superqode 2.4.39__tar.gz → 2.4.41__tar.gz

{superqode-2.4.39 → superqode-2.4.41}/CHANGELOG.md

@@ -7,6 +7,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.4.41] - 2026-10-01
+
+### Fixed
+
+- Guard Copilot account connections against model-provider environment overrides,
+  including when an explicit GitHub identity token is supplied.
+- Require a live ChatGPT account check for Codex subscription connections before
+  creating a thread and before each prompt; mask inherited API keys and restrict
+  the app-server login method. Explicit runtime connections retain agent-managed
+  authentication.
+- Keep transport, authentication, requested billing and verification separate in
+  saved routes. Migrate old ACP authentication values without implying plan
+  verification, restore runtime/model choices, and stop unsupported reconnects
+  instead of falling back to a previously used BYOK route.
+- Describe external harness accounts as agent-managed with unverified billing.
+  Reject legacy interactive plan routes in headless commands before any model call.
+
+## [2.4.40] - 2026-10-01
+
+### Changed
+
+- Add Use your subscription (Experimental) to the SuperQode model-source
+  picker. All provider cards say Partner integration in progress and show
+  information only, preserving the current connection. Claude/Anthropic is
+  excluded. Existing native plan shortcuts remain compatible.
+- Classify Warp Agent under Closed harnesses: its server-side agent harness
+  is proprietary, while its client remains open source under AGPL-3.0.
+- Alphabetize Subscription, Open harnesses and Closed harnesses connection
+  lists by their displayed names, keeping the Browse ACP shortcut last.
+
 ## [2.4.39] - 2026-10-01
 
 ### Fixed

{superqode-2.4.39 → superqode-2.4.41}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: superqode
-Version: 2.4.39
+Version: 2.4.41
 Summary: The harness layer for coding agents
 Author-email: Shashi Jagtap <info@super-agentic.ai>
 Maintainer-email: Shashi Jagtap <info@super-agentic.ai>

{superqode-2.4.39 → superqode-2.4.41}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "superqode"
-version = "2.4.39"
+version = "2.4.41"
 description = "The harness layer for coding agents"
 readme = "README.md"
 license = "Apache-2.0"

{superqode-2.4.39 → superqode-2.4.41}/src/superqode/__init__.py

@@ -38,7 +38,7 @@ __all__ = [
     "sidebar",
 ]
 
-__version__ = "2.4.39"
+__version__ = "2.4.41"
 
 # Stable, lightweight public extension surface.  Importing this package does
 # not discover or execute third-party extensions; discovery happens only when

{superqode-2.4.39 → superqode-2.4.41}/src/superqode/app/mixins/codex.py

@@ -333,6 +333,7 @@ class CodexMixin:
         app-server can have a stale catalogue while still honoring a newer
         configured model.
         """
+        runtime = None
         try:
             pure = getattr(self, "_pure_mode", None)
             runtime = getattr(pure, "_runtime", None) if pure is not None else None
@@ -354,10 +355,24 @@ class CodexMixin:
                     model_id = str(getattr(chosen, "model", getattr(chosen, "id", "")) or "")
             if not model_id:
                 return
+            # A switch while this worker was starting must not change the new route.
+            if getattr(getattr(self, "_pure_mode", None), "_runtime", None) is not runtime:
+                return
             self._set_status_model(model_id)
+            status = getattr(runtime, "subscription_status", {})
+            if status.get("billing_verified") == "chatgpt-account":
+                self._sync_self_contained_status("codex-sdk")
+                self._set_status_model(model_id)
+                log.add_info(
+                    f"Codex ChatGPT login verified · plan: {status.get('plan', 'unavailable')} · quota unavailable"
+                )
+            save_model = getattr(self, "_save_runtime_model_choice", None)
+            if save_model:
+                save_model("codex-sdk", model_id)
             log.add_info(f"Active Codex model: {model_id}  ·  switch with :codex model")
-        except Exception:  # noqa: BLE001 — best-effort, never fatal
-            pass
+        except Exception as exc:  # noqa: BLE001 — background connection feedback
+            if getattr(runtime, "billing_requested", "") == "subscription":
+                log.add_error(f"Codex subscription verification failed: {exc}")
 
