@intentic/sandbox-contract 1.247.0 → 1.249.0

package/src/shell-regions.ts

@@ -1,289 +0,0 @@
-/* WHICH PARTS OF A COMMAND ARE TEXT RATHER THAN A PROGRAM, so the one tier that cannot be argued with stops
- * firing on a mention of a dangerous verb.
- *
- * WHAT THIS IS FOR, precisely, because it bounds how good it has to be. The triage catalog next door
- * (command-classes.ts) is deliberately over-inclusive: a match only means a judge should look, and a false
- * positive there costs one model call. That economy holds for every class except the hard-ruled one, where a
- * match is an interruption no policy and no verdict can waive (safety-policy.ts hardRuleClasses). So
- * `echo "rm -rf /" >> notes.md` and `rg 'rm -rf /'` raised un-waivable cards over a string being written to a
- * file and a search of the tree — the exact failure the judge redesign was built to end, surviving in the one
- * tier the judge cannot reach.
- *
- * This says where a fragment sits. A fragment inside a region below is still REPORTED (the class holds, the
- * judge still reads it, the card still marks it); it just does not trip the hard rule.
- *
- * WHICH IS WHY A REGEX-LEVEL SCANNER IS ENOUGH, and this is the design argument rather than an excuse. Both
- * ways of being wrong are cheap:
- *
- *   · MISS a region (call text a program) ⇒ one judge call. Exactly today's behaviour, which is the floor.
- *   · INVENT a region (call a program text) ⇒ the class is still reported and the judge still rules on it.
- *     Only the un-waivable tier is skipped, and the judge is the tier that reads the owner's policy.
- *
- * Precision has to be good enough to skip tier 1½, never good enough to skip tier 1. Nothing here is a
- * boundary, for the same reason nothing in command-classes.ts is: `sh -c "$CMD"` and a path assembled from a
- * variable walk past all of it. The boundaries are structural and elsewhere.
- *
- * THREE KINDS OF REGION, and each is a place a shell will not run what it holds:
- *
- *   1 A COMMENT, `#` to end of line.
- *   2 A HEREDOC BODY, the usual way an agent writes a script it is not running yet.
- *   3 A QUOTED ARGUMENT OF A VERB THAT CANNOT EXECUTE ONE — echo, printf, and the searchers. Plus a quoted
- *     commit message after -m, whatever the verb, because message text never runs.
- *
- * `sed`, `awk` and `perl` are deliberately NOT in that verb list, though they are the obvious next entries:
- * each can run a shell out of its own quoted program (`awk 'BEGIN{system("…")}'`, `perl -e`, GNU sed's `s///e`),
- * so their quoted argument is a program and calling it text would be wrong rather than merely imprecise.
- */
-
-import type { CommandSpan } from "./command-classes.js";
-
-/* Verbs whose quoted arguments this scanner will call text. Every one of them either prints its argument or
- * matches with it, and none has a documented way to execute it. Widening this list is safe in the sense the
- * header sets out, but each entry should be able to answer "how would this run its argument?" with "it cannot". */
-const QUOTING_VERBS: ReadonlySet<string> = new Set([
-    "echo",
-    "printf",
-    "rg",
-    "grep",
-    "egrep",
-    "fgrep",
-    "ack",
-    "ag",
-    "ripgrep",
-]);
-
-/* A flag whose value is a message: git's -m, and the long spelling. A quoted string here is prose that reaches
- * a commit, a tag or a PR, and `git commit -m "rm -rf the old build dir"` is one of the more ordinary ways to
- * write a dangerous-looking command that is not one. Read on the WORD BEFORE a quoted argument, so it applies
- * whatever the verb is. */
-const MESSAGE_FLAGS: ReadonlySet<string> = new Set(["-m", "--message", "-am", "--body", "-b"]);
-
-// Where an unquoted word ends: whitespace, a pipeline or list operator, a redirect, a subshell paren.
-const WORD_END = /[\s;|&<>()]/;
-
-// A word that is a variable assignment prefixing a command (`FOO=bar cmd …`), skipped when looking for the verb.
