@intentic/sandbox-contract 1.300.0 → 1.301.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentic/sandbox-contract",
-  "version": "1.300.0",
+  "version": "1.301.0",
   "description": "oRPC wire contract for the intentic sandbox daemon, shared by the daemon and its browser client",
   "license": "MIT",
   "type": "module",
@@ -207,10 +207,10 @@
     }
   },
   "dependencies": {
-    "@intentic/base": "1.300.0",
-    "@intentic/constants": "1.300.0",
-    "@intentic/extension-manifest": "1.300.0",
-    "@intentic/registry": "1.300.0",
+    "@intentic/base": "1.301.0",
+    "@intentic/constants": "1.301.0",
+    "@intentic/extension-manifest": "1.301.0",
+    "@intentic/registry": "1.301.0",
     "@orpc/contract": "1.14.13",
     "tslib": "2.8.1",
     "zod": "4.5.4"

package/src/contracts/agent.contract.ts

@@ -1,4 +1,5 @@
-import { eventIterator, oc } from "@orpc/contract";
+import { oc } from "@orpc/contract";
+import { streamOf } from "../protocol/routes.js";
 import { AgentCommandsQuerySchema, AgentCommandsSchema } from "../events/cards.js";
 import { AttachFrameSchema } from "../events/agent-events.js";
 import { AgentTurnSchema, AttachTurnSchema, StartedTurnSchema } from "../schemas/agent.js";
@@ -30,7 +31,7 @@ export const agentContract = {
                 "Streams everything the agent does: its words, the tools it reaches for, and the answers it gets. Give it the point you have already seen and it replays from there before going live, so a reload loses nothing. The window that started the turn holds no special claim, and any number of watchers on any number of devices see the same thing.",
         })
         .input(AttachTurnSchema)
-        .output(eventIterator(AttachFrameSchema)),
+        .output(streamOf(AttachFrameSchema)),
     reply: oc
         .route({
             method: "POST",

package/src/contracts/agents.contract.ts

@@ -1,11 +1,12 @@
 import { oc } from "@orpc/contract";
-import { AgentTranscriptSchema } from "../events/transcript.js";
+import { AgentToolChildrenSchema, AgentTranscriptSchema } from "../events/transcript.js";
 import {
     AgentArchiveSchema,
     AgentAssignSchema,
     AgentAutoLandSchema,
     AgentFileDiffQuerySchema,
     AgentIdSchema,
+    AgentToolChildrenQuerySchema,
     AgentTranscriptQuerySchema,
     AgentIdsSchema,
     AgentLandSchema,
@@ -81,6 +82,16 @@ export const agentsContract = {
         })
         .input(AgentTranscriptQuerySchema)
         .output(AgentTranscriptSchema),
+    toolChildren: oc
+        .route({
+            method: "GET",
+            path: "/agents/{id}/transcript/tools/{toolId}",
+            summary: "One delegation's own calls",
+            description:
+                "The calls a delegated agent made under one tool card. A transcript page leaves them behind and reports their count as `nested`, since a settled delegation draws collapsed; this is what fills the card in when it is opened. Empty when the record no longer holds that call.",
+        })
+        .input(AgentToolChildrenQuerySchema)
+        .output(AgentToolChildrenSchema),
     // Also forgets the provider session, rewind-style, so the next fresh session reads the placed line as the agent's
     // own.
     place: oc

package/src/contracts/capabilities.contract.ts

@@ -1,4 +1,5 @@
-import { eventIterator, oc } from "@orpc/contract";
+import { oc } from "@orpc/contract";
+import { streamOf } from "../protocol/routes.js";
 import { IntenticLineSchema } from "../events/system-events.js";
 import {
     CapabilitiesListSchema,
@@ -38,7 +39,7 @@ export const capabilitiesContract = {
                 "Writes a connection and streams the work of applying it, because some kinds provision real infrastructure and take a while. Sending an id that already exists edits that connection: this is the edit as well as the create. Since a caller is never shown stored credentials, it marks the ones it is leaving alone and the daemon fills them in, which is the only way to change one setting without retyping a key.",
         })
         .input(CapabilitySchema)
-        .output(eventIterator(IntenticLineSchema)),
+        .output(streamOf(IntenticLineSchema)),
     // A credential the caller is keeping arrives as VAULTED here too, so an edit can be tested without retyping a key.
     probe: oc
         .route({

