@intentic/constants 1.364.0 → 1.366.0

package/README.md

@@ -1,6 +1,6 @@
 # constants
 
-The values several packages must agree on (ports, workspace paths, origins, install-script URLs, the sign-in client id, the hosted price ladder), defined once so no copy drifts.
+The values several packages must agree on (ports, workspace paths, origins, install-script URLs, sign-in parameters, name limits, the hosted price ladder), defined once so no copy drifts.
 
 ```mermaid
 flowchart LR
@@ -22,16 +22,27 @@ flowchart LR
 - `./node` holds `repoRoot` and `packageRoot`, which find the monorepo by walking up to `pnpm-workspace.yaml`
   instead of counting `../..`. The `paths` check refuses counted roots.
 - The `.mjs` modules (`control-bytes`, `contract-shrink`, `assertion-measure`, `mirror-roots`, `test-suites`,
-  `vocabulary`, `ci-infra-steps`, `memory-room`, `allow`, `heavy-rules`) are plain JavaScript with `.d.mts` types, so
+  `vocabulary`, `ci-infra-steps`, `memory-room`, `allow`, `heavy-rules`, `dev-previews`) are plain JavaScript with `.d.mts` types, so
   the checks and the verify scripts import them by path before any install or build, and the daemon applies the same
   rule from the same file.
 - `heavy-rules.cjs` is the one heavy-command table (which programs queue, their pools, max-holds and deadlines, and
   the owner's overrides merged on top); `heavy-hook.cjs` (a `node --require` preload) and `heavy-exec.cjs` (behind the
   sandbox's wrappers for native programs) judge a program by what it is as it starts. CommonJS, so the hook loads
-  on any Node an agent's project pins.
+  on any Node an agent's project pins. A rule may also match the program's working directory (`cwd`), name its memory
+  price (`size`), and be judged under a program that already holds a slot (`nests`): the editor's `vue-tsc` takes the
+  `vue-typecheck` lane, one at a time, from under a `pnpm -r typecheck`. Only a pool no `nests` rule names may wait on
+  one that does, so the waits cannot form a cycle.
+- `memory-room`'s `SIZE_BYTES` prices a toolchain command by its measured shape instead of its class: `targeted` (a test
+  run aimed at named files), `editor-typecheck` (the editor's full `vue-tsc`, 7 GiB) and `scoped-typecheck` (`lsp diag`
+  on a Vue package, 4 GiB).
 - `memory-room` is the one formula for whether the sandbox has room (limit, used, free, stall, and what each workload
   class costs). The daemon's resource budget judges by it, and it is also the `memory-room` command `queue-run` asks:
   it asks the daemon's room socket, and applies the formula itself where no daemon answers.
+- `dev-previews` is the record of a conversation's managed dev preview (its demo server): where the records live
+  (`/tmp/intentic-previews`), what makes one trustworthy (pid, start tick, conversation stamp, pid namespace), the cap
+  of three and the ten-minute idle bound, the conversation's own port in 47150-47199, and how a preview is stopped
+  with its reason kept for the next start. The demo's dev script writes the records, the server keeps its own
+  current, and the daemon's keeper and the `preview` command read them.
 - `./allow` reads the two exception forms every check and guard suite honours: the site pragma
   `// allow(<check>): <reason>` and the commit trailer `Allow: <check> — <reason>`.
 - `WORKSPACE_ROOT` and `HISTORY_ROOT` are defaults only: a running daemon reads its real roots from config.

package/dist/index.d.ts

@@ -104,4 +104,6 @@ export declare const TRANSLATOR_PORT = 8789;
 export declare const BROKER_PORT = 8790;
 export declare const GOOGLE_CLIENT_ID = "481795963975-cq9msl6higcd91joidrfp8mjlkuq5fk3.apps.googleusercontent.com";
 export declare const GOOGLE_TOKEN_STORAGE_KEY = "intentic.gid.481795963975-cq9msl6higcd91joidrfp8mjlkuq5fk3.apps.googleusercontent.com";
+export declare const SIGN_IN_CODE_LENGTH = 6;
+export declare const SANDBOX_NAME_MAX = 60;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AAOnC,eAAO,MAAM,cAAc,UAAU,CAAC;AAGtC,eAAO,MAAM,YAAY,aAAa,CAAC;AAGvC,eAAO,MAAM,SAAS,cAAc,CAAC;AAIrC,eAAO,MAAM,mBAAmB,kCAAqC,CAAC;AAItE,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAczD,CAAC;AAKF,eAAO,MAAM,aAAa,SAAS,CAAC;AAGpC,eAAO,MAAM,UAAU,WAAW,CAAC;AAKnC,eAAO,MAAM,WAAW,cAAc,CAAC;AAKvC,eAAO,MAAM,gBAAgB,sCAAsC,CAAC;AAGpE,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAG/C,eAAO,MAAM,aAAa,eAAe,CAAC;AAC1C,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAI1D,eAAO,MAAM,iBAAiB,uCAAuC,CAAC;AACtE,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAC7C,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAGtC,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAG5C,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAG9D,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAI3D,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AAIrE,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,eAAO,MAAM,eAAe;;iBAClB,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,YAAY;;;iBACnC,IAAI,EAAE,cAAc;iBAAE,IAAI,EAAE,aAAa;;;iBAEtC,IAAI,EAAE,eAAe;iBAAE,IAAI,EAAE,iBAAiB;;;iBAC7C,IAAI,EAAE,mBAAmB;iBAAE,IAAI,EAAE,kBAAkB;;;iBAC/C,IAAI,EAAE,eAAe;iBAAE,IAAI,EAAE,iBAAiB;;;iBAChD,IAAI,EAAE,OAAO;iBAAE,IAAI,EAAE,SAAS;;;iBAC7B,IAAI,EAAE,WAAW;iBAAE,IAAI,EAAE,UAAU;;;iBACrC,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,WAAW;;;iBACjC,IAAI,EAAE,aAAa;iBAAE,IAAI,EAAE,YAAY;;;iBACzC,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,aAAa;;;iBAClC,IAAI,EAAE,cAAc;iBAAE,IAAI,EAAE,cAAc;;;iBAC9C,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,aAAa;;;iBACjC,IAAI,EAAE,aAAa;iBAAE,IAAI,EAAE,cAAc;;;iBAC3C,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,YAAY;;;iBACjC,IAAI,EAAE,cAAc;iBAAE,IAAI,EAAE,aAAa;;;iBAGhD,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,QAAQ;;;iBACzB,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,SAAS;;CACoB,CAAC;AAEpE,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,eAAe,CAAC;AAGzD,eAAO,MAAM,gBAAgB,QAAS,aAAa,KAAG,MAA+D,CAAC;AAGtH,eAAO,MAAM,iBAAiB,QAAS,aAAa,KAAG,MAA+D,CAAC;AAIvH,cAAc,gBAAgB,CAAC;AAI/B,eAAO,MAAM,WAAW,OAAO,CAAC;AAChC,eAAO,MAAM,YAAY,OAAO,CAAC;AAGjC,eAAO,MAAM,UAAU,OAAO,CAAC;AAG/B,eAAO,MAAM,eAAe,OAAO,CAAC;AAIpC,eAAO,MAAM,WAAW,OAAO,CAAC;AAGhC,eAAO,MAAM,gBAAgB,6EAA6E,CAAC;AAG3G,eAAO,MAAM,wBAAwB,0FAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AAOnC,eAAO,MAAM,cAAc,UAAU,CAAC;AAGtC,eAAO,MAAM,YAAY,aAAa,CAAC;AAGvC,eAAO,MAAM,SAAS,cAAc,CAAC;AAIrC,eAAO,MAAM,mBAAmB,kCAAqC,CAAC;AAItE,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAczD,CAAC;AAKF,eAAO,MAAM,aAAa,SAAS,CAAC;AAGpC,eAAO,MAAM,UAAU,WAAW,CAAC;AAKnC,eAAO,MAAM,WAAW,cAAc,CAAC;AAKvC,eAAO,MAAM,gBAAgB,sCAAsC,CAAC;AAGpE,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAG/C,eAAO,MAAM,aAAa,eAAe,CAAC;AAC1C,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAI1D,eAAO,MAAM,iBAAiB,uCAAuC,CAAC;AACtE,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAC7C,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAGtC,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAG5C,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAG9D,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAI3D,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AAIrE,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,eAAO,MAAM,eAAe;;iBAClB,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,YAAY;;;iBACnC,IAAI,EAAE,cAAc;iBAAE,IAAI,EAAE,aAAa;;;iBAEtC,IAAI,EAAE,eAAe;iBAAE,IAAI,EAAE,iBAAiB;;;iBAC7C,IAAI,EAAE,mBAAmB;iBAAE,IAAI,EAAE,kBAAkB;;;iBAC/C,IAAI,EAAE,eAAe;iBAAE,IAAI,EAAE,iBAAiB;;;iBAChD,IAAI,EAAE,OAAO;iBAAE,IAAI,EAAE,SAAS;;;iBAC7B,IAAI,EAAE,WAAW;iBAAE,IAAI,EAAE,UAAU;;;iBACrC,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,WAAW;;;iBACjC,IAAI,EAAE,aAAa;iBAAE,IAAI,EAAE,YAAY;;;iBACzC,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,aAAa;;;iBAClC,IAAI,EAAE,cAAc;iBAAE,IAAI,EAAE,cAAc;;;iBAC9C,IAAI,EAAE,SAAS;iBAAE,IAAI,EAAE,aAAa;;;iBACjC,IAAI,EAAE,aAAa;iBAAE,IAAI,EAAE,cAAc;;;iBAC3C,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,YAAY;;;iBACjC,IAAI,EAAE,cAAc;iBAAE,IAAI,EAAE,aAAa;;;iBAGhD,IAAI,EAAE,MAAM;iBAAE,IAAI,EAAE,QAAQ;;;iBACzB,IAAI,EAAE,UAAU;iBAAE,IAAI,EAAE,SAAS;;CACoB,CAAC;AAEpE,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,eAAe,CAAC;AAGzD,eAAO,MAAM,gBAAgB,QAAS,aAAa,KAAG,MAA+D,CAAC;AAGtH,eAAO,MAAM,iBAAiB,QAAS,aAAa,KAAG,MAA+D,CAAC;AAIvH,cAAc,gBAAgB,CAAC;AAI/B,eAAO,MAAM,WAAW,OAAO,CAAC;AAChC,eAAO,MAAM,YAAY,OAAO,CAAC;AAGjC,eAAO,MAAM,UAAU,OAAO,CAAC;AAG/B,eAAO,MAAM,eAAe,OAAO,CAAC;AAIpC,eAAO,MAAM,WAAW,OAAO,CAAC;AAGhC,eAAO,MAAM,gBAAgB,6EAA6E,CAAC;AAG3G,eAAO,MAAM,wBAAwB,0FAAqC,CAAC;AAG3E,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAGrC,eAAO,MAAM,gBAAgB,KAAK,CAAC"}

