@intentic/sandbox-contract 1.303.0 → 1.305.0

package/src/text/mentions.test.ts

@@ -1,5 +1,6 @@
-import { describe, expect, it } from "vitest";
-import { mentionedPathTokens, mentionPaths } from "./mentions.js";
+import { describe, it, expect } from "bun:test";
+import { AgentTurnSchema } from "../schemas/agent.js";
+import { MENTION_LIMIT, mentionedPathTokens, mentionPaths } from "./mentions.js";
 
 describe(`mentionPaths`, () => {
     it(`extracts path-looking tokens, deduped, with trailing punctuation stripped`, () => {
@@ -13,6 +14,23 @@ describe(`mentionPaths`, () => {
     it(`skips scoped package script prefixes in copied pnpm output`, () => {
         expect(mentionPaths(`@intentic/iq-engine:test: failed\nsee @src/app.ts`)).toEqual([`src/app.ts`]);
     });
+
+    // A pasted `ps` dump attached a file nobody chose and the turn died on it: curl's `@file` argument is a mention's
+    // exact shape.
+    it(`skips curl's @file argument and anything else outside the workspace`, () => {
+        expect(mentionPaths(`curl --data-binary @/tmp/probe/req.json localhost`)).toEqual([]);
+        expect(mentionPaths(`@~/notes.md @C:\\tmp\\out.log @../outside.bin @.. done`)).toEqual([]);
+        expect(mentionPaths(`curl -d @/tmp/req.json x, then read @src/app.ts`)).toEqual([`src/app.ts`]);
+    });
+
+    // The wire takes MENTION_LIMIT paths: past it the schema would refuse the whole message, which is the failure a
+    // pasted log must not be able to cause.
+    it(`stops at the limit a turn can carry rather than overflowing it`, () => {
+        const pasted = Array.from({ length: MENTION_LIMIT + 5 }, (_, index) => `@src/file${index}.ts`).join(` `);
+
+        expect(mentionPaths(pasted)).toHaveLength(MENTION_LIMIT);
+        expect(AgentTurnSchema.safeParse({ prompt: pasted, mentions: mentionPaths(pasted) }).success).toBe(true);
+    });
 });
 
 describe(`mentionedPathTokens`, () => {

package/src/text/mentions.ts

@@ -18,4 +18,13 @@ export const mentionedPathTokens = (text: string): string[] => {
 // Excludes a copied pnpm script prefix (`@scope/package:test:`), which shares the opening shape but is not a file;
 // accepting it creates a phantom attachment.
 const PACKAGE_SCRIPT = /^[^/]+\/[^/]+:[^/]+$/u;
-export const mentionPaths = (text: string): string[] => mentionedPathTokens(text).filter((token) => !PACKAGE_SCRIPT.test(token));
+// A mention names a workspace-relative path and nothing else: the picker inserts one from the workspace index, an
+// upload mints one under the state dir. An absolute, home, drive-letter or climbing token is therefore never a
+// mention, and curl's `@file` argument (`--data-binary @/tmp/req.json`) wears exactly that shape in pasted output.
+const OUTSIDE_WORKSPACE = /^(?:[/~]|[A-Za-z]:[\\/]|\.\.(?:[/\\]|$))/u;
+// How many a turn may carry; the tokenizer stops here rather than letting a pasted log's 21st token refuse the turn.
+export const MENTION_LIMIT = 20;
+export const mentionPaths = (text: string): string[] =>
+    mentionedPathTokens(text)
+        .filter((token) => !PACKAGE_SCRIPT.test(token) && !OUTSIDE_WORKSPACE.test(token))
+        .slice(0, MENTION_LIMIT);

package/src/text/path-refs.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, test } from "vitest";
+import { describe, test, expect } from "bun:test";
 import { isTestPath, rankRefCandidates, referenceTails } from "./path-refs.js";
 
 describe("referenceTails", () => {

package/src/text/title.test.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "vitest";
+import { test, expect } from "bun:test";
 import { AgentTurnSchema } from "../schemas/agent.js";
 import { deriveTitle } from "./title.js";
 

package/src/text/transcript-fold.test.ts

@@ -1,8 +1,9 @@
 import { STATE_DIR } from "@intentic/constants";
-import { describe, expect, it } from "vitest";
+import { describe, it, expect } from "bun:test";
 import type { AgentEvent } from "../events/agent-events.js";
 import type { TranscriptPatch, TranscriptRow } from "../events/transcript.js";
 import { watchWakePrompt } from "../events/watch-wake.js";
+import { childReportPrompt, peerMessagePrompt } from "../events/agent-words.js";
 import { applyTranscriptPatch, foldTurn, TranscriptFold, userRow } from "./transcript-fold.js";
 
