Target /api/v1, and stop revoking a thread on the way out

bac494248859 · AtlantisPleb · 3d ago · parent 3d716e9fce8f

Target /api/v1, and stop revoking a thread on the way out

The API is `/api/v1` now (openagents.com #212, eb8ea8f). The CLI targets it
through one constant rather than the twenty-odd literals it had, which is what
made the rename a seventy-file change in the first place (#214).

The server answers `/api/v3` through a transparent alias, so this build reaches
a deployment that has not shipped the rename yet and an older CLI reaches one
that has. Neither side has to move first.

"This thread was revoked. Start a new session to open another." A session
revoked its own thread as it exited. Two consequences nobody asked for:
`--resume` was impossible by construction, because every past session's thread
was already terminal before it could be resumed; and anything that touched a
thread again — a delegated child still running on the lent grant, a second
window, a resumed session — was told it had been revoked.

A thread is durable. That is the whole point of the thread model, and ending a
session is not a reason to destroy it. `DELETE /threads/{id}` stays for a
reader who means it, and the sentence it produces no longer names a lifecycle
the reader never asked about. The server drops the open-thread cap in the same
change, because a cap sized against sessions that cleaned up after themselves
would now count every session the account had ever run.

715 tests pass, including two new ones: that a session leaves its thread alone,
and that an explicit revoke still revokes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012TRDRrfL1khQhQtNr3SRrA

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012TRDRrfL1khQhQtNr3SRrA

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

modified packages/openagents-cli/README.md
modified packages/openagents-cli/contracts/repositories-v1.json
modified packages/openagents-cli/skills/openagents-cli/SKILL.md
modified packages/openagents-cli/skills/superdelegate/SKILL.md
modified packages/openagents-cli/src/api-contract.ts
modified packages/openagents-cli/src/api-passthrough.ts
modified packages/openagents-cli/src/cli.ts
modified packages/openagents-cli/src/coder-backends.ts
modified packages/openagents-cli/src/coder-export.ts
modified packages/openagents-cli/src/coder-markdown.ts
modified packages/openagents-cli/src/coder-merge.ts
modified packages/openagents-cli/src/coder-ollama.ts
modified packages/openagents-cli/src/coder-plugins.ts
modified packages/openagents-cli/src/coder-resume.ts
modified packages/openagents-cli/src/coder-self-harness.ts
modified packages/openagents-cli/src/coder-shell.ts
modified packages/openagents-cli/src/coder-skills.ts
modified packages/openagents-cli/src/coder-thread.ts
modified packages/openagents-cli/src/coder-tools.ts
modified packages/openagents-cli/src/coder-transcript.ts
modified packages/openagents-cli/src/coder-ui.ts
modified packages/openagents-cli/src/coder-zen.ts
added packages/openagents-cli/src/constants.ts
modified packages/openagents-cli/src/device-client.ts
modified packages/openagents-cli/src/fleet-client.ts
modified packages/openagents-cli/src/forum-client.ts
modified packages/openagents-cli/src/index.ts
modified packages/openagents-cli/src/issue-client.ts
modified packages/openagents-cli/src/repository-client.ts
modified packages/openagents-cli/src/trace-command.ts
modified packages/openagents-cli/src/tracker-request.ts
modified packages/openagents-cli/test/api-command.test.ts
modified packages/openagents-cli/test/api-passthrough.test.ts
modified packages/openagents-cli/test/coder-backends.test.ts
modified packages/openagents-cli/test/coder-dev-server.test.ts
modified packages/openagents-cli/test/coder-export.test.ts
modified packages/openagents-cli/test/coder-ollama.test.ts
modified packages/openagents-cli/test/coder-paste.test.ts
modified packages/openagents-cli/test/coder-plugin-list-dir.test.ts
modified packages/openagents-cli/test/coder-plugin-mounts.test.ts
modified packages/openagents-cli/test/coder-resume.test.ts
modified packages/openagents-cli/test/coder-self-harness.test.ts
modified packages/openagents-cli/test/coder-shell.test.ts
modified packages/openagents-cli/test/coder-skills.test.ts
modified packages/openagents-cli/test/coder-steer.test.ts
modified packages/openagents-cli/test/coder-tools-openagents.test.ts
modified packages/openagents-cli/test/coder-transcript.test.ts
modified packages/openagents-cli/test/coder-ui.test.ts
modified packages/openagents-cli/test/coder-zen.test.ts
modified packages/openagents-cli/test/deploy-command.test.ts
modified packages/openagents-cli/test/device-client.test.ts
modified packages/openagents-cli/test/fleet-client.test.ts
modified packages/openagents-cli/test/issue-client.test.ts
modified packages/openagents-cli/test/issue-command.test.ts
modified packages/openagents-cli/test/repository-client.test.ts
modified packages/openagents-cli/test/trace-command.test.ts

Diff

56 files changed, +443 -293

openagents api repos/OWNER/REPO/issues | jq '.[].title'
```

A path without a leading slash resolves under the API base `/api/v3/`, so
`repos/OWNER/REPO/issues` and `/api/v3/repos/OWNER/REPO/issues` name the same
A path without a leading slash resolves under the API base `/api/v1/`, so
`repos/OWNER/REPO/issues` and `/api/v1/repos/OWNER/REPO/issues` name the same
route. An absolute path must start with `/api/`, and a complete URL must match
the API origin you selected. The CLI refuses a path that would leave that
origin.

## Deploy the fleet (operators)

The `deploy` commands drive the operator-only fleet promotion API
(`/api/v3/admin/forge/targets`). They require an API token holding the
(`/api/v1/admin/forge/targets`). They require an API token holding the
privileged `deployments:promote` scope, and the server additionally checks
that the account is a current operator on every request. `forge:write` cannot
promote, and neither can a Git credential or a browser session.

  "idempotency": {
    "header": "Idempotency-Key",
    "required_for": [
      "POST /api/v3/user/repos",
      "POST /api/v3/orgs/{org}/repos",
      "POST /api/v3/user/repos/imports",
      "POST /api/v3/orgs/{org}/repos/imports"
      "POST /api/v1/user/repos",
      "POST /api/v1/orgs/{org}/repos",
      "POST /api/v1/user/repos/imports",
      "POST /api/v1/orgs/{org}/repos/imports"
    ]
  },
  "endpoints": {
    "get_authenticated_user": "GET /api/v3/user",
    "create_user_repository": "POST /api/v3/user/repos",
    "create_organization_repository": "POST /api/v3/orgs/{org}/repos",
    "import_user_repository": "POST /api/v3/user/repos/imports",
    "import_organization_repository": "POST /api/v3/orgs/{org}/repos/imports",
    "list_repositories": "GET /api/v3/user/repos",
    "get_repository": "GET /api/v3/repos/{owner}/{repo}",
    "delete_repository": "DELETE /api/v3/repos/{owner}/{repo}",
    "get_repository_import": "GET /api/v3/repository-imports/{id}",
    "create_device_authorization": "POST /api/v3/device/authorizations",
    "poll_device_authorization": "POST /api/v3/device/authorizations/token"
    "get_authenticated_user": "GET /api/v1/user",
    "create_user_repository": "POST /api/v1/user/repos",
    "create_organization_repository": "POST /api/v1/orgs/{org}/repos",
    "import_user_repository": "POST /api/v1/user/repos/imports",
    "import_organization_repository": "POST /api/v1/orgs/{org}/repos/imports",
    "list_repositories": "GET /api/v1/user/repos",
    "get_repository": "GET /api/v1/repos/{owner}/{repo}",
    "delete_repository": "DELETE /api/v1/repos/{owner}/{repo}",
    "get_repository_import": "GET /api/v1/repository-imports/{id}",
    "create_device_authorization": "POST /api/v1/device/authorizations",
    "poll_device_authorization": "POST /api/v1/device/authorizations/token"
  },
  "authenticated_user": {
    "required": ["id", "login", "namespaces", "token_expires_at"],


`openagents api <path>` sends an authenticated request to any API route and
writes the body as JSON. A path without a leading slash resolves under
`/api/v3/`. Use it when no named command covers what you need — several routes
`/api/v1/`. Use it when no named command covers what you need — several routes
have no command of their own.

## Two cautions


## Which lane

| The work | Use |
| --- | --- |
| One command, one answer | `shell` |
| The same thing to N independent parts | `delegate` |
| A backlog of issues | the method below |
| The work                              | Use              |
| ------------------------------------- | ---------------- |
| One command, one answer               | `shell`          |
| The same thing to N independent parts | `delegate`       |
| A backlog of issues                   | the method below |

Run a single command yourself. Starting an agent to run `pwd` costs minutes and
real money and hands back an answer nobody watched being produced.

export const REPOSITORY_CONTRACT_NAME = "openagents.repositories.v1";
export const REPOSITORY_CONTRACT_VERSION = 1;
export const REPOSITORY_CONTRACT_SHA256 =
  "5be86539258c38d5249887ff2628680b1f90c93909d6e83e86a836d0250ce79f";
  "96a71ee0a3d19eb77ffa0721cc76876e1e514bb821368c469f0a6d91f21c3870";

export const AuthenticatedNamespace = Schema.Struct({
  id: Schema.Union([Schema.Number, Schema.String]),

import { Effect, Option } from "effect";

import type { HttpMethod } from "./api-transport.js";
import { API_BASE_PATH } from "./constants.js";
import { InputError } from "./errors.js";

/**
 * Every OpenAgents API route lives under this prefix. A passthrough path
 * without a leading slash resolves under it.
 */
export const API_BASE_PATH = "/api/v3/";
export { API_BASE_PATH };

/**
 * The methods `openagents api` accepts. The transport supports more, but a

/**
 * Turns a caller-supplied path into an origin-relative request path.
 *
 * A path without a leading slash resolves under `/api/v3/`, so
 * `repos/OWNER/REPO/issues` and `/api/v3/repos/OWNER/REPO/issues` name the same
 * A path without a leading slash resolves under `/api/v1/`, so
 * `repos/OWNER/REPO/issues` and `/api/v1/repos/OWNER/REPO/issues` name the same
 * route. An absolute path must stay under `/api/`, because this command talks
 * to the API rather than to the website. A complete URL is accepted only when
 * it matches the configured origin.

 * and a hint that omits it sends the reader around a loop that never signs
 * them in.
 */
const loginCommandFor = (endpoint: {
  readonly origin: string;
  readonly profile: string;
}): string =>
const loginCommandFor = (endpoint: { readonly origin: string; readonly profile: string }): string =>
  endpoint.profile === "production"
    ? "openagents auth login"
    : endpoint.profile === "custom"

);
// `--model` can name an `ollama:<model>` local model or a chat API backend.
// For a chat API backend a thread's grant still pins its own model and
// `POST /api/v3/threads` publishes no model parameter, so naming one cannot
// `POST /api/v1/threads` publishes no model parameter, so naming one cannot
// change which model answers. For `ollama:<model>` the local Ollama server is
// used directly and the named model is the one that runs.
const coderModelFlag = Flag.string("model").pipe(

      // coder without asking for one.
      const localModel =
        local && named === undefined && !offline && !resume
          ? yield* Effect.promise(() => discoverOllamaModel(process.env["OLLAMA_HOST"] || undefined))
          ? yield* Effect.promise(() =>
              discoverOllamaModel(process.env["OLLAMA_HOST"] || undefined),
            )
          : undefined;

      if (local && named === undefined && localModel === undefined && !offline && !resume) {

      // opencode already holds here. It is how a session runs on Ox Alpha,
      // which is free there and which no deployment serves.
      const wantsZen = named !== undefined && /^opencode:/.test(named);
      const zenAsked = wantsZen && named !== undefined ? named.slice("opencode:".length) : undefined;
      const zenAsked =
        wantsZen && named !== undefined ? named.slice("opencode:".length) : undefined;

      const wantsOllama = named === undefined ? localModel !== undefined : isOllamaModelFlag(named);
      const zenKey = wantsZen ? zenCredential() : undefined;

      if (resumed !== undefined) session.restore(resumed.entries);

      // The thread lane writes its transcript to the server as the turn loop
      // runs — `POST /api/v3/threads/{id}/events`, on the account token that
      // runs — `POST /api/v1/threads/{id}/events`, on the account token that
      // opened the thread. The server copy is the only durable copy; the
      // offline, Ollama, and stand-in lanes keep no record and attach nothing.
      // A failed post never reaches the turn loop: the writer queues, retries,

        );
      }


      // With --resume the positional argument named the thread, not a prompt.
      const oneShot = resume ? undefined : Option.getOrUndefined(prompt);
      const interactive = terminal.interactive && !plain && !flags.json && oneShot === undefined;

          // Flush before revoking: revoking makes the thread terminal, and a
          // terminal thread refuses the events that are still queued.
          if (transcript !== undefined) await transcript.close();
          if (thread !== undefined) await thread.revoke();
          if (childThread?.kind === "opened") await childThread.thread.revoke();
          // The thread outlives the session. It used to be revoked here, which
          // made `--resume` impossible by construction — every past session's
          // thread was already terminal — and put "This thread was revoked" in
          // front of anything that touched one again: a delegated child still
          // running, a second window, a resumed session. A thread is durable;
          // ending a session is not a reason to destroy it. `DELETE
          // /threads/{id}` is still there for a reader who means it.
          if (setup !== undefined) await setup.close();
        }
      });

          // The thread's slot goes back even on the failure path: an account
          // holds eight, and a script that delegates in a loop would otherwise
          // be refused on its ninth run.
          if (thread !== undefined) await thread.revoke();
          // Left open, for the same reason as above.
