@intentic/sandbox-contract 1.304.0 → 1.306.0

package/src/events/resume.ts

@@ -20,6 +20,9 @@ export const RESUME_NOTES = {
     carried: `The model provider's usage allowance ran out while this turn was running, which stopped it, and it has been sent again on a different account of the same provider, in this same session: everything you knew is still here. ${REPEATED}`,
     refused:
         "The model provider refused the previous attempt at this request outright, because its usage allowance was spent: no part of the request below was read or acted on, and nothing has been done towards it. It has been sent again, and starts from the beginning. Where the sandbox has measured earlier work on this branch, it is in the note headed 'Where the work stands'.",
+    // Turned away before the model saw a word (a memory hold, a dead credential, a model the plan lacks), with the
+    // sandbox keeping the turn: nothing to continue from, so the request starts at its beginning.
+    door: "The previous attempt at this request was turned away before any of it reached you: no part of the request below was read or acted on. It has now been sent, and starts from the beginning.",
     // A turn parked on the user when the daemon died; what follows the note is their actual answer, not a repeat.
     answered:
         "The sandbox restarted while this conversation was waiting for the user to respond; it is back, and their response follows below: continue from where the session left off.",
@@ -52,6 +55,7 @@ const RESUME_DISCLOSURES: Record<ResumeReason, ResumeDisclosure> = {
     switched: { kind: "notice", text: "Sent again on the switched account after the allowance ran out mid-turn, in a fresh session." },
     carried: { kind: "notice", text: "Sent again on the switched account after the allowance ran out mid-turn, carrying the session with it." },
     refused: { kind: "notice", text: "Sent again after the allowance refused it: nothing had run." },
+    door: { kind: "notice", text: "Sent again: the first attempt was turned away before anything ran." },
     answered: { kind: "note", note: { title: "Picked back up after a sandbox restart", text: RESUME_NOTES.answered } },
 };
 

package/src/events/transcript.ts

@@ -2,14 +2,14 @@ import { z } from "zod";
 import { AgentHarnessSchema, AgentProviderSchema } from "../schemas/agent.js";
 import { ShareDetailSchema } from "../schemas/share.js";
 import { SubagentKindSchema, SubagentStatusSchema, SubagentVerificationSchema } from "../schemas/terminal.js";
-import type { ToolCallContent, ToolCallLocation, ToolCallStatus, ToolKind} from "./cards.js";
-import { browserHelpCard, capabilityOfferCard, CapabilityOutcomeSchema, credentialOfferCard, CredentialReceiptSchema, paymentOfferCard, PaymentReceiptSchema, PermissionAskSchema, permissionCard, planCard, questionCard, terminalHelpCard, TodoItemSchema, ToolCallContentSchema, ToolCallLocationSchema, ToolCallStatusSchema, ToolKindSchema } from "./cards.js";
+import type { ToolCallContent, ToolCallLocation, ToolCallStatus, ToolKind} from "./requests.js";
+import { browserHelpRequest, capabilityOfferRequest, CapabilityOutcomeSchema, credentialOfferRequest, CredentialReceiptSchema, paymentOfferRequest, PaymentReceiptSchema, PermissionAskSchema, permissionRequest, planRequest, questionRequest, terminalHelpRequest, TodoItemSchema, ToolCallContentSchema, ToolCallLocationSchema, ToolCallStatusSchema, ToolKindSchema } from "./requests.js";
 
 // A conversation as recorded and replayed: the rows, the cards they carry, and the patches that change them while a
 // turn runs. One shape for the live row and the recorded one, since they're the same row.
 
 // Transcript cards.
-// Status enums for a parked card, settled by the fold from the reply that released it (card-status.ts), riding the row
+// Status enums for a parked card, settled by the fold from the reply that released it (request-status.ts), riding the row
 // rather than the reply. `cancelled` means nobody answered, not a decision; `pending` is still parked.
 export const PlanStatusSchema = z.enum(["pending", "approved", "rejected", "cancelled"]);
 export type PlanStatus = z.infer<typeof PlanStatusSchema>;
@@ -25,10 +25,10 @@ export type OfferStatus = z.infer<typeof OfferStatusSchema>;
 export const CapabilityOfferStatusSchema = z.enum(["pending", "connecting", "skipped", "cancelled"]);
 export type CapabilityOfferStatus = z.infer<typeof CapabilityOfferStatusSchema>;
 
