castle-web-cli 0.4.103 → 0.4.105

package/dist/agent-failures.d.ts

@@ -11,6 +11,12 @@ export interface AgentFailure {
 }
 export declare function failureForStatus(status: number, body: string, model?: string): AgentFailure | undefined;
 export declare function classifyProviderError(text: string | undefined, model?: string): AgentFailure | undefined;
+/**
+ * Record the reader's IANA zone. Junk is ignored rather than stored: an invalid
+ * zone makes toLocaleTimeString throw, and the one place that formatting runs is
+ * the error path, which must not fail.
+ */
+export declare function setReaderTimeZone(zone: string): void;
 export declare function failureCopy(opts: {
     failure: AgentFailure;
     spawnedTasks: boolean;

package/dist/agent-failures.js

@@ -10,7 +10,8 @@
 //               what's wrong and points at settings / Castle.
 //   limit     - Castle's daily AI allowance for this user is spent. Nothing to
 //               fix in the session and nothing to retry until the reset, so the
-//               copy gives the time and the one way around it (own credential).
+//               copy gives the time (see setReaderTimeZone) and the one way
+//               around it (own credential).
 //   transient - the provider was busy or broke. NOT auto-retried either (see
 //               below), but the copy invites the user to send again.
 //   no-work   - the model answered instead of working. Config is fine; the
@@ -98,6 +99,41 @@ export function classifyProviderError(text, model) {
 function quoted(model) {
     return model ? `"${model}"` : "the model this session is set to";
 }
+// The zone the person reading the copy is in, as the shell reported it on
+// connect. Module state rather than a parameter because it is a property of the
+// one reader this serve has, not of any particular failure, and every call site
+// would otherwise thread it through a ctx that has no other reason to know.
+let readerTimeZone;
+/**
+ * Record the reader's IANA zone. Junk is ignored rather than stored: an invalid
+ * zone makes toLocaleTimeString throw, and the one place that formatting runs is
+ * the error path, which must not fail.
+ */
+export function setReaderTimeZone(zone) {
+    try {
+        new Intl.DateTimeFormat(undefined, { timeZone: zone });
+    }
+    catch {
+        return;
+    }
+    readerTimeZone = zone;
+}
+// The reset is a Pacific midnight and this process runs on the sandbox's clock
+// (UTC), so a server-local time is wrong for every reader. Format in the zone
+// the shell reported; with none reported, name the zone we did use rather than
+// print a bare time that reads as local and isn't.
+function resetsClause(atMs) {
+    if (!atMs)
+        return "";
+    const time = new Date(atMs).toLocaleTimeString(undefined, {
+        hour: "numeric",
+        minute: "2-digit",
+        ...(readerTimeZone
+            ? { timeZone: readerTimeZone }
+            : { timeZoneName: "short" }),
+    });
+    return ` -- resets ${time}`;
+}
 // Plain-language copy for a failed run. Deliberately ONE table rather than a
 // router copy and a task copy: the sentences would be near-identical, and the
 // duplicate-detection gate (jscpd, threshold 0) is right to reject that.