        }
      });


/**
 * The backends `openagents coder` can send a turn to.
 *
 * The server owns the real list and publishes it at `GET /api/v3/models`, and a
 * The server owns the real list and publishes it at `GET /api/v1/models`, and a
 * session that can reach the server reads it from there — see
 * `fetchServedCatalog` below. The list in this file is the fallback for a
 * session that cannot: `--offline`, or no stored credential.

 * so this list is what the flag validates against and what the status line
 * names, nothing more.
 *
 * The `id` is what `POST /api/v3/threads` takes as `model`. The `label` is what
 * The `id` is what `POST /api/v1/threads` takes as `model`. The `label` is what
 * a person reads in the status bar, where the whole line is competing for a
 * narrow terminal; a model the server serves and this file has never heard of
 * is labelled with its own id.
 */

import { API_VERSION_PATH } from "./constants.js";

export interface CoderBackend {
  /** The value the chat API takes as `model`. Matches the server's enum. */
  readonly id: string;

/** Every id, for a flag's error message and its accepted values. */
export const backendIds = (): readonly string[] => CODER_BACKENDS.map((backend) => backend.id);

/** One model as the server publishes it at `GET /api/v3/models`. */
/** One model as the server publishes it at `GET /api/v1/models`. */
export interface ServedModel {
  readonly id: string;
  /** Served here *and* its provider credential configured. */

  signal?: AbortSignal,
): Promise<readonly ServedModel[] | undefined> => {
  try {
    const response = await fetch(new URL("/api/v3/models", api.origin), {
    const response = await fetch(new URL(`${API_VERSION_PATH}/models`, api.origin), {
      headers: { authorization: `Bearer ${api.token}`, accept: "application/json" },
      signal: signal ?? AbortSignal.timeout(5_000),
    });

  const measured = entries.filter((entry) => entry.metrics !== undefined);
  if (measured.length === 0) return {};
  return {
    total_prompt_tokens: measured.reduce((sum, entry) => sum + (entry.metrics?.promptTokens ?? 0), 0),
    total_prompt_tokens: measured.reduce(
      (sum, entry) => sum + (entry.metrics?.promptTokens ?? 0),
      0,
    ),
    total_completion_tokens: measured.reduce(
      (sum, entry) => sum + (entry.metrics?.completionTokens ?? 0),
      0,

  // that contains a code span too wide.
  const plain = (text: string) => visibleWidth(styled(text, ""));


  const widths: number[] = [];
  for (let column = 0; column < columns; column += 1) {
    const widest = cells.reduce(

      .trimEnd();

  const out = [line(headings, BOLD)];
  out.push(
    `${DIM}${widths.map((room) => "─".repeat(room)).join("─".repeat(gap))}${RESET}`,
  );
  out.push(`${DIM}${widths.map((room) => "─".repeat(room)).join("─".repeat(gap))}${RESET}`);
  for (const row of cells) out.push(line(row, ""));
  return out;
}

 * Order within one stream is preserved, because a tool call and its result are
 * a sequence. Order between streams is arrival order, which is the point.
 */
export async function* merge<T>(
  streams: ReadonlyArray<AsyncIterable<T>>,
): AsyncIterable<T> {
export async function* merge<T>(streams: ReadonlyArray<AsyncIterable<T>>): AsyncIterable<T> {
  if (streams.length === 0) return;
  if (streams.length === 1) {
    yield* streams[0] as AsyncIterable<T>;

 */

import { Ollama } from "ollama";
import type { Message as OllamaMessage, Tool as OllamaTool, ToolCall as OllamaToolCall } from "ollama";
import type {
  Message as OllamaMessage,
  Tool as OllamaTool,
  ToolCall as OllamaToolCall,
} from "ollama";

import { declaredDescription } from "./coder-tool-families.js";
import { merge } from "./coder-merge.js";

 * Shared by discovery and by resolution, so the two cannot disagree about what
 * is on the machine.
 */
const installedModels = async (
  host: string,
  timeoutMs: number,
): Promise<ReadonlyArray<string>> => {
const installedModels = async (host: string, timeoutMs: number): Promise<ReadonlyArray<string>> => {
  try {
    const response = await fetch(new URL("/api/tags", host), {
      signal: AbortSignal.timeout(timeoutMs),

    try {
      yield* this.rounds(prompt, signal);
    } finally {
      yield { type: "usage", promptTokens: this.spentIn, completionTokens: this.spentOut, calls: this.calls };
      yield {
        type: "usage",
        promptTokens: this.spentIn,
        completionTokens: this.spentOut,
        calls: this.calls,
      };
    }
  }


      if (signal.aborted) return;
      yield* merge(calls.map((call) => this.invoke(call, signal)));
    }


  }

  /**

        return refuse("mount_invalid", `mount \`${mount.path}\` is not a directory`);
      }
    } catch {
      return refuse("mount_invalid", `mount \`${mount.path}\` does not resolve to a readable directory`);
      return refuse(
        "mount_invalid",
        `mount \`${mount.path}\` does not resolve to a readable directory`,
      );
    }
    mounts.push(root);
  }


  // Every import must be granted by a declared capability. Mounts grant
  // exactly two: the read_file and list_dir capability imports.
  const granted = new Set(
    mounts.length > 0 ? ["openagents.read_file", "openagents.list_dir"] : [],
  );
  const granted = new Set(mounts.length > 0 ? ["openagents.read_file", "openagents.list_dir"] : []);
  const undeclared = shape.imports.filter((name) => !granted.has(name));
  if (undeclared.length > 0) {
    const grantHint =

 * 2026-08-24: bare `--resume` shows a picker over recent threads filtered to
 * the current repository, `--resume <id>` names one directly, `--resume
 * --last` continues the most recent without asking, and `--all` drops the
 * repository filter. `GET /api/v3/threads` is the picker's list and
 * `GET /api/v3/threads/{id}/events` is the transcript it replays, paged
 * repository filter. `GET /api/v1/threads` is the picker's list and
 * `GET /api/v1/threads/{id}/events` is the transcript it replays, paged
 * through the `after` cursor because the listing caps at fifty and a working
 * session passes fifty events inside an hour.
 *

 * the server's own; posting them again would double the record.
 *
 * The repository filter prefers the thread's own field. Since
 * openagents.com #210, `POST /api/v3/threads` records a structured
 * openagents.com #210, `POST /api/v1/threads` records a structured
 * `repository` and every thread view returns it, so a summary takes that
 * first. Threads opened before the field existed carry none, so the objective
 * sentence this CLI composes (`openagents coder in <repo> on <branch>`) is


import type { CoderEntry } from "./coder-session.js";
import { boundedResult, ThreadUnavailable, type WireMessage } from "./coder-thread.js";

const THREADS_PATH = "/api/v3/threads";
import { THREADS_PATH } from "./constants.js";

/** The server's listing cap. Pages are read at exactly this size. */
const PAGE_LIMIT = 50;

/** One thread as `GET /api/v3/threads` reports it. */
/** One thread as `GET /api/v1/threads` reports it. */
export interface ThreadSummary {
  readonly id: string;
  readonly status: string;

  readonly branch: string | undefined;
}

/** One event as `GET /api/v3/threads/{id}/events` reports it. */
/** One event as `GET /api/v1/threads/{id}/events` reports it. */
export interface ThreadEvent {
  /** The cursor: a client continues from the last id it read. */
  readonly id: number;

    const tools = this.toolsFor(input.cwd);

    const resumed =
      input.resumeSessionId === undefined
        ? undefined
        : this.sessions.get(input.resumeSessionId);
      input.resumeSessionId === undefined ? undefined : this.sessions.get(input.resumeSessionId);

    const sessionId = input.resumeSessionId ?? this.mintSession();
    const transcript: WireMessage[] = resumed ?? [

    child.stderr.on("data", collect);

    child.on("error", (cause) => {
      finish({ output: `The command could not be started: ${cause.message}`, code: undefined, timedOut: false });
      finish({
        output: `The command could not be started: ${cause.message}`,
        code: undefined,
        timedOut: false,
      });
    });
    child.on("close", (code) => {
      finish({ output, code: code ?? undefined, timedOut: false });

 * ordinary skills otherwise: they appear in the catalog, and `/skills` switches
 * them off like any other.
 */
const SKILL_DIRECTORIES = (
  cwd: string,
  home: string,
  builtIn: string,
): ReadonlyArray<string> => [
const SKILL_DIRECTORIES = (cwd: string, home: string, builtIn: string): ReadonlyArray<string> => [
  join(cwd, ".agents", "skills"),
  join(home, ".agents", "skills"),
  builtIn,
];

/** The skills packaged with this CLI, beside the compiled output. */
const builtInSkills = (): string =>
  join(dirname(fileURLToPath(import.meta.url)), "..", "skills");
const builtInSkills = (): string => join(dirname(fileURLToPath(import.meta.url)), "..", "skills");

/** How much of one skill body is handed back. */
const BODY_LIMIT = 32_000;

    "most of the work, and they are easy to confuse:",
    "",
    "- **`openagents.com`** is the web application: a Phoenix and Elixir codebase serving the",
    "  site, the forge, and the `/api/v3` API. Its issues are the site's issues.",
    "  site, the forge, and the `/api/v1` API. Its issues are the site's issues.",
    "- **`openagents`** is the monorepo: the `openagents` CLI lives in",
    "  `packages/openagents-cli`, alongside the other packages. Its issues are the CLI's and the",
    "  monorepo's.",

 * otherwise be told to `cd` somewhere that does not exist, which is a worse
 * instruction than none.
 */
const siblingCheckout = (cwd: string): { readonly name: string; readonly path: string } | undefined => {
const siblingCheckout = (
  cwd: string,
): { readonly name: string; readonly path: string } | undefined => {
  const here = basename(cwd);
  const other = here === "openagents.com" ? "openagents" : here === "openagents" ? "openagents.com" : undefined;
  const other =
    here === "openagents.com" ? "openagents" : here === "openagents" ? "openagents.com" : undefined;
  if (other === undefined) return undefined;

  const path = join(dirname(cwd), other);

 * A reply source backed by a thread of the caller's own, and the grant that
 * thread mints.
 *
 * `openagents coder` used to submit through `POST /api/v3/chat/turns` and poll
 * `GET /api/v3/chat/events`. That was the only route a user token could reach a
 * `openagents coder` used to submit through `POST /api/v1/chat/turns` and poll
 * `GET /api/v1/chat/events`. That was the only route a user token could reach a
 * model through, and the server records one conversation per account, so every
 * prompt a person typed in a terminal landed in the same conversation `/chat`
 * reads, contended for the one streaming slot that conversation admits, and
 * became provider context for the next question asked in the browser. This
 * replaces both paths.
 *
 * `POST /api/v3/threads` opens a thread and returns a grant. The grant is the
 * `POST /api/v1/threads` opens a thread and returns a grant. The grant is the
 * bearer for `POST /api/inference/proxy`, an OpenAI-compatible
 * `/chat/completions` surface that meters against the thread's own budget and
 * keeps the provider credential on the server, so the CLI still holds no
 * provider key. `DELETE /api/v3/threads/{id}` revokes the thread on exit, which
 * provider key. `DELETE /api/v1/threads/{id}` revokes the thread on exit, which
 * matters because an account may hold only eight open threads at once and a
 * closed terminal would otherwise hold a slot until its authority was spent.
 *

import type { CoderTool } from "./coder-tools.js";
import { systemPrompt, THREAD_LANE } from "./coder-system.js";
import type { TranscriptSink } from "./coder-transcript.js";

const THREADS_PATH = "/api/v3/threads";
import { THREADS_PATH } from "./constants.js";

/**
 * How many rounds of tool calls one turn may take before it has to answer.

 * it revokes every active grant naming the thread, bumps the thread's
 * generation, and mints fresh authority against the same thread — the grant
 * lineage a resume is supposed to continue. This client asks for that at
 * `POST /api/v3/threads/{id}/grants`.
 * `POST /api/v1/threads/{id}/grants`.