-export const TranscriptPlanSchema = z.object({ ...planCard, status: PlanStatusSchema.describe("Where the decision stands.") });
+export const TranscriptPlanSchema = z.object({ ...planRequest, status: PlanStatusSchema.describe("Where the decision stands.") });
 export type TranscriptPlan = z.infer<typeof TranscriptPlanSchema>;
 export const TranscriptQuestionSchema = z.object({
-    ...questionCard,
+    ...questionRequest,
     status: QuestionStatusSchema.describe("Where the answer stands."),
     answers: z
         .record(z.string(), z.array(z.string()))
@@ -37,26 +37,26 @@ export const TranscriptQuestionSchema = z.object({
 });
 export type TranscriptQuestion = z.infer<typeof TranscriptQuestionSchema>;
 // `explain`, the judge's sentence, arrives via PermissionAskSchema at raise time; nothing patches it in after.
-export const TranscriptPermissionSchema = PermissionAskSchema.extend({ ...permissionCard, status: PermissionStatusSchema.describe("Where the decision stands.") });
+export const TranscriptPermissionSchema = PermissionAskSchema.extend({ ...permissionRequest, status: PermissionStatusSchema.describe("Where the decision stands.") });
 export type TranscriptPermission = z.infer<typeof TranscriptPermissionSchema>;
-export const TranscriptBrowserHelpSchema = z.object({ ...browserHelpCard, status: HelpStatusSchema.describe("How the hand-over ended.") });
+export const TranscriptBrowserHelpSchema = z.object({ ...browserHelpRequest, status: HelpStatusSchema.describe("How the hand-over ended.") });
 export type TranscriptBrowserHelp = z.infer<typeof TranscriptBrowserHelpSchema>;
-export const TranscriptTerminalHelpSchema = z.object({ ...terminalHelpCard, status: HelpStatusSchema.describe("How the hand-over ended.") });
+export const TranscriptTerminalHelpSchema = z.object({ ...terminalHelpRequest, status: HelpStatusSchema.describe("How the hand-over ended.") });
 export type TranscriptTerminalHelp = z.infer<typeof TranscriptTerminalHelpSchema>;
 export const TranscriptCapabilityOfferSchema = z.object({
-    ...capabilityOfferCard,
+    ...capabilityOfferRequest,
     status: CapabilityOfferStatusSchema.describe("Where the decision stands."),
     outcome: CapabilityOutcomeSchema.optional().describe("How an accepted ask's setup ended (the capability_outcome frame)."),
 });
 export type TranscriptCapabilityOffer = z.infer<typeof TranscriptCapabilityOfferSchema>;
 export const TranscriptPaymentOfferSchema = z.object({
-    ...paymentOfferCard,
+    ...paymentOfferRequest,
     status: OfferStatusSchema.describe("Where the decision stands."),
     receipt: PaymentReceiptSchema.optional().describe("How the approved payment ended (the payment_receipt frame)."),
 });
 export type TranscriptPaymentOffer = z.infer<typeof TranscriptPaymentOfferSchema>;
 export const TranscriptCredentialOfferSchema = z.object({
-    ...credentialOfferCard,
+    ...credentialOfferRequest,
     status: OfferStatusSchema.describe("Where the decision stands."),
     receipt: CredentialReceiptSchema.optional().describe("Who released it, or that somebody refused (the credential_receipt frame)."),
 });
@@ -131,9 +131,8 @@ export interface TranscriptTool {
     subagent?: TranscriptSubagent | undefined;
 }
 
-// Three endings that wake a conversation off a condition watch: the first two are promised when it is armed, the third
-// is the daemon's own (a deadline that passed while it was down). Composing and parsing the wake is watch-wake.ts.
-export const WatchOutcomeSchema = z.enum(["met", "timeout", "restart-expired"]);
+// Every ending that wakes a conversation off a condition watch; composing and parsing the wake is watch-wake.ts.
+export const WatchOutcomeSchema = z.enum(["met", "timeout", "restart-expired", "broken"]);
 export type WatchOutcome = z.infer<typeof WatchOutcomeSchema>;
 
 // A condition watch waking the conversation, as the row carries it. The wake arrives as an ordinary turn prompt that
@@ -148,6 +147,25 @@ export const TranscriptWatchWakeSchema = z.object({
 });
 export type TranscriptWatchWake = z.infer<typeof TranscriptWatchWakeSchema>;
 
