@intentic/sandbox-contract 1.325.0 → 1.327.0

package/src/chores/probes.ts

@@ -74,16 +74,99 @@ const semverKind = (current: string, latest: string): OutdatedPackage["kind"] =>
     return latestMinor !== currentMinor ? `minor` : `patch`;
 };
 
+// ---- packages the workspace leaves out -------------------------------------------------------------------------
+// `pnpm outdated -r` and `pnpm audit` read the workspace's own tree, so a package the repo deliberately keeps OUT of
+// it (the iOS shell, whose dependencies Xcode consumes and which is installed with npm on the Mac that builds it)
+// was measured by neither, while Dependabot reads every manifest: GitHub reported a critical Capacitor advisory
+// this panel never saw. Every literal `!dir` under `packages:` in pnpm-workspace.yaml naming a folder with its own
+// package.json counts. A glob negation (`!**/fixtures/**`) is how fixtures are left out; it never names a folder
+// that exists, so the package.json test drops it without a rule of its own.
+const STANDALONE_DIRS =
+    `sed -n '/^packages:/,/^[^[:space:]#-]/p' pnpm-workspace.yaml 2>/dev/null | tr -d "\\"'" | ` +
+    `sed -n -e 's|/\\*\\*[[:space:]]*$||' -e 's|^[[:space:]]*-[[:space:]]*!\\([^[:space:]#]*\\).*$|\\1|p'`;
+
+// The line that opens one standalone package's report, as JSON so a guard can still read the stream with `jq -s`.
+const STANDALONE_KEY = `standalone`;
+const STANDALONE_LINE = /^\{"standalone":"([^"]*)"\}$/;
+
+// Runs `measure` against each standalone package in a scratch copy, never in place: `--lockfile-only` would write
+// a pnpm lockfile into a folder whose whole point is that pnpm does not manage it. A lockfile the folder already
+// has is honoured (an npm one through `pnpm import`); without one the tree is what a fresh install there resolves
+// today, which for a folder that commits none is exactly what its next build installs. A copy that cannot be
+// resolved prints nothing after its marker, and the parser turns that into a failed probe, never a clean package.
+const standaloneCommand = (measure: string): string =>
+    `${STANDALONE_DIRS} | while IFS= read -r dir; do ` +
+    `[ -f "$dir/package.json" ] || continue; ` +
+    `printf '{"${STANDALONE_KEY}":"%s"}\\n' "$dir"; ` +
+    `scratch=$(mktemp -d) || continue; ` +
+    `for file in package.json pnpm-lock.yaml package-lock.json .npmrc; do [ -f "$dir/$file" ] && cp "$dir/$file" "$scratch/"; done; ` +
+    `( cd "$scratch" && { [ -f pnpm-lock.yaml ] || { [ -f package-lock.json ] && pnpm import >/dev/null 2>&1; } || ` +
+    `pnpm install --lockfile-only --ignore-workspace --ignore-scripts >/dev/null 2>&1; } && ${measure} ); ` +
+    `rm -rf "$scratch"; ` +
+    `done`;
+
+// The workspace's own report, then one per standalone package; `true` at the end because pnpm exits non-zero when
+// it has findings, and the runner judges by whether the output parses.
+const withStandalone = (measure: string, standaloneMeasure: string): string => `${measure}; ${standaloneCommand(standaloneMeasure)}; true`;
+
+interface Section {
+    readonly standalone?: string;
+    readonly text: string;
+}
+
+// Splits a probe's output at each standalone marker; the first section, before any marker, is the workspace's own.
+const sectionsOf = (stdout: string): Section[] => {
+    const sections: { standalone?: string; lines: string[] }[] = [{ lines: [] }];
+    for (const line of stdout.split(`\n`)) {
+        const marker = STANDALONE_LINE.exec(line.trim());
+        if (marker === null) {
+            sections.at(-1)?.lines.push(line);
+        } else {
+            sections.push({ standalone: marker[1] ?? ``, lines: [] });
+        }
+    }
+    return sections.map(({ standalone, lines }) => ({ ...(standalone === undefined ? {} : { standalone }), text: lines.join(`\n`) }));
+};
+
+// Every section has to parse: a standalone package that could not be measured is not a clean one, so one unreadable
+// report fails the whole probe rather than vanishing from it.
+const parseSections = <T>(stdout: string, parse: (section: Section) => readonly T[] | undefined): T[] | undefined => {
+    const found: T[] = [];
+    for (const section of sectionsOf(stdout)) {
+        const parsed = parse(section);
+        if (parsed === undefined) {
+            return undefined;
+        }
+        found.push(...parsed);
+    }
+    return found;
+};
+
+const standaloneOf = (section: Section): { standalone?: string } => (section.standalone === undefined ? {} : { standalone: section.standalone });
+
+// pnpm 12 keys a package that appears more than once in the workspace (two versions, or both a dependency and a
+// devDependency somewhere) as `name@version` and `name@version (dev)`; taken as the name, that listed mermaid twice
+// under a name no registry knows.
+const DISAMBIGUATED_KEY = /^(@?[^@\s]+)@\S+(?:\s+\([^)]*\))?$/;
+const packageNameOf = (key: string): string => DISAMBIGUATED_KEY.exec(key)?.[1] ?? key;
+
+// What ships outranks what only builds, so the merged row says `dependencies` if any of its copies does.
+const SECTION_RANK = [`dependencies`, `optionalDependencies`, `peerDependencies`, `devDependencies`];
+const rankOf = (section: string): number => {
+    const rank = SECTION_RANK.indexOf(section);
+    return rank === -1 ? SECTION_RANK.length : rank;
+};
+
 // `pnpm outdated --json` prints a name→{current,latest,dependencyType} map; the recursive workspace form merges into
 // the same shape.
 // Entries missing `current` or `latest` are skipped: pnpm could not resolve them against the registry.
-const parseOutdated = (stdout: string): ProbeFacts | undefined => {
-    const root = asObject(stdout);
+const parseOutdatedSection = (section: Section): OutdatedPackage[] | undefined => {
+    const root = asObject(section.text);
     if (root === undefined) {
         return undefined;
     }
-    const packages: OutdatedPackage[] = [];
-    for (const [name, raw] of Object.entries(root)) {
+    const packages = new Map<string, OutdatedPackage>();
+    for (const [key, raw] of Object.entries(root)) {
         if (typeof raw !== `object` || raw === null) {
             continue;
         }
@@ -93,9 +176,28 @@ const parseOutdated = (stdout: string): ProbeFacts | undefined => {
         if (current === undefined || latest === undefined || current === latest) {
             continue;
         }
-        packages.push({ name, current, latest, kind: semverKind(current, latest), section: asString(entry[`dependencyType`]) ?? `dependencies` });
+        const name = packageNameOf(key);
+        const row: OutdatedPackage = {
+            name,
+            current,
+            latest,
+            kind: semverKind(current, latest),
+            section: asString(entry[`dependencyType`]) ?? `dependencies`,
+            ...standaloneOf(section),
+        };
+        // One row per version pair: the same upgrade seen from a dependency and a devDependency is one upgrade.
+        const identity = `${name}@${current}→${latest}`;
+        const seen = packages.get(identity);
+        if (seen === undefined || rankOf(row.section) < rankOf(seen.section)) {
+            packages.set(identity, row);
+        }
     }
-    return { id: `outdated`, packages };
+    return [...packages.values()];
+};
+
+const parseOutdated = (stdout: string): ProbeFacts | undefined => {
+    const packages = parseSections(stdout, parseOutdatedSection);
+    return packages === undefined ? undefined : { id: `outdated`, packages };
 };
 
