feat(routing): launch routing, reasoning effort, server preparation and sign-in

[BIackFIame]

Goal

Choose the right agent, account, server and reasoning effort for a task, prepare servers automatically, and sign in or add a key once in the app instead of on every server.

Behavior

• Decision routing (opt-in): rules run first, with optional Jev evaluation. Routes are assembled automatically from accounts, servers and installed CLIs, ordered by task difficulty, and weigh cost, quality and limit headroom. Jev responses are validated tolerantly (extra fields, partial distributions), and the evaluator budget is reserved before waiting.
• Reasoning effort is a launch dimension: Claude --effort, Codex model_reasoning_effort, Grok --reasoning-effort. It is refused for providers without it, for ACP and for containers, and it changes a route's cost and quality estimate.
• "Prepare server" / "Prepare all servers" runs over SSH with root or passwordless sudo on Ubuntu or Debian. It installs base packages and only the agents whose API answers from that server. On machines under 2 GB it adds swap and fails if the kernel does not report it active.
• API key forwarding: a key held in the app is sent per launch over SSH stdin into a 0600 tmpfs file, loaded into the agent's environment, and deleted before exec. It never appears in argv or on the server's disk.
• Sign in once: Codex and Claude subscription accounts sign in through the app, on the computer the account is bound to, into a private managed directory. Credentials are created by the vendor CLI and never pass through CanvasTTY.
• Orchestrator option: the launch dialog offers an explicit Orchestrator option. It is disabled with an explanation for agents without a verified orchestration adapter. Cards show Orchestrator or Subagent, and the role label stays readable on narrow cards.
• Consent flows down the chain: a delegation chain whose root the person launched as an orchestrator carries that consent. The default class and the task-text floor warn instead of blocking every child, so orchestration works out of the box. Explicit classes, path policies, capsules and containers stay enforced, and an unconsented parent's child is still blocked.
• Launchers keep agents that have a remote or container route even without a local CLI.
• Direct launches on the default data class warn instead of blocking. This also holds when a session with a typed task is rechecked before spawn, restarted or restored; previously a project class below D2 blocked those. Delegated and automated launches stay blocked.
• An account with unreviewed terms follows the same rule. A CLI-home account without a reviewed data-handling assessment signs in through the same consumer route as the CLI login and carries only the same estimate. A direct launch at the default class now warns instead of blocking; before, adding a Claude account made every task fail at the default D2. A reviewed assessment, an API route, a shared account, the person's own limit on the account, an explicitly raised class and unconsented delegation still block. The launcher uses the only compatible account without a separate choice, names the account in its warning and disables D0/D1 once a task is typed; account settings explain that the extra limit can only lower access.
• Fixes: remote terminals open the server's login shell in the mapped folder. Cursor's reachability probe uses its real API host (api2.cursor.sh). Servers without curl are no longer excluded. The idle orchestration gateway runs no timers and stops on exit. Podman's read-only /run/.containerenv is accepted by the container bootstrap. The unused ExecutionIsolation planner is removed.

Documentation

docs/routing-decision-notes.md.