     def _codex_cmd(self, args: str, log) -> None:
         """Handle :codex and Codex SDK runtime subcommands."""
@@ -366,6 +381,8 @@ class CodexMixin:
         sub = parts[0].lower() if parts else "connect"
         rest = parts[1].strip() if len(parts) > 1 else ""
         if sub in {"", "connect", "start"}:
+            self._requested_runtime_target = "codex-sdk"
+            self._requested_runtime_billing = "subscription"
             self._runtime_cmd("codex-sdk", log)
             return
         status_expr = f"{sub} {rest}".strip()
@@ -434,6 +451,8 @@ class CodexMixin:
             and getattr(getattr(pure, "session", None), "connected", False)
         ):
             return runtime
+        self._requested_runtime_target = "codex-sdk"
+        self._requested_runtime_billing = "subscription"
         self._runtime_cmd("codex-sdk", log)
         pure = getattr(self, "_pure_mode", None)
         runtime = getattr(pure, "_runtime", None) if pure is not None else None
@@ -817,6 +836,9 @@ class CodexMixin:
                 self._pure_mode.session.model = model
             label = model or "Codex default"
             self._set_status_model(model)  # reflect in the status-bar badge
+            save_model = getattr(self, "_save_runtime_model_choice", None)
+            if save_model:
+                save_model("codex-sdk", model)
             log.add_success(f"Codex model set to {label}")
         except Exception as exc:  # noqa: BLE001
             log.add_error(f"Could not set Codex model: {exc}")

{superqode-2.4.39 → superqode-2.4.41}/src/superqode/app/mixins/commands_impl.py

@@ -2048,47 +2048,20 @@ class CommandImplMixin:
             log.add_error(f"Runtime '{sub}' is not ready: {info.status_detail or 'check setup'}")
             return
 
-        # A friendly setup path for the Codex subscription: someone without
-        # the product installed should get install steps, not a stack trace
-        # from a missing ~/.codex login.
-        if sub == "codex-sdk":
-            codex_auth = Path.home() / ".codex" / "auth.json"
-            has_env_key = bool(
-                _os.environ.get("OPENAI_API_KEY") or _os.environ.get("CODEX_API_KEY")
-            )
-            if not codex_auth.exists() and not has_env_key:
-                if shutil.which("codex") is None:
-                    if getattr(self, "_prompts", None) is not None:
-                        self._show_external_cli_setup(
-                            name="Codex",
-                            binary="codex",
-                            command="npm i -g @openai/codex",
-                            log=log,
-                            resume=lambda: self._runtime_cmd("codex-sdk", log),
-                        )
-                        return
-                    log.add_error(
-                        "The Codex CLI is not installed, so the Codex "
-                        "subscription route is unavailable."
-                    )
-                    log.add_info("Install it:  npm i -g @openai/codex")
-                    log.add_info("Sign in with `codex login`, then re-run :connect codex.")
-                    log.add_info("No subscription? Use BYOK instead: :connect byok openai <model>")
-                    return
-                # Codex is installed but signed out: launch `codex login`
-                # (device auth) and auto-resume the connect once it lands.
-                started = self._begin_subscription_login(
-                    "codex",
-                    log,
-                    on_success=lambda: self._runtime_cmd("codex-sdk", log),
-                    reason="Codex is installed but not signed in (~/.codex/auth.json missing).",
-                )
-                if started:
-                    return
-                log.add_error("Codex is installed but not signed in (~/.codex/auth.json missing).")
-                log.add_info("Sign in with `codex login`, then re-run :connect codex.")
-                log.add_info("No subscription? Use BYOK instead: :connect byok openai <model>")
-                return
+        requested_target = getattr(self, "_requested_runtime_target", sub)
+        requested_billing = (
+            getattr(self, "_requested_runtime_billing", "agent-managed")
+            if requested_target == sub
+            else "agent-managed"
+        )
+        self._requested_runtime_target = ""
+        self._requested_runtime_billing = "agent-managed"
+        requested_model = (
+            getattr(self, "_requested_runtime_model", "") if requested_target == sub else ""
+        )
+        self._requested_runtime_model = ""
+        # Credential files cannot distinguish API keys, keyring login or custom
+        # CODEX_HOME. The app-server performs the actual account check.
 