 // Epoch ms stamped on the opening user row's sentAt.
@@ -443,6 +444,37 @@ describe("patches", () => {
         expect(fold.steerRows).toEqual([]);
     });
 
+    // Another agent's words are drawn as theirs, never as the owner's.
+    it("writes a peer's message and a child's report into a live turn as notices, not as the owner's words", () => {
+        const fold = new TranscriptFold(openingOf("ship it"));
+        fold.apply({
+            kind: "steer",
+            text: peerMessagePrompt({ from: "sharp-shale-htw8", title: "Bun migration", message: "done" }),
+            sentAt: SENT_AT + 1,
+            voice: "agent",
+        });
+        fold.apply({
+            kind: "steer",
+            text: childReportPrompt({ child: "sub-x7", title: "Port the parser", failed: false, report: "ported", verification: undefined }),
+            sentAt: SENT_AT + 2,
+            voice: "sandbox",
+        });
+        expect(fold.rows.slice(1)).toMatchObject([
+            { role: "notice", agentWords: { kind: "peer", from: "sharp-shale-htw8" } },
+            { role: "notice", agentWords: { kind: "child", from: "sub-x7" } },
+        ]);
+        expect(fold.steerRows).toEqual([]);
+    });
+
+    // An anchor from any other voice would shift every later person's anchor onto the wrong message.
+    it("anchors only a person's steer, even when another voice's words draw as a user row", () => {
+        const fold = new TranscriptFold(openingOf("ship it"));
+        fold.apply({ kind: "steer", text: "also cover the parser", sentAt: SENT_AT + 1, voice: "agent" });
+        fold.apply({ kind: "steer", text: "and the docs", sentAt: SENT_AT + 2 });
+        expect(fold.rows.map((row) => row.role)).toEqual(["user", "user", "user"]);
+        expect(fold.steerRows).toEqual([2]);
+    });
+
     it("drop an empty bubble the turn opened and abandoned", () => {
         const events: AgentEvent[] = [
             { kind: "todos", items: [] },
@@ -462,3 +494,153 @@ describe("patches", () => {
         expect(fold.rows[1]?.text).toBe("ab");
     });
 });
+
+// A refusal that ran nothing offers the message back to the composer — true where somebody typed one, false for a run
+// that started itself, where there is no composer and no typed message.
+describe(`a refusal that ran nothing`, () => {
+    const REFUSED = { kind: `error`, code: `context-window-too-small`, message: `This model accepts 16,384 tokens.` } as const satisfies AgentEvent;
+
+    it(`holds a turn somebody typed for another press`, () => {
+        const rows = foldOf(`land it`, [REFUSED]);
+
+        expect(rows.at(-1)?.text).toContain(`held for you to send again`);
+    });
+
+    it(`promises no resend for a turn that started itself`, () => {
+        const rows = foldOf(`land it`, [{ ...REFUSED, unattended: true }]);
+
+        expect(rows.at(-1)?.text).not.toContain(`send again`);
+        expect(rows.at(-1)?.text).toContain(`started on its own`);
+        // The provider's own sentence still leads, whichever clause follows it.
+        expect(rows.at(-1)?.text).toContain(`16,384 tokens`);
+    });
+
+    // The daemon lets a person's next send through once it has warned them, so the row says so and always offers it;
+    // the raise joins only when the hold carried a ceiling to size it by, which a stall does not.
+    describe(`on a sandbox short of memory`, () => {
+        const GIB = 1024 ** 3;
+        const lowMemory = {
+            kind: `error`,
+            code: `sandbox-memory-low`,
+            message: `Sandbox memory is low: 12.0 GiB resident + 4.0 GiB swapped, against 16.0 GiB.`,
+            memory: { limitBytes: 16 * GIB, residentBytes: 12 * GIB, swapBytes: 4 * GIB },
+        } as const satisfies AgentEvent;
+
+        it(`tells the reader that sending again starts it, and offers both presses when there is a ceiling to raise`, () => {
+            const row = foldOf(`land it`, [lowMemory]).at(-1);
+            expect(row?.text).toBe(`${lowMemory.message} Your message is held: send it again to start anyway.`);
+            expect(row?.noticeAction).toBe(`sandboxMemory`);
+        });
+
+        it(`offers only the send on a stall, which names no ceiling`, () => {
+            const { memory: _stalled, ...noReading } = lowMemory;
+            const row = foldOf(`land it`, [noReading]).at(-1);
+            expect(row?.noticeAction).toBe(`sendAnyway`);
+            expect(row?.text).toContain(`send it again to start anyway`);
+        });
+
+        it(`offers nothing on a background turn, which has no message to send`, () => {
+            const row = foldOf(`land it`, [{ ...lowMemory, unattended: true }]).at(-1);
+            expect(row?.noticeAction).toBeUndefined();
+            expect(row?.text).toContain(`started on its own`);
+        });
+    });
+
+    // The other held refusals share the sentence, not the button: nothing about a dead credential is fixed by a cap.
+    it(`offers no press on the held refusals that a raise would not fix`, () => {
+        expect(foldOf(`land it`, [REFUSED]).at(-1)?.noticeAction).toBeUndefined();
+    });
+
+    // The bug this retraction exists for: the composer keeps the words for another press, so a bubble left standing
