import { runCoderPlain } from "./coder-plain.js";

import { CoderSession, DummyReplySource } from "./coder-session.js";

import { runCoderUi } from "./coder-ui.js";

import { backendIds, findBackend } from "./coder-backends.js";

import { ChatApiReplySource } from "./coder-chat-api.js";

import { backendIds } from "./coder-backends.js";

import { openThread, ThreadUnavailable } from "./coder-thread.js";

import { describeWorkspace } from "./coder-workspace.js";

import { ComputerClient } from "./computer-client.js";

import { ComputerUp } from "./computer-up.js";

  ComputerPairingInProgress,

  ComputerReconnectExhausted,

  InputError,

  NetworkRefused,

} from "./errors.js";

import { CredentialStore } from "./credential-store.js";

import {

  "medium",

  "high",

  "max",

]).pipe(Flag.optional, Flag.withDescription("Reasoning effort the server passes to the provider"));

// The accepted values come from the same list the status line and Tab read, so

// a backend cannot be offered by one and refused by another.

const coderModelFlag = Flag.choice("model", backendIds() as string[]).pipe(

]).pipe(

  Flag.optional,

  Flag.withDescription("The backend that answers the turn"),

  Flag.withDescription("Reasoning effort recorded on the thread as its admitted execution shape"),

);

// The accepted values are still the chat API's published backends. A thread's

// grant pins its own model and `POST /api/v3/threads` publishes no model

// parameter, so naming one here cannot change which model answers; the session

// says so rather than letting the flag look like it worked.

const coderModelFlag = Flag.choice("model", backendIds() as string[]).pipe(

  Flag.optional,

  Flag.withDescription("A chat API backend. The thread's grant pins its own model"),

);

/**

 * Turn a refused thread into an error the CLI already knows how to print.

 *

 * The server's code and sentence are carried through unchanged, so a caller

 * reading `--json` branches on `thread_quota_reached` and a person reading the

 * terminal is told the limit and how many threads the account is holding.

 */

const coderRefusal = (origin: string, cause: unknown) => {

  if (!(cause instanceof ThreadUnavailable)) {

    return new InputError({ message: `The thread could not be opened: ${String(cause)}` });

  }

  if (cause.code === "network_refused") {

    return new NetworkRefused({ origin, message: cause.message });

  }

  return new ApiError({

    operation: "coder.thread.open",

    status: cause.status,

    code: cause.code,

    message: cause.message,

  });

};

const coderCommand = Command.make(

  "coder",

      const workspace = describeWorkspace();

      const endpoint = yield* resolveApiEndpoint(endpointOverrides(flags));

      // Replies come from the account chat API, so the CLI never holds a

      // provider key and a thread costs exactly what the server metered.

      // Without a credential it falls back to the stand-in and says so rather

      // than failing.

      // The session opens a thread of its own and spends that thread's grant,

      // so the CLI still holds no provider key and nothing typed here reaches

      // the account's conversation. Without a credential it falls back to the

      // stand-in and says so rather than failing.

      const stored = offline

        ? Option.none()

        : yield* findToken(endpoint.origin).pipe(

            ),

          );

      const chosen = Option.getOrUndefined(model);

      const source = Option.isSome(stored)

        ? new ChatApiReplySource({

            origin: endpoint.origin,

            token: Redacted.value(stored.value.token),

            reasoning: Option.getOrUndefined(reasoning),

            backend: chosen === undefined ? undefined : findBackend(chosen),

      const thread = Option.isSome(stored)

        ? yield* Effect.tryPromise({

            try: () =>

              openThread({

                origin: endpoint.origin,

                token: Redacted.value(stored.value.token),

                objective: `openagents coder in ${workspace.repository} on ${workspace.branch}`,

                reasoning: Option.getOrUndefined(reasoning),

              }),

            // The server's own code and sentence, which is what turns a ninth

            // concurrent session from an obscure failure into an instruction

            // naming the ceiling and how many threads the account is holding.

            catch: (cause) => coderRefusal(endpoint.origin, cause),

          })

        : new DummyReplySource();

        : undefined;

      const source = thread ?? new DummyReplySource();

      const session = new CoderSession(source, workspace.repository, workspace.branch);

      if (Option.isNone(stored) && !offline) {

        );