+// Another agent's words that reached this conversation as a prompt; the row keeps the prompt and names the sender.
+export const TranscriptAgentWordsSchema = z.object({
+    kind: z.enum(["peer", "child"]).describe("Who sent it: another conversation in the workspace, or a child agent this one started."),
+    from: z.string().describe("The sending conversation's id."),
+    title: z.string().optional().describe("The sender's title, when it had one."),
+    failed: z.boolean().optional().describe("A child's report on a turn that failed rather than finished."),
+    sent: z.string().describe("The whole prompt the model received, disclosed under the row."),
+});
+export type TranscriptAgentWords = z.infer<typeof TranscriptAgentWordsSchema>;
+
+// A command the agent left running past its own call; how it is doing now is live state on the card (AgentSummary.jobs).
+export const TranscriptBackgroundJobSchema = z.object({
+    id: z.string().describe("The daemon's handle for the job, which its live state on the conversation's card is keyed by."),
+    label: z.string().describe("What the job is, in the agent's own words when it gave any, else its command on one line."),
+    command: z.string().describe("The command as the agent wrote it, folded to one line."),
+    startedAt: z.number().describe("When it started, in milliseconds."),
+});
+export type TranscriptBackgroundJob = z.infer<typeof TranscriptBackgroundJobSchema>;
+
 // One note the daemon put before a user's message: the model reads `text`, the chat draws `title` on a row that opens
 // to it. Shared by the live frame and the restored transcript, so it reads the same either way.
 export const TurnNoteSchema = z.object({
@@ -226,14 +244,23 @@ export const TranscriptRowSchema = z.object({
         .describe(
             "A person wrote this in the agent's voice, with no turn behind it. Marked for the human re-reading the conversation months later, so their own words do not pass as the agent's. The agent itself never sees the mark.",
         ),
-    // The one-press follow-up this notice offers, by name; the chat decides what it does, and whether it stands.
+    // The follow-up this notice offers, by name; the chat decides what it does, and whether it stands. `sendAnyway` sends
+    // the held message; `sandboxMemory` offers that and a raise of the sandbox's memory; `sendAgain` sends a turn the
+    // sandbox kept after a refusal no raise would clear.
     noticeAction: z
-        .enum(["landHold", "depsInstall", "watchStop"])
+        .enum(["landHold", "depsInstall", "watchStop", "sandboxMemory", "sendAnyway", "sendAgain"])
         .optional()
         .describe("A one-press follow-up this notice offers, by name. The chat decides what it does and whether it still applies."),
+    // Where a refused turn's words wait decides what the notice's press does: the composer's queue, or the sandbox.
+    sandboxHeld: z
+        .boolean()
+        .optional()
+        .describe(
+            "The sandbox kept this refused turn whole, its message still above, so the notice's press runs that turn again instead of sending anything from the composer, which never held these words.",
+        ),
     // An unfinished wait this notice describes, by name; whether it's still running is live state, not stored here.
     noticeWait: z
-        .enum(["credentialRenewal", "personaRoute", "modelRoute", "watch"])
+        .enum(["credentialRenewal", "chatRoute", "watch"])
         .optional()
         .describe("The wait this notice describes, by name, so a reader can say whether it is still on."),
     // Which one, for a wait whose kind can have several in flight at once; without it two armed watches settle together.
@@ -250,6 +277,8 @@ export const TranscriptRowSchema = z.object({
     capabilityOffer: TranscriptCapabilityOfferSchema.optional().describe("The capability setup this row asked for, the decision, and the outcome."),
     paymentOffer: TranscriptPaymentOfferSchema.optional().describe("The payment this row asked for, the decision, and the receipt."),
     watchWake: TranscriptWatchWakeSchema.optional().describe("The condition watch that woke this conversation, and the prompt it was woken with."),
+    agentWords: TranscriptAgentWordsSchema.optional().describe("Another agent's words that reached this conversation, whose they are, and the prompt they came as."),
+    backgroundJob: TranscriptBackgroundJobSchema.optional().describe("The background job this row marks the start of."),
     credentialOffer: TranscriptCredentialOfferSchema.optional().describe(
         "The gated credential this row asked to use, who may release it, and who did.",
     ),
@@ -257,7 +286,7 @@ export const TranscriptRowSchema = z.object({
 export type TranscriptRow = z.infer<typeof TranscriptRowSchema>;
 
 // Every card field, as one list, for readers asking whether a row holds a card at all.
-export const CARD_FIELDS = [
+export const REQUEST_FIELDS = [
     "plan",
     "question",
     "permission",
@@ -267,12 +296,12 @@ export const CARD_FIELDS = [
     "paymentOffer",
     "credentialOffer",
 ] as const;
-export type CardField = (typeof CARD_FIELDS)[number];
-export type TranscriptCards = Pick<TranscriptRow, CardField>;
+export type RequestField = (typeof REQUEST_FIELDS)[number];
+export type TranscriptRequests = Pick<TranscriptRow, RequestField>;
 // Whether a row holds a card at all, answered or not.
-export const holdsCard = (row: TranscriptCards): boolean => CARD_FIELDS.some((field) => row[field] !== undefined);
+export const holdsRequest = (row: TranscriptRequests): boolean => REQUEST_FIELDS.some((field) => row[field] !== undefined);
 // Whether a row is holding the turn open on a card nobody has answered.
-export const isAwaitingDecision = (row: TranscriptCards): boolean => CARD_FIELDS.some((field) => row[field]?.status === "pending");
+export const isAwaitingDecision = (row: TranscriptRequests): boolean => REQUEST_FIELDS.some((field) => row[field]?.status === "pending");
 
