@intentic/sandbox-contract 1.328.0 → 1.330.0

package/src/index.ts

@@ -28,6 +28,7 @@ import { loopsContract } from "./contracts/loops.contract.js";
 import { pagesContract } from "./contracts/pages.contract.js";
 import { panelsContract } from "./contracts/panels.contract.js";
 import { portsContract } from "./contracts/ports.contract.js";
+import { runsContract } from "./contracts/runs.contract.js";
 import { publicContract } from "./contracts/public.contract.js";
 import { netdiskContract } from "./contracts/netdisk.contract.js";
 import { providersContract } from "./contracts/providers.contract.js";
@@ -96,6 +97,7 @@ export * from "./protocol/vitals.js";
 export { loopsContract } from "./contracts/loops.contract.js";
 export { panelsContract } from "./contracts/panels.contract.js";
 export { portsContract } from "./contracts/ports.contract.js";
+export { runsContract } from "./contracts/runs.contract.js";
 export { pagesContract, PageAppCallResultSchema, PageAppCallSchema, PageErrorsResultSchema, PageErrorsSchema } from "./contracts/pages.contract.js";
 export { publicContract } from "./contracts/public.contract.js";
 export { providersContract, type RunnableProviders, RunnableProvidersSchema } from "./contracts/providers.contract.js";
@@ -135,6 +137,7 @@ export * from "./events/child-run.js";
 export * from "./policy/turned-away.js";
 export * from "./text/mentions.js";
 export * from "./text/pages.js";
+export * from "./text/transcript-page.js";
 export * from "./protocol/sse.js";
 export * from "./protocol/routes.js";
 export { type ControlReach, defaultFloor, type RouteAccess, type RouteMeta, routeAccess } from "./protocol/route-meta.js";
@@ -200,6 +203,7 @@ export * from "./policy/fence-paths.js";
 export * from "./policy/persona-home.js";
 export * from "./schemas/agents.js";
 export * from "./schemas/speaker.js";
+export * from "./schemas/speech.js";
 export * from "./schemas/approvals.js";
 export * from "./schemas/automations.js";
 export * from "./schemas/agents-list.js";
@@ -211,6 +215,8 @@ export * from "./schemas/codebase-health.js";
 export * from "./schemas/context-trim.js";
 export * from "./schemas/devices.js";
 export * from "./schemas/project-delivery.js";
+export * from "./schemas/device-artifacts.js";
+export * from "./schemas/run-targets.js";
 export * from "./schemas/engines.js";
 export * from "./schemas/environment.js";
 export * from "./schemas/exit.js";
@@ -264,6 +270,7 @@ export * from "./schemas/offload.js";
 export * from "./schemas/webext.js";
 export * from "./schemas/phone.js";
 export * from "./schemas/workflows.js";
+export * from "./schemas/workspace/workspace-graph.js";
 export * from "./schemas/workspace/workspace-repos.js";
 export * from "./schemas/workspace/workspace-search.js";
 export * from "./schemas/workspace/workspace-setup.js";
@@ -276,7 +283,6 @@ export * from "./text/title.js";
 export * from "./state/versions.js";
 export * from "./text/model-answer.js";
 export * from "./text/shell-regions.js";
-export * from "./text/whisper.js";
 export * from "./text/workflow-faults.js";
 export * from "./text/emoji.js";
 export * from "./time/zone.js";
@@ -315,6 +321,7 @@ export const sandboxContract = {
     pages: pagesContract,
     panels: panelsContract,
     ports: portsContract,
+    runs: runsContract,
     public: publicContract,
     providers: providersContract,
     push: pushContract,

package/src/models/agent-runtimes.ts

@@ -121,7 +121,7 @@ export const OPENCODE: AgentCapabilities = {
     steering: false,
     permissions: "plan",
     questions: false,
-    // Added at runtime under the conversation's own names, each prompt showing its session only its own (opencode-mcp.ts).
+    // Added at runtime under the conversation's own names, each session's own rules showing it only its own (opencode-mcp.ts).
     mcp: "http",
     execution: ["shell"],
     effort: false,
@@ -131,7 +131,7 @@ export const OPENCODE: AgentCapabilities = {
     terminals: false,
     recovery: false,
     warm: false,
-    // `system` on the prompt body, per message; adds to OpenCode's own prompt, with no seam to replace it.
+    // The session's own instruction entry, set per message; adds to OpenCode's own prompt, with no seam to replace it.
     instructions: "append",
     skillDiscovery: "prompt",
     // OpenCode raises its permission asks for the commands its config names; the daemon answers from the rulebook, a

package/src/protocol/doors/listener-protocol.ts

@@ -9,7 +9,9 @@ import { rawRouteUrl } from "../raw/raw-routes.js";
 // The path of one of the four listener routes for a provider, built from RAW_ROUTES so the gateway and the daemon
 // cannot spell it two ways.
 export const listenerRouteUrl = (route: "state" | "dispatch" | "failure" | "status", provider: string): string =>
-    route === "state" ? rawRouteUrl("GET /listeners/{provider}/state", { provider }) : rawRouteUrl(`POST /listeners/{provider}/${route}`, { provider });
+    route === "state"
+        ? rawRouteUrl("GET /listeners/{provider}/state", { provider })
+        : rawRouteUrl(`POST /listeners/{provider}/${route}`, { provider });
 