+    // here is the SAME message a second time, and a third, once per press against a gate that keeps refusing.
+    it(`takes the message back out, leaving the composer's copy as the only one`, () => {
+        const fold = new TranscriptFold(openingOf(`land it`));
+        const patches = fold.apply(REFUSED);
+
+        expect(fold.rows).toEqual([{ role: `notice`, text: expect.stringContaining(`held for you to send again`) }]);
+        expect(fold.ranNothing).toBe(true);
+        // Dropped ahead of the notice that stands in for it: a window applies patches in order, and an append first
+        // would have it renumber every row under an index that is about to move.
+        expect(patches).toEqual([
+            { op: `drop`, index: 0 },
+            { op: `append`, row: expect.objectContaining({ role: `notice` }) },
+        ]);
+    });
+
+    // Three presses is what the screenshot of this bug showed: one paragraph, four times, with a refusal between each.
+    it(`leaves nothing behind however many times the same message is refused`, () => {
+        const pressed = [0, 1, 2].map(() => foldOf(`land it`, [REFUSED]));
+
+        expect(pressed.flat().filter((row) => row.role === `user`)).toEqual([]);
+    });
+
+    it(`keeps the message of a run that started itself, which has no composer to repeat from`, () => {
+        const fold = new TranscriptFold(openingOf(`land it`));
+        fold.apply({ ...REFUSED, unattended: true });
+
+        expect(fold.rows[0]).toEqual(expect.objectContaining({ role: `user`, text: `land it` }));
+        expect(fold.ranNothing).toBe(false);
+    });
+
+    // A refusal is only a retraction where it refused the whole turn. One arriving after the agent has spoken ends a
+    // turn that happened, and everything it said is kept and recorded.
+    it(`keeps a turn the refusal interrupted rather than prevented`, () => {
+        const fold = new TranscriptFold(openingOf(`land it`));
+        fold.apply({ kind: `delta`, text: `on it` });
+        fold.apply(REFUSED);
+
+        expect(fold.rows.map((row) => row.role)).toEqual([`user`, `assistant`, `notice`]);
+        expect(fold.ranNothing).toBe(false);
+    });
+
+    // The sandbox, not a composer, keeps a turn it started itself (a fix press, a peer's message): the frame says so
+    // with `held`. The bug this exists for: such a refusal took the fix prompt out, and no queue anywhere held a copy.
+    describe(`of a turn the sandbox keeps`, () => {
+        const kept = { ...REFUSED, held: { ran: false } } as const satisfies AgentEvent;
+
+        it(`leaves the message where it was, and is recorded like any turn`, () => {
+            const fold = new TranscriptFold(openingOf(`land it`));
+            const patches = fold.apply(kept);
+
+            expect(fold.rows[0]).toEqual(expect.objectContaining({ role: `user`, text: `land it` }));
+            expect(fold.ranNothing).toBe(false);
+            expect(patches).toEqual([{ op: `append`, row: expect.objectContaining({ role: `notice` }) }]);
+        });
+
+        it(`offers to send it again, as the sandbox's to run rather than the composer's`, () => {
+            const row = foldOf(`land it`, [kept]).at(-1);
+            expect(row?.text).toBe(`${REFUSED.message} Nothing has run yet: the message above is kept here to send again once that is sorted.`);
+            expect(row).toMatchObject({ noticeAction: `sendAgain`, sandboxHeld: true });
+        });
+
+        it(`offers the memory hold's own presses, anyway and the raise`, () => {
+            const GIB = 1024 ** 3;
+            const lowMemory = {
+                kind: `error`,
+                code: `sandbox-memory-low`,
+                message: `Sandbox memory is low: 15.9 GiB of 16.0 GiB used.`,
+                memory: { limitBytes: 16 * GIB, residentBytes: 15.9 * GIB, swapBytes: 0 },
+                held: { ran: false },
+            } as const satisfies AgentEvent;
+            const row = foldOf(`land it`, [lowMemory]).at(-1);
+            expect(row?.text).toBe(`${lowMemory.message} Nothing has run yet: the message above is kept here, and sending it anyway starts it.`);
+            expect(row).toMatchObject({ noticeAction: `sandboxMemory`, sandboxHeld: true });
+        });
+    });
+
+    // Asked by whoever keeps the words before the frame is folded, so it has to agree with the fold's own reading.
+    describe(`turned away at the door`, () => {
+        it(`is a refusal before anything was said, with somebody watching`, () => {
+            const fold = new TranscriptFold(openingOf(`land it`));
+            expect(fold.turnedAway(REFUSED)).toBe(true);
+            expect(fold.turnedAway({ ...REFUSED, unattended: true })).toBe(false);
+            expect(fold.turnedAway({ kind: `error`, code: `rate_limit`, message: `Usage limit reached.` })).toBe(false);
+        });
+
+        it(`is not a refusal that ended a turn which had already spoken`, () => {
+            const fold = new TranscriptFold(openingOf(`land it`));
+            fold.apply({ kind: `delta`, text: `on it` });
+            expect(fold.turnedAway(REFUSED)).toBe(false);
+        });
+    });
+});