-const ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
-
-/* `<<EOF`, `<<-EOF`, `<<'EOF'`, `<<"EOF"`. The delimiter's quoting only decides whether the body expands, which
- * changes nothing here: an expanded body is still a body being written somewhere rather than run. */
-const HEREDOC_OPEN = /<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/g;
-
-/* The heredoc bodies in a command, as spans. Found first and in their own pass, because a body is line-oriented
- * and can hold anything at all — an odd number of quotes in it would otherwise throw the word scanner out of
- * step for the rest of the command. */
-const heredocBodies = (command: string): CommandSpan[] => {
-    const bodies: CommandSpan[] = [];
-    for (const open of command.matchAll(HEREDOC_OPEN)) {
-        const indented = command.slice(open.index, open.index + 3).startsWith("<<-");
-        const newline = command.indexOf("\n", open.index + open[0].length);
-        if (newline === -1) {
-            // `cat <<EOF` with nothing after it: an unterminated heredoc, so there is no body to mark.
-            continue;
-        }
-        const start = newline + 1;
-        const terminator = new RegExp(`^${indented ? "[ \\t]*" : ""}${open[2] as string}[ \\t]*$`, "m");
-        const rest = command.slice(start);
-        const end = terminator.exec(rest)?.index;
-        // An unterminated body runs to the end of the command, which is what the shell would read too.
-        bodies.push({ start, end: end === undefined ? command.length : start + end });
-    }
-    return bodies;
-};
-
-// Is this offset inside one of the spans already found? Heredoc bodies are skipped wholesale by the word scan.
-const within = (spans: readonly CommandSpan[], offset: number): CommandSpan | undefined =>
-    spans.find((span) => offset >= span.start && offset < span.end);
-
-// A substitution inside double quotes, the one thing that makes a quoted argument a program again.
-const EXPANDS = /\$\(|`/;
-
-/* One quoted segment inside a word: the span covers the quotes as well as what is between them, so a region
- * handed back from here contains the whole `"rm -rf /"` and a match on any part of it reads as contained. */
-interface QuotedSegment {
-    readonly span: CommandSpan;
-    /* Does a shell expand anything in here? `"$(rm -rf /)"` inside an echo is a real delete whose output is
-     * printed, so a double-quoted segment carrying a substitution is NOT text and never becomes a region. Single
-     * quotes expand nothing, so they never set this. */
-    readonly expands: boolean;
-}
-
-interface ShellWord {
-    readonly start: number;
-    // The word with its quoting removed, which is what a verb name and a flag are compared against.
-    readonly text: string;
-    readonly quoted: readonly QuotedSegment[];
-    // Does this word begin a simple command? True for the first word after a separator or at the start.
-    readonly opensCommand: boolean;
-}
-
-// A verb by its bare name: `/bin/echo` and `./echo` are echo, and the path in front of it says nothing new.
-const bareVerb = (text: string): string => text.slice(Math.max(text.lastIndexOf("/"), text.lastIndexOf("\\")) + 1);
-
-// Every list and pipeline operator: past one of these the next word is a verb again.
-const SEPARATORS = new Set(["\n", ";", "|", "&", "(", ")"]);
-const BLANKS = new Set([" ", "\t", "\r"]);
-
-/* One quoted run, from its opening quote to its closing one. An unbalanced quote takes the rest of the
- * command, which is what a shell waiting for more input would do and keeps the caller advancing. */
-const readQuoted = (command: string, open: number): QuotedSegment & { readonly text: string; readonly end: number } => {
-    const quote = command[open] as string;
-    const close = command.indexOf(quote, open + 1);
-    const end = close === -1 ? command.length : close + 1;
-    const text = command.slice(open + 1, close === -1 ? command.length : close);
-    return { span: { start: open, end }, expands: quote === '"' && EXPANDS.test(text), text, end };
-};
-
-/* One word, from `start` to whatever ends it, with the quoted runs inside it kept as spans. `end === start`
- * cannot happen: the caller only enters here on a character that is neither blank nor a separator. */
-const readWord = (command: string, start: number): { readonly word: Omit<ShellWord, "opensCommand">; readonly end: number } => {
-    const quoted: QuotedSegment[] = [];
-    let text = "";
-    let index = start;
-    while (index < command.length && !WORD_END.test(command[index] as string)) {
-        const char = command[index] as string;
-        if (char === "'" || char === '"') {
-            const segment = readQuoted(command, index);
-            quoted.push({ span: segment.span, expands: segment.expands });
-            text += segment.text;
-            index = segment.end;
-            continue;
-        }
-        if (char === "\\") {
-            text += command[index + 1] ?? "";
-            index += 2;
-            continue;
-        }
-        text += char;
-        index += 1;
-    }
-    return { word: { start, text, quoted }, end: index };
-};
-
-/* The command taken apart into words, with each word's quoted segments and whether it opens a simple command.