 const SEVERITIES = new Set([`critical`, `high`, `moderate`, `low`, `info`]);
@@ -104,15 +206,15 @@ const SEVERITIES = new Set([`critical`, `high`, `moderate`, `low`, `info`]);
 // and whether a patch exists.
 // `dev` is read from the findings' own flag: a build-time-only advisory is a different risk than one in a running
 // service.
-const parseAudit = (stdout: string): ProbeFacts | undefined => {
-    const root = asObject(stdout);
+const parseAuditSection = (section: Section): Advisory[] | undefined => {
+    const root = asObject(section.text);
     if (root === undefined) {
         return undefined;
     }
     const raw = root[`advisories`];
     // No `advisories` key is pnpm's clean report (empty list), not an unrecognized shape.
     if (raw === undefined) {
-        return { id: `audit`, advisories: [] };
+        return [];
     }
     if (typeof raw !== `object` || raw === null) {
         return undefined;
@@ -137,11 +239,22 @@ const parseAudit = (stdout: string): ProbeFacts | undefined => {
             // `<0.0.0` is npm's spelling of "no patch exists"; treated as absent rather than a fixable range.
             ...(patched === undefined || patched === `<0.0.0` ? {} : { patched }),
             dev: findings.length > 0 && findings.every((finding) => finding[`dev`] === true),
+            ...standaloneOf(section),
         });
     }
-    return { id: `audit`, advisories };
+    return advisories;
 };
 
