin mode is not available in this build.\n'));
+      process.exitCode = 1;
+      return;
+    }
     process.stdout.write(chalk.dim(`  [admin] Stopping ${idOrName}...`));
     try {
       const refreshed = await withReauthRetry(config, chalk, cfg => adminTerminateDeployment(cfg, idOrName));

package/src/commands/job.js

@@ -8,7 +8,7 @@ import { ensureBadgrReady } from '../onboarding.js';
  * Submits a bounded coding-agent job via POST /v1/jobs (type: "agent"),
  * which creates a Job record and runs it on a GPU/CPU VM.
  * All three interfaces (website, CLI, POST /v1/jobs) share the same
- * execution path on the backend (backend/jobs_routes.py).
+ * execution path on the backend.
  *
  * Usage:
  *   badgr job cline "Fix the checkout bug" --check "npm test"
@@ -46,15 +46,15 @@ function parseJobArgs(rawArgs) {
   return { flags, positional };
 }
 
-// Providers the agent Job type accepts (backend jobs_routes._VALID_AGENT_PROVIDERS).
+// Providers the agent Job type accepts (server-side allowlist).
 // The BYOK/OpenAI-compatible providers `badgr launch --provider` supports
 // (openrouter, deepseek, glm, custom) are NOT among them: the Jobs API
 // resolves credentials server-side from stored provider credentials and has
 // nowhere to put a custom base URL, so those must be rejected in the CLI
 // rather than sent on to a 400 from the server.
-export const JOB_API_PROVIDERS = ['badgr', 'openai', 'anthropic'];
+export const JOB_API_PROVIDERS = ['badgr', 'openai', 'anthropic', 'commandcode'];
 
-export const JOB_AGENTS = ['cline', 'claude', 'claude-code', 'codex', 'playwright'];
+export const JOB_AGENTS = ['cline', 'claude', 'claude-code', 'codex', 'opencode', 'commandcode', 'playwright'];
 
 export async function jobCommand(config, args, chalk) {
   // Support both:
@@ -77,7 +77,7 @@ export async function jobCommand(config, args, chalk) {
 
   if (!instructionText || !agentName) {
     console.error(chalk.red('\nUsage: badgr job <agent> "<instruction>" --check "<command>"\n'));
-    console.error(chalk.dim('  Agents: cline (default), claude-code, codex, playwright'));
+    console.error(chalk.dim('  Agents: cline (default), claude-code, codex, opencode, commandcode, playwright'));
     console.error(chalk.dim('  Example: badgr job cline "Fix the checkout bug" --check "npm test"'));
     console.error(chalk.dim('  Example: badgr job claude-code "Add pagination" --check "pytest tests/" --max-cost 3\n'));
     process.exitCode = 1;

