@intentic/sandbox-contract 1.232.0 → 1.233.0

package/src/contracts/history.contract.ts

@@ -1,5 +1,6 @@
 import { oc } from "@orpc/contract";
-import { FileDiffSchema, OkSchema, SnapshotDiffSchema, SnapshotFileDiffQuerySchema, SnapshotIdSchema, SnapshotsListSchema } from "../schemas.js";
+import { FileDiffSchema, SnapshotDiffSchema, SnapshotFileDiffQuerySchema, SnapshotIdSchema, SnapshotsListSchema } from "../schemas/history.js";
+import { OkSchema } from "../schemas/shared.js";
 
 // Workspace history: daemon-owned snapshots of /work with diff + restore. `diff` compares a checkpoint against
 // the previous visible checkpoint (everything that happened since it, hidden interval captures included); an

package/src/contracts/host.contract.ts

@@ -1,6 +1,9 @@
 import { eventIterator, oc } from "@orpc/contract";
 import { z } from "zod";
-import { HostFactsSchema, HostScopesSchema, MachineFlowLineSchema, MachineSandboxFlowSchema, OkSchema } from "../schemas.js";
+import { MachineFlowLineSchema, MachineSandboxFlowSchema } from "../schemas/computers.js";
+import { HostScopesSchema } from "../schemas/capabilities.js";
+import { HostFactsSchema } from "../schemas/hosts.js";
+import { OkSchema } from "../schemas/shared.js";
 
 /* What a connected computer can be ASKED, over the socket it opened to this sandbox.
  *

package/src/contracts/intentic.contract.ts

@@ -1,6 +1,7 @@
 import { eventIterator, oc } from "@orpc/contract";
 import { IntenticLineSchema } from "../events.js";
-import { IntenticRunSchema, OkSchema } from "../schemas.js";
+import { IntenticRunSchema } from "../schemas/intentic.js";
+import { OkSchema } from "../schemas/shared.js";
 
 // Run the in-sandbox intentic CLI (resolve/plan/apply/deployments/…) and stream its ndjson lines as they
 // arrive, so the UI sees live progress. A non-zero exit surfaces as a thrown error once the stream ends.

package/src/contracts/inventory.contract.ts

@@ -1,5 +1,5 @@
 import { oc } from "@orpc/contract";
-import { AddInventoryInputSchema, InventoryListSchema, InventoryNameParamSchema } from "../schemas.js";
+import { AddInventoryInputSchema, InventoryListSchema, InventoryNameParamSchema } from "../schemas/inventory.js";
 
 // The i.have.* / i.want.service entries in deploy.config.ts's managed region. add/remove rewrite the region and
 // commit it (mirroring an agent edit) and return the full updated list so the UI re-renders from one response.

package/src/contracts/logs.contract.ts

@@ -1,5 +1,11 @@
 import { oc } from "@orpc/contract";
-import { ClientDiagnosticsAcceptedSchema, ClientDiagnosticsReportSchema, LogReadQuerySchema, LogReadSchema, LogsListSchema } from "../schemas.js";
+import {
+    ClientDiagnosticsAcceptedSchema,
+    ClientDiagnosticsReportSchema,
+    LogReadQuerySchema,
+    LogReadSchema,
+    LogsListSchema,
+} from "../schemas/logs.js";
 
 // Daemon-owned debug logs (historyRoot/logs): terminal pipe-pane captures, intentic CLI run logs, daemon.log.
 // Reads are read-only by design, the files are written by the daemon/tmux only, so the record stays

package/src/contracts/loops.contract.ts

@@ -8,8 +8,8 @@ import {
     LoopRecordSchema,
     LoopSchema,
     LoopsListSchema,
-    OkSchema,
-} from "../schemas.js";
+} from "../schemas/loops.js";
+import { OkSchema } from "../schemas/shared.js";
 
 /* The loop routes, "run this conversation again until the goal is met".
  *

package/src/contracts/panels.contract.ts

@@ -1,5 +1,6 @@
 import { oc } from "@orpc/contract";
-import { OkSchema, PanelRepoParamSchema, PanelsListSchema } from "../schemas.js";
+import { PanelRepoParamSchema, PanelsListSchema } from "../schemas/panels.js";
+import { OkSchema } from "../schemas/shared.js";
 
