@intentic/sandbox-contract 1.325.0 → 1.327.0

package/src/index.ts

@@ -1,6 +1,6 @@
 import { getEventIteratorSchemaDetails, isContractProcedure } from "@orpc/contract";
 import type { z } from "zod";
-import { RAW_ROUTE_LIST } from "./protocol/raw-routes.js";
+import { RAW_ROUTE_LIST } from "./protocol/raw/raw-routes.js";
 import type { ContractRoute } from "./protocol/routes.js";
 import { contractRoutes, requestPathFor, routeForProcedure, routeNameForRequest, routeShapes, servedRoute } from "./protocol/routes.js";
 import { accountsContract } from "./contracts/accounts.contract.js";
@@ -25,6 +25,7 @@ import { inventoryContract } from "./contracts/inventory.contract.js";
 import { issuesContract } from "./contracts/issues.contract.js";
 import { logsContract } from "./contracts/logs.contract.js";
 import { loopsContract } from "./contracts/loops.contract.js";
+import { pagesContract } from "./contracts/pages.contract.js";
 import { panelsContract } from "./contracts/panels.contract.js";
 import { portsContract } from "./contracts/ports.contract.js";
 import { publicContract } from "./contracts/public.contract.js";
@@ -59,12 +60,12 @@ export { choresContract } from "./contracts/chores.contract.js";
 export { ciContract } from "./contracts/ci.contract.js";
 export {
     endpointsContract,
-    type LocalModelDevice,
-    LocalModelDeviceSchema,
+    type HostModelServer,
+    HostModelServerSchema,
+    type HostModelServers,
+    HostModelServersSchema,
     LocalModelFitSchema,
     type LocalModelFitResponse,
-    type LocalModelGpu,
-    LocalModelGpuSchema,
     type LocalModelPrefetch,
     LocalModelPrefetchSchema,
     type TrialHealth,
@@ -81,18 +82,21 @@ export { historyContract } from "./contracts/history.contract.js";
 export { deviceContract } from "./contracts/device.contract.js";
 // Same inversion, spoken over a browser extension's socket, with the extension implementing it.
 export { webextContract } from "./contracts/webext.contract.js";
+// Same inversion, spoken over a phone app's socket as JSON-RPC (protocol/doors/phone-protocol.ts), with the app implementing it.
+export { phoneContract } from "./contracts/phone.contract.js";
 // Same inversion again: spoken over a runner's WebSocket, with the runner implementing it.
 export { runnerContract } from "./contracts/runner.contract.js";
 export { intenticContract } from "./contracts/intentic.contract.js";
 export { inventoryContract } from "./contracts/inventory.contract.js";
 export { issuesContract } from "./contracts/issues.contract.js";
 export { logsContract } from "./contracts/logs.contract.js";
-export { REQUEST_ID_HEADER } from "./protocol/request-id.js";
+export { CONNECT_TOKEN_HEADER, EXTENSION_TOKEN_HEADER, REQUEST_ID_HEADER } from "./protocol/headers.js";
 export * from "./protocol/edge-verdict.js";
 export * from "./protocol/vitals.js";
 export { loopsContract } from "./contracts/loops.contract.js";
 export { panelsContract } from "./contracts/panels.contract.js";
 export { portsContract } from "./contracts/ports.contract.js";
+export { pagesContract, PageAppCallResultSchema, PageAppCallSchema, PageErrorsResultSchema, PageErrorsSchema } from "./contracts/pages.contract.js";
 export { publicContract } from "./contracts/public.contract.js";
 export { providersContract, type RunnableProviders, RunnableProvidersSchema } from "./contracts/providers.contract.js";
 export { pushContract } from "./contracts/push.contract.js";
@@ -130,10 +134,13 @@ export * from "./policy/request-status.js";
 export * from "./events/child-run.js";
 export * from "./policy/turned-away.js";
 export * from "./text/mentions.js";
+export * from "./text/pages.js";
 export * from "./protocol/sse.js";
 export * from "./protocol/routes.js";
 export { type ControlReach, defaultFloor, type RouteAccess, type RouteMeta, routeAccess } from "./protocol/route-meta.js";
-export { RAW_ROUTE_LIST, RAW_ROUTES, type RawRouteKey, rawRoutePath } from "./protocol/raw-routes.js";
+export { RAW_ROUTE_LIST, RAW_ROUTES, type RawRouteKey, type RawRouteParams, rawRoutePath, rawRouteUrl } from "./protocol/raw/raw-routes.js";