 *
 * Today the server publishes no such route. `GET /api/v3/threads/{id}` reports
 * Today the server publishes no such route. `GET /api/v1/threads/{id}` reports
 * the grant's status and limits but never its token — the plaintext exists
 * exactly once, at minting — so there is no other honest way to spend an
 * existing thread. A 404 here is therefore the server saying it cannot yet

    throw new ThreadUnavailable(
      "grant_unavailable",
      "This server cannot hand back authority for an existing thread: " +
        "GET /api/v3/threads/{id} reports the grant without its token, and " +
        "POST /api/v3/threads/{id}/grants is not there to re-mint one. " +
        "GET /api/v1/threads/{id} reports the grant without its token, and " +
        "POST /api/v1/threads/{id}/grants is not there to re-mint one. " +
        "The transcript is readable, but new turns cannot spend this thread " +
        "until the server can re-grant it.",
      response.status,

      if (response.status >= 200 && response.status < 300) return response;

      const refusal = await proxyRefusal(response);
      const transient = response.status === 502 || response.status === 503 || response.status === 504;
      const transient =
        response.status === 502 || response.status === 503 || response.status === 504;
      if (!transient || attempt >= attempts) throw refusal;

      // Short and fixed. The failure is on the provider's side and a reader is

    if (response === undefined || signal.aborted) return;
    if (response.body === null) return;


    /** Tool call fragments by their wire index, assembled as frames arrive. */
    const calls = new Map<number, { id: string; name: string; args: string }>();


  const code = string(error["code"]) ?? `http_${response.status}`;

  const sentences: Record<string, string> = {
    grant_revoked: "This thread was revoked. Start a new session to open another.",
    // Only reachable when someone deliberately revoked this thread — a session
    // no longer does it on the way out. The sentence says what to do rather
    // than naming a lifecycle the reader did not ask about.
    grant_revoked: "This thread is no longer live. Start a new session to open another.",
    // Not a sentence about a clock. A thread's authority has no deadline —
    // this reaches a caller only where the deployment minted one that does,
    // and it says what the reader can act on rather than naming an expiry a
    // coder session cannot have.
    grant_expired: "This thread's authority is no longer live. Start a new session to open another.",
    grant_expired:
      "This thread's authority is no longer live. Start a new session to open another.",
    grant_exhausted: "This thread spent its budget. Start a new session to open another.",
    grant_budget_reached: "This thread reached its budget ceiling and cannot buy another call.",
    invalid_grant: "The inference proxy did not recognize this thread's grant.",

};

function record(value: unknown): Record<string, unknown> {

  return typeof value === "object" && value !== null && !Array.isArray(value)
    ? (value as Record<string, unknown>)
    : {};

    if (block === null) continue;
    const names = [...(block[1] ?? "").matchAll(/'([a-z][a-z0-9-]*):/g)].map((found) => found[1]);
    if (names.length === 0) continue;
    lines.push(owner.length === 0 ? `openagents ${names.join(" | ")}` : `  ${owner} ${names.join(" | ")}`);
    lines.push(
      owner.length === 0 ? `openagents ${names.join(" | ")}` : `  ${owner} ${names.join(" | ")}`,
    );
  }
  return lines.length === 0 ? undefined : lines.join("\n");
};

        ? rawArgs["args"].filter((word): word is string => typeof word === "string")
        : [];
      if (args.length === 0) {
        return "No command was run: `args` is required, such as [\"--help\"].";
        return 'No command was run: `args` is required, such as ["--help"].';
      }

      const refusal = refusalFor(args);


        const timer = setTimeout(() => {
          child.kill("SIGKILL");
          finish(`The command did not finish within ${String(CLI_TIMEOUT_MS / 1000)}s.\n\n${output}`);
          finish(
            `The command did not finish within ${String(CLI_TIMEOUT_MS / 1000)}s.\n\n${output}`,
          );
        }, CLI_TIMEOUT_MS);

        const onAbort = () => {

      const refusal = shellRefusalFor(command);
      if (refusal !== undefined) return refusal;

      const asked = typeof args["timeout_seconds"] === "number" ? args["timeout_seconds"] : undefined;
      const asked =
        typeof args["timeout_seconds"] === "number" ? args["timeout_seconds"] : undefined;
      const timeoutMs = Math.min(
        asked === undefined ? DEFAULT_TIMEOUT_MS : Math.max(1, Math.trunc(asked)) * 1000,
        MAXIMUM_TIMEOUT_MS,

/**
 * The thread's durable transcript, written as the turn loop runs.
 *
 * `POST /api/v3/threads/{id}/events` is append-only and the server's copy is
 * `POST /api/v1/threads/{id}/events` is append-only and the server's copy is
 * the only copy: this process keeps no file of its own, so what lands here is
 * what `--resume`, the export, and every other machine reading the thread will
 * ever see. The vocabulary is the one decided in the openagents.com audit of

 * throwing into the loop that called it.
 */

const THREADS_PATH = "/api/v3/threads";
import { THREADS_PATH } from "./constants.js";

/**
 * How many consecutive failed posts before the reader is told once.

      return out;
    };

    const renderEntry = (entry: CoderEntry, width: number, tasks: ReadonlyArray<CoderTask>): ReadonlyArray<string> => {
    const renderEntry = (
      entry: CoderEntry,
      width: number,
      tasks: ReadonlyArray<CoderTask>,
    ): ReadonlyArray<string> => {
      const color =
        entry.role === "you"
          ? CYAN

      });
    };

    const entryRows = (entry: CoderEntry, width: number, tasks: ReadonlyArray<CoderTask>): ReadonlyArray<string> => {
    const entryRows = (
      entry: CoderEntry,
      width: number,
      tasks: ReadonlyArray<CoderTask>,
    ): ReadonlyArray<string> => {
      if (entry.role === "tool" && entry.tool !== undefined) {
        return toolRows(entry.tool, width, expanded.has(entry.tool.callId), tasks);
      }

      return wrapStyled(entry.text, width, entry.role === "notice" ? DIM : "");
    };

    const toolRows = (tool: CoderToolCall, width: number, open: boolean, tasks: ReadonlyArray<CoderTask>): ReadonlyArray<string> => {
    const toolRows = (
      tool: CoderToolCall,
      width: number,
      open: boolean,
      tasks: ReadonlyArray<CoderTask>,
    ): ReadonlyArray<string> => {
      const mark =
        tool.status === "running"
          ? `${YELLOW}◐${RESET}`

        Math.max(8, width - tool.name.length - 4),
      );
      const rows = [
        `${mark} ${BOLD}${tool.name}${RESET}` + (summary.length === 0 ? "" : ` ${DIM}${summary}${RESET}`),
        `${mark} ${BOLD}${tool.name}${RESET}` +
          (summary.length === 0 ? "" : ` ${DIM}${summary}${RESET}`),
      ];

      if (tool.name === "delegate" && tool.status === "running") {

          case "tool":
            rows.push(
              `${YELLOW}▸${RESET} ${BOLD}${entry.name}${RESET}` +
                (entry.target === undefined ? "" : ` ${DIM}${truncate(entry.target, body - 6)}${RESET}`),
                (entry.target === undefined
                  ? ""
                  : ` ${DIM}${truncate(entry.target, body - 6)}${RESET}`),
            );
            break;


        return;
      }

      paint(
        rows,
        transcriptHeight + 3,
        4 + [...visible].length + 1,
      );
      paint(rows, transcriptHeight + 3, 4 + [...visible].length + 1);
    };

    /**

          const columnOpen =
            children.length > 0 && (stdout.columns ?? 80) >= SIDEBAR_MINIMUM_TERMINAL;

          if (focus === "composer" && columnOpen && (sequence === "\x1b[C" || sequence === "\x1bOC")) {
          if (
            focus === "composer" &&
            columnOpen &&
            (sequence === "\x1b[C" || sequence === "\x1bOC")
          ) {
            focus = "sidebar";
            sidebarRow = Math.min(sidebarRow, children.length - 1);
            render();

        if (payload === undefined) continue;

        const usage = payload["usage"];
        if (typeof usage === "object" && usage !== null) this.spend(usage as Record<string, unknown>);
        if (typeof usage === "object" && usage !== null)
          this.spend(usage as Record<string, unknown>);

        const choices = payload["choices"];
        if (!Array.isArray(choices)) continue;

1	+	`/**`
2	+	`* The base path for all versioned OpenAgents API routes.`
3	+	`*`
4	+	`* All versioned REST resources live under this prefix. A passthrough path`
5	+	`* without a leading slash resolves under it.`
6	+	`*/`
7	+	`export const API_BASE_PATH = "/api/v1/";`
8	+
9	+	`/**`
10	+	`* The versioned API prefix without a trailing slash, used to construct`
11	+	`* route paths for specific endpoints across CLI clients.`
12	+	`*/`
13	+	`export const API_VERSION_PATH = "/api/v1";`
14	+
15	+	`/**`
16	+	`* The endpoint path for coder threads.`
17	+	`*/`
18	+	export const THREADS_PATH = `${API_VERSION_PATH}/threads`;
19	+
20	+	`/**`
21	+	`* The endpoint path for operator fleet targets.`
22	+	`*/`
23	+	export const FLEET_TARGETS_PATH = `${API_VERSION_PATH}/admin/forge/targets`;

import * as Context from "effect/Context";

import { ApiTransport } from "./api-transport.js";
import { API_VERSION_PATH } from "./constants.js";
import { ApiError, ContractError, type CliError } from "./errors.js";

export const DeviceAuthorization = Schema.Struct({

      const response = yield* transport.request({
        origin,
        method: "POST",
        path: "/api/v3/device/authorizations",
        path: `${API_VERSION_PATH}/device/authorizations`,
        // The server decides the default scope set. Asking for none keeps that
        // decision on the server; asking names exactly what the approval page
        // must show the person approving it.

        .request({
          origin,
          method: "POST",
          path: "/api/v3/device/authorizations/token",
          path: `${API_VERSION_PATH}/device/authorizations/token`,
          body: { device_code: authorization.device_code },
        })
        .pipe(

 * The operator fleet promotion client.
 *
 * It speaks only the operator API from OpenAgentsInc/openagents.com#57 —
 * `POST/GET /api/v3/admin/forge/targets` — behind the same `/api/v3` error
 * `POST/GET /api/v1/admin/forge/targets` — behind the same `/api/v1` error
 * envelope every other command family reads. It never touches `/admin/forge`,
 * SSH, or any internal RPC, and it adds only what a terminal caller cannot do
 * for itself: an idempotent re-send after a failed transport, and bounded

import * as Context from "effect/Context";

import { ApiTransport } from "./api-transport.js";
import { FLEET_TARGETS_PATH } from "./constants.js";
import { ApiError, DeploymentWaitTimeout, type CliError } from "./errors.js";
import type { AuthenticatedApi } from "./repository-client.js";
import { asRecord, asText, makeTrackerRequest, trackerErrorDetails } from "./tracker-request.js";

/** The one route family from OpenAgentsInc/openagents.com#57. */
export const FLEET_TARGETS_PATH = "/api/v3/admin/forge/targets";
export { FLEET_TARGETS_PATH };

/** The privileged scope the server requires; `forge:write` cannot promote. */
export const OPERATOR_SCOPE = "deployments:promote";

import * as Context from "effect/Context";

import { ApiTransport, type ApiRequest } from "./api-transport.js";
import { API_VERSION_PATH } from "./constants.js";
import { ApiError, type CliError } from "./errors.js";

/** An origin and the token that authorizes a request against it. */

      request,

      boards: (input) =>
        request("list forum boards", { ...input, method: "GET", path: "/api/v3/forum" }),
        request("list forum boards", {
          ...input,
          method: "GET",
          path: `${API_VERSION_PATH}/forum`,
        }),

      topics: (input) =>
        request("list forum topics", {
          ...input,
          method: "GET",
          path: `/api/v3/forum/topics?forum=${encodeURIComponent(input.board)}${
          path: `${API_VERSION_PATH}/forum/topics?forum=${encodeURIComponent(input.board)}${
            input.page === undefined ? "" : `&page=${input.page}`
          }`,
        }),

        request("read a forum topic", {
          ...input,
          method: "GET",
          path: `/api/v3/forum/topics/${encodeURIComponent(input.id)}${
          path: `${API_VERSION_PATH}/forum/topics/${encodeURIComponent(input.id)}${
            input.page === undefined ? "" : `?page=${input.page}`
          }`,
        }),

        request("create a forum topic", {
          ...input,
          method: "POST",
          path: "/api/v3/forum/topics",
          path: `${API_VERSION_PATH}/forum/topics`,
          body: { forum: input.board, title: input.title, body_text: input.bodyText },
        }),


        request("reply to a forum topic", {
          ...input,
          method: "POST",
          path: `/api/v3/forum/topics/${encodeURIComponent(input.topicId)}/posts`,
          path: `${API_VERSION_PATH}/forum/topics/${encodeURIComponent(input.topicId)}/posts`,
          body: { body_text: input.bodyText },
        }),


        request("claim a legacy forum identity", {
          ...input,
          method: "POST",
          path: "/api/v3/forum/claims",
          path: `${API_VERSION_PATH}/forum/claims`,
          body: { actor_ref: input.actorRef },
        }),

      claims: (input) =>
        request("list identity claims", { ...input, method: "GET", path: "/api/v3/forum/claims" }),
        request("list identity claims", {
          ...input,
          method: "GET",
          path: `${API_VERSION_PATH}/forum/claims`,
        }),
    };
  }),
);

export * from "./computer-journal.js";
export * from "./computer-policy.js";
export * from "./computer-probe.js";
export * from "./constants.js";
export * from "./credential-store.js";
export * from "./device-authorization-store.js";
export * from "./endpoint.js";

 * The issue API client.
 *
 * The routes it calls answer with the GitHub-compatible shapes this
 * repository publishes at `GET /api/v3`, so the client keeps the server's
 * repository publishes at `GET /api/v1`, so the client keeps the server's
 * bodies intact and adds only what a terminal caller cannot do for itself:
 * paging a list that has no `per_page` parameter, and reporting a rejected
 * write by the field the server named.