         if sub == "muse":
             from superqode.providers.connection_profiles import _muse_signed_in
@@ -2107,7 +2080,11 @@ class CommandImplMixin:
                 and Path(getattr(existing.session, "working_directory", Path.cwd())).resolve()
                 == Path.cwd().resolve()
                 and getattr(existing, "_runtime", None) is not None
+                and getattr(existing, "billing_requested", "agent-managed") == requested_billing
             ):
+                if requested_model:
+                    existing._runtime.set_model(requested_model)
+                    existing.session.model = requested_model
                 self._install_pure_permission_bridge(existing, log)
                 _os.environ["SUPERQODE_RUNTIME"] = sub
                 self._sync_self_contained_status(sub)
@@ -2148,6 +2125,7 @@ class CommandImplMixin:
                 pure = self._ensure_pure_mode()
                 self._install_pure_permission_bridge(pure, log)
                 pure.runtime_name = sub
+                pure.billing_requested = requested_billing
                 provider = {
                     "copilot-sdk": "github-copilot",
                     "claude-agent-sdk": "anthropic",
@@ -2157,7 +2135,7 @@ class CommandImplMixin:
                     "devin-cli": "devin",
                     "muse": "meta",
                 }.get(sub, "openai")
-                pure.connect(provider=provider, model="", working_directory=Path.cwd())
+                pure.connect(provider=provider, model=requested_model, working_directory=Path.cwd())
                 self._announce_self_contained_connection(sub, log)
             except Exception as exc:  # noqa: BLE001
                 log.add_error(f"Switched to {sub} but auto-connect failed: {exc}")
@@ -2909,6 +2887,9 @@ class CommandImplMixin:
             if getattr(self, "_pure_mode", None) is not None:
                 self._pure_mode.session.model = model
             self._set_status_model(model)
+            save_model = getattr(self, "_save_runtime_model_choice", None)
+            if save_model:
+                save_model("copilot-sdk", model)
             log.add_success(f"GitHub Copilot model set to {model}")
         except Exception as exc:  # noqa: BLE001
             log.add_error(f"Could not set GitHub Copilot model: {exc}")

{superqode-2.4.39 → superqode-2.4.41}/src/superqode/app/mixins/connect.py

@@ -71,6 +71,11 @@ _CONNECTION_KEYS = (
     "model",
     "transport",
     "after_auth",
+    "runtime_name",
+    "auth_method",
+    "billing_requested",
+    "billing_verified",
+    "fallback_policy",
 )
 
 
@@ -140,12 +145,24 @@ class ConnectMixin:
             CONNECT_MENU_SUBSCRIPTIONS,
         )
 
+        pure = getattr(self, "_pure_mode", None)
+        if (
+            pure is not None
+            and getattr(pure, "runtime_name", "") in {"codex-sdk", "copilot-sdk"}
+            and getattr(getattr(pure, "session", None), "connected", False)
+        ):
+            runtime = getattr(pure, "_runtime", None)
+            verified = getattr(runtime, "subscription_status", {}).get("billing_verified")
+            if getattr(pure, "billing_requested", "agent-managed") == "subscription":
+                return "subscription" if verified == "chatgpt-account" else "subscription requested"
+            return "agent-managed"
         profile = get_connection_profile(str(getattr(self, "_connecting_profile_id", "") or ""))
         if profile is not None:
-            return profile.auth_mode or (
+            auth = profile.auth_mode or (
                 "subscription" if profile.menu == CONNECT_MENU_SUBSCRIPTIONS else ""
             )
-        return "subscription" if getattr(self, "_acp_subscription_vendor", None) else ""
+            return "subscription requested" if auth == "subscription" else auth
+        return "subscription requested" if getattr(self, "_acp_subscription_vendor", None) else ""
 
