@intentic/sandbox-contract 1.309.0 → 1.311.0

package/src/ids/share-paths.test.ts

@@ -1,4 +1,3 @@
-import { describe, it, expect } from "bun:test";
 import { SHARE_ID, shareId, shareStem } from "./share-paths.js";
 
 /* The id a shared conversation is filed under is two things at once: the readable half of a link somebody pastes. */

package/src/ids/tunnel-ids.test.ts

@@ -1,4 +1,3 @@
-import { test, expect } from "bun:test";
 import { hostSshIdFromToken, PORT_SLOT_COUNT, portSlotsFromToken, sandboxIdFromToken } from "./tunnel-ids.js";
 
 const TOKEN = "connect-token-one";

package/src/index.ts

@@ -28,7 +28,6 @@ import { loopsContract } from "./contracts/loops.contract.js";
 import { panelsContract } from "./contracts/panels.contract.js";
 import { portsContract } from "./contracts/ports.contract.js";
 import { publicContract } from "./contracts/public.contract.js";
-import { prepushContract } from "./contracts/prepush.contract.js";
 import { netdiskContract } from "./contracts/netdisk.contract.js";
 import { providersContract } from "./contracts/providers.contract.js";
 import { pushContract } from "./contracts/push.contract.js";
@@ -89,7 +88,6 @@ export { loopsContract } from "./contracts/loops.contract.js";
 export { panelsContract } from "./contracts/panels.contract.js";
 export { portsContract } from "./contracts/ports.contract.js";
 export { publicContract } from "./contracts/public.contract.js";
-export { prepushContract } from "./contracts/prepush.contract.js";
 export { providersContract, type RunnableProviders, RunnableProvidersSchema } from "./contracts/providers.contract.js";
 export { pushContract } from "./contracts/push.contract.js";
 export { safetyContract } from "./contracts/safety.contract.js";
@@ -218,6 +216,7 @@ export * from "./schemas/system-prompt.js";
 export * from "./schemas/system.js";
 export * from "./schemas/terminal.js";
 export * from "./schemas/turn-break.js";
+export * from "./schemas/keep-warm.js";
 export * from "./schemas/providers/usage.js";
 export * from "./schemas/vpn.js";
 export * from "./schemas/webext.js";
@@ -272,7 +271,6 @@ export const sandboxContract = {
     panels: panelsContract,
     ports: portsContract,
     public: publicContract,
-    prepush: prepushContract,
     providers: providersContract,
     push: pushContract,
     secrets: secretsContract,

package/src/models/agent-catalog.test.ts

@@ -1,4 +1,3 @@
-import { describe, it, test, expect } from "bun:test";
 import {
     accessFor,
     capabilitiesOf,

package/src/models/capability-ledger.test.ts

@@ -1,4 +1,3 @@
-import { describe, it, expect } from "bun:test";
 import { capabilitiesOf, limitationsOf } from "./agent-catalog.js";
 import type { AgentCapabilities } from "./agent-runtimes.js";
 

package/src/models/model-label.test.ts

@@ -1,4 +1,3 @@
-import { expect, test } from "bun:test";
 import { humanizeModelId } from "./model-label.js";
 
 // One humanizer for every id no catalog names, on both sides of the wire.

package/src/models/model-offer.test.ts

@@ -1,4 +1,3 @@
-import { test, expect } from "bun:test";
 import { type ModelOffer, offerLines, parseModelPick, renewsInWords } from "./model-offer.js";
 
 /* THE OFFER the Auto judge chooses from, and the reading of what it replies. Pure both ways: no catalog, no account. */

package/src/models/model-order.test.ts

@@ -1,4 +1,3 @@
-import { test, expect } from "bun:test";
 import { compareModelIds, compareUnrankedModelIds, familyOf, namesThinking, releaseOf, tierRankOf } from "./model-order.js";
 
 // The order every provider's catalog is served and browsed in; only Anthropic's catalog arrives ranked, the rest hand

package/src/models/model-pins.test.ts

@@ -1,4 +1,3 @@
-import { test, expect } from "bun:test";
 import { type ModelSource, modelPinKey, parsePinned, readyChain } from "./model-pins.js";
 import type { ModelPin } from "../schemas/agent.js";
 

package/src/models/model-roles.test.ts

@@ -1,4 +1,3 @@
-import { test, expect } from "bun:test";
 import { MODEL_ROLE_BLOCKS, MODEL_ROLES, type ModelRoleSpec } from "./model-roles.js";
 