  repositoryFromAcceptedImport,
} from "./api-contract.js";
import { ApiTransport } from "./api-transport.js";
import { API_VERSION_PATH } from "./constants.js";
import {
  ApiError,
  ContractError,

      const poll = request("read repository provisioning state", {
        ...input,
        method: "GET",
        path: `/api/v3/repos/${encoded(input.owner)}/${encoded(input.repo)}`,
        path: `${API_VERSION_PATH}/repos/${encoded(input.owner)}/${encoded(input.repo)}`,
        acceptedStatuses: [200],
      }).pipe(
        Effect.flatMap((value) => decode("read repository provisioning state", Repository, value)),

        ...(input.defaultBranch === undefined ? {} : { default_branch: input.defaultBranch }),
      };
      const path =
        owner === undefined ? "/api/v3/user/repos" : `/api/v3/orgs/${encoded(owner)}/repos`;
        owner === undefined
          ? `${API_VERSION_PATH}/user/repos`
          : `${API_VERSION_PATH}/orgs/${encoded(owner)}/repos`;
      const value = yield* retryMutation(
        request("create repository", {
          ...input,

      const responseBody = yield* request("read authenticated user", {
        ...input,
        method: "GET",
        path: "/api/v3/user",
        path: `${API_VERSION_PATH}/user`,
        acceptedStatuses: [200],
      });
      return yield* decode("read authenticated user", AuthenticatedUser, responseBody);

      const responseBody = yield* request("list repositories", {
        ...input,
        method: "GET",
        path: `/api/v3/user/repos?${parameters.toString()}`,
        path: `${API_VERSION_PATH}/user/repos?${parameters.toString()}`,
        acceptedStatuses: [200],
      });
      const pageResponse = yield* decode("list repositories", RepositoryListResponse, responseBody);

      const value = yield* request("view repository", {
        ...input,
        method: "GET",
        path: `/api/v3/repos/${encoded(owner)}/${encoded(repo)}`,
        path: `${API_VERSION_PATH}/repos/${encoded(owner)}/${encoded(repo)}`,
        acceptedStatuses: [200],
      });
      return yield* decode("view repository", RepositoryResponse, value);

      yield* request("delete repository", {
        ...input,
        method: "DELETE",
        path: `/api/v3/repos/${encoded(owner)}/${encoded(repo)}`,
        path: `${API_VERSION_PATH}/repos/${encoded(owner)}/${encoded(repo)}`,
        acceptedStatuses: [204],
      });
    });

      const value = yield* request("read repository import", {
        ...input,
        method: "GET",
        path: `/api/v3/repository-imports/${encoded(input.importId)}`,
        path: `${API_VERSION_PATH}/repository-imports/${encoded(input.importId)}`,
        acceptedStatuses: [200],
      });
      return yield* decode("read repository import", RepositoryImportStatusResponse, value);

      };
      const path =
        owner === undefined
          ? "/api/v3/user/repos/imports"
          : `/api/v3/orgs/${encoded(owner)}/repos/imports`;
          ? `${API_VERSION_PATH}/user/repos/imports`
          : `${API_VERSION_PATH}/orgs/${encoded(owner)}/repos/imports`;
      const value = yield* retryMutation(
        request("import repository", {
          ...input,

import { Argument, Command, Flag } from "effect/unstable/cli";

import { InputError, TraceUploadUnsupported } from "./errors.js";
import { API_VERSION_PATH } from "./constants.js";
import { Output, type OutputMode } from "./output.js";
import {
  defaultDiscoveryBounds,

/** The server half `trace upload` is waiting for. One place, one sentence. */
export const TRACE_INGEST_ROUTE_GAP =
  "openagents.com has no trace ingest route yet. Upload needs the server half first: " +
  "POST /api/v3/traces accepting an ATIF v1.7 document with owner_only default visibility. " +
  `POST ${API_VERSION_PATH}/traces accepting an ATIF v1.7 document with owner_only default visibility. ` +
  "Until that route exists, this command refuses rather than pretending to upload.";

const listPathFlag = Flag.string("path").pipe(

/**
 * The request seam the issue and project clients share.
 *
 * Both talk to the same `/api/v3` routes behind the same unified error
 * Both talk to the same `/api/v1` routes behind the same unified error
 * envelope from issue #82, so the transport call, the accepted-status check,
 * and the failure translation live once rather than twice.
 */

import { Effect } from "effect";

import type { ApiTransportInterface, HttpMethod } from "./api-transport.js";
import { API_VERSION_PATH } from "./constants.js";
import { ApiError } from "./errors.js";
import type { AuthenticatedApi } from "./repository-client.js";


100	101
101	102		`/** The path prefix every repository-scoped tracker route shares. */`
102	103		`export const repositoryPath = (owner: string, repo: string): string =>`
103		-	`/api/v3/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`;
	104	+	`${API_VERSION_PATH}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`;

    expect(harnessed.requests).toHaveLength(1);
    expect(harnessed.requests[0]?.origin).toBe("http://localhost:4000");
    expect(harnessed.requests[0]?.method).toBe("GET");
    expect(harnessed.requests[0]?.path).toBe("/api/v3/repos/octavia/project/issues");
    expect(harnessed.requests[0]?.path).toBe("/api/v1/repos/octavia/project/issues");
    expect(Redacted.value(harnessed.requests[0]?.token ?? Redacted.make(""))).toBe(
      "oa_pat_fixture",
    );

  it("accepts an absolute API path and a relative path as the same route", async () => {
    const harnessed = harness({ token: "oa_pat_fixture" });
    await run(harnessed, ["api", "repos/octavia/project/issues"]);
    await run(harnessed, ["api", "/api/v3/repos/octavia/project/issues"]);
    await run(harnessed, ["api", "/api/v1/repos/octavia/project/issues"]);
    expect(harnessed.requests.map((request) => request.path)).toEqual([
      "/api/v3/repos/octavia/project/issues",
      "/api/v3/repos/octavia/project/issues",
      "/api/v1/repos/octavia/project/issues",
      "/api/v1/repos/octavia/project/issues",
    ]);
  });

  it("refuses a path that leaves the configured origin", async () => {
    const harnessed = harness({ token: "oa_pat_fixture" });
    const failure = await failureOf(harnessed, ["api", "https://openagents.com/api/v3/user"]);
    const failure = await failureOf(harnessed, ["api", "https://openagents.com/api/v1/user"]);
    expect(failure._tag).toBe("OpenAgentsCli.InputError");
    expect(failure.message).toContain("leaves the configured API origin");
    expect(harnessed.requests).toHaveLength(0);

    });
    const failure = await failureOf(harnessed, ["api", "repos/octavia/project/issues/9999"]);
    expect(failure._tag).toBe("OpenAgentsCli.ApiError");
    expect(failure.message).toContain("HTTP 404 for GET /api/v3/repos/octavia/project/issues/9999");
    expect(failure.message).toContain("HTTP 404 for GET /api/v1/repos/octavia/project/issues/9999");
    expect(failure.message).toContain("Not Found");
    if (failure._tag === "OpenAgentsCli.ApiError") {
      expect(failure.status).toBe(404);

      expect(result.code).toBe(0);
      expect(JSON.parse(result.stdout)).toEqual({ number: 41 });
      expect(server.received[0]?.method).toBe("POST");
      expect(server.received[0]?.url).toBe("/api/v3/repos/octavia/project/issues");
      expect(server.received[0]?.url).toBe("/api/v1/repos/octavia/project/issues");
      expect(server.received[0]?.headers.authorization).toBe("Bearer oa_pat_loopback-fixture");
      expect(JSON.parse(server.received[0]?.body ?? "")).toEqual({
        title: "From stdin",

      expect(result.stdout).toBe("");
      expect(result.stderr).toContain("Not Found");
      expect(result.stderr).toContain("Request id: request-loopback");
      expect(result.stderr).toContain("HTTP 404 for GET /api/v3/repos/octavia/project/issues/9999");
      expect(result.stderr).toContain("HTTP 404 for GET /api/v1/repos/octavia/project/issues/9999");
    } finally {
      await server.close();
    }


  it("keeps an absolute API path unchanged", async () => {
    await expect(
      Effect.runPromise(resolveApiPath(origin, "/api/v3/repos/octavia/project/issues")),
    ).resolves.toBe("/api/v3/repos/octavia/project/issues");
      Effect.runPromise(resolveApiPath(origin, "/api/v1/repos/octavia/project/issues")),
    ).resolves.toBe("/api/v1/repos/octavia/project/issues");
  });

  it("preserves a query string in both forms", async () => {

      Effect.runPromise(resolveApiPath(origin, "repos/octavia/project/issues?state=closed")),
    ).resolves.toBe(`${API_BASE_PATH}repos/octavia/project/issues?state=closed`);
    await expect(
      Effect.runPromise(resolveApiPath(origin, "/api/v3/labels?per_page=5")),
    ).resolves.toBe("/api/v3/labels?per_page=5");
      Effect.runPromise(resolveApiPath(origin, "/api/v1/labels?per_page=5")),
    ).resolves.toBe("/api/v1/labels?per_page=5");
  });

  it("accepts a complete URL on the configured origin", async () => {
    await expect(Effect.runPromise(resolveApiPath(origin, `${origin}/api/v3/user`))).resolves.toBe(
      "/api/v3/user",
    await expect(Effect.runPromise(resolveApiPath(origin, `${origin}/api/v1/user`))).resolves.toBe(
      "/api/v1/user",
    );
  });

  it.each([
    "https://openagents.com/api/v3/user",
    "//openagents.com/api/v3/user",
    "http://127.0.0.1:5000/api/v3/user",
    "https://openagents.com/api/v1/user",
    "//openagents.com/api/v1/user",
    "http://127.0.0.1:5000/api/v1/user",
  ])("refuses %s because it leaves the configured origin", async (path) => {
    expect(await failureText(resolveApiPath(origin, path))).toContain("leaves the configured");
  });

  });

  it("publishes ids the chat API's own enum lists", () => {
    // These are the values `POST /api/v3/chat/turns` accepts as `model`, so a
    // These are the values `POST /api/v1/chat/turns` accepts as `model`, so a
    // change here without the matching server change is a refusal at runtime.
    expect(backendIds()).toEqual(["gemini-3.7-flash", "ox-alpha", "gpt-5.6-luna"]);
  });

  });

  it("says so plainly when the deployment can run nothing", () => {
    const refusal = refuseBackend([{ id: "ox-alpha", available: false, isDefault: true }], "ox-alpha");
    const refusal = refuseBackend(
      [{ id: "ox-alpha", available: false, isDefault: true }],
      "ox-alpha",
    );
    expect(refusal).toContain("no model with a configured credential");
  });
});

  it("reads ids and availability from the server's own shape", async () => {
    const served = await withFetch(
      (url) => {
        expect(url).toBe("http://localhost:4000/api/v3/models");
        expect(url).toBe("http://localhost:4000/api/v1/models");
        return new Response(
          JSON.stringify({
            default: "gpt-5.6-luna",

/** A directory tree with a Phoenix `mix.exs` at its root. */
const siteCheckout = () => {
  const root = mkdtempSync(join(tmpdir(), "oa-site-"));
  writeFileSync(join(root, "mix.exs"), "def project do\n  [app: :openagents, version: \"0.1.0\"]\nend\n");
  writeFileSync(
    join(root, "mix.exs"),
    'def project do\n  [app: :openagents, version: "0.1.0"]\nend\n',
  );
  mkdirSync(join(root, "lib", "openagents_web"), { recursive: true });
  return root;
};

    const root = siteCheckout();
    // Falls through to the search rather than starting `mix` somewhere that
    // will fail a minute later and less clearly.
    expect(findSiteCheckout(root, { OPENAGENTS_COM_PATH: mkdtempSync(join(tmpdir(), "oa-not-")) })).toBe(
      root,
    );
    expect(
      findSiteCheckout(root, { OPENAGENTS_COM_PATH: mkdtempSync(join(tmpdir(), "oa-not-")) }),
    ).toBe(root);
  });

  it("does not take a Mix project that is some other application", () => {

  it("does not count a server whose database is behind as ready", async () => {
    // Phoenix answers this as its own debug page, so it is a live server that
    // cannot serve yet — neither ready nor absent.