 // Per-repository dev servers + the content facts the web app's extensions detect on. `list` enumerates every
 // repo with its runtime status + facts; `start`/`stop` drive the repo's dev server. Their tmux sessions list

package/src/contracts/personas.contract.ts

@@ -1,15 +1,15 @@
 import { oc } from "@orpc/contract";
 import {
-    OkSchema,
     PersonaIdParamSchema,
     PersonaKitSchema,
     PersonaPromptSchema,
     PersonaSchema,
-    PersonasListSchema,
     PersonaSkillBodySchema,
     PersonaSkillNameSchema,
     PersonaSkillSchema,
-} from "../schemas.js";
+    PersonasListSchema,
+} from "../schemas/personas.js";
+import { OkSchema } from "../schemas/shared.js";
 
 /* The sandbox's named personas (PersonaSchema): which connected accounts each one speaks for, what a session
  * wearing it may do, where it works, and what it is told. The card half is a plain three-verb CRUD with no apply

package/src/contracts/ports.contract.ts

@@ -1,8 +1,9 @@
 import { oc } from "@orpc/contract";
-import { OkSchema, PortForwardResultSchema, PortParamSchema, PortsListSchema } from "../schemas.js";
+import { PortForwardResultSchema, PortParamSchema, PortsListSchema } from "../schemas/ports.js";
+import { OkSchema } from "../schemas/shared.js";
 
 // Listening TCP ports in the sandbox + explicit forwarding through the preview proxy (see the ports section in
-// schemas.ts). `forward` is idempotent, re-forwarding a port returns its existing slot's URL; `unforward`
+// schemas/ports.ts). `forward` is idempotent, re-forwarding a port returns its existing slot's URL; `unforward`
 // frees the slot immediately (the hostname keeps resolving, the proxy just stops mapping it).
 export const portsContract = {
     list: oc

package/src/contracts/prepush.contract.ts

@@ -1,5 +1,6 @@
 import { oc } from "@orpc/contract";
-import { OkSchema, PrepushRunSchema } from "../schemas.js";
+import { PrepushRunSchema } from "../schemas/ci.js";
+import { OkSchema } from "../schemas/shared.js";
 
 // The pre-push check, the command the workspace runs when the user pushes, before anything leaves the machine
 // (see PrepushRunSchema for where this sits and why). Three verbs about ONE run: the check answers about the

package/src/contracts/providers.contract.ts

@@ -1,5 +1,6 @@
 import { oc } from "@orpc/contract";
-import { ModelsSchema, NativeProviderParamSchema } from "../schemas.js";
+import { NativeProviderParamSchema } from "../schemas/agent.js";
+import { ModelsSchema } from "../schemas/provider-oauth.js";
 
 // EVERY NATIVE PROVIDER'S PICKER CATALOG, ON ONE ROUTE.
 //

package/src/contracts/public.contract.ts

@@ -1,7 +1,8 @@
 import { oc } from "@orpc/contract";
-import { OkSchema, PublicListSchema, PublishResultSchema, PublishSchema, UnpublishSchema } from "../schemas.js";
+import { PublicListSchema, PublishResultSchema, PublishSchema, UnpublishSchema } from "../schemas/public.js";
+import { OkSchema } from "../schemas/shared.js";
 
-// The workspace outbox, what `public/` currently holds and its address (see the public section in schemas.ts).
+// The workspace outbox, what `public/` currently holds and its address (see schemas/public.ts).
 // `publish` copies a workspace file or directory in, creating the outbox if this is the first one; `unpublish`
 // withdraws one and removes the outbox behind the last, so the directory's presence always means exactly "there
 // is something published". There is no route to READ a published file: that is the whole point of the

package/src/contracts/push.contract.ts

@@ -1,5 +1,6 @@
 import { oc } from "@orpc/contract";
-import { OkSchema, PushChannelIdSchema, PushChannelSchema, PushConfigQuerySchema, PushConfigSchema, PushTestSchema } from "../schemas.js";
+import { PushChannelIdSchema, PushChannelSchema, PushConfigQuerySchema, PushConfigSchema, PushTestSchema } from "../schemas/push.js";
+import { OkSchema } from "../schemas/shared.js";
 