package/src/text/transcript-fold.ts

@@ -1,8 +1,19 @@
-import { cancelledCards, settledCards } from "../policy/card-status.js";
+import { cancelledRequests, settledRequests } from "../policy/request-status.js";
 import type { AgentEvent } from "../events/agent-events.js";
-import { CARD_FIELDS, holdsCard, isAwaitingDecision, type TranscriptCards, type TranscriptPatch, type TranscriptRow, type TranscriptSubagent, type TranscriptTool } from "../events/transcript.js";
+import {
+    REQUEST_FIELDS,
+    holdsRequest,
+    isAwaitingDecision,
+    type TranscriptRequests,
+    type TranscriptPatch,
+    type TranscriptRow,
+    type TranscriptSubagent,
+    type TranscriptTool,
+} from "../events/transcript.js";
+import { contextTrimLine } from "../schemas/context-trim.js";
+import { turnedAwayCode } from "../policy/turned-away.js";
 import { mentionedPathTokens } from "./mentions.js";
-import { watchWakeRow } from "../events/watch-wake.js";
+import { unspokenPromptRow } from "../events/agent-words.js";
 
 // Folds a turn's frames into rows once, live and for the settled record alike, so a reopened chat matches what was on
 // screen. `tag` selects the stream read: undefined is the main turn, a tool-call id is the subagent it spawned; other
@@ -18,7 +29,8 @@ interface CardPlace {
 }
 
 // Strips undefined fields, so spreading a partial frame never overwrites a field an earlier frame already set.
-const defined = <T extends object>(value: T): Partial<T> => Object.fromEntries(Object.entries(value).filter(([, field]) => field !== undefined)) as Partial<T>;
+const defined = <T extends object>(value: T): Partial<T> =>
+    Object.fromEntries(Object.entries(value).filter(([, field]) => field !== undefined)) as Partial<T>;
 
 const cardOf = (event: Extract<AgentEvent, { kind: "tool_call" }>): TranscriptTool => ({
     id: event.id,
@@ -30,6 +42,11 @@ const cardOf = (event: Extract<AgentEvent, { kind: "tool_call" }>): TranscriptTo
     ...(event.content !== undefined ? { content: event.content } : {}),
 });
 
+// Whether a just-retired prose bubble says exactly what the plan about to be drawn says, so the request can take its
+// place instead of the same markdown appearing twice in a row.
+const restates = (row: TranscriptRow | undefined, text: string): boolean =>
+    row?.role === "assistant" && !holdsRequest(row) && row.text.trim() !== "" && row.text.trim() === text.trim();
+
 // Whether a bubble has any content: text, thinking, tools, todos, usage or a card; empty otherwise.
 const empty = (row: TranscriptRow): boolean =>
     row.text.length === 0 &&
@@ -37,7 +54,7 @@ const empty = (row: TranscriptRow): boolean =>
     (row.tools?.length ?? 0) === 0 &&
     (row.todos?.length ?? 0) === 0 &&
     row.usage === undefined &&
-    !holdsCard(row);
+    !holdsRequest(row);
 