      }

      // A grant pins the model the proxy will use, and the thread route takes

      // no model parameter, so a named backend cannot reach this turn. Saying

      // nothing would leave a reader with a flag that appeared to work.

      if (thread !== undefined && Option.isSome(model)) {

        session.notice(

          `This thread's grant pins ${thread.model}. \`--model\` names a chat API ` +

            "backend, which the inference proxy does not route to, so it had no effect.",

        );

      }

      const oneShot = Option.getOrUndefined(prompt);

      const interactive = terminal.interactive && !plain && !flags.json && oneShot === undefined;

      const code = yield* Effect.promise(() =>

        interactive

          ? runCoderUi(session, { stdin: process.stdin, stdout: process.stdout })

          : runCoderPlain(session, {

              stdin: process.stdin,

              stdout: process.stdout,

              prompt: oneShot,

            }),

      );

      const code = yield* Effect.promise(async () => {

        try {

          return interactive

            ? await runCoderUi(session, { stdin: process.stdin, stdout: process.stdout })

            : await runCoderPlain(session, {

                stdin: process.stdin,

                stdout: process.stdout,

                prompt: oneShot,

              });

        } finally {

          // An account holds eight open threads at once. A terminal that closed

          // without giving its slot back would hold one until the authority

          // expired an hour later, which is the ninth session refused for a

          // session nobody is in. A process killed outright still leaves it to

          // the server's expiry reap.

          if (thread !== undefined) await thread.revoke();

        }

      });

      if (code !== 0) {

        process.exitCode = code;

    }),

).pipe(

  Command.withDescription(

    "Open a terminal coding session. Replies come from Ox Alpha through the account chat API; --offline answers from a built-in stand-in instead",

    "Open a terminal coding session on a thread of its own. Replies come from the thread's grant through the inference proxy, so nothing typed here reaches /chat; --offline answers from a built-in stand-in instead",

  ),

);

/**

 * A reply source backed by the account chat API.

 *

 * The CLI never holds a provider key and never talks to a model vendor. It

 * submits a turn and reads the durable event log the server writes, so a coder

 * thread costs exactly what the server metered and leaves the same receipts the

 * web surface leaves.

 *

 * Which model answers is the server's `model` parameter, and every backend

 * answers with the same events, so this file has no branch per backend: the

 * backend is a value it sends and a label it reports.

 *

 * Two properties of the shipped contract shape this file:

 *

 * - The server records one conversation per account (`DATA-002`) and one active

 *   turn per conversation (`TURN-001`). A coder session therefore shares the

 *   account's conversation rather than opening its own, and a second turn while

 *   one is running is refused with `turn_in_progress` rather than queued.

 * - `GET /api/v3/chat/events` returns the conversation's whole event log, not a

 *   stream. This polls it and yields what is new, which is why the reply

 *   appears in pieces rather than at once.

 */

import { type CoderBackend, defaultBackend, nextBackend } from "./coder-backends.js";

import type { ReplyChunk } from "./coder-session.js";

const SUBMIT_PATH = "/api/v3/chat/turns";

const EVENTS_PATH = "/api/v3/chat/events";

const POLL_INTERVAL_MS = 250;

/** Give up rather than poll forever when a turn never reaches a terminal event. */

const TURN_TIMEOUT_MS = 300_000;

export interface ChatApiOptions {

  readonly origin: string;

  readonly token: string;

  /** Reasoning effort the server passes to the provider. */

  readonly reasoning?: string | undefined;

  /** The backend that answers. Defaults to the first in the published list. */

  readonly backend?: CoderBackend | undefined;

}

interface ChatEvent {

  readonly id?: string;

  readonly run_id?: string;

  readonly sequence?: number;

  readonly type?: string;

  readonly payload?: Record<string, unknown>;

  /**

   * The server's own projection of the tool call this event belongs to, which

   * every `tool_call_*` event carries. It already holds pretty-printed

   * arguments, the extracted result, and a structured error, so reading it

   * rather than the raw payload keeps the CLI and the web surface showing the

   * same tool call.

   */

  readonly tool_call?: ToolCallView;

}

interface ToolCallView {

  readonly call_id?: string;

  readonly name?: string;

  readonly arguments?: string;

  readonly output?: string | null;

  readonly error?: { readonly code?: string | null; readonly message?: string | null } | null;

  readonly status?: string;

}

export class ChatApiUnavailable extends Error {

  constructor(

    readonly code: string,

    message: string,

  ) {

    super(message);

    this.name = "ChatApiUnavailable";

  }

}

/**

 * Submit a turn and yield what the server records, in the order it records it.