 // Push notifications for this sandbox. The daemon owns the VAPID keypair and the channel list (see
 // push/push-store.ts for why the key lives on the history volume), and sends on the three moments where the

package/src/contracts/runner.contract.ts

@@ -2,7 +2,9 @@ import { eventIterator, oc } from "@orpc/contract";
 import { z } from "zod";
 import { AgentEventSchema } from "../events.js";
 import { RunnerFactsSchema, RunnerSyncLineSchema, RunnerSyncSchema, RunnerTurnSchema } from "../runner-protocol.js";
-import { AgentReplySchema, EditorContextSchema, OkSchema } from "../schemas.js";
+import { EditorContextSchema } from "../schemas/agent.js";
+import { AgentReplySchema } from "../schemas/plan-limits.js";
+import { OkSchema } from "../schemas/shared.js";
 
 /* What a RUNNER can be asked, over the socket it opened to its parent sandbox. Phase-1 skeleton: the shape is
  * decided (docs/remote-runners-plan.md §5, workspace root), the implementations land with runner mode.
@@ -40,8 +42,22 @@ export const runnerContract = {
      * editor context UNCOMPOSED: the note over those paths has to be built against the runner's own
      * workspace root, since that is the machine whose files the agent will open. */
     steer: oc
-        .input(z.object({ conversationId: z.string().min(1), text: z.string(), attachments: z.array(z.string()).optional(), editorContext: EditorContextSchema.optional() }))
+        .input(
+            z.object({
+                conversationId: z.string().min(1),
+                text: z.string(),
+                attachments: z.array(z.string()).optional(),
+                editorContext: EditorContextSchema.optional(),
+            }),
+        )
         .output(z.object({ applied: z.boolean(), invalid: z.string().optional() })),
+    /* The parent pushing its declared shape onto this runner: a settings-only definition (sandbox.toml text,
+     * runner-protocol.ts's hello says why settings are all a runner declares). REPLACE semantics, not the
+     * owner-facing apply's merge-beside: a key the definition omits returns to its default, because the parent
+     * is a runner's whole authority and "make this runner match" must also unset what the parent unset. The
+     * answer names the keys now holding non-default values, which is what the parent adopts as the runner's
+     * new declared shape without waiting for a reconnect. */
+    applyDefinition: oc.input(z.object({ toml: z.string() })).output(z.object({ settings: z.array(z.string()) })),
     // Stop the running turn; the parent's stop button reaching through.
     interrupt: oc.input(RunnerTurnSchema.pick({ conversationId: true })).output(OkSchema),
     // Liveness, driven by the parent: keepalive and gone-detection in one, the host hub's heartbeat verbatim.

package/src/contracts/secrets.contract.ts

@@ -1,5 +1,6 @@
 import { oc } from "@orpc/contract";
-import { OkSchema, SecretInventorySchema, SecretKeyParamSchema, SecretKeysSchema, SecretRevealSchema, SecretSetSchema } from "../schemas.js";
+import { SecretInventorySchema, SecretKeyParamSchema, SecretKeysSchema, SecretRevealSchema, SecretSetSchema } from "../schemas/secrets.js";
+import { OkSchema } from "../schemas/shared.js";
 
 // User-supplied env-var secrets, written to the sandbox's gitignored desired-state/.env (which
 // `apply` reloads each run, no restart). `set` upserts one KEY=value, `remove` deletes it; `list` returns the

package/src/contracts/sessions.contract.ts

@@ -1,7 +1,7 @@
 import { oc } from "@orpc/contract";
 import { z } from "zod";
 import { SessionTranscriptSchema } from "../events.js";
-import { SessionIdParamSchema, SessionsListSchema } from "../schemas.js";
+import { SessionIdParamSchema, SessionsListSchema } from "../schemas/sessions.js";
 
 // Past conversations in this workspace (the SDK-native session store, keyed on the working dir, which for a
 // repo covers its linked worktrees too, so an isolated conversation's transcript is reachable from the

package/src/contracts/settings.contract.ts

@@ -1,13 +1,7 @@
 import { oc } from "@orpc/contract";
-import {
-    BuiltinPromptSchema,
-    BuiltinPromptTextSchema,
-    DayWindowQuerySchema,
-    OkSchema,
-    RuleFiringsSchema,
-    SandboxSettingsSchema,
-    SavingsReportSchema,
-} from "../schemas.js";
+import { BuiltinPromptSchema, BuiltinPromptTextSchema, RuleFiringsSchema, SandboxSettingsSchema, SavingsReportSchema } from "../schemas/settings.js";
+import { OkSchema } from "../schemas/shared.js";
+import { DayWindowQuerySchema } from "../schemas/usage.js";
 