package/dist/index.js

@@ -66,4 +66,6 @@ export const TRANSLATOR_PORT = 8789;
 export const BROKER_PORT = 8790;
 export const GOOGLE_CLIENT_ID = "481795963975-cq9msl6higcd91joidrfp8mjlkuq5fk3.apps.googleusercontent.com";
 export const GOOGLE_TOKEN_STORAGE_KEY = `intentic.gid.${GOOGLE_CLIENT_ID}`;
+export const SIGN_IN_CODE_LENGTH = 6;
+export const SANDBOX_NAME_MAX = 60;
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AAOnC,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAGtC,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AAGvC,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AAIrC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,SAAS,sBAAsB,CAAC;AAItE,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC3D,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;CACV,CAAC;AAKF,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AAGpC,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;AAKnC,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC;AAKvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,mCAAmC,CAAC;AAGpE,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAG/C,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAI1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAGtC,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAG5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAG9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAI3D,MAAM,CAAC,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAIrE,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D,MAAM,CAAC,MAAM,eAAe,GAAG;IAC3B,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE;IAC5C,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE;IAElD,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC1D,OAAO,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE;IAChE,WAAW,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC/D,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7C,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;IACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE;IAChD,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE;IACtD,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE;IAClD,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE;IAC1D,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE;IAChD,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE;IACxD,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE;IACjD,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE;IAGzD,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;CACkB,CAAC;AAKpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAkB,EAAU,EAAE,CAAC,GAAG,oBAAoB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAGtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAkB,EAAU,EAAE,CAAC,GAAG,mBAAmB,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAIvH,cAAc,gBAAgB,CAAC;AAI/B,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC;AAChC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AAGjC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC;AAG/B,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAIpC,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC;AAGhC,MAAM,CAAC,MAAM,gBAAgB,GAAG,0EAA0E,CAAC;AAG3G,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AAOnC,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAGtC,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AAGvC,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AAIrC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,SAAS,sBAAsB,CAAC;AAItE,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC3D,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;CACV,CAAC;AAKF,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AAGpC,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;AAKnC,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC;AAKvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,mCAAmC,CAAC;AAGpE,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAG/C,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAI1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAGtC,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAG5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAG9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAI3D,MAAM,CAAC,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAIrE,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D,MAAM,CAAC,MAAM,eAAe,GAAG;IAC3B,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE;IAC5C,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE;IAElD,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC1D,OAAO,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE;IAChE,WAAW,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC/D,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7C,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE;IACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE;IAChD,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE;IACtD,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE;IAClD,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE;IAC1D,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE;IAChD,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE;IACxD,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE;IACjD,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE;IAGzD,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;CACkB,CAAC;AAKpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAkB,EAAU,EAAE,CAAC,GAAG,oBAAoB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAGtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAkB,EAAU,EAAE,CAAC,GAAG,mBAAmB,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAIvH,cAAc,gBAAgB,CAAC;AAI/B,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC;AAChC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AAGjC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC;AAG/B,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAIpC,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC;AAGhC,MAAM,CAAC,MAAM,gBAAgB,GAAG,0EAA0E,CAAC;AAG3G,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,gBAAgB,EAAE,CAAC;AAG3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAGrC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentic/constants",
-  "version": "1.364.0",
+  "version": "1.366.0",
   "description": "Shared constants for the intentic packages, ports, paths, and image references the daemon, CLIs and desktop app all agree on",
   "license": "MIT",
   "type": "module",
@@ -29,6 +29,8 @@
     "src/memory-room.d.mts",
     "src/allow.mjs",
     "src/allow.d.mts",
+    "src/dev-previews.mjs",
+    "src/dev-previews.d.mts",
     "src/heavy/heavy-rules.cjs",
     "src/heavy/heavy-rules.d.cts",
     "src/heavy/heavy-turn.cjs",
@@ -83,6 +85,10 @@
       "types": "./src/allow.d.mts",
       "default": "./src/allow.mjs"
     },
+    "./dev-previews": {
+      "types": "./src/dev-previews.d.mts",
+      "default": "./src/dev-previews.mjs"
+    },
     "./heavy-rules": {
       "types": "./src/heavy/heavy-rules.d.cts",
       "default": "./src/heavy/heavy-rules.cjs"

package/src/dev-previews.d.mts

@@ -0,0 +1,58 @@
+// Types for dev-previews.mjs, the records of long-lived dev previews (the demo's per-conversation dev servers).