+const parseAudit = (stdout: string): ProbeFacts | undefined => {
+    const advisories = parseSections(stdout, parseAuditSection);
+    return advisories === undefined ? undefined : { id: `audit`, advisories };
+};
+
+// Shared with the security chore's nightly guard, so the automation wakes on exactly what the panel shows. The output
+// is a stream of JSON documents (`jq -s` reads it whole): pnpm's report, then a `{"standalone": dir}` line and that
+// package's report for each standalone package.
+export const AUDIT_COMMAND = withStandalone(`pnpm audit --json 2>/dev/null`, `pnpm audit --json --ignore-workspace 2>/dev/null`);
+
 // Sample of paths only; the agent re-runs knip live, so a full list would already be stale.
 const DEAD_CODE_SAMPLE = 8;
 
@@ -404,9 +517,10 @@ export const PROBES: readonly ProbeSpec[] = [
         timeoutMs: 5 * 60_000,
         available: `test -f package.json`,
         unavailable: `no package.json`,
-        // `-r` reports every workspace package, not just root; `|| true` since pnpm exits non-zero when it has
-        // findings.
-        command: `pnpm outdated -r --json 2>/dev/null || true`,
+        // `-r` reports every workspace package, not just root, and resolves `catalog:` through pnpm-workspace.yaml,
+        // so the catalog is what gets measured. It also honours `minimumReleaseAge`: a release younger than the
+        // floor is not reported as latest, by the same policy that would refuse to install it.
+        command: withStandalone(`pnpm outdated -r --json 2>/dev/null`, `pnpm outdated --json --ignore-workspace 2>/dev/null`),
         parse: parseOutdated,
     },
     {
@@ -419,7 +533,7 @@ export const PROBES: readonly ProbeSpec[] = [
         // A lockfile, not package.json: audit resolves the installed tree, and without one pnpm has nothing to check.
         available: `test -f pnpm-lock.yaml || test -f package-lock.json`,
         unavailable: `no lockfile`,
-        command: `pnpm audit --json 2>/dev/null || true`,
+        command: AUDIT_COMMAND,
         parse: parseAudit,
     },
     {

package/src/chores/verdict.test.ts

@@ -10,6 +10,7 @@ import type {
     UiScan,
 } from "../schemas/maintenance.js";
 import { choreById, CHORES } from "./chores.js";
+import { digestOf } from "./digest.js";
 import { assessReport, choreAnswer, choreAnswered, ledgerKey, unseenVerdicts } from "./verdict.js";
 
 // The chore verdict state machine, tested at the distinctions a simpler design gets wrong: reporting an unmeasured repo
@@ -101,6 +102,34 @@ describe(`what "we have not measured this" means`, () => {
     });
 });
 
+// A package the pnpm workspace leaves out is fixed in its own folder, so its findings have to say which folder; the
+// workspace's own findings keep the digest they always had, so adding the field rebadges nothing already settled.
+describe(`findings from a package the workspace leaves out`, () => {
+    const advisory = (name: string, standalone?: string) => ({
+        name,
+        severity: `critical` as const,
+        title: `${name} is bad`,
+        patched: `>=2`,
+        dev: false,
+        ...(standalone === undefined ? {} : { standalone }),
+    });
+    const withFacts = (advisories: ReturnType<typeof advisory>[]) =>
+        report({ repos: [{ repo: `app`, probes: [probe({ id: `audit`, facts: { id: `audit`, advisories } })], signals: signals() }] });
+
+    test(`name their folder in the panel and in the prompt`, () => {
+        const verdict = verdictFor(withFacts([advisory(`@capacitor/ios`, `_editor/ios-app`)]), `security-advisories`);
+        expect(verdict.detail).toEqual([`critical · @capacitor/ios in _editor/ios-app, @capacitor/ios is bad`]);
+        expect(verdict.prompt).toContain(`@capacitor/ios in _editor/ios-app (critical`);
+    });
+
+    test(`are a different finding from the same package in the workspace, which keeps its old digest`, () => {
+        const workspace = verdictFor(withFacts([advisory(`left-pad`)]), `security-advisories`);
+        const standalone = verdictFor(withFacts([advisory(`left-pad`, `shell`)]), `security-advisories`);
+        expect(workspace.digest).toBe(digestOf(`left-pad@critical`));
+        expect(standalone.digest).not.toBe(workspace.digest);
+    });
+});
+
 describe(`the ledger debounces; it cannot hide`, () => {
     const withAdvisories = report({ repos: [{ repo: `app`, probes: [auditProbe([`left-pad`])], signals: signals() }] });
     const ledgerEntry = (over: Partial<ChoreLedgerEntry> = {}): ChoreLedgerEntry => ({