 // Clause appended to the landed notice for a workspace dependency change, or empty when there is none. Reports the
 // install as already started, or queued when other agents are still running; never as a request.
@@ -89,6 +106,46 @@ const landedRow = (event: Extract<AgentEvent, { kind: "landed" }>): TranscriptRo
     };
 };
 
+// The clause after a refusal that ran nothing. A turn somebody typed is held in the composer for another press; a turn
+// that started itself — an automation, a loop, a watch wake — has no typed message and nobody watching, so promising a
+// resend there names a composer the reader is not looking at. Neither version promises a retry: whether one comes is
+// the scheduler's decision, not this row's to state.
+const undelivered = (unattended: boolean): string =>
+    unattended
+        ? `Nothing ran, and nothing is held: this run started on its own, so there is no message waiting to be sent again.`
+        : `Your message was not delivered: it is held for you to send again.`;
+
+// The press a memory hold offers: the raise rides along only when the hold carried a ceiling to size it by, since a
+// stall names none and raising one would not clear it.
+const memoryPress = (event: Extract<AgentEvent, { kind: "error" }>): "sendAnyway" | "sandboxMemory" =>
+    event.memory === undefined ? "sendAnyway" : "sandboxMemory";
+
+// A memory hold is asked once and never again that spell (memory-admission.ts), so the next send always runs. A turn the
+// sandbox started itself (a fix press, a peer's message, a re-run) was never in a composer: its message stays above, and
+// the press asks the sandbox to run the turn it kept rather than sending a queue that holds nothing.
+const heldRow = (event: Extract<AgentEvent, { kind: "error" }>): TranscriptRow => {
+    const unattended = event.unattended === true;
+    const memory = event.code === "sandbox-memory-low";
+    if (event.held !== undefined && !unattended) {
+        return {
+            role: "notice",
+            text: memory
+                ? `${event.message} Nothing has run yet: the message above is kept here, and sending it anyway starts it.`
+                : `${event.message} Nothing has run yet: the message above is kept here to send again once that is sorted.`,
+            noticeAction: memory ? memoryPress(event) : "sendAgain",
+            sandboxHeld: true,
+        };
+    }
+    if (!memory || unattended) {
+        return { role: "notice", text: `${event.message} ${undelivered(unattended)}` };
+    }
+    return {
+        role: "notice",
+        text: `${event.message} Your message is held: send it again to start anyway.`,
+        noticeAction: memoryPress(event),
+    };
+};
+
 // Row for a turn-ending error: the provider's own message plus one clause on what happens next. The live wait itself is
 // drawn by the chat, not stored here.
 const errorRow = (event: Extract<AgentEvent, { kind: "error" }>): TranscriptRow => {
@@ -100,22 +157,21 @@ const errorRow = (event: Extract<AgentEvent, { kind: "error" }>): TranscriptRow
                 : { role: "notice", text: `${message} Retrying by itself: attempt ${event.outage.attempt} of ${event.outage.maxAttempts}.` };
         case "claude-token-refused":
             return event.autoResume === "scheduled"
-                ? { role: "notice", text: `${message} The credential is being renewed and this turn continues automatically.`, noticeWait: "credentialRenewal" }
+                ? {
+                      role: "notice",
+                      text: `${message} The credential is being renewed and this turn continues automatically.`,
+                      noticeWait: "credentialRenewal",
+                  }
                 : { role: "notice", text: `${message} Reconnect the account to pick this conversation back up.` };
         case "rate_limit":
             return { role: "notice", text: message };
-        // Refused before the model saw it; the composer holds the message so the user can resend it.
-        case "claude-reauth":
-        case "unknown-command":
-        case "context-window-too-small":
-        case "sandbox-memory-low":
-        case "trial-unavailable":
-        case "trial-model-unavailable":
-        case "trial-exhausted":
-            return { role: "notice", text: `${message} Your message was not delivered: it is held for you to send again.` };
         default:
-            return { role: "notice", text: message };
+            break;
     }
+    if (!turnedAwayCode(code)) {
+        return { role: "notice", text: message };
+    }
+    return heldRow(event);
 };
 