+export * from "./protocol/raw/raw-json-routes.js";
+export { fillRoutePath, type RoutePathParams } from "./protocol/raw/route-path.js";
 export { tunnelBulkRoutes } from "./protocol/tunnel-bulk.js";
 export type { SandboxCallInput, SandboxGroup, SandboxHandlerInput, SandboxHandlerOutput, SandboxProcedure } from "./protocol/procedure-types.js";
 export * from "./policy/control-scopes.js";
@@ -161,13 +168,16 @@ export * from "./policy/capability-secrets.js";
 export * from "./policy/secret-hosts.js";
 export * from "./ids/conversation-ids.js";
 export * from "./text/documents.js";
-export * from "./protocol/host-protocol.js";
-export * from "./protocol/webext-protocol.js";
-export * from "./protocol/webext-links.js";
-export * from "./protocol/runner-protocol.js";
-export * from "./protocol/listener-protocol.js";
+export * from "./protocol/doors/host-protocol.js";
+export * from "./protocol/doors/webext-protocol.js";
+export * from "./protocol/doors/webext-links.js";
+export * from "./protocol/doors/phone-protocol.js";
+export * from "./protocol/doors/phone-links.js";
+export * from "./protocol/doors/runner-protocol.js";
+export * from "./protocol/doors/listener-protocol.js";
 export * from "./protocol/container-requirements.js";
 export * from "./ids/hostnames.js";
+export { SANDBOX_ID } from "./ids/sandbox-id.js";
 export * from "./ids/project-dir.js";
 export * from "./policy/overlay-lint.js";
 export * from "./models/model-label.js";
@@ -180,6 +190,7 @@ export * from "./text/path-refs.js";
 export * from "./text/archives.js";
 export * from "./policy/output-fields.js";
 export * from "./policy/approvals-execution.js";
+export * from "./policy/message-limits.js";
 // Wire shapes, one module per subject area, mirroring `contracts/`; a `{param}` in the route path merges into the same
 // flat object, split back into path/body/query. `schemas/internal.ts` is absent: it's vocabulary, not a wire shape.
 export * from "./schemas/activity.js";
@@ -191,6 +202,7 @@ export * from "./schemas/agents.js";
 export * from "./schemas/speaker.js";
 export * from "./schemas/approvals.js";
 export * from "./schemas/automations.js";
+export * from "./schemas/agents-list.js";
 export * from "./schemas/capabilities.js";
 export * from "./schemas/chat-route.js";
 export * from "./schemas/ci.js";
@@ -198,6 +210,7 @@ export * from "./schemas/providers/claude-gate.js";
 export * from "./schemas/codebase-health.js";
 export * from "./schemas/context-trim.js";
 export * from "./schemas/devices.js";
+export * from "./schemas/project-delivery.js";
 export * from "./schemas/engines.js";
 export * from "./schemas/environment.js";
 export * from "./schemas/exit.js";
@@ -209,6 +222,7 @@ export * from "./schemas/git/git-history.js";
 export * from "./schemas/history.js";
 export * from "./schemas/hosts.js";
 export * from "./schemas/loopback-catch.js";
+export * from "./schemas/peer-enrollment.js";
 export * from "./schemas/intentic.js";
 export * from "./schemas/inventory.js";
 export * from "./schemas/issues.js";
@@ -216,6 +230,7 @@ export * from "./schemas/logs.js";
 export * from "./schemas/loops.js";
 export * from "./schemas/maintenance.js";
 export * from "./schemas/marketplace.js";
+export * from "./schemas/members.js";
 export * from "./schemas/metrics.js";
 export * from "./schemas/panels.js";
 export * from "./schemas/personas.js";
@@ -247,6 +262,7 @@ export * from "./schemas/providers/usage.js";
 export * from "./schemas/vpn.js";
 export * from "./schemas/offload.js";
 export * from "./schemas/webext.js";
+export * from "./schemas/phone.js";
 export * from "./schemas/workflows.js";
 export * from "./schemas/workspace/workspace-repos.js";
 export * from "./schemas/workspace/workspace-search.js";
@@ -296,6 +312,7 @@ export const sandboxContract = {
     issues: issuesContract,
     logs: logsContract,
     loops: loopsContract,
+    pages: pagesContract,
     panels: panelsContract,
     ports: portsContract,
     public: publicContract,