 // The catalog draws the settings page directly, so its properties (every role in one block) must hold of the table

package/src/models/plan-pools.test.ts

@@ -1,4 +1,3 @@
-import { test, expect } from "bun:test";
 import { bindingWindow, gatesModel, gatingWindows, scopedWindow, windowLive, windowPeriod } from "./plan-pools.js";
 import type { AccountUsage, UsageWindow } from "../schemas/providers/plan-limits.js";
 

package/src/models/provider-specs.test.ts

@@ -1,5 +1,4 @@
 import { PROVIDER_BRAND_PATHS } from "@intentic/constants";
-import { describe, test, expect } from "bun:test";
 import { accessFor, capabilitiesOf, harnessChoosable, PROVIDER_ACCESS, PROVIDER_VENDOR, PROVIDERS, providerLabel } from "./agent-catalog.js";
 import {
     ACCESS_COST,

package/src/policy/batch-runs.test.ts

@@ -1,5 +1,4 @@
 import { STATE_DIR } from "@intentic/constants";
-import { describe, it, expect } from "bun:test";
 
 // Stands in for any role: what's tested is that the role reaches the turn, not which one it is.
 const ROLE = `maintenance-chore` as const;

package/src/policy/command-classes.test.ts

@@ -1,4 +1,3 @@
-import { describe, test, expect } from "bun:test";
 import { classifyCommand, type CommandContext, type CommandSpan, matchCommand } from "./command-classes.js";
 
 // Every call states a locus (now required); these default to `device`, the wider reading, so an assertion made here

package/src/policy/command-run.test.ts

@@ -0,0 +1,35 @@
+import type { CommandRun } from "../schemas/ci.js";
+import { followCommandRun } from "./command-run.js";
+
+const RUNNING: CommandRun = { status: "running", command: "pnpm test", output: "" };
+const PASSED: CommandRun = { status: "passed", command: "pnpm test", output: "ok" };
+
+test("a poll that fails is reported and retried, and the run is still followed to its verdict", async () => {
+    const answers: Array<CommandRun | Error> = [new Error("daemon restarting"), RUNNING, PASSED];
+    const errors: unknown[] = [];
+    const settled = await followCommandRun(
+        async () => {
+            const next = answers.shift();
+            if (next instanceof Error) {
+                throw next;
+            }
+            return next as CommandRun;
+        },
+        { intervalMs: 1, onError: (cause) => errors.push(cause) },
+    );
+    expect(settled).toEqual(PASSED);
+    expect(errors).toEqual([new Error("daemon restarting")]);
+});
+
+test("a throw from onState is the caller's bug and reaches the caller, not a poll failure retried forever", async () => {
+    const errors: unknown[] = [];
+    const following = followCommandRun(async () => RUNNING, {
+        intervalMs: 1,
+        onState: () => {
+            throw new TypeError("state.session is undefined");
+        },
+        onError: (cause) => errors.push(cause),
+    });
+    await expect(following).rejects.toThrow("state.session is undefined");
+    expect(errors).toEqual([]);
+});

package/src/policy/command-run.ts

@@ -10,8 +10,9 @@ export interface FollowRunOptions<R extends CommandRun> {
     readonly signal?: AbortSignal | undefined;
     // Every state read, settled or not, for a surface that draws progress.
     readonly onState?: ((run: R) => void) | undefined;
-    // A poll that failed, not a run that failed: the run is still going, and following continues.
-    readonly onError?: ((cause: unknown) => void) | undefined;
+    // A poll that failed, not a run that failed: the run is still going, and following continues. Required, since a
+    // loop that retries a failing read forever with nobody told looks exactly like a run that is still going.
+    readonly onError: (cause: unknown) => void;
 }
 