package/src/contracts/exit.contract.ts

@@ -1,4 +1,5 @@
-import { eventIterator, oc } from "@orpc/contract";
+import { oc } from "@orpc/contract";
+import { streamOf } from "../protocol/routes.js";
 import { IntenticLineSchema } from "../events/system-events.js";
 import { ExitCountriesSchema, ExitIdParamSchema, ExitListSchema, ExitObservationSchema, ExitUseInputSchema } from "../schemas/exit.js";
 import { OkSchema } from "../schemas/shared.js";
@@ -37,7 +38,7 @@ export const exitContract = {
                 "Starts the exit in the country it was configured for. Streamed, because a first start fetches a catalogue, raises a tunnel and then checks the address, which takes tens of seconds on the free providers and can fail at each step with something worth reading. Starting one that is already up simply says so.",
         })
         .input(ExitIdParamSchema)
-        .output(eventIterator(IntenticLineSchema)),
+        .output(streamOf(IntenticLineSchema)),
     use: oc
         .route({
             method: "POST",
@@ -47,7 +48,7 @@ export const exitContract = {
                 "Switches the exit's country, starting it first if it was down. It ends by checking where the world actually sees you and fails if that does not match what you asked for. A switch that quietly left your traffic where it was is the exact failure this whole feature exists to rule out.",
         })
         .input(ExitUseInputSchema)
-        .output(eventIterator(IntenticLineSchema)),
+        .output(streamOf(IntenticLineSchema)),
     // Cheap on tor (a control-port signal); a re-dial to another server for everything else.
     rotate: oc
         .route({
@@ -58,7 +59,7 @@ export const exitContract = {
                 "Swaps to another address in the country you are already in. Fails if the address does not actually change, which on a small pool it sometimes cannot.",
         })
         .input(ExitIdParamSchema)
-        .output(eventIterator(IntenticLineSchema)),
+        .output(streamOf(IntenticLineSchema)),
     check: oc
         .route({
             method: "POST",

package/src/contracts/host.contract.ts

@@ -1,4 +1,5 @@
-import { eventIterator, oc } from "@orpc/contract";
+import { oc } from "@orpc/contract";
+import { streamOf } from "../protocol/routes.js";
 import { z } from "zod";
 import { DeviceAgentFlowSchema, DeviceFlowLineSchema, DeviceSandboxFlowSchema } from "../schemas/devices.js";
 import { HostScopesSchema } from "../schemas/capabilities.js";
@@ -18,7 +19,7 @@ export const hostContract = {
     // One MCP JSON-RPC message forwarded verbatim in both directions, unmodified.
     mcp: oc.input(z.unknown()).output(z.unknown()),
     // Streamed for a person watching progress; the scope is checked on the machine, this only adds visibility.
-    runSandboxFlow: oc.input(DeviceSandboxFlowSchema).output(eventIterator(DeviceFlowLineSchema)),
+    runSandboxFlow: oc.input(DeviceSandboxFlowSchema).output(streamOf(DeviceFlowLineSchema)),
     // Spawns the work detached from the socket, so restarting the agent process cannot brick a swap in progress.
-    runAgentFlow: oc.input(DeviceAgentFlowSchema).output(eventIterator(DeviceFlowLineSchema)),
+    runAgentFlow: oc.input(DeviceAgentFlowSchema).output(streamOf(DeviceFlowLineSchema)),
 };

package/src/contracts/intentic.contract.ts

@@ -1,4 +1,5 @@
-import { eventIterator, oc } from "@orpc/contract";
+import { oc } from "@orpc/contract";
+import { streamOf } from "../protocol/routes.js";
 import { IntenticLineSchema } from "../events/system-events.js";
 import { IntenticRunSchema } from "../schemas/intentic.js";
 import { OkSchema } from "../schemas/shared.js";
@@ -15,7 +16,7 @@ export const intenticContract = {
                 "Runs the sandbox's own command-line tool and streams its output as it arrives, so progress is visible rather than arriving all at once at the end. A failure surfaces once the stream closes.",
         })
         .input(IntenticRunSchema)
-        .output(eventIterator(IntenticLineSchema)),
+        .output(streamOf(IntenticLineSchema)),
     // Launch the minutes-long apply → adopt reconcile as a one-shot tmux job (session panel-infra-apply) and
     // return immediately, progress is followed by attaching the terminal, not by holding this request open.
     apply: oc
@@ -39,5 +40,5 @@ export const intenticContract = {
             description:
                 "The same progress the terminal shows, as structured events, kept on disk so a page refresh does not lose it. It replays from the start of the run and then follows live, closing when the run ends.",
         })
-        .output(eventIterator(IntenticLineSchema)),
+        .output(streamOf(IntenticLineSchema)),
 };

