castle-web-cli 0.4.108 → 0.4.110

package/dist/agent-failures.d.ts

@@ -1,5 +1,5 @@
 export type FailureKind = "config" | "limit" | "transient" | "no-work" | "spawn" | "timeout" | "exit";
-export type ConfigReason = "no-key" | "bad-key" | "no-credits" | "unknown-model" | "no-tools" | "no-endpoints" | "flagged" | "context-length";
+export type ConfigReason = "no-key" | "bad-key" | "no-credits" | "model-not-allowed" | "unknown-model" | "no-tools" | "no-endpoints" | "flagged" | "context-length";
 export interface AgentFailure {
     kind: FailureKind;
     reason?: ConfigReason;

package/dist/agent-failures.js

@@ -150,6 +150,8 @@ function configCopy(failure) {
             return "OpenRouter rejected this session's API key. The person running this session needs to check it -- reach out to Castle if you need help.";
         case "no-credits":
             return "OpenRouter is out of credits for this session's key. Reach out to Castle to top it up, or switch to a different model in settings.";
+        case "model-not-allowed":
+            return `${model} isn't available on this Castle account. Pick a different model in settings, or run it on your own API key or login.`;
         case "unknown-model": {
             const hint = failure.suggestion ? ` Did you mean "${failure.suggestion}"?` : "";
             return `I can't use the model this session is set to -- OpenRouter doesn't recognize ${model}.${hint} Pick a different model in settings. If you think that model should work, reach out to Castle.`;

package/dist/agent-prompts.js

@@ -6,6 +6,20 @@
 // Router calls are stateless (a fresh cursor-agent print run each time) so the
 // transcript is the only memory.
 const TRANSCRIPT_LIMIT = 40;
+// Byte ceiling on the replayed transcript, applied AFTER TRANSCRIPT_LIMIT.
+// The count cap above bounds how many messages replay, not how big they are --
+// forty long ones clear 128KB easily. That matters because the whole prompt is
+// handed to the backend CLI as a single argv entry, and Linux caps one argument
+// at MAX_ARG_STRLEN (128KB): past it, spawn() throws E2BIG and the turn dies
+// before it starts. Since the transcript is the only term here that grows
+// without bound (it accumulates for the life of the deck), it's the one that
+// needs a byte budget.
+//
+// Sized to leave room for everything else the prompt carries: the rules
+// (~10KB), the deck's quick reference (~13KB), the file tree, the smith-only
+// deck contents (ROUTER_DECK_CONTENTS_BUDGET, 40KB), the task board, and this
+// turn's instruction.
+const TRANSCRIPT_BYTE_BUDGET = 32 * 1024;
 const ROUTER_RULES = `You are Castle's create assistant: the fast conversational router for a game-making session. The deck (game project) lives in the current directory and runs live in a pane right next to this chat.
 
 What a deck is: a normal web project served by vite -- index.html plus plain JS/JSX modules, with real npm dependencies (more can be installed), the castle-web-sdk package, and usually a kit framework whose engine, behaviors, scenes, editors, and drawings are ordinary files in this directory. The web platform is fully available (DOM, canvas, npm libraries like react, three, etc.). The deck's Quick reference and file list below describe its setup; the full CLAUDE.md / AGENTS.md has deeper detail. NEVER claim something is impossible or unsupported on the platform without checking that context (or, for specifics it doesn't cover, the deck's files) first.
@@ -66,20 +80,55 @@ Conversation style:
 - The user sees a live task board above the chat -- never re-announce task status yourself.
 - Spawning a task does NOT apply the change -- tasks run for minutes and finish on the board. Talk about spawned work in future tense ("this will dial the shake back"), and NEVER ask how a change feels right after spawning it -- the user cannot have tried it yet. Save "how is it?" for things whose task already finished.
 - The user playtests in the pane beside this chat; finished work shows up there after a reload.`;
+function renderTranscriptLine(m) {
+    if (m.role === "user")
+        return `user: ${m.text}`;
+    const label = m.interrupted
+        ? "you (interrupted draft -- not a complete reply)"
+        : "you";
+    return `${label}: ${m.text}`;
+}
+// Cut a line to fit `budget` BYTES without splitting a multi-byte character
+// (a half-written character would render as a replacement glyph mid-sentence).
+function truncateToBytes(line, budget) {
+    const buf = Buffer.from(line, "utf8");
+    if (buf.byteLength <= budget)
+        return line;
+    return new TextDecoder("utf8", { fatal: false, ignoreBOM: true })
+        .decode(buf.subarray(0, budget))
+        .replace(/�+$/, "");
+}
 function renderTranscript(messages) {
     const recent = messages.slice(-TRANSCRIPT_LIMIT);
     if (recent.length === 0)
         return "(no conversation yet)";
-    return recent
-        .map((m) => {
-        if (m.role === "user")
-            return `user: ${m.text}`;
-        const label = m.interrupted
-            ? "you (interrupted draft -- not a complete reply)"
-            : "you";
-        return `${label}: ${m.text}`;
-    })
-        .join("\n\n");
+    // Newest-first, keeping WHOLE messages until the budget is spent: the recent
+    // exchanges are the ones a reply actually depends on, and half-including a
+    // message would read as the user having said something they didn't.
+    const kept = [];
+    let bytes = 0;
+    for (let i = recent.length - 1; i >= 0; i -= 1) {
+        const line = renderTranscriptLine(recent[i]);
+        // +2 for the "\n\n" this line will be joined with.
+        const size = Buffer.byteLength(line, "utf8") + 2;
+        if (bytes + size > TRANSCRIPT_BYTE_BUDGET) {
+            // One message bigger than the whole budget (a huge paste) still has to
+            // yield something -- an empty transcript would strand the router with no
+            // idea what was just asked. Truncate that one rather than drop it, so the
+            // bound genuinely holds no matter what a single message contains.
+            if (kept.length === 0) {
+                kept.push(truncateToBytes(line, TRANSCRIPT_BYTE_BUDGET));
+            }
+            break;
+        }
+        kept.unshift(line);
+        bytes += size;
+    }
+    const elided = recent.length - kept.length;
+    if (elided <= 0)
+        return kept.join("\n\n");
+    const plural = elided === 1 ? "message" : "messages";
+    return `(${elided} earlier ${plural} trimmed to keep this prompt within its size limit)\n\n${kept.join("\n\n")}`;
 }
 function renderTasks(tasks) {
     if (tasks.length === 0)

