castle-web-cli 0.4.183 → 0.4.185

package/dist/byo-accounts.d.ts

@@ -1,5 +1,5 @@
 import { type LoginProvider, type LoginState } from "./byo-login.js";
-export type ProviderId = "anthropic" | "openrouter" | "cursor";
+export type ProviderId = "anthropic" | "openrouter";
 export interface ProviderStatus {
     id: ProviderId;
     label: string;
@@ -21,9 +21,9 @@ export declare function accountsSnapshot(): AccountsState;
 /**
  * Call `onChange` when a credential this module reports on changes on disk.
  *
- * The editor is not the only writer: `claude /login` and `cursor-agent login`
- * in the terminal panel, an agent run that refreshes an OAuth token, and a
- * hand-edited `user-keys.json` all change the answer behind its back. Without
+ * The editor is not the only writer: `claude /login` in the terminal panel, an
+ * agent run that refreshes an OAuth token, and a hand-edited
+ * `user-keys.json` all change the answer behind its back. Without
  * this the account state is whatever was true when the page loaded, so a
  * terminal sign-in looks like it did nothing until a reload.
  *

package/dist/byo-accounts.js

@@ -8,9 +8,8 @@
 // is allowed to write. The login subprocesses live in byo-login.ts; this module
 // only reports their state as part of one snapshot.
 import * as fs from "fs";
-import * as os from "os";
 import * as path from "path";
-import { CASTLE_USER_KEYS_PATH, claudeCredentialsPath, claudeHasSavedLogin, cursorAuthPath, cursorHasUserLogin, readUserKeys, } from "./byo-auth.js";
+import { CASTLE_USER_KEYS_PATH, claudeCredentialsPath, claudeHasSavedLogin, readUserKeys, } from "./byo-auth.js";
 import { activeLogin } from "./byo-login.js";
 import { inCastleSandbox } from "./metering.js";
 // Providers, not credentials: Anthropic is reachable by EITHER a key or a
@@ -21,19 +20,13 @@ const PROVIDERS = [
     {
         id: "anthropic",
         label: "Anthropic",
-        key: { env: "ANTHROPIC_API_KEY", placeholder: "sk-ant-…", offered: true },
+        key: { env: "ANTHROPIC_API_KEY", placeholder: "sk-ant-…" },
         login: "claude",
     },
     {
         id: "openrouter",
         label: "OpenRouter",
-        key: { env: "OPENROUTER_API_KEY", placeholder: "sk-or-…", offered: true },
-    },
-    {
-        id: "cursor",
-        label: "Cursor",
-        key: { env: "CURSOR_API_KEY", placeholder: "key_…", offered: false },
-        login: "cursor",
+        key: { env: "OPENROUTER_API_KEY", placeholder: "sk-or-…" },
     },
 ];
 // A stored value is never sent toward a browser -- only this. Short values get
@@ -41,39 +34,30 @@ const PROVIDERS = [
 function hintFor(value) {
     return value.length >= 12 ? `…${value.slice(-4)}` : "…";
 }
-function hasLogin(provider) {
-    return provider === "claude"
-        ? claudeHasSavedLogin()
-        : cursorHasUserLogin(os.homedir());
-}
-// Offered at all: a key field the user may fill, or a login they may start.
-function isOffered(d) {
-    return Boolean(d.key?.offered) || Boolean(d.login);
-}
 function descriptorFor(id) {
     if (typeof id !== "string")
         return null;
-    return PROVIDERS.find((d) => isOffered(d) && d.id === id) ?? null;
+    return PROVIDERS.find((d) => d.id === id) ?? null;
 }
 export function accountsSnapshot() {
     // Empty outside a sandbox, which hides the whole surface. A local serve has no
-    // Castle budget to escape, and the host machine's own claude/cursor logins are
-    // ALREADY what its CLIs use -- offering to "sign in" there would report the
+    // Castle budget to escape, and the host machine's own claude login is ALREADY
+    // what its CLI uses -- offering to "sign in" there would report the