     def _begin_connection_view(self, log: ConversationLog) -> None:
         """Isolate inline setup from the conversation and its prompt draft."""
@@ -530,8 +547,8 @@ class ConnectMixin:
                 offered.append(
                     ConnectionProfile(
                         id=f"account-{entry.id}",
-                        label="Use this agent's subscription / account",
-                        description="Use the model and account configured in this agent; keeps its coding loop",
+                        label="Use this agent's configured account",
+                        description="Use its configured model and account; billing is unverified",
                         connector="harness-account",
                         runtime=entry.id,
                         menu=menu,
@@ -1875,6 +1892,14 @@ class ConnectMixin:
         still know which harness they belong to. Any other connector ends that
         flow so a later Core switch does not inherit KEY_MODELS / persist.
         """
+        if profile.connector == "plan-guidance":
+            # Information cards do not start a connection attempt or discard
+            # the active harness's model-selection state.
+            self._reset_connect_selection_states()
+            self._open_connect_screen(log)
+            log.add_info(profile.unavailable_hint)
+            log.add_info("Your current harness and model have been kept.")
+            return
         self._connection_retry_target = ("profile", (profile.id,))
         self._connection_attempt_state = "Setup"
         self._reset_connect_selection_states()
@@ -1978,6 +2003,9 @@ class ConnectMixin:
             self._connect_prime_rpc("", log)
         elif conn == "runtime":
             # Self-contained runtime (e.g. Codex) — auto-connects in _runtime_cmd.
+            self._requested_runtime_target = profile.runtime or ""
+            self._requested_runtime_billing = getattr(profile, "auth_mode", "") or "agent-managed"
+            ConnectMixin._apply_subscription_billing_policy(self, profile, log)
             self._runtime_cmd(profile.runtime or "", log)
         elif conn == "acp":
             # A specific ACP agent by short_name (Claude, Grok Build, …).
@@ -2058,11 +2086,6 @@ class ConnectMixin:
             from superqode.providers.connection_profiles import CONNECT_MENU_PLAN
 
             self._show_connect_type_picker(log, menu=CONNECT_MENU_PLAN)
-        elif conn == "plan-guidance":
-            log.add_info(profile.unavailable_hint)
-            log.add_info(
-                "Your current harness and model have been kept. Choose the agent route explicitly to switch."
-            )
         elif conn == "plan-agent":
             from superqode.providers.connection_profiles import get_connection_profile
 
@@ -2107,6 +2130,10 @@ class ConnectMixin:
                 spec.notes
                 or "Using the agent's configured account and model; sign-in is checked by the agent."
             )
+            if self._acp_subscription_vendor is None:
+                log.add_info(
+                    "Billing: agent-managed, unverified. Check the provider and billing route in the agent."
+                )
             self._connect_acp_cmd(entry.acp_agent, log)
             self._set_acp_extra_env(dict(spec.account_env), entry.acp_agent)
         elif conn == "vendor-picker":
@@ -2574,7 +2601,12 @@ class ConnectMixin:
             subscription_notice,
         )
 
-        if getattr(profile, "menu", "") != CONNECT_MENU_SUBSCRIPTIONS:
+        if (
+            getattr(profile, "auth_mode", "")
+            or (
+                "subscription" if getattr(profile, "menu", "") == CONNECT_MENU_SUBSCRIPTIONS else ""
+            )
+        ) != "subscription":
             self._acp_subscription_vendor = None
             return
 
@@ -2604,6 +2636,7 @@ class ConnectMixin:
         )
 
         self._apply_subscription_billing_policy(profile, log)
+        self._requested_runtime_billing = "subscription"
 
