witbitz-code 1.2.1__tar.gz → 1.3.1__tar.gz

{witbitz_code-1.2.1/src/witbitz_code.egg-info → witbitz_code-1.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.2.1
+Version: 1.3.1
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT
@@ -48,28 +48,36 @@ verifier — attestation, Sigstore and TLS pinning — for the confidential mode
 witbitz-code setup
 ```
 
-`setup` walks five steps and skips whatever is already done: it installs OpenCode if it is missing (it asks first), pairs
-this computer (scan the QR code in Spaces → Settings → Back up & recovery → Add a device), asks for your **TrustedRouter**
-key and an optional **Tinfoil** key (each checked with the provider before it is saved; it shows as `*****` while you
-paste), then starts `serve` in the window. Then open Code in Spaces. Leave it running (Ctrl-C stops it); next time,
-`witbitz-code serve` is enough.
+`setup` walks four steps and skips whatever is already done: it installs OpenCode if it is missing (it asks first), pairs
+this computer (scan the QR code in Spaces → Settings → Back up & recovery → Add a device), which gives the computer **its
+own keys from your Spaces account**, then starts `serve` in the window. Then open Code in Spaces. Leave it running (Ctrl-C
+stops it); next time, `witbitz-code serve` is enough.
 
-Your keys are yours: you pay TrustedRouter and Tinfoil directly, and your Witbitz account never carries them — so a new
-computer asks for them once. The TrustedRouter key goes into OpenCode's own credentials (`$XDG_DATA_HOME/opencode/auth.json`,
-the file `opencode auth login` writes), the Tinfoil key into `~/.opencode-server.env`. Without a TrustedRouter key,
-OpenCode offers only its own free models.
+**No key to paste.** Pairing asks your Spaces account for this computer's own TrustedRouter and Tinfoil keys, capped by the
+providers (today up to $50 of models and $5 of tools a month per computer). They are sent sealed to this computer, kept in
+`~/.witbitz/code/account-keys.json` (0600) and never given to OpenCode: the local proxy puts them on each call. Model calls
+still go from this computer straight to TrustedRouter and Tinfoil. Coding is by invitation for now — an account that is not
+invited gets no keys, and the pairing stops with a sentence saying so. A computer paired before 1.3 has no account keys:
+pair it once more (`witbitz-code pair`).
+
+**Several accounts on one computer:** each pays for its own prompts. OpenCode names the conversation on every call it
+makes; the connector knows which account sent each prompt, and the proxy bills the call to that account. A prompt typed in
+OpenCode's own window on this computer is refused ("coding runs from the Spaces app"), and while one account's reply is
+being written another account cannot add to it. This splits the bill fairly between people who share a computer; it is not
+a wall between them (they already share its files and shell).
+
+To start over: `witbitz-code uninstall`, then `pipx install witbitz-code` and `witbitz-code setup`.
 
 The same thing one step at a time: install OpenCode (`curl -fsSL https://opencode.ai/install | bash`), then
-`witbitz-code pair`, `witbitz-code trustedrouter-key`, `witbitz-code tinfoil-key` (optional) and `witbitz-code serve`.
+`witbitz-code pair` and `witbitz-code serve`.
 
 | command | what it does |
 |---|---|
 | `setup [--port <n>]` | The walk-through above. With `--port`, a pairing made for another port moves to it (no new scan). |
-| `trustedrouter-key` | Ask for a TrustedRouter key, check it, and store it in OpenCode's credentials. Restart `serve` to use it. |
-| `tinfoil-key` | Ask for a Tinfoil key, check it, and store it. Used from the next message. |
+| `uninstall [--yes] [--remove-keys] [--remove-notes] [--remove-sessions] [--remove-opencode]` | Remove witbitz-code from this computer: its coding keys go back to each account, each account lets go of it, `~/.witbitz/code` and what `serve` added to OpenCode are deleted, and the pipx install removes itself. Asks first (Enter keeps) before your saved keys, project notes, OpenCode's sessions and OpenCode itself; never deletes sessions an OpenCode still has open. `--yes` skips the questions and keeps all four unless their flag is given. |
 | `pair [--name <name>] [--port <n> \| --opencode-url <url>]` | Show the QR code. The account that scans it gets this computer. `--name` sets the label your devices show (default: the hostname). |
-| `serve [--port <n>] [--no-opencode]` | Start OpenCode on `127.0.0.1:<n>` (default 4096) if nothing is listening there, then connect the pairings whose OpenCode is on that port. One OpenCode per port, one `serve` per OpenCode. |
-| `status` | List this computer's pairings: name, account, OpenCode address and relay. Secrets are never printed. |
+| `serve [--port <n>] [--no-opencode]` | Start OpenCode on `127.0.0.1:<n>` (default 4096) with your account's keys, then connect the pairings whose OpenCode is on that port. An OpenCode already running there, started some other way, is not used (it cannot have the keys) — close it first. One OpenCode per port, one `serve` per OpenCode. |
+| `status` | List this computer's pairings — name, account, OpenCode address, relay — and each one's coding keys: live, this month's model spend and the caps. Secrets are never printed. |
 | `rotate [--account <email>]` | Replace the pairing secret(s) without scanning again, then restart `serve`. Devices pick up the new secret on their next sync. |
 | `unpair [--account <email>]` | Remove this computer from an account. Every device drops it on its next sync. |
 | `version`, `--help` | |
@@ -117,8 +125,8 @@ all the accounts are yours. If a second account belongs to **another person**, r
   receipt** to verify for these exact request and response bytes (an attested key, a TEE-verified upstream under a known
   policy). A receipt that does not verify ends the step with an error, so no tool from that answer runs;
 - an image or a document a text-only confidential model cannot read is read **as text inside Tinfoil's attested
-  enclave** with your Tinfoil key — or refused, never sent anywhere less;
-- every other model passes through untouched.
+  enclave** with the account's Tinfoil key — or refused, never sent anywhere less;
+- every other model Witbitz offers passes through with the account's key; a model Witbitz does not offer is refused.
 
 **Auto mode** (Manual · Accept edits · Plan · **Auto** in the Code composer's mode chip, per session) lets this computer answer OpenCode's permission
 prompts while you are away:

{witbitz_code-1.2.1 → witbitz_code-1.3.1}/README.md

@@ -23,28 +23,36 @@ verifier — attestation, Sigstore and TLS pinning — for the confidential mode
 witbitz-code setup
 ```
 