 *

 * A turn interleaves reasoning, tool calls, and assistant text. Every one of

 * those becomes a chunk here. An earlier version yielded only `text_delta`,

 * which made a tool call invisible and joined the sentence before it to the

 * sentence after it.

 */

export class ChatApiReplySource {

  private backend: CoderBackend;

  constructor(private readonly options: ChatApiOptions) {

    this.backend = options.backend ?? defaultBackend();

  }

  /** The label the status line shows, which is the current backend's. */

  get model(): string {

    return this.backend.label;

  }

  /** The id the next turn sends as `model`. */

  get backendId(): string {

    return this.backend.id;

  }

  /**

   * Move to the next backend and return its label.

   *

   * This changes only what the next turn asks for. A turn already running was

   * submitted with the backend it named and keeps it, because the server has

   * already accepted that turn and cannot be told to change its mind.

   */

  cycleBackend(): string {

    this.backend = nextBackend(this.backend);

    return this.backend.label;

  }

  async *reply(prompt: string, signal: AbortSignal): AsyncIterable<ReplyChunk> {

    const seen = await this.latestSequence();

    const runId = await this.submit(prompt, signal);

    const startedAt = Date.now();

    const delivered = new Map<string, number>();

    if (runId !== undefined) delivered.set(runId, seen.get(runId) ?? -1);

    while (!signal.aborted) {

      if (Date.now() - startedAt > TURN_TIMEOUT_MS) {

        throw new ChatApiUnavailable(

          "turn_timed_out",

          "The turn produced no terminal event within five minutes.",

        );

      }

      const events = await this.events(signal);

      if (signal.aborted) return;

      // A submit that answered without a run id still identifies its run in the

      // log; take the newest run not already accounted for.

      const target = runId ?? newestRun(events, seen);

      if (target === undefined) {

        await sleep(POLL_INTERVAL_MS, signal);

        continue;

      }

      const floor = delivered.get(target) ?? seen.get(target) ?? -1;

      let highest = floor;

      let finished = false;

      for (const event of events) {

        if (event.run_id !== target) continue;

        const sequence = typeof event.sequence === "number" ? event.sequence : -1;

        if (sequence <= floor) continue;

        highest = Math.max(highest, sequence);

        if (event.type === "text_delta") {

          const value = event.payload?.["value"];

          if (typeof value === "string" && value.length > 0) yield { type: "text", value };

        } else if (event.type === "reasoning_delta") {

          const value = event.payload?.["value"];

          if (typeof value === "string" && value.length > 0) yield { type: "reasoning", value };

        } else if (event.type === "tool_call_started") {

          const call = toolCall(event);

          if (call !== undefined) yield call;

        } else if (event.type === "tool_call_completed" || event.type === "tool_call_failed") {

          const result = toolResult(event);

          if (result !== undefined) yield result;

        } else if (event.type === "response_completed") {

          finished = true;

        } else if (event.type === "response_failed") {

          // The server names the terminal events `response_completed` and

          // `response_failed`, and reports why in `reason` with a stable

          // `code` beside it.

          const reason = event.payload?.["reason"];

          const code = event.payload?.["code"];

          throw new ChatApiUnavailable(

            typeof code === "string" ? code : "turn_failed",

            typeof reason === "string" ? reason : "The turn failed on the server.",

          );

        }

      }

      delivered.set(target, highest);

      if (finished) return;

      await sleep(POLL_INTERVAL_MS, signal);

    }

  }

  /** Highest sequence per run before submitting, so old events are not replayed. */

  private async latestSequence(): Promise<Map<string, number>> {

    const seen = new Map<string, number>();

    for (const event of await this.events()) {

      if (typeof event.run_id !== "string") continue;

      const sequence = typeof event.sequence === "number" ? event.sequence : -1;

      seen.set(event.run_id, Math.max(seen.get(event.run_id) ?? -1, sequence));

    }

    return seen;