 // Follows a run to its verdict: reads state until it is no longer running. The one shared loop, so a dropped poll isn't
@@ -22,14 +23,18 @@ export const followCommandRun = async <R extends CommandRun>(read: () => Promise
         if (signal?.aborted === true) {
             return undefined;
         }
+        // Only the read is a poll that may fail and be retried; a throw from `onState` is the caller's own bug.
+        let run: R | undefined;
         try {
-            const run = await read();
+            run = await read();
+        } catch (cause) {
+            onError(cause);
+        }
+        if (run !== undefined) {
             onState?.(run);
             if (run.status !== "running") {
                 return run;
             }
-        } catch (cause) {
-            onError?.(cause);
         }
         await sleep(intervalMs, { signal });
     }

package/src/policy/credential-material.test.ts

@@ -1,4 +1,3 @@
-import { describe, test, expect } from "bun:test";
 import { holdsCredentialMaterial, maskCredentialMaterial } from "./credential-material.js";
 
 // The two directions aren't symmetric: a miss just raises an extra card, a wrong clear un-gates a real credential read.

package/src/policy/fence-paths.test.ts

@@ -1,4 +1,3 @@
-import { describe, test, expect } from "bun:test";
 import { fenceAllows, fenceCovers, fenceIntersection, fenceReaches, foldPath, pathInsideFolder } from "./fence-paths.js";
 
 describe("foldPath", () => {

package/src/policy/overlay-lint.test.ts

@@ -1,4 +1,3 @@
-import { test, expect } from "bun:test";
 import { hasOfficialBase, invalidExtensionFragment, isOfficialSandboxImage, lintOverlay, overlayBase, rewriteOverlayBase } from "./overlay-lint.js";
 
 test("accepts a RUN/ENV-only fragment, comments and blank lines included", () => {

package/src/policy/owner-ticket.test.ts

@@ -1,5 +1,4 @@
 import { generateKeyPairSync } from "node:crypto";
-import { describe, it, expect } from "bun:test";
 import { mintReachabilityGrant, verifyReachabilityGrant } from "../protocol/ingress-contract.js";
 import { isOwnerTicket, mintOwnerTicket, OWNER_TICKET_TTL_MS, publicKeyPemOf, verifyOwnerTicket } from "./owner-ticket.js";
 

package/src/policy/persona-home.test.ts

@@ -1,4 +1,3 @@
-import { describe, test, expect } from "bun:test";
 import { fenceHoldsPersona, personaHome } from "./persona-home.js";
 
 // Where a card lives, and therefore who may wear it. This is the whole of the rule the Access tab draws and the

package/src/policy/reserved-servers.test.ts

@@ -1,4 +1,3 @@
-import { describe, test, expect } from "bun:test";
 import {
     collidesWithReservedServer,
     CONTROL_MCP_SERVERS,

package/src/policy/safety-policy.test.ts

@@ -1,4 +1,3 @@
-import { describe, test, expect } from "bun:test";
 import { COMMAND_CLASS_LABELS, COMMAND_CLASS_PATTERNS } from "./command-classes.js";
 import { COMMAND_RULE_CATALOG, DEFAULT_SAFETY_POLICY, hardRuleClasses } from "./safety-policy.js";
 import { CommandClassSchema, CommandLocusSchema } from "../schemas/agent.js";

package/src/policy/search-globs.test.ts

@@ -1,4 +1,3 @@
-import { test, expect } from "bun:test";
 import { includeGlobs } from "./search-globs.js";
 
 test("an empty field scopes nothing", () => {

package/src/protocol/container-requirements.test.ts

@@ -1,4 +1,3 @@
-import { describe, it, expect } from "bun:test";
 import { CONTAINER_REQUIREMENTS, containerDrift } from "./container-requirements.js";
 
 // Healthy baseline: every case below removes one piece of it to produce a gap.

package/src/protocol/ingress-contract.test.ts

@@ -1,5 +1,4 @@
 import { generateKeyPairSync } from "node:crypto";
-import { describe, it, expect } from "bun:test";
 import { hostOwnerId, mintReachabilityGrant, verifyReachabilityGrant } from "./ingress-contract.js";
 
 const pemPair = (): { privateKey: string; publicKey: string } => {

package/src/protocol/ingress-protocol.test.ts

@@ -2,7 +2,6 @@ import { createHash, randomBytes } from "node:crypto";
 import { createServer, type IncomingMessage, request as h1Request, type Server, type ServerResponse } from "node:http";
 import type { AddressInfo } from "node:net";
 import { type Duplex, duplexPair } from "node:stream";
-import { test, expect, beforeAll, afterAll } from "bun:test";
 import { waitFor } from "@intentic/testing/bun";
 import { INITIAL_WINDOW_SIZE, openIngressSession, serveIngressSession } from "./ingress-protocol.js";
 