- * Deliberately a scanner rather than a parser: it tracks quoting and the separators that start a new command,
- * and it knows nothing about control flow, functions or expansion. Everything it gets wrong is bounded by the
- * header's argument. */
-const scanWords = (command: string, skip: readonly CommandSpan[]): ShellWord[] => {
-    const words: ShellWord[] = [];
-    let index = 0;
-    let opensCommand = true;
-    while (index < command.length) {
-        const skipped = within(skip, index);
-        if (skipped !== undefined) {
-            index = skipped.end;
-            continue;
-        }
-        const char = command[index] as string;
-        if (SEPARATORS.has(char)) {
-            opensCommand = true;
-            index += 1;
-            continue;
-        }
-        if (BLANKS.has(char)) {
-            index += 1;
-            continue;
-        }
-        if (char === "#") {
-            // A comment runs to the end of the line. Only reached at a word boundary, so `a#b` is one word.
-            const newline = command.indexOf("\n", index);
-            index = newline === -1 ? command.length : newline;
-            continue;
-        }
-        const { word, end } = readWord(command, index);
-        // A character that is neither a separator nor part of a word (a stray redirect): step over it so the
-        // loop always advances.
-        index = end === index ? index + 1 : end;
-        if (end !== word.start) {
-            words.push({ ...word, opensCommand });
-            opensCommand = false;
-        }
-    }
-    return words;
-};
-
-/* WHERE A COMMAND HOLDS TEXT RATHER THAN A PROGRAM, as spans over the command, unsorted and possibly
- * overlapping — callers ask containment questions of them rather than rendering them.
- *
- * Exported for the classifier, which asks it once per command and hands the answer to every table. */
-export const inertRegions = (command: string): CommandSpan[] => {
-    const bodies = heredocBodies(command);
-    const regions: CommandSpan[] = [...bodies];
-    const words = scanWords(command, bodies);
-    // Comments are consumed by the scanner rather than reported, so they are found again here: the scan is
-    // where the quoting state lives, and a `#` inside a quoted string is not a comment.
-    let quotingVerb = false;
-    let previous: ShellWord | undefined;
-    for (const word of words) {
-        if (word.opensCommand) {
-            quotingVerb = QUOTING_VERBS.has(bareVerb(word.text));
-            previous = undefined;
-        }
-        /* An env assignment in front of the verb (`LC_ALL=C grep …`) is not the verb. Re-read the next word as
-         * one instead of giving up on the command. */
-        if (word.opensCommand && ASSIGNMENT.test(word.text) && word.quoted.length === 0) {
-            quotingVerb = false;
-            previous = undefined;
-            continue;
-        }
-        const afterMessageFlag = previous !== undefined && MESSAGE_FLAGS.has(previous.text);
-        if (quotingVerb || afterMessageFlag) {
-            regions.push(...word.quoted.filter((segment) => !segment.expands).map((segment) => segment.span));
-        }
-        previous = word;
-    }
-    regions.push(...commentRegions(command, bodies));
-    return regions;
-};
-
-/* Comments, on the same scan discipline as the words: a `#` only opens one where a word could have started, so
- * `sha#1` is not a comment, and a quoted `"# …"` is not one either.
- *
- * Its own walk rather than a by-product of scanWords, because the two want different things from a quote — the
- * word scan needs what is INSIDE one, this needs only to be past it. Sharing readQuoted keeps them agreeing on
- * where one ends, which is the only fact they both depend on. */
-const commentRegions = (command: string, skip: readonly CommandSpan[]): CommandSpan[] => {
-    const comments: CommandSpan[] = [];
-    let index = 0;
-    while (index < command.length) {
-        const skipped = within(skip, index);
-        if (skipped !== undefined) {
-            index = skipped.end;
-            continue;
-        }
-        const char = command[index] as string;
-        if (char === "'" || char === '"') {
-            index = readQuoted(command, index).end;
-            continue;
-        }
-        if (char === "\\") {
-            index += 2;
-            continue;
-        }
-        // A word boundary in front is what makes it a comment rather than part of a word.
-        if (char === "#" && (index === 0 || WORD_END.test(command[index - 1] as string))) {
-            const newline = command.indexOf("\n", index);
-            const end = newline === -1 ? command.length : newline;
-            comments.push({ start: index, end });
-            index = end;
-            continue;
-        }
-        index += 1;
-    }
-    return comments;
-};
-
-/* Is this fragment somewhere a shell would RUN it? The question the hard rule asks of every span triage matched.