  }

  private async submit(prompt: string, signal: AbortSignal): Promise<string | undefined> {

    const response = await fetch(new URL(SUBMIT_PATH, this.options.origin), {

      method: "POST",

      signal,

      headers: {

        authorization: `Bearer ${this.options.token}`,

        "content-type": "application/json",

        accept: "application/json",

      },

      body: JSON.stringify({

        message: prompt,

        model: this.backend.id,

        ...(this.options.reasoning === undefined ? {} : { reasoning: this.options.reasoning }),

      }),

    });

    const body = (await response.json().catch(() => ({}))) as Record<string, unknown>;

    if (response.status === 401 || response.status === 403) {

      throw new ChatApiUnavailable(

        "scope_missing",

        "This token cannot reach the chat API. Sign in again with the chat:account scope.",

      );

    }

    if (response.status === 409) {

      throw new ChatApiUnavailable(

        "turn_in_progress",

        "The account already has a turn running. One turn runs at a time.",

      );

    }

    if (response.status === 429) {

      throw new ChatApiUnavailable("rate_limited", "The chat API is rate limiting this account.");

    }

    if (response.status < 200 || response.status >= 300) {

      const code = typeof body["error"] === "string" ? body["error"] : `http_${response.status}`;

      throw new ChatApiUnavailable(code, `The chat API refused the turn (${code}).`);

    }

    const turn = body["turn"];

    if (turn !== null && typeof turn === "object") {

      const id = (turn as Record<string, unknown>)["id"];

      if (typeof id === "string") return id;

    }

    return undefined;

  }

  private async events(signal?: AbortSignal): Promise<ReadonlyArray<ChatEvent>> {

    const response = await fetch(new URL(EVENTS_PATH, this.options.origin), {

      ...(signal === undefined ? {} : { signal }),

      headers: {

        authorization: `Bearer ${this.options.token}`,

        accept: "application/json",

      },

    });

    if (response.status === 401 || response.status === 403) {

      throw new ChatApiUnavailable(

        "scope_missing",

        "This token cannot read chat events. Sign in again with the chat:account scope.",

      );

    }

    if (response.status < 200 || response.status >= 300) return [];

    const body = (await response.json().catch(() => ({}))) as Record<string, unknown>;

    const events = body["events"];

    return Array.isArray(events) ? (events as ReadonlyArray<ChatEvent>) : [];

  }

}

/** The start of a tool call, read from the server's projection of it. */

function toolCall(event: ChatEvent): Extract<ReplyChunk, { type: "tool_call" }> | undefined {

  const view = event.tool_call;

  const callId = view?.call_id ?? stringField(event.payload, "call_id");

  if (callId === undefined) return undefined;

  return {

    type: "tool_call",

    callId,

    name: view?.name ?? stringField(event.payload, "name") ?? "tool",

    arguments: view?.arguments ?? stringField(event.payload, "arguments") ?? "",

  };

}

/** The outcome of a tool call. `error` decides whether it succeeded. */

function toolResult(event: ChatEvent): Extract<ReplyChunk, { type: "tool_result" }> | undefined {

  const view = event.tool_call;

  const callId = view?.call_id ?? stringField(event.payload, "call_id");

  if (callId === undefined) return undefined;

  const message = view?.error?.message ?? stringField(event.payload, "error");

  const error = message ?? (event.type === "tool_call_failed" ? "The tool failed." : undefined);

  const output = view?.output ?? stringField(event.payload, "output");

  return { type: "tool_result", callId, output: output ?? undefined, error };

}

function stringField(

  payload: Record<string, unknown> | undefined,

  key: string,

): string | undefined {

  const value = payload?.[key];

  return typeof value === "string" && value.length > 0 ? value : undefined;

}

/** The newest run in the log that the pre-submit snapshot did not know about. */

function newestRun(

  events: ReadonlyArray<ChatEvent>,

  seen: ReadonlyMap<string, number>,

): string | undefined {

  for (let index = events.length - 1; index >= 0; index -= 1) {

    const runId = events[index]?.run_id;

    if (typeof runId === "string" && !seen.has(runId)) return runId;

  }

  return undefined;

}

function sleep(ms: number, signal: AbortSignal): Promise<void> {

  return new Promise((resolve) => {

    if (signal.aborted) return resolve();

    const timer = setTimeout(finish, ms);

    signal.addEventListener("abort", finish, { once: true });

    function finish() {

      clearTimeout(timer);

      signal.removeEventListener("abort", finish);

      resolve();

    }

  });

}

   * this process never saw.