@@ -149,9 +148,25 @@ const target = createServer((request: IncomingMessage, response: ServerResponse)
 
 const cancelled = gate<string>();
 
+// `/late` holds its handshake until released, so the session can die while the loopback upgrade is still pending.
+const lateArrived = gate();
+const lateReleased = gate();
+let lateTornDown = false;
+
 // Hand-written HTTP/1.1 upgrade carrying the 101 head plus the raw bytes after it. `/refuse` answers instead of
 // upgrading.
 target.on("upgrade", (request: IncomingMessage, socket: Duplex, head: Buffer) => {
+    if ((request.url ?? "") === "/late") {
+        socket.on("error", () => {});
+        socket.on("close", () => (lateTornDown = true));
+        lateArrived.open();
+        void lateReleased.opened.then(() => {
+            if (!socket.destroyed) {
+                socket.write("HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n\r\n");
+            }
+        });
+        return;
+    }
     if ((request.url ?? "") === "/refuse") {
         socket.end("HTTP/1.1 404 Not Found\r\nContent-Type: text/plain\r\nContent-Length: 7\r\n\r\nno dice");
         return;
@@ -180,7 +195,7 @@ target.on("upgrade", (request: IncomingMessage, socket: Duplex, head: Buffer) =>
 // One session; every request is routed through it.
 const front = async (
     targetPort: number,
-): Promise<{ readonly server: Server; readonly poison: (bytes: Buffer) => void; readonly close: () => void }> => {
+): Promise<{ readonly server: Server; readonly poison: (bytes: Buffer) => void; readonly sever: () => void; readonly close: () => void }> => {
     const [edgeSide, daemonSide] = duplexPair();
     const daemon = await serveIngressSession(daemonSide, { targetPort });
     const session = await openIngressSession(edgeSide);
@@ -203,6 +218,8 @@ const front = async (
         server,
         // Writes garbage onto the wire the edge reads, simulating a wedged or corrupted peer.
         poison: (bytes: Buffer) => void daemonSide.write(bytes),
+        // Cuts the tunnel under the daemon, which takes its h2 session and every stream on it down.
+        sever: () => void daemonSide.destroy(),
         close: () => {
             session.close();
             daemon.close();
@@ -440,6 +457,32 @@ test("a browser that gives up cancels the stream all the way to the target", asy
     await expect(cancelled.opened).resolves.toBe("aborted");
 });
 
+// The handshake lands after its stream is gone: answering it throws ERR_HTTP2_INVALID_STREAM from an event callback.
+test("a session that dies mid-handshake tears the loopback upgrade down instead of answering into a dead stream", async () => {
+    const own = await front((target.address() as AddressInfo).port);
+    const ownPort = await listen(own.server);
+    const request = h1Request({
+        host: "127.0.0.1",
+        port: ownPort,
+        path: "/late",
+        headers: { host: HOST, connection: "Upgrade", upgrade: "websocket", "sec-websocket-key": "x" },
+        agent: false,
+    });
+    request.on("error", () => {});
+    request.end();
+    await lateArrived.opened;
+
+    own.sever();
+    await new Promise((resolve) => setTimeout(resolve, 250));
+    lateReleased.open();
+
+    await waitFor(() => expect(lateTornDown).toBe(true));
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    expect(uncaught).toStrictEqual([]);
+    request.destroy();
+    own.close();
+});
+
 test("a tunnel whose target is not listening fails the exchange rather than answering for it", async () => {
     const dead = createServer();
     const deadPort = await listen(dead);

package/src/protocol/ingress-protocol.ts

@@ -10,9 +10,9 @@ import {
 import { type AddressInfo, createServer as createNetServer, connect as netConnect, type Socket } from "node:net";
 import { Duplex } from "node:stream";
 