package/src/models/agent-catalog.ts

@@ -42,9 +42,8 @@ export const isTrialProvider = (provider: AgentProvider): boolean => provider ==
 
 // A synthetic id, never changing; which real model answers is decided per message by the platform alone.
 export const TRIAL_MODEL_ID = "auto";
-// One wording for both the picker's label and the composer's notice, so they can't describe different bargains.
+// What the daemon and the trial endpoint call the free trial; the web says it in the reader's language.
 export const TRIAL_LABEL = "Free trial";
-export const TRIAL_NOTICE = "Trial messages pass through intentic. Connect an account to chat directly.";
 
 export const ENDPOINT_PROVIDER_PREFIX = "endpoint/";
 export const endpointProvider = (id: string): AgentProvider => `${ENDPOINT_PROVIDER_PREFIX}${id}`;

package/src/models/agent-runtimes.ts

@@ -52,10 +52,13 @@ export interface AgentCapabilities {
     // Whether a credential is masked; "none" is structural, only the Claude Code loop can rewrite a model's read.
     readonly secrets: "masked" | "none";
     // Whether the privacy shield can stand between this loop and its provider: `gateway` when the daemon names the base
-    // URL the loop sends its model requests to (so the gateway reads and masks every byte of them), `none` when the loop
-    // talks to its provider on a wire or a configuration the daemon does not own. A `none` loop on an untrusted provider
-    // is refused while the shield is on.
-    readonly privacy: "gateway" | "none";
+    // URL the loop sends its model requests to (so the gateway reads and masks every byte of them); `hooks` when the wire
+    // is the vendor's own but every channel the model reads through passes the daemon first (the prompt and instructions
+    // it hands over, a hook in front of each file read, a shell whose output the daemon masks, MCP behind the masking
+    // proxy), so the shield reads by content there too; `none` when the loop talks to its provider on a wire or a
+    // configuration the daemon does not own and reads files it never sees. Only a `none` loop on an untrusted provider is
+    // refused while the shield is on.
+    readonly privacy: "gateway" | "hooks" | "none";
 }
 
 // The Claude Code Agent SDK loop, the ceiling every other runtime is measured against: the only one that owns the whole
@@ -234,6 +237,9 @@ export const CURSOR: AgentCapabilities = {
     rulebook: "hooks",
     // none, structurally: its hooks only allow/deny or are discarded, nothing here to substitute a reference into.
     secrets: "none",
-    // Cursor's own RPC to its own servers, which then reach the model: redirectable, not readable.
-    privacy: "none",
+    // Cursor's own RPC to its own servers, so no gateway; but the daemon owns every channel the model reads through:
+    // it hands over the prompt and instructions, its hooks stand before each file read and rewrite each shell command
+    // to mask the output, the tools that read past both (grep, ls, glob, semantic search, fetch, lints) are withheld,
+    // and MCP goes through the masking proxy (runtimes/cursor/cursor-shield.ts).
+    privacy: "hooks",
 };