@@ -140,12 +176,8 @@ export function failureCopy(opts) {
     switch (opts.failure.kind) {
         case "config":
             return `${configCopy(opts.failure)}${tasksNote}`;
-        case "limit": {
-            const resets = opts.failure.resetAtMs
-                ? ` -- resets ${new Date(opts.failure.resetAtMs).toLocaleString()}`
-                : "";
-            return `Daily Castle AI limit reached${resets}. Runs on your own API key or login aren't limited.${tasksNote}`;
-        }
+        case "limit":
+            return `Daily Castle AI limit reached${resetsClause(opts.failure.resetAtMs)}. Runs on your own API key or login aren't limited.${tasksNote}`;
         case "transient":
             return `OpenRouter is busy right now and I couldn't get through. Send that again in a moment.${tasksNote}`;
         case "no-work":

package/dist/agent.js

@@ -23,7 +23,7 @@ import { WebSocketServer } from "ws";
 import { rawDataToString } from "./ide.js";
 import { buildRouterPrompt, buildTaskPrompt, userTurnInstruction, CLAUDE_TASK_SYSTEM_REMINDER, } from "./agent-prompts.js";
 import { checkOpenrouterKey, checkOpenrouterModel, openrouterCatalogEntry, primeOpenrouterCatalog, } from "./openrouter-catalog.js";
-import { classifyProviderError, failureCopy, } from "./agent-failures.js";
+import { classifyProviderError, failureCopy, setReaderTimeZone, } from "./agent-failures.js";
 import { fetchBudget, meteringHeaders, newAgentSessionId, reportCursorRun, withCustomHeaders, } from "./metering.js";
 import { anthropicKeyHelperCommand, claudeHasSavedLogin, resolveAnthropicAuth, userKey, ANTHROPIC_CREDENTIAL_ENV, ANTHROPIC_PROXY_ENV, CASTLE_USER_KEYS_PATH, } from "./byo-auth.js";
 import { runAgentNative } from "./native/loop.js";
@@ -41,12 +41,14 @@ export const AGENT_MODEL_CAPS_PREFIX = "/__castle/agent/model-caps";
 const DEFAULT_SETTINGS = {
     router: "claude",
     tasks: "claude",
-    routerClaudeModel: "opus",
-    // Tasks default one tier down: task agents run long unattended builds, so
-    // sonnet's cost/speed wins by default; the operator stays on opus.
-    tasksClaudeModel: "sonnet",
+    // Both roles run the claude CLI routed through OpenRouter at the slug below.
+    // Note this takes the Anthropic credential out of play entirely: a role on
+    // "openrouter" resolves OpenRouter auth, so a user's `claude /login` or
+    // ANTHROPIC_API_KEY no longer applies (see buildAgentInvocation).
+    routerClaudeModel: "openrouter",
+    tasksClaudeModel: "openrouter",
     // Free-form -- change to any OpenRouter slug.
-    routerOpenrouterModel: "openai/gpt-5.6-sol",
+    routerOpenrouterModel: "openai/gpt-5.6-terra",
     tasksOpenrouterModel: "openai/gpt-5.6-terra",
     // Both roles think at "medium": the operator stays snappy (the user waits
     // on every operator turn), and task agents' multi-turn tool loops don't pay
@@ -60,10 +62,10 @@ const DEFAULT_SETTINGS = {
     // which matters for tool-calling fidelity over long loops).
     routerRouting: "nitro",
     tasksRouting: "exacto",
-    // Operator pins OpenAI's priority (low-latency SLA) tier for the default
-    // sol model; harmless with other slugs since the pin falls back when the
-    // tag doesn't exist (allow_fallbacks). Tasks stay on auto: high-volume
-    // background turns should ride the cheapest available capacity.
+    // Operator pins OpenAI's priority (low-latency SLA) tier; harmless with a
+    // slug that lacks it since the pin falls back when the tag doesn't exist
+    // (allow_fallbacks). Tasks stay on auto: high-volume background turns
+    // should ride the cheapest available capacity.
     routerProviderTier: "openai/priority",
     tasksProviderTier: "",
 };
@@ -72,16 +74,14 @@ function normalizeBackend(value) {
         ? value
         : null;
 }
-// Settings written before the smith backend existed used "openrouter" as a
-// BACKEND value meaning "claude CLI routed at OpenRouter" -- exactly what
-// backend "claude" + that role's claude model "openrouter" means now. Used
-// only when loading persisted settings (normalizeBackend rejects it live) so
-// old decks keep their behavior across the upgrade.
-function migrateStoredBackend(value) {
-    if (value === "openrouter")
-        return "claude";
-    return normalizeBackend(value);
-}
+// Bump to force every deck onto the current DEFAULT_SETTINGS once, discarding
+// what users had chosen: a stored file below this epoch has ALL of its setting
+// fields dropped on load (see loadAgentSettings). Bump ONLY when a default
+// change is meant to override existing choices -- an ordinary one needs no
+// bump, since sparse storage already reaches anyone who never set that field.
+// The wipe is also what retires older file shapes, so a migration for one is
+// only worth writing if it must survive the epoch that introduces it.