     // developer's existing login back to them as a Castle setting, and invite them
     // to sign out of it from a deck editor.
     if (!inCastleSandbox())
         return { providers: [], login: null };
     const stored = readUserKeys();
     return {
-        providers: PROVIDERS.filter(isOffered).map((d) => {
+        providers: PROVIDERS.map((d) => {
             // typeof, not just truthiness: the file is hand-editable, and a
             // non-string value would throw on trim -- see readUserKeys.
-            const raw = d.key?.offered ? stored[d.key.env] : undefined;
+            const raw = d.key ? stored[d.key.env] : undefined;
             const value = typeof raw === "string" ? raw.trim() : undefined;
             return {
                 id: d.id,
                 label: d.label,
-                ...(d.key?.offered
+                ...(d.key
                     ? {
                         key: {
                             placeholder: d.key.placeholder,
@@ -83,7 +67,7 @@ export function accountsSnapshot() {
                     }
                     : {}),
                 ...(d.login
-                    ? { login: { provider: d.login, loggedIn: hasLogin(d.login) } }
+                    ? { login: { provider: d.login, loggedIn: claudeHasSavedLogin() } }
                     : {}),
             };
         }),
@@ -97,9 +81,9 @@ const WATCH_DEBOUNCE_MS = 250;
 /**
  * Call `onChange` when a credential this module reports on changes on disk.
  *
- * The editor is not the only writer: `claude /login` and `cursor-agent login`
- * in the terminal panel, an agent run that refreshes an OAuth token, and a
- * hand-edited `user-keys.json` all change the answer behind its back. Without
+ * The editor is not the only writer: `claude /login` in the terminal panel, an
+ * agent run that refreshes an OAuth token, and a hand-edited
+ * `user-keys.json` all change the answer behind its back. Without
  * this the account state is whatever was true when the page loaded, so a
  * terminal sign-in looks like it did nothing until a reload.
  *
@@ -111,11 +95,7 @@ const WATCH_DEBOUNCE_MS = 250;
  * costs freshness, never correctness.
  */
 export function watchCredentials(onChange) {
-    const dirs = new Set([
-        claudeCredentialsPath(),
-        cursorAuthPath(os.homedir()),
-        CASTLE_USER_KEYS_PATH,
-    ].map((p) => path.dirname(p)));
+    const dirs = new Set([claudeCredentialsPath(), CASTLE_USER_KEYS_PATH].map((p) => path.dirname(p)));
     let timer = null;
     const fire = () => {
         if (timer)
@@ -203,7 +183,7 @@ export function writeCredential(id, value) {
         return { ok: false, message: "only available in a Castle sandbox" };
     }
     const descriptor = descriptorFor(id);
-    if (!descriptor?.key?.offered)
+    if (!descriptor?.key)
         return { ok: false, message: "unknown credential" };
     const env = descriptor.key.env;
     const stored = readUserKeys();
@@ -230,9 +210,8 @@ export function writeCredential(id, value) {
 // The login provider a client-supplied id names, or null. Keeps the WS handler
 // from having to know the descriptor table. Null outside a sandbox for the
 // same reason writeCredential refuses there -- most of all so no client can
-// run `claude auth logout` / `cursor-agent logout` against the host machine's
-// own login, which is exactly the outcome hiding the surface was meant to
-// prevent.
+// run `claude auth logout` against the host machine's own login, which is
+// exactly the outcome hiding the surface was meant to prevent.
 export function loginProviderFor(id) {
     if (!inCastleSandbox())
         return null;