    stub(() => new Response("<html>Phoenix.Ecto.PendingMigrationError at GET /healthz</html>", { status: 500 }));
    stub(
      () =>
        new Response("<html>Phoenix.Ecto.PendingMigrationError at GET /healthz</html>", {
          status: 500,
        }),
    );
    expect(await devServerReady("http://localhost:4000")).toBe(false);
  });


      entry({ role: "you", text: "a real question" }),
    ]);

    expect(document["steps"]).toEqual([
      expect.objectContaining({ message: "a real question" }),
    ]);
    expect(document["steps"]).toEqual([expect.objectContaining({ message: "a real question" })]);
  });

  it("leaves out the empty entry the interface opens for the caret", () => {

    expect(document["steps"]).toHaveLength(1);
  });


  it("records what a turn cost, and how many calls that was", () => {
    const { document } = write([
      entry({ role: "you", text: "ask" }),

    expect(document["final_metrics"]).toEqual({ total_steps: 1 });
  });


  it("takes the clipboard only when asked to", () => {
    const directory = mkdtempSync(join(tmpdir(), "coder-export-"));


    expect(messages.at(-1)).toMatchObject({ content: "child 1 said PONG", tool_name: "delegate" });
  });



  it("keeps the turn's reasoning on the transcript it sends back", async () => {
    const { source, stub } = sourceWith([
      [

describe("finding a local model to default to", () => {
  const serve = (body: unknown, status = 200) =>
    vi.spyOn(globalThis, "fetch").mockResolvedValue(
      new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } }),
      new Response(JSON.stringify(body), {
        status,
        headers: { "content-type": "application/json" },
      }),
    );

  afterEach(() => {

import { runCoderUi } from "../src/coder-ui.js";

class FakeOut extends EventEmitter {
  columns = 100; rows = 24; written = "";
  write(t: string) { this.written += t; return true; }
  columns = 100;
  rows = 24;
  written = "";
  write(t: string) {
    this.written += t;
    return true;
  }
}
class FakeIn extends EventEmitter {
  isTTY = true;
  setRawMode(){return this;} resume(){return this;} pause(){return this;} setEncoding(){return this;}
  setRawMode() {
    return this;
  }
  resume() {
    return this;
  }
  pause() {
    return this;
  }
  setEncoding() {
    return this;
  }
}

describe("pasting", () => {
  it("keeps a multi-line paste as one message", async () => {
    const sent: string[] = [];
    const src: ReplySource = { model: "m", async *reply(p: string) { sent.push(p); yield { type: "text", value: "ok" } as const; } };
    const stdin = new FakeIn(); const stdout = new FakeOut();
    const src: ReplySource = {
      model: "m",
      async *reply(p: string) {
        sent.push(p);
        yield { type: "text", value: "ok" } as const;
      },
    };
    const stdin = new FakeIn();
    const stdout = new FakeOut();
    const session = new CoderSession(src, "repo", "main");
    const running = runCoderUi(session, { stdin: stdin as never, stdout: stdout as never });


    await new Promise((r) => setTimeout(r, 20));

    expect(sent).toEqual(["line one\nline two\nline three"]);
    stdin.emit("data", "\x04"); await running;
    stdin.emit("data", "\x04");
    await running;
  });

  it("holds a paste whose end has not arrived", async () => {
    const sent: string[] = [];
    const src: ReplySource = { model: "m", async *reply(p: string) { sent.push(p); yield { type: "text", value: "ok" } as const; } };
    const stdin = new FakeIn(); const stdout = new FakeOut();
    const src: ReplySource = {
      model: "m",
      async *reply(p: string) {
        sent.push(p);
        yield { type: "text", value: "ok" } as const;
      },
    };
    const stdin = new FakeIn();
    const stdout = new FakeOut();
    const session = new CoderSession(src, "repo", "main");
    const running = runCoderUi(session, { stdin: stdin as never, stdout: stdout as never });


    await new Promise((r) => setTimeout(r, 20));

    expect(sent).toEqual(["first\nsecond"]);
    stdin.emit("data", "\x04"); await running;
    stdin.emit("data", "\x04");
    await running;
  });

  it("shows a paste as a blob rather than as its last line", async () => {
    const src: ReplySource = { model: "m", async *reply() { yield { type: "text", value: "ok" } as const; } };
    const stdin = new FakeIn(); const stdout = new FakeOut();
    const src: ReplySource = {
      model: "m",
      async *reply() {
        yield { type: "text", value: "ok" } as const;
      },
    };
    const stdin = new FakeIn();
    const stdout = new FakeOut();
    const session = new CoderSession(src, "repo", "main");
    const running = runCoderUi(session, { stdin: stdin as never, stdout: stdout as never });


    // Ctrl+D quits only an empty composer, which is why escape comes first.
    stdin.emit("data", ESC);
    await new Promise((r) => setTimeout(r, 60));
    stdin.emit("data", "\x04"); await running;
    stdin.emit("data", "\x04");
    await running;
  });

  it("asks the terminal to bracket pastes, and stops asking on the way out", async () => {
    const src: ReplySource = { model: "m", async *reply() { yield { type: "text", value: "ok" } as const; } };
    const stdin = new FakeIn(); const stdout = new FakeOut();
    const src: ReplySource = {
      model: "m",
      async *reply() {
        yield { type: "text", value: "ok" } as const;
      },
    };
    const stdin = new FakeIn();
    const stdout = new FakeOut();
    const session = new CoderSession(src, "repo", "main");
    const running = runCoderUi(session, { stdin: stdin as never, stdout: stdout as never });


    // in it is an enter.
    expect(stdout.written).toContain(`${ESC}[?2004h`);

    stdin.emit("data", "\x04"); await running;
    stdin.emit("data", "\x04");
    await running;

    expect(stdout.written).toContain(`${ESC}[?2004l`);
  });

});

 */
const stage = (mutateManifest?: (manifest: Record<string, unknown>) => void): string => {
  const dir = mkdtempSync(join(tmpdir(), "plugin-listdir-"));
  const manifest = JSON.parse(readFileSync(DIR_STATS_MANIFEST, "utf8")) as Record<
    string,
    unknown
  >;
  const manifest = JSON.parse(readFileSync(DIR_STATS_MANIFEST, "utf8")) as Record<string, unknown>;
  mutateManifest?.(manifest);
  writeFileSync(join(dir, "manifest.json"), JSON.stringify(manifest));
  copyFileSync(DIR_STATS_WASM, join(dir, "dir_stats.wasm"));

 */
const stage = (mutateManifest?: (manifest: Record<string, unknown>) => void): string => {
  const dir = mkdtempSync(join(tmpdir(), "plugin-mount-"));
  const manifest = JSON.parse(readFileSync(FILE_STATS_MANIFEST, "utf8")) as Record<
    string,
    unknown
  >;
  const manifest = JSON.parse(readFileSync(FILE_STATS_MANIFEST, "utf8")) as Record<string, unknown>;
  mutateManifest?.(manifest);
  writeFileSync(join(dir, "manifest.json"), JSON.stringify(manifest));
  copyFileSync(FILE_STATS_WASM, join(dir, "file_stats.wasm"));

  const packet = new TextEncoder().encode(JSON.stringify({ path }));
  const outcome = await invokePlugin(plugin, packet);
  if (isRefusal(outcome)) throw new Error(`${outcome.code}: ${outcome.reason}`);
  return JSON.parse(new TextDecoder().decode(outcome)) as Record<
    string,
    Record<string, unknown>
  >;
  return JSON.parse(new TextDecoder().decode(outcome)) as Record<string, Record<string, unknown>>;
};

describe("read-only mounts", () => {


    const threads = await listThreads({ origin: ORIGIN, token: TOKEN, fetch: transport });

    expect(calls[0]?.url).toBe(`${ORIGIN}/api/v3/threads?limit=50`);
    expect(calls[0]?.url).toBe(`${ORIGIN}/api/v1/threads?limit=50`);
    expect(calls[0]?.authorization).toBe(`Bearer ${TOKEN}`);
    expect(threads).toHaveLength(1);
    expect(threads[0]?.repository).toBe("openagents");

    expect(events).toHaveLength(120);
    expect(events.map((event) => event.id)).toEqual(all.map((event) => event.id));
    expect(urls).toEqual([
      `${ORIGIN}/api/v3/threads/${THREAD_ID}/events?limit=50`,
      `${ORIGIN}/api/v3/threads/${THREAD_ID}/events?limit=50&after=50`,
      `${ORIGIN}/api/v3/threads/${THREAD_ID}/events?limit=50&after=100`,
      `${ORIGIN}/api/v1/threads/${THREAD_ID}/events?limit=50`,
      `${ORIGIN}/api/v1/threads/${THREAD_ID}/events?limit=50&after=50`,
      `${ORIGIN}/api/v1/threads/${THREAD_ID}/events?limit=50&after=100`,
    ]);
  });


  });

describe("remintThread", () => {
  // The same `minted_view` shape `POST /api/v3/threads` returns for a grant at
  // The same `minted_view` shape `POST /api/v1/threads` returns for a grant at
  // minting: token, url, model, expires_at, limits — and no `remaining`,
  // because a freshly minted grant has spent nothing.
  const REMINTED = {

    const source = await remintThread({ origin: ORIGIN, token: TOKEN, threadId: THREAD_ID });

    expect(calls[0]?.method).toBe("POST");
    expect(calls[0]?.url).toBe(`${ORIGIN}/api/v3/threads/${THREAD_ID}/grants`);
    expect(calls[0]?.url).toBe(`${ORIGIN}/api/v1/threads/${THREAD_ID}/grants`);
    expect(source.threadId).toBe(THREAD_ID);
    expect(source.model).toBe("gpt-5.6-luna");
    // A fresh grant has spent nothing, so the budget opens at its ceilings.

    // A child that fans out is a fan-out nobody asked for, and a child that
    // stops without saying so is reported to the parent as having succeeded.
    const sent = stub([sse([`data: [DONE]`])]);
    const harness = new SelfHarness({ grant: GRANT, tools: (cwd) => [tool(`in-${cwd}`, async () => "")] });
    const harness = new SelfHarness({
      grant: GRANT,
      tools: (cwd) => [tool(`in-${cwd}`, async () => "")],
    });

    await drain(harness, "do it", scratch());


      sse([`data: {"choices":[{"delta":{"content":"/repo"}}]}`, `data: [DONE]`]),
    ]);
    const path = scratch();
    const harness = new SelfHarness({ grant: GRANT, tools: () => [tool("shell", async () => "/repo")] });
    const harness = new SelfHarness({
      grant: GRANT,
      tools: () => [tool("shell", async () => "/repo")],
    });

    await drain(harness, "where", path);

    const lines = readFileSync(path, "utf8").trim().split("\n").map((line) => JSON.parse(line));
    const lines = readFileSync(path, "utf8")
      .trim()
      .split("\n")
      .map((line) => JSON.parse(line));
    expect(lines.map((line: { type: string }) => line.type)).toEqual([
      "session",
      "tool",

      // The provider drops. The fleet retries with the session it was given.
      sse([`data: {"choices":[{"delta":{"content":"carried on"}}]}`, `data: [DONE]`]),
    ]);
    const harness = new SelfHarness({ grant: GRANT, tools: () => [tool("shell", async () => "ok")] });
    const harness = new SelfHarness({
      grant: GRANT,
      tools: () => [tool("shell", async () => "ok")],
    });
    const path = scratch();

    const first = await drain(harness, "long task", path);

    stub([new Response("no", { status: 403 })]);
    const harness = new SelfHarness({ grant: GRANT, tools: () => [] });

    await expect(drain(harness, "go", scratch())).rejects.toThrow(/refused the child's call \(403\)/);
    await expect(drain(harness, "go", scratch())).rejects.toThrow(
      /refused the child's call \(403\)/,
    );
  });
});

    const directory = mkdtempSync(join(tmpdir(), "coder-shell-"));
    writeFileSync(join(directory, "marker.txt"), "here");

    const output = await shellTool(directory).run(
      { command: "ls" },
      new AbortController().signal,
    );
    const output = await shellTool(directory).run({ command: "ls" }, new AbortController().signal);

    expect(output).toContain("marker.txt");
  });

    const root = workspace({ "house-style": SKILL });
    mkdirSync(join(root, ".agents", "skills", "empty"), { recursive: true });

    expect(discoverSkills(root, EMPTY_HOME, NO_BUILT_INS).map((skill) => skill.name)).toEqual(["house-style"]);
    expect(discoverSkills(root, EMPTY_HOME, NO_BUILT_INS).map((skill) => skill.name)).toEqual([
      "house-style",
    ]);
  });

  it("skips a skill missing a name or a description", () => {

    });

    // One cannot be asked for and the other gives nothing to choose on.
    expect(discoverSkills(root, EMPTY_HOME, NO_BUILT_INS).map((skill) => skill.name)).toEqual(["house-style"]);
    expect(discoverSkills(root, EMPTY_HOME, NO_BUILT_INS).map((skill) => skill.name)).toEqual([
      "house-style",
    ]);
  });


  it("reads a description written as a folded block, not the block marker", () => {
    const root = workspace({
      folded: [


  it("keeps the line breaks of a literal block", () => {
    const root = workspace({
      literal: ["---", "name: literal", "description: |", "  One.", "  Two.", "---", "", "Body."].join(
        "\n",
      ),
      literal: [
        "---",
        "name: literal",
        "description: |",
        "  One.",
        "  Two.",
        "---",
        "",
        "Body.",
      ].join("\n"),
    });

    expect(discoverSkills(root, EMPTY_HOME, NO_BUILT_INS)[0]?.description).toBe("One.\nTwo.");
  });

  it("is empty for a repository with no skills directory", () => {
    expect(discoverSkills(mkdtempSync(join(tmpdir(), "coder-skills-")), EMPTY_HOME, NO_BUILT_INS)).toEqual([]);
    expect(
      discoverSkills(mkdtempSync(join(tmpdir(), "coder-skills-")), EMPTY_HOME, NO_BUILT_INS),
    ).toEqual([]);
  });

  it("strips the quotes from a quoted description", () => {

      quoted: '---\nname: quoted\ndescription: "Quoted, with a comma."\n---\n\nBody.',
    });

    expect(discoverSkills(root, EMPTY_HOME, NO_BUILT_INS)[0]?.description).toBe("Quoted, with a comma.");
    expect(discoverSkills(root, EMPTY_HOME, NO_BUILT_INS)[0]?.description).toBe(
      "Quoted, with a comma.",
    );
  });
});


  });

  it("offers only the names it found, so a model cannot ask for another", () => {
    expect((tool.parameters["properties"] as Record<string, { enum: string[] }>)["name"]?.enum).toEqual([
      "house-style",
    ]);
    expect(
      (tool.parameters["properties"] as Record<string, { enum: string[] }>)["name"]?.enum,
    ).toEqual(["house-style"]);
  });

  it("hands back the body when asked", async () => {


    loadSkillSelection(root, where, NO_BUILT_INS).toggle("beta");

    expect(loadSkillSelection(root, where, NO_BUILT_INS).active().map((skill) => skill.name)).toEqual(["alpha"]);
    expect(
      loadSkillSelection(root, where, NO_BUILT_INS)
        .active()
        .map((skill) => skill.name),
    ).toEqual(["alpha"]);
  });

  it("switches one back on", () => {

    loadSkillSelection(root, where, NO_BUILT_INS).toggle("beta");
    loadSkillSelection(root, where, NO_BUILT_INS).toggle("beta");

    expect(loadSkillSelection(root, where, NO_BUILT_INS).active().map((skill) => skill.name)).toEqual([
      "alpha",
      "beta",
    ]);
    expect(
      loadSkillSelection(root, where, NO_BUILT_INS)
        .active()
        .map((skill) => skill.name),
    ).toEqual(["alpha", "beta"]);
  });

  it("keeps the choice to the workspace it was made in", () => {

    loadSkillSelection(one, where, NO_BUILT_INS).toggle("alpha");

    // A skill switched off for one repository is not switched off everywhere.