+const SETTINGS_EPOCH = 1;
 function normalizeClaudeModel(value) {
     return value === "sonnet" ||
         value === "opus" ||
@@ -141,6 +141,60 @@ function normalizeProviderTier(value) {
         return null;
     return trimmed;
 }
+// Every setting's validator, keyed the same as AgentSettings, so load and save
+// iterate one list rather than repeating the field names per direction.
+const SETTING_NORMALIZERS = {
+    router: normalizeBackend,
+    tasks: normalizeBackend,
+    routerClaudeModel: normalizeClaudeModel,
+    tasksClaudeModel: normalizeClaudeModel,
+    routerOpenrouterModel: normalizeOpenrouterModel,
+    tasksOpenrouterModel: normalizeOpenrouterModel,
+    routerReasoningEffort: normalizeReasoningEffort,
+    tasksReasoningEffort: normalizeReasoningEffort,
+    routerRouting: normalizeRoutingMode,
+    tasksRouting: normalizeRoutingMode,
+    routerProviderTier: normalizeProviderTier,
+    tasksProviderTier: normalizeProviderTier,
+};
+const SETTING_KEYS = Object.keys(SETTING_NORMALIZERS);
+// Sparse ON PURPOSE: only fields that DIFFER from the current defaults are
+// stored, so "absent" means "follow the default" and a later default change
+// reaches every deck that never set that field. Writing the full object
+// instead (as this once did) froze all 12 settings the first time a user
+// touched any one of them, pinning models nobody had chosen.
+//
+// The flip side, accepted: re-selecting the value that is currently the
+// default stores nothing, so that deck moves when the default moves. Nothing
+// is lost relative to the old behavior -- applyAgentSettings already
+// early-returns on a no-op change, so that click never persisted anything.
+function serializeAgentSettings(settings) {
+    const out = { settingsEpoch: SETTINGS_EPOCH };
+    for (const key of SETTING_KEYS) {
+        if (settings[key] !== DEFAULT_SETTINGS[key])
+            out[key] = settings[key];
+    }
+    return JSON.stringify(out, null, 2) + "\n";
+}
+function loadAgentSettings(settingsPath) {
+    const stored = readJsonFile(settingsPath);
+    const storedEpoch = typeof stored?.settingsEpoch === "number" ? stored.settingsEpoch : 0;
+    // A stale file is ignored, not rewritten: leaving it means the wipe is a
+    // pure read-side decision that repeats harmlessly until the user's next real
+    // change overwrites it in the sparse shape. A newer epoch (a downgraded CLI
+    // reading a file from a newer one) is honored rather than wiped.
+    if (!stored || storedEpoch < SETTINGS_EPOCH)
+        return { ...DEFAULT_SETTINGS };
+    const overrides = {};
+    for (const key of SETTING_KEYS) {
+        if (!(key in stored))
+            continue;
+        const value = SETTING_NORMALIZERS[key](stored[key]);
+        if (value !== null)
+            overrides[key] = value;
+    }
+    return { ...DEFAULT_SETTINGS, ...overrides };
+}
 // Base for OpenRouter's Anthropic-compatible endpoint (confirmed current, 2026: it
 // accepts the standard Anthropic Messages API shape -- text/tool-use/extended-thinking
 // -- for ANY OpenRouter model slug, not just Anthropic ones), which the claude CLI
@@ -2974,7 +3028,7 @@ function applyAgentSettings(incoming, ctx) {
     }
     if (changes.length === 0)
         return;
-    fs.writeFileSync(ctx.settingsPath, JSON.stringify(settings, null, 2) + "\n");
+    fs.writeFileSync(ctx.settingsPath, serializeAgentSettings(settings));
     // The value is saved and broadcast IMMEDIATELY -- validation never gates a
     // write. The verdict follows in a second frame once the catalog answers.
     ctx.broadcast({ type: "settings", settings });
@@ -3448,59 +3502,7 @@ export function createAgentServer(opts) {
     // Which CLI backs the router and the task agents -- independently
     // switchable from the settings popover, persisted next to the chat state.
     const settingsPath = path.join(agentDir, "settings.json");
-    // Loosely typed on purpose: the file may carry legacy values the current
-    // types no longer admit (backend "openrouter", single openrouterModel /
-    // claudeModel) -- every field goes through a normalizer/migrator below.