package/dist/byo-auth.d.ts

@@ -1,5 +1,5 @@
 export declare const CASTLE_USER_KEYS_PATH: string;
-export type UserKeyName = "ANTHROPIC_API_KEY" | "OPENROUTER_API_KEY" | "CURSOR_API_KEY";
+export type UserKeyName = "ANTHROPIC_API_KEY" | "OPENROUTER_API_KEY";
 export declare function readUserKeys(): Record<string, string>;
 export declare function userKey(envName: UserKeyName): string | null;
 export type AnthropicAuth = {
@@ -19,17 +19,14 @@ export type OpenrouterAuth = {
 };
 export declare function claudeCredentialsPath(): string;
 export declare function claudeHasSavedLogin(): boolean;
-export declare function cursorAuthPath(home: string): string;
-export declare function cursorHasUserLogin(home: string): boolean;
 export declare function resolveAnthropicAuth(): AnthropicAuth;
 export declare const ANTHROPIC_CREDENTIAL_ENV: readonly ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN_HELPER", "CLAUDE_CODE_OAUTH_TOKEN"];
 export declare const ANTHROPIC_PROXY_ENV: readonly ["ANTHROPIC_BASE_URL", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_CUSTOM_HEADERS", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN_HELPER", "CLAUDE_CODE_OAUTH_TOKEN"];
 export declare function anthropicKeyHelperCommand(): string;
 export declare function envForUserShell(base: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
-export declare const SHIMMED_CLIS: readonly ["claude", "cursor-agent"];
+export declare const SHIMMED_CLIS: readonly ["claude"];
 export type ShimmedCli = (typeof SHIMMED_CLIS)[number];
 export declare function claudeShellEnvScript(env: NodeJS.ProcessEnv, args?: readonly string[]): string;
-export declare function cursorShellEnvScript(env: NodeJS.ProcessEnv): string;
 export declare function shimEnvScript(cli: string, env: NodeJS.ProcessEnv, shimDir: string, args?: readonly string[]): string;
 export declare function ensureClaudeOnboarded(): void;
 export declare function installCliShims(deckDir: string): string | null;

package/dist/byo-auth.js

@@ -94,32 +94,6 @@ export function claudeCredentialsPath() {
 export function claudeHasSavedLogin() {
     return fs.existsSync(claudeCredentialsPath());
 }
-// cursor-agent rewrites ~/.config/cursor/auth.json on every successful run,
-// including Castle's own CURSOR_API_KEY runs -- so the file existing does NOT
-// mean a user logged in. Distinguish by the apiKey field: a real login is OAuth,
-// which drops apiKey and leaves only session tokens; any auth.json that still
-// carries an apiKey is an env-key cache cursor wrote from an injected key --
-// OURS, including a PREVIOUS key after a rotation. Treating that cache as a login
-// suppresses the injected key and drops cursor into the stale (dead) session.
-//
-// An earlier apiKey === castleKeys().CURSOR_API_KEY comparison misfired on a key
-// switch: the stale cache holds the OLD key, reads as "!= current" => "user
-// login" => key withheld => auth fails until auth.json is deleted by hand.
-// Deferring only on OAuth is rotation-proof. The cost: a tester's own-API-key
-// login is no longer distinguishable from our stale cache, so it is not deferred
-// to -- OAuth login still is (the common bypass path).