   */

  readonly turns: number;

  /**

   * What the source may still spend, or undefined for a source that spends

   * nothing. A budget first shown when it runs out is a budget that already

   * cost somebody the work it was funding, so the status line carries it from

   * the first frame.

   */

  readonly budget: string | undefined;

}

/** Where reply chunks come from. One implementation today; ACP is the next. */

  /** The label the status line shows for the reply source. */

  readonly model: string;

  /**

   * One sentence about where this source's turns are recorded, shown once at

   * the start of a session. A source whose turns are private to this process

   * leaves it unset; a source that writes into a conversation shared with

   * another surface has to say so, because nothing else on screen would.

   * What this source may still spend, already formatted for the status line,

   * or undefined for a source that meters nothing. Read on every snapshot, so

   * a source spending against a ceiling reports the figure it is at rather

   * than the one it opened with.

   */

  readonly budget?: string | undefined;

  /**

   * Move to the next backend and return its new label.

   *

      branch: this.branch,

      model: this.source.model,

      turns: this.turnCount,

      budget: this.source.budget,

    };

  }

/**

 * A reply source backed by a thread of the caller's own, and the grant that

 * thread mints.

 *

 * `openagents coder` used to submit through `POST /api/v3/chat/turns` and poll

 * `GET /api/v3/chat/events`. That was the only route a user token could reach a

 * model through, and the server records one conversation per account, so every

 * prompt a person typed in a terminal landed in the same conversation `/chat`

 * reads, contended for the one streaming slot that conversation admits, and

 * became provider context for the next question asked in the browser. This

 * replaces both paths.

 *

 * `POST /api/v3/threads` opens a thread and returns a grant. The grant is the

 * bearer for `POST /api/inference/proxy`, an OpenAI-compatible

 * `/chat/completions` surface that meters against the thread's own budget and

 * keeps the provider credential on the server, so the CLI still holds no

 * provider key. `DELETE /api/v3/threads/{id}` revokes the thread on exit, which

 * matters because an account may hold only eight open threads at once and a

 * closed terminal would otherwise hold a slot until the authority expired.

 *

 * Three properties of that proxy shape this file, and each is a real loss

 * against the event log this replaces:

 *

 * - **It answers in one piece.** The proxy builds the whole SSE body and sends

 *   it once, so the frames below all arrive together. The parser is written

 *   against the stream anyway rather than against `await response.text()`, so

 *   chunked delivery becomes visible here the day the server sends it, with no

 *   change on this side.

 * - **It carries no reasoning.** `OpenAgents.Providers.ProviderEvent` has no

 *   reasoning member at all — the union is `response_started`, `text_delta`,

 *   `tool_call`, `usage`, `response_completed`, `failed`, `cancelled` — and the

 *   proxy drops everything it cannot name. The chat event log had

 *   `reasoning_delta`; nothing on this path does. So no `reasoning` chunk is

 *   ever produced here, and the interface's dim-italic reasoning entry, which

 *   the stand-in behind `--offline` still exercises, never appears against a

 *   live model.

 * - **No tool runs.** The chat lane ran tools on the server and reported each

 *   one. The proxy is a bare completions surface: it forwards the `tools` a

 *   caller declares and returns the calls the model asks for, and the caller

 *   executes them. This CLI declares none and has no tool runtime, so the

 *   `tool_calls` translation below is the honest mapping of a frame that does

 *   not arrive today. It is kept because the frame is part of the surface and

 *   the alternative is discovering the mapping is missing on the day tools land.

 *

 * Nothing here announces any of that on screen. `2c15c6ed20` removed the

 * `scopeNotice` seam with the reasoning that a session private to its own

 * thread has nothing to announce, and a banner at the top of every session

 * teaches the constraint rather than the design. The losses above are real and

 * belong in the issue that decides what to do about them, not in a permanent

 * line above the first prompt.

 *

 * The grant is a bearer credential. It is held `Redacted` so that an accidental

 * interpolation prints a placeholder, it never reaches the transcript, and it

 * is never passed as an argument to anything this process spawns.