-// Both ends of the ingress tunnel's h2 session, over any node Duplex, in one file: a wire format with two owners
-// drifts. h2 gives multiplexing and backpressure for free; routing is per h2 stream, since one edge connection can
-// interleave several sandboxes' hosts.
+// Both halves of the ingress tunnel's h2 session over any node Duplex, in one file so the wire has one owner: the edge's,
+// and a daemon half its suites dial (a sandbox runs the Rust one, _sandbox/front tunnel.rs, held to this by its test).
+// Routing is per h2 stream, since one edge connection can interleave several sandboxes' hosts.
 
 // Header hygiene
 
@@ -308,7 +308,7 @@ export const openIngressSession = async (duplex: Duplex): Promise<IngressSession
     };
 };
 
-// The daemon half: an h2 server over the tunnel, onto the loopback listener
+// The daemon half the edge's suites dial: an h2 server over the tunnel, onto a local listener
 
 export interface ServeIngressSessionOptions {
     // The daemon's own listener; every stream lands there as a plain HTTP/1.1 request or upgrade.
@@ -340,6 +340,10 @@ export const serveIngressSession = async (duplex: Duplex, options: ServeIngressS
     server.on("error", () => duplex.destroy());
     server.on("session", (session) => session.setLocalWindowSize(CONNECTION_WINDOW_SIZE));
 
+    // The loopback's answer can outlive its stream when the session dies, and respond/write on a dead stream throws
+    // ERR_HTTP2_INVALID_STREAM from an event callback, where nothing catches it.
+    const gone = (stream: ServerHttp2Stream): boolean => stream.destroyed || stream.closed;
+
     const forwardToLoopback = (stream: ServerHttp2Stream, headers: IncomingHttpHeaders): void => {
         const local = h1Request({
             host: LOOPBACK,
@@ -353,6 +357,10 @@ export const serveIngressSession = async (duplex: Duplex, options: ServeIngressS
         });
         stream.pipe(local);
         local.on("response", (response) => {
+            if (gone(stream)) {
+                response.destroy();
+                return;
+            }
             stream.respond({ [constants.HTTP2_HEADER_STATUS]: response.statusCode ?? 502, ...endToEnd(response.headers) });
             response.pipe(stream);
         });
@@ -364,6 +372,9 @@ export const serveIngressSession = async (duplex: Duplex, options: ServeIngressS
         // means this — on a reset, node fires `aborted` before `finish` and `close`, so a
         // `writableEnded`/`writableFinished` guard there would miss it.
         stream.on("aborted", () => local.destroy());
+        // `aborted` fires only while the stream's writable side is open; `close` covers every other way it dies, and a
+        // request whose answer already completed ignores the destroy.
+        stream.on("close", () => local.destroy());
     };
 
     const spliceUpgrade = (stream: ServerHttp2Stream, headers: IncomingHttpHeaders): void => {
@@ -372,6 +383,10 @@ export const serveIngressSession = async (duplex: Duplex, options: ServeIngressS
         // pool the request path above uses.
         const local = h1Request({ host: LOOPBACK, port: options.targetPort, method: head.method, path: head.path, headers: head.headers, agent: false });
         local.on("upgrade", (response, socket, first) => {
+            if (gone(stream)) {
+                socket.destroy();
+                return;
+            }
             stream.respond({ [constants.HTTP2_HEADER_STATUS]: constants.HTTP_STATUS_OK });
             // Response head written verbatim (see serializeHead), then any bytes already sent past it, then the pipe.
             stream.write(serializeHead(response, NOTHING_DROPPED, []));
@@ -383,11 +398,17 @@ export const serveIngressSession = async (duplex: Duplex, options: ServeIngressS
         // The local server declined to upgrade; its answer goes to the browser with framing that matches the already
         // de-chunked body.
         local.on("response", (response) => {
+            if (gone(stream)) {
+                response.destroy();
+                return;
+            }
             stream.respond({ [constants.HTTP2_HEADER_STATUS]: constants.HTTP_STATUS_OK });
             stream.write(serializeHead(response, DECLINED_UPGRADE_DROP, DECLINED_UPGRADE_ADD));
             response.pipe(stream);
         });
         local.on("error", () => stream.close(constants.NGHTTP2_CONNECT_ERROR));
+        // Before the handshake answers, nothing else ties the loopback request to the stream; once spliced, a no-op.
+        stream.on("close", () => local.destroy());
         // An upgrade request carries no body; the client is waiting on the handshake before it says anything else.
         local.end();
     };