package/src/models/provider-specs.test.ts

@@ -7,6 +7,7 @@ import {
     mintedVariant,
     mintedVariants,
     NATIVE_PROVIDERS,
+    nativeProvidersIn,
     PROVIDER_SPECS,
     providerSpec,
 } from "./provider-specs.js";
@@ -124,3 +125,14 @@ test("an id that is not a provider resolves to nothing", () => {
         expect(mintedVariant(id), id).toBeUndefined();
     }
 });
+
+// The desktop app's `?found=claude,codex`: what it found signed in on the computer, read back as providers.
+test("a list of ids names known providers once each, in its own order", () => {
+    expect(nativeProvidersIn("codex,claude")).toEqual(["codex", "claude"]);
+    // Unknown ids, blanks and repeats are dropped rather than refusing the whole list.
+    expect(nativeProvidersIn(" claude , ,nope,endpoint/x,claude,gemini")).toEqual(["claude", "gemini"]);
+    // A repeated query key, as a router hands it back, and a bare `?found`.
+    expect(nativeProvidersIn(["codex", null, "cursor"])).toEqual(["codex", "cursor"]);
+    expect(nativeProvidersIn(null)).toEqual([]);
+    expect(nativeProvidersIn(undefined)).toEqual([]);
+});

package/src/models/provider-specs.ts

@@ -233,6 +233,22 @@ const BY_ID = new Map<string, ProviderSpec>(PROVIDER_SPECS.map((spec) => [spec.i
 // surface goes through.
 export const providerSpec = (provider: string): ProviderSpec | undefined => BY_ID.get(provider);
 
+// The native providers a list of ids names, in its order and once each; anything else in it (an endpoint, a typo, a
+// provider a newer build knows) is dropped rather than refusing the list. Takes a comma-separated string or an array of
+// them, the way a query string hands it over: the desktop app's `?found=claude,codex` names the providers it found
+// signed in on the computer it runs on.
+export const nativeProvidersIn = (value: string | readonly (string | null)[] | null | undefined): NativeProvider[] => {
+    const raw = [value].flat().filter((entry) => entry !== null && entry !== undefined);
+    const found: NativeProvider[] = [];
+    for (const id of raw.flatMap((entry) => entry.split(",")).map((entry) => entry.trim())) {
+        const provider = NATIVE_PROVIDERS.find((candidate) => candidate === id);
+        if (provider !== undefined && !found.includes(provider)) {
+            found.push(provider);
+        }
+    }
+    return found;
+};
+
 // Providers whose model runs under Claude Code through the bundled translator (CLIProxyAPI); claude is absent, native
 // Anthropic OAuth serves it directly. Narrowed off the auth kind so tables built on this move with it.
 export type TranslatorProvider = Extract<Spec, { auth: { kind: "translator" } }>["id"];

package/src/{front → netd}/browser-wire.ts

@@ -1,4 +1,4 @@
-// Everything a browser sees of a sandbox's front and of the edge in front of it, outside the daemon's oRPC contract. The
+// Everything a browser sees of a sandbox's netd and of the edge in front of it, outside the daemon's oRPC contract. The
 // Rust crates are the definition (`browser-wire`, and `tunnel` for what the edge declares): their types arrive as
 // TypeScript in generated/, and every value here is held to the manifest they write beside it (wire-manifests.test.ts),
 // which contract.lock.json pins.