 // Per-sandbox agent settings (.intentic/config/settings.json). `get` returns the current flags with defaults applied
 // when the file is absent; `set` overwrites them. `savings` reports what each token-reduction mechanism was

package/src/contracts/share.contract.ts

@@ -1,7 +1,8 @@
 import { oc } from "@orpc/contract";
-import { OkSchema, ShareCreateSchema, ShareListSchema, ShareRemoveSchema, ShareUpdateSchema, SharedConversationSchema } from "../schemas.js";
+import { ShareCreateSchema, SharedConversationSchema, ShareListSchema, ShareRemoveSchema, ShareUpdateSchema } from "../schemas/share.js";
+import { OkSchema } from "../schemas/shared.js";
 
-/* Conversations published as read-only pages (see the share section in schemas.ts).
+/* Conversations published as read-only pages (see schemas/share.ts).
  *
  * Its own group rather than two more routes on `public`, because the two speak different path spaces and mean
  * different things by "publish". The outbox's routes take a path in the workspace and copy the bytes at it; a

package/src/contracts/skills.contract.ts

@@ -1,5 +1,6 @@
 import { oc } from "@orpc/contract";
-import { OkSchema, SkillBodySchema, SkillDraftSchema, SkillIdSchema, SkillRemoveSchema, SkillsListSchema } from "../schemas.js";
+import { SkillBodySchema, SkillDraftSchema, SkillIdSchema, SkillRemoveSchema, SkillsListSchema } from "../schemas/settings.js";
+import { OkSchema } from "../schemas/shared.js";
 
 /* WHAT THE AGENT KNOWS RIGHT NOW, and which half of it the owner controls.
  *

package/src/contracts/system.contract.ts

@@ -1,24 +1,21 @@
 import { eventIterator, oc } from "@orpc/contract";
 import { z } from "zod";
 import { SessionTranscriptSchema, SystemEventSchema } from "../events.js";
+import { MachineFlowLineSchema, MachineSandboxFlowInputSchema } from "../schemas/computers.js";
+import { PresenceReportSchema } from "../schemas/logs.js";
+import { OkSchema } from "../schemas/shared.js";
+import { DaemonSessionSchema, InfoSchema, ManifestProblemsSchema } from "../schemas/system.js";
 import {
     BrowserNameParamSchema,
     BrowsersListSchema,
-    DaemonSessionSchema,
-    InfoSchema,
-    ManifestProblemsSchema,
-    MachineFlowLineSchema,
-    MachineSandboxFlowInputSchema,
-    OkSchema,
-    PresenceReportSchema,
     SubagentIdParamSchema,
     SubagentsListSchema,
     TerminalNameParamSchema,
     TerminalScrollbackQuerySchema,
     TerminalScrollbackSchema,
     TerminalsListSchema,
-    UsageSummarySchema,
-} from "../schemas.js";
+} from "../schemas/terminal.js";
+import { UsageSummarySchema } from "../schemas/usage.js";
 
 // Sandbox status + identity, the long-lived liveness stream, and the connect-token-relayed host tunnel.
 // `events` interleaves heartbeat frames (browser holds it open to detect the sandbox dying instantly) with

package/src/contracts/translator.contract.ts

@@ -1,6 +1,9 @@
 import { oc } from "@orpc/contract";
 import { z } from "zod";
-import { KeyedProviderSchema, OkSchema, TranslatorAccountsSchema, TranslatorCompleteSchema, TranslatorStartSchema } from "../schemas.js";
+import { TranslatorAccountsSchema } from "../schemas/plan-limits.js";
+import { TranslatorCompleteSchema, TranslatorStartSchema } from "../schemas/provider-oauth.js";
+import { KeyedProviderSchema } from "../schemas/provider-subscriptions.js";
+import { OkSchema } from "../schemas/shared.js";
 