 */

import { Redacted } from "effect";

import type { ReplyChunk, ReplySource } from "./coder-session.js";

const THREADS_PATH = "/api/v3/threads";

/** What the thread may still spend, as the server last reported it. */

export interface ThreadBudget {

  readonly calls: number;

  readonly totalTokens: number;

  readonly costMicrousd: number;

}

export interface ThreadOptions {

  readonly origin: string;

  /** The account token. Opens, reads, and revokes the thread; never spends it. */

  readonly token: string;

  /** What this body of work is for. The server requires one. */

  readonly objective: string;

  /** Recorded on the thread as its admitted execution shape. */

  readonly reasoning?: string | undefined;

}

export class ThreadUnavailable extends Error {

  constructor(

    readonly code: string,

    message: string,

    /** The HTTP status behind the code, or 0 when the request never landed. */

    readonly status = 0,

  ) {

    super(message);

    this.name = "ThreadUnavailable";

  }

}

/**

 * Open a thread and take its grant.

 *

 * A refusal here is reported with the server's own code and sentence. The

 * account cap is the one a person meets: the ninth concurrent session is

 * refused `thread_quota_reached` with a message naming the limit and how many

 * threads the account is holding, which is what tells them to close one rather

 * than to retry.

 */

export async function openThread(options: ThreadOptions): Promise<ThreadReplySource> {

  const response = await fetch(new URL(THREADS_PATH, options.origin), {

    method: "POST",

    headers: {

      authorization: `Bearer ${options.token}`,

      "content-type": "application/json",

      accept: "application/json",

    },

    body: JSON.stringify({

      objective: options.objective,

      ...(options.reasoning === undefined ? {} : { reasoning: options.reasoning }),

    }),

  }).catch((cause: unknown) => {

    throw new ThreadUnavailable(

      "network_refused",

      `The API at ${options.origin} could not be reached: ${String(cause)}`,

    );

  });

  const body = (await response.json().catch(() => ({}))) as Record<string, unknown>;

  if (response.status === 401 || response.status === 403) {

    throw new ThreadUnavailable(

      "scope_missing",

      "This token cannot open a thread. Sign in again with the chat:account scope.",

      response.status,

    );

  }

  if (response.status < 200 || response.status >= 300) {

    // The envelope names the code and the sentence. Passing both through is

    // what turns a ninth session from an obscure failure into an instruction.

    const code = typeof body["code"] === "string" ? body["code"] : `http_${response.status}`;

    const message =

      typeof body["message"] === "string"

        ? body["message"]

        : `The server refused to open a thread (${code}).`;

    throw new ThreadUnavailable(code, message, response.status);

  }

  const thread = record(body["thread"]);

  const grant = record(body["grant"]);

  const id = string(thread["id"]);

  const token = string(grant["token"]);

  const url = string(grant["url"]);

  const model = string(grant["model"]);

  if (id === undefined || token === undefined || url === undefined || model === undefined) {

    throw new ThreadUnavailable(

      "malformed_thread",

      "The server opened a thread but did not return the grant needed to spend it.",

    );

  }

  return new ThreadReplySource({

    origin: options.origin,

    accountToken: options.token,

    threadId: id,

    grantToken: Redacted.make(token),

    proxyUrl: url,

    model,

    budget: budgetOf(record(grant["limits"]), record(grant["limits"])),

  });

}

interface SourceState {

  readonly origin: string;

  readonly accountToken: string;

  readonly threadId: string;

  readonly grantToken: Redacted.Redacted<string>;

  readonly proxyUrl: string;

  readonly model: string;

  readonly budget: ThreadBudget;

}

/** One chat-completions message, which is what the proxy takes as its input. */

interface WireMessage {

  readonly role: "user" | "assistant";

  readonly content: string;

}

export class ThreadReplySource implements ReplySource {

  readonly threadId: string;

  /**

   * The thread's transcript, keyed on the thread by construction: this array

   * exists only inside the source that holds that thread's grant, so the

   * context a turn is answered against is the thread's and nothing else's.

   * The account conversation is not read and not written.

   */

  private readonly transcript: WireMessage[] = [];

  private remaining: ThreadBudget;

  constructor(private readonly state: SourceState) {

    this.threadId = state.threadId;

    this.remaining = state.budget;

  }

  /**

   * The model the grant pins.

   *

   * Not a backend the client chose. The proxy takes the model from the grant so

   * a request body cannot select another, and the thread route deliberately

   * publishes no model parameter, so this is the one name that is true of the

   * reply on screen.