-`setup` walks five steps and skips whatever is already done: it installs OpenCode if it is missing (it asks first), pairs
-this computer (scan the QR code in Spaces → Settings → Back up & recovery → Add a device), asks for your **TrustedRouter**
-key and an optional **Tinfoil** key (each checked with the provider before it is saved; it shows as `*****` while you
-paste), then starts `serve` in the window. Then open Code in Spaces. Leave it running (Ctrl-C stops it); next time,
-`witbitz-code serve` is enough.
-
-Your keys are yours: you pay TrustedRouter and Tinfoil directly, and your Witbitz account never carries them — so a new
-computer asks for them once. The TrustedRouter key goes into OpenCode's own credentials (`$XDG_DATA_HOME/opencode/auth.json`,
-the file `opencode auth login` writes), the Tinfoil key into `~/.opencode-server.env`. Without a TrustedRouter key,
-OpenCode offers only its own free models.
+`setup` walks four steps and skips whatever is already done: it installs OpenCode if it is missing (it asks first), pairs
+this computer (scan the QR code in Spaces → Settings → Back up & recovery → Add a device), which gives the computer **its
+own keys from your Spaces account**, then starts `serve` in the window. Then open Code in Spaces. Leave it running (Ctrl-C
+stops it); next time, `witbitz-code serve` is enough.
+
+**No key to paste.** Pairing asks your Spaces account for this computer's own TrustedRouter and Tinfoil keys, capped by the
+providers (today up to $50 of models and $5 of tools a month per computer). They are sent sealed to this computer, kept in
+`~/.witbitz/code/account-keys.json` (0600) and never given to OpenCode: the local proxy puts them on each call. Model calls
+still go from this computer straight to TrustedRouter and Tinfoil. Coding is by invitation for now — an account that is not
+invited gets no keys, and the pairing stops with a sentence saying so. A computer paired before 1.3 has no account keys:
+pair it once more (`witbitz-code pair`).
+
+**Several accounts on one computer:** each pays for its own prompts. OpenCode names the conversation on every call it
+makes; the connector knows which account sent each prompt, and the proxy bills the call to that account. A prompt typed in
+OpenCode's own window on this computer is refused ("coding runs from the Spaces app"), and while one account's reply is
+being written another account cannot add to it. This splits the bill fairly between people who share a computer; it is not
+a wall between them (they already share its files and shell).
+
+To start over: `witbitz-code uninstall`, then `pipx install witbitz-code` and `witbitz-code setup`.
 