 // Routed-provider subscriptions (Sandbox ▸ Agent). The bundled translator (CLIProxyAPI) runs a non-Claude model
 // UNDER the Claude Code harness on the user's SUBSCRIPTION, so each provider connects via an OAuth login rather

package/src/contracts/usage.contract.ts

@@ -1,5 +1,5 @@
 import { oc } from "@orpc/contract";
-import { DayWindowQuerySchema, UsageRollupSchema } from "../schemas.js";
+import { DayWindowQuerySchema, UsageRollupSchema } from "../schemas/usage.js";
 
 // The durable spend ledger (see UsageTurnSchema). Read-only over the wire, rows are appended daemon-side at
 // turn end, so the ledger stays a trustworthy record of what was actually spent, the same principle as the

package/src/contracts/vpn.contract.ts

@@ -1,13 +1,7 @@
 import { eventIterator, oc } from "@orpc/contract";
 import { IntenticLineSchema } from "../events.js";
-import {
-    ForticlientImportInputSchema,
-    ForticlientImportSchema,
-    OkSchema,
-    VpnConnectInputSchema,
-    VpnIdParamSchema,
-    VpnListSchema,
-} from "../schemas.js";
+import { OkSchema } from "../schemas/shared.js";
+import { ForticlientImportInputSchema, ForticlientImportSchema, VpnConnectInputSchema, VpnIdParamSchema, VpnListSchema } from "../schemas/vpn.js";
 
 // The live VPN surface. A VPN is ADDED as a `vpn` capability (credentials, autoConnect, capabilities.contract);
 // it is DIALLED here. The split is deliberate: connecting is a runtime operation that both the operator (the

package/src/contracts/webext.contract.ts

@@ -0,0 +1,37 @@
+import { oc } from "@orpc/contract";
+import { z } from "zod";
+import { WebExtScopesSchema } from "../schemas/capabilities.js";
+import { OkSchema } from "../schemas/shared.js";
+import { WebExtFactsSchema } from "../schemas/webext.js";
+
+/* What a connected BROWSER can be asked, over the socket its extension opened to this sandbox.
+ *
+ * The inversion is the host contract's (contracts/host.contract.ts): the extension dialled out, and the
+ * extension is the oRPC SERVER. A browser cannot be dialled — it is behind the same NAT as the laptop it runs
+ * on, and it is not even a process that is always there — so it can only be the side that connects, while
+ * everything is asked OF it.
+ *
+ * `mcp` IS THE SAME DELIBERATE HOLE IN THE TYPING, for the same reason: if this contract described each tool,
+ * a browser could not learn one without a matching daemon release, and the daemon would have to hold every
+ * tool's schema to translate. Keeping one opaque procedure buys the extension the Chrome Web Store's release
+ * cycle, which is measured in review days and is not this daemon's to wait on. The payload is still validated
+ * where it is understood: in the extension, against the tool's own schema.
+ *
+ * There is no `runSandboxFlow` twin here. A browser runs nothing that takes minutes and narrates itself; every
+ * one of its operations is a click or a read that either happened or did not. */
+export const webextContract = {
+    // What this browser is, and what it is currently allowed to touch: pulled right after the socket
+    // authenticates and again whenever the card is read, because the grant list changes IN THE BROWSER (the
+    // person clicks Allow on a site) rather than here, so a cached copy would be a card that lies.
+    describe: oc.output(WebExtFactsSchema),
+    /* The switches the owner ticked on the capability card. The extension ENFORCES them; nothing on this side
+     * checks one. Note what is NOT in here: which sites the agent may touch. Those are Chrome's own optional
+     * host permissions, granted by the person in the browser and revocable there, so the strongest boundary in
+     * this feature is one the sandbox cannot even describe, let alone widen. */
+    setScopes: oc.input(WebExtScopesSchema).output(OkSchema),
+    // Liveness, driven by the daemon: doubles as the keepalive for the tunnel and as the probe whose failure
+    // means the browser is closed rather than quiet.
+    ping: oc.output(OkSchema),
+    // One MCP JSON-RPC message in, its answer out, forwarded verbatim in both directions. See above.
+    mcp: oc.input(z.unknown()).output(z.unknown()),
+};

package/src/contracts/workflows.contract.ts

@@ -1,6 +1,6 @@
 import { oc } from "@orpc/contract";
+import { OkSchema } from "../schemas/shared.js";
 import {
-    OkSchema,
     WorkflowIdParamSchema,
     WorkflowRunIdParamSchema,
     WorkflowRunSchema,
@@ -9,7 +9,7 @@ import {
     WorkflowSaveSchema,
     WorkflowSchema,
     WorkflowsListSchema,
-} from "../schemas.js";
+} from "../schemas/workflows.js";
 