- *
- * JUDGED ON WHERE THE FRAGMENT STARTS, not on whether a region contains the whole of it, and the difference is
- * not a relaxation — it is the only reading that answers the question asked. Every pattern in the catalog is
- * written to BEGIN at the verb (`rm`, `docker volume rm`, `mkfs`, `git push`), so the span's first character is
- * where the dangerous thing was found. Whether the match then ran on past a closing quote says something about
- * the regex, not about the command: `rm`'s own parser reads to the end of the invocation and `>` is not a
- * terminator, so `echo "rm -rf /" >> notes.md` produces a span covering `rm -rf /" >> notes.md`. Requiring
- * containment made that command live — which is exactly the card this whole change exists to stop raising.
- *
- * The conservative direction is preserved where it matters: a fragment whose verb sits OUTSIDE every region is
- * live no matter what it runs into afterwards, so `echo "tidying" && rm -rf /` and `rm -rf "$(cat list)" # ok`
- * both stay live. */
-export const isLive = (span: CommandSpan, regions: readonly CommandSpan[]): boolean =>
-    !regions.some((region) => span.start >= region.start && span.start < region.end);

package/src/starter.ts

@@ -1,13 +0,0 @@
-/* THE STARTER SITE'S NAMES, declared where both sides of the wire read them.
- *
- * A fresh sandbox opens with one real, running thing in it: a one-page site, copied out of the image and
- * started by the daemon's first boot (sandbox src/scaffold/starter-site.ts). The browser's job is the other
- * half of that promise, to have it on screen when the user arrives (web shell/ShellDesktop.vue), and to do
- * that it has to name the same repo and the same app the daemon seeded.
- *
- * Two constants rather than one because they are two different kinds of name: `site` is the repo directory a
- * person would have picked, and `landing` is the template's own app name, which the apps extension, the
- * preview hostname (preview-site--landing-<id>.<zone>) and the folder under `_apps/` all inherit. Renaming
- * either is a product decision, not a rename: the seeded workspaces already out there keep the old names. */
-export const STARTER_REPO = "site";
-export const STARTER_APP = "landing";

package/src/state-portability.ts

@@ -1,56 +0,0 @@
-/* WHETHER A PIECE OF DAEMON STATE TRAVELS, the second thing every state manifest declares.
- *
- * A sandbox's environment is not one directory. `/work` holds the workspace and the daemon's manifests,
- * `/history` holds the real git dirs, the fleet registry and the ledgers, and the container carries the built
- * image and its env. "Export the environment" therefore means walking state that lives in two volumes and
- * deciding, per entry, which of four things it is, and that decision has to be written down beside the entry
- * itself, or the exporter becomes the hand-kept list that workspace-state.ts exists to argue against.
- *
- * So each manifest entry carries a class, and both the bundler and the restorer derive from it. Adding a store
- * without saying whether it travels is a failing coverage test, not a file that silently goes missing from
- * every bundle.
- *
- * The classes are exhaustive on purpose, there is no "unset", because the failure mode of a default is
- * exactly the one that matters: a credential store added later would inherit `carry` and ride out of the
- * sandbox in a file the owner thought was safe to email.
- */
-export type Portability =
-    /* Ordinary state. Travels in every bundle. */
-    | "carry"
-    /* Holds a credential, a provider token, a webhook secret, an ssh key. Travels ONLY when the owner opts
-     * in at export, and the bundle records that it did. Never the default. */
-    | "secret"
-    /* Binds this sandbox to its owner, its browsers or its host: who may drive it, the session-signing secret,
-     * push subscriptions, enrollments, certificates. Never travels, the target mints its own, and carrying
-     * one would either hand the target's ownership to the source or leave two sandboxes claiming one identity. */
-    | "identity"
-    /* Regenerated by the target from state that does travel: composed files, caches, indexes, checkouts. Left
-     * out for size, not for safety, carrying it would only ship a stale copy of something the daemon rebuilds
-     * on its own. */
-    | "derived";
-
-// One entry of a state manifest: the path it owns and what happens to it at export. `note` is user-facing,
-// the import report prints it beside a skipped entry, so it is written as an instruction to the owner ("log in
-// again"), not as a rationale for the next reader. Rationale belongs in a comment on the entry.
-export interface StateFile {
-    readonly path: string;
-    readonly portability: Portability;
-    readonly note?: string;
-}
-
-/* The entry that owns a path, LONGEST PREFIX FIRST.
- *
- * Manifests may deliberately nest when one subtree has a different lifecycle. First-match resolution would
- * classify the child by whichever entry happened to be listed first, so the specific entry has to win over the
- * general one by construction rather than by list order, the same reason a .gitignore consults its deepest
- * matcher first.