 The same thing one step at a time: install OpenCode (`curl -fsSL https://opencode.ai/install | bash`), then
-`witbitz-code pair`, `witbitz-code trustedrouter-key`, `witbitz-code tinfoil-key` (optional) and `witbitz-code serve`.
+`witbitz-code pair` and `witbitz-code serve`.
 
 | command | what it does |
 |---|---|
 | `setup [--port <n>]` | The walk-through above. With `--port`, a pairing made for another port moves to it (no new scan). |
-| `trustedrouter-key` | Ask for a TrustedRouter key, check it, and store it in OpenCode's credentials. Restart `serve` to use it. |
-| `tinfoil-key` | Ask for a Tinfoil key, check it, and store it. Used from the next message. |
+| `uninstall [--yes] [--remove-keys] [--remove-notes] [--remove-sessions] [--remove-opencode]` | Remove witbitz-code from this computer: its coding keys go back to each account, each account lets go of it, `~/.witbitz/code` and what `serve` added to OpenCode are deleted, and the pipx install removes itself. Asks first (Enter keeps) before your saved keys, project notes, OpenCode's sessions and OpenCode itself; never deletes sessions an OpenCode still has open. `--yes` skips the questions and keeps all four unless their flag is given. |
 | `pair [--name <name>] [--port <n> \| --opencode-url <url>]` | Show the QR code. The account that scans it gets this computer. `--name` sets the label your devices show (default: the hostname). |
-| `serve [--port <n>] [--no-opencode]` | Start OpenCode on `127.0.0.1:<n>` (default 4096) if nothing is listening there, then connect the pairings whose OpenCode is on that port. One OpenCode per port, one `serve` per OpenCode. |
-| `status` | List this computer's pairings: name, account, OpenCode address and relay. Secrets are never printed. |
+| `serve [--port <n>] [--no-opencode]` | Start OpenCode on `127.0.0.1:<n>` (default 4096) with your account's keys, then connect the pairings whose OpenCode is on that port. An OpenCode already running there, started some other way, is not used (it cannot have the keys) — close it first. One OpenCode per port, one `serve` per OpenCode. |
+| `status` | List this computer's pairings — name, account, OpenCode address, relay — and each one's coding keys: live, this month's model spend and the caps. Secrets are never printed. |
 | `rotate [--account <email>]` | Replace the pairing secret(s) without scanning again, then restart `serve`. Devices pick up the new secret on their next sync. |
 | `unpair [--account <email>]` | Remove this computer from an account. Every device drops it on its next sync. |
 | `version`, `--help` | |
@@ -92,8 +100,8 @@ all the accounts are yours. If a second account belongs to **another person**, r
   receipt** to verify for these exact request and response bytes (an attested key, a TEE-verified upstream under a known
   policy). A receipt that does not verify ends the step with an error, so no tool from that answer runs;
 - an image or a document a text-only confidential model cannot read is read **as text inside Tinfoil's attested
-  enclave** with your Tinfoil key — or refused, never sent anywhere less;
-- every other model passes through untouched.
+  enclave** with the account's Tinfoil key — or refused, never sent anywhere less;
+- every other model Witbitz offers passes through with the account's key; a model Witbitz does not offer is refused.
 