-export function cursorAuthPath(home) {
-    return path.join(home, ".config", "cursor", "auth.json");
-}
-export function cursorHasUserLogin(home) {
-    try {
-        const auth = JSON.parse(fs.readFileSync(cursorAuthPath(home), "utf8"));
-        return !auth.apiKey && !!auth.accessToken;
-    }
-    catch {
-        return false;
-    }
-}
 export function resolveAnthropicAuth() {
     const k = userKey("ANTHROPIC_API_KEY");
     if (k)
@@ -209,13 +183,6 @@ export function envForUserShell(base) {
         if (anthropic.mode === "user-key")
             env.ANTHROPIC_API_KEY = anthropic.key;
     }
-    // The same withholding envForAgentSpawn does for a cursor run: Castle's key
-    // would let cursor-agent consider itself authenticated and never look at the
-    // user's own OAuth session, so their terminal would keep spending Castle's
-    // budget after they signed in. Cursor has no key of its own to put back --
-    // user-keys.json's CURSOR_API_KEY is described but not yet injected anywhere.
-    if (cursorHasUserLogin(os.homedir()))
-        stash("CURSOR_API_KEY");
     const openrouter = userKey("OPENROUTER_API_KEY");
     if (openrouter) {
         env.OPENROUTER_API_KEY = openrouter;
@@ -254,9 +221,9 @@ function realpath(p) {
         return path.resolve(p);
     }
 }
-// The CLIs a shim is installed for. Both take a credential from the environment
-// that Castle may be supplying, so both need the decision re-made per run.
-export const SHIMMED_CLIS = ["claude", "cursor-agent"];
+// The CLIs a shim is installed for. Each takes a credential from the
+// environment that Castle may be supplying, so the decision is re-made per run.
+export const SHIMMED_CLIS = ["claude"];
 // The real binary the shim should exec: the first executable one on `pathValue`
 // that isn't the shim itself. Skipping by resolved directory (not by string) is
 // what keeps the shim from exec'ing itself forever.
@@ -319,23 +286,8 @@ export function claudeShellEnvScript(env, args = []) {
     }
     return lines.join("\n");
 }
-// The cursor half. Simpler, because there is one credential and no proxy pair:
-// Castle's CURSOR_API_KEY is either withheld (the user has their own OAuth
-// session, which cursor-agent would otherwise never look at) or put back from
-// the stash when they sign out again.
-export function cursorShellEnvScript(env) {
-    if (cursorHasUserLogin(os.homedir()))
-        return "unset CURSOR_API_KEY";
-    const stashed = env[PROXY_STASH_PREFIX + "CURSOR_API_KEY"];
-    if (stashed !== undefined && env.CURSOR_API_KEY === undefined) {
-        return `CURSOR_API_KEY=${shellQuote(stashed)}; export CURSOR_API_KEY`;
-    }
-    return "";
-}
 export function shimEnvScript(cli, env, shimDir, args = []) {
-    const lines = cli === "cursor-agent"
-        ? cursorShellEnvScript(env)
-        : claudeShellEnvScript(env, args);
+    const lines = claudeShellEnvScript(env, args);
     const real = findRealBin(env.PATH, shimDir, cli);
     const all = [lines, real ? `CASTLE_REAL_BIN=${shellQuote(real)}` : ""].filter((l) => l !== "");
     return all.length > 0 ? all.join("\n") + "\n" : "";