package/src/contracts/netdisk.contract.ts

@@ -1,4 +1,5 @@
-import { eventIterator, oc } from "@orpc/contract";
+import { oc } from "@orpc/contract";
+import { streamOf } from "../protocol/routes.js";
 import { IntenticLineSchema } from "../events/system-events.js";
 import { NetdiskIdParamSchema, NetdiskListSchema } from "../schemas/netdisk.js";
 import { OkSchema } from "../schemas/shared.js";
@@ -28,7 +29,7 @@ export const netdiskContract = {
                 "Mounts a stored disk at its place under /mnt/netdisk, streaming progress. Mounting one that is already mounted simply says so. A read-only disk is mounted read-only; the kernel refuses writes to it.",
         })
         .input(NetdiskIdParamSchema)
-        .output(eventIterator(IntenticLineSchema)),
+        .output(streamOf(IntenticLineSchema)),
     unmount: oc
         .route({
             method: "POST",

package/src/contracts/runner.contract.ts

@@ -1,4 +1,5 @@
-import { eventIterator, oc } from "@orpc/contract";
+import { oc } from "@orpc/contract";
+import { streamOf } from "../protocol/routes.js";
 import { z } from "zod";
 import { AgentEventSchema } from "../events/agent-events.js";
 import { RunnerFactsSchema, RunnerSyncLineSchema, RunnerSyncSchema, RunnerTurnSchema } from "../protocol/runner-protocol.js";
@@ -13,9 +14,9 @@ export const runnerContract = {
     // Hardware facts, refreshed on demand; parity facts (image, overlay hash) ride the hello, not this call.
     describe: oc.output(RunnerFactsSchema),
     // `pull` updates the checkout, `push` returns a turn's result; streamed since a first sync clones repos.
-    syncWorkspace: oc.input(RunnerSyncSchema).output(eventIterator(RunnerSyncLineSchema)),
+    syncWorkspace: oc.input(RunnerSyncSchema).output(streamOf(RunnerSyncLineSchema)),
     // One turn in, the frames a local turn would produce out; the parent republishes them into the local pipeline.
-    runTurn: oc.input(RunnerTurnSchema).output(eventIterator(AgentEventSchema)),
+    runTurn: oc.input(RunnerTurnSchema).output(streamOf(AgentEventSchema)),
     // Returns `applied` rather than throwing: a missing id is an ordinary race, same as local NOT_FOUND.
     reply: oc.input(AgentReplySchema).output(z.object({ applied: z.boolean() })),
     // Attachments/editor context travel uncomposed: the note must build against the runner's own workspace root.

package/src/contracts/system.contract.ts

@@ -1,4 +1,5 @@
-import { eventIterator, oc } from "@orpc/contract";
+import { oc } from "@orpc/contract";
+import { streamOf } from "../protocol/routes.js";
 import { z } from "zod";
 import { SessionTranscriptSchema } from "../events/transcript.js";
 import { SystemEventSchema } from "../events/system-events.js";
@@ -78,7 +79,7 @@ export const systemContract = {
                 "A stream held open for as long as you want it, carrying heartbeats so a caller notices the sandbox dying at once, batches of file changes so a tree or an editor can refresh itself, and the roster of who else is looking. Give it an id for this connection to appear in that roster; leave it out and you watch without being seen.",
         })
         .input(z.object({ clientId: z.string().optional() }))
-        .output(eventIterator(SystemEventSchema)),
+        .output(streamOf(SystemEventSchema)),
     // A tab's activity self-report (view/session/file/idle), fanned back out to every member on /events.
     presence: oc
         .route({
@@ -191,7 +192,7 @@ export const systemContract = {
                 "Start, stop, restart, update, rebuild, roll back, reshape (its memory and CPU caps, privileged, GPU) or remove a sandbox running on a machine you own, relayed over the connection that machine holds open. The answer is a stream because the slowest of these takes minutes, and it is the same stream whichever you ask for. The daemon adds no opinion: the machine enforces its own permissions and a refusal arrives as the last line, in the machine's words, naming the switch to flip.",
         })
         .input(DeviceSandboxFlowInputSchema)
-        .output(eventIterator(DeviceFlowLineSchema)),
+        .output(streamOf(DeviceFlowLineSchema)),
     // Closed set of actions; the daemon builds the command line, not the caller. One sentence is the whole answer.
     runDeviceCommand: oc
         .route({
@@ -213,5 +214,5 @@ export const systemContract = {
                 "Updates a machine you own to the current intentic-machine agent, or restarts the loop it is running, over the connection that machine holds open. The answer is a stream of the run's own output — and it normally stops mid-run, because the agent's loop is what carries this connection: the work is detached from it first, so it finishes regardless, and the device's reported version is what confirms it. Takes the machine's \"Run commands\" permission, the same one a command typed there would.",
         })
         .input(DeviceAgentFlowInputSchema)
-        .output(eventIterator(DeviceFlowLineSchema)),
+        .output(streamOf(DeviceFlowLineSchema)),
 };