package/src/contracts/agent.contract.ts

@@ -112,7 +112,7 @@ export const agentContract = {
             path: "/agent/queue/resume",
             summary: "Let waiting messages go",
             description:
-                "Releases a queue held after a stop or a refusal: what waits goes out now as one turn when nothing is running, or after the running turn otherwise. Name who serves that turn when the conversation has been re-pointed since the messages were queued.",
+                "Releases a queue held after a stop or a refusal: what waits goes out now as one turn when nothing is running, or after the running turn otherwise. Name who serves that turn when the conversation has been re-pointed since the messages were queued. Name messages by id to let only those go (a scheduled one now, ahead of its time), leaving every other booking on its time.",
         })
         .meta({ floor: "collaborator", guest: true })
         .input(QueueResumeSchema)
@@ -124,7 +124,7 @@ export const agentContract = {
             path: "/agent/queue/schedule",
             summary: "Reschedule waiting messages",
             description:
-                "Books what waits in the conversation's queue to go out by itself at another instant, or once another conversation has finished and its work has landed, holding it until then. Works on a queue that is held for any reason, or on messages waiting behind a running turn. A time already past, or a conversation with nothing left to land, lets them go now.",
+                "Books what waits in the conversation's queue to go out by itself at another instant, or once another conversation has finished and its work has landed, holding it until then. Works on a queue that is held for any reason, or on messages waiting behind a running turn. Name messages by id to re-time only those; every other keeps its own booking. A time already past, or a conversation with nothing left to land, lets them go now.",
         })
         .meta({ floor: "collaborator", guest: true })
         .input(QueueScheduleSchema)

package/src/contracts/agents.contract.ts

@@ -25,7 +25,7 @@ import {
     AgentUnsentSchema,
     LandResultSchema,
 } from "../schemas/agents.js";
-import { AgentsListSchema } from "../schemas/automations.js";
+import { AgentsListSchema } from "../schemas/agents-list.js";
 import { AgentChangesSchema, AgentConflictsSchema, AgentScratchSchema, AgentHistorySchema } from "../schemas/git/git.js";
 import { FileDiffSchema } from "../schemas/history.js";
 import { OkSchema } from "../schemas/shared.js";

package/src/contracts/automations.contract.ts

@@ -9,20 +9,38 @@ import {
     AutomationsListSchema,
     SendersProviderParamSchema,
     SendersRosterSchema,
+    WatchCheckInputSchema,
+    WatchCheckResultSchema,
 } from "../schemas/automations.js";
 import { DoorTokenSchema, OkSchema } from "../schemas/shared.js";
 
 // Automations manifest (scheduled agent wake-ups); `pending*` is the owner's approval queue for wakes a
 // `requireApproval` automation holds instead of firing directly.
 export const automationsContract = {
+    // The `automations` CLI reads it on the agent token; a door's credential is attached for an operator only, which the
+    // agent token never is.
     list: procedure
+        .meta({ agent: true })
         .route({
             method: "GET",
             path: "/automations",
             summary: "Things that wake an agent on their own",
-            description: "Every automation with its recent runs and when it fires next.",
+            description: "Every automation with its recent runs, what its check saw last, and when it fires next.",
         })
         .output(AutomationsListSchema),
+    // A source only, never a guard command: a command run here would carry whichever persona's credentials the caller
+    // named, and the agent can run its own command in its own shell.
+    check: procedure
+        .meta({ agent: true })
+        .route({
+            method: "POST",
+            path: "/automations/check",
+            summary: "Try a watch's check once",
+            description:
+                "Runs a ready-made source's check now and answers what it sees, without saving or remembering anything: what to look at before proposing a watch, and what the composer shows beside the source it is editing.",
+        })
+        .input(WatchCheckInputSchema)
+        .output(WatchCheckResultSchema),
     catalog: procedure
         .route({
             method: "GET",

package/src/contracts/device.contract.ts

@@ -6,6 +6,7 @@ import { DeviceScopesSchema } from "../schemas/capabilities.js";
 import { DeviceFactsSchema } from "../schemas/hosts.js";
 import { LoopbackCatchEventSchema, LoopbackCatchSchema } from "../schemas/loopback-catch.js";
 import { OkSchema } from "../schemas/shared.js";
+import { ProjectDeliveryResultSchema, ProjectDeliverySchema } from "../schemas/project-delivery.js";
 