package/dist/byo-login.d.ts

@@ -1,5 +1,5 @@
-export type LoginProvider = "claude" | "cursor";
-export type LoginPhase = "starting" | "awaiting-user" | "awaiting-code" | "verifying" | "error";
+export type LoginProvider = "claude";
+export type LoginPhase = "starting" | "awaiting-code" | "verifying" | "error";
 export interface LoginState {
     provider: LoginProvider;
     phase: LoginPhase;
@@ -7,8 +7,7 @@ export interface LoginState {
     message?: string;
 }
 export declare function activeLogin(): LoginState | null;
-export declare function providerHasLogin(provider: LoginProvider): boolean;
-export declare function startLogin(provider: LoginProvider, onChange: () => void): void;
+export declare function startLogin(onChange: () => void): void;
 export declare function submitLoginCode(code: string): void;
-export declare function logout(provider: LoginProvider, onChange: () => void): void;
+export declare function logout(onChange: () => void): void;
 export declare function cancelLogin(): void;

package/dist/byo-login.js

@@ -1,59 +1,38 @@
-// Driving `claude auth login` / `cursor-agent login` from the editor, so a user
-// can put a run on their own subscription without knowing the terminal exists.
+// Driving `claude auth login` from the editor, so a user can put a run on their
+// own subscription without knowing the terminal exists.
 //
-// Both CLIs are usable HEADLESS -- measured, not documented (probed 2026-07-30
-// against claude 2.1.220 and the current cursor-agent):
+// The CLI is usable HEADLESS -- measured, not documented (probed 2026-07-30
+// against claude 2.1.220): `claude auth login` with no TTY and stdin from a
+// pipe prints "Opening browser to sign in…" then the OAuth URL, then blocks
+// reading a pasted code from STDIN. The URL is wrapped in an OSC-8 hyperlink,
+// so it appears TWICE in the raw bytes.
 //
-//   claude auth login   with no TTY and stdin from a pipe, prints
-//                       "Opening browser to sign in…" then the OAuth URL, then
-//                       blocks reading a pasted code from STDIN. The URL is
-//                       wrapped in an OSC-8 hyperlink, so it appears TWICE in
-//                       the raw bytes.
-//   cursor-agent login  with NO_OPEN_BROWSER=1, prints
-//                       "Open a browser and navigate to this link: <url>" and
-//                       then POLLS the challenge itself -- no code to paste.
-//
-// Neither uses a localhost callback, which is what makes this work at all in a
-// sandbox: the browser is on the user's machine and the CLI is in a container,
-// so a loopback redirect would have nowhere to land.
+// It does not use a localhost callback, which is what makes this work at all in
+// a sandbox: the browser is on the user's machine and the CLI is in a
+// container, so a loopback redirect would have nowhere to land.
 //
 // `claude setup-token` is NOT usable here: with no TTY it prints nothing, and
 // under one it launches the full Claude Code TUI.
 import { spawn } from "child_process";
-import * as os from "os";
-import { ANTHROPIC_PROXY_ENV, claudeHasSavedLogin, cursorHasUserLogin, } from "./byo-auth.js";
+import { ANTHROPIC_PROXY_ENV, claudeHasSavedLogin } from "./byo-auth.js";
 // A login is a singleton: two at once would race for the same credential file,
 // and the UI only ever offers one. A second start replaces the first.
 let active = null;
 export function activeLogin() {
     return active ? active.state : null;
 }
-export function providerHasLogin(provider) {
-    return provider === "claude"
-        ? claudeHasSavedLogin()
-        : cursorHasUserLogin(os.homedir());
-}
 // Long enough for a real sign-in (find the browser, log in, maybe sign up),
 // short enough that an abandoned flow doesn't leave a child running forever.
 // The env override is a QA seam, like CASTLE_USER_KEYS_PATH: ten minutes is
 // unwaitable in a test.
 const LOGIN_TIMEOUT_MS = Number(process.env.CASTLE_LOGIN_TIMEOUT_MS ?? "") || 10 * 60 * 1000;
-// OSC-8 hyperlinks and colour codes come through on both CLIs; strip them