package/src/contracts/vpn.contract.ts

@@ -1,4 +1,5 @@
-import { eventIterator, oc } from "@orpc/contract";
+import { oc } from "@orpc/contract";
+import { streamOf } from "../protocol/routes.js";
 import { IntenticLineSchema } from "../events/system-events.js";
 import { OkSchema } from "../schemas/shared.js";
 import { ForticlientImportInputSchema, ForticlientImportSchema, VpnConnectInputSchema, VpnIdParamSchema, VpnListSchema } from "../schemas/vpn.js";
@@ -28,7 +29,7 @@ export const vpnContract = {
                 "Brings a stored tunnel up, streaming the client's progress as it authenticates and then sets up routing. Streamed because a dial takes seconds and can fail with something you have to read: a wrong password, a gateway certificate nobody trusts, a code it wants. Connecting one that is already up simply says so.",
         })
         .input(VpnConnectInputSchema)
-        .output(eventIterator(IntenticLineSchema)),
+        .output(streamOf(IntenticLineSchema)),
     // Drops a tunnel; tolerates one already down, since the contract is "not up," not "it was up."
     disconnect: oc
         .route({

package/src/events/transcript.ts

@@ -81,6 +81,14 @@ export const TranscriptToolSchema: z.ZodType<TranscriptTool> = z.lazy(() =>
             .describe(
                 "Calls a delegated subagent made, nested under the call that started it, so a reopened conversation redraws the delegation rather than collapsing it into one result.",
             ),
+        nested: z
+            .number()
+            .int()
+            .nonnegative()
+            .optional()
+            .describe(
+                "How many calls sit under this one, present in place of `children` when they were left behind. A transcript page does that, since a settled delegation draws collapsed; ask for the call's own children to fill it in.",
+            ),
         thinking: z.string().optional().describe("What the agent was reasoning about around this call."),
         subagent: TranscriptSubagentSchema.optional().describe(
             "The helper this call started, as the daemon's registry sees it: what it is, how it is going, what it has spent. What a card can say about a backgrounded child whose result is minutes away.",
@@ -116,6 +124,9 @@ export interface TranscriptTool {
     locations?: ToolCallLocation[] | undefined;
     content?: ToolCallContent[] | undefined;
     children?: TranscriptTool[] | undefined;
+    // How many calls sit under this one when `children` is not carried: a transcript page leaves a delegation's run
+    // behind, since it only draws once the card is opened.
+    nested?: number | undefined;
     thinking?: string | undefined;
     subagent?: TranscriptSubagent | undefined;
 }
@@ -166,6 +177,15 @@ export const TranscriptRowSchema = z.object({
             "Who said it. A notice is neither side: it is something that happened to the turn, recorded so a reopened conversation can say it. Without those, a turn a provider refused ends on the user's message and reads as broken.",
         ),
     text: z.string().describe("The words."),
+    // Which run produced this row, carried on every copy of it: the live head's, the record's, a client's mirror.
+    // It is how a client says "I am already showing this run" without comparing content, which cannot answer that
+    // while the run's last row is still growing.
+    run: z
+        .string()
+        .optional()
+        .describe(
+            "The run that produced this row. Present on everything a turn produced, absent on rows written outside one. A client draws a run's rows over whatever it already holds for that run, which is what this identifies; content cannot, because the last row of a live run keeps growing.",
+        ),
     // The turn's send time (user rows only), not settlement; the only row-moment the daemon actually knows.
     sentAt: z
         .number()
@@ -331,6 +351,11 @@ export const AgentTranscriptSchema = SessionTranscriptSchema.extend({
     more: z.boolean().describe("Whether older messages precede this page."),
 });
 