 // One change to a run's rows, so a client keeps rows rather than frames. Prose/thinking append to a row; a `tool` card
 // replaces whole by id; everything else replaces its row; `drop` removes a row that opened and never wrote.

package/src/events/watch-wake.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from "vitest";
+import { describe, it, expect } from "bun:test";
 import type { WatchOutcome } from "./transcript.js";
 import { watchWakeOf, watchWakePrompt, watchWakeRow, type WatchWakeFields } from "./watch-wake.js";
 
@@ -13,7 +13,7 @@ const fields = (over: Partial<WatchWakeFields> = {}): WatchWakeFields => ({
     ...over,
 });
 
-const OUTCOMES: readonly WatchOutcome[] = ["met", "timeout", "restart-expired"];
+const OUTCOMES: WatchOutcome[] = ["met", "timeout", "restart-expired", "broken"];
 
 describe("watch wake", () => {
     // The composer and the parser are the same piece of knowledge; this is what holds them together when either is
@@ -52,6 +52,7 @@ describe("watch wake", () => {
         const textOf = (outcome: WatchOutcome): string => watchWakeRow(watchWakePrompt(fields({ outcome })))?.text ?? "";
         expect(textOf("timeout")).toBe("CI run 316 on intentic/intentic — the watch gave up after 43m.");
         expect(textOf("restart-expired")).toBe("CI run 316 on intentic/intentic — the watch stopped when the sandbox restarted, after 43m.");
+        expect(textOf("broken")).toBe("CI run 316 on intentic/intentic — the watch stopped after 43m: its check can no longer run.");
     });
 
     it("ignores a prompt that is not a wake, so any reader can ask without checking first", () => {

package/src/events/watch-wake.ts

@@ -11,6 +11,7 @@ const OPENINGS: Record<WatchOutcome, string> = {
     timeout: "Watch timed out: the deadline passed and the check never exited 0. Decide whether to re-arm it, investigate the check, or report back.",
     "restart-expired":
         "Watch stopped: its deadline passed while the daemon was restarting, so it went unchecked for part of that window. It has just been re-checked once and the condition still does not hold. Decide whether to re-arm it, investigate the check, or report back.",
+    broken: "Watch stopped: its check can no longer run at all, so it was disarmed rather than left waiting on a condition it could never see. The reason is in the output below. Decide whether to re-arm it with a check that can run, or report back.",
 };
 
 // Labels the prompt writes and the parser reads back. `Watching` and `Elapsed` are load-bearing on both sides; the rest
@@ -51,6 +52,9 @@ const headline = (outcome: WatchOutcome, note: string, elapsed: string): string
     if (outcome === "timeout") {
         return `${note} — the watch gave up after ${elapsed}.`;
     }
+    if (outcome === "broken") {
+        return `${note} — the watch stopped after ${elapsed}: its check can no longer run.`;
+    }
     return `${note} — the watch stopped when the sandbox restarted, after ${elapsed}.`;
 };
 

package/src/ids/conversation-ids.test.ts

@@ -1,4 +1,4 @@
-import { afterEach, expect, test, vi } from "vitest";
+import { test, expect, afterEach, spyOn, jest } from "bun:test";
 import {
     CI_FIX_PREFIX,
     ciFixConversationId,
@@ -15,7 +15,7 @@ import { ConversationIdSchema } from "../schemas/agent.js";
 
 const mockRandomValues = (values: readonly number[]) => {
     const remaining = [...values];
-    const getRandomValues = vi.spyOn(crypto, "getRandomValues").mockImplementation(<T extends ArrayBufferView | null>(array: T): T => {
+    const getRandomValues = spyOn(crypto, "getRandomValues").mockImplementation(<T extends ArrayBufferView | null>(array: T): T => {
         if (!(array instanceof Uint32Array)) {
             throw new TypeError(`Expected a Uint32Array`);
         }
@@ -29,7 +29,7 @@ const mockRandomValues = (values: readonly number[]) => {
     return { getRandomValues, remaining };
 };
 
-afterEach(() => vi.restoreAllMocks());
+afterEach(() => jest.restoreAllMocks());
 
 test("every generated id passes the conversation-id guard", () => {
     for (let index = 0; index < 2_000; index += 1) {

package/src/ids/hostnames.test.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "vitest";
+import { test, expect } from "bun:test";
 import {
     labelHostname,
     panelFromHost,

package/src/ids/share-paths.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from "vitest";
+import { describe, it, expect } from "bun:test";
 import { SHARE_ID, shareId, shareStem } from "./share-paths.js";
 