 /* The workflow routes, "run these sessions, in this order, each handing its result to the next".
  *

package/src/contracts/workspace.contract.ts

@@ -1,17 +1,23 @@
 import { oc } from "@orpc/contract";
+import { WorkspaceHealthQuerySchema, WorkspaceHealthSchema } from "../schemas/codebase-health.js";
+import { WorkspaceModulesSchema } from "../schemas/git.js";
+import { OkSchema } from "../schemas/shared.js";
 import {
     AddAppsSchema,
     AppParamSchema,
     AppsListSchema,
     CloneRepoSchema,
     CloneResultSchema,
-    WorkspaceSearchResultSchema,
-    WorkspaceSearchQuerySchema,
-    OkSchema,
     RepoAppsParamSchema,
     ReposListSchema,
     RunTestsSchema,
     TemplatesListSchema,
+    WorkspaceGraphSchema,
+    WorkspaceSyncSchema,
+} from "../schemas/workspace-repos.js";
+import { WorkspaceSearchQuerySchema, WorkspaceSearchResultSchema } from "../schemas/workspace-search.js";
+import { WorkspaceInstallResultSchema, WorkspaceInstallSchema, WorkspaceSetupSchema } from "../schemas/workspace-setup.js";
+import {
     WorkspaceChildrenQuerySchema,
     WorkspaceChildrenSchema,
     WorkspaceClassificationSchema,
@@ -19,22 +25,14 @@ import {
     WorkspaceFileQuerySchema,
     WorkspaceFileReadQuerySchema,
     WorkspaceFileSchema,
-    WorkspaceGraphSchema,
-    WorkspaceHealthQuerySchema,
-    WorkspaceHealthSchema,
-    WorkspaceInstallResultSchema,
-    WorkspaceInstallSchema,
     WorkspaceMediaTicketQuerySchema,
     WorkspaceMediaTicketSchema,
-    WorkspaceModulesSchema,
     WorkspaceMoveSchema,
     WorkspaceResolveQuerySchema,
     WorkspaceResolveSchema,
     WorkspaceScopeSchema,
-    WorkspaceSetupSchema,
-    WorkspaceSyncSchema,
     WorkspaceTreeSchema,
-} from "../schemas.js";
+} from "../schemas/workspace-tree.js";
 
 // The full /work view + extra-repo cloning. The binary preview (/workspace/raw) is intentionally NOT here, it
 // stays a plain Hono route serving raw bytes with a Content-Type header (oRPC's request/response shape doesn't

package/src/conversation-ids.test.ts

@@ -1,6 +1,6 @@
 import { afterEach, expect, test, vi } from "vitest";
 import { newConversationId } from "./conversation-ids.js";
-import { ConversationIdSchema } from "./schemas.js";
+import { ConversationIdSchema } from "./schemas/agent.js";
 
 const mockRandomValues = (values: readonly number[]) => {
     const remaining = [...values];

package/src/definition-action.ts

@@ -0,0 +1,8 @@
+import { z } from "zod";
+
+/* One "do this by hand" line, the definition surface's honesty unit (definition.ts is the home story; this
+ * lives in its own leaf module because runner-protocol.ts also speaks it, and THAT file is imported by
+ * schemas/agent.ts, which definition.ts imports — the schema living in definition.ts made a cycle that left
+ * schemas half-initialized under module-eval). A subject the UI bolds, a detail written as an instruction. */
+export const DefinitionActionSchema = z.object({ subject: z.string(), detail: z.string() });
+export type DefinitionAction = z.infer<typeof DefinitionActionSchema>;

package/src/definition.ts

@@ -1,9 +1,11 @@
 import { z } from "zod";
-import { CapabilitySchema, SandboxSettingsSchema } from "./schemas.js";
+import { DefinitionActionSchema } from "./definition-action.js";
+import { CapabilitySchema } from "./schemas/capabilities.js";
+import { SandboxSettingsSchema } from "./schemas/settings.js";
 