+// A delegation's own run, fetched when its card opens; empty when the record no longer holds it.
+export const AgentToolChildrenSchema = z.object({
+    children: z.array(TranscriptToolSchema).describe("The calls the delegated agent made, in the order it made them."),
+});
+
 // The whole of a published conversation, baked into the page since nothing else may still be running when it opens. The
 // same TranscriptRow rows the app replays, filtered to the chosen detail, pictures rewritten to published copies.
 export const SharePayloadSchema = z.object({

package/src/protocol/routes.test.ts

@@ -2,7 +2,7 @@ import { eventIterator, oc } from "@orpc/contract";
 import { describe, expect, it } from "vitest";
 import { z } from "zod";
 import { SANDBOX_ROUTE_NAMES, SANDBOX_ROUTE_SHAPES, SANDBOX_ROUTES, sandboxRouteName } from "../index.js";
-import { contractRoutes, routeNameForRequest, routeShapes } from "./routes.js";
+import { contractRoutes, routeNameForRequest, routeShapes, streamOf } from "./routes.js";
 
 const fixture = {
     vpn: {
@@ -111,18 +111,38 @@ describe(`routeShapes`, () => {
         expect(routeShapes(shaped(z.object({ a: z.string() })))[`vpn.list`]).not.toBe(shapes[`vpn.list`]);
     });
 
-    it(`omits a route whose shape cannot be expressed rather than failing the walk`, () => {
-        // An oRPC event iterator wraps its output in an opaque type with no schema, so `watch` here keeps its name but
-        // no shape.
+    it(`fingerprints a stream through the frames it declares`, () => {
         const withStream = {
+            vpn: {
+                list: fixture.vpn.list,
+                watch: oc.route({ method: "GET", path: "/vpn/watch" }).output(streamOf(z.object({ a: z.string() }))),
+            },
+        };
+        expect(Object.keys(routeShapes(withStream)).toSorted()).toEqual([`vpn.list`, `vpn.watch`]);
+        // A changed frame is a changed route, which is the whole point of reaching past the iterator.
+        const reframed = { vpn: { watch: oc.route({ method: "GET", path: "/vpn/watch" }).output(streamOf(z.object({ a: z.number() }))) } };
+        expect(routeShapes(reframed)[`vpn.watch`]).not.toBe(routeShapes(withStream)[`vpn.watch`]);
+    });
+
+    it(`tells a stream of X apart from a route that answers X`, () => {
+        const frame = z.object({ a: z.string() });
+        const streamed = { vpn: { watch: oc.route({ method: "GET", path: "/vpn/watch" }).output(streamOf(frame)) } };
+        const answered = { vpn: { watch: oc.route({ method: "GET", path: "/vpn/watch" }).output(frame) } };
+        expect(routeShapes(streamed)[`vpn.watch`]).not.toBe(routeShapes(answered)[`vpn.watch`]);
+    });
+
+    it(`omits a route whose shape cannot be expressed rather than failing the walk`, () => {
+        // oRPC's own eventIterator hides its frames, which is why contracts declare streams with streamOf; one that
+        // slipped through keeps its name and loses only its shape, instead of breaking the walk for every other route.
+        const withRawIterator = {
             vpn: {
                 list: fixture.vpn.list,
                 watch: oc.route({ method: "GET", path: "/vpn/watch" }).output(eventIterator(z.object({ a: z.string() }))),
             },
         };
-        expect(Object.keys(routeShapes(withStream)).toSorted()).toEqual([`vpn.list`]);
+        expect(Object.keys(routeShapes(withRawIterator)).toSorted()).toEqual([`vpn.list`]);
         expect(
-            contractRoutes(withStream)
+            contractRoutes(withRawIterator)
                 .map((route) => route.name)
                 .toSorted(),
         ).toEqual([`vpn.list`, `vpn.watch`]);
@@ -130,34 +150,47 @@ describe(`routeShapes`, () => {
 });
 
 describe(`the real sandbox contract`, () => {
-    it(`fingerprints all but the streaming routes`, () => {
-        const unshaped = SANDBOX_ROUTE_NAMES.filter((name) => !(name in SANDBOX_ROUTE_SHAPES));
-        // oRPC gives an event iterator's output no schema, so these can't be fingerprinted; named rather than counted
-        // so a new one added here fails the test.
-        expect(unshaped.toSorted()).toEqual([
+    it(`fingerprints every route, streams included`, () => {
+        // Nothing may opt out: a route with no fingerprint is a route the browser can never tell has drifted, and the
+        // streaming ones (system.events, agent.attach, the exit dials) carry the frames a stale daemon breaks first.
+        expect(SANDBOX_ROUTE_NAMES.filter((name) => !(name in SANDBOX_ROUTE_SHAPES))).toEqual([]);
+    });
+
+    it(`fingerprints the streaming routes eventIterator used to hide`, () => {
+        expect(
+            [
+                `agent.attach`,
+                `capabilities.add`,
+                `exit.rotate`,
+                `exit.start`,
+                `exit.use`,
+                `intentic.applyEvents`,
+                `intentic.run`,
+                `netdisk.mount`,
+                `system.events`,
+                `system.manageDeviceSandbox`,
+                `system.runDeviceAgentFlow`,
+                `vpn.connect`,
+            ].filter((name) => name in SANDBOX_ROUTE_SHAPES).toSorted(),
+        ).toEqual([
             `agent.attach`,
             `capabilities.add`,
-            // The three exit moves stream since bringing an exit up dials and verifies over tens of seconds, failing at
-            // any step.
             `exit.rotate`,
             `exit.start`,
             `exit.use`,
             `intentic.applyEvents`,
             `intentic.run`,
-            // A mount dials a file server and can fail at any step with something to read, like a vpn dial.
             `netdisk.mount`,
             `system.events`,
             `system.manageDeviceSandbox`,
-            // The device agent updates or restarts itself; the stream dies with the process, so lines arrive as they
-            // happen.
             `system.runDeviceAgentFlow`,
             `vpn.connect`,
         ]);
     });
 