    expect(loadSkillSelection(other, where, NO_BUILT_INS).active().map((skill) => skill.name)).toEqual([
      "alpha",
      "beta",
    ]);
    expect(
      loadSkillSelection(other, where, NO_BUILT_INS)
        .active()
        .map((skill) => skill.name),
    ).toEqual(["alpha", "beta"]);
  });

  it("offers a skill added after the choice was made", () => {

    );

    // Off is what is recorded, so something nobody has ruled on is on.
    expect(loadSkillSelection(root, where, NO_BUILT_INS).active().map((skill) => skill.name)).toEqual([
      "beta",
      "gamma",
    ]);
    expect(
      loadSkillSelection(root, where, NO_BUILT_INS)
        .active()
        .map((skill) => skill.name),
    ).toEqual(["beta", "gamma"]);
  });
});


  const NORMAL = "---\nname: other\ndescription: Something else.\n---\n\nRead me on request.";

  it("marks a skill that loads itself", () => {
    const found = discoverSkills(workspace({ method: AUTO, other: NORMAL }), EMPTY_HOME, NO_BUILT_INS);
    const found = discoverSkills(
      workspace({ method: AUTO, other: NORMAL }),
      EMPTY_HOME,
      NO_BUILT_INS,
    );

    expect(found.find((skill) => skill.name === "method")?.auto).toBe(true);
    expect(found.find((skill) => skill.name === "other")?.auto).toBe(false);
  });

  it("carries an auto-loaded body and leaves the rest in the catalog", () => {
    const found = discoverSkills(workspace({ method: AUTO, other: NORMAL }), EMPTY_HOME, NO_BUILT_INS);
    const found = discoverSkills(
      workspace({ method: AUTO, other: NORMAL }),
      EMPTY_HOME,
      NO_BUILT_INS,
    );

    const standing = standingContext(found, "/somewhere/else") ?? "";
    expect(standing).toContain("Work this way.");

        // Round 0 asks for a tool and waits, so a steer can arrive mid-turn.
        const pieces =
          mine === 0
            ? [chunk({ content: "", tool_calls: [{ function: { name: "t", arguments: {} } }] }), chunk({}, true)]
            ? [
                chunk({ content: "", tool_calls: [{ function: { name: "t", arguments: {} } }] }),
                chunk({}, true),
              ]
            : [chunk({ content: "done" }, true)];
        return Object.assign(
          (async function* () {

    await expect(run(["--version"])).resolves.toContain("openagents v");
  });


  it("carries the command tree, so a session need not go looking for one", async () => {
    const { description } = openagentsTool();


    expect(wire.calls).toHaveLength(1);
    const call = wire.calls[0];
    expect(call?.method).toBe("POST");
    expect(call?.url).toBe(`${ORIGIN}/api/v3/threads/${THREAD_ID}/events`);
    expect(call?.url).toBe(`${ORIGIN}/api/v1/threads/${THREAD_ID}/events`);
    expect(call?.authorization).toBe(`Bearer ${TOKEN}`);
    expect(call?.body).toEqual({
      event_type: "turn.user",

  });

  it("moves the selector without moving the transcript", async () => {
    const frames = await driveKeys(two, [
      ["\x1b[C"],
      ["\x1b[B"],
    ]);
    const frames = await driveKeys(two, [["\x1b[C"], ["\x1b[B"]]);

    // Down in the column selects the second child. It must not scroll the
    // conversation, which is what down does when the composer has the keys.

  });

  it("ignores right when there is no column to move into", async () => {
    const frames = await driveKeys(
      () => undefined,
      [["\x1b[C"]],
    );
    const frames = await driveKeys(() => undefined, [["\x1b[C"]]);

    expect((frames[0] ?? []).join("\n")).not.toContain("enter opens");
  });

  const drillKeys = async () =>
    driveKeys(two, [[], ["\x1b[C"], ["\x1b[D"]]);
  const drillKeys = async () => driveKeys(two, [[], ["\x1b[C"], ["\x1b[D"]]);
});


describe("answering a turn", () => {
  it("calls Zen with the slug and the borrowed key", async () => {
    const sent = stub([
      sse([`data: {"choices":[{"delta":{"content":"Hi"}}]}`, `data: [DONE]`]),
    ]);
    const sent = stub([sse([`data: {"choices":[{"delta":{"content":"Hi"}}]}`, `data: [DONE]`])]);
    const source = new ZenReplySource({ model: "ox-alpha", key: "secret-key" });

    expect(textOf(await chunks(source, "hello"))).toBe("Hi");

  error_code: null,
  promoted_at: "2026-08-24T00:00:00Z",
  updated_at: "2026-08-24T00:00:00Z",
  status_url: `http://localhost:4000/api/v3/admin/forge/targets/${targetId}`,
  status_url: `http://localhost:4000/api/v1/admin/forge/targets/${targetId}`,
  ...overrides,
});



    expect(requests).toHaveLength(1);
    expect(requests[0]?.method).toBe("POST");
    expect(requests[0]?.path).toBe("/api/v3/admin/forge/targets");
    expect(requests[0]?.path).toBe("/api/v1/admin/forge/targets");
    expect(requests[0]?.body).toEqual({
      repo: "openagents.com",
      sha: fullSha,

    await run(["--json", ...promoteArgv(["--wait", "--idempotency-key", "release-key-0002"])]);

    expect(requests.map((request) => `${request.method} ${request.path}`)).toEqual([
      "POST /api/v3/admin/forge/targets",
      `GET /api/v3/admin/forge/targets/${targetId}`,
      "POST /api/v1/admin/forge/targets",
      `GET /api/v1/admin/forge/targets/${targetId}`,
    ]);
    const value = written[0]?.document.value as Record<string, unknown>;
    expect(value["outcome"]).toBe("live");


    await run(["--json", "deploy", "view", targetId]);

    expect(requests[0]?.path).toBe(`/api/v3/admin/forge/targets/${targetId}`);
    expect(requests[0]?.path).toBe(`/api/v1/admin/forge/targets/${targetId}`);
    const value = written[0]?.document.value as Record<string, unknown>;
    expect(value["outcome"]).toBe("pending");
    expect(value["terminal"]).toBe(false);


    await run(["--json", "deploy", "list", "--repo", "openagents.com", "--limit", "5"]);

    expect(requests[0]?.path).toBe("/api/v3/admin/forge/targets?repo=openagents.com&limit=5");
    expect(requests[0]?.path).toBe("/api/v1/admin/forge/targets?repo=openagents.com&limit=5");
    expect(written[0]?.document.value).toEqual({
      repo: "openagents.com",
      targets: [targetBody("live")],

    const result = await Effect.runPromise(program);
    expect(Redacted.value(result.token)).toBe("oa_pat_fixture");
    expect(result.requests[0]).toEqual({
      path: "/api/v3/device/authorizations",
      path: "/api/v1/device/authorizations",
      body: {},
    });
    expect(result.requests[1]).toEqual({
      path: "/api/v3/device/authorizations/token",
      path: "/api/v1/device/authorizations/token",
      body: { device_code: "secret-device-code" },
    });
  });

23	23		`promoted_at: "2026-08-24T00:00:00Z",`
24	24		`updated_at: "2026-08-24T00:00:00Z",`
25	25		`status_url:`
26		-	`"http://localhost:4000/api/v3/admin/forge/targets/0d4e8a70-0000-4000-8000-000000000001",`
	26	+	`"http://localhost:4000/api/v1/admin/forge/targets/0d4e8a70-0000-4000-8000-000000000001",`
27	27		`...overrides,`
28	28		`});`
29	29


    expect(requests).toHaveLength(1);
    expect(requests[0]?.method).toBe("POST");
    expect(requests[0]?.path).toBe("/api/v3/admin/forge/targets");
    expect(requests[0]?.path).toBe("/api/v1/admin/forge/targets");
    expect(requests[0]?.body).toEqual({
      repo: "openagents.com",
      sha: "a".repeat(40),

    );

    expect(requests[0]?.method).toBe("GET");
    expect(requests[0]?.path).toBe("/api/v3/admin/forge/targets?repo=openagents.com&limit=5");
    expect(requests[0]?.path).toBe("/api/v1/admin/forge/targets?repo=openagents.com&limit=5");
  });
});

    );

    expect(requests[0]?.method).toBe("PATCH");
    expect(requests[0]?.path).toBe("/api/v3/repos/octavia/project/issues/155");
    expect(requests[0]?.path).toBe("/api/v1/repos/octavia/project/issues/155");
    expect(requests[0]?.body).toEqual({ state: "closed" });
    expect(Object.keys(requests[0]?.body as Record<string, unknown>)).not.toContain("body");
  });

    );

    expect(requests.map((request) => `${request.method} ${request.path}`)).toEqual([
      "GET /api/v3/repos/octavia/project/issues/129/dependencies",
      "POST /api/v3/repos/octavia/project/issues/129/dependencies",
      "DELETE /api/v3/repos/octavia/project/issues/129/dependencies/81",
      "GET /api/v1/repos/octavia/project/issues/129/dependencies",
      "POST /api/v1/repos/octavia/project/issues/129/dependencies",
      "DELETE /api/v1/repos/octavia/project/issues/129/dependencies/81",
    ]);
    expect(requests[1]?.body).toEqual({ blocked_by: [80, 81] });
    expect(requests[2]?.body).toBeUndefined();

                message: "Validation Failed",
                code: "validation_failed",
                status: 422,
                documentation_url: "http://localhost:4000/api/v3",
                documentation_url: "http://localhost:4000/api/v1",
                request_id: "request-1",
                errors: { blocked_by: ["Issue #99999 does not exist in this repository"] },
              },


    await run(["--json", "issue", "list", "--limit", "40"]);

    expect(requests[0]?.path.startsWith("/api/v3/repos/octavia/project/issues?")).toBe(true);
    expect(requests[0]?.path.startsWith("/api/v1/repos/octavia/project/issues?")).toBe(true);
    expect(requests).toHaveLength(2);
    const value = written[0]?.document.value as {
      readonly pagination: Record<string, unknown>;


    await run(["issue", "list", "-R", "OpenAgentsInc/openagents.com"]);

    expect(requests[0]?.path.startsWith("/api/v3/repos/OpenAgentsInc/openagents.com/issues?")).toBe(
    expect(requests[0]?.path.startsWith("/api/v1/repos/OpenAgentsInc/openagents.com/issues?")).toBe(
      true,
    );
  });

    await run(["issue", "close", "#155", "--comment", "why"]);

    expect(requests.map((request) => `${request.method} ${request.path}`)).toEqual([
      "POST /api/v3/repos/octavia/project/issues/155/comments",
      "PATCH /api/v3/repos/octavia/project/issues/155",
      "POST /api/v1/repos/octavia/project/issues/155/comments",
      "PATCH /api/v1/repos/octavia/project/issues/155",
    ]);
    expect(requests[0]?.body).toEqual({ body: "why" });
    expect(requests[1]?.body).toEqual({ state: "closed" });

    await run(["--json", "issue", "deps", "129", "--add", "#80", "--remove", "81"]);

    expect(requests.map((request) => `${request.method} ${request.path}`)).toEqual([
      "POST /api/v3/repos/octavia/project/issues/129/dependencies",
      "DELETE /api/v3/repos/octavia/project/issues/129/dependencies/81",
      "POST /api/v1/repos/octavia/project/issues/129/dependencies",
      "DELETE /api/v1/repos/octavia/project/issues/129/dependencies/81",
    ]);
    expect(written[0]?.mode).toBe("json");
    expect(written[0]?.document.value).toEqual(graph);


    await run(["--json", "project", "list"]);

    expect(requests[0]?.path).toBe("/api/v3/repos/octavia/project/projectsV2");
    expect(requests[0]?.path).toBe("/api/v1/repos/octavia/project/projectsV2");
    expect(written[0]?.document.value).toEqual({
      projects: [{ number: 1, title: "Roadmap", state: "open", archived: false }],
    });


    await run(["project", "item-add", "2", "--issue", "#155"]);

    expect(requests[0]?.path).toBe("/api/v3/repos/octavia/project/projectsV2/2/items");
    expect(requests[0]?.path).toBe("/api/v1/repos/octavia/project/projectsV2/2/items");
    expect(requests[0]?.body).toEqual({ issue_number: 155 });
  });
});

      }).pipe(Effect.provide(layer)),
    );
    expect(user.login).toBe("octavia");
    expect(requests[0]?.path).toBe("/api/v3/user");
    expect(requests[0]?.path).toBe("/api/v1/user");
  });

  it("creates a personal repository with the Phoenix API contract", async () => {


    expect(repository.full_name).toBe("octavia/project");
    expect(requests).toHaveLength(1);
    expect(requests[0]?.path).toBe("/api/v3/user/repos");
    expect(requests[0]?.path).toBe("/api/v1/user/repos");
    expect(requests[0]?.body).toEqual({ name: "project", private: true });
    expect(requests[0]?.headers?.["idempotency-key"]).toBeTypeOf("string");
  });

        });
      }).pipe(Effect.provide(layer)),
    );
    expect(requests[0]?.path).toBe("/api/v3/orgs/acme/repos");