 /* THE SANDBOX DEFINITION: the declarable SHAPE of a sandbox, split off from its state.
  *
- * A bundle (portability section of schemas.ts) moves everything a sandbox holds; this is the half of it that
+ * A bundle (BundleSchema, schemas/maintenance.ts) moves everything a sandbox holds; this is the half of it that
  * is a REFERENCE to a source of truth rather than bytes only this sandbox has: which repos (as remotes a
  * target can clone), which connections (as shapes a target re-authenticates), which overlay steps (as source
  * a target's owner approves), which secrets (as NAMES a target asks for), which agent settings. Everything
@@ -19,7 +21,7 @@ import { CapabilitySchema, SandboxSettingsSchema } from "./schemas.js";
 // One repository, by reference: the id it lands under in the workspace, where a target clones it from, and
 // (optionally) the branch to check out. A repo with NO remote cannot appear here, the exporter reports it as
 // omitted instead of inventing a source for bytes only the source sandbox holds.
-export const DefinitionRepositorySchema = z.object({
+export const DefinitionRepositorySchema = z.strictObject({
     // Workspace-relative repo id ("intentic", "clients/foo"), the same id the wire {repo} routes use.
     id: z.string().min(1),
     // The clone URL, verbatim from the source repo's own remote.
@@ -29,7 +31,26 @@ export const DefinitionRepositorySchema = z.object({
 });
 export type DefinitionRepository = z.infer<typeof DefinitionRepositorySchema>;
 
-export const DefinitionEnvironmentSchema = z.object({
+/* THE WORKSPACE ITSELF, by reference. `/work` is a git repo of its own (the daemon's `root` scope, git dir on
+ * /history), tracking every workspace file that is not a nested repo, the reference shelf, or daemon-internal
+ * state — which by the versioned-state allowlist means the owner's AUTHORED content: notes, skills, personas,
+ * automations, workflow and loop designs, drafts, workspace extensions. None of that has a source anywhere else,
+ * so before this section a definition could only shrug at it and a bundle was the sole way to move it.
+ *
+ * With a remote it becomes referenceable like any other repo, which is the whole point: `[workspace]` plus
+ * `[[repositories]]` is a sandbox's code AND its way of working, and what remains bundle-only is exactly what
+ * cannot be pushed anywhere — secrets, identity, /history, the built image.
+ *
+ * A workspace with no remote cannot appear here; the exporter says so in `omitted` rather than inventing one. */
+export const DefinitionWorkspaceSchema = z.strictObject({
+    // The clone URL, verbatim from the workspace repo's own remote.
+    remote: z.string().min(1),
+    // The branch to check out; absent means the remote's default.
+    ref: z.string().optional(),
+});
+export type DefinitionWorkspace = z.infer<typeof DefinitionWorkspaceSchema>;
+
+export const DefinitionEnvironmentSchema = z.strictObject({
     // The image the overlay extends, informational: the target composes against ITS OWN base (see
     // composeEnvironment's baseImageOf), this records what the source was on.
     baseImage: z.string().optional(),
@@ -57,16 +78,19 @@ const bareField = (field: z.ZodType): z.ZodType => {
 
 const definitionSettings = (): z.ZodType<Partial<z.infer<typeof SandboxSettingsSchema>>> => {
     const shape = Object.fromEntries(Object.entries(SandboxSettingsSchema.shape).map(([key, field]) => [key, bareField(field).optional()]));
-    return z.object(shape).prefault({}) as unknown as z.ZodType<Partial<z.infer<typeof SandboxSettingsSchema>>>;
+    return z.strictObject(shape).prefault({}) as unknown as z.ZodType<Partial<z.infer<typeof SandboxSettingsSchema>>>;
 };
 