package/dist/agent.js

@@ -14,7 +14,7 @@
 // Backend CLI: cursor-agent in headless print mode (stream-json). The router
 // runs with --mode ask (read-only at the CLI level); task agents run with
 // --force. Claude support can slot in later behind runAgentCli.
-import { execFileSync, spawn } from "child_process";
+import { execFileSync, spawn, } from "child_process";
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
@@ -92,6 +92,23 @@ function normalizeClaudeModel(value) {
         ? value
         : null;
 }
+// A claude run is spawned with an alias (`--model fable`) but reaches the proxy
+// as a concrete id (`claude-fable-5`), and it is the ids the proxy refuses. This
+// is the one place that knows both, so the model picker and the pre-flight
+// refusal can't disagree about which models a user actually has.
+const CLAUDE_MODEL_ID_PREFIXES = {
+    sonnet: "claude-sonnet-",
+    opus: "claude-opus-",
+    fable: "claude-fable-",
+};
+// Blocked when the two prefixes agree as far as the shorter one goes: the proxy
+// may name a family ("claude-fable-") or one model within it.
+function claudeModelBlocked(model, budget) {
+    const id = CLAUDE_MODEL_ID_PREFIXES[model];
+    if (!id || !budget)
+        return false;
+    return budget.blockedModelPrefixes.some((p) => p.startsWith(id) || id.startsWith(p));
+}
 // Free-form, so validation is just "non-empty, not absurdly long" (guards
 // against a stray huge paste landing in settings.json / the CLI argv).
 const OPENROUTER_MODEL_MAX_LEN = 200;
@@ -1341,11 +1358,33 @@ function makeAgentEventHandler(opts, state) {
 // end with a result event carrying the canonical final text.
 function runAgentCli(opts) {
     return new Promise((resolve) => {
-        const child = spawn(opts.command, opts.args, {
-            cwd: opts.cwd,
-            env: opts.env,
-            stdio: ["ignore", "pipe", "pipe"],
-        });
+        // spawn() throws SYNCHRONOUSLY for the failures the OS rejects at exec
+        // time -- in practice E2BIG, when the prompt argv exceeds Linux's
+        // MAX_ARG_STRLEN (128KB per argument). That throw escapes this executor
+        // and rejects the promise, so it never reaches the child.on("error")
+        // handler below and never becomes an AgentFailure: the turn dies
+        // unclassified and the composer spins forever with nothing shown. Settle
+        // it here in the same shape that handler uses so it lands on the normal
+        // "spawn" copy instead. The declared type mirrors the stdio tuple below:
+        // stdin ignored, stdout/stderr piped.
+        let child;
+        try {
+            child = spawn(opts.command, opts.args, {
+                cwd: opts.cwd,
+                env: opts.env,
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            resolve({
+                ok: false,
+                finalText: "",
+                error: `could not run ${opts.command}: ${message}`,
+                failure: { kind: "spawn", detail: `${opts.command}: ${message}` },
+            });
+            return;
+        }
         opts.children.add(child);
         opts.onSpawn?.(child.pid);
         const log = opts.logPath
@@ -1632,14 +1671,29 @@ function anyRoleIsCastlePaid(settings) {
     return (runIsCastlePaid(settings.router, settings.routerClaudeModel, null) ||
         runIsCastlePaid(settings.tasks, settings.tasksClaudeModel, null));
 }
-// The proxy 403s a spent-out user mid-stream, which a CLI surfaces as a generic
-// provider error after a spawn. Asking first turns that into one sentence and
-// no spawn. Fails open on every non-answer: the proxy is the real backstop.
-async function budgetRefusal(backend, claudeModel, orAuth) {
+// The proxy 403s a spent-out user -- or one who asked for a model they don't
+// have -- mid-stream, which a CLI surfaces as a generic provider error after a
+// spawn. Asking first turns either into one sentence and no spawn. Fails open on
+// every non-answer: the proxy is the real backstop.
+//
+// Only the claude aliases are checked, which is exactly what the picker offers.
+// A free-form OpenRouter slug naming a restricted model is left to the proxy:
+// resolving an arbitrary slug to what it bills as is its job, not the editor's.
+async function castleSpendRefusal(backend, claudeModel, orAuth) {