 // The reconcile feed GET /listeners/<provider>/state answers: the enabled automations listening to this provider and
 // the connectors the asking extension contributes, each with its whole config, secrets included, since the gateway
@@ -86,10 +88,9 @@ export const ListenerPairingSchema = z.object({
 export type ListenerPairing = z.infer<typeof ListenerPairingSchema>;
 
 // Push-based status: a gateway POSTs its connection/voice snapshot to /listeners/<provider>/status, since the daemon
-// holds no provider connection to probe itself. Extends ActivityStatus with whisper's voice-pending flag and each
-// unpaired capability's pairing ceremony by id.
+// holds no provider connection to probe itself. Extends ActivityStatus with each unpaired capability's pairing ceremony
+// by id.
 export const ListenerStatusSchema = ActivityStatusSchema.extend({
-    whisperReady: z.boolean().optional(),
     pairing: z.record(z.string(), ListenerPairingSchema).optional(),
 });
 export type ListenerStatus = z.infer<typeof ListenerStatusSchema>;

package/src/protocol/raw/raw-routes.ts

@@ -16,7 +16,11 @@ export const RAW_ROUTES = {
     "GET /diff/raw": { lane: "bulk" },
     // Arming the dictation model is a read any tier makes; dictating is writing a message, the collaborator's grant.
     "GET /speech/status": { guest: true },
+    "POST /speech/prepare": { guest: true },
     "POST /speech/transcribe": { floor: "collaborator", guest: true },
+    // The live phrase stream (schemas/speech.ts): a WebSocket, so the query ticket, floored at the collaborator in the
+    // handler like the transcribe it streams.
+    "GET /speech/stream": { auth: "door" },
     // The bytes behind the workspace reads; each applies the caller's fence itself.
     "GET /workspace/raw": { guest: true, lane: "bulk" },
     // No door, unlike media: the page fetches a thumbnail itself, so the request carries the header.
@@ -124,6 +128,17 @@ export const RAW_ROUTES = {
     "GET /fleet": { agent: true },
     "POST /fleet/message": { agent: true },
     "GET /fleet/{handle}": { agent: true },
+    // The `devices push` CLI: a program the agent built, carried to one of the owner's computers in chunks; held to the
+    // devices the calling conversation's turn mounts, and refused by the machine itself unless "Run programs" is on.
+    "POST /devices/{name}/artifacts": { agent: true, control: "never" },
+    // The rest of the `devices` command, held to the same rule (hosts/device-door.routes.ts): the device's app_start for a
+    // shell, and its loopback ports reached from the sandbox (hosts/device-tunnels.ts).
+    "POST /devices/{name}/apps": { agent: true, control: "never" },
+    "POST /devices/{name}/tunnels": { agent: true, control: "never" },
+    "DELETE /devices/{name}/tunnels/{port}": { agent: true, control: "never" },
+    "GET /devices/tunnels": { agent: true },
+    // Where a device dials back with a tunnel's one-time ticket; the ticket is the whole credential, checked by the route.
+    "GET /system/hosts/tunnel": { auth: "door", control: "never" },
     // An extension gateway's realtime-listener control: /state hands back its connectors' stored credentials, so only the
     // extension token of the extension declaring that `listener.provider` reaches them, checked in the handler too.
     "GET /listeners/{provider}/state": { floor: "maintainer", panel: false, control: "never" },

package/src/schemas/agents.ts

@@ -3,7 +3,7 @@ import { LandingDeliverySchema } from "./project-delivery.js";
 import { z } from "zod";
 import { AgentHarnessSchema, AgentOriginSchema, AgentProviderSchema, ConversationQueueSchema, ForkedFromSchema } from "./agent.js";
 import { LoopStateSchema } from "./loops.js";
-import { LimitPolicySchema, RetryPolicySchema, TurnBreakPolicySchema, TurnBreakSchema } from "./turn-break.js";
+import { LimitPolicySchema, RetryPolicySchema, RoomPolicySchema, TurnBreakPolicySchema, TurnBreakSchema } from "./turn-break.js";
 import { KeepWarmSchema } from "./keep-warm.js";
 import { AgentNeedSchema } from "./needs.js";
 import { EMOJI_MAX_LENGTH, isSingleEmoji } from "../text/emoji.js";
@@ -362,6 +362,7 @@ export const AgentSummarySchema = z.object({
     limitPolicy: LimitPolicySchema.optional(),