- *
- * Undefined for a path no entry claims. Callers decide what that means: workspace content (including an
- * extension's undeclared output) defaults to `carry`, while unclaimed history machinery defaults to `derived`.
- * The daemon's state-path coverage guard is what prevents one of its own credential stores from relying on the
- * workspace default.
- */
-export const stateFileFor = <T extends StateFile>(path: string, files: readonly T[]): T | undefined =>
-    files
-        .filter((file) => path === file.path || path.startsWith(file.path) || `${path}/` === file.path)
-        .reduce<T | undefined>((best, file) => (best === undefined || file.path.length > best.path.length ? file : best), undefined);

package/src/terminal-protocol.ts

@@ -1,16 +0,0 @@
-// The /system/terminal WebSocket wire protocol. JSON text frames both ways (xterm speaks strings), shared by
-// the daemon's terminal route and the browser's terminal session so the two can't drift. Plain types, not zod
-// schemas: `data` is the per-pty-chunk hot path between two mutually authenticated endpoints, and no oRPC
-// eventIterator validates these frames (which is why events.ts uses schemas).
-
-// `ping` is the client's 30s keepalive against tunnel idle-reaping; the server answers with `pong`, so a
-// healthy idle connection always sees a frame within the ping interval, silence beyond it means half-open.
-export type TerminalClientMessage =
-    | { readonly type: "input"; readonly data: string }
-    | { readonly type: "resize"; readonly cols: number; readonly rows: number }
-    | { readonly type: "ping" };
-
-// `data` is raw pty output; `exit` fires when the tmux client ends (shell exited, or an attach-only session
-// doesn't exist) and is terminal, the client never reconnects after it.
-export type TerminalServerMessage =
-    { readonly type: "data"; readonly data: string } | { readonly type: "exit"; readonly code: number } | { readonly type: "pong" };

package/src/title.ts

@@ -1,267 +0,0 @@
-/* HOW A CONVERSATION NAMES ITSELF from its opening prompt, the title a chat tab, a fleet card and the agent
- * detail header wear from the first keystroke of a turn until something better arrives.
- *
- * The naive rule (collapse whitespace, cut at N) reads the prompt as if it were a headline, and opening
- * prompts are not headlines. They are pasted stack traces, links dropped in with two words of context,
- * politeness that eats half the budget before the ask begins, and multi-line asks whose first line is throat-
- * clearing. Cutting those at 40 characters yields `Error: ENOENT: no such file or directo…`, a title that
- * names the paste rather than the work, and that reads identically for every one of the day's five pastes.
- *
- * So the prompt is read as prose FIRST and cut second: quoted material and fenced code are not the ask, the
- * opener is not the ask, and a reference is worth only its last segment. What survives is the earliest line
- * that still says something, cut on a sentence or a word rather than mid-syllable.
- *
- * Both sides derive: the browser names a conversation the instant it sends (conversation.ts), and the daemon
- * names a turn that arrived without one, an automation, a Discord message, a webchat visitor (agents-
- * registry.ts). One rule, because two would let the same prompt open under two different names depending on
- * where it entered. Nothing here calls a model: the title has to exist before the first frame comes back.
- *
- * Which is exactly the ceiling on it. Cutting is not naming, what comes out is the user's own sentence,
- * shortened, and a column of those is scannable only where the users' sentences happened to differ early. The
- * name a conversation ends up WEARING is written a second or two later by a model that reads the same prompt
- * and answers in the fleet board's own shape (the daemon's title-namer.ts). This is the title that holds the
- * tab until that arrives, and the one it keeps if nothing is connected to write a better one. */
-
-// The registry's title budget (agents-registry MAX_TITLE_LENGTH, the rename input's maxlength), the widest
-// any surface stores. Every surface truncates in CSS to its own width, so the clamp here is a storage cap,
-// not a display rule: cutting shorter than the widest surface (a full-width fleet card) would throw away
-// signal that surface has room to show, and no narrow surface is hurt because its CSS cuts first anyway.
-const MAX_LENGTH = 80;
-// Below this a sentence-shaped cut is more likely an abbreviation (`e.g.`, `i.e.`) than a sentence, so the
-// length clamp takes over.
-const MIN_SENTENCE = 12;
-// A word-boundary cut this far back strands a fragment; better to cut mid-word than to title a conversation
-// with two characters and an ellipsis.