+export interface PreviewRecord {
+    readonly v: 1;
+    readonly conversation: string;
+    readonly label: string;
+    readonly pid: number;
+    readonly startTicks: string;
+    readonly pidNamespace: string;
+    readonly port: number;
+    readonly url: string;
+    readonly root: string;
+    readonly log: string;
+    readonly startedAt: number;
+    readonly lastActiveAt: number;
+}
+
+export interface EndedNote {
+    readonly reason: string;
+    readonly at: number;
+}
+
+export const PREVIEWS_DIR_ENV: string;
+export const DEFAULT_PREVIEWS_DIR: string;
+export const OWNER_ENV: string;
+export const RECORD_ENV: string;
+export const PREVIEW_PORTS: { readonly first: number; readonly last: number };
+export const PREVIEW_CAP: number;
+export const PREVIEW_IDLE_MS: number;
+export const TOUCH_EVERY_MS: number;
+
+export function previewsDir(env?: Readonly<Record<string, string | undefined>>): string;
+export function recordName(conversation: string, label: string): string;
+export function recordPath(dir: string, conversation: string, label: string): string;
+export function hostLabel(conversation: string): string;
+export function startTicksOf(pid: number, procRoot?: string): string | undefined;
+export function ownerOf(pid: number, procRoot?: string): string | undefined;
+export function pidNamespaceOf(pid?: number | "self", procRoot?: string): string;
+export function parseRecord(text: string): PreviewRecord | undefined;
+export function recordIsOurs(record: PreviewRecord, procRoot?: string): boolean;
+export function recordIsLive(record: PreviewRecord, procRoot?: string): boolean;
+export function readRecords(dir?: string, procRoot?: string): PreviewRecord[];
+export function writeRecord(dir: string, record: PreviewRecord): string;
+export function touchRecord(path: string, at?: number): PreviewRecord | undefined;
+export function removeRecord(dir: string, record: PreviewRecord): void;
+export function noteStop(dir: string, record: PreviewRecord, reason: string): void;
+export function stopReason(dir: string, record: PreviewRecord): string | undefined;
+export function endedNote(dir: string, conversation: string, label: string): EndedNote | undefined;
+export function clearEnded(dir: string, conversation: string, label: string): void;
+export function overCap(records: readonly PreviewRecord[], cap?: number): PreviewRecord[];
+export function idleRecords(records: readonly PreviewRecord[], now?: number, idleMs?: number): PreviewRecord[];
+export function stopPreview(
+    dir: string,
+    record: PreviewRecord,
+    reason: string,
+    options?: { readonly graceMs?: number; readonly procRoot?: string },
+): Promise<void>;
+export function preferredPort(conversation: string): number;
+export function freePreviewPort(taken?: ReadonlySet<number>, from?: number, isFree?: (port: number) => Promise<boolean>): Promise<number | undefined>;

package/src/dev-previews.mjs

@@ -0,0 +1,321 @@
+// The record a long-lived dev preview leaves while it runs, so the sandbox can keep their number down. The demo's dev
+// script starts one per conversation and writes its record (_site/demo/scripts/dev.mjs); the server itself refreshes
+// the record while it is used and stops itself once it is not (_site/demo/vite.config.ts, previewKeeper); the daemon
+// shields a recorded server from the sweep that ends a finished turn's processes, and stops one that outlived its own
+// idle stop (_sandbox/sandbox/src/processes/dev-previews.ts); the `preview` command lists and stops them
+// (_sandbox/sandbox/bin/preview). Plain JavaScript with no dependencies, so all of them read one definition of where
+// the records live, what makes one trustworthy, and how a preview is stopped.
+//
+// A record names a process, and the keepers signal it, so a record alone proves nothing: the process must still be
+// alive, must have started at the clock tick the record says (a reused pid fails that), and must carry the
+// conversation stamp (INTENTIC_TURN_OWNER) the record claims. A record written from another pid namespace (an agent
+// domain has its own) names a pid this reader cannot see, so it is neither trusted nor removed here.
+import { chmodSync, mkdirSync, readdirSync, readFileSync, readlinkSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { createServer } from "node:net";
+import { join } from "node:path";
+
+export const PREVIEWS_DIR_ENV = "INTENTIC_PREVIEWS_DIR";
+// /tmp, not the workspace: every conversation's mount namespace and the daemon see the same /tmp (the background
+// jobs' run directories live there for the same reason), and nothing here should ever ride a land.
+export const DEFAULT_PREVIEWS_DIR = "/tmp/intentic-previews";
+export const OWNER_ENV = "INTENTIC_TURN_OWNER";
+// Set on a server the dev script started, naming its record, so the server can keep it current.
+export const RECORD_ENV = "INTENTIC_PREVIEW_RECORD";
+// Ports the previews pick from: clear of 47145 and 47146, which the editor mirrors from the owner's own machine (a
+// server there may be serving the owner's tree, not the conversation's).
+export const PREVIEW_PORTS = Object.freeze({ first: 47150, last: 47199 });
+// How many previews run at once across the sandbox, and how long one may go unused before it stops. One demo server
+// holds 0.8 GiB warm and 2 GiB while it optimizes (measured 2026-10-27); five to seven of them, each up for a whole turn
+// and idle most of it, were 9-13 GiB of a 21 GiB sandbox on 2026-10-26.
+export const PREVIEW_CAP = 3;
+export const PREVIEW_IDLE_MS = 10 * 60_000;
+// How often a running server refreshes its record's lastActiveAt while it is used.
+export const TOUCH_EVERY_MS = 30_000;
+// How long a signalled preview gets to exit before SIGKILL.
+const TERM_GRACE_MS = 5_000;
+const RECORD_SUFFIX = ".json";
+const STOP_SUFFIX = ".stop";
+const ENDED_SUFFIX = ".ended";
+
+export const previewsDir = (env = process.env) => env[PREVIEWS_DIR_ENV] || DEFAULT_PREVIEWS_DIR;
+
+// One record per conversation and label: a second start in the same conversation finds the first.
+export const recordName = (conversation, label) => `${conversation}--${label}`.replaceAll(/[^A-Za-z0-9._-]/gu, "_");
+export const recordPath = (dir, conversation, label) => join(dir, `${recordName(conversation, label)}${RECORD_SUFFIX}`);
+const stopPath = (dir, conversation, label) => join(dir, `${recordName(conversation, label)}${STOP_SUFFIX}`);
+const endedPath = (dir, conversation, label) => join(dir, `${recordName(conversation, label)}${ENDED_SUFFIX}`);
+
+// A conversation id as one DNS label, for its preview's hostname: `<label>.demo.localhost`.