 **Auto mode** (Manual · Accept edits · Plan · **Auto** in the Code composer's mode chip, per session) lets this computer answer OpenCode's permission
 prompts while you are away:

{witbitz_code-1.2.1 → witbitz_code-1.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "witbitz-code"
-version = "1.2.1"
+version = "1.3.1"
 description = "Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -43,7 +43,7 @@ where = ["src"]
 
 # Our OpenCode plugins, installed by `serve` (plugins.py) — copies of tools/opencode-plugins, kept current by embed.mjs
 [tool.setuptools.package-data]
-witbitz_code = ["opencode_plugins/*", "confidential_models.json"]
+witbitz_code = ["opencode_plugins/*", "confidential_models.json", "offered_models.json"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]

{witbitz_code-1.2.1 → witbitz_code-1.3.1}/src/witbitz_code/__init__.py

@@ -4,4 +4,4 @@ The Python implementation of tools/witbitz-code.mjs (docs/opencode-relay.md phas
 vectors and cross-implementation tests.
 """
 
-__version__ = "1.2.1"
+__version__ = "1.3.1"

{witbitz_code-1.2.1 → witbitz_code-1.3.1}/src/witbitz_code/account.py

@@ -73,13 +73,16 @@ async def publish_computer(*, call: ApiCall, idx: dict, computer_id: str, name:
 
 
 async def unpublish_computer(*, call: ApiCall, idx: dict, computer_id: str, now: float | None = None) -> dict:
-    """Tombstone this computer in the account's registry (its secret leaves the account). Nothing there → nothing written."""
+    """Tombstone this computer in the account's registry (its secret leaves the account). Written even when this doc does not
+    list it: an app that seals the list keeps it in 'xcomputers', which this tool cannot read (it holds no account key), and
+    an older app emptied this doc — so "not listed" here says nothing about the list the apps show (tools/opencode-pair.mjs
+    unpublishComputer). Only a tombstone already here is left alone."""
     now = _now_ms() if now is None else now
     rd = await read_doc(call, idx, COMPUTERS_DOC)
     if not rd["ok"]:
         return rd
     cur = norm_registry(rd["state"])["computers"].get(computer_id)
-    if not cur or cur.get("removed"):
+    if cur and cur.get("removed"):
         return {"ok": True, "noop": True}
     nxt = without_computer(rd["state"], computer_id, now)
     wr = await call(_write_body(idx, COMPUTERS_DOC, wrap_index_state({**nxt, "at": now}), "computer unpaired"))

{witbitz_code-1.2.1 → witbitz_code-1.3.1}/src/witbitz_code/auto_runner.py

@@ -110,8 +110,12 @@ class AutoRunner:
                  log_path: Path | None, poll_ms: float = 1000, review_timeout_ms: float = 30_000, home: str | None = None,
                  on_verdict: Callable[[dict], Any] = lambda v: None, log: Callable[[str], Any] = lambda m: None,
                  now: Callable[[], int] = _now_ms, scratch_check: Callable[[list[str]], bool] = scratch_on_disk,
-                 list_asks: Callable[[str], Awaitable[list | None]] | None = None) -> None:
+                 list_asks: Callable[[str], Awaitable[list | None]] | None = None,
+                 on_review: Callable[[str, bool], Any] | None = None) -> None:
         self._root = re.sub(r"/+\Z", "", base or "")
+        # The review session's model calls are billed to the account that turned Auto on (payers.py): told when the
+        # review opens and closes, since nothing from the Spaces app ever posts into it.
+        self._on_review = on_review
         self._auth = auth
         self._client = client
         self._state_path = Path(state_path) if state_path else None
@@ -303,6 +307,8 @@ class AutoRunner:
             return None, label, "could not open a review session"
         rid = _js.js_string(rid)
         timed_out = False
+        if self._on_review:
+            self._on_review(rid, True)
         try:
             body = {"model": model, "system": prompt["system"], "tools": {"*": False}, "parts": [{"type": "text", "text": prompt["text"]}]}
             try:
@@ -321,6 +327,8 @@ class AutoRunner:
             secs = math.floor(self._review_timeout_ms / 1000 + 0.5) or 1  # Math.round(ms / 1000) || 1
             return None, label, f"the reviewer did not answer within {secs} s" if timed_out else "the review failed"
         finally:
+            if self._on_review:
+                self._on_review(rid, False)
             if timed_out:
                 try:
                     await self._call("POST", f"/session/{_uri_component(rid)}/abort", directory)