 // What a connected device can be asked, over the socket it opened; the machine is the oRPC server, the daemon the
 // client. No `.route()`: the procedure path is the address, not HTTP. Every input is strict (devices.ts says why). `mcp` stays opaque (`z.unknown()`) so a machine
@@ -31,4 +32,8 @@ export const deviceContract = {
     // daemon arms it, never a tool, and aborting the stream is how it stops. Sent only to an agent advertising
     // `loopback-catch`.
     catchLoopback: oc.input(LoopbackCatchSchema).output(streamOf(LoopbackCatchEventSchema)),
+    // Landed work written into the owner's folder that `/work/<name>` copies (schemas/project-delivery.ts). Only the
+    // daemon calls it, after a land, and only on an agent advertising `project-delivery`; the machine refuses a folder
+    // that did not opt into delivery, takes a restore point first, and never writes over an edit of the owner's own.
+    deliverProject: oc.input(ProjectDeliverySchema).output(ProjectDeliveryResultSchema),
 };

package/src/contracts/endpoints.contract.ts

@@ -27,27 +27,28 @@ export const TrialStatusSchema = z.object({
 });
 export type TrialStatusResponse = z.infer<typeof TrialStatusSchema>;
 
-// Whether this container can reach an NVIDIA GPU, and how sure we are. The three states are not a tri-state boolean:
-// `absent` means nobody has asked yet, so the switch is still worth offering, while `unsupported` means the host's
-// Docker answered and has no nvidia runtime, which is a sentence to print rather than a switch to offer. Before the
-// grant the sandbox cannot see VRAM at all — only after it can `gpuMemoryBytes` be anything but zero.
-export const LocalModelGpuSchema = z.enum(["granted", "unsupported", "absent"]);
-export type LocalModelGpu = z.infer<typeof LocalModelGpuSchema>;
+// A model server found running on the computer that hosts the sandbox.
+export const HostModelServerSchema = z.object({
+    kind: z.enum(["ollama", "lmstudio", "llamacpp", "vllm"]).describe("Which program usually listens on the port it answered on."),
+    label: z.string().describe("Its name, for the row."),
+    baseUrl: z.string().describe("Where the container reaches it, as a model endpoint's base URL."),
+    models: z.array(z.string()).describe("The models it lists right now."),
+    capability: z.string().optional().describe("The connection that already points at it, if one does."),
+});
+export type HostModelServer = z.infer<typeof HostModelServerSchema>;
 
-// Which one device a model runs at full speed on: the GPU when one reached this sandbox, else the host's RAM. One, never
-// a sum: a model split between a card and the CPU runs at the CPU's pace.
-export const LocalModelDeviceSchema = z.enum(["gpu", "host"]);
-export type LocalModelDevice = z.infer<typeof LocalModelDeviceSchema>;
+export const HostModelServersSchema = z.object({ servers: z.array(HostModelServerSchema) });
+export type HostModelServers = z.infer<typeof HostModelServersSchema>;
 
 // One window rung priced against one model, so a surface never has to redo the arithmetic the start check will.
 const LocalModelWindowFitSchema = z.object({
     tokens: z.number().int().positive(),
     // Weights + KV cache + the runtime's own floor: the same estimate the admission check refuses a start on.
     totalBytes: z.number().int().nonnegative(),
-    // Whether it can load at all, GPU and host together: what a start is refused on.
+    // Whether it can load at all: what a start is refused on.
     fits: z.boolean(),
-    // Whether all of it fits in the free memory of the one device, so it runs at that device's pace. A rung can fit and
-    // still run mostly on the CPU. Absent from a daemon older than the distinction.
+    // Whether all of it fits in the sandbox's free memory, so it runs at full speed. Absent from a daemon older than the
+    // distinction.
     fullSpeed: z.boolean().optional(),
 });
 