+export const hostLabel = (conversation) =>
+    conversation
+        .toLowerCase()
+        .replaceAll(/[^a-z0-9-]+/gu, "-")
+        .replaceAll(/^-+|-+$/gu, "")
+        .slice(0, 63) || "preview";
+
+// Field 22 of /proc/<pid>/stat, the process's start time in clock ticks since boot. The command name (field 2) can
+// hold spaces and parentheses, so fields are counted after its closing parenthesis.
+export const startTicksOf = (pid, procRoot = "/proc") => {
+    try {
+        const stat = readFileSync(join(procRoot, String(pid), "stat"), "utf8");
+        return stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19];
+    } catch {
+        // allow(silent-catch): no such process (or no /proc) is the answer "not running".
+        return undefined;
+    }
+};
+
+// The conversation stamp a process started with, from its initial environment.
+export const ownerOf = (pid, procRoot = "/proc") => {
+    try {
+        const environ = readFileSync(join(procRoot, String(pid), "environ"), "utf8");
+        const entry = environ.split("\0").find((line) => line.startsWith(`${OWNER_ENV}=`));
+        return entry === undefined ? undefined : entry.slice(OWNER_ENV.length + 1);
+    } catch {
+        // allow(silent-catch): unreadable means unowned, and an unowned process is never one a record may name.
+        return undefined;
+    }
+};
+
+// Which pid namespace a process (default: this one) is in, as the kernel names it (`pid:[4026532293]`).
+export const pidNamespaceOf = (pid = "self", procRoot = "/proc") => {
+    try {
+        return readlinkSync(join(procRoot, String(pid), "ns", "pid"));
+    } catch {
+        // allow(silent-catch): no procfs is one namespace nobody can tell apart, named as such.
+        return "";
+    }
+};
+
+// A preview's address is loopback: the IP itself, or a name under `.localhost`, which browsers resolve there.
+const LOOPBACK_URL = /^http:\/\/(127\.0\.0\.1|[a-z0-9-]+(\.[a-z0-9-]+)*\.localhost):\d+\//u;
+
+const isPort = (port) => Number.isSafeInteger(port) && port > 0 && port < 65_536;
+// What each field of a record must be once coerced.
+const RECORD_RULES = [
+    (record) => record.v === 1 && record.conversation !== "" && record.label !== "",
+    (record) => Number.isSafeInteger(record.pid) && record.pid > 1 && /^\d+$/u.test(record.startTicks),
+    (record) => isPort(record.port) && LOOPBACK_URL.test(record.url),
+    (record) => Number.isFinite(record.startedAt) && Number.isFinite(record.lastActiveAt),
+];
+
+// A record as read off disk, or undefined for anything that is not one: every field coerced to its type, then held to
+// what it means (a positive pid, digits for the start tick, a port in range, a loopback URL).
+export const parseRecord = (text) => {
+    let raw;
+    try {
+        raw = JSON.parse(text) ?? {};
+    } catch {
+        // allow(silent-catch): a half-written or foreign file is not a record.
+        return undefined;
+    }
+    const record = {
+        v: Number(raw.v),
+        conversation: String(raw.conversation ?? ""),
+        label: String(raw.label ?? ""),
+        pid: Number(raw.pid),
+        startTicks: String(raw.startTicks ?? ""),
+        pidNamespace: String(raw.pidNamespace ?? ""),
+        port: Number(raw.port),
+        url: String(raw.url ?? ""),
+        root: String(raw.root ?? ""),
+        log: String(raw.log ?? ""),
+        startedAt: Number(raw.startedAt),
+        lastActiveAt: Number(raw.lastActiveAt ?? raw.startedAt),
+    };
+    return RECORD_RULES.every((holds) => holds(record)) ? record : undefined;
+};
+
+// Whether a record was written from this reader's pid namespace, so its pid means the process it meant.
+export const recordIsOurs = (record, procRoot = "/proc") => record.pidNamespace === pidNamespaceOf("self", procRoot);
+
+// Whether the process a record names is the one that wrote it, still running.
+export const recordIsLive = (record, procRoot = "/proc") =>
+    startTicksOf(record.pid, procRoot) === record.startTicks && ownerOf(record.pid, procRoot) === record.conversation;
+
+// Written whole and renamed into place, so a reader never sees half a file.
+const writeWhole = (path, text) => {
+    const temporary = `${path}.${String(process.pid)}.tmp`;
+    writeFileSync(temporary, text);
+    renameSync(temporary, path);
+};
+
+// A dead record's stop note becomes its ended note: why it stopped, kept for the next start or listing to say.
+const retire = (dir, record) => {
+    const reason = stopReason(dir, record);
+    if (reason !== undefined) {
+        writeWhole(endedPath(dir, record.conversation, record.label), `${JSON.stringify({ reason, at: Date.now() })}\n`);
+    }
+    removeRecord(dir, record);
+};
+
+// Every live record in the directory written from this pid namespace; a file that does not parse is removed, and so is
+// one of ours naming a process that is gone or not its own (its stop note kept as the ended note).
+export const readRecords = (dir = previewsDir(), procRoot = "/proc") => {
+    let names;
+    try {
+        names = readdirSync(dir);
+    } catch {
+        // allow(silent-catch): no directory yet is no previews.
+        return [];
+    }
+    const namespace = pidNamespaceOf("self", procRoot);
+    const records = [];
+    for (const name of names.filter((one) => one.endsWith(RECORD_SUFFIX))) {
+        const path = join(dir, name);
+        let record;
+        try {
+            record = parseRecord(readFileSync(path, "utf8"));
+        } catch {
+            // allow(silent-catch): a file removed between the listing and the read is gone either way.
+            continue;
+        }
+        if (record === undefined) {
+            rmSync(path, { force: true });
+        } else if (record.pidNamespace !== namespace) {
+            continue;
+        } else if (recordIsLive(record, procRoot)) {
+            records.push(record);
+        } else {
+            retire(dir, record);
+        }
+    }
+    return records.toSorted((a, b) => a.startedAt - b.startedAt);
+};
+
+export const writeRecord = (dir, record) => {
+    mkdirSync(dir, { recursive: true });
+    // Sticky and open to all, like /tmp: a conversation in an agent domain writes here as a different uid.
+    try {
+        chmodSync(dir, 0o1777);
+    } catch {
+        // allow(silent-catch): a directory someone else made is theirs to keep open; writing below still says if it is not.
+    }
+    const path = recordPath(dir, record.conversation, record.label);
+    writeWhole(path, `${JSON.stringify(record)}\n`);
+    rmSync(stopPath(dir, record.conversation, record.label), { force: true });
+    rmSync(endedPath(dir, record.conversation, record.label), { force: true });
+    return path;
+};
+
+// The record with a later lastActiveAt, written in place; a record removed meanwhile (the preview was stopped) stays
+// removed.
+export const touchRecord = (path, at = Date.now()) => {
+    let record;
+    try {
+        record = parseRecord(readFileSync(path, "utf8"));
+    } catch {
+        // allow(silent-catch): no record is nothing to touch.
+        return undefined;
+    }
+    if (record === undefined) {
+        return undefined;
+    }
+    const touched = { ...record, lastActiveAt: Math.max(record.lastActiveAt, at) };
+    writeWhole(path, `${JSON.stringify(touched)}\n`);
+    return touched;
+};
+
+export const removeRecord = (dir, record) => {
+    rmSync(recordPath(dir, record.conversation, record.label), { force: true });
+    rmSync(stopPath(dir, record.conversation, record.label), { force: true });
+};
+
+// Why the sandbox is stopping a preview, written before the signal, so whoever looks next can say why it stopped.