{witbitz_code-1.2.1 → witbitz_code-1.3.1}/src/witbitz_code/cli.py

@@ -1,14 +1,13 @@
 """witbitz-code — connect the Spaces Code section to OpenCode on this computer (docs/opencode-relay.md). The same commands
 as the single-file Node download (tools/witbitz-code.mjs):
 
-  witbitz-code setup [--port 4096]      the walk-through: OpenCode, pairing, the TrustedRouter and Tinfoil keys, then serve
+  witbitz-code setup [--port 4096]      the walk-through: OpenCode, pairing (which brings this computer's keys), then serve
   witbitz-code pair [--name desk]       scan the QR with the Spaces app → this computer joins that account
   witbitz-code serve [--port 4096]      start OpenCode (if it is not running) and the connector
-  witbitz-code status                   what this computer is paired with
+  witbitz-code status                   what this computer is paired with, and its coding keys
   witbitz-code rotate                   new secrets (no scan) — restart serve afterwards
   witbitz-code unpair [--account a@b]   remove this computer from an account
-  witbitz-code trustedrouter-key        store the TrustedRouter key in OpenCode's credentials (what `opencode auth login` does)
-  witbitz-code tinfoil-key              store the Tinfoil key (confidential reading of images and files)
+  witbitz-code uninstall                remove witbitz-code from this computer (asks before your keys, notes and sessions)
 """
 
 from __future__ import annotations
@@ -18,6 +17,7 @@ import os
 import signal
 import subprocess
 import sys
+from pathlib import Path
 from typing import Any
 
 import httpx
@@ -25,24 +25,26 @@ import httpx
 from . import __version__
 from . import pair as pair_cmd
 from . import pairings as pp
-from . import codetools, confidential, keys, models, plugins, policy, wizard
+from . import codekeys, codetools, confidential, keys, models, plugins, policy, uninstall as uninstall_mod, wizard
 from ._js import to_number, truthy
 from .connector import pairings_for_port, start_connector
+from .payers import SessionPayers
 
 HELP = f"""witbitz-code {__version__} — reach OpenCode on this computer from the Spaces Code section, end-to-end encrypted.
 
-  setup [--port <n>]           start here: installs OpenCode if needed, pairs this computer, asks for your TrustedRouter
-                               and Tinfoil keys (each checked before it is saved), then serves
+  setup [--port <n>]           start here: installs OpenCode if needed, pairs this computer — which gives it its own
+                               keys from your Spaces account — then serves
   pair [--name <name>]         show a QR code; scan it in Spaces (Settings → Back up & recovery → Add a device)
   serve [--port <n>] [--no-opencode]
-                               start OpenCode on 127.0.0.1 (unless it is already running) and the connector
-  status                       list this computer's pairings
+                               start OpenCode on 127.0.0.1 with your account's keys, and the connector
+  status                       list this computer's pairings and their coding keys
   rotate [--account <email>]   replace the pairing secret(s) without a scan, then restart serve
   unpair [--account <email>]   remove this computer from an account
-  trustedrouter-key            store your TrustedRouter API key in OpenCode's credentials (same as opencode auth login)
-  tinfoil-key                  store your Tinfoil API key (images and files a confidential model cannot read)
+  uninstall [--yes] [--remove-keys] [--remove-notes] [--remove-sessions] [--remove-opencode]
+                               remove witbitz-code from this computer; asks before your keys, notes, sessions and OpenCode
 
 Nothing listens on the network: OpenCode stays on 127.0.0.1 and the connector dials out to wss://code-relay.witbitz.chat.
+Model calls go from this computer straight to TrustedRouter and Tinfoil, each billed to the account whose prompt it is.
 """
 