-// before matching so a URL isn't cut short at an escape byte.
+// OSC-8 hyperlinks and colour codes come through; strip them before matching
+// so a URL isn't cut short at an escape byte.
 // eslint-disable-next-line no-control-regex
 const ANSI = /\x1b\[[0-9;]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?/g;
-const URL_PATTERN = {
-    claude: /https:\/\/claude\.com\/\S*oauth\S*/,
-    cursor: /https:\/\/cursor\.com\/\S*/,
-};
-function commandFor(provider) {
+const URL_PATTERN = /https:\/\/claude\.com\/\S*oauth\S*/;
+function commandFor() {
     const env = { ...process.env, NO_OPEN_BROWSER: "1" };
-    if (provider === "cursor") {
-        // Castle's key would let cursor-agent consider itself authenticated and
-        // skip the OAuth it was just asked for.
-        delete env.CURSOR_API_KEY;
-        return { file: "cursor-agent", args: ["login"], env };
-    }
     // Castle's proxy pair outranks a claude.ai login (see byo-auth), and the
     // sandbox always has it set -- leaving it in place would have claude decide
     // it is already authenticated and skip the flow entirely.
@@ -107,28 +86,22 @@ function handleOutput(text) {
         return;
     }
     if (!active.state.url) {
-        const match = URL_PATTERN[active.provider].exec(clean);
-        if (match) {
-            publish({
-                url: match[0],
-                // claude will ask for a pasted code next; cursor polls on its own.
-                phase: active.provider === "claude" ? "awaiting-code" : "awaiting-user",
-            });
-        }
+        const match = URL_PATTERN.exec(clean);
+        if (match)
+            publish({ url: match[0], phase: "awaiting-code" });
     }
 }
-export function startLogin(provider, onChange) {
+export function startLogin(onChange) {
     cancelLogin();
-    const { file, args, env } = commandFor(provider);
+    const { file, args, env } = commandFor();
     let child;
     try {
         child = spawn(file, args, { env, stdio: ["pipe", "pipe", "pipe"] });
     }
     catch {
         active = {
-            provider,
             child: null,
-            state: { provider, phase: "error", message: `could not run ${file}` },
+            state: { provider: "claude", phase: "error", message: `could not run ${file}` },
             timer: setTimeout(() => undefined, 0),
             onChange,
         };
@@ -136,9 +109,8 @@ export function startLogin(provider, onChange) {
         return;
     }
     active = {
-        provider,
         child,
-        state: { provider, phase: "starting" },
+        state: { provider: "claude", phase: "starting" },
         timer: setTimeout(() => finish("Timed out waiting for sign-in."), LOGIN_TIMEOUT_MS),
         onChange,
     };
@@ -157,7 +129,7 @@ export function startLogin(provider, onChange) {
         // The RESOLVER decides, never the exit code: what matters is whether the
         // credential this process routes on is now there. A CLI that exits 0
         // without leaving one behind must not read as success.
-        if (providerHasLogin(provider))
+        if (claudeHasSavedLogin())
             finish(null);
         else
             finish("Sign-in did not complete.");
@@ -176,12 +148,12 @@ export function submitLoginCode(code) {
 // Sign out, so the modal isn't a one-way door. Fire-and-forget by shape but
 // awaited for its close, because the snapshot is only right once the CLI has
 // actually dropped the credential -- the resolver, again, not the exit code.
-export function logout(provider, onChange) {
+export function logout(onChange) {
     cancelLogin();
-    const { file, args, env } = provider === "cursor"
-        ? { file: "cursor-agent", args: ["logout"], env: process.env }
-        : { file: "claude", args: ["auth", "logout"], env: commandFor("claude").env };
-    const child = spawn(file, args, { env, stdio: "ignore" });
+    const child = spawn("claude", ["auth", "logout"], {
+        env: commandFor().env,
+        stdio: "ignore",
+    });
     child.on("error", onChange);
     child.on("close", onChange);
 }