Verification

• npm run typecheck, npm run audit:secrets and git diff --check passed. Full suite: 1445/1445; Even G2 companion tests (npm run test:even): 47/47. npm run build succeeded. The CI browser smoke (31 steps) and provider-helper smoke passed locally with an off-screen window, as they do on upstream main. Packaging and the Windows job were not run locally.
• Live, against three fresh Ubuntu servers and macOS:
  • Server preparation on all three. The 889 MB server got an active 2 GB swap and all four agents; the regional server installed only the agents whose APIs answer there.
  • Key forwarding with OpenCode: the key reached the remote process environment, was absent from argv, and left no file behind.
  • Remote agents: Claude on a server with --effort high. Disposing a session killed its remote process.
  • Podman: a container shell on a server ran after the .containerenv fix.
  • Off-screen Electron UI check of the launch dialog (effort, privacy notice), agent install rows and route preview.
• Real models, in the app itself (off-screen window, empty temporary folders):
  • OpenCode (Z.AI plan) wrote a working calc.py from a launcher task.
  • A project rule reached the model: the new file started with the exact line the rule required.
  • An orchestrator OpenCode session called spawn_agent through the orchestration MCP. The child was refused by the privacy policy, as designed, because an OpenCode subscription login has no account adapter.
  • This run found the recheck bug fixed above.
  • An OpenCode orchestrator delegated to OpenCode subagents through spawn_agent, waited for a result, and stopped a second child with cancel_agent. A second recheck bug (a child's task floor) was found this way and fixed.
• Settings layout evidence: 18 screenshots of the changed sections at 920×620 and 1440×900, UI scale 0.85 and 1.25, RU and EN, with 0 horizontally overflowing elements, in the pr-evidence branch.
• Codex and Claude sign-in reached the vendor's browser step; completing it needs the account owner. Jev was not called live (no API key).

Series

Each part is one commit on top of the previous one. Please merge them in order. Until #68 is merged, GitHub also shows the earlier parts here; review only the top commit 5d294d8 (Commits tab → last commit).

Part	PR	Scope	Lines
1	#63	Providers: Cursor, MiniMax Code, Devin, Antigravity	+579/−90
2	#64	API keys, API profiles, agent delegation (MCP)	+4275/−63
3	#65	Remote servers, placement, privacy tiers, accounts	+6620/−40
4	#66	Isolation: capsules, worktrees, containers	+5508/−839
5	#67	ACP, connection settings, remote containers	+6827/−563
6	#68	Project context and learning	+6148/−370
7	#69	Routing, reasoning effort, server preparation, sign-in	+3122/−467
8	#70	Open issues and safe fixes from open PRs	+306/−58

Compatibility with open upstream PRs

integration/stack-with-open-prs is this whole stack with #54–#62 merged on top and every conflict resolved. On that branch both TypeScript checks, 1492/1492 tests, npm run test:even (47/47) and electron-vite build pass.

• fix(even-g2): isolate transport keys per paired device #54, fix(even-g2): align local-network Settings card layout #56, fix(canvas): honor region bounds when snapping resize #57, fix(canvas): let sticky note editors scroll their own text #59, fix(plugins): prevent stale version writes during updates #60 merge cleanly.
• fix(settings): keep rejected writes out of live settings #58: conflicts in SettingsStore.ts. Keep this stack's store: it already serializes every write and publishes a value only after the disk write succeeds. fix(settings): keep rejected writes out of live settings #58's new tests pass against it unchanged.
• fix(window): restore state events after macOS Dock reopen #61: mechanical. registerIpc returns the window observer; keep both sides. This stack's IPC tests stub both window-state helpers, so they pass in either merge order.
• fix(even-g2): require explicit grant for answer capture #55:
  • TerminalManager.ts: keep this stack's launch structure. The answer-capture grant must also reach the prepared and measured-grid first start, because every real agent launch goes through that path.
  • hook-helper.mjs: keep this stack's 512 KiB input read and safe cut, and gate the answer on fix(even-g2): require explicit grant for answer capture #55's grant.
  • Fix and tests: 64ef294 (grant through prepared starts, feat(updates): add GitHub release updates across platforms #62 follow-ups) and c2dd726 (hook test under the grant).
• feat(updates): add GitHub release updates across platforms #62: whichever of this stack and feat(updates): add GitHub release updates across platforms #62 lands second needs the same commit:
  • The restore step in shutdownForUpdate must clear shuttingDown. Otherwise no session can start after a failed update; feat(updates): add GitHub release updates across platforms #62's own test fails without this.
  • Restore only live sessions, using the orphan-subagent rule.
  • Refuse to install while a server is being prepared or a capsule test runs.
  • Open About through SettingsLocation.

I will rebase this stack onto whichever of these lands first.

🤖 Generated with Claude Code