 // The turn's opening user row: text, timestamp, attachments, and whatever the daemon later stamps onto it (checkpoint,
@@ -131,13 +187,17 @@ export class TranscriptFold {
     readonly rows: TranscriptRow[] = [];
     // Row index of each user steer, in order; the daemon anchors rewind state to these once the turn settles.
     readonly steerRows: number[] = [];
+    // Whether anything was steered in, whoever spoke: a retract may not take back an opening something followed.
+    private steeredIn = false;
     // Index of the open assistant bubble; always the last row, since every other row kind closes it first.
     private bubble: number | undefined;
     private readonly cards = new Map<string, CardPlace>();
     // requestId to the row holding its card, for frames landing on it later (a reply, a late sentence, a receipt).
     private readonly parked = new Map<string, number>();
-    // The turn's opening user row, where the checkpoint and daemon notes land.
-    private readonly opener: number | undefined;
+    // The turn's opening user row, where the checkpoint and daemon notes land; cleared once `retract` takes it back.
+    private opener: number | undefined;
+    // Set by `retract`: this turn was refused before it ran, and its message went back to the composer.
+    private unrun = false;
 
     constructor(
         opening: readonly TranscriptRow[],
@@ -246,6 +306,10 @@ export class TranscriptFold {
             case "preamble":
                 // Collapses the daemon's preamble notes onto the user row; an empty note list is not a disclosure.
                 return event.notes.length === 0 ? [] : this.stampOpener((row) => (row.notes = [...event.notes]));
+            case "context_trim":
+                // A row of its own rather than a stamp on the message: what was left out is not part of what was sent,
+                // and the fold beside the message only ever lists notes that actually rode.
+                return this.pushRow({ role: "notice", text: contextTrimLine(event) });
             case "worktree":
                 return event.sync === undefined ? [] : this.pushRow({ role: "notice", text: syncLine(event.sync) });
             case "landed":
@@ -254,17 +318,13 @@ export class TranscriptFold {
                 return this.pushRow({ role: "notice", text: `Context compacted to free up space.` });
             case "error":
                 // Keeps a refusal (no prose from the provider) from reading as a session that ended mid-question.
-                return this.pushRow(errorRow(event));
+                // A refusal that ran nothing takes its message back out ahead of the notice standing in for it.
+                return [...this.retract(event), ...this.pushRow(errorRow(event))];
             case "plan": {
                 // Folds a plan into an identical retired prose bubble instead of drawing the same markdown twice.
                 const adjacent = this.rows.at(-1);
-                const consumes =
-                    this.bubble === undefined &&
-                    adjacent?.role === "assistant" &&
-                    !holdsCard(adjacent) &&
-                    adjacent.text.trim() !== "" &&
-                    adjacent.text.trim() === event.text.trim();
-                if (consumes) {
+                const consumes = this.bubble === undefined && restates(adjacent, event.text);
+                if (consumes && adjacent !== undefined) {
                     adjacent.text = "";
                 }
                 return this.park(
@@ -309,7 +369,7 @@ export class TranscriptFold {
                 return this.park(event.requestId, { credentialOffer: { requestId: event.requestId, offer: event.offer, status: "pending" } });
             case "resolved":
                 // Releases the card; the answering window already froze it locally, so this is a no-op there.
-                return this.patchParked(event.requestId, (row) => Object.assign(row, settledCards(row, event.reply)));
+                return this.patchParked(event.requestId, (row) => Object.assign(row, settledRequests(row, event.reply)));
             case "capability_outcome":
                 return this.patchParked(event.requestId, (row) => {
                     if (row.capabilityOffer !== undefined) {
@@ -353,14 +413,12 @@ export class TranscriptFold {
         }
     }
 
-    /**
-     * A message pushed into a turn already running. A condition watch's wake arrives this way too, and it is the
-     * daemon's own words: it becomes a notice, and never an anchor the rewind can return a person to.
-     */
+    /** A message pushed into a running turn; only a person's own message is a rewind anchor. */
     private steered(event: Extract<AgentEvent, { kind: "steer" }>): TranscriptPatch[] {
-        const wake = watchWakeRow(event.text);
-        if (wake !== undefined) {
-            return this.pushRow(wake);
+        this.steeredIn = true;
+        const unspoken = unspokenPromptRow(event.text);
+        if (unspoken !== undefined) {
+            return this.pushRow(unspoken);
         }
         // A steer also closes the bubble, or the next answer would print over it mid-call.
         const patches = this.pushRow({
@@ -369,7 +427,10 @@ export class TranscriptFold {
             sentAt: event.sentAt,
             ...(event.attachments === undefined ? {} : { attachments: [...event.attachments] }),
         });
-        this.steerRows.push(this.rows.length - 1);
+        // Anchors pair by position with the checkpoints only a person's steer reserves.
+        if (event.voice === undefined) {
+            this.steerRows.push(this.rows.length - 1);
+        }
         return patches;
     }
 