package/src/commands/launch.js

@@ -9,9 +9,16 @@ import { VM_CLASSES, LAUNCH_VM_SIZES, vmClassForWorkload } from '../spec.js';
 // explicit `badgr launch <source> -- <command>` form (kept as the advanced
 // escape hatch), including --image for a fully custom runtime.
 //
+// `opencode` rejoins this list (it was dropped from the bare-shorthand set
+// in Phase 1's third revision — see docs/badgr-execution-roadmap.md's
+// history note) now that it has a real image and a wrapper script verified
+// against the live CLI (images/badgr-agent-opencode/badgr-opencode-run). It
+// is a BYOK-only lane like claude/codex, not a Badgr-native default like
+// cline — opencode has no Badgr-hosted model-token integration.
+//
 // `cline` is the Badgr-native default: no user credential required, since
 // Badgr mints a short-lived, job-scoped token pointing at its own
-// OpenAI-compatible coding-model endpoint (see backend jobs_routes.py's
+// OpenAI-compatible coding-model endpoint (see the backend's own
 // `_cline_model_token` / `_build_worker_command`). `claude`/`codex` are
 // bring-your-own-provider lanes — if no credential is stored yet, an
 // interactive terminal prompts for one inline and stores it via `badgr
@@ -40,13 +47,19 @@ import { VM_CLASSES, LAUNCH_VM_SIZES, vmClassForWorkload } from '../spec.js';
 // always exactly one array element, so it reaches the agent unchanged
 // regardless of spaces, quotes, punctuation, or shell metacharacters: there
 // is no shell-string layer left to round-trip it through (see
-// command_argv on the backend and BADGR_COMMAND_JSON in
-// images/badgr-job-runner/entrypoint.py, which subprocess.run executes
+// command_argv on the backend and BADGR_COMMAND_JSON in the worker
+// image's own entrypoint, which subprocess.run executes
 // directly with shell=False — no shlex.split() involved for this path).
 const AGENT_WORKLOADS = {
-  cline:  { image: process.env.BADGR_AGENT_IMAGE_CLINE  || 'ghcr.io/michaelmanly/badgr-agent-cline:latest',  buildCmd: task => ['badgr-cline-run', task],  provider: null },
-  claude: { image: process.env.BADGR_AGENT_IMAGE_CLAUDE || 'ghcr.io/michaelmanly/badgr-agent-claude:latest', buildCmd: task => ['badgr-claude-run', task], provider: 'anthropic' },
-  codex:  { image: process.env.BADGR_AGENT_IMAGE_CODEX   || 'ghcr.io/michaelmanly/badgr-agent-codex:latest',  buildCmd: task => ['badgr-codex-run', task], provider: 'openai' },
+  cline:       { image: process.env.BADGR_AGENT_IMAGE_CLINE       || 'ghcr.io/michaelmanly/badgr-agent-cline:latest',       buildCmd: task => ['badgr-cline-run', task],       provider: null },
+  claude:      { image: process.env.BADGR_AGENT_IMAGE_CLAUDE      || 'ghcr.io/michaelmanly/badgr-agent-claude:latest',      buildCmd: task => ['badgr-claude-run', task],      provider: 'anthropic' },
+  codex:       { image: process.env.BADGR_AGENT_IMAGE_CODEX       || 'ghcr.io/michaelmanly/badgr-agent-codex:latest',       buildCmd: task => ['badgr-codex-run', task],       provider: 'openai' },
+  opencode:    { image: process.env.BADGR_AGENT_IMAGE_OPENCODE    || 'ghcr.io/michaelmanly/badgr-agent-opencode:latest',    buildCmd: task => ['badgr-opencode-run', task],    provider: 'openai' },
+  // Command Code is a single hosted account (bundled model catalog reached
+  // through its own API), not an OpenAI/Anthropic-compatible endpoint —
+  // there is no BYOK provider-swap lane for it, unlike claude/codex/cline
+  // (see the flags.provider guard in launchAgentWorkload below).
+  commandcode: { image: process.env.BADGR_AGENT_IMAGE_COMMANDCODE || 'ghcr.io/michaelmanly/badgr-agent-commandcode:latest', buildCmd: task => ['badgr-commandcode-run', task], provider: 'commandcode' },
 };
 