 
@@ -110,13 +112,18 @@ async def _wait_for_stop(stop: _Stop, child: asyncio.subprocess.Process | None)
     return 0
 
 
+# OpenCode needs SOME TrustedRouter key to offer the provider; the proxy replaces it on every call with the key of the
+# account whose prompt it is (docs/code-account-keys.md), so OpenCode never holds a real one.
+OPENCODE_TR_PLACEHOLDER = "witbitz-account-keys"
+
+
 async def _start_opencode(exe: str, port: int, media: dict | None = None, tools: tuple[dict, dict] | None = None,
                           extra: dict | None = None) -> asyncio.subprocess.Process:
     password = pp.read_env_password()
     # Subagents ask like their parent, and a refused call does not end the turn (policy.py) — merged by OpenCode over the
     # user's own config, which is never written.
     tools_env, tools_config = tools or ({}, {})  # codetools.py: the lsp tool, ast-grep on PATH, the hint naming it
-    env = {**os.environ, **tools_env, **({"OPENCODE_SERVER_PASSWORD": password} if password else {}),
+    env = {**os.environ, **tools_env, **({"OPENCODE_SERVER_PASSWORD": password} if password else {}), "TRUSTEDROUTER_API_KEY": OPENCODE_TR_PLACEHOLDER,
            "OPENCODE_CONFIG_CONTENT": policy.config_content(os.environ.get("OPENCODE_CONFIG_CONTENT"), policy.merge_config(policy.merge_config(media or {}, tools_config), extra))}
     # The Tinfoil key is witbitz-code's (the confidential proxy reads it). Handed to OpenCode it would be in every shell the
     # agent runs, and OpenCode would list Tinfoil as a plain provider whose attestation nothing checks (as the Node one).
@@ -169,21 +176,43 @@ async def serve(args: list[str]) -> int:
     tools_env, tools_config, note = await asyncio.to_thread(codetools.code_tools, plugins.opencode_config_dir())
     if note:
         _err(note)
+    # THIS COMPUTER'S CODING KEYS (codekeys.py; docs/code-account-keys.md): the only model keys witbitz-code uses. A pairing
+    # made before them is not served — every call of its account would be refused.
+    unkeyed = [p for p in pairings if not codekeys.for_computer(p.get("computerId") or "")]
+    for p in unkeyed:
+        _err(f'witbitz-code: "{p.get("name")}" → {p.get("account") or "account"} has no coding keys — this computer must be paired again to use your Spaces account: witbitz-code pair')
+    pairings = [p for p in pairings if p not in unkeyed]
+    if not pairings:
+        return 1
+    live_keys = codekeys.LiveKeys([p["computerId"] for p in pairings])
+    payers = SessionPayers()
+    offered = models.offered()
+
+    def credential_for(req: Any) -> dict | None:
+        # Billed to the account whose prompt started the turn (payers.py); a call nobody here started is refused.
+        return live_keys.credential(payers.payer(req.header("x-session-id")[:100], req.header("x-parent-session-id")[:100]))
+
     stop = _Stop()
     child = None
     proxy = None
     live: dict = {"connector": None}
+    keys_http = httpx.AsyncClient(timeout=30)
     try:
-        # THE CONFIDENTIAL-MODEL PROXY (confidential.py): started BEFORE OpenCode, so OpenCode is pointed at it only when it
-        # runs — and only where TrustedRouter is connected, or the confidential models would be on the menu of a computer
-        # that cannot call them.
+        # THE PROXY (confidential.py): started BEFORE OpenCode, which is always pointed at it — it puts each account's key on
+        # the calls of that account's prompts, enforces the confidential models and refuses a model Witbitz does not offer.
         pport = models.proxy_port_for(port)
         try:
-            proxy = await confidential.start_confidential_proxy(port=pport, log=_err, on_progress=lambda ev: live["connector"] and live["connector"].progress(ev))
+            proxy = await confidential.start_confidential_proxy(port=pport, log=_err, on_progress=lambda ev: live["connector"] and live["connector"].progress(ev),
+                                                                credential_for=credential_for, offered=lambda m: m in offered)
         except OSError as e:
-            _err(f"witbitz-code: could not start the confidential-model proxy on 127.0.0.1:{pport} ({e}) — confidential models are not offered")
-        route = models.proxy_config(proxy.port) if proxy and keys.has_trustedrouter() else None
-        if not await is_listening(port) and "--no-opencode" not in args:
+            _err(f"witbitz-code: could not start the model proxy on 127.0.0.1:{pport} ({e}) — free that port and run serve again")
+            return 1
+        route = models.proxy_config(proxy.port)
+        if await is_listening(port) and "--no-opencode" not in args:
+            _err(f"witbitz-code: OpenCode is already running on 127.0.0.1:{port}, started some other way — it cannot use your account's keys.")
+            _err("              Close it, then run witbitz-code serve again (it starts OpenCode itself).")
+            return 1
+        if "--no-opencode" not in args:
             exe = wizard.find_opencode()
             if not exe:
                 _err("witbitz-code: OpenCode is not installed (or not on PATH). Run witbitz-code setup, or install it and run serve again:")
@@ -197,13 +226,10 @@ async def serve(args: list[str]) -> int:
                 await asyncio.sleep(0.25)
         if stop.event.is_set():
             return 0
-        if proxy and child is None and "--no-opencode" not in args:
-            _err("witbitz-code: OpenCode was already running, so its TrustedRouter calls do not go through the confidential-model proxy — restart it with witbitz-code serve")
-        elif route and child is not None:
-            _err(f"witbitz-code: confidential models are enforced (min_privacy + verified receipts){' and read images through Tinfoil' if keys.tinfoil_key() else ' — add a Tinfoil key (witbitz-code tinfoil-key) to read images with text-only ones'}")
-        elif proxy and not keys.has_trustedrouter():
-            _err("witbitz-code: TrustedRouter is not connected, so Code offers only OpenCode's own models — run witbitz-code trustedrouter-key")
-        connector = await start_connector(pairings)
+        if child is not None:
+            _err("witbitz-code: model calls are paid by each account's own coding keys; confidential models are enforced (min_privacy + verified receipts)")
+        connector = await start_connector(pairings, payers=payers)
+        live["status"] = asyncio.ensure_future(_check_keys_every(live_keys, keys_http))
         live["connector"] = connector
         if proxy:
             connector.set_confidential_sink(proxy.add_confidential)  # the page hands down what the account offers today
@@ -212,32 +238,26 @@ async def serve(args: list[str]) -> int:
         try:
             return await _wait_for_stop(stop, child)
         finally:
+            live["status"].cancel()
             await connector.aclose()
     finally:
         if child is not None:
             await _stop_opencode(child)
         if proxy is not None:
             await proxy.close()
+        await keys_http.aclose()
         stop.remove()
 
 
-async def set_key(label: str, check, save, after: str) -> int:
-    """`trustedrouter-key` / `tinfoil-key`: ask (it shows as *****), check with the provider, save. A rejected key is not saved."""
-    key = keys.read_line(f"{label} API key (it shows as *****): ", hidden=True)
-    if not key:
-        _err("witbitz-code: no key entered — nothing changed")
-        return 1
-    if not keys.valid_key_shape(key):
-        _err("witbitz-code: that does not look like an API key (no spaces, 8–512 characters) — nothing changed")
-        return 1
-    v = await check(key)
-    if v.get("ok") is False:
-        _err(f"witbitz-code: {v.get('why')} — nothing changed")
-        return 1
-    where = save(key)
-    unchecked = f" without checking it — {v.get('why')}" if v.get("ok") is None else ""
-    _err(f"witbitz-code: saved in {where} (only you can read it){unchecked}. {after}")
-    return 0
+async def _check_keys_every(live_keys: codekeys.LiveKeys, http: httpx.AsyncClient) -> None:
+    """At start and every few hours: are the keys live (revoked → refused, paused → refused until it is back on)? In the
+    background — the keys file is used meanwhile, and a slow server never holds up serving."""
+    while True:
+        try:
+            await live_keys.check(http, _err)
+        except Exception as e:  # noqa: BLE001 — a reading that failed is asked again next time
+            _err(f"witbitz-code: could not check the coding keys ({str(e)[:80]})")
+        await asyncio.sleep(codekeys.STATUS_EVERY_S)
 
 
 async def setup(args: list[str]) -> int:
@@ -253,15 +273,67 @@ async def setup(args: list[str]) -> int:
     return r.get("served", 0) if not r.get("stopped") else 1
 
 
+async def uninstall(args: list[str]) -> int:
+    yes = "--yes" in args
+    if not yes and not sys.stdin.isatty():
+        _err("witbitz-code: uninstall asks before it removes anything — run it in a terminal, or pass --yes")
+        return 2
+    from . import account as acct, net  # noqa: PLC0415
+
+    client = net.new_client()
+    call = net.make_api_call(client)
+    closed = {"done": False}
+
+    async def close_client() -> None:
+        if not closed["done"]:
+            closed["done"] = True
+            await client.aclose()
+
+    async def remove_package(info: dict) -> dict:
+        await close_client()  # before pipx deletes the files it would load
+        return uninstall_mod.remove_package(info)
+
+    async def unpair(p: dict) -> dict:
+        # This computer's coding keys go back first (codekeys.py) — the signing key that can return them is in the folder
+        # uninstall removes.
+        entry = codekeys.for_computer(p["computerId"])
+        if entry and not await codekeys.revoke(client, entry):
+            return {"ok": False, "why": "could not give this computer's coding keys back"}
+        if entry:
+            codekeys.forget(p["computerId"])
+        r = await acct.unpublish_computer(call=call, idx=p["idx"], computer_id=p["computerId"])
+        if r.get("ok"):
+            pp.write_pairings(pp.remove_pairings(pp.read_pairings(), p.get("account") or "")["doc"])
+        return r
+
+    try:
+        r = await uninstall_mod.run_uninstall(uninstall_mod.Deps(
+            say=_err, ask=lambda q: keys.read_line(q), yes=yes,
+            remove_keys="--remove-keys" in args, remove_notes="--remove-notes" in args,
+            remove_sessions="--remove-sessions" in args, remove_opencode="--remove-opencode" in args,
+            unpair=unpair, has_keys=uninstall_mod.saved_keys, delete_keys=uninstall_mod.delete_saved_keys,
+            notes=uninstall_mod.notes_info, owned_files=uninstall_mod.owned_files, sessions=uninstall_mod.sessions_info,
+            delete_sessions=uninstall_mod.delete_sessions, remove_package=remove_package))
+    finally:
+        await close_client()
+    if r.get("done"):
+        for d in (pp.pairings_path().parent.parent, Path.home() / ".cache" / "witbitz"):  # emptied by now, unless the person keeps something there
+            try:
+                d.rmdir()
+            except OSError:
+                pass
+    return 0 if r.get("done") else 1
+
+
 async def _main(argv: list[str]) -> int:
     cmd, rest = (argv[0], argv[1:]) if argv else ("", [])
+    if cmd == "uninstall":
+        return await uninstall(rest)
     if cmd == "setup":
         return await setup(rest)
-    if cmd == "trustedrouter-key":
-        return await set_key("TrustedRouter", keys.check_trustedrouter_key, keys.save_trustedrouter_key,
-                             "Restart witbitz-code serve so OpenCode picks it up.")
-    if cmd == "tinfoil-key":
-        return await set_key("Tinfoil", keys.check_tinfoil_key, keys.save_tinfoil_key, "It is used from the next message — no restart needed.")
+    if cmd in ("trustedrouter-key", "tinfoil-key"):
+        _err("witbitz-code: keys now come from your Spaces account — this computer gets its own when you pair it: witbitz-code pair")
+        return 2
     if cmd == "pair":
         return await pair_cmd.main(rest)
     if cmd == "serve":