+export const noteStop = (dir, record, reason) => {
+    writeWhole(stopPath(dir, record.conversation, record.label), `${reason}\n`);
+};
+
+export const stopReason = (dir, record) => {
+    try {
+        return readFileSync(stopPath(dir, record.conversation, record.label), "utf8").trim() || undefined;
+    } catch {
+        // allow(silent-catch): no note means nobody but the preview's own caller stopped it.
+        return undefined;
+    }
+};
+
+// Why this conversation's last preview of `label` stopped, when the sandbox stopped it: { reason, at }.
+export const endedNote = (dir, conversation, label) => {
+    try {
+        const note = JSON.parse(readFileSync(endedPath(dir, conversation, label), "utf8")) ?? {};
+        const ended = { reason: String(note.reason ?? ""), at: Number(note.at) };
+        return ended.reason !== "" && Number.isFinite(ended.at) ? ended : undefined;
+    } catch {
+        // allow(silent-catch): no note is a preview nobody stopped, or one already reported.
+        return undefined;
+    }
+};
+
+export const clearEnded = (dir, conversation, label) => rmSync(endedPath(dir, conversation, label), { force: true });
+
+// Which previews to stop so that one more fits under `cap`: the least recently used first.
+export const overCap = (records, cap = PREVIEW_CAP) =>
+    records.toSorted((a, b) => a.lastActiveAt - b.lastActiveAt).slice(0, Math.max(0, records.length - cap + 1));
+
+// Which previews have gone unused past the idle bound, judged by their record alone.
+export const idleRecords = (records, now = Date.now(), idleMs = PREVIEW_IDLE_MS) => records.filter((record) => now - record.lastActiveAt >= idleMs);
+
+const signalGroup = (pid, signal) => {
+    try {
+        process.kill(-pid, signal);
+        return true;
+    } catch {
+        try {
+            process.kill(pid, signal);
+            return true;
+        } catch {
+            // allow(silent-catch): already gone, which is what stopping it was for.
+            return false;
+        }
+    }
+};
+
+const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+// Stops a preview: the reason noted first, then SIGTERM to its process group (a preview leads its own), SIGKILL once
+// the grace is up, and its record retired so the reason is what remains. Resolves once it has exited.
+export const stopPreview = async (dir, record, reason, { graceMs = TERM_GRACE_MS, procRoot = "/proc" } = {}) => {
+    noteStop(dir, record, reason);
+    if (signalGroup(record.pid, "SIGTERM")) {
+        const deadline = Date.now() + graceMs;
+        while (recordIsLive(record, procRoot) && Date.now() < deadline) {
+            await delay(100);
+        }
+        if (recordIsLive(record, procRoot)) {
+            signalGroup(record.pid, "SIGKILL");
+        }
+    }
+    retire(dir, record);
+};
+
+// Whether a port is free to listen on at 127.0.0.1, by trying it.
+const portFree = (port) =>
+    new Promise((resolve) => {
+        const probe = createServer();
+        probe.once("error", () => resolve(false));
+        probe.listen({ host: "127.0.0.1", port, exclusive: true }, () => probe.close(() => resolve(true)));
+    });
+
+// The port a conversation's preview asks for first: the same one every time, so its origin (and the sign-in and look
+// stored under it) survives a restart of its server.
+export const preferredPort = (conversation) => {
+    let hash = 0;
+    for (const char of conversation) {
+        hash = (hash * 31 + char.codePointAt(0)) % 1_000_003;
+    }
+    return PREVIEW_PORTS.first + (hash % (PREVIEW_PORTS.last - PREVIEW_PORTS.first + 1));
+};
+
+// The first free port in the preview range, starting at `from` and wrapping, that no live record claims; undefined
+// when all are taken.
+export const freePreviewPort = async (taken = new Set(), from = PREVIEW_PORTS.first, isFree = portFree) => {
+    const span = PREVIEW_PORTS.last - PREVIEW_PORTS.first + 1;
+    for (let step = 0; step < span; step += 1) {
+        const port = PREVIEW_PORTS.first + ((from - PREVIEW_PORTS.first + step) % span);
+        if (!taken.has(port) && (await isFree(port))) {
+            return port;
+        }
+    }
+    return undefined;
+};

package/src/heavy/heavy-rules.cjs

@@ -17,6 +17,11 @@ const QUEUE_SKIPPED_EXIT_CODE = 75;
 // Characters of an invocation a rule's regex runs against; bounds backtracking, since node has no regex timeout.
 const MATCH_LIMIT = 4096;
 
+// `vue-tsc` as the program, not a word joined to it (`check-vue-tsc`).
+const VUE_TSC = "(?<![-.])\\bvue-tsc\\b(?![-.])";
+// The two packages whose typecheck compiles the editor's whole source, by package name or by path.
+const EDITOR_PACKAGE = "(@intentic/(web|demo)|_editor/web|_site/demo)(?![-\\w])";
+
 // The shipped rules and settings. Every rule is something measured pinning a sandbox, not merely slow.
 const SHIPPED_HEAVY_COMMANDS = Object.freeze({
     // How many matching programs may run at once across the sandbox; two fits twice the peak of one bounded run.
@@ -61,6 +66,48 @@ const SHIPPED_HEAVY_COMMANDS = Object.freeze({
             pool: "install",
             limit: 1,
         },
+        // The editor's typecheck, one at a time in a lane of its own, priced at what it holds (memory-room.mjs
+        // SIZE_BYTES): `vue-tsc` over `_editor/web` peaks at 6.8 GiB of its 8 GiB heap, and `_site/demo`'s check compiles
+        // the same source (measured 2026-10-26: 418-571 s each). Two at once, priced at a toolchain's 1 GiB, were the
+        // 20 GiB peaks of 2026-10-26, holding both heavy slots for 13-29 minutes while ten commands queued behind them.
+        // `nests`: judged again under a program that already holds a slot of a pool no `nests` rule names, so the
+        // `vue-tsc` a `pnpm -r typecheck` or a repository verification starts still takes this lane (see matchInvocation
+        // for why that cannot deadlock).
+        // - A changed-files check (`lsp diag` on a Vue package, _search/lsp/src/vue-check.ts) names the tsconfig it
+        //   writes, `tsconfig.lsp-changed.<pid>.json`, and is priced as what it loads (measured 2026-10-27: 1.0-3.9 GiB,
+        //   5-55 s). A lane of its own, two at once, so it never waits behind a full check's ten minutes; the memory gate
+        //   still prices each one.
+        // - The program, or the package script, naming the editor or the demo: `vue-tsc -p tsconfig.app.json` (only the
+        //   editor has one), `pnpm --filter @intentic/web typecheck`, `turbo run typecheck --filter=@intentic/demo`.
+        //   Never two at once, not even after the wait, for the reason `repo-verify` gives.
+        // - The same program or script run from inside either package, which its arguments cannot say (`cwd`).