   */

  get model(): string {

    return this.state.model;

  }

  /** What is left to spend, in the width a status line has for it. */

  get budget(): string {

    return formatBudget(this.remaining);

  }

  async *reply(prompt: string, signal: AbortSignal): AsyncIterable<ReplyChunk> {

    this.transcript.push({ role: "user", content: prompt });

    let assistant = "";

    try {

      for await (const chunk of this.stream(signal)) {

        if (signal.aborted) break;

        if (chunk.type === "text") assistant += chunk.value;

        yield chunk;

      }

    } finally {

      // Whatever the model said belongs to the thread even when the turn was

      // interrupted, or the next turn answers a question it cannot see it

      // half-answered.

      if (assistant.length > 0) this.transcript.push({ role: "assistant", content: assistant });

      // Read the budget on the way out of every turn, including an interrupted

      // one. Interrupting is a client-side abort: the proxy had already bought

      // the call and metered it, so a status line that kept the figure it

      // opened with would under-report the spend by exactly the turns a reader

      // cut short.

      await this.refresh();

    }

  }

  /**

   * Revoke the thread and its grant.

   *

   * Best effort by design: this runs while the process is leaving, and a

   * network failure on the way out must not turn a finished session into an

   * error. The server retires elapsed authority on its own, so the worst case

   * of a failed revoke is a slot held until the thread expires rather than one

   * held forever.

   */

  async revoke(): Promise<void> {

    await fetch(new URL(`${THREADS_PATH}/${this.state.threadId}`, this.state.origin), {

      method: "DELETE",

      headers: {

        authorization: `Bearer ${this.state.accountToken}`,

        accept: "application/json",

      },

    }).catch(() => undefined);

  }

  /** Spend one call against the proxy and translate what comes back. */

  private async *stream(signal: AbortSignal): AsyncIterable<ReplyChunk> {

    const response = await fetch(this.state.proxyUrl, {

      method: "POST",

      signal,

      headers: {

        authorization: `Bearer ${Redacted.value(this.state.grantToken)}`,

        "content-type": "application/json",

        // The body is an event stream and the refusals are JSON, and both have

        // to be acceptable: the `:api` pipeline negotiates on `json` and

        // answers `406` to a request that will only take `text/event-stream`.

        accept: "text/event-stream, application/json",

      },

      body: JSON.stringify({

        model: this.state.model,

        stream: true,

        messages: this.transcript,

      }),

    }).catch((cause: unknown) => {

      if (signal.aborted) return undefined;

      throw new ThreadUnavailable(

        "network_refused",

        `The inference proxy could not be reached: ${String(cause)}`,

      );

    });

    if (response === undefined || signal.aborted) return;

    if (response.status < 200 || response.status >= 300) {

      throw await proxyRefusal(response);

    }

    if (response.body === null) return;

    /** Tool call fragments by their wire index, assembled as frames arrive. */

    const calls = new Map<number, { id: string; name: string; args: string }>();

    for await (const frame of frames(response.body, signal)) {

      if (signal.aborted) return;

      if (frame === "[DONE]") break;

      const payload = parse(frame);

      if (payload === undefined) continue;

      const usage = record(payload["usage"]);

      if (Object.keys(usage).length > 0) this.spend(usage);

      const choices = payload["choices"];

      if (!Array.isArray(choices)) continue;

      for (const choice of choices) {

        const delta = record(record(choice)["delta"]);

        const content = delta["content"];

        if (typeof content === "string" && content.length > 0) {

          yield { type: "text", value: content };

        }

        const toolCalls = delta["tool_calls"];

        if (Array.isArray(toolCalls)) accumulate(calls, toolCalls);

      }

    }

    for (const call of calls.values()) {

      yield { type: "tool_call", callId: call.id, name: call.name, arguments: call.args };

    }

  }

  /**

   * Take the turn's own usage off the budget immediately.

   *

   * The authoritative numbers come from the server a moment later, but a status

   * line that only moves after a second request would show a stale budget for

   * exactly as long as the reader is looking at the reply that spent it.