-export const SandboxDefinitionSchema = z.object({
+export const SandboxDefinitionSchema = z.strictObject({
     // Bumped when the layout changes in a way an older daemon would misread. Refused rather than guessed at,
     // the bundle manifest's own rule.
     schemaVersion: z.literal(1),
     // What the source sandbox was called, for the reader; never used to authorize anything.
     name: z.string().optional(),
     environment: DefinitionEnvironmentSchema.prefault({}),
+    // The workspace repo itself, when it has a remote to be named by. Absent is the ordinary state of a
+    // workspace nobody has published, not an error.
+    workspace: DefinitionWorkspaceSchema.optional(),
     repositories: z.array(DefinitionRepositorySchema).prefault([]),
     /* Each connection IN FULL (id, kind, config), not merely named: the manifest they come from carries the
      * SHAPE of a connection and never its credential (workspace-state.ts argues the split on the
@@ -82,9 +106,9 @@ export const SandboxDefinitionSchema = z.object({
 export type SandboxDefinition = z.infer<typeof SandboxDefinitionSchema>;
 
 // One "do this by hand" line, the same honesty unit ImportReportSchema carries: a subject the UI bolds and a
-// detail written as an instruction to the owner.
-export const DefinitionActionSchema = z.object({ subject: z.string(), detail: z.string() });
-export type DefinitionAction = z.infer<typeof DefinitionActionSchema>;
+// detail written as an instruction to the owner. Defined in its own leaf module (definition-action.ts says
+// why) and re-exported here, where every consumer of the definition surface finds it.
+export { DefinitionActionSchema, type DefinitionAction } from "./definition-action.js";
 
 // What GET /definition answers: the emitted TOML, plus what the derivation could not express (a repo with no
 // remote), listed rather than silent, the export's own `excluded` discipline.
@@ -99,7 +123,7 @@ export type DefinitionExport = z.infer<typeof DefinitionExportSchema>;
 // same items the owner reviewed.
 export const DefinitionItemSchema = z.object({
     id: z.string(),
-    kind: z.enum(["repo", "capability", "environment", "settings"]),
+    kind: z.enum(["workspace", "repo", "capability", "environment", "settings"]),
     label: z.string(),
     detail: z.string().optional(),
     /* False when the target already holds this piece (the repo's directory exists, a capability with that id
@@ -144,6 +168,46 @@ export const DefinitionDiffSchema = z.object({
 });
 export type DefinitionDiff = z.infer<typeof DefinitionDiffSchema>;
 
+/* ---- publishing the workspace repo, the one step a definition cannot take for itself ----
+ *
+ * `[workspace]` names a remote; nothing can name one that does not exist. So the owner-facing half of the
+ * feature is this: create a PRIVATE repo on a connected git host and push /work to it, or adopt a URL the
+ * owner made themselves. Deliberately its own route rather than a side effect of the export, publishing a
+ * workspace is an outward act with its own confirmation, and deriving a document must stay read-only.
+ */
+export const WorkspacePublishSchema = z.object({
+    /* An existing repo's clone URL. Given, nothing is created: the remote is wired up and pushed to, which is
+     * the path for an owner who made the repo themselves or is moving hosts. */
+    remote: z.string().min(1).optional(),
+    // The repo to create when `remote` is absent. Owner-side default is the sandbox's own name.
+    name: z.string().min(1).optional(),
+    /* The account or organization to create it under; absent means the authenticated user. Ignored when
+     * `remote` is given. */
+    owner: z.string().min(1).optional(),
+});
+export type WorkspacePublish = z.infer<typeof WorkspacePublishSchema>;
+
+// Where the workspace now lives, and what a definition will name. `created` distinguishes "made you a repo"
+// from "wired up the one you gave me", which is the difference the card reports back.
+export const WorkspacePublishResultSchema = z.object({
+    remote: z.string(),
+    branch: z.string(),
+    created: z.boolean(),
+});
+export type WorkspacePublishResult = z.infer<typeof WorkspacePublishResultSchema>;
+
+// What the card renders before anything is published: whether /work has a remote, and which connected git
+// hosts could make one. Read-only, so the button can say "Publish to github.com" rather than opening a form
+// into a void.
+export const WorkspaceRemoteSchema = z.object({
+    remote: z.string().optional(),
+    branch: z.string().optional(),
+    // Hostnames of connected github/gitlab accounts, in the order they would be tried. Empty means the owner
+    // must connect one (or paste a URL).
+    hosts: z.array(z.string()),
+});
+export type WorkspaceRemote = z.infer<typeof WorkspaceRemoteSchema>;
+
 /* ---- the bundle manifest, restated on the definition ----
  *
  * A bundle is DEFINITION + STATE: its manifest embeds the same definition `GET /definition` emits, and the