package/src/protocol/peer-dial.test.ts

@@ -1,4 +1,3 @@
-import { test, expect, mock, jest } from "bun:test";
 import { waitFor, advanceTimersByTimeAsync } from "@intentic/testing/bun";
 import { dialPeer, LONG_OUTAGE_ATTEMPTS, LONG_OUTAGE_MS, PEER_TRY_AGAIN, type SocketLike } from "./peer-dial.js";
 
@@ -64,7 +63,7 @@ const dialling = (delay?: number) => {
     const sockets: FakeSocket[] = [];
     const attached: FakeSocket[] = [];
     const said: string[] = [];
-    const revoked = mock();
+    const revoked = jest.fn();
     const link = dialPeer<FakeSocket>({
         open: async () => {
             const socket = new FakeSocket();

package/src/protocol/peer-mcp-server.test.ts

@@ -1,4 +1,3 @@
-import { test, expect } from "bun:test";
 import { z } from "zod";
 import { createMcpServer, type McpAuditEntry, textResult, tool } from "./peer-mcp-server.js";
 

package/src/protocol/routes.test.ts

@@ -1,5 +1,4 @@
 import { eventIterator, oc } from "@orpc/contract";
-import { describe, it, expect } from "bun:test";
 import { z } from "zod";
 import { SANDBOX_ROUTE_NAMES, SANDBOX_ROUTE_SHAPES, SANDBOX_ROUTES, sandboxRouteName } from "../index.js";
 import { procedure } from "./route-meta.js";
@@ -34,8 +33,12 @@ describe(`contractRoutes`, () => {
 
     it(`carries the policy a procedure declared, merged over its builder's`, () => {
         const operated = procedure.meta({ agent: true, control: `never` });
-        const routes = contractRoutes({ vpn: { connect: operated.route({ method: "POST", path: "/vpn/{id}/connect" }).meta({ floor: `collaborator` }) } });
-        expect(routes).toEqual([{ name: `vpn.connect`, method: `POST`, path: `/vpn/{id}/connect`, meta: { agent: true, control: `never`, floor: `collaborator` } }]);
+        const routes = contractRoutes({
+            vpn: { connect: operated.route({ method: "POST", path: "/vpn/{id}/connect" }).meta({ floor: `collaborator` }) },
+        });
+        expect(routes).toEqual([
+            { name: `vpn.connect`, method: `POST`, path: `/vpn/{id}/connect`, meta: { agent: true, control: `never`, floor: `collaborator` } },
+        ]);
     });
 
     it(`ignores non-procedure members rather than inventing routes for them`, () => {

package/src/protocol/tunnel-heartbeat.test.ts

@@ -1,12 +1,11 @@
-import { describe, test, expect, mock } from "bun:test";
 import { createHeartbeat, DEAD_AFTER_MS } from "./tunnel-heartbeat.js";
 
 // The clock is injected, so these read as "what happens after N seconds of silence" rather than as timer
 // plumbing — which is the only question the heartbeat answers.
 const world = (deadAfterMs = DEAD_AFTER_MS) => {
     let clock = 0;
-    const ping = mock();
-    const onDead = mock();
+    const ping = jest.fn();
+    const onDead = jest.fn();
     const heartbeat = createHeartbeat({ ping, onDead, deadAfterMs, now: () => clock });
     return { heartbeat, ping, onDead, advance: (ms: number) => (clock += ms) };
 };