+        {
+            id: "vue-typecheck-changed",
+            pattern: `${VUE_TSC}.*\\btsconfig\\.lsp-changed\\b`,
+            pool: "vue-typecheck-changed",
+            limit: 2,
+            size: "scoped-typecheck",
+            nests: true,
+        },
+        {
+            id: "editor-typecheck",
+            pattern: `${VUE_TSC}.*(\\btsconfig\\.app\\.json\\b|${EDITOR_PACKAGE})|^(pnpm|npm|yarn|bun|turbo)\\b(?=.*${EDITOR_PACKAGE})(?=.*\\btypecheck\\b)`,
+            pool: "vue-typecheck",
+            limit: 1,
+            size: "editor-typecheck",
+            nests: true,
+            onDeadline: "skip",
+        },
+        {
+            id: "editor-typecheck-here",
+            pattern: `^${VUE_TSC}|^(pnpm|npm|yarn|bun)\\b.*\\btypecheck\\b`,
+            cwd: "(^|/)(_editor/web|_site/demo)/?$",
+            pool: "vue-typecheck",
+            limit: 1,
+            size: "editor-typecheck",
+            nests: true,
+            onDeadline: "skip",
+        },
         // A program's name joined to `.` or `-` is another word (`check-tsc`), not the program.
         { id: "vitest", pattern: "(?<![-.])\\b(vitest|jest)\\b(?![-.])" },
         { id: "typechecker", pattern: "(?<![-.])\\b(tsc|tsgo|vue-tsc)\\b(?![-.])" },
@@ -90,7 +137,10 @@ const EARLIER_SHIPPED_RULES = Object.freeze([
 ]);
 
 const SETTING_KEYS = Object.freeze(["limit", "defaultPool", "waitSeconds", "memoryGateSeconds", "maxHoldSeconds", "onDeadline"]);
-const RULE_KEYS = Object.freeze(["id", "pattern", "pool", "limit", "maxHoldSeconds", "exempt", "onDeadline"]);
+// `cwd`: a regex the program's working directory must match too, for what its arguments cannot name. `size`: the
+// memory gate's price for it (memory-room.mjs SIZE_BYTES) instead of its class's. `nests`: judged even under a program
+// already holding a slot of another pool.
+const RULE_KEYS = Object.freeze(["id", "pattern", "pool", "limit", "maxHoldSeconds", "exempt", "onDeadline", "cwd", "size", "nests"]);
 
 // Two rules are the same when every field either names is equal; key order and absent-versus-undefined do not count.
 const sameRule = (left, right) => RULE_KEYS.every((key) => left[key] === right[key]);
@@ -150,28 +200,93 @@ const compileRule = (rule, report) => {
     }
 };
 
+// A rule's `cwd` against the program's working directory: absent matches anywhere, and one that does not compile or a
+// directory nobody named matches nothing.
+const inDirectory = (rule, cwd, report) => {
+    if (rule.cwd === undefined) {
+        return true;
+    }
+    if (cwd === undefined) {
+        return false;
+    }
+    try {
+        return new RegExp(rule.cwd, "i").test(cwd.slice(0, MATCH_LIMIT));
+    } catch (error) {
+        report?.(`${rule.id}: cwd ${error instanceof Error ? error.message : "bad pattern"}`);
+        return false;
+    }
+};
+
+// The pools some `nests` rule queues into: a program holding a slot of one of them is never judged again.
+const nestingPools = (config) => new Set(config.rules.filter((rule) => rule.nests === true && rule.exempt !== true).map((rule) => rule.pool ?? config.defaultPool));
+
+// Whether a rule is judged at all for a program whose ancestors already hold slots of `held`. Nothing held: every rule.
+// Under a held slot, an `exempt` rule still ends the search (a watch is no less long-lived for running under a
+// verification), and a `nests` rule is judged only while every held pool is one no `nests` rule names.
+//
+// WHY THIS CANNOT DEADLOCK. A program waits for a slot while holding others only through a `nests` rule, so every wait
+// that holds something goes from a pool no `nests` rule names to one that a `nests` rule names, and never from a nesting
+// pool to anything. Waits-for edges between pools all point one way, so no cycle of them exists, across sessions too;
+// and a program never waits on a pool it holds, which is the flock on its own ancestor's slot that would never be free.
+// The owner's overrides cannot break this: a `nests` rule they add makes its pool a nesting pool, whose holders are then
+// never judged again.
+const judgedUnder = (rule, held, nesting) => {
+    if (held.length === 0 || rule.exempt === true) {
+        return true;
+    }
+    return rule.nests === true && held.every((pool) => !nesting.has(pool));
+};
+
 // The rule a program's invocation falls under, with what the queue does with it; undefined for one that is not heavy.
-const matchInvocation = (invocation, config, report) => {
+// `where.cwd` is the program's working directory, for a rule with a `cwd`; `where.heldPools` the pools programs above
+// this one already hold slots of (heldPoolsOf), which narrows the rules judged (judgedUnder).
+const matchInvocation = (invocation, config, report, where = {}) => {
     const text = invocation.slice(0, MATCH_LIMIT);
+    const held = where.heldPools ?? [];
+    const nesting = held.length === 0 ? new Set() : nestingPools(config);
     for (const rule of config.rules) {
+        if (!judgedUnder(rule, held, nesting)) {
+            continue;
+        }
         const compiled = compileRule(rule, report);
-        if (compiled === undefined || !compiled.regex.test(text)) {
+        if (compiled === undefined || !compiled.regex.test(text) || !inDirectory(rule, where.cwd, report)) {
             continue;
         }
         if (rule.exempt === true) {
             return undefined;
         }
-        return {
+        const match = {
             id: rule.id,
             pool: rule.pool ?? config.defaultPool,
             limit: rule.limit ?? config.limit,
             maxHold: rule.maxHoldSeconds ?? config.maxHoldSeconds,
             onDeadline: rule.onDeadline ?? config.onDeadline,
         };
+        if (rule.size !== undefined) {
+            match.size = rule.size;
+        }
+        return match;
     }
     return undefined;
 };
 
+// The pools programs above this one hold slots of, from what they handed down: the rule the nearest was queued under
+// (INTENTIC_HEAVY_HELD, by its id in the merged table) and the slot queue-run took last (INTENTIC_QUEUE_SLOT,
+// `<queue dir>/<pool>/slot.<n>`), which differ when a script queued itself under a queued program. Empty for a program
+// nothing above has queued.
+const heldPoolsOf = (env, config) => {
+    const pools = new Set();
+    const held = env.INTENTIC_HEAVY_HELD ?? "";
+    if (held !== "") {
+        pools.add(ruleById(config, held)?.pool ?? config.defaultPool);
+    }
+    const slot = env.INTENTIC_QUEUE_SLOT ?? "";
+    if (slot !== "") {
+        pools.add(slot.split("/").filter((part) => part !== "").at(-2) ?? config.defaultPool);
+    }
+    return [...pools];
+};
+
 // queue-run's flags for a match (bin/queue-run), before its `--`.
 const queueArgs = (match, config) => [
     "--pool",
@@ -218,9 +333,14 @@ const targetedRun = (invocation) => {
     });
 };
 
-// queue-run's `--size` for a match: `targeted` for a test run aimed at named files, nothing for everything else.
-const sizeArgs = (match, invocation) =>
-    ["vitest", "package-script"].includes(match.id) && targetedRun(invocation) ? ["--size", "targeted"] : [];
+// queue-run's `--size` for a match: its rule's own price where it names one, `targeted` for a test run aimed at named
+// files, nothing for everything else.
+const sizeArgs = (match, invocation) => {
+    if (match.size !== undefined) {
+        return ["--size", match.size];
+    }
+    return ["vitest", "package-script"].includes(match.id) && targetedRun(invocation) ? ["--size", "targeted"] : [];
+};
 
 // When a slot held this long is worth a line in the log: half of what its own rule lets it hold, never for a rule that
 // lets it hold forever.