 /* The id a shared conversation is filed under is two things at once: the readable half of a link somebody pastes. */

package/src/ids/tunnel-ids.test.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "vitest";
+import { test, expect } from "bun:test";
 import { hostSshIdFromToken, PORT_SLOT_COUNT, portSlotsFromToken, sandboxIdFromToken } from "./tunnel-ids.js";
 
 const TOKEN = "connect-token-one";

package/src/index.ts

@@ -71,7 +71,7 @@ export { diffContract } from "./contracts/diff.contract.js";
 export { gitContract } from "./contracts/git.contract.js";
 export { historyContract } from "./contracts/history.contract.js";
 // Not part of `sandboxContract` below: spoken over a device's WebSocket, with the machine implementing it.
-export { hostContract } from "./contracts/host.contract.js";
+export { deviceContract } from "./contracts/device.contract.js";
 // Same inversion, spoken over a browser extension's socket, with the extension implementing it.
 export { webextContract } from "./contracts/webext.contract.js";
 // Same inversion again: spoken over a runner's WebSocket, with the runner implementing it.
@@ -103,13 +103,15 @@ export { vpnContract } from "./contracts/vpn.contract.js";
 export { workflowsContract } from "./contracts/workflows.contract.js";
 export { workspaceContract } from "./contracts/workspace.contract.js";
 export * from "./events/agent-events.js";
-export * from "./events/cards.js";
+export * from "./events/agent-words.js";
+export * from "./events/requests.js";
 export * from "./events/resume.js";
 export * from "./events/system-events.js";
 export * from "./events/transcript.js";
 export * from "./events/verify-nudge.js";
 export * from "./events/watch-wake.js";
-export * from "./policy/card-status.js";
+export * from "./policy/request-status.js";
+export * from "./policy/turned-away.js";
 export * from "./text/mentions.js";
 export * from "./protocol/sse.js";
 export * from "./protocol/routes.js";
@@ -163,9 +165,11 @@ export * from "./schemas/agents.js";
 export * from "./schemas/approvals.js";
 export * from "./schemas/automations.js";
 export * from "./schemas/capabilities.js";
+export * from "./schemas/chat-route.js";
 export * from "./schemas/ci.js";
 export * from "./schemas/providers/claude-gate.js";
 export * from "./schemas/codebase-health.js";
+export * from "./schemas/context-trim.js";
 export * from "./schemas/devices.js";
 export * from "./schemas/engines.js";
 export * from "./schemas/environment.js";
@@ -184,7 +188,7 @@ export * from "./schemas/logs.js";
 export * from "./schemas/loops.js";
 export * from "./schemas/maintenance.js";
 export * from "./schemas/marketplace.js";
-export * from "./schemas/model-route.js";
+export * from "./schemas/metrics.js";
 export * from "./schemas/panels.js";
 export * from "./schemas/personas.js";
 export * from "./schemas/providers/plan-limits.js";
@@ -200,6 +204,7 @@ export * from "./schemas/sessions.js";
 export * from "./schemas/settings.js";
 export * from "./schemas/share.js";
 export * from "./schemas/shared.js";
+export * from "./schemas/system-prompt.js";
 export * from "./schemas/system.js";
 export * from "./schemas/terminal.js";
 export * from "./schemas/turn-break.js";

package/src/models/agent-catalog.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it, test } from "vitest";
+import { describe, it, test, expect } from "bun:test";
 import {
     accessFor,
     capabilitiesOf,

package/src/models/capability-ledger.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from "vitest";
+import { describe, it, expect } from "bun:test";
 import { capabilitiesOf, limitationsOf } from "./agent-catalog.js";
 import type { AgentCapabilities } from "./agent-runtimes.js";
 

package/src/models/model-offer.test.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "vitest";
+import { test, expect } from "bun:test";
 import { type ModelOffer, offerLines, parseModelPick, renewsInWords } from "./model-offer.js";
 
 /* THE OFFER the Auto judge chooses from, and the reading of what it replies. Pure both ways: no catalog, no account. */
@@ -15,7 +15,14 @@ const OFFER: ModelOffer = {
     ],
     accounts: {
         claude: [
-            { id: "work", label: "work@studio", windows: [{ short: "5h", left: 38, resetsAt: IN_TWO_HOURS }, { short: "wk", left: 61 }] },
+            {
+                id: "work",
+                label: "work@studio",
+                windows: [
+                    { short: "5h", left: 38, resetsAt: IN_TWO_HOURS },
+                    { short: "wk", left: 61 },
+                ],
+            },
             { id: "personal", windows: [] },
         ],
         codex: [],

package/src/models/model-offer.ts

@@ -1,6 +1,6 @@
 import { modelPinKey } from "./model-pins.js";
 import type { AgentProvider } from "../schemas/agent.js";
-import type { ModelPick } from "../schemas/model-route.js";
+import type { ModelPick } from "../schemas/chat-route.js";
 