-    const storedSettings = readJsonFile(settingsPath);
-    // Three legacy shapes migrate on load, chained oldest-first (rewritten in
-    // the new shape on the next settings change):
-    // - a single `openrouterModel` (pre per-role split) seeds BOTH per-role
-    //   slug fields;
-    // - a single shared `claudeModel` (pre per-role split) seeds BOTH per-role
-    //   claude-model fields;
-    // - backend value "openrouter" ON A ROLE (pre-smith: it meant that role
-    //   ran claude-via-OpenRouter) becomes backend "claude" + THAT role's
-    //   claude model "openrouter" -- exactly that behavior today, and now
-    //   per-role: one legacy openrouter role no longer drags the other role's
-    //   model along.
-    const legacyOpenrouterModel = normalizeOpenrouterModel(storedSettings?.openrouterModel);
-    const legacySharedClaudeModel = normalizeClaudeModel(storedSettings?.claudeModel);
-    const roleClaudeModel = (role) => {
-        // A stored per-role value wins; a legacy openrouter BACKEND on this role
-        // forces "openrouter" (those two never coexist in one file -- per-role
-        // fields postdate the openrouter backend's removal); else the legacy
-        // shared claudeModel, else the default.
-        return (normalizeClaudeModel(storedSettings?.[`${role}ClaudeModel`]) ??
-            (storedSettings?.[role] === "openrouter"
-                ? "openrouter"
-                : (legacySharedClaudeModel ?? DEFAULT_SETTINGS[`${role}ClaudeModel`])));
-    };
-    const settings = {
-        router: migrateStoredBackend(storedSettings?.router) ?? DEFAULT_SETTINGS.router,
-        tasks: migrateStoredBackend(storedSettings?.tasks) ?? DEFAULT_SETTINGS.tasks,
-        routerClaudeModel: roleClaudeModel("router"),
-        tasksClaudeModel: roleClaudeModel("tasks"),
-        routerOpenrouterModel: normalizeOpenrouterModel(storedSettings?.routerOpenrouterModel) ??
-            legacyOpenrouterModel ??
-            DEFAULT_SETTINGS.routerOpenrouterModel,
-        tasksOpenrouterModel: normalizeOpenrouterModel(storedSettings?.tasksOpenrouterModel) ??
-            legacyOpenrouterModel ??
-            DEFAULT_SETTINGS.tasksOpenrouterModel,
-        routerReasoningEffort: normalizeReasoningEffort(storedSettings?.routerReasoningEffort) ??
-            DEFAULT_SETTINGS.routerReasoningEffort,
-        tasksReasoningEffort: normalizeReasoningEffort(storedSettings?.tasksReasoningEffort) ??
-            DEFAULT_SETTINGS.tasksReasoningEffort,
-        routerRouting: normalizeRoutingMode(storedSettings?.routerRouting) ??
-            DEFAULT_SETTINGS.routerRouting,
-        tasksRouting: normalizeRoutingMode(storedSettings?.tasksRouting) ??
-            DEFAULT_SETTINGS.tasksRouting,
-        // Provider tier: "" is valid (auto), so keep a normalized "" over the
-        // default rather than treating it as absent.
-        routerProviderTier: normalizeProviderTier(storedSettings?.routerProviderTier) ??
-            DEFAULT_SETTINGS.routerProviderTier,
-        tasksProviderTier: normalizeProviderTier(storedSettings?.tasksProviderTier) ??
-            DEFAULT_SETTINGS.tasksProviderTier,
-    };
+    const settings = loadAgentSettings(settingsPath);
     const usageFeed = createUsageFeed({
         broadcast,
         hasClients: () => clients.size > 0,
@@ -3623,6 +3625,9 @@ export function createAgentServer(opts) {
             else if (msg.type === "set-settings") {
                 applySettings(msg);
             }
+            else if (msg.type === "client-timezone" && typeof msg.timeZone === "string") {
+                setReaderTimeZone(msg.timeZone);
+            }
         });
         socket.on("close", () => {
             clients.delete(socket);