         if _copilot_sdk_ready():
             # Choosing silently taught the user nothing. Connecting on the best
@@ -2619,15 +2652,17 @@ class ConnectMixin:
                     alternative="Copilot CLI",
                     alternative_command=":connect copilot-cli",
                 )
+            self._requested_runtime_target = profile.runtime or "copilot-sdk"
             self._runtime_cmd(profile.runtime or "copilot-sdk", log)
             return
         if _copilot_acp_ready():
             if log is not None:
                 log.add_info(
-                    "Using the installed GitHub Copilot CLI on your subscription. "
+                    "Using the installed GitHub Copilot CLI with your account. "
                     "Install the SDK extra for per-tool approval prompts and "
                     "resumable sessions."
                 )
+            self._requested_runtime_target = "copilot-cli"
             self._runtime_cmd("copilot-cli", log)
             # Whether the vendor CLI is signed in cannot be read from a file:
             # the token lives in the OS credential store. Probe it in the
@@ -2879,7 +2914,12 @@ class ConnectMixin:
         self._workspace_intro_visible = True
         t = Text()
         t.append("\n  ✓ ", style=f"bold {THEME['success']}")
-        t.append("Connected: ", style=f"bold {THEME['text']}")
+        pending = (
+            runtime_name == "codex-sdk"
+            and getattr(getattr(self, "_pure_mode", None), "billing_requested", "")
+            == "subscription"
+        )
+        t.append("Selected: " if pending else "Connected: ", style=f"bold {THEME['text']}")
         t.append(f"{label}\n\n", style=f"bold {THEME['success']}")
         t.append("    Runtime   ", style=THEME["muted"])
         t.append(f"{runtime_name}\n", style=THEME["text"])
@@ -2899,7 +2939,7 @@ class ConnectMixin:
         announce = getattr(self, "_announce_transition", None)
         if announce is not None:
             announce(
-                title="Connected",
+                title="Verifying login" if pending else "Connected",
                 primary=label,
                 detail=f"{runtime_name} · {details['model']}",
                 severity="success",
@@ -2917,6 +2957,28 @@ class ConnectMixin:
             model=details.get("model", ""),
         )
         self._mark_onboarding_complete()
+        pure = getattr(self, "_pure_mode", None)
+        billing = str(getattr(pure, "billing_requested", "agent-managed"))
+        self._save_connection_config(
+            category="subscriptions" if billing == "subscription" else "runtime",
+            auth_mode=billing,
+            runtime_name=runtime_name,
+            profile_id="codex" if runtime_name == "codex-sdk" and billing == "subscription" else "",
+            acp_agent="",
+            harness_id="",
+            provider="",
+            model=str(getattr(getattr(pure, "session", None), "model", "") or ""),
+            transport="SDK" if runtime_name.endswith("-sdk") else "CLI",
+            openness="",
+            after_auth="",
+            billing_requested=billing,
+        )
+        if runtime_name == "codex-sdk" and billing == "subscription":
+            log.add_info("ChatGPT login: verification pending; remaining quota is unverified.")
+        elif runtime_name == "copilot-sdk":
+            log.add_info(
+                "Account billing: unverified. Copilot checks sign-in and available usage on request."
+            )
         if runtime_name == "codex-sdk":
             self.run_worker(self._resolve_codex_active_model(log), exclusive=False)
 
@@ -3880,6 +3942,16 @@ class ConnectMixin:
         provider = str(connection.get("provider") or "")
         model = str(connection.get("model") or "")
 
+        runtime_name = str(connection.get("runtime_name") or "")
+        if runtime_name:
+            self._requested_runtime_target = runtime_name
+            self._requested_runtime_billing = str(
+                connection.get("billing_requested") or "agent-managed"
+            )
+            self._requested_runtime_model = model
+            self._runtime_cmd(runtime_name, log)
+            return
+
         # Restore the agent/account route before considering any stale model
         # fields from a previous native connection. This also restores account
         # launch defaults (for example fast-agent's codexplan).
@@ -3888,11 +3960,15 @@ class ConnectMixin:
 
             profile = get_connection_profile(profile_id)
             if profile and profile.connector in {"acp", "harness-account"}:
+                self._pending_acp_model_hint = model
                 self._dispatch_connection_profile(profile, log)
                 return
 
-        if category == "acp" or (auth_mode == "acp" and not after_auth):
+        if category == "acp" or (
+            auth_mode in {"acp", "agent-managed"} and acp_agent and not after_auth
+        ):
             if acp_agent:
+                self._pending_acp_model_hint = model
                 self._connect_acp_cmd(acp_agent, log)
                 return
         elif (
@@ -3936,6 +4012,11 @@ class ConnectMixin:
                     self._dispatch_connection_profile(profile, log)
                 return
 