@@ -378,6 +439,46 @@ export class TranscriptFold {
         return this.pushRow(row);
     }
 
+    /**
+     * Whether the turn ran nothing: refused before the model saw it, message handed back; never recorded (turn-runs).
+     * Re-derived rather than latched, so a stream that spoke after its refusal still keeps what it said.
+     */
+    get ranNothing(): boolean {
+        return this.unrun && !this.rows.some((row) => row.role === "assistant");
+    }
+
+    /**
+     * Whether this frame turns the whole turn away at the door: a refusal before the model saw a word, with somebody
+     * watching and nothing yet said or steered in. Asked before the frame is applied, by whoever keeps the words.
+     */
+    turnedAway(event: AgentEvent): boolean {
+        return (
+            event.kind === "error" &&
+            turnedAwayCode(event.code) &&
+            event.unattended !== true &&
+            !this.rows.some((row) => row.role === "assistant") &&
+            !this.steeredIn
+        );
+    }
+
+    // Attended refusals only: the composer holds those words for another press, so a bubble left standing repeats them
+    // once per press. Splicing is safe because nothing ran — no open bubble, no parked card, no steer above it. A turn
+    // the sandbox kept (`held`) keeps its message and is recorded: no composer anywhere holds a copy of it.
+    private retract(event: Extract<AgentEvent, { kind: "error" }>): TranscriptPatch[] {
+        if (!this.turnedAway(event) || event.held !== undefined) {
+            return [];
+        }
+        this.unrun = true;
+        const opener = this.opener;
+        // An opening the daemon wrote (a watch wake, a resume disclosure) has no bubble to take back, and is still unrun.
+        if (opener === undefined) {
+            return [];
+        }
+        this.rows.splice(opener, 1);
+        this.opener = undefined;
+        return [{ op: "drop", index: opener }];
+    }
+
     /**
      * Ends the turn: closes the open bubble, freezes every still-pending card as nobody's decision, and notes a user
      * stop.
@@ -386,7 +487,7 @@ export class TranscriptFold {
         const patches = this.closeBubble();
         for (const [index, row] of this.rows.entries()) {
             if (row.role === "assistant" && isAwaitingDecision(row)) {
-                Object.assign(row, cancelledCards(row));
+                Object.assign(row, cancelledRequests(row));
                 patches.push(this.replace(index));
             }
         }
@@ -453,7 +554,7 @@ export class TranscriptFold {
 
     // A card takes the open bubble and closes it; `into` reuses an existing row (a plan's own prose) instead of opening
     // a new one.
-    private park(requestId: string, cards: TranscriptCards, into?: number): TranscriptPatch[] {
+    private park(requestId: string, cards: TranscriptRequests, into?: number): TranscriptPatch[] {
         const [index, opened] = into === undefined ? this.open() : [into, []];
         Object.assign(this.rows[index]!, cards);
         this.bubble = undefined;
@@ -493,7 +594,12 @@ export class TranscriptFold {
 }
 
 /** Folds a whole turn at once: opening rows, every frame, and how it ended; what a settled turn reads back as. */
-export const foldTurn = (opening: readonly TranscriptRow[], events: readonly AgentEvent[], ending: TurnEnding = "settled", tag?: string): TranscriptRow[] => {
+export const foldTurn = (
+    opening: readonly TranscriptRow[],
+    events: readonly AgentEvent[],
+    ending: TurnEnding = "settled",
+    tag?: string,
+): TranscriptRow[] => {
     const fold = new TranscriptFold(opening, tag);
     for (const event of events) {
         fold.apply(event);
@@ -561,4 +667,5 @@ export const mapTool = (tools: readonly TranscriptTool[], id: string, fn: (tool:
 };
 
 // Which row fields are cards, exported for readers that count rows by them.
-export const cardFieldsOf = (row: TranscriptRow): TranscriptCards => Object.fromEntries(CARD_FIELDS.flatMap((field) => (row[field] === undefined ? [] : [[field, row[field]]])));
+export const cardFieldsOf = (row: TranscriptRow): TranscriptRequests =>
+    Object.fromEntries(REQUEST_FIELDS.flatMap((field) => (row[field] === undefined ? [] : [[field, row[field]]])));

package/src/text/whisper.test.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "vitest";
+import { test, expect } from "bun:test";
 import { cleanTranscription } from "./whisper.js";
 
 test("flattens whisper output onto one line", () => {

package/src/text/workflow-faults.test.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "vitest";
+import { test, expect } from "bun:test";
 import { type Workflow, WorkflowSchema, type WorkflowStep } from "../schemas/workflows.js";
 import { workflowFaults, workflowRunFaults } from "./workflow-faults.js";
 

package/src/time/zone.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, test } from "vitest";
+import { describe, test, expect } from "bun:test";
 import { asCivilDay, asZone, civilDayIn, cronOptions, isZone, sameClock, utcDayOf, UTC, zoneLabel } from "./zone.js";
 import type { Zone } from "./zone.js";
 