 // What the Auto judge is allowed to choose from, and how its reply is read back. Pure: the daemon gathers the facts
 // (catalogs, connected accounts, headroom readings) and this turns them into the lines the model sees and the
@@ -100,19 +100,22 @@ export const offerLines = (offer: ModelOffer, now: number): readonly string[] =>
 // Wrapper words a model reaches for anyway: a fence, a bullet, quotes, a trailing period.
 const FENCE_LINE = /^```/u;
 const BULLET_LINE = /^[-*•]\s+/u;
-const FIELD = /^(model|effort|account)\s*:\s*(.+)$/iu;
+const FIELD = /^([a-z][\w-]*)\s*:\s*(.+)$/iu;
 
 const bare = (value: string): string => value.trim().replace(/^[`'"]+/u, ``).replace(/[.`'"]+$/u, ``).trim();
 
-// The reply's `key: value` lines, lowercased keys, bullets and fences stripped. First wins: a model that answers twice
-// meant its first answer, and a later line is commentary on it.
-const fieldsOf = (reply: string): ReadonlyMap<string, string> => {
+// The reply's `key: value` lines for the keys asked about, lowercased, bullets and fences stripped. First wins: a model
+// that answers twice meant its first answer, and a later line is commentary on it. Keys are passed in rather than
+// fixed here, since one reply can carry the answers to several questions (chat-route.ts asks two at once), and an
+// empty map is the honest way to tell a keyed reply from a bare one-word one.
+export const replyFields = (reply: string, keys: readonly string[]): ReadonlyMap<string, string> => {
+    const wanted = new Set(keys.map((key) => key.toLowerCase()));
     const fields = new Map<string, string>();
     for (const line of reply.split(`\n`)) {
         const trimmed = line.trim().replace(BULLET_LINE, ``);
         const found = FENCE_LINE.test(trimmed) ? null : FIELD.exec(trimmed);
         const key = found?.[1]?.toLowerCase();
-        if (key !== undefined && found?.[2] !== undefined && !fields.has(key)) {
+        if (key !== undefined && wanted.has(key) && found?.[2] !== undefined && !fields.has(key)) {
             fields.set(key, bare(found[2]));
         }
     }
@@ -130,7 +133,7 @@ export interface ParsedPick {
 // provider has. An unrecognised effort or account is dropped instead, keeping the model it came with — those are
 // refinements, and the turn's own defaults answer for them correctly.
 export const parseModelPick = (reply: string, offer: ModelOffer): ParsedPick => {
-    const fields = fieldsOf(reply);
+    const fields = replyFields(reply, [`model`, `effort`, `account`]);
     const token = fields.get(`model`) ?? ``;
     const chosen = offer.models.find((model) => modelPinKey(model).toLowerCase() === token.toLowerCase());
     if (chosen === undefined) {

package/src/models/model-order.test.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "vitest";
+import { test, expect } from "bun:test";
 import { compareModelIds, compareUnrankedModelIds, familyOf, namesThinking, releaseOf, tierRankOf } from "./model-order.js";
 
 // The order every provider's catalog is served and browsed in; only Anthropic's catalog arrives ranked, the rest hand

package/src/models/model-pins.test.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "vitest";
+import { test, expect } from "bun:test";
 import { type ModelSource, modelPinKey, parsePinned, readyChain } from "./model-pins.js";
 import type { ModelPin } from "../schemas/agent.js";
 

package/src/models/model-roles.test.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "vitest";
+import { test, expect } from "bun:test";
 import { MODEL_ROLE_BLOCKS, MODEL_ROLES, type ModelRoleSpec } from "./model-roles.js";
 
 // The catalog draws the settings page directly, so its properties (every role in one block) must hold of the table

package/src/models/model-roles.ts

@@ -58,19 +58,13 @@ export const MODEL_ROLES = [
         icon: "check-square",
     },
     {
-        // Picks one persona id or none from a fixed list; a classification, not free text.
-        id: "persona-router",
-        label: "Persona routing",
-        blurb: "Which model reads a new chat's first message and picks the persona for it.",
-        kind: "helper",
-        icon: "users",
-    },
-    {
-        // Picks one offered `provider:model` line, an effort and an account from a fixed list; a classification, not
-        // free text. Prompt carries live account headroom, so it must not be a model whose own allowance it is reading.
+        // One reading answering both halves of "what does this chat open on": an offered `provider:model` line with an
+        // effort and an account, and a persona id, each a classification over a fixed list rather than free text. The
+        // id predates the persona half and stays as it is, since it is what a settings file already carries.
+        // Prompt carries live account headroom, so it must not be a model whose own allowance it is reading.
         id: "model-router",
-        label: "Auto model choice",
-        blurb: "Which model reads a new chat's first message and picks the model, effort and account it runs on.",
+        label: "New chat routing",
+        blurb: "Which model reads a new chat's first message and picks what it opens on: the model, effort and account, and the persona.",
         kind: "helper",
         icon: "sparkles",
     },