-    it(`fingerprints every other route exactly once`, () => {
+    it(`fingerprints every route exactly once`, () => {
         expect(Object.keys(SANDBOX_ROUTE_SHAPES).every((name) => SANDBOX_ROUTE_NAMES.includes(name))).toBe(true);
-        expect(Object.keys(SANDBOX_ROUTE_SHAPES).length).toBe(SANDBOX_ROUTE_NAMES.length - 12);
+        expect(Object.keys(SANDBOX_ROUTE_SHAPES).length).toBe(SANDBOX_ROUTE_NAMES.length);
     });
 
     it(`derives a route table with no duplicate names`, () => {

package/src/protocol/routes.ts

@@ -1,9 +1,23 @@
+import { eventIterator } from "@orpc/contract";
 import { z } from "zod";
 
 // Named route surface of the daemon's contract (`<group>.<route>`), derived automatically so nothing here is
 // hand-maintained. The daemon advertises which routes it implements (the /events hello frame); the browser diffs that
 // against its own contract so an old daemon's gap is a named feature check, not a silent 404.
 
+// Every streamed route declares its frames through this, never oRPC's `eventIterator` directly: that returns an opaque
+// standard-schema validator holding no reachable inner schema, so a stream's payload would be unfingerprintable and its
+// drift invisible. The frame schema rides along under a symbol, which oRPC never reads and JSON never serializes.
+// Typed as a plain `symbol`, not the inferred unique one: a unique symbol would ride into every contract's inferred
+// type and break declaration emit on a local name nothing outside can refer to.
+const FRAME: symbol = Symbol.for("intentic.contract.frame");
+
+export const streamOf = <T extends z.ZodType>(frame: T) => Object.assign(eventIterator(frame), { [FRAME]: frame });
+
+// The frame schema behind a streamed route's validator, or undefined for an ordinary request/response schema.
+const frameOf = (schema: unknown): z.ZodType | undefined =>
+    typeof schema === "object" && schema !== null && FRAME in schema ? ((schema as Record<symbol, unknown>)[FRAME] as z.ZodType) : undefined;
+
 // Structural shape of `~orpc.route`, the metadata oRPC attaches to every `oc.route(...)` procedure; read this way since
 // oRPC's internal types aren't public.
 interface ContractProcedureLike {
@@ -85,18 +99,24 @@ const fingerprint = (value: unknown): string => {
     return hash.toString(36);
 };
 
-// One route's wire shape, or undefined if it can't be expressed (a streaming route with no underlying schema). `io`
-// matters: a `.default()` field is optional in and required out, so both directions must be read separately.
+// One side of a route as JSON Schema. A streamed side is read through its frame and tagged, so "answers X" and "streams
+// frames of X" can never fingerprint alike. `io` matters: a `.default()` field is optional in and required out.
+const wireShape = (schema: unknown, io: "input" | "output"): unknown => {
+    if (schema === undefined) {
+        return undefined;
+    }
+    const frame = frameOf(schema);
+    return frame === undefined ? z.toJSONSchema(schema as z.ZodType, { io }) : { stream: z.toJSONSchema(frame, { io }) };
+};
+
+// One route's wire shape, or undefined if it can't be expressed at all.
 const procedureShape = (value: unknown): string | undefined => {
     if (typeof value !== "object" || value === null || !("~orpc" in value)) {
         return undefined;
     }
     const { inputSchema, outputSchema } = (value as ContractSchemasLike)["~orpc"];
     try {
-        return fingerprint({
-            in: inputSchema === undefined ? undefined : z.toJSONSchema(inputSchema as z.ZodType, { io: "input" }),
-            out: outputSchema === undefined ? undefined : z.toJSONSchema(outputSchema as z.ZodType, { io: "output" }),
-        });
+        return fingerprint({ in: wireShape(inputSchema, "input"), out: wireShape(outputSchema, "output") });
     } catch {
         return undefined;
     }