-const MIN_WORD_CUT = MAX_LENGTH * 0.6;
-
-// Markdown's two fence syntaxes, and the quote marker. Both open and close on the same shape, so a fence line
-// toggles rather than matching a pair, an UNTERMINATED fence (a paste the user never closed) then swallows
-// the rest of the prompt, which is what it visually does too.
-const FENCE = /^\s*(?:```|~~~)/;
-const QUOTE = /^\s*>/;
-
-// The ways an ask opens without starting. Stripped repeatedly, so `Hey, can you please …` unwinds one layer
-// per pass; a line that unwinds to nothing was pure throat-clearing and the next line carries the ask.
-const OPENERS: readonly RegExp[] = [
-    /^(?:hey|hi|hello|yo|ok|okay|so|well|also|btw|now|next|then)\b[\s,.:;!—–-]*/i,
-    /^(?:please|pls)\b[\s,.:;!—–-]*/i,
-    /^(?:can|could|would|will)\s+(?:you|u|we)\b\s*(?:please|pls)?[\s,.:;!—–-]*/i,
-    /^i(?:'d|\s+would)?\s+(?:want|need|like)\s+(?:you\s+)?to\b[\s,.:;!—–-]*/i,
-    /^(?:let'?s|lets)\b[\s,.:;!—–-]*/i,
-    /^we\s+(?:need|have|ought)\s+to\b[\s,.:;!—–-]*/i,
-    /^(?:quick\s+(?:one|question|q)|one\s+more\s+thing)\b[\s,.:;!—–-]*/i,
-];
-
-// A sentence ends on terminal punctuation that is actually followed by a break, which is what holds `v1.2`
-// and `foo.ts` together while still ending `Why is it red?`.
-const SENTENCE_END = /[.!?](?=\s|$)/;
-
-/* A report of work already done, `We have recently added…`, `I've just landed…`, `we were refactoring…`. The
- * one first-sentence shape that is reliably CONTEXT rather than the ask: prompts that open on it set the scene
- * for an instruction further down, and titling from the scene names every such conversation after last week's
- * work instead of this one's.
- *
- * Detected as we/I, an optional aux chain, then a verb in past or progressive form: the regular `…ed`/`…ing`
- * endings plus the irregular pasts that actually appear in prompts about software. The lookahead excludes the
- * handful of present-tense verbs the `…ed` ending would swallow (`we need…`, `we embed…`); `…ing` wants three
- * letters in front so `we ping`/`we bring` stay present tense. */
-const NARRATION =
-    /^(?:(?:recently|previously|earlier|today|yesterday|lately)[\s,]+)?(?:we|i)(?:'ve|'d|'m|'re)?(?:\s+(?:have|had|am|are|was|were|been|just|recently|already|earlier|previously|also|finally|now|currently|still))*\s+(?!(?:need|feed|speed|shed|heed|breed|bleed|embed|proceed|exceed|succeed)\b)(?:\w+ed|\w{3,}ing|built|wrote|rewrote|made|found|saw|thought|began|got|kept|put|set|sent|split|ran|did|redid|went|came|gave|held|hit|cut|let|read|understood|broke|chose|became|brought|spent|meant|lost|forgot|rebuilt|told|taught|stood|drew|grew|knew|threw|took|left|felt|hid)\b/i;
-
-// The ask read as an instruction: a sentence leading with a bare verb of the kind coding asks lead with. A
-// curated list rather than grammar. English hands out noun/verb ambiguity too freely for anything cleverer.
-const IMPERATIVE =
-    /^(?:add|fix|make|implement|create|build|write|rewrite|refactor|rename|remove|delete|drop|update|change|convert|migrate|move|extract|split|merge|rebase|revert|restore|wire|connect|integrate|support|handle|improve|clean|simplify|redesign|rework|rethink|investigate|analyze|analyse|debug|find|figure|check|verify|test|run|try|document|describe|explain|propose|design|draft|prepare|stop|prevent|ensure|allow|enable|disable|introduce|replace|swap|optimize|optimise|reduce|bump|upgrade|deploy|ship|release|adjust|tweak|polish|finish|complete|continue|extend|unify|dedupe|deduplicate|cache|persist|expose|hide|show|render|port|automate|wrap|inline|audit|review|profile|measure|instrument|validate|parse|generate|turn|look|think|come|consider|help|start|use|keep|avoid|teach|harden|tighten|localize|localise|translate)\b/i;
-
-// An unmistakable ask: an instruction, or a question asked outright. Anything less deliberate is not worth
-// skipping a sentence for.