package/src/protocol/upgrade-relay.ts

@@ -0,0 +1,28 @@
+import type { ClientRequest } from "node:http";
+import type { Duplex } from "node:stream";
+
+// `upstream` is the client's handshake replayed; a 101 is echoed and bytes flow raw, any other answer ends the socket.
+export const relayUpgrade = (upstream: ClientRequest, socket: Duplex, head: Buffer): void => {
+    upstream.on("error", () => socket.destroy());
+    upstream.on("response", (answer) => {
+        socket.end(`HTTP/1.1 ${answer.statusCode ?? 502} ${answer.statusMessage ?? ""}\r\n\r\n`);
+    });
+    upstream.on("upgrade", (answer, upstreamSocket, upstreamHead) => {
+        const lines: string[] = [];
+        for (let index = 0; index < answer.rawHeaders.length; index += 2) {
+            lines.push(`${answer.rawHeaders[index]}: ${answer.rawHeaders[index + 1]}`);
+        }
+        socket.write(`HTTP/1.1 101 Switching Protocols\r\n${lines.join("\r\n")}\r\n\r\n`);
+        if (upstreamHead.length > 0) {
+            socket.write(upstreamHead);
+        }
+        if (head.length > 0) {
+            upstreamSocket.write(head);
+        }
+        upstreamSocket.on("error", () => socket.destroy());
+        socket.on("error", () => upstreamSocket.destroy());
+        upstreamSocket.pipe(socket);
+        socket.pipe(upstreamSocket);
+    });
+    upstream.end();
+};

package/src/schemas/agent.test.ts

@@ -1,4 +1,3 @@
-import { describe, expect, test } from "bun:test";
 import { AgentTurnSchema, profileOf, TurnProfileSchema } from "./agent.js";
 
 // The profile is what every continuation carries whole, so its field set and its normalisation are the contract: a key

package/src/schemas/agents.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { AgentHarnessSchema, AgentOriginSchema, AgentProviderSchema, ConversationQueueSchema, ForkedFromSchema } from "./agent.js";
 import { LoopStateSchema } from "./loops.js";
 import { LimitPolicySchema, RetryPolicySchema, TurnBreakPolicySchema, TurnBreakSchema } from "./turn-break.js";
+import { KeepWarmSchema } from "./keep-warm.js";
 import { EMOJI_MAX_LENGTH, isSingleEmoji } from "../text/emoji.js";
 // A fleet agent is any conversation with a registry entry, keyed by conversationId. Isolated ones own a git worktree
 // (branch agent/<id>); workspace conversations have none, but both share one status/activity/cost lifecycle.
@@ -329,11 +330,24 @@ export const AgentSummarySchema = z.object({
         .object({
             at: z.number().describe("When its last request touched the provider's prompt cache, in milliseconds."),
             ttlMs: z.number().describe("How long that entry lives from `at`, in milliseconds."),
+            rollsAt: z
+                .number()
+                .optional()
+                .describe(
+                    "When the date written into the agent's prompt next changes, in milliseconds (midnight where the agent runs). Past it the next turn sends a different prompt, so nothing kept before it is read again.",
+                ),
+            keepable: z
+                .boolean()
+                .optional()
+                .describe("Whether this sandbox can keep this cache warm: it holds the last turn's exact request to replay, on a Claude subscription account."),
         })
         .optional()
         .describe(
             "When this conversation's prompt cache was last kept alive and how long it lasts, which together say when picking the conversation up stops being cheap. Absent when the provider publishes nothing to ground it on.",
         ),
+    keepWarm: KeepWarmSchema.optional().describe(
+        "Whether the sandbox is keeping this conversation's prompt cache warm while it sits idle, how that is going, or why it stopped. Absent when nobody asked for it.",
+    ),
     activity: AgentActivitySchema.optional().describe("What it is doing at this moment."),
     // Beside `activity` because both answer "where is it", one in a sentence and one as a fraction. Live while a turn
     // runs, and left standing after it, so a settled card still says how far the work got.
@@ -517,13 +531,6 @@ export const AgentToolChildrenQuerySchema = AgentIdSchema.extend({
     toolId: z.string().min(1).describe("Which tool call, by the id its card carries."),
 });
 // Absent `ids` archives every archivable finished agent (the lane's "Clear"); unarchive always names its own ids.
-export const AgentArchiveSchema = z.object({
-    ids: z
-        .array(z.string().min(1))
-        .max(500)
-        .optional()
-        .describe("Which conversations to put away. Leave it out for every finished one that can be archived right now."),
-});
 export const AgentIdsSchema = z.object({ ids: z.array(z.string().min(1)).min(1).max(500).describe("Which conversations.") });
 // What actually moved, not the roster afterward: two archives finishing at once would otherwise let a slower snapshot
 // resurrect what a faster one just filed away. Whole summaries, since the receiving surfaces (archive list, detail

package/src/schemas/areas.test.ts

@@ -1,5 +1,4 @@
 import { PUBLIC_DIR, STATE_DIR } from "@intentic/constants";
-import { describe, test, expect } from "bun:test";
 import { AreaFolderSchema } from "./areas.js";
 