package/src/schemas/agents.ts

@@ -471,6 +471,12 @@ export const AgentTranscriptQuerySchema = AgentIdSchema.extend({
         .describe("Return the messages before this position in the record: the `from` of the page below. Absent asks for the most recent turns."),
     turns: z.coerce.number().int().min(1).max(200).optional().describe("How many of the user's turns to return, newest first. Absent takes the daemon's default."),
 });
+
+// Fills in what a page counted instead of carrying: a delegation's own calls, addressed by the card's id, which is
+// unique within a conversation.
+export const AgentToolChildrenQuerySchema = AgentIdSchema.extend({
+    toolId: z.string().min(1).describe("Which tool call, by the id its card carries."),
+});
 // Absent `ids` archives every archivable finished agent (the lane's "Clear"); unarchive always names its own ids.
 export const AgentArchiveSchema = z.object({
     ids: z

package/src/schemas/devices.ts

@@ -1,6 +1,6 @@
 // What one of the user's own machines is running.
 import { z } from "zod";
-import { type HostFacts, HostFactsSchema, WslEnvironmentSchema } from "./hosts.js";
+import { hostCardOf, hostEnvironmentOf, type HostFacts, HostFactsSchema, WslEnvironmentSchema } from "./hosts.js";
 import { DEV_VERSION } from "../state/versions.js";
 // Desktop-sync report shape shared by the agent, daemon and browser, produced only by `intentic-machine status --json`.
 // The agent never reports `sandboxes`; the docker half is filled in by whoever reads the report, scoped to the reader's
@@ -451,54 +451,100 @@ export type DevicesList = z.infer<typeof DevicesListSchema>;
 // The physical computer a device is an environment of. Windows and every WSL distro on it are one machine with one
 // Docker engine, one screen and one set of disks, each environment holding its own agent and its own door.
 export interface Machine {
-    /** A lone device's own key, so its address does not change; a folded machine's is the hostname its doors share. */
+    /** The card its doors hang off, else the hostname they share, else a lone uncarded device's own key. */
     readonly key: string;
     readonly label: string;
-    /** Windows first, then distros by label: the side that owns the screen leads. */
+    /** Windows first, then distros by the name WSL registered: the side that owns the screen leads. */
     readonly environments: readonly Device[];
 }
 
 export const deviceHostname = (device: Device): string | undefined => device.facts?.hostname ?? device.report?.hostname;
-export const deviceEnvironment = (device: Device): string | undefined => environmentOf(device.facts, device.report);
-export const isWslDevice = (device: Device): boolean => deviceEnvironment(device)?.startsWith("wsl:") === true;
 
-// Two native installs that merely share a name stay two machines; only a distro joins the machine whose hostname it
-// carries, which is the one fact that makes the name safe to join on.
-const byEnvironment = (a: Device, b: Device): number => Number(isWslDevice(a)) - Number(isWslDevice(b)) || a.label.localeCompare(b.label);
+// Which side of a machine a device is. Its door id names the environment it connected under (`<card>::wsl:<distro>`),
+// and that is all an environment nobody has reached since this daemon booted can say about itself: liveness resets on
+// restart, so facts and reports are absent on a side that is merely asleep.
+export const deviceEnvironment = (device: Device): string | undefined =>
+    environmentOf(device.facts, device.report) ?? (device.hostId === undefined ? undefined : hostEnvironmentOf(device.hostId));
+
+const WSL_PREFIX = "wsl:";
+export const isWslDevice = (device: Device): boolean => deviceEnvironment(device)?.startsWith(WSL_PREFIX) === true;
+// The distro a device runs, by whatever evidence it holds; absent on a native install and on one that has said nothing.
+export const deviceDistro = (device: Device): string | undefined => {
+    const environment = deviceEnvironment(device);
+    return environment?.startsWith(WSL_PREFIX) === true ? environment.slice(WSL_PREFIX.length) : undefined;
+};
+
+// Native first, then distros by the name WSL registered them under rather than by their door id, which is that same
+// name behind a card's and so would order a PC's distros by which card each was connected through.
+const byEnvironment = (a: Device, b: Device): number =>
+    Number(isWslDevice(a)) - Number(isWslDevice(b)) || (deviceDistro(a) ?? a.label).localeCompare(deviceDistro(b) ?? b.label);
 
 const hostnameKey = (device: Device): string | undefined => deviceHostname(device)?.toLowerCase();
 