package/dist/mcpPlaytest.js

@@ -1,6 +1,5 @@
 // A stdio MCP server exposing ONE tool -- `playtest` -- to a spawned claude
-// task agent, so the claude backend gets the capability smith already has
-// natively (native/tools.ts). It owns no browser: every call is relayed to the
+// task agent. It owns no browser: every call is relayed to the
 // running serve over its loopback control WebSocket (`playtest_request` in
 // serve.ts), which is where the one warm Chromium and the task's frames dir
 // live.

package/dist/metering.d.ts

@@ -7,29 +7,6 @@ export type MeteringRoute = "anthropic" | "openrouter";
  * background-task spend" a prefix match with no extra column.
  */
 export declare function newAgentSessionId(role: "router" | "task"): string;
-/**
- * Report a cursor run to the llm-proxy, which stamps the user + sandbox from
- * our token and forwards it to the ledger alongside the anthropic/openrouter
- * rows the proxy records itself.
- *
- * Cursor needs this because it is the one backend the proxy cannot see:
- * cursor-agent has no base-URL override, so it talks to Cursor directly on its
- * own key. There are no token counts to send -- cursor-agent's stream-json
- * reports none -- so a row is a run count with its deck, agent run, model, and
- * outcome, and the ledger's NULL tokens read as "not measured".
- *
- * Fire-and-forget by contract: the run is already over and its output already
- * reached the user, so every failure here is swallowed. A dropped post loses
- * one row rather than retrying, which is the right trade for a signal whose
- * value is aggregate.
- */
-export declare function reportCursorRun(opts: {
-    deckDir: string;
-    sessionId: string;
-    model: string;
-    durationMs: number;
-    ok: boolean;
-}): void;
 /**
  * True when this serve runs inside a Castle sandbox -- i.e. the host injected the
  * llm-proxy pair, which is what makes a run metered and limit-gated in the first
@@ -44,6 +21,7 @@ export interface CastleBudget {
     resetAtMs: number;
     blocked: boolean;
     blockedModelPrefixes: string[];
+    freeModelPrefixes: string[];
 }
 export interface AiCredits {
     plan: "credits" | "daily";
@@ -66,6 +44,40 @@ export interface AiCredits {
     };
 }
 export declare function spendableMicros(budget: CastleBudget): number | null;
+/**
+ * Whether Castle foots the bill for this model, so its runs are free to the
+ * user however their credits stand.
+ *
+ * A prefix matches either the full slug or the part after the last "/", so a
+ * vendor-qualified prefix still covers the variant suffixes OpenRouter allows
+ * ("meta/muse-spark-1.3-contributor:nitro" is the same model, billed the same)
+ * while stopping short of a shorter sibling ("meta/muse-spark-1.3" is a
+ * different model and is NOT free). Matching is the loose kind on purpose:
+ * being wrong here costs one proxy 403 with its own copy, never a run that
+ * silently spends credits the user was told were not being spent -- which is
+ * why the unqualified form is accepted too, rather than demanding the vendor
+ * segment the user may have typed differently.
+ */
+export declare function modelIsFree(model: string, prefixes: readonly string[]): boolean;
+/** One agent role as the free-tier question sees it. */
+export interface RoleSpend {
+    castlePaid: boolean;
+    slug: string | null;
+}
+/**
+ * Whether this editor is entirely on models Castle pays for -- the signal the
+ * UI uses to stop talking about credits.
+ *
+ * "Every Castle-paid role", not "any": one role left on a metered model still
+ * spends the user's balance, and a UI that hid credits then would hide the
+ * thing about to run out. With no Castle-paid role at all there is nothing to
+ * call free (the usage frame is null in that case anyway), so it answers false.
+ */
+export declare function freeTierForRoles(roles: readonly RoleSpend[], prefixes: readonly string[]): boolean;
+export declare function freeRolesFor(spends: readonly RoleSpend[], prefixes: readonly string[]): {
+    router: boolean;
+    tasks: boolean;
+};
 /**
  * Coalesce asynchronous refresh triggers without letting an older read finish
  * after and overwrite a newer one. `withFullState` is sticky across queued