+        if connection:
+            log.add_error(
+                "The saved connection cannot be restored. Choose a route with :connect; billing will not fall back to BYOK."
+            )
+            return
         config = self._load_byok_config()
         if config.get("last_provider") and config.get("last_model"):
             self._connect_byok_mode(config["last_provider"], config["last_model"], log)
@@ -4691,7 +4772,18 @@ class ConnectMixin:
         raw = self._read_user_config().get("connection", {})
         if not isinstance(raw, dict):
             return {}
-        return {key: raw[key] for key in _CONNECTION_KEYS if key in raw}
+        saved = {key: raw[key] for key in _CONNECTION_KEYS if key in raw}
+        if not saved:
+            return {}
+        if saved.get("auth_mode") == "acp":
+            saved["auth_mode"] = "agent-managed"
+            saved.setdefault("transport", "ACP")
+        saved.setdefault("auth_method", "agent-managed" if saved.get("acp_agent") else "unknown")
+        saved.setdefault("billing_requested", saved.get("auth_mode") or "agent-managed")
+        # A saved login or old menu category is not proof of current entitlement.
+        saved["billing_verified"] = "unknown"
+        saved.setdefault("fallback_policy", "stop")
+        return saved
 
     def _save_connection_config(self, **fields: str) -> None:
         """Persist connection.* via the same RMW helper as byok.*. No secrets."""
@@ -4700,6 +4792,20 @@ class ConnectMixin:
             current = data.get("connection")
             if not isinstance(current, dict):
                 current = {}
+            # Reset evidence when saving a route; never carry another connection's status.
+            current.update(
+                runtime_name="",
+                auth_method="api-key"
+                if fields.get("auth_mode") == "byok"
+                else "none"
+                if fields.get("auth_mode") == "local"
+                else "agent-managed"
+                if fields.get("acp_agent")
+                else "unknown",
+                billing_requested=fields.get("auth_mode", "agent-managed"),
+                billing_verified="unknown",
+                fallback_policy="stop",
+            )
             for key in _CONNECTION_KEYS:
                 if key in fields:
                     current[key] = str(fields[key] or "")
@@ -4722,6 +4828,12 @@ class ConnectMixin:
         except OSError:
             pass  # A read-only project must not prevent connecting.
 
+    def _save_runtime_model_choice(self, runtime_name: str, model: str) -> None:
+        """Update the chosen model only for the matching saved runtime route."""
+        saved = self._load_connection_config()
+        if saved.get("runtime_name") == runtime_name:
+            self._save_connection_config(**{**saved, "model": model})
+
     def _persist_acp_connection(self, acp_agent: str) -> None:
         """Write connection.* for an ACP attach. Subscriptions keep their category."""
         from superqode.providers.connection_profiles import get_connection_profile
@@ -4732,7 +4844,7 @@ class ConnectMixin:
         if vendor:
             category, auth_mode, profile_id = "subscriptions", "subscription", connecting_id
         else:
-            category, auth_mode = "acp", "acp"
+            category, auth_mode = "acp", "agent-managed"
             known = get_connection_profile(connecting_id) if connecting_id else None
             profile_id = known.id if known is not None else ""
         self._save_connection_config(
@@ -4906,6 +5018,8 @@ class ConnectMixin:
         parts = args.split(maxsplit=1)
         agent_name = parts[0]
         model_hint = parts[1] if len(parts) > 1 else None
+        model_hint = model_hint or getattr(self, "_pending_acp_model_hint", None) or None
+        self._pending_acp_model_hint = ""
         self._connect_agent(agent_name, model_hint)
 
     @work(exclusive=True)

{superqode-2.4.39 → superqode-2.4.41}/src/superqode/app/widgets.py

@@ -258,6 +258,8 @@ class ColorfulStatusBar(Static):
             auth_mode = (self.connection_auth or default).strip().lower()
             label = {
                 "subscription": "SUBSCRIPTION" if medium else "SUB",
+                "subscription requested": "PLAN CHECK" if medium else "PLAN?",
+                "agent-managed": "AGENT ACCOUNT" if medium else "ACCOUNT",
                 "local": "LOCAL",
                 "byok": "BYOK",
             }.get(auth_mode, auth_mode.upper())