 // Non-agent workloads: no LLM credential, and the task string (if given) is
@@ -101,8 +114,9 @@ const _VALUE_FLAGS = {
   '--max-runtime': 'maxRuntime', '--max-cost': 'maxCost', '--save': 'save',
   '--workspace': 'workspace', '--output': 'output', '--checkpoint': 'checkpoint',
   '--resume-cmd': 'resumeCmd', '--size': 'size',
-  // BYOK / OpenAI-compatible model selection — `badgr launch cline` only,
-  // see resolveModelProviderEnv below.
+  // BYOK / OpenAI-compatible model selection — `badgr launch cline` (BYOK
+  // opt-in) and `codex`/`opencode` (BYOK-only) — see resolveModelProviderEnv
+  // below.
   '--provider': 'provider', '--model': 'model', '--base-url': 'baseUrl',
   // When present, routes to POST /v1/jobs (type: agent) instead of the
   // plain badgr-launch GPU/CPU run path.
@@ -194,6 +208,8 @@ function warnIfTaskMayHaveSwallowedAFlag(task, chalk) {
  * badgr launch cline "<task>"       — Badgr-hosted model, no credential needed
  * badgr launch claude "<task>"      — prompts inline for an Anthropic key if not connected
  * badgr launch codex "<task>"       — prompts inline for an OpenAI key if not connected
+ * badgr launch opencode "<task>"    — prompts inline for an OpenAI key if not connected
+ * badgr launch commandcode "<task>" — prompts inline for a Command Code key if not connected
  * badgr launch playwright ["<task>"] — no credential; task is a display label only
  * badgr launch <source> -- <command> — explicit form / advanced escape hatch
  * badgr launch <source> --cmd "<command>"
@@ -210,6 +226,8 @@ export async function launchCommand(config, args, chalk) {
     console.error(chalk.dim('  badgr launch cline "Fix the checkout bug"'));
     console.error(chalk.dim('  badgr launch claude "Fix the checkout bug"'));
     console.error(chalk.dim('  badgr launch codex "Fix the checkout bug"'));
+    console.error(chalk.dim('  badgr launch opencode "Fix the checkout bug"'));
+    console.error(chalk.dim('  badgr launch commandcode "Fix the checkout bug"'));
     console.error(chalk.dim('  badgr launch playwright "Test the checkout flow"'));
     console.error(chalk.dim('  badgr launch . --max-cost 1 -- npm test   (explicit escape hatch)'));
     console.error('');
@@ -282,7 +300,7 @@ async function resolveMissingCredential(provider, chalk, label) {
 /**
  * BYOK / OpenAI-compatible or Anthropic-compatible model selection.
  *
- * `badgr launch <cline|codex> --provider <name> --model <id> [--base-url <url>]`
+ * `badgr launch <cline|codex|opencode> --provider <name> --model <id> [--base-url <url>]`
  * uses apiKind='openai' (injects OPENAI_API_KEY/OPENAI_BASE_URL/MODEL).
  * `badgr launch claude --provider <name> --model <id> [--base-url <url>]`
  * uses apiKind='anthropic' (injects ANTHROPIC_API_KEY/ANTHROPIC_BASE_URL/MODEL).
@@ -376,6 +394,13 @@ async function launchAgentWorkload(config, agentName, rawArgs, chalk) {
 
   const spec = AGENT_WORKLOADS[agentName];
 
+  if (agentName === 'commandcode' && flags.provider) {
+    console.error(chalk.red(`\n  ✗ --provider is not supported for \`badgr launch commandcode\` — it has no BYOK/swappable-endpoint lane, only its own hosted account.\n`));
+    console.error(chalk.dim(`  Run \`badgr connect commandcode\` instead.\n`));
+    process.exitCode = 1;
+    return;
+  }
+
   if (spec.provider && flags.provider) {
     // BYOK override for a fixed-provider workload (claude → anthropic,
     // codex → openai). Skip the managed credential flow and inject the
@@ -422,7 +447,7 @@ async function launchAgentWorkload(config, agentName, rawArgs, chalk) {
   } else if (flags.provider) {
     // BYOK for cline (spec.provider is null) — injects OPENAI_API_KEY,
     // OPENAI_BASE_URL, MODEL. The backend skips its managed model token
-    // when it sees an existing OPENAI_API_KEY (see jobs_routes.py).
+    // when it sees an existing OPENAI_API_KEY (handled server-side).
     const modelEnv = await resolveModelProviderEnv(flags, chalk, 'openai');
     if (!modelEnv) {
       process.exitCode = 1;
@@ -435,7 +460,7 @@ async function launchAgentWorkload(config, agentName, rawArgs, chalk) {
     flags.authRequired = { provider: null, status: 'none' };
   }
   // cline with no --provider: Badgr mints a short-lived job-scoped model
-  // token server-side (see backend jobs_routes.py); the CLI never handles
+  // token server-side; the CLI never handles
   // or displays that token. --provider switches cline to BYOK instead.
 
   const cmdArgv = spec.buildCmd(task);
@@ -460,7 +485,7 @@ async function launchDirectWorkload(config, workloadName, rawArgs, chalk) {
 
   if (flags.provider) {
     console.error(chalk.red(`\n  ✗ --provider is not supported for \`badgr launch ${workloadName}\` — it is a test runner with no LLM component.\n`));
-    console.error(chalk.dim(`  Use \`badgr launch claude/cline/codex\` for AI agent workloads.\n`));
+    console.error(chalk.dim(`  Use \`badgr launch claude/cline/codex/opencode/commandcode\` for AI agent workloads.\n`));
     process.exitCode = 1;
     return;
   }