@@ -28,7 +28,7 @@ describe(`isZone`, () => {
     });
 
     test(`asZone passes real ids through and swallows the rest`, () => {
-        expect(asZone(`America/New_York`)).toBe(`America/New_York`);
+        expect<string | undefined>(asZone(`America/New_York`)).toBe(`America/New_York`);
         expect(asZone(`Mars/Olympus`)).toBeUndefined();
         expect(asZone(undefined)).toBeUndefined();
     });
@@ -39,9 +39,9 @@ describe(`civilDayIn`, () => {
     test(`an instant falls on different days depending on the zone asked`, () => {
         // 2026-09-20T23:30Z: already the 21st in Warsaw, still the 20th in UTC and New York.
         const lateEvening = Date.UTC(2026, 8, 20, 23, 30);
-        expect(civilDayIn(lateEvening, WARSAW)).toBe(`2026-09-21`);
-        expect(civilDayIn(lateEvening, UTC)).toBe(`2026-09-20`);
-        expect(civilDayIn(lateEvening, NEW_YORK)).toBe(`2026-09-20`);
+        expect<string>(civilDayIn(lateEvening, WARSAW)).toBe(`2026-09-21`);
+        expect<string>(civilDayIn(lateEvening, UTC)).toBe(`2026-09-20`);
+        expect<string>(civilDayIn(lateEvening, NEW_YORK)).toBe(`2026-09-20`);
     });
 
     test(`utcDayOf is civilDayIn UTC, spelled so every UTC bucket is greppable`, () => {
@@ -49,7 +49,7 @@ describe(`civilDayIn`, () => {
     });
 
     test(`asCivilDay takes the shape and nothing else`, () => {
-        expect(asCivilDay(`2026-09-20`)).toBe(`2026-09-20`);
+        expect<string | undefined>(asCivilDay(`2026-09-20`)).toBe(`2026-09-20`);
         expect(asCivilDay(`2026-09-20T00:00:00Z`)).toBeUndefined();
         expect(asCivilDay(`20/09/2026`)).toBeUndefined();
     });

package/dist/contracts/host.contract.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"host.contract.d.ts","sourceRoot":"","sources":["../../src/contracts/host.contract.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,eAAO,MAAM,YAAY;IAErB,QAAQ;;;;;;;;;;;;;;;;IAER,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAET,IAAI;;;IAEJ,GAAG;IAEH,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAEd,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CACf,CAAC"}

package/dist/contracts/host.contract.js

@@ -1,16 +0,0 @@
-import { oc } from "@orpc/contract";
-import { streamOf } from "../protocol/routes.js";
-import { z } from "zod";
-import { DeviceAgentFlowSchema, DeviceFlowLineSchema, DeviceSandboxFlowSchema } from "../schemas/devices.js";
-import { HostScopesSchema } from "../schemas/capabilities.js";
-import { HostFactsSchema } from "../schemas/hosts.js";
-import { OkSchema } from "../schemas/shared.js";
-export const hostContract = {
-    describe: oc.output(HostFactsSchema),
-    setScopes: oc.input(HostScopesSchema).output(OkSchema),
-    ping: oc.output(OkSchema),
-    mcp: oc.input(z.unknown()).output(z.unknown()),
-    runSandboxFlow: oc.input(DeviceSandboxFlowSchema).output(streamOf(DeviceFlowLineSchema)),
-    runAgentFlow: oc.input(DeviceAgentFlowSchema).output(streamOf(DeviceFlowLineSchema)),
-};
-//# sourceMappingURL=host.contract.js.map

package/dist/contracts/host.contract.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"host.contract.js","sourceRoot":"","sources":["../../src/contracts/host.contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAC7G,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAKhD,MAAM,CAAC,MAAM,YAAY,GAAG;IAExB,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC;IAEpC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IAEtD,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;IAEzB,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAE9C,cAAc,EAAE,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAExF,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;CACvF,CAAC"}