package/src/models/plan-pools.test.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "vitest";
+import { test, expect } from "bun:test";
 import { bindingWindow, gatesModel, gatingWindows, scopedWindow, windowLive, windowPeriod } from "./plan-pools.js";
 import type { AccountUsage, UsageWindow } from "../schemas/providers/plan-limits.js";
 

package/src/models/provider-specs.test.ts

@@ -1,5 +1,5 @@
 import { PROVIDER_BRAND_PATHS } from "@intentic/constants";
-import { describe, expect, test } from "vitest";
+import { describe, test, expect } from "bun:test";
 import { accessFor, capabilitiesOf, harnessChoosable, PROVIDER_ACCESS, PROVIDER_VENDOR, PROVIDERS, providerLabel } from "./agent-catalog.js";
 import {
     ACCESS_COST,
@@ -40,12 +40,12 @@ describe("every provider in the table", () => {
         if (spec.auth.kind === "translator") {
             // The CLIProxyAPI's own name for this provider, addressed by the daemon's management API.
             expect(cliProxyIdOf(id), `${id} is routed but names no CLIProxyAPI provider`).toBe(spec.auth.cliProxy);
-            expect(KeyedProviderSchema.options, `${id} is routed but missing from KeyedProvider`).toContain(id);
+            expect<readonly string[]>(KeyedProviderSchema.options, `${id} is routed but missing from KeyedProvider`).toContain(id);
             expect(Object.keys(TranslatorAccountsSchema.shape), `${id} has no slot in TranslatorAccounts`).toContain(id);
             return;
         }
         if (spec.auth.kind === "minted") {
-            expect(MINTED_PROVIDERS, `${id} is minted but missing from MINTED_PROVIDERS`).toContain(id);
+            expect<readonly string[]>(MINTED_PROVIDERS, `${id} is minted but missing from MINTED_PROVIDERS`).toContain(id);
             // The head of this list is what a login/start naming no variant gets; empty means a dead connect button.
             expect(spec.auth.variants.length, `${id} is minted but offers no estate to sign in to`).toBeGreaterThan(0);
             for (const variant of spec.auth.variants) {

package/src/policy/batch-runs.test.ts

@@ -1,5 +1,5 @@
 import { STATE_DIR } from "@intentic/constants";
-import { describe, expect, it } from "vitest";
+import { describe, it, expect } from "bun:test";
 
 // Stands in for any role: what's tested is that the role reaches the turn, not which one it is.
 const ROLE = `maintenance-chore` as const;

package/src/policy/command-classes.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, test } from "vitest";
+import { describe, test, expect } from "bun:test";
 import { classifyCommand, type CommandContext, type CommandSpan, matchCommand } from "./command-classes.js";
 
 // Every call states a locus (now required); these default to `device`, the wider reading, so an assertion made here
@@ -475,7 +475,7 @@ describe("live", () => {
 
     test("a command substitution inside an echo is not text", () => {
         expect(live(`echo "$(rm -rf /)"`, "files.destructive")).toBe(true);
-        expect(live("echo \"`rm -rf /`\"", "files.destructive")).toBe(true);
+        expect(live('echo "`rm -rf /`"', "files.destructive")).toBe(true);
         expect(live(`echo '$(rm -rf /)'`, "files.destructive")).toBe(false);
     });
 
@@ -485,3 +485,38 @@ describe("live", () => {
         }
     });
 });
+
+// The one class whose answer depends on WHOSE checkout would move. A conversation working in a copy of its own may
+// stand wherever it likes — the drift that causes is reported at turn-settled, not refused here — but a turn sharing
+// the owner's tree would move the owner's checkout under them, which is not its call to make.
+describe("git.branch-switch", () => {
+    const shared = (command: string): string[] => classify(command);
+    const own = (command: string): string[] => classify(command, { ownCheckout: true });
+
+    test("catches both spellings of moving a shared checkout", () => {
+        for (const command of ["git checkout main", "git checkout -b ci/extension-admission", "git switch main", "git switch -c feature"]) {
+            expect(shared(command), command).toContain("git.branch-switch");
+        }
+    });
+
+    test("the conversation's own copy is its own to move", () => {
+        for (const command of ["git checkout main", "git switch -c feature"]) {
+            expect(own(command), command).not.toContain("git.branch-switch");
+        }
+    });
+
+    // Absent, not false: a caller that has not been taught the difference must get the guard rather than a hole.
+    test("a caller that cannot say whose checkout it is gets the guard", () => {
+        expect(classify("git checkout main", {})).toContain("git.branch-switch");
+    });
+
+    test("checkout restoring files moves nothing, and is not this", () => {
+        for (const command of ["git checkout -- src/app.ts", "git checkout .", "git checkout HEAD -- package.json"]) {
+            expect(shared(command), command).not.toContain("git.branch-switch");
+        }
+    });
+
+    test("the card points at the verb, not the whole line", () => {
+        expect(marked("cd repo && git switch main && pnpm build", "git.branch-switch")).toEqual(["git switch"]);
+    });
+});