package/src/{front → netd}/generated/browser-wire.json

@@ -71,7 +71,7 @@
           "type": "object"
         },
         {
-          "description": "The client's liveness, the socket's only one: the editor sends one every 30 s and calls the socket stale after\n90 s without a frame. The front answers `pong`, sends a WebSocket ping only to a client silent for 45 s, and closes\none silent for 90.",
+          "description": "The client's liveness, the socket's only one: the editor sends one every 30 s and calls the socket stale after\n90 s without a frame. netd answers `pong`, sends a WebSocket ping only to a client silent for 45 s, and closes\none silent for 90.",
           "properties": {
             "type": {
               "const": "ping",
@@ -162,7 +162,7 @@
     "body": {
       "$defs": {
         "NodeLink": {
-          "description": "Where the front's control link to Node stands.",
+          "description": "Where netd's control link to Node stands.",
           "oneOf": [
             {
               "const": "starting",
@@ -176,7 +176,7 @@
             },
             {
               "const": "restarting",
-              "description": "Node was up or was restarted before, and is not up now: its link dropped, or its process exited and the front is\nstarting it again.",
+              "description": "Node was up or was restarted before, and is not up now: its link dropped, or its process exited and netd is\nstarting it again.",
               "type": "string"
             }
           ]
@@ -203,12 +203,73 @@
             "io"
           ],
           "type": "object"
+        },
+        "TunnelState": {
+          "description": "Where netd's tunnel stands.",
+          "oneOf": [
+            {
+              "const": "off",
+              "description": "No tunnel is configured: the sandbox is reachable on loopback only.",
+              "type": "string"
+            },
+            {
+              "const": "dialling",
+              "description": "Configured and not held right now: dialling, or waiting to redial.",
+              "type": "string"
+            },
+            {
+              "const": "held",
+              "description": "The edge holds the interactive socket.",
+              "type": "string"
+            },
+            {
+              "const": "elsewhere",
+              "description": "Another copy of this sandbox holds the tunnel, and the edge refused this one three times in a row; netd\ndials every 15 minutes meanwhile.",
+              "type": "string"
+            },
+            {
+              "const": "deleted",
+              "description": "The platform deleted this sandbox, and netd stopped dialling.",
+              "type": "string"
+            }
+          ]
+        },
+        "TunnelVitals": {
+          "description": "The ingress tunnel as netd holds it: the interactive socket, which every request can ride, and QUIC beside it.",
+          "properties": {
+            "dropsLastHour": {
+              "description": "How many times a registered interactive socket dropped in the last hour.",
+              "format": "uint32",
+              "minimum": 0,
+              "type": "integer"
+            },
+            "holder": {
+              "description": "Where the copy holding this sandbox's tunnel runs, as the edge named it, while `state` is `elsewhere`.",
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "quic": {
+              "description": "Whether a QUIC connection is held beside the socket.",
+              "type": "boolean"
+            },
+            "state": {
+              "$ref": "#/$defs/TunnelState"
+            }
+          },
+          "required": [
+            "state",
+            "dropsLastHour",
+            "quic"
+          ],
+          "type": "object"
         }
       },
-      "description": "The sandbox's proof of life, measured by the front and answered by it at [`VITALS_PATH`] whatever state Node is in:\nthe daemon's own heartbeat rides Node's event loop, so a sandbox busy enough to starve it would otherwise look dead.\nIt carries nothing of the workspace.",
+      "description": "The sandbox's proof of life, measured by netd and answered by it at [`VITALS_PATH`] whatever state Node is in:\nthe daemon's own heartbeat rides Node's event loop, so a sandbox busy enough to starve it would otherwise look dead.\nIt carries nothing of the workspace.",
       "properties": {
         "lagMs": {
-          "description": "How long Node's event loop takes to answer the front, in milliseconds: the round trip of the last ping it\nanswered, or how long the one outstanding has waited when that is longer. The front pings every 2 s, only once\nthe previous ping is answered. Null before the first ping, and while Node is not `up`.",
+          "description": "How long Node's event loop takes to answer netd, in milliseconds: the round trip of the last ping it\nanswered, or how long the one outstanding has waited when that is longer. netd pings every 2 s, only once\nthe previous ping is answered. Null before the first ping, and while Node is not `up`.",
           "format": "uint32",
           "minimum": 0,
           "type": [
@@ -231,13 +292,24 @@
           "description": "The container's pressure stall; null where the cgroup's pressure files cannot be read."
         },
         "restarts": {
-          "description": "How many times the front restarted Node in the last 10 minutes.",
+          "description": "How many times netd restarted Node in the last 10 minutes.",
           "format": "uint32",
           "minimum": 0,
           "type": "integer"
         },
+        "tunnel": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/TunnelVitals"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Where the ingress tunnel stands and how often it dropped (2026-10-05: a tunnel that dropped once a minute for\nfour hours was counted nowhere). Absent from an older netd."
+        },
         "uptimeS": {
-          "description": "Seconds since the front, and so the container, started.",
+          "description": "Seconds since netd, and so the container, started.",
           "format": "uint32",
           "minimum": 0,
           "type": "integer"
@@ -251,6 +323,7 @@
       "title": "SandboxVitals",
       "type": "object"
     },
+    "file": "/run/intentic/vitals.json",
     "path": "/system/vitals"
   },
   "webTransport": {