 // What an area may name. These refusals are load-bearing rather than cosmetic: an area's folders become the fence
@@ -22,7 +21,7 @@ describe("AreaFolderSchema", () => {
     });
 
     test("the sandbox's own configuration and its outbox can never be named", () => {
-        for (const folder of [STATE_DIR, `${STATE_DIR}/config`, `${STATE_DIR}/config/hooks`, PUBLIC_DIR, `${PUBLIC_DIR}/site`]) {
+        for (const folder of [STATE_DIR, `${STATE_DIR}/config`, `${STATE_DIR}/config/skills`, PUBLIC_DIR, `${PUBLIC_DIR}/site`]) {
             expect(AreaFolderSchema.safeParse(folder).success, folder).toBe(false);
         }
     });

package/src/schemas/capabilities.ts

@@ -354,6 +354,12 @@ export const CapabilityStatusSchema = z.object({
     state: CapabilityStateSchema.describe("Whether it is live, still coming up, broken, or switched off."),
     detail: z.string().optional().describe("What is wrong, in words a person can act on."),
     code: z.string().optional().describe("A short marker for that reason, for anything deciding what to do about it."),
+    settling: z
+        .boolean()
+        .optional()
+        .describe(
+            "True while something under way will move this on its own: a start, a download, a pairing code waiting to be typed. Absent when only a person can move it, or a pushed change will say when it moved.",
+        ),
 });
 export type CapabilityStatus = z.infer<typeof CapabilityStatusSchema>;
 // The list row: manifest entry plus live status, secrets never returned. `secrets` names which config keys hold a

package/src/schemas/ci.ts

@@ -151,15 +151,9 @@ export const CiFixResponseSchema = z.object({
     conversationId: z.string().describe("The conversation that was opened, already holding the failure. Open it to watch, or attach to its turn."),
 });
 export type CiFixResponse = z.infer<typeof CiFixResponseSchema>;
-// The workspace's own answer to "would this push go red": front-runs CI at the push itself, the last moment before work
-// leaves the machine and the first at which what's pushed is finally settled. Runs at the push rather than the land,
-// where the tree keeps moving and a verdict would need staleness tracking to answer a question the push gets for free.
-// No stored verdict, nothing polled at rest: a run exists while it runs and is gone after, since the next push asks
-// again.
-
-// One shape for any command the daemon runs on a click with a verdict and a quotable tail (the pre-push check, and the
-// push itself via PushRunSchema in schemas/git/git.ts), so the fields the browser reads (terminal, tail, kill vs timeout)
-// can't drift between them.
+// One shape for any command the daemon runs on a click with a verdict and a quotable tail (the push via PushRunSchema in
+// schemas/git/git.ts, which runs the repository's own pre-push hook), so the fields the browser reads (terminal, tail,
+// kill vs timeout) have one definition.
 // idle: nothing has run yet, or the last run was cleared
 // running: live; its output is the terminal's, not this object's
 // passed: exited 0

package/src/schemas/context-trim.test.ts

@@ -1,4 +1,3 @@
-import { test, expect } from "bun:test";
 import { contextTrimLine } from "./context-trim.js";
 
 // The one thing a reader ever sees of this mechanism. It has to answer three questions in one line: why the turn ran

package/src/schemas/dev-rebuild-log.test.ts

@@ -1,4 +1,3 @@
-import { test, expect } from "bun:test";
 import { DEV_REBUILD_EXIT_MARK, DEV_REBUILD_QUIET_MARK, devRebuildLogPath, readDevRebuildLog } from "./devices.js";
 
 // The one account a detached rebuild gives of itself. The daemon builds the shell that writes this text and the browser