package/src/policy/command-classes.ts

@@ -28,6 +28,10 @@ export interface CommandContext {
     readonly locus: CommandLocus;
     // true/false/undefined for holding a credential; only false drops a class, undefined still counts as a hit.
     readonly holdsSecret?: (path: string) => boolean | undefined;
+    // Whether this cwd is the conversation's OWN copy, which only an isolated turn has. Absent means the tree is shared
+    // with its owner, the fail-safe reading: a caller that has not been taught the difference gets the guard, not a
+    // hole. Read only by git.branch-switch, whose whole question is whose checkout would move.
+    readonly ownCheckout?: boolean;
 }
 
 // The `g` twin of a table's patterns, built once: the tables stay flag-free since a surviving lastIndex is how a shared
@@ -63,6 +67,10 @@ const GIT_DESTRUCTIVE = [
     /\bgit\s+filter-branch\b/,
 ];
 
+// `switch` exists only to move HEAD, so every form of it counts. `checkout` is two commands wearing one name: with
+// `-- <path>` or a bare `.` it restores files and moves nothing, and those are the common ones, so they are cut out.
+const GIT_BRANCH_SWITCH = [/\bgit\s+switch\b/, /\bgit\s+checkout\b(?![^|;&]*\s--\s)(?![^|;&]*\s\.(?:\s|$))/];
+
 // The credential is IN the command, not in a file; there is nothing for a filesystem to fact-check here.
 const SECRET_REFERENCES = [/\{\{secret:[A-Za-z0-9_./-]+\}\}/];
 
@@ -251,6 +259,7 @@ const rootDeletes = (program: string, locus: CommandLocus): CommandSpan[] => [
 
 // The g twins, built once at load: a card is minted per command held, classify runs per command typed.
 const GIT_DESTRUCTIVE_G = globally(GIT_DESTRUCTIVE);
+const GIT_BRANCH_SWITCH_G = globally(GIT_BRANCH_SWITCH);
 const SECRET_REFERENCES_G = globally(SECRET_REFERENCES);
 const CREDENTIAL_PATHS_G = globally(CREDENTIAL_PATHS);
 const PACKAGE_PUBLISH_G = globally(PACKAGE_PUBLISH);
@@ -298,6 +307,8 @@ const credentialReads = (command: string, context: CommandContext): CommandSpan[
 // One function per class; empty means the command is not in it, so membership and evidence are the same walk.
 const MATCHES: Readonly<Record<CommandClass, (command: string, context: CommandContext) => CommandSpan[]>> = {
     "git.destructive": (command) => spansOf(GIT_DESTRUCTIVE_G, command),
+    // The only class that can answer "not here": in its own copy a conversation's checkout is its own to move.
+    "git.branch-switch": (command, context) => (context.ownCheckout === true ? [] : spansOf(GIT_BRANCH_SWITCH_G, command)),
     "files.destructive": (command) => [...recursiveForceRms(command), ...recursiveDeletes(command)],
     "system.destructive": (command, context) => [...spansOf(BLOCK_DEVICE_G, command), ...rootDeletes(command, context.locus)],
     "container.state": (command) => spansOf(CONTAINER_STATE_G, command),
@@ -323,6 +334,7 @@ export const classifyCommand = (command: string, context: CommandContext): Comma
 // What the card says the command would do. The class name is a settings key, not a sentence to show a person.
 export const COMMAND_CLASS_LABELS: Readonly<Record<CommandClass, string>> = {
     "git.destructive": "rewrite or discard git history",
+    "git.branch-switch": "move a checkout you share with this conversation onto another branch",
     "files.destructive": "delete files recursively",
     "system.destructive": "wipe a disk, or delete a whole root directory",
     "container.state": "delete a container volume or the data in it",
@@ -350,6 +362,10 @@ export const COMMAND_CLASS_PATTERNS: Readonly<Record<CommandClass, readonly Comm
         { code: "git branch -D" },
         { code: "git filter-branch" },
     ],
+    "git.branch-switch": [
+        { code: "git switch <branch>" },
+        { code: "git checkout <branch>", qualifier: "not `git checkout -- <path>` or `git checkout .`, which restore files and move nothing" },
+    ],
     "files.destructive": [
         { code: "rm -rf <path>" },
         { code: "fs.rm(<path>, { recursive: true })", qualifier: "also rmSync, rmdir, rmdirSync" },