@@ -79,18 +80,12 @@ export const LocalModelFitSchema = z.object({
     // True when the number above is a container limit rather than the machine's: worth saying, since the host may look
     // much larger than what a model can have.
     memoryCapped: z.boolean(),
-    gpu: LocalModelGpuSchema,
-    gpuMemoryBytes: z.number().int().nonnegative(),
-    // The GPU's free memory, on the card with the most of it; zero before the grant. Absent from an older daemon.
-    gpuFreeBytes: z.number().int().nonnegative().optional(),
-    // What a start is refused on: the host and the GPU together, since llama.cpp can split a model between them. Only a
-    // model that cannot load at all is turned away here; a model that fits only this way runs mostly on the CPU.
+    // What a start is refused on: the sandbox's memory, by total. Only a model that cannot load at all is turned away.
     budgetBytes: z.number().int().nonnegative(),
-    // What a model may take and still run at full speed: the free memory of one device (fullSpeedDevice), plus whatever
-    // this sandbox's own local model holds there now, since a start stops it first. Both offers are sized against this,
-    // never against the sum. Zero means unmeasurable. Absent from a daemon older than the distinction.
+    // What a model may take and still run at full speed: the sandbox's free memory, plus whatever its own local model
+    // holds now, since a start stops it first. Both offers are sized against this. Zero means unmeasurable. Absent from
+    // a daemon older than the distinction.
     fullSpeedBytes: z.number().int().nonnegative().optional(),
-    fullSpeedDevice: LocalModelDeviceSchema.optional(),
     // Whether llama-server is in this image. False means the local lane costs a rebuild before it can serve anything.
     serverReady: z.boolean(),
     options: z.array(LocalModelOptionFitSchema),
@@ -122,17 +117,28 @@ export const endpointsContract = {
                 "The allowance, what has been used, when it resets, and which model actually answered the last message. Not being available is the ordinary answer rather than a failure: most sandboxes run against a platform that offers no trial at all.",
         })
         .output(TrialStatusSchema),
-    // Sized against this machine rather than a table in the browser, because the numbers that matter (a cgroup cap, a
-    // GPU that may not be passed through, weights already on disk) are only knowable in here.
+    // Sized against this machine rather than a table in the browser, because the numbers that matter (a cgroup cap, the
+    // memory free now, weights already on disk) are only knowable in here.
     localModelFit: procedure
         .route({
             method: "GET",
             path: "/endpoints/local-model/fit",
             summary: "Which local models this machine can actually run",
             description:
-                "The memory this sandbox may use, whether a GPU reached it, and every curated model priced two ways: whether it fits on one device's free memory and so runs at full speed, and whether it can load at all. The two the connect view offers, one that downloads in a minute and the best this machine runs at full speed, come from the first; a start is refused only on the second.",
+                "The memory this sandbox may use, and every curated model priced two ways: whether it fits in the free memory and so runs at full speed, and whether it can load at all. The two the connect view offers, one that downloads in a minute and the best this machine runs at full speed, come from the first; a start is refused only on the second. These run on the sandbox's CPU; a GPU model is a server on the host, which hostServers finds.",
         })
         .output(LocalModelFitSchema),
+    // A GPU model runs in a server on the computer that hosts the sandbox, never inside it; this finds the ones already
+    // running, so pointing at one is a press rather than a form.
+    hostServers: procedure
+        .route({
+            method: "GET",
+            path: "/endpoints/host-servers",
+            summary: "Model servers already running on the computer that hosts this sandbox",
+            description:
+                "Asks the usual ports of the hosting computer (Ollama 11434, LM Studio 1234, llama.cpp 8080, vLLM 8000) for their model list, as the container reaches them at host.docker.internal. Only servers that answer with models are listed, each with the connection that already points at it, if one does. Nothing is added.",
+        })
+        .output(HostModelServersSchema),
     // Start or stop fetching the instant model's weights before anyone has asked for them, so the first local turn does
     // not begin with a download. Idempotent: starting twice joins the transfer already running.
     localModelPrefetch: procedure

package/src/contracts/extensions.contract.ts

@@ -2,6 +2,11 @@ import { procedure } from "../protocol/route-meta.js";
 import { CapabilityIdParamSchema } from "../schemas/capabilities.js";
 import {
     ExtensionApproveInputSchema,
+    ExtensionDevClearedSchema,
+    ExtensionDevListSchema,
+    ExtensionDevSetInputSchema,
+    ExtensionDevStateSchema,
+    ExtensionDevTargetSchema,
     ExtensionEnabledInputSchema,
     ExtensionProcessParamSchema,
     ExtensionProcessStatusSchema,
@@ -22,6 +27,10 @@ import {
 import { ExtensionReadinessSchema } from "../schemas/maintenance.js";
 import { OkSchema } from "../schemas/shared.js";
 