package/src/{front → netd}/generated/browser-wire.ts

@@ -6,7 +6,7 @@
 export type EdgeVerdict = "no-tunnel" | "unknown-sandbox" | "dropped";
 
 /**
- * Where the front's control link to Node stands.
+ * Where netd's control link to Node stands.
  */
 export type NodeLink = "starting" | "up" | "restarting";
 
@@ -17,29 +17,34 @@ export type NodeLink = "starting" | "up" | "restarting";
 export type Pressure = { cpu: number, memory: number, io: number, };
 
 /**
- * The sandbox's proof of life, measured by the front and answered by it at [`VITALS_PATH`] whatever state Node is in:
+ * The sandbox's proof of life, measured by netd and answered by it at [`VITALS_PATH`] whatever state Node is in:
  * the daemon's own heartbeat rides Node's event loop, so a sandbox busy enough to starve it would otherwise look dead.
  * It carries nothing of the workspace.
  */
 export type SandboxVitals = { node: NodeLink, 
 /**
- * How long Node's event loop takes to answer the front, in milliseconds: the round trip of the last ping it
- * answered, or how long the one outstanding has waited when that is longer. The front pings every 2 s, only once
+ * How long Node's event loop takes to answer netd, in milliseconds: the round trip of the last ping it
+ * answered, or how long the one outstanding has waited when that is longer. netd pings every 2 s, only once
  * the previous ping is answered. Null before the first ping, and while Node is not `up`.
  */
 lagMs: number | null, 
 /**
- * How many times the front restarted Node in the last 10 minutes.
+ * How many times netd restarted Node in the last 10 minutes.
  */
 restarts: number, 
 /**
- * Seconds since the front, and so the container, started.
+ * Seconds since netd, and so the container, started.
  */
 uptimeS: number, 
 /**
  * The container's pressure stall; null where the cgroup's pressure files cannot be read.
  */
-pressure: Pressure | null, };
+pressure: Pressure | null, 
+/**
+ * Where the ingress tunnel stands and how often it dropped (2026-10-05: a tunnel that dropped once a minute for
+ * four hours was counted nowhere). Absent from an older netd.
+ */
+tunnel?: TunnelVitals, };
 
 /**
  * What the browser sends on a terminal socket, each a JSON text message.
@@ -50,3 +55,25 @@ export type TerminalClientMessage = { "type": "input", data: string, } | { "type
  * What a terminal socket sends as JSON text; the pane's own bytes travel as binary messages.
  */
 export type TerminalServerMessage = { "type": "grid", cols: number, rows: number, } | { "type": "exit", code: number, reason?: string, } | { "type": "pong" };
+
+/**
+ * Where netd's tunnel stands.
+ */
+export type TunnelState = "off" | "dialling" | "held" | "elsewhere" | "deleted";
+
+/**
+ * The ingress tunnel as netd holds it: the interactive socket, which every request can ride, and QUIC beside it.
+ */
+export type TunnelVitals = { state: TunnelState, 
+/**
+ * How many times a registered interactive socket dropped in the last hour.
+ */
+dropsLastHour: number, 
+/**
+ * Where the copy holding this sandbox's tunnel runs, as the edge named it, while `state` is `elsewhere`.
+ */
+holder?: string, 
+/**
+ * Whether a QUIC connection is held beside the socket.
+ */
+quic: boolean, };