-const isAsk = (sentence: string): boolean => sentence.endsWith("?") || IMPERATIVE.test(sentence);
-
-const collapse = (text: string): string =>
-    text
-        .replaceAll(/[\p{Cc}\p{Cf}]+/gu, " ")
-        .replaceAll(/\s+/g, " ")
-        .trim();
-
-// The prompt minus everything the user pasted rather than wrote. Fenced blocks and quoted blocks are evidence
-// attached to the ask, never the ask itself.
-const proseLines = (prompt: string): string[] => {
-    const lines: string[] = [];
-    let fenced = false;
-    for (const line of prompt.split(/\r?\n/)) {
-        if (FENCE.test(line)) {
-            fenced = !fenced;
-            continue;
-        }
-        if (!fenced && !QUOTE.test(line)) {
-            lines.push(line);
-        }
-    }
-    return lines;
-};
-
-/* Peel the openers off a line, but only keep the peeling when something with shape is left underneath.
- *
- * Three outcomes, and the difference between them is the whole point. A remnant of SEVERAL words is the ask,
- * `Can you please fix the auth tests?` was carrying `fix the auth tests?`. A remnant of NOTHING was pure
- * greeting (`Hey, quick one -`), and returning empty is how the caller learns to read the next line instead.
- * A remnant of ONE word means the opener was meaningful. `Hi there` is not a conversation about `there`,
- * and `So what?` is not one about `what?`, so the line stands as written. */
-const withoutOpener = (line: string): string => {
-    let text = line;
-    for (let pass = 0; pass < OPENERS.length; pass++) {
-        const stripped = OPENERS.reduce((current, opener) => current.replace(opener, ""), text);
-        if (stripped === text) {
-            break;
-        }
-        text = stripped;
-    }
-    const remnant = text.trim();
-    if (text === line || remnant === "") {
-        return text;
-    }
-    return remnant.includes(" ") ? text : line;
-};
-
-// A URL is worth its last meaningful segment: the host when there is no path, and the segment before a purely
-// numeric one so an issue link reads `merge_requests/42` rather than `42`.
-const shortUrl = (token: string): string => {
-    let url: URL;
-    try {
-        url = new URL(token);
-    } catch {
-        return token;
-    }
-    const segments = url.pathname.split("/").filter((segment) => segment !== "");
-    const last = segments.at(-1);
-    if (last === undefined) {
-        return url.hostname.replace(/^www\./, "");
-    }
-    const previous = segments.at(-2);
-    return /^\d+$/.test(last) && previous !== undefined ? `${previous}/${last}` : last;
-};
-
-// A path is worth its basename once it is deep enough that the lead is scaffolding, `src/foo.ts` already
-// reads as a place, `_editor/web/src/composables/chat/conversation.ts` reads as a wall.
-const shortPath = (token: string): string => {
-    const segments = token.replace(/^@/, "").split("/");
-    return segments.length > 2 ? (segments.findLast((segment) => segment !== "") ?? token) : token;
-};
-
-// Trailing punctuation belongs to the sentence, not to the reference inside it, so it is set aside across the
-// shortening and put back, `see _editor/web/src/foo.ts,` collapses to `see foo.ts,`.
-const shortReference = (token: string): string => {
-    const match = /^(.*?)([\s,.;:!?)\]]*)$/s.exec(token);
-    const core = match?.[1] ?? token;
-    const tail = match?.[2] ?? "";
-    if (/^https?:\/\//i.test(core)) {
-        return `${shortUrl(core)}${tail}`;
-    }
-    if (core.includes("/")) {
-        return `${shortPath(core)}${tail}`;
-    }
-    return token;
-};
-
-const collapseReferences = (text: string): string => text.split(" ").map(shortReference).join(" ");
-
-const firstSentence = (text: string): string => {
-    const end = text.search(SENTENCE_END);
-    if (end < MIN_SENTENCE) {
-        return text;
-    }
-    // A question mark or a bang carries tone worth keeping; a full stop on a title is just noise.
-    const terminator = text[end];
-    return terminator === "." ? text.slice(0, end) : text.slice(0, end + 1);
-};
-
-// Every sentence in turn, terminators handled as in firstSentence, the walk the ask-scan below reads. No
-// abbreviation guard here: a fragment split off at an `e.g.` never leads with an imperative, so it simply
-// loses the scan rather than corrupting it.