+// Dev mode's verbs: the agent's `extension` CLI drives them on the agent token, and the Extensions tab's way back
+// calls devClear. None reads or moves a credential.
+const devRoute = procedure.meta({ agent: true });
+
 // Installed extensions resolved to their approved manifests. The bundle itself is a plain Hono route, `GET
 // /extensions/{id}/bundle`, not part of this oRPC contract: raw ESM bytes aren't a JSON payload.
 export const extensionsContract = {
@@ -209,4 +218,44 @@ export const extensionsContract = {
         })
         .input(ExtensionProcessParamSchema)
         .output(OkSchema),
+    // Dev mode (.intentic/local/extension-dev.json): an installed extension served from a source checkout. Same powers
+    // only: a checkout declaring more is held, and the pinned version keeps running.
+    devList: devRoute
+        .route({
+            method: "GET",
+            path: "/extensions/dev",
+            summary: "Installed extensions and their source checkouts",
+            description:
+                "Every extension installed from a repository, with its pinned commit, whether it runs from a source checkout, and the checkout of its repository this workspace holds, if any. The calling conversation's own copy is named first.",
+        })
+        .output(ExtensionDevListSchema),
+    devSet: devRoute
+        .route({
+            method: "POST",
+            path: "/extensions/{id}/dev",
+            summary: "Run an installed extension from its source checkout",
+            description:
+                "Serves the extension's browser bundle, backend, processes, skills and contributions from a checkout of its source instead of its pinned copy, so a change to it shows on reload without being landed first. The checkout must hold the same extension and declare the same powers; one asking for more, or not built yet, is held and the pinned version keeps running, with the reason. Nothing is installed or updated: the pinned copy stays where it is.",
+        })
+        .input(ExtensionDevSetInputSchema)
+        .output(ExtensionDevStateSchema),
+    devClear: devRoute
+        .route({
+            method: "POST",
+            path: "/extensions/{id}/dev/clear",
+            summary: "Go back to the pinned version",
+            description: "Stops serving the extension from its source checkout. The checkout itself is left exactly as it is.",
+        })
+        .input(ExtensionDevTargetSchema)
+        .output(ExtensionDevClearedSchema),
+    devReload: devRoute
+        .route({
+            method: "POST",
+            path: "/extensions/{id}/dev/reload",
+            summary: "Pick up a rebuilt checkout",
+            description:
+                "Call after rebuilding an extension that runs from its source checkout: its backend restarts on the new code, and an open app is told the list changed, so it offers to reload the new browser bundle.",
+        })
+        .input(ExtensionDevTargetSchema)
+        .output(ExtensionDevStateSchema),
 };

package/src/contracts/pages.contract.ts

@@ -0,0 +1,61 @@
+import { z } from "zod";
+import { procedure } from "../protocol/route-meta.js";
+import { PAGE_ERROR_CHARS, PAGE_ERRORS_MAX } from "../text/pages.js";
+
+// Pages the agent showed in a chat. The pages themselves are files the workspace already serves; the routes here are
+// what an MCP server's app asks of its server while a reader uses it (`tools/call` over the bridge), carried by the
+// daemon since the app's frame reaches no network of its own, and what a page's own scripts threw as it drew, carried
+// back to the agent that showed it.
+export const PageAppCallSchema = z.object({
+    page: z.string().min(1).describe("The stored page the app is drawn from, as a workspace path; it names the server and the tool the app belongs to."),
+    name: z.string().min(1).describe("The tool the app asks to call, on its own server."),
+    arguments: z.record(z.string(), z.unknown()).optional().describe("What the app passes it."),
+    pressed: z
+        .boolean()
+        .optional()
+        .describe(
+            "Whether the reader had just pressed something in the app when it asked. Without a press, only a tool its server marks read-only is called: an app's own script cannot make a change nobody asked for.",
+        ),
+});
+export const PageAppCallResultSchema = z.object({
+    result: z.unknown().describe("The server's answer, as the MCP call result it sent (`content`, `structuredContent`, `isError`)."),
+});
+
+export const PageErrorsSchema = z.object({
+    page: z.string().min(1).describe("The stored page that threw, as a workspace path."),
+    errors: z
+        .array(z.string().min(1).max(PAGE_ERROR_CHARS))
+        .min(1)
+        .max(PAGE_ERRORS_MAX)
+        .describe("Its uncaught errors as its frame caught them, each with the first line of its stack."),
+});
+export const PageErrorsResultSchema = z.object({
+    told: z
+        .boolean()
+        .describe(
+            "Whether the agent heard: true when the turn that showed the page was still running and took the errors. False when that turn is over, the page is an MCP server's app, or these errors were already told.",
+        ),
+});
+
+export const pagesContract = {
+    appCall: procedure
+        .route({
+            method: "POST",
+            path: "/pages/app-call",
+            summary: "Call a tool for an MCP app shown in a chat",
+            description:
+                "Calls one tool of the connected MCP server whose app a chat is showing, on behalf of a reader using that app. Only a tool the server marks as callable by its app is answered, and only on the server the page was shown for. The answer goes back to the app, not to the agent.",
+        })
+        .input(PageAppCallSchema)
+        .output(PageAppCallResultSchema),
+    reportErrors: procedure
+        .route({
+            method: "POST",
+            path: "/pages/errors",
+            summary: "Tell the agent that a page it showed threw",
+            description:
+                "Hands the uncaught errors a page's own scripts threw in a reader's chat to the agent that showed it, as the sandbox's notice inside that agent's running turn, so it fixes the page and draws it again. Only the turn that showed the page hears it, once per drawing, and never for an MCP server's app; afterwards nothing is said, and the reader can ask from the page's own line.",
+        })
+        .input(PageErrorsSchema)
+        .output(PageErrorsResultSchema),
+};