@@ -242,4 +362,5 @@ module.exports = {
     sizeArgs,
     holdWarnSeconds,
     ruleById,
+    heldPoolsOf,
 };

package/src/heavy/heavy-rules.d.cts

@@ -10,6 +10,12 @@ export interface HeavyCommandRule {
     readonly maxHoldSeconds?: number | undefined;
     readonly exempt?: boolean | undefined;
     readonly onDeadline?: OnDeadline | undefined;
+    // A regex the program's working directory must match too, for what its arguments cannot name.
+    readonly cwd?: string | undefined;
+    // The memory gate's price by name (memory-room.mjs SIZE_BYTES) instead of its class's; an unknown name is the class.
+    readonly size?: string | undefined;
+    // Judged even under a program already holding a slot, while every held pool is one no `nests` rule names.
+    readonly nests?: boolean | undefined;
 }
 
 // An owner's change to the table: a shipped rule's id changes the fields it names, or removes it (`disabled`); any other
@@ -22,6 +28,12 @@ export interface HeavyCommandRuleEdit {
     readonly maxHoldSeconds?: number | undefined;
     readonly exempt?: boolean | undefined;
     readonly onDeadline?: OnDeadline | undefined;
+    // A regex the program's working directory must match too, for what its arguments cannot name.
+    readonly cwd?: string | undefined;
+    // The memory gate's price by name (memory-room.mjs SIZE_BYTES) instead of its class's; an unknown name is the class.
+    readonly size?: string | undefined;
+    // Judged even under a program already holding a slot, while every held pool is one no `nests` rule names.
+    readonly nests?: boolean | undefined;
     readonly disabled?: boolean | undefined;
 }
 
@@ -57,6 +69,14 @@ export interface HeavyMatch {
     readonly limit: number;
     readonly maxHold: number;
     readonly onDeadline: OnDeadline;
+    readonly size?: string;
+}
+
+// Where a program runs, for the rules that look past its arguments.
+export interface MatchWhere {
+    readonly cwd?: string | undefined;
+    // The pools programs above it already hold slots of (heldPoolsOf).
+    readonly heldPools?: readonly string[] | undefined;
 }
 
 export const QUEUE_SKIPPED_EXIT_CODE: 75;
@@ -65,11 +85,13 @@ export const SHIPPED_HEAVY_COMMANDS: HeavyCommandSettings & { readonly rules: re
 export const EARLIER_SHIPPED_RULES: readonly HeavyCommandRule[];
 export function mergeHeavyRules(overrides?: HeavyCommandOverrides): HeavyCommands;
 export function overridesOf(full: Partial<HeavyCommandSettings> & { readonly rules?: readonly HeavyCommandRule[] | undefined }): HeavyCommandOverrides;
-export function matchInvocation(invocation: string, config: HeavyCommands, report?: (detail: string) => void): HeavyMatch | undefined;
+export function matchInvocation(invocation: string, config: HeavyCommands, report?: (detail: string) => void, where?: MatchWhere): HeavyMatch | undefined;
 export function queueArgs(match: HeavyMatch, config: HeavyCommandSettings): string[];
 // Whether a test invocation names the files it runs, for the memory gate's smaller price.
 export function targetedRun(invocation: string): boolean;
-// queue-run's `--size targeted` for a targeted test run under a test rule, else nothing.
+// queue-run's `--size <name>`: the rule's own size, else `targeted` for a targeted test run under a test rule, else nothing.
 export function sizeArgs(match: HeavyMatch, invocation: string): string[];
 export function holdWarnSeconds(maxHold: number): number | undefined;
 export function ruleById(config: HeavyCommands, id: string): HeavyCommandRule | undefined;
+// The pools the programs above one already hold slots of, from INTENTIC_HEAVY_HELD and INTENTIC_QUEUE_SLOT.
+export function heldPoolsOf(env: Readonly<Record<string, string | undefined>>, config: HeavyCommands): string[];

package/src/heavy/heavy-turn.cjs

@@ -5,7 +5,9 @@
 // A heavy program is put in the toolchain class (its rank for the OOM killer, its CPU and IO priority) right away,
 // whether or not anything queues it, then replaces itself with the same run behind queue-run (a slot, and memory first),
 // or behind offload-run when the owner sends that kind of work to a runner. Everything it starts inherits both, and
-// nothing below it is judged again: INTENTIC_HEAVY_HELD and queue-run's INTENTIC_QUEUE_SLOT say it is already covered.
+// nothing below it is judged again (INTENTIC_HEAVY_HELD and queue-run's INTENTIC_QUEUE_SLOT say it is already covered)
+// except by a `nests` rule while every pool held above is one no `nests` rule names (heavy-rules.cjs judgedUnder): the
+// editor's `vue-tsc` takes its own lane even under a `pnpm -r typecheck` that holds a heavy slot.
 //
 // The daemon hands the table in INTENTIC_HEAVY, as JSON: { rules (heavy-rules.cjs mergeHeavyRules), queue, queueRun,
 // offloadRun, offload: { <rule id>: <runner> }, klass: { oomScoreAdj, nice, lowIo } }. Every failure here is a program
@@ -15,17 +17,18 @@
 const { spawnSync } = require("node:child_process");
 const { accessSync, constants, readFileSync, writeFileSync } = require("node:fs");
 const { getPriority, setPriority } = require("node:os");
-const { matchInvocation, queueArgs, sizeArgs } = require("./heavy-rules.cjs");
+const { heldPoolsOf, matchInvocation, queueArgs, sizeArgs } = require("./heavy-rules.cjs");
 
-// The spec the daemon handed down, or undefined when this program is not under it or is already covered.
-const pendingSpec = (env = process.env) => {
+// The spec the daemon handed down, or undefined when this program is not under it.
+const handedSpec = (env) => {
     const raw = env.INTENTIC_HEAVY;
-    if (raw === undefined || raw === "" || env.INTENTIC_HEAVY_HELD !== undefined || env.INTENTIC_QUEUE_SLOT !== undefined) {
-        return undefined;
-    }
-    return JSON.parse(raw);
+    return raw === undefined || raw === "" ? undefined : JSON.parse(raw);
 };
 
+// The spec the daemon handed down, or undefined when this program is not under it or is already covered.
+const pendingSpec = (env = process.env) =>
+    env.INTENTIC_HEAVY_HELD !== undefined || env.INTENTIC_QUEUE_SLOT !== undefined ? undefined : handedSpec(env);
+
 // The class applied to this very process, raised only: descendants inherit all three at fork.
 const applyClass = (klass) => {
     if (klass === undefined || process.platform !== "linux") {
@@ -87,13 +90,13 @@ const become = (argv, env) => {
  * Judges one program as it starts. Returns false for one that is not heavy (or not under the daemon's table), true for
  * one that was classed and runs in place; a queued or offloaded one does not return.
  */
-const takeTurn = ({ program, args, command, env = process.env }) => {
-    const spec = pendingSpec(env);
+const takeTurn = ({ program, args, command, env = process.env, cwd = process.cwd() }) => {
+    const spec = handedSpec(env);
     if (spec === undefined) {
         return false;
     }
     const invocation = [program, ...args].join(" ");
-    const match = matchInvocation(invocation, spec.rules);
+    const match = matchInvocation(invocation, spec.rules, undefined, { cwd, heldPools: heldPoolsOf(env, spec.rules) });
     if (match === undefined) {
         return false;
     }

package/src/index.ts

@@ -145,3 +145,9 @@ export const GOOGLE_CLIENT_ID = "481795963975-cq9msl6higcd91joidrfp8mjlkuq5fk3.a
 
 // localStorage slot for the cached ID token, keyed by client id so a rotation can't reuse it.
 export const GOOGLE_TOKEN_STORAGE_KEY = `intentic.gid.${GOOGLE_CLIENT_ID}`;
+
+// The platform's sign-in plugin and the editor's code fields must accept the same number of digits.