-const sentencesOf = (text: string): string[] => {
-    const parts: string[] = [];
-    let rest = text;
-    while (rest !== "") {
-        const end = rest.search(SENTENCE_END);
-        if (end === -1) {
-            parts.push(rest);
-            break;
-        }
-        parts.push(rest[end] === "." ? rest.slice(0, end) : rest.slice(0, end + 1));
-        rest = rest.slice(end + 1).trimStart();
-    }
-    return parts;
-};
-
-/* THE ELLIPSIS IS PART OF THE BUDGET, not an addition to it. MAX_LENGTH is a STORAGE cap the wire contract
- * enforces (AgentTurnSchema.title), so a title one character over it is not a wide tab, it is a 400 on the
- * turn that carried it. Cutting to MAX_LENGTH and appending afterwards was exactly that off-by-one, and it
- * hid for as long as it did because the word-boundary backoff almost always absorbed it: an ordinary sentence
- * has a space late in the window, so `kept` came back short and the ellipsis fit. What has no such space is a
- * long unbroken token straddling the cut, a SCREAMING_SNAKE env var, a hash, a base64 blob, and there the
- * fallback kept the full-width slice and made it one character too long. The conversation then wedged: the
- * browser writes the derived title into its state before it sends, so every later turn re-sent the same
- * rejected name. */
-const clamped = (text: string): string => {
-    if (text.length <= MAX_LENGTH) {
-        return text;
-    }
-    const cut = text.slice(0, MAX_LENGTH - 1);
-    const boundary = cut.lastIndexOf(" ");
-    const kept = boundary >= MIN_WORD_CUT ? cut.slice(0, boundary) : cut;
-    return `${kept.replace(/[\s,;:—–-]+$/, "")}…`;
-};
-
-// Sentence case, but only when the opening word is plainly lowercase prose. An identifier (`useAgents`), a
-// path (`src/foo`) or an abbreviation (`e.g`) means something by its casing and is left alone.
-const capitalized = (text: string): string => {
-    const [first = ""] = text.split(" ", 1);
-    if (!/^[a-z]/.test(first) || /[A-Z/.\\]/.test(first)) {
-        return text;
-    }
-    return `${text[0]?.toUpperCase() ?? ""}${text.slice(1)}`;
-};
-
-/* Split a plan's markdown into its leading heading and the remaining body.
- *
- * The heading is the one place in a turn where an agent writes a name for the WHOLE job rather than for a step
- *, a task checklist describes `Read the failing test`, `Fix the assertion`, `Run the suite`, none of which is
- * what the conversation is about, whereas a plan opens `## Fix the flaky auth tests`. That makes it the only
- * authored line in the stream worth promoting to a title, which is why this lives here rather than next to the
- * plan card that also renders it: the browser titles its own tabs from it and the daemon titles fleet cards. */
-export const planParts = (text: string): { title?: string; body: string } => {
-    const match = /^\s*#{1,6}\s+(.+)/.exec(text);
-    if (match === null) {
-        return { body: text };
-    }
-    return { title: match[1]!.trim(), body: text.slice(match.index + match[0].length).trimStart() };
-};
-
-/* Name a conversation after the prompt that opened it. Never empty for a non-empty prompt: a paste with no
- * prose around it still titles as its own first line, which at least names what was pasted. */
-export const deriveTitle = (prompt: string): string => {
-    const prose = proseLines(prompt)
-        .map(collapse)
-        .filter((line) => line !== "");
-    // Lines that survive opener-stripping with letters in them. The first is the title's default; the rest
-    // only matter when that default turns out to be scene-setting.
-    const lines = prose.map(withoutOpener).filter((line) => /\p{L}/u.test(line));
-    const primary = lines[0];
-    if (primary !== undefined) {
-        /* A first sentence that reports work already done is the scene, not the ask, `We have recently added
-         * iq map. Now let's expose health.` is a conversation about exposing health. Skipped only for an
-         * unmistakable ask further in (an instruction or an outright question); anything hazier and the
-         * narration stands, exactly as every non-narrative opening always does. */
-        const head = firstSentence(primary);
-        const ask = NARRATION.test(head)
-            ? lines
-                  .flatMap(sentencesOf)
-                  .map(withoutOpener)
-                  .find((sentence) => sentence !== head && isAsk(sentence))
-            : undefined;
-        return capitalized(clamped(firstSentence(collapseReferences(ask ?? primary))));
-    }
-    // Everything the user sent was code, a quote, or a greeting, title it as what it is rather than blank.
-    const fallback = prose[0] ?? collapse(prompt.replaceAll(/^\s*(?:```|~~~).*$/gm, ""));
-    return clamped(collapseReferences(fallback === "" ? collapse(prompt) : fallback));
-};