    expect(requests[0]?.path).toBe("/api/v1/orgs/acme/repos");
  });

  it("reports repository provisioning progress before completion", async () => {

    const layer = layerFromHandler((input) =>
      Effect.sync(() => {
        requests.push(input);
        return input.path.startsWith("/api/v3/user/repos")
        return input.path.startsWith("/api/v1/user/repos")
          ? { status: 200, body: { repositories: [repositoryFixture()], next_cursor: "next" } }
          : { status: 200, body: repositoryFixture() };
      }),

    expect(result.list.repositories).toHaveLength(1);
    expect(result.list.nextCursor).toBe("next");
    expect(requests[0]?.path).toBe(
      "/api/v3/user/repos?per_page=12&after=cursor+value&namespace=octavia",
      "/api/v1/user/repos?per_page=12&after=cursor+value&namespace=octavia",
    );
    expect(result.view.full_name).toBe("octavia/project");
  });


    expect(requests).toHaveLength(1);
    expect(requests[0]?.method).toBe("DELETE");
    expect(requests[0]?.path).toBe("/api/v3/repos/octavia/project");
    expect(requests[0]?.path).toBe("/api/v1/repos/octavia/project");
  });

  it("routes GitHub imports to the selected personal or organization namespace", async () => {

      }).pipe(Effect.provide(layer)),
    );
    expect(requests.map((request) => request.path)).toEqual([
      "/api/v3/user/repos/imports",
      "/api/v3/orgs/acme/repos/imports",
      "/api/v1/user/repos/imports",
      "/api/v1/orgs/acme/repos/imports",
    ]);
    expect(requests[0]?.body).toEqual({
      source: { provider: "github", repository: "octavia/project" },

    const { fail } = harness();
    const error = await fail(["trace", "upload", path]);
    expect(error).toMatchObject({ _tag: "OpenAgentsCli.TraceUploadUnsupported" });
    expect(String((error as { message: string }).message)).toContain("POST /api/v3/traces");
    expect(String((error as { message: string }).message)).toContain("POST /api/v1/traces");
  });

  it("still validates the local path before refusing an upload", async () => {

153	153		`openagents api repos/OWNER/REPO/issues \| jq '.[].title'`
154	154		```
155	155
156		-	A path without a leading slash resolves under the API base `/api/v3/`, so
157		-	`repos/OWNER/REPO/issues` and `/api/v3/repos/OWNER/REPO/issues` name the same
	156	+	A path without a leading slash resolves under the API base `/api/v1/`, so
	157	+	`repos/OWNER/REPO/issues` and `/api/v1/repos/OWNER/REPO/issues` name the same
158	158		route. An absolute path must start with `/api/`, and a complete URL must match
159	159		`the API origin you selected. The CLI refuses a path that would leave that`
160	160		`origin.`

359	359		`## Deploy the fleet (operators)`
360	360
361	361		The `deploy` commands drive the operator-only fleet promotion API
362		-	(`/api/v3/admin/forge/targets`). They require an API token holding the
	362	+	(`/api/v1/admin/forge/targets`). They require an API token holding the
363	363		privileged `deployments:promote` scope, and the server additionally checks
364	364		that the account is a current operator on every request. `forge:write` cannot
365	365		`promote, and neither can a Git credential or a browser session.`

3	3		`export const REPOSITORY_CONTRACT_NAME = "openagents.repositories.v1";`
4	4		`export const REPOSITORY_CONTRACT_VERSION = 1;`
5	5		`export const REPOSITORY_CONTRACT_SHA256 =`
6		-	`"5be86539258c38d5249887ff2628680b1f90c93909d6e83e86a836d0250ce79f";`
	6	+	`"96a71ee0a3d19eb77ffa0721cc76876e1e514bb821368c469f0a6d91f21c3870";`
7	7
8	8		`export const AuthenticatedNamespace = Schema.Struct({`
9	9		`id: Schema.Union([Schema.Number, Schema.String]),`

740	740		`* and a hint that omits it sends the reader around a loop that never signs`
741	741		`* them in.`
742	742		`*/`
743		-	`const loginCommandFor = (endpoint: {`
744		-	`readonly origin: string;`
745		-	`readonly profile: string;`
746		-	`}): string =>`
	743	+	`const loginCommandFor = (endpoint: { readonly origin: string; readonly profile: string }): string =>`
747	744		`endpoint.profile === "production"`
748	745		`? "openagents auth login"`
749	746		`: endpoint.profile === "custom"`

1537	1534		`);`
1538	1535		// `--model` can name an `ollama:<model>` local model or a chat API backend.
1539	1536		`// For a chat API backend a thread's grant still pins its own model and`
1540		-	// `POST /api/v3/threads` publishes no model parameter, so naming one cannot
	1537	+	// `POST /api/v1/threads` publishes no model parameter, so naming one cannot
1541	1538		// change which model answers. For `ollama:<model>` the local Ollama server is
1542	1539		`// used directly and the named model is the one that runs.`
1543	1540		`const coderModelFlag = Flag.string("model").pipe(`

9	9		`"idempotency": {`
10	10		`"header": "Idempotency-Key",`
11	11		`"required_for": [`
12		-	`"POST /api/v3/user/repos",`
13		-	`"POST /api/v3/orgs/{org}/repos",`
14		-	`"POST /api/v3/user/repos/imports",`
15		-	`"POST /api/v3/orgs/{org}/repos/imports"`
	12	+	`"POST /api/v1/user/repos",`
	13	+	`"POST /api/v1/orgs/{org}/repos",`
	14	+	`"POST /api/v1/user/repos/imports",`
	15	+	`"POST /api/v1/orgs/{org}/repos/imports"`
16	16		`]`
17	17		`},`
18	18		`"endpoints": {`
19		-	`"get_authenticated_user": "GET /api/v3/user",`
20		-	`"create_user_repository": "POST /api/v3/user/repos",`
21		-	`"create_organization_repository": "POST /api/v3/orgs/{org}/repos",`
22		-	`"import_user_repository": "POST /api/v3/user/repos/imports",`
23		-	`"import_organization_repository": "POST /api/v3/orgs/{org}/repos/imports",`
24		-	`"list_repositories": "GET /api/v3/user/repos",`
25		-	`"get_repository": "GET /api/v3/repos/{owner}/{repo}",`
26		-	`"delete_repository": "DELETE /api/v3/repos/{owner}/{repo}",`
27		-	`"get_repository_import": "GET /api/v3/repository-imports/{id}",`
28		-	`"create_device_authorization": "POST /api/v3/device/authorizations",`
29		-	`"poll_device_authorization": "POST /api/v3/device/authorizations/token"`
	19	+	`"get_authenticated_user": "GET /api/v1/user",`
	20	+	`"create_user_repository": "POST /api/v1/user/repos",`
	21	+	`"create_organization_repository": "POST /api/v1/orgs/{org}/repos",`
	22	+	`"import_user_repository": "POST /api/v1/user/repos/imports",`
	23	+	`"import_organization_repository": "POST /api/v1/orgs/{org}/repos/imports",`
	24	+	`"list_repositories": "GET /api/v1/user/repos",`
	25	+	`"get_repository": "GET /api/v1/repos/{owner}/{repo}",`
	26	+	`"delete_repository": "DELETE /api/v1/repos/{owner}/{repo}",`
	27	+	`"get_repository_import": "GET /api/v1/repository-imports/{id}",`
	28	+	`"create_device_authorization": "POST /api/v1/device/authorizations",`
	29	+	`"poll_device_authorization": "POST /api/v1/device/authorizations/token"`
30	30		`},`
31	31		`"authenticated_user": {`
32	32		`"required": ["id", "login", "namespaces", "token_expires_at"],`

88	88
89	89		`openagents api <path>` sends an authenticated request to any API route and
90	90		`writes the body as JSON. A path without a leading slash resolves under`
91		-	`/api/v3/`. Use it when no named command covers what you need — several routes
	91	+	`/api/v1/`. Use it when no named command covers what you need — several routes
92	92		`have no command of their own.`
93	93
94	94		`## Two cautions`

8	8
9	9		`## Which lane`
10	10
11		-	`\| The work \| Use \|`
12		-	`\| --- \| --- \|`
13		-	\| One command, one answer \| `shell` \|
14		-	\| The same thing to N independent parts \| `delegate` \|
15		-	`\| A backlog of issues \| the method below \|`
	11	+	`\| The work \| Use \|`
	12	+	`\| ------------------------------------- \| ---------------- \|`
	13	+	\| One command, one answer \| `shell` \|
	14	+	\| The same thing to N independent parts \| `delegate` \|
	15	+	`\| A backlog of issues \| the method below \|`
16	16
17	17		Run a single command yourself. Starting an agent to run `pwd` costs minutes and
18	18		`real money and hands back an answer nobody watched being produced.`

1	1		`import { Effect, Option } from "effect";`
2	2
3	3		`import type { HttpMethod } from "./api-transport.js";`
	4	+	`import { API_BASE_PATH } from "./constants.js";`
4	5		`import { InputError } from "./errors.js";`
5	6
6	7		`/**`
7	8		`* Every OpenAgents API route lives under this prefix. A passthrough path`
8	9		`* without a leading slash resolves under it.`
9	10		`*/`
10		-	`export const API_BASE_PATH = "/api/v3/";`
	11	+	`export { API_BASE_PATH };`
11	12
12	13		`/**`
13	14		* The methods `openagents api` accepts. The transport supports more, but a

30	31		`/**`
31	32		`* Turns a caller-supplied path into an origin-relative request path.`
32	33		`*`
33		-	* A path without a leading slash resolves under `/api/v3/`, so
34		-	* `repos/OWNER/REPO/issues` and `/api/v3/repos/OWNER/REPO/issues` name the same
	34	+	* A path without a leading slash resolves under `/api/v1/`, so
	35	+	* `repos/OWNER/REPO/issues` and `/api/v1/repos/OWNER/REPO/issues` name the same
35	36		* route. An absolute path must stay under `/api/`, because this command talks
36	37		`* to the API rather than to the website. A complete URL is accepted only when`
37	38		`* it matches the configured origin.`

1965	1962		`// coder without asking for one.`
1966	1963		`const localModel =`
1967	1964		`local && named === undefined && !offline && !resume`
1968		-	`? yield* Effect.promise(() => discoverOllamaModel(process.env["OLLAMA_HOST"] \|\| undefined))`
	1965	+	`? yield* Effect.promise(() =>`
	1966	+	`discoverOllamaModel(process.env["OLLAMA_HOST"] \|\| undefined),`
	1967	+	`)`
1969	1968		`: undefined;`
1970	1969
1971	1970		`if (local && named === undefined && localModel === undefined && !offline && !resume) {`

1980	1979		`// opencode already holds here. It is how a session runs on Ox Alpha,`
1981	1980		`// which is free there and which no deployment serves.`
1982	1981		`const wantsZen = named !== undefined && /^opencode:/.test(named);`
1983		-	`const zenAsked = wantsZen && named !== undefined ? named.slice("opencode:".length) : undefined;`
	1982	+	`const zenAsked =`
	1983	+	`wantsZen && named !== undefined ? named.slice("opencode:".length) : undefined;`
1984	1984
1985	1985		`const wantsOllama = named === undefined ? localModel !== undefined : isOllamaModelFlag(named);`
1986	1986		`const zenKey = wantsZen ? zenCredential() : undefined;`

2260	2260		`if (resumed !== undefined) session.restore(resumed.entries);`
2261	2261
2262	2262		`// The thread lane writes its transcript to the server as the turn loop`
2263		-	// runs — `POST /api/v3/threads/{id}/events`, on the account token that
	2263	+	// runs — `POST /api/v1/threads/{id}/events`, on the account token that
2264	2264		`// opened the thread. The server copy is the only durable copy; the`
2265	2265		`// offline, Ollama, and stand-in lanes keep no record and attach nothing.`
2266	2266		`// A failed post never reaches the turn loop: the writer queues, retries,`

2376	2376		`);`
2377	2377		`}`
2378	2378
2379		-
2380	2379		`// With --resume the positional argument named the thread, not a prompt.`
2381	2380		`const oneShot = resume ? undefined : Option.getOrUndefined(prompt);`
2382	2381		`const interactive = terminal.interactive && !plain && !flags.json && oneShot === undefined;`

2407	2406		`// Flush before revoking: revoking makes the thread terminal, and a`
2408	2407		`// terminal thread refuses the events that are still queued.`
2409	2408		`if (transcript !== undefined) await transcript.close();`
2410		-	`if (thread !== undefined) await thread.revoke();`
2411		-	`if (childThread?.kind === "opened") await childThread.thread.revoke();`
	2409	+	`// The thread outlives the session. It used to be revoked here, which`
	2410	+	// made `--resume` impossible by construction — every past session's
	2411	+	`// thread was already terminal — and put "This thread was revoked" in`
	2412	+	`// front of anything that touched one again: a delegated child still`
	2413	+	`// running, a second window, a resumed session. A thread is durable;`
	2414	+	// ending a session is not a reason to destroy it. `DELETE
	2415	+	// /threads/{id}` is still there for a reader who means it.