-const siblingsOf = (device: Device, devices: readonly Device[]): Device[] => {
-    const key = hostnameKey(device);
-    const shared = key === undefined ? [device] : devices.filter((candidate) => hostnameKey(candidate) === key);
-    return shared.length > 1 && shared.some(isWslDevice) ? shared.toSorted(byEnvironment) : [device];
+// The card a device's door hangs off: one card is one computer, so two doors naming the same card are one machine
+// whatever either has said about itself — which is the whole of what an environment that has never connected says.
+const cardKey = (device: Device): string | undefined => (device.hostId === undefined ? undefined : hostCardOf(device.hostId));
+
+// What makes two devices one computer: a shared card, or a shared hostname where a distro answers to it, since WSL
+// hands a distro the Windows machine's name. Two native installs that merely share a name stay two machines.
+const tokensOf = (device: Device, distroNames: ReadonlySet<string>): string[] => {
+    const card = cardKey(device);
+    const hostname = hostnameKey(device);
+    return [
+        ...(card === undefined ? [] : [`card:${card.toLowerCase()}`]),
+        ...(hostname !== undefined && distroNames.has(hostname) ? [`host:${hostname}`] : []),
+    ];
 };
 
-const machineOf = (device: Device, environments: readonly Device[]): Machine => {
-    if (environments.length === 1) {
-        return { key: device.key, label: device.label, environments };
-    }
-    // Folding needs a hostname, so it is present here; the fallback only keeps the type honest.
-    const hostname = deviceHostname(device) ?? device.key;
-    return { key: hostname, label: hostname, environments };
-};
+// Components over both joins at once: a device holding a card token and a hostname token is the evidence that merges
+// the machines those tokens named, so a distro connected under a card of its own still lands on the PC it runs on.
+interface Component {
+    readonly tokens: Set<string>;
+    readonly devices: Device[];
+}
 
-export const machinesOf = (devices: readonly Device[]): Machine[] => {
-    const folded = new Set<Device>();
-    const machines: Machine[] = [];
+const componentsOf = (devices: readonly Device[]): Component[] => {
+    const distroNames = new Set(devices.filter(isWslDevice).map(hostnameKey).filter((name) => name !== undefined));
+    const components: Component[] = [];
     for (const device of devices) {
-        if (folded.has(device)) {
+        const tokens = tokensOf(device, distroNames);
+        const [head, ...merged] = components.filter((component) => tokens.some((token) => component.tokens.has(token)));
+        if (head === undefined) {
+            components.push({ tokens: new Set(tokens), devices: [device] });
             continue;
         }
-        const environments = siblingsOf(device, devices);
-        for (const environment of environments) {
-            folded.add(environment);
+        for (const other of merged) {
+            other.tokens.forEach((token) => head.tokens.add(token));
+            head.devices.push(...other.devices);
+            components.splice(components.indexOf(other), 1);
         }
-        machines.push(machineOf(device, environments));
+        for (const token of tokens) {
+            head.tokens.add(token);
+        }
+        head.devices.push(device);
     }
-    return machines;
+    return components;
 };
 
+// Addressed by the card of the side that owns the screen, an address that does not change when a second environment
+// connects — unlike a row key, which is a hostname another environment can take first. An uncarded fold has only the
+// hostname its doors share, and an uncarded lone device its own key. Called what the owner calls it: the name the
+// leading environment carries, unless that is nothing but its door id, which reads as a PC named after one of its
+// own sides.
+const machineOf = (environments: readonly Device[]): Machine => {
+    const [first, ...rest] = environments;
+    // A component holds the device that made it; the empty case only keeps the type honest.
+    if (first === undefined) {
+        return { key: "", label: "", environments };
+    }
+    const named = environments.map(cardKey).find((key) => key !== undefined) ?? (rest.length === 0 ? undefined : deviceHostname(first));
+    const label = first.label === first.hostId ? (cardKey(first) ?? first.label) : first.label;
+    return { key: named ?? first.key, label, environments };
+};
+
+export const machinesOf = (devices: readonly Device[]): Machine[] =>
+    componentsOf(devices).map((component) => machineOf(component.devices.toSorted(byEnvironment)));
+
 // Every door whose docker reports a given sandbox slug, in list order. More than one is the ordinary case, not a
 // conflict: Windows and the WSL distros on it share one engine, so each door answers for the same containers.
 const doorsRunningSandbox = (devices: readonly Device[], slug: string | undefined): Device[] =>