   */

  private spend(usage: Record<string, unknown>): void {

    const total = number(usage["total_tokens"]);

    this.remaining = {

      calls: Math.max(0, this.remaining.calls - 1),

      totalTokens: Math.max(0, this.remaining.totalTokens - total),

      costMicrousd: this.remaining.costMicrousd,

    };

  }

  /** Read what the server says the thread has left. Failure keeps the estimate. */

  private async refresh(): Promise<void> {

    const response = await fetch(

      new URL(`${THREADS_PATH}/${this.state.threadId}`, this.state.origin),

      {

        headers: {

          authorization: `Bearer ${this.state.accountToken}`,

          accept: "application/json",

        },

      },

    ).catch(() => undefined);

    if (response === undefined || response.status < 200 || response.status >= 300) return;

    const body = (await response.json().catch(() => ({}))) as Record<string, unknown>;

    const grant = record(body["grant"]);

    const remaining = record(grant["remaining"]);

    if (Object.keys(remaining).length === 0) return;

    this.remaining = budgetOf(remaining, record(grant["limits"]));

  }

}

/** Frames of an SSE body, yielded as the body arrives rather than after it. */

async function* frames(

  body: ReadableStream<Uint8Array>,

  signal: AbortSignal,

): AsyncIterable<string> {

  const reader = body.getReader();

  const decoder = new TextDecoder();

  let buffer = "";

  try {

    for (;;) {

      // A stream is read in order and each read depends on the one before it,

      // so there is no set of promises here to run together.

      // eslint-disable-next-line no-await-in-loop

      const { done, value } = await reader.read();

      if (done || signal.aborted) break;

      buffer += decoder.decode(value, { stream: true });

      for (;;) {

        const boundary = buffer.indexOf("\n\n");

        if (boundary < 0) break;

        const frame = buffer.slice(0, boundary);

        buffer = buffer.slice(boundary + 2);

        const data = dataOf(frame);

        if (data !== undefined) yield data;

      }

    }

  } finally {

    reader.releaseLock();

  }

}

/** The `data:` payload of one frame, or nothing for a comment or a keep-alive. */

function dataOf(frame: string): string | undefined {

  const lines = frame.split("\n");

  const parts: string[] = [];

  for (const line of lines) {

    const trimmed = line.endsWith("\r") ? line.slice(0, -1) : line;

    if (!trimmed.startsWith("data:")) continue;

    parts.push(trimmed.slice(5).trimStart());

  }

  return parts.length === 0 ? undefined : parts.join("\n");

}

function parse(frame: string): Record<string, unknown> | undefined {

  try {

    const value: unknown = JSON.parse(frame);

    return typeof value === "object" && value !== null

      ? (value as Record<string, unknown>)

      : undefined;

  } catch {

    return undefined;

  }

}

/**

 * Fold `tool_calls` fragments into whole calls.

 *

 * Chat-completions splits one call across frames and identifies the pieces by

 * `index`, so a name and its arguments can arrive separately.

 */

function accumulate(

  calls: Map<number, { id: string; name: string; args: string }>,

  fragments: ReadonlyArray<unknown>,

): void {

  for (const fragment of fragments) {

    const piece = record(fragment);

    const index = number(piece["index"]);

    const current = calls.get(index) ?? { id: "", name: "tool", args: "" };

    const fn = record(piece["function"]);

    calls.set(index, {

      id: string(piece["id"]) ?? current.id,

      name: string(fn["name"]) ?? current.name,

      args: current.args + (string(fn["arguments"]) ?? ""),

    });

  }

}

/** The proxy's typed refusal, turned into a sentence a reader can act on. */

async function proxyRefusal(response: Response): Promise<ThreadUnavailable> {

  const body = (await response.json().catch(() => ({}))) as Record<string, unknown>;

  const code = string(record(body["error"])["code"]) ?? `http_${response.status}`;

  const sentences: Record<string, string> = {

    grant_revoked: "This thread was revoked. Start a new session to open another.",

    grant_expired: "This thread's authority expired. Start a new session to open another.",

    grant_exhausted: "This thread spent its budget. Start a new session to open another.",

    grant_budget_reached: "This thread reached its budget ceiling and cannot buy another call.",

    invalid_grant: "The inference proxy did not recognize this thread's grant.",

    provider_failed: "The model provider failed. The call was not completed.",

  };

  return new ThreadUnavailable(

    code,

    sentences[code] ?? `The inference proxy refused the call (${code}).`,

    response.status,

  );

}

/**

 * The budget, read from `remaining` when the server has reported one and from