2412	2416		`if (setup !== undefined) await setup.close();`
2413	2417		`}`
2414	2418		`});`

243	242		`.trimEnd();`
244	243
245	244		`const out = [line(headings, BOLD)];`
246		-	`out.push(`
247		-	`${DIM}${widths.map((room) => "─".repeat(room)).join("─".repeat(gap))}${RESET}`,
248		-	`);`
	245	+	out.push(`${DIM}${widths.map((room) => "─".repeat(room)).join("─".repeat(gap))}${RESET}`);
249	246		`for (const row of cells) out.push(line(row, ""));`
250	247		`return out;`
251	248		`}`

496	502		`if (signal.aborted) return;`
497	503		`yield* merge(calls.map((call) => this.invoke(call, signal)));`
498	504		`}`
499		-
500		-
501	505		`}`
502	506
503	507		`/**`

117	117		`const tools = this.toolsFor(input.cwd);`
118	118
119	119		`const resumed =`
120		-	`input.resumeSessionId === undefined`
121		-	`? undefined`
122		-	`: this.sessions.get(input.resumeSessionId);`
	120	+	`input.resumeSessionId === undefined ? undefined : this.sessions.get(input.resumeSessionId);`
123	121
124	122		`const sessionId = input.resumeSessionId ?? this.mintSession();`
125	123		`const transcript: WireMessage[] = resumed ?? [`

2600	2604		`// The thread's slot goes back even on the failure path: an account`
2601	2605		`// holds eight, and a script that delegates in a loop would otherwise`
2602	2606		`// be refused on its ninth run.`
2603		-	`if (thread !== undefined) await thread.revoke();`
	2607	+	`// Left open, for the same reason as above.`
2604	2608		`}`
2605	2609		`});`
2606	2610

1	1		`/**`
2	2		* The backends `openagents coder` can send a turn to.
3	3		`*`
4		-	* The server owns the real list and publishes it at `GET /api/v3/models`, and a
	4	+	* The server owns the real list and publishes it at `GET /api/v1/models`, and a
5	5		`* session that can reach the server reads it from there — see`
6	6		* `fetchServedCatalog` below. The list in this file is the fallback for a
7	7		* session that cannot: `--offline`, or no stored credential.

18	18		`* so this list is what the flag validates against and what the status line`
19	19		`* names, nothing more.`
20	20		`*`
21		-	* The `id` is what `POST /api/v3/threads` takes as `model`. The `label` is what
	21	+	* The `id` is what `POST /api/v1/threads` takes as `model`. The `label` is what
22	22		`* a person reads in the status bar, where the whole line is competing for a`
23	23		`* narrow terminal; a model the server serves and this file has never heard of`
24	24		`* is labelled with its own id.`
25	25		`*/`
26	26
	27	+	`import { API_VERSION_PATH } from "./constants.js";`
	28	+
27	29		`export interface CoderBackend {`
28	30		/** The value the chat API takes as `model`. Matches the server's enum. */
29	31		`readonly id: string;`

59	61		`/** Every id, for a flag's error message and its accepted values. */`
60	62		`export const backendIds = (): readonly string[] => CODER_BACKENDS.map((backend) => backend.id);`
61	63
62		-	/** One model as the server publishes it at `GET /api/v3/models`. */
	64	+	/** One model as the server publishes it at `GET /api/v1/models`. */
63	65		`export interface ServedModel {`
64	66		`readonly id: string;`
65	67		`/** Served here and its provider credential configured. */`

81	83		`signal?: AbortSignal,`
82	84		`): Promise<readonly ServedModel[] \| undefined> => {`
83	85		`try {`
84		-	`const response = await fetch(new URL("/api/v3/models", api.origin), {`
	86	+	const response = await fetch(new URL(`${API_VERSION_PATH}/models`, api.origin), {
85	87		headers: { authorization: `Bearer ${api.token}`, accept: "application/json" },
86	88		`signal: signal ?? AbortSignal.timeout(5_000),`
87	89		`});`

82	82		`const measured = entries.filter((entry) => entry.metrics !== undefined);`
83	83		`if (measured.length === 0) return {};`
84	84		`return {`
85		-	`total_prompt_tokens: measured.reduce((sum, entry) => sum + (entry.metrics?.promptTokens ?? 0), 0),`
	85	+	`total_prompt_tokens: measured.reduce(`
	86	+	`(sum, entry) => sum + (entry.metrics?.promptTokens ?? 0),`
	87	+	`0,`
	88	+	`),`
86	89		`total_completion_tokens: measured.reduce(`
87	90		`(sum, entry) => sum + (entry.metrics?.completionTokens ?? 0),`
88	91		`0,`

212	212		`// that contains a code span too wide.`
213	213		`const plain = (text: string) => visibleWidth(styled(text, ""));`
214	214
215		-
216	215		`const widths: number[] = [];`
217	216		`for (let column = 0; column < columns; column += 1) {`
218	217		`const widest = cells.reduce(`

10	10		`* Order within one stream is preserved, because a tool call and its result are`
11	11		`* a sequence. Order between streams is arrival order, which is the point.`
12	12		`*/`
13		-	`export async function* merge<T>(`
14		-	`streams: ReadonlyArray<AsyncIterable<T>>,`
15		-	`): AsyncIterable<T> {`
	13	+	`export async function* merge<T>(streams: ReadonlyArray<AsyncIterable<T>>): AsyncIterable<T> {`
16	14		`if (streams.length === 0) return;`
17	15		`if (streams.length === 1) {`
18	16		`yield* streams[0] as AsyncIterable<T>;`

12	12		`*/`
13	13
14	14		`import { Ollama } from "ollama";`
15		-	`import type { Message as OllamaMessage, Tool as OllamaTool, ToolCall as OllamaToolCall } from "ollama";`
	15	+	`import type {`
	16	+	`Message as OllamaMessage,`
	17	+	`Tool as OllamaTool,`
	18	+	`ToolCall as OllamaToolCall,`
	19	+	`} from "ollama";`
16	20
17	21		`import { declaredDescription } from "./coder-tool-families.js";`
18	22		`import { merge } from "./coder-merge.js";`

137	141		`* Shared by discovery and by resolution, so the two cannot disagree about what`
138	142		`* is on the machine.`
139	143		`*/`
140		-	`const installedModels = async (`
141		-	`host: string,`
142		-	`timeoutMs: number,`
143		-	`): Promise<ReadonlyArray<string>> => {`
	144	+	`const installedModels = async (host: string, timeoutMs: number): Promise<ReadonlyArray<string>> => {`
144	145		`try {`
145	146		`const response = await fetch(new URL("/api/tags", host), {`
146	147		`signal: AbortSignal.timeout(timeoutMs),`

357	358		`try {`
358	359		`yield* this.rounds(prompt, signal);`
359	360		`} finally {`
360		-	`yield { type: "usage", promptTokens: this.spentIn, completionTokens: this.spentOut, calls: this.calls };`
	361	+	`yield {`
	362	+	`type: "usage",`
	363	+	`promptTokens: this.spentIn,`
	364	+	`completionTokens: this.spentOut,`
	365	+	`calls: this.calls,`
	366	+	`};`
361	367		`}`
362	368		`}`
363	369

173	173		return refuse("mount_invalid", `mount \`${mount.path}\` is not a directory`);
174	174		`}`
175	175		`} catch {`
176		-	return refuse("mount_invalid", `mount \`${mount.path}\` does not resolve to a readable directory`);
	176	+	`return refuse(`
	177	+	`"mount_invalid",`
	178	+	`mount \`${mount.path}\` does not resolve to a readable directory`,
	179	+	`);`
177	180		`}`
178	181		`mounts.push(root);`
179	182		`}`

202	205
203	206		`// Every import must be granted by a declared capability. Mounts grant`
204	207		`// exactly two: the read_file and list_dir capability imports.`
205		-	`const granted = new Set(`
206		-	`mounts.length > 0 ? ["openagents.read_file", "openagents.list_dir"] : [],`
207		-	`);`
	208	+	`const granted = new Set(mounts.length > 0 ? ["openagents.read_file", "openagents.list_dir"] : []);`
208	209		`const undeclared = shape.imports.filter((name) => !granted.has(name));`
209	210		`if (undeclared.length > 0) {`
210	211		`const grantHint =`

5	5		* 2026-08-24: bare `--resume` shows a picker over recent threads filtered to
6	6		* the current repository, `--resume <id>` names one directly, `--resume
7	7		* --last` continues the most recent without asking, and `--all` drops the
8		-	* repository filter. `GET /api/v3/threads` is the picker's list and
9		-	* `GET /api/v3/threads/{id}/events` is the transcript it replays, paged
	8	+	* repository filter. `GET /api/v1/threads` is the picker's list and
	9	+	* `GET /api/v1/threads/{id}/events` is the transcript it replays, paged
10	10		* through the `after` cursor because the listing caps at fifty and a working
11	11		`* session passes fifty events inside an hour.`
12	12		`*`

27	27		`* the server's own; posting them again would double the record.`
28	28		`*`
29	29		`* The repository filter prefers the thread's own field. Since`
30		-	* openagents.com #210, `POST /api/v3/threads` records a structured
	30	+	* openagents.com #210, `POST /api/v1/threads` records a structured
31	31		* `repository` and every thread view returns it, so a summary takes that
32	32		`* first. Threads opened before the field existed carry none, so the objective`
33	33		* sentence this CLI composes (`openagents coder in <repo> on <branch>`) is

39	39
40	40		`import type { CoderEntry } from "./coder-session.js";`
41	41		`import { boundedResult, ThreadUnavailable, type WireMessage } from "./coder-thread.js";`
42		-
43		-	`const THREADS_PATH = "/api/v3/threads";`
	42	+	`import { THREADS_PATH } from "./constants.js";`
44	43
45	44		`/** The server's listing cap. Pages are read at exactly this size. */`
46	45		`const PAGE_LIMIT = 50;`
47	46
48		-	/** One thread as `GET /api/v3/threads` reports it. */
	47	+	/** One thread as `GET /api/v1/threads` reports it. */
49	48		`export interface ThreadSummary {`
50	49		`readonly id: string;`
51	50		`readonly status: string;`

60	59		`readonly branch: string \| undefined;`
61	60		`}`
62	61
63		-	/** One event as `GET /api/v3/threads/{id}/events` reports it. */
	62	+	/** One event as `GET /api/v1/threads/{id}/events` reports it. */
64	63		`export interface ThreadEvent {`
65	64		`/** The cursor: a client continues from the last id it read. */`
66	65		`readonly id: number;`

123	123		`child.stderr.on("data", collect);`
124	124
125	125		`child.on("error", (cause) => {`
126		-	finish({ output: `The command could not be started: ${cause.message}`, code: undefined, timedOut: false });
	126	+	`finish({`
	127	+	output: `The command could not be started: ${cause.message}`,
	128	+	`code: undefined,`
	129	+	`timedOut: false,`
	130	+	`});`
127	131		`});`
128	132		`child.on("close", (code) => {`
129	133		`finish({ output, code: code ?? undefined, timedOut: false });`

31	31		* ordinary skills otherwise: they appear in the catalog, and `/skills` switches
32	32		`* them off like any other.`
33	33		`*/`
34		-	`const SKILL_DIRECTORIES = (`
35		-	`cwd: string,`
36		-	`home: string,`
37		-	`builtIn: string,`
38		-	`): ReadonlyArray<string> => [`
	34	+	`const SKILL_DIRECTORIES = (cwd: string, home: string, builtIn: string): ReadonlyArray<string> => [`
39	35		`join(cwd, ".agents", "skills"),`
40	36		`join(home, ".agents", "skills"),`
41	37		`builtIn,`
42	38		`];`
43	39
44	40		`/** The skills packaged with this CLI, beside the compiled output. */`
45		-	`const builtInSkills = (): string =>`
46		-	`join(dirname(fileURLToPath(import.meta.url)), "..", "skills");`
	41	+	`const builtInSkills = (): string => join(dirname(fileURLToPath(import.meta.url)), "..", "skills");`
47	42
48	43		`/** How much of one skill body is handed back. */`
49	44		`const BODY_LIMIT = 32_000;`

331	326		`"most of the work, and they are easy to confuse:",`
332	327		`"",`
333	328		"- `openagents.com` is the web application: a Phoenix and Elixir codebase serving the",
334		-	" site, the forge, and the `/api/v3` API. Its issues are the site's issues.",
	329	+	" site, the forge, and the `/api/v1` API. Its issues are the site's issues.",
335	330		"- `openagents` is the monorepo: the `openagents` CLI lives in",
336	331		" `packages/openagents-cli`, alongside the other packages. Its issues are the CLI's and the",
337	332		`" monorepo's.",`