{superqode-2.4.39 → superqode-2.4.41}/src/superqode/harness/hub.py

@@ -254,7 +254,9 @@ _OPENNESS_BY_ID: dict[str, HubOpenness] = {
     ),
     "ecosystem:jcode": HubOpenness("open", "MIT", "https://github.com/1jehuang/jcode"),
     "ecosystem:letta": HubOpenness("open", "Apache-2.0", "https://github.com/letta-ai/letta-code"),
-    "ecosystem:warp": HubOpenness("open", "AGPL-3.0", "https://github.com/warpdotdev/warp"),
+    "ecosystem:warp": HubOpenness(
+        "closed", "Proprietary (harness); AGPL-3.0 (client)", "https://github.com/warpdotdev/warp"
+    ),
     "ecosystem:qm": HubOpenness("open", "MIT", "https://github.com/yc-software/qm"),
     "ecosystem:headlong": HubOpenness(
         "open", "Apache-2.0", "https://github.com/laude-institute/headlong"
@@ -1178,7 +1180,7 @@ _ECOSYSTEM_DETAILS: dict[str, dict[str, Any]] = {
             "Model routing",
             "Cloud handoff (Oz)",
         ),
-        "based_on": "Warp Agent (AGPL-3.0)",
+        "based_on": "Warp Agent (proprietary harness; AGPL-3.0 client)",
         "popularity_rank": 70,
         "setup_steps": (
             HubSetupStep(
@@ -1744,7 +1746,7 @@ def _supplemental_records() -> list[HubRecord]:
         (
             "ecosystem:warp",
             "Warp Agent",
-            "Warp's AGPL-3.0 Agent CLI, the same harness as Warp Terminal, runnable in any terminal with a Warp account or WARP_API_KEY.",
+            "Warp's proprietary server-side agent harness with an AGPL-3.0 client, runnable in any terminal with a Warp account or WARP_API_KEY.",
             "https://www.warp.dev/agent-cli",
             ("warp", "warp agent cli", "warp terminal agent"),
         ),

{superqode-2.4.39 → superqode-2.4.41}/src/superqode/headless.py

@@ -165,6 +165,7 @@ async def run_headless(
     runtime: Optional[str] = None,
     output_schema: Optional[Path] = None,
     rubric: Optional[str] = None,
+    billing_requested: str = "agent-managed",
 ) -> AgentResponse:
     """Run a single non-interactive SuperQode request.
 
@@ -329,6 +330,8 @@ async def run_headless(
 
     runtime_name = resolve_runtime_name(cli=runtime)
     runtime_kwargs: dict[str, Any] = {}
+    if runtime_name == "codex-sdk":
+        runtime_kwargs["billing_requested"] = billing_requested
     if runtime_name == "builtin":
         runtime_kwargs["hooks"] = extension_runtime.build_hooks()
     runtime_obj = create_runtime(

{superqode-2.4.39 → superqode-2.4.41}/src/superqode/main.py

@@ -751,6 +751,7 @@ def cli_main(
         yaml_runtime = None
         yaml_harness = None
     effective_runtime = runtime_name or yaml_runtime
+    requested_billing = "agent-managed"
     # A connection profile (e.g. --connect codex) can imply a runtime backend.
     if connect_name:
         try:
@@ -761,13 +762,20 @@ def cli_main(
             _profile = None
         if _profile is not None:
             if headless_intent and (
-                _profile.menu == "plan"
-                or _profile.connector in {"plan-agent", "plan-guidance", "harness-account"}
+                _profile.id.startswith("plan-")
+                or _profile.connector
+                in {"plan-picker", "plan-agent", "plan-guidance", "harness-account"}
             ):
                 raise click.UsageError(
                     f"--connect {_profile.id} is an interactive account/setup route. "
                     "Use the TUI, or choose an explicit --runtime/--provider for headless use."
                 )
+            if headless_intent and _profile.auth_mode == "subscription":
+                requested_billing = "subscription"
+                if runtime_name and runtime_name != _profile.runtime:
+                    raise click.UsageError(
+                        "A subscription connection cannot override its runtime. Choose an explicit runtime without --connect instead."
+                    )
             # Runtime-connector profiles (Codex) map to a runtime backend; an
             # explicit --runtime still wins.
             if _profile.connector == "runtime" and _profile.runtime and not runtime_name:
@@ -869,6 +877,11 @@ def cli_main(
                         fork_from=fork_from,
                         sandbox_backend=sandbox_backend,
                         runtime=effective_runtime,
+                        **(
+                            {"billing_requested": requested_billing}
+                            if requested_billing == "subscription"
+                            else {}
+                        ),
                         output_schema=output_schema,
                         rubric=rubric_text,
                     )