package/dist/metering.js

@@ -48,58 +48,6 @@ function deckIdFor(deckDir) {
         return null;
     return parsed.deckId.replace(/[\r\n]/g, "") || null;
 }
-// Path on the proxy that accepts a run the proxy never routed. Must match
-// CASTLE_USAGE_PATH in castle-sandboxes/shared/src/index.ts.
-const CASTLE_USAGE_PATH = "/castle/usage";
-// A metering post must never delay a turn that has already finished, and its
-// result is never awaited -- so a proxy that has gone away costs one socket
-// timeout in the background, not a hung run.
-const USAGE_POST_TIMEOUT_MS = 5_000;
-/**
- * Report a cursor run to the llm-proxy, which stamps the user + sandbox from
- * our token and forwards it to the ledger alongside the anthropic/openrouter
- * rows the proxy records itself.
- *
- * Cursor needs this because it is the one backend the proxy cannot see:
- * cursor-agent has no base-URL override, so it talks to Cursor directly on its
- * own key. There are no token counts to send -- cursor-agent's stream-json
- * reports none -- so a row is a run count with its deck, agent run, model, and
- * outcome, and the ledger's NULL tokens read as "not measured".
- *
- * Fire-and-forget by contract: the run is already over and its output already
- * reached the user, so every failure here is swallowed. A dropped post loses
- * one row rather than retrying, which is the right trade for a signal whose
- * value is aggregate.
- */
-export function reportCursorRun(opts) {
-    const base = process.env.CASTLE_LLM_PROXY_URL;
-    const token = process.env.CASTLE_LLM_PROXY_TOKEN;
-    // Absent outside a sandbox, and on a host whose proxy predates this route --
-    // both cases correctly report nothing rather than posting into the void.
-    if (!base || !token)
-        return;
-    const deckId = deckIdFor(opts.deckDir);
-    void fetch(`${base}${CASTLE_USAGE_PATH}`, {
-        method: "POST",
-        headers: {
-            "content-type": "application/json",
-            authorization: `Bearer ${token}`,
-        },
-        body: JSON.stringify({
-            provider: "cursor",
-            model: opts.model,
-            ...(deckId ? { deckId } : {}),
-            agentSessionId: opts.sessionId,
-            durationMs: opts.durationMs,
-            // A cursor run has no HTTP status; the ledger's column is one, and
-            // `>= 400 means it failed` is the reading every other row already gets.
-            status: opts.ok ? 200 : 500,
-        }),
-        signal: AbortSignal.timeout(USAGE_POST_TIMEOUT_MS),
-    }).catch(() => {
-        /* best-effort: metering must never surface in a finished run */
-    });
-}
 /**
  * True when this serve runs inside a Castle sandbox -- i.e. the host injected the
  * llm-proxy pair, which is what makes a run metered and limit-gated in the first
@@ -120,6 +68,60 @@ export function spendableMicros(budget) {
         return null;
     return Math.max(0, budget.limitMicros - budget.usedMicros);
 }
+/**
+ * Whether Castle foots the bill for this model, so its runs are free to the
+ * user however their credits stand.
+ *
+ * A prefix matches either the full slug or the part after the last "/", so a
+ * vendor-qualified prefix still covers the variant suffixes OpenRouter allows
+ * ("meta/muse-spark-1.3-contributor:nitro" is the same model, billed the same)
+ * while stopping short of a shorter sibling ("meta/muse-spark-1.3" is a
+ * different model and is NOT free). Matching is the loose kind on purpose:
+ * being wrong here costs one proxy 403 with its own copy, never a run that
+ * silently spends credits the user was told were not being spent -- which is
+ * why the unqualified form is accepted too, rather than demanding the vendor
+ * segment the user may have typed differently.
+ */
+export function modelIsFree(model, prefixes) {
+    const slug = model.trim().toLowerCase();
+    if (!slug)
+        return false;
+    const bare = slug.slice(slug.lastIndexOf("/") + 1);
+    return prefixes.some((raw) => {
+        const prefix = raw.trim().toLowerCase();
+        // An empty prefix would make every model free -- refuse it rather than
+        // hand a malformed server list the power to turn metering off.
+        if (!prefix)
+            return false;
+        return slug.startsWith(prefix) || bare.startsWith(prefix);
+    });
+}
+/**
+ * Whether this editor is entirely on models Castle pays for -- the signal the
+ * UI uses to stop talking about credits.
+ *
+ * "Every Castle-paid role", not "any": one role left on a metered model still
+ * spends the user's balance, and a UI that hid credits then would hide the
+ * thing about to run out. With no Castle-paid role at all there is nothing to
+ * call free (the usage frame is null in that case anyway), so it answers false.
+ */
+export function freeTierForRoles(roles, prefixes) {
+    const paid = roles.filter((role) => role.castlePaid);
+    return (paid.length > 0 &&
+        paid.every((role) => role.slug !== null && modelIsFree(role.slug, prefixes)));
+}
+// Per-role version of the free-tier question, for the picker rather than the
+// bill: which Castle-paid role is sitting on a free model. `freeTier` answers
+// for the whole editor and cannot say which of the two rows earns the chip.
+// A role paid through the user's credential, or on a fixed claude alias with
+// no slug, is never free.
+export function freeRolesFor(spends, prefixes) {
+    const [router, tasks] = spends;
+    const free = (spend) => spend.castlePaid &&
+        spend.slug !== null &&
+        modelIsFree(spend.slug, prefixes);
+    return { router: free(router), tasks: free(tasks) };
+}
 /**
  * Coalesce asynchronous refresh triggers without letting an older read finish
  * after and overwrite a newer one. `withFullState` is sticky across queued
@@ -268,6 +270,9 @@ export async function fetchBudget() {
             blockedModelPrefixes: Array.isArray(body.blockedModelPrefixes)
                 ? body.blockedModelPrefixes.filter((p) => typeof p === "string")
                 : [],
+            freeModelPrefixes: Array.isArray(body.freeModelPrefixes)
+                ? body.freeModelPrefixes.filter((p) => typeof p === "string")
+                : [],
         };
     }
     catch {

package/dist/openrouter-catalog.d.ts

@@ -27,4 +27,3 @@ export declare function checkOpenrouterKey(apiKey: string, opts?: {
     direct?: boolean;
 }): Promise<KeyCheck>;
 export declare function checkOpenrouterModel(slug: string): Promise<ModelCheck>;
-export declare function openrouterCatalogEntry(slug: string): Promise<CatalogEntry | null>;