warpmetal 0.8.12 → 0.9.0

package/README.md

@@ -41,11 +41,15 @@ x402api help --json
 Install the bundled skill for supported coding agents:
 
 ```sh
+warpmetal agent install --target <codex|claude|all>
 warpmetal agent install --target codex
 warpmetal agent install --target claude
 warpmetal agent install --target all
 ```
 
+`warpmetal agent install` installs only the bundled WarpMetal skill; it does
+not install sandbox tools or select a sandbox tool profile.
+
 Use `--scope project` to install into the current repository instead of the
 user-level agent directory.
 
@@ -58,7 +62,7 @@ integration.
 
 The repository also contains a skills-only WarpMetal plugin for the public
 Plugins Directory shared by Codex and ChatGPT. The plugin remains a separate
-artifact from the npm CLI and requires `warpmetal` CLI version 0.8.1 or newer.
+artifact from the npm CLI and requires `warpmetal` CLI version 0.9.0 or newer.
 
 To test the repository marketplace after the plugin lands on `main`:
 
@@ -80,9 +84,13 @@ the repo marketplace is only for development, testing, and direct distribution.
 ## First commands
 
 ```sh
+warpmetal login
+warpmetal auth status
 warpmetal health
 warpmetal catalog
+warpmetal models --auth-mode chatgpt_subscription
 warpmetal order prepare \
+  --account --without-agent-boxes \
   --plan agent \
   --hostname codex-workspace \
   --os '<exact name from warpmetal catalog>' \
@@ -90,11 +98,54 @@ warpmetal order prepare \
   --json
 ```
 
+`warpmetal login` starts WarpMetal account authorization before any SSH key or
+order configuration is needed. It opens the browser approval page by default;
+use `--no-browser` to print the page and user code without opening it. The
+default session requests `cli:read cli:write`; `--read-only` requests only
+`cli:read`. Check the current account with `warpmetal auth status` and revoke
+the CLI session with `warpmetal logout`.
+
+The CLI stores only its own rotating account session under the private
+WarpMetal state directory. Account sessions are separate from browser sessions,
+legacy order owner tokens and SSH credentials, and are bound to the exact
+Identity and account origins that issued them. `--identity-url` and
+`--account-url` accept explicit origins for testing or alternate deployments;
+credentials are never sent after an HTTP redirect or reused for other origins.
+If a refresh response is lost, the CLI clears the local session and requires a
+new login rather than risking reuse of a rotated credential. Logout always
+clears the matching local session, and reports when remote revocation could not
+be confirmed.
+
+Use `warpmetal account orders` and `warpmetal account devices` for your account's
+order history and active servers; add `--task <id>` or `--server <id>` for one
+item. `order prepare --account` binds the unpaid order to the signed-in account
+and uses its verified contact. It never issues an owner token. Login and account
+creation do not require SSH keys or order configuration.
+
+New account preparation defaults to Agent Boxes and an Agent team. Supply the
+selected team in `--runtime-file`; no provider or model is silently selected.
+Use `--without-team` for a single small persistent box, or
+`--without-agent-boxes` for a VPS without boxes. An explicit runtime file keeps
+its existing selections. `warpmetal models --json` supplies published model and
+authentication choices; server readiness checks still apply.
+
+Without `--account`, order preparation retains the existing owner-token
+workflow, including payment and SSH automation. This release adds account order
+preparation and inventory, not a new account payment or runtime-execution grant.
+The account scopes do not authorize charges, renewals, deletion or Fleet access.
+
+`warpmetal catalog` lists VPS plans. `warpmetal models` reads the separate,
+public Agent Teams model catalog. It never signs in to a model provider or
+creates an order. Use `--provider` or `--auth-mode api_key|chatgpt_subscription`
+to filter published entries; JSON preserves the catalog snapshot, provenance,
+freshness state and published authentication modes.
+
 The generated key defaults to
 `${WARPMETAL_HOME:-~/.config/warpmetal}/ssh/warpmetal-codex-workspace`. A
 collision receives a random suffix; existing keys are never overwritten. Once
 checkout returns `serverId`, the CLI binds that ID to the identity so
-`warpmetal server login` and `warpmetal runtime install` can select it without
+`warpmetal server login` is the distinct SSH challenge flow for one server.
+It and `warpmetal runtime install` can select the generated identity without
 an `--identity` flag. Use `--ssh-public-key-file` instead when supplying a
 user-managed public key.
 