     if (!runIsCastlePaid(backend, claudeModel, orAuth))
         return null;
     const budget = await fetchBudget();
-    if (!budget?.blocked)
+    if (!budget)
+        return null;
+    if (claudeModelBlocked(claudeModel, budget)) {
+        return {
+            kind: "config",
+            reason: "model-not-allowed",
+            detail: `${claudeModel} is not available on this Castle account`,
+            model: claudeModel,
+        };
+    }
+    if (!budget.blocked)
         return null;
     return {
         kind: "limit",
@@ -1651,6 +1705,33 @@ async function budgetRefusal(backend, claudeModel, orAuth) {
 // finished run already refreshes. This is for the spend this serve never sees
 // -- a `claude` invoked straight from the sandbox terminal.
 const USAGE_POLL_MS = 60_000;
+const PICKER_CLAUDE_MODELS = ["sonnet", "opus", "fable"];
+/**
+ * Which of the picker's claude models this editor can't use. Gated on the
+ * ANTHROPIC credential specifically, not on `anyRoleIsCastlePaid` (which draws
+ * the usage bar): those two disagree exactly when one role runs on Castle's
+ * OpenRouter key -- or on Castle's cursor key -- while the user's own Anthropic
+ * key or login covers every claude run. Those runs never reach the proxy, so
+ * nothing about them is Castle's to restrict, and the picker must keep offering
+ * the model. A claude run on a fixed alias always resolves through
+ * resolveAnthropicAuth, so no role's settings enter into this.
+ */
+function blockedClaudeModels(budget) {
+    if (resolveAnthropicAuth().mode !== "proxy")
+        return [];
+    return PICKER_CLAUDE_MODELS.filter((m) => claudeModelBlocked(m, budget));
+}
+function usageFrame(budget) {
+    if (!budget)
+        return null;
+    return {
+        usedMicros: budget.usedMicros,
+        limitMicros: budget.limitMicros,
+        resetAtMs: budget.resetAtMs,
+        blocked: budget.blocked,
+        blockedClaudeModels: blockedClaudeModels(budget),
+    };
+}
 /**
  * The editor's daily-usage feed, pushed over the agent socket exactly the way
  * settings are: the current value rides `hello`, and a change is broadcast.
@@ -1667,7 +1748,7 @@ const USAGE_POLL_MS = 60_000;
 function createUsageFeed(opts) {
     let latest = null;
     async function refreshAsync() {
-        const next = opts.castlePaid() ? await fetchBudget() : null;
+        const next = usageFrame(opts.castlePaid() ? await fetchBudget() : null);
         if (JSON.stringify(next ?? null) === JSON.stringify(latest ?? null))
             return;
         latest = next;
@@ -1703,11 +1784,11 @@ async function runAgentTurn(opts) {
     // Deterministic config errors stop here: nothing spawned, no request issued,
     // nothing billed. Returned (not thrown) because the callers' catch paths
     // emit generic "something went wrong" copy, which would bury the specific
-    // reason this pre-flight exists to produce. A spent-out daily budget is the
-    // same shape of answer, and comes second so a misconfigured run is still
-    // reported as misconfigured.
+    // reason this pre-flight exists to produce. What Castle's spend policy
+    // refuses is the same shape of answer, and comes second so a misconfigured
+    // run is still reported as misconfigured.
     const failure = (await preflightOpenrouterRun({ ...opts, orAuth })) ??
-        (await budgetRefusal(opts.backend, opts.claudeModel, orAuth));
+        (await castleSpendRefusal(opts.backend, opts.claudeModel, orAuth));
     if (failure) {
         return {
             ok: false,

package/dist/metering.d.ts

@@ -43,6 +43,7 @@ export interface CastleBudget {
     limitMicros: number | null;
     resetAtMs: number;
     blocked: boolean;
+    blockedModelPrefixes: string[];
 }
 /**
  * The daily Castle-paid AI budget for the user this sandbox belongs to, or null

package/dist/metering.js

@@ -145,6 +145,9 @@ export async function fetchBudget() {
             limitMicros: typeof body.limitMicros === "number" ? body.limitMicros : null,
             resetAtMs: typeof body.resetAtMs === "number" ? body.resetAtMs : 0,
             blocked: body.blocked,
+            blockedModelPrefixes: Array.isArray(body.blockedModelPrefixes)
+                ? body.blockedModelPrefixes.filter((p) => typeof p === "string")
+                : [],
         };
     }
     catch {