+export const SIGN_IN_CODE_LENGTH = 6;
+
+// Sandbox registry and fleet requests, suggested names, and the editor's name fields share this bound.
+export const SANDBOX_NAME_MAX = 60;

package/src/memory-room.d.mts

@@ -4,8 +4,11 @@ export type RoomWorkload = "agentRuntime" | "service" | "panel" | "install" | "c
 export const COST_BYTES: Readonly<Record<RoomWorkload, number>>;
 export const PERSON_RESERVE_BYTES: number;
 export const TARGETED_RUN_BYTES: number;
-// A toolchain command aimed at named files, priced at TARGETED_RUN_BYTES instead of its class's cost.
-export type RoomSize = "targeted";
+// A toolchain command priced by its named shape instead of its class's cost (SIZE_BYTES): one aimed at named files,
+// the editor's full typecheck, a changed-files Vue typecheck.
+export type RoomSize = "targeted" | "editor-typecheck" | "scoped-typecheck";
+export const SIZE_BYTES: Readonly<Record<RoomSize, number>>;
+export function isRoomSize(size: string): size is RoomSize;
 export const TEST_PROCESS_BYTES: Readonly<{ fanOutWorker: number; standaloneWorker: number; typecheck: number; ceiling: number }>;
 export const STALL_PERCENT: number;
 export const STALL_SUSTAINED_PERCENT: number;

package/src/memory-room.mjs

@@ -30,6 +30,23 @@ export const COST_BYTES = Object.freeze({
 // the invocation, and queue-run passes it as `--size targeted`.
 export const TARGETED_RUN_BYTES = 512 * MIB;
 
+// What a toolchain command a heavy-command rule prices by name takes, instead of its class's cost (heavy-rules.cjs
+// `size`, which queue-run passes as `--size <name>`). One name per measured shape:
+export const SIZE_BYTES = Object.freeze({
+    targeted: TARGETED_RUN_BYTES,
+    // The editor's full typecheck, `vue-tsc` over `_editor/web`, or `_site/demo`'s, which compiles the same source:
+    // 6.8 GiB at its peak (measured 2026-10-26, cold and warm alike), under the 8 GiB heap its script gives it.
+    "editor-typecheck": 7 * GIB,
+    // `lsp diag` on a Vue package: `vue-tsc` over the files a change touches and their direct importers
+    // (_search/lsp/src/vue-check.ts). Measured 2026-10-27 on `_editor/web`, no build info: 3.9 GiB at its peak for
+    // AgentsView.vue (1 changed file, 8 importers, about 1,800 files loaded), 2.0 GiB for ChatPermissionCard.vue; with
+    // the build info a run leaves, 2.4 and 1.0 GiB.
+    "scoped-typecheck": 4 * GIB,
+});
+
+/** Whether `size` is a price the gate knows; any other word is priced as its class. */
+export const isRoomSize = (size) => Object.hasOwn(SIZE_BYTES, size);
+
 // What one test or typecheck process holds at its peak, for the scripts that size a fan-out to the free memory
 // (_tools/scripts/verify/test-workers.mjs) and the ceiling that stops a runaway one (_tools/scripts/lib/memory-ceiling.mjs).
 export const TEST_PROCESS_BYTES = Object.freeze({
@@ -42,7 +59,7 @@ export const TEST_PROCESS_BYTES = Object.freeze({
     // One typecheck task: most packages' tsgo or vue-tsc settle under 1 GiB, the web package's vue-tsc may take its 8 GiB
     // heap (measured 2026-10-06: 4.8 GiB from no build info, 1 GiB of it vue-i18n's `t` checked against the catalog;
     // 2026-10-20: 6.5 GiB, past the 6 GiB it had, which only a check seeded with build info stayed under), and at most
-    // one of those runs among the others.
+    // one of those runs among the others: the heavy-command table's `vue-typecheck` lane holds them to one.
     typecheck: 2 * GIB,
     // Past this one process is a leak, not a suite: twice the largest worker measured. On 2026-09-25 a single bun process
     // reached 14.7 GiB resident plus 31 GiB of swap, twice in one day, and stalled every conversation on the sandbox.
@@ -174,9 +191,9 @@ export const readReadingSync = () => readingFrom(readSync);
 
 const gib = (bytes) => `${(bytes / GIB).toFixed(1)} GiB`;
 
-/** What one more of `workload` costs: its class's cost, or a targeted run's where `size` says so. */
+/** What one more of `workload` costs: its class's cost, or a named toolchain shape's where `size` names one. */
 export const costBytesOf = (workload, size) =>
-    workload === "toolchain" && size === "targeted" ? TARGETED_RUN_BYTES : (COST_BYTES[workload] ?? COST_BYTES.agentRuntime);
+    workload === "toolchain" && size !== undefined && isRoomSize(size) ? SIZE_BYTES[size] : (COST_BYTES[workload] ?? COST_BYTES.agentRuntime);
 
 /** What starting one more of `workload` needs free: its own cost, plus a person's turn when nobody is waiting on it. */
 export const needBytes = (workload, attended, size) => costBytesOf(workload, size) + (attended ? 0 : PERSON_RESERVE_BYTES);
@@ -338,7 +355,7 @@ const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /**
  * The daemon's verdict for one more of `workload`, waiting up to `waitSeconds` for room; where no daemon answers, the
  * same formula over the same files, polled every `intervalMs`. Never throws: every failure is an answer of `run`.
- * `size: "targeted"` prices a toolchain command aimed at named files (TARGETED_RUN_BYTES); `pid` is the process the
+ * `size` prices a toolchain command by its named shape (SIZE_BYTES: `targeted` for one aimed at named files); `pid` is the process the
  * admitted work runs as, whose exit hands its reservation back at once instead of after RESERVATION_MS.
  */
 export const askRoom = async ({
@@ -364,7 +381,7 @@ export const askRoom = async ({
     return { ...verdict, waitedMs: Date.now() - startedAt, source: "formula" };
 };
 
-// `memory-room --class toolchain --wait 120 --label NAME [--size targeted] [--pid PID]` holds a command until there is
+// `memory-room --class toolchain --wait 120 --label NAME [--size targeted|editor-typecheck|…] [--pid PID]` holds a command until there is
 // room, printing why it waited, and always exits 0: a gate that cannot read the sandbox must not be the reason a command
 // did not run. `--json` prints the answer instead; `--free` prints the free memory as the daemon counts it, for a caller
 // that sizes itself to it.
@@ -385,7 +402,7 @@ const main = async (args) => {
         waitSeconds,
         label,
         intervalMs: Math.max(50, Number(option("interval-ms", "5000")) || 5000),
-        size: option("size", undefined) === "targeted" ? "targeted" : undefined,
+        size: isRoomSize(option("size", "")) ? option("size", "") : undefined,
         pid: Number.isInteger(pid) && pid > 1 ? pid : undefined,
     });
     if (args.includes("--json")) {