package/src/contracts/phone.contract.ts

@@ -0,0 +1,21 @@
+import { oc } from "@orpc/contract";
+import { z } from "zod";
+import { PhoneFactsSchema, PhoneScopesSchema } from "../schemas/phone.js";
+import { OkSchema } from "../schemas/shared.js";
+
+// What a connected phone can be asked, over the socket its app opened; the phone answers, the daemon asks, inverted
+// as every peer door is, since a phone cannot be dialled. Carried as JSON-RPC rather than oRPC frames
+// (protocol/doors/phone-protocol.ts says why); each key here is a JSON-RPC method name.
+// `mcp` stays one opaque procedure so the app can gain a tool without a matching daemon release.
+export const phoneContract = {
+    // Refetched on connect and each card read: the person changes the app's access in Android's settings, not here.
+    describe: oc.output(PhoneFactsSchema),
+    // Pushed on connect and on every card edit; enforced by the app, never checked here. The daemon sends the card's
+    // whole config, so its `platform` is accepted and ignored. Not strict, unlike a computer's: the app ships on its own
+    // schedule, and it reads a switch it does not know as off rather than refusing the grant and dropping the link.
+    setScopes: oc.input(PhoneScopesSchema.extend({ platform: z.string().optional() })).output(OkSchema),
+    // Liveness and keepalive; a failure means the phone went away, not that it is merely quiet.
+    ping: oc.output(OkSchema),
+    // One MCP JSON-RPC message forwarded verbatim in both directions.
+    mcp: oc.input(z.unknown()).output(z.unknown()),
+};

package/src/contracts/privacy.contract.ts

@@ -6,6 +6,7 @@ import {
     PrivacyKnownSourceSchema,
     PrivacyKnownValueSchema,
     PrivacyLedgerEntrySchema,
+    PrivacyRevealSchema,
     PrivacyShieldPolicySchema,
     PrivacyShieldStatusSchema,
 } from "../schemas/privacy.js";
@@ -42,9 +43,20 @@ export const privacyContract = {
             path: "/privacy/log",
             summary: "What the privacy shield did lately",
             description:
-                "Each model request the gateway handled: which provider, whether it was trusted, and how many of each kind of personal data it found. Never the values.",
+                "Each model request the gateway handled: which provider, whether it was trusted, how many of each kind of personal data it found, and the tokens it gave with the masked text around them. Never the values.",
         })
         .output(z.array(PrivacyLedgerEntrySchema)),
+    reveal: procedure
+        .route({
+            method: "POST",
+            path: "/privacy/reveal",
+            summary: "Read tokens back to their values",
+            description:
+                "The value each token stands for, from the vault, so the owner can check what the shield masked and spot a value it should have left alone. Only the owner may ask; a token the vault never gave out is left out.",
+        })
+        .meta({ floor: "owner", control: "never", panel: false })
+        .input(PrivacyRevealSchema)
+        .output(z.record(z.string(), z.string())),
     dictionary: procedure
         .route({
             method: "GET",

package/src/contracts/runner.contract.ts

@@ -2,7 +2,7 @@ import { oc } from "@orpc/contract";
 import { streamOf } from "../protocol/routes.js";
 import { z } from "zod";
 import { AgentEventSchema } from "../events/agent-events.js";
-import { RunnerCommandFrameSchema, RunnerCommandSchema, RunnerFactsSchema, RunnerSyncLineSchema, RunnerSyncSchema, RunnerTurnSchema } from "../protocol/runner-protocol.js";
+import { RunnerCommandFrameSchema, RunnerCommandSchema, RunnerFactsSchema, RunnerSyncLineSchema, RunnerSyncSchema, RunnerTurnSchema } from "../protocol/doors/runner-protocol.js";
 import { EditorContextSchema } from "../schemas/agent.js";
 import { AgentReplySchema } from "../schemas/providers/plan-limits.js";
 import { OkSchema } from "../schemas/shared.js";