@@ -340,6 +391,19 @@ compatible external signer.
   and reports an owner-host-key refresh opens one new managed trust epoch;
   failed or ambiguous reloads retain the old pin and never permit replacement.
   Erased workspaces are never described as recoverable.
+- New agent-enabled candidate orders and Runtime-enabled reloads pass the
+  closed nested-sandbox opt-in inside verified provider cloud-init. The signed
+  Runtime bundle installs the exact-path AppArmor policy for the neutral
+  image's immutable Bubblewrap helper; this needs no follow-up customer SSH
+  key and adds no public order field or CLI flag. VPS-only cloud-init is
+  unchanged. Existing enrolled hosts use reload/reprovision; the CLI does not
+  claim a silent in-place policy repair command.
+- Runtime reports a new or replaced sandbox generation as running only after a
+  fixed, credential-free inner-Bubblewrap oracle proves nested namespaces, an
+  inherited read-only view of the outer Agent Box's already isolated procfs,
+  an allowed workspace write, empty Linux capability sets,
+  `no-new-privileges`, and protected-root write denial. Failure stops the
+  container before access grants or tool setup advance.
 
 For a Runtime-enabled reload, no separate installation command is part of the
 successful path:
@@ -387,6 +451,61 @@ warpmetal sandbox access keygen \
   --json
 ```
 
+### Registered sandbox tools
+
+WarpMetal can apply only registered, immutable tool profiles. These commands use
+the owner credential already stored in the private WarpMetal state file; they do
+not accept a bearer token on the command line or permit a caller-supplied URL,
+shell command, environment, or artifact override.
+
+```sh
+warpmetal tools list --server <serverId> --json
+warpmetal tools install --server <serverId> --sandbox <sandboxId> --profile <profileId> \
+  [--idempotency-key <key>] [--wait] [--timeout-seconds <n>] --json
+warpmetal tools status --server <serverId> [--wait] [--timeout-seconds <n>] --json
+```
+
+`tools install` posts only the selected registered `profileId`. Waiting is
+bounded: `ready` exits 0, `failed` or `cancelled` exits 5, and a timeout exits 8.
+JSON output contains public profile, operation, and receipt metadata only.
+Successful non-wait installs and status inspections exit 0 while reporting the
+accepted or current state; exit 8 is reserved for an actual `--wait` deadline
+timeout.
+
+Codex is a released automatic tool profile when the public
+`/agent-tool-profiles` endpoint advertises it as `available`. WarpMetal installs
+the exact registered artifacts when selected at order time or through
+`tools install`. Claude Code uses the released `claude-code` automatic tool
+profile under the same public availability gate. Claude Managed Agents are separate:
+`claude-managed-ant` is an install-only CLI profile. Installing `ant` does not
+authenticate a worker and does not activate Managed Agents. Cursor CLI remains
+manual and unavailable as an automatic profile until separately qualified later.
+Gemini CLI remains manual.
+
+An order `--runtime-file` may add the closed optional setup intent beside its
+`sandboxes` array:
+
+```json
+{
+  "sandboxes": [
+    { "name": "codex-worker", "size": "small" },
+    { "name": "claude-worker", "size": "small" },
+    { "name": "managed-worker", "size": "small" }
+  ],
+  "setup": {
+    "version": 1,
+    "sandboxProfiles": [
+      { "sandboxName": "codex-worker", "profileId": "codex" },
+      { "sandboxName": "claude-worker", "profileId": "claude-code" },
+      { "sandboxName": "managed-worker", "profileId": "claude-managed-ant" }
+    ]
+  }
+}
+```
+
+Only those fields are accepted. Each setup entry must name a sandbox in the
+same file and a registered profile ID.
+
 ### Install a standard sandbox SSH alias
 
 Use a separate keypair and access grant for each sandbox. After the grant is
@@ -410,10 +529,16 @@ ssh -t <alias> gemini
 ssh <alias> gemini -p '<task>'
 ```
 
-Install and authenticate Codex, Claude Code, Cursor CLI, or Gemini CLI inside
-the sandbox first. Provider credentials are sandbox-owned and remain in its
-persistent home; WarpMetal does not install these tools, perform their login,
-or receive their credentials.
+Authenticate Codex or Claude Code inside the sandbox after its selected profile
+is ready. The public `/agent-tool-profiles` response is authoritative for
+availability and checkout selection. Claude Code uses the `claude-code`
+automatic tool profile. Claude Managed Agents are
+separate: `claude-managed-ant` is an install-only CLI profile. Installing `ant`
+does not authenticate a worker and does not activate Managed Agents. Cursor CLI
+remains manual and unavailable as an automatic profile until separately
+qualified later. Install and authenticate Cursor CLI or Gemini CLI inside the
+sandbox. Provider credentials are sandbox-owned and remain in its
+persistent home; WarpMetal does not perform provider login or receive them.
 
 The alias is local-only. It prepends a managed include to `~/.ssh/config` and
 uses the profile's pinned host key plus the sandbox identity. It never uses or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "warpmetal",
-  "version": "0.8.12",
+  "version": "0.9.0",
   "description": "Agent-safe CLI and skill for purchasing, renewing, and managing WarpMetal VPS servers",
   "type": "module",
   "bin": {
@@ -16,7 +16,7 @@
     "node": ">=20.0.0"
   },
   "scripts": {
-    "check": "node --check bin/warpmetal.js && node --check src/api.js && node --check src/args.js && node --check src/cli.js && node --check src/connection.js && node --check src/errors.js && node --check src/host-trust.js && node --check src/install-skill.js && node --check src/installer.js && node --check src/payment.js && node --check src/runtime.js && node --check src/ssh-alias.js && node --check src/ssh.js && node --check src/state.js && node --check src/version.js",
+    "check": "node --check bin/warpmetal.js && node --check src/account-gateway.js && node --check src/account-session.js && node --check src/api.js && node --check src/args.js && node --check src/cli.js && node --check src/connection.js && node --check src/customer-auth.js && node --check src/errors.js && node --check src/host-trust.js && node --check src/install-skill.js && node --check src/installer.js && node --check src/models.js && node --check src/payment.js && node --check src/runtime.js && node --check src/ssh-alias.js && node --check src/ssh.js && node --check src/state.js && node --check src/version.js",
     "plugin:check": "node --test test/plugin.test.js",
     "test": "node --test",
     "prepack": "npm run check && npm test"

package/skills/warpmetal/SKILL.md

@@ -11,7 +11,7 @@ with ad hoc HTTP commands.
 
 ## Start safely
 
-1. Run `warpmetal --version` and require version `0.8.1` or newer for this
+1. Run `warpmetal --version` and require version `0.9.0` or newer for this
    plugin. If it is missing or older, explain the compatibility requirement,
    ask before installing or upgrading software, and use only the official npm
    package from `https://www.npmjs.com/package/warpmetal`.
@@ -44,8 +44,14 @@ Run:
 ```sh
 warpmetal health --json
 warpmetal catalog --json
+warpmetal models --json
 ```
 
+`catalog` is the live VPS plan catalog. `models` is the separate public Agent
+Teams model catalog; it makes one read-only request and never infers model
+availability, credentials, entitlement, or provider support. Filter only with
+published `--provider` or `--auth-mode api_key|chatgpt_subscription` values.
+
 Stop the current purchase if `purchasingReady` is false. In unattended
 scheduling, recheck after 60 seconds, then double the delay after each failed
 check up to 15 minutes and honor a longer `Retry-After`; never hot-loop. In an

package/skills/warpmetal/references/cli-reference.md

@@ -3,6 +3,7 @@
 ## Contents
 
 - Discovery
+- Account authentication
 - Purchase and provisioning
 - SSH identities
 - Renewal and notifications
@@ -17,11 +18,106 @@
 ```sh
 warpmetal health --json
 warpmetal catalog [--plan <planId>] --json
+warpmetal models [--provider <id>] [--auth-mode <api_key|chatgpt_subscription>] [--json]
 ```
 
+## Public model catalog
+
+`warpmetal models` performs a read-only `GET /agent-team-model-catalog` request.
+It preserves the published snapshot metadata, source provenance, freshness state
+and authentication modes. `--provider` and `--auth-mode` filter entries and
+remove recommendations whose published entry is no longer present. The command
+does not infer eligibility or contact a model provider. `catalog` remains the
+VPS plan catalog.
+
 `health` exits with code 3 when the service responds but purchasing is paused.
 The catalog remains useful for read-only discovery.
 
+## Account authentication
+
+```sh
+warpmetal login [--no-browser] [--read-only] --json
+warpmetal auth status --json
+warpmetal logout --json
+```
+
+`login` uses the public `warpmetal-customer-cli` device client. It requests
+`cli:read cli:write` by default or only `cli:read` with `--read-only`, prints the
+bounded verification page and user code to stderr, and opens that page unless
+`--no-browser` is present. Polling follows the server interval and treats
+pending, slow-down, denial, expiry and cancellation as distinct outcomes. JSON
+stdout contains only safe account identity and scope fields; access, refresh
+and device credentials are never output.
+
+The rotating CLI refresh family is independent of browser sessions, legacy
+owner tokens and SSH credentials. It is stored in an owner-only, atomic session
+file under the private WarpMetal state directory. Concurrent commands serialize
+refresh. If refresh completion is ambiguous, the saved session is cleared and a
+new login is required rather than replaying the old credential.
+
+Sessions are bound to the exact Identity and account origins. Defaults are
+`https://identity.warpmetal.com` and `https://warpmetal.com`; explicit
+`--identity-url` and `--account-url` values must be HTTPS origins (localhost may
+use HTTP). Redirects are refused, and credentials for one origin pair are never
+sent to another. `logout` attempts remote family revocation and always clears
+the matching local session, reporting whether revocation was confirmed.
+
+Account login does not grant server SSH access. `warpmetal server login` remains
+the separate, server-specific SSH challenge command.
+
+## Account orders and devices
+
+```sh
+warpmetal account orders [--task <taskId>] --json
+warpmetal account devices [--server <serverId>] --json
+warpmetal order prepare --account --without-agent-boxes \
+  --plan <planId> --hostname <name> --os '<exact catalog OS>' \
+  --generate-ssh-key [--idempotency-key <key>] --json
+```
+
+Reads require `cli:read`; unpaid preparation requires `cli:write`. Only these
+allowlisted operations are granted. Account scope never authorizes a payment,
+renewal, server deletion, credential change or runtime execution. Collections
+return the server's bounded page and `nextCursor`; order history is distinct from
+active devices and can include released or cancelled orders.
+
+Account mode signs in before checking order fields. It derives contact and
+ownership from the signed-in principal, rejects `--email`, uses the private
+account gateway, and records `ownershipMode: account` plus principal/origin in
+private local state without an owner token. Use the same idempotency key and
+unchanged payload to retry an ambiguous preparation. Do not retry a charge.
+Existing owner-token checkout commands do not become account payment commands.
+
+Boxes/team are selected by default for new account preparation: provide
+`--runtime-file` with your chosen team, `--without-team` for one persistent small
+`main` box, or `--without-agent-boxes` for no runtime. Explicit runtime files keep
+their box/team choices, and older scripts without `--account` retain their
+defaults. Server model/runtime readiness gates remain binding.
+
+The optional `teams` sibling of `sandboxes` uses the deployed team-v1 schema:
+
+```json
+{
+  "sandboxes": [{"name":"manager","size":"small"},{"name":"builder","size":"small"}],
+  "teams": {"version":1,"teams":[{
+    "name":"Build team",
+    "members":[
+      {"sandboxName":"manager","role":"manager","providerId":"openai"},
+      {"sandboxName":"builder","role":"worker","providerId":"anthropic"}
+    ],
+    "links":[{"from":"manager","to":"builder","capability":"task.delegate"}],
+    "startPolicy":"manual"
+  }]}
+}
+```
+
+Provider names in this example are preferences, not qualification proof. Optional
+`modelId` and `authMode` must reflect the selected published entry; omitted values
+mean choose later, never automatic credentials. A team has one manager and 2–8
+distinct declared boxes. Credentials, unknown fields, automatic start and
+cross-team links are rejected. Team/setup files are for order preparation;
+`sandbox create --file` accepts a sandbox batch only.
+
 ## Purchase and provisioning
 
 ```sh
@@ -221,6 +317,13 @@ process listings.
 
 ## Agent Runtime and sandboxes
 
+Agent-enabled first boot and Runtime-enabled reload automatically carry the
+closed nested-sandbox opt-in inside verified provider cloud-init. The signed
+Runtime bundle installs the exact-path policy for the image's immutable
+Bubblewrap helper without a later customer SSH key. This is not a public order
+field or CLI flag; VPS-only cloud-init remains unchanged, and existing enrolled
+hosts use reload/reprovision. There is no silent in-place policy repair.
+
 ```sh
 warpmetal runtime enable --server <serverId> [--idempotency-key <key>] --json
 warpmetal runtime get --server <serverId> [--wait] [--timeout-seconds <n>] --json
@@ -243,6 +346,11 @@ warpmetal sandbox action \
   [--wait] --json
 warpmetal sandbox delete \
   --server <serverId> --sandbox <sandboxId> --confirm DELETE [--wait] --json
+
+warpmetal tools list --server <serverId> --json
+warpmetal tools install --server <serverId> --sandbox <sandboxId> --profile <profileId> \
+  [--idempotency-key <key>] [--wait] [--timeout-seconds <n>] --json
+warpmetal tools status --server <serverId> [--wait] [--timeout-seconds <n>] --json
 ```
 
 CLI 0.8.8 manages owner-facing VPS host trust during `runtime install`. With no
@@ -256,7 +364,52 @@ reloads never replace trust. This TOFU step cannot detect an active attacker on
 the first connection. Provider-console pre-enrollment is optional and stronger.
 
 See [runtime.md](runtime.md) for capacity, lifetime, cleanup, polling, and
-installation safety. Exit 8 means accepted or pending, never applied.
+installation safety. Exit 8 is reserved for an actual bounded `--wait`
+deadline timeout; a successful non-wait inspection exits 0 while reporting an
+accepted, pending, applying, ready, or empty current state.
+
+The `tools` commands use only the owner token already stored for the named
+server. They do not accept token argv or `--token-file`. `tools list` returns
+the registered immutable profiles. `tools install` sends only `{profileId}`
+with an idempotency key; callers cannot supply download URLs, shell commands,
+argv, environment variables, or artifacts. With `--wait`, `ready` exits 0,
+`failed` or `cancelled` exits 5, and a bounded timeout exits 8. JSON contains
+only the public profile/setup-operation fields returned by WarpMetal.
+
+Codex is a released automatic tool profile when the public
+`/agent-tool-profiles` endpoint advertises it as `available`. WarpMetal installs
+the exact registered artifacts when selected at order time or through
+`tools install`. Claude Code uses the released `claude-code` automatic tool
+profile under the same public availability gate. Claude Managed Agents are separate:
+`claude-managed-ant` is an install-only CLI profile. Installing `ant` does not
+authenticate a worker and does not activate Managed Agents. Cursor CLI remains
+manual and unavailable as an automatic profile until separately qualified later.
+Gemini CLI remains manual.
+
+For order-time setup, the runtime JSON file may contain the exact optional
+shape below in addition to `sandboxes`:
+
+```json
+{
+  "sandboxes": [
+    { "name": "codex-worker", "size": "small" },
+    { "name": "claude-worker", "size": "small" },
+    { "name": "managed-worker", "size": "small" }
+  ],
+  "setup": {
+    "version": 1,
+    "sandboxProfiles": [
+      { "sandboxName": "codex-worker", "profileId": "codex" },
+      { "sandboxName": "claude-worker", "profileId": "claude-code" },
+      { "sandboxName": "managed-worker", "profileId": "claude-managed-ant" }
+    ]
+  }
+}
+```
+
+Every selection must reference a sandbox name in the same file. Unknown fields,
+including URL, shell, command, argv, environment, or artifact overrides, are
+rejected before an API request.
 
 ## Per-agent access
 
@@ -315,9 +468,16 @@ ssh -t <alias> gemini
 ssh <alias> gemini -p '<task>'
 ```
 
-Install and authenticate Codex, Claude Code, Cursor CLI, or Gemini CLI inside
-the sandbox first. WarpMetal does not install, authenticate, configure, or
-receive credentials for those tools.
+Authenticate each selected provider tool inside the sandbox after setup is
+ready. The public `/agent-tool-profiles` response is authoritative for
+availability and checkout selection. Claude Code uses the `claude-code`
+automatic tool profile. Claude Managed Agents are
+separate: `claude-managed-ant` is an install-only CLI profile. Installing `ant`
+does not authenticate a worker and does not activate Managed Agents. Cursor CLI
+remains manual and unavailable as an automatic profile until separately
+qualified later. Install and authenticate Cursor CLI or Gemini CLI inside the
+sandbox. WarpMetal does not perform provider login or receive provider
+credentials.
 
 [Codex Desktop](https://learn.chatgpt.com/docs/remote-connections) reads
 the concrete alias from `~/.ssh/config` and starts Codex through the sandbox
@@ -341,6 +501,9 @@ warpmetal agent install --target <codex|claude|all> [--scope user|project]
 warpmetal state list --json
 ```
 
+`warpmetal agent install` installs only the bundled WarpMetal skill; it does
+not install sandbox tools or select a sandbox tool profile.
+
 `state list` returns identifiers, public runtime metadata, and
 credential-presence booleans only. Never
 open the underlying state file from an agent session.

package/skills/warpmetal/references/runtime.md

@@ -46,6 +46,20 @@ Pass it to `warpmetal order prepare --runtime-file <path>`. If it contains a
 temporary sandbox, pass `--confirm TEMPORARY`. Preparing remains unpaid; keep
 the existing separate interactive-or-autonomous payment authority check.
 
+For released Codex and Claude Code automatic profiles, an agent-enabled first
+boot passes a closed nested-sandbox opt-in through verified
+provider cloud-init. The signed Runtime bundle owns the exact-path AppArmor
+policy for the neutral image's immutable Bubblewrap helper. No later customer
+SSH key is used. No public order field or CLI flag exists; VPS-only cloud-init
+remains unchanged. Existing enrolled hosts require reload/reprovision for this policy
+because no silent in-place repair command is claimed.
+Runtime does not report a new or replaced sandbox generation as running until a
+fixed, credential-free inner-Bubblewrap oracle proves nested namespaces, an
+inherited read-only view of the outer Agent Box's already isolated procfs, an
+allowed workspace write, empty Linux capability sets, `no-new-privileges`, and
+protected-root write denial; failure stops the container before access grants
+or tool setup advance.
+
 For an existing ready server:
 
 Use the WarpMetal owner account `root` for every supported host image; do not
@@ -300,10 +314,15 @@ ssh -t <alias> gemini
 ssh <alias> gemini -p '<task>'
 ```
 
-Install and authenticate Codex, Claude Code, Cursor CLI, or Gemini CLI inside
-the sandbox first. Provider authentication and credentials are sandbox-owned
-and persist only in the sandbox home. WarpMetal does not install, authenticate,
-configure, or receive credentials for those tools.
+Authenticate each selected provider tool inside the sandbox after setup is
+ready. The public `/agent-tool-profiles` endpoint is authoritative for profile
+availability. Claude Code uses the released `claude-code` automatic tool
+profile. Claude Managed Agents are separate: `claude-managed-ant` is an
+install-only CLI profile. Installing `ant` does not authenticate a worker and
+does not activate Managed Agents. Cursor CLI remains manual and unavailable as
+an automatic profile until separately qualified later. Provider authentication
+and credentials are sandbox-owned and persist only in the sandbox home;
+WarpMetal does not perform provider login or receive those credentials.
 
 [Codex Desktop](https://learn.chatgpt.com/docs/remote-connections)
 discovers a concrete alias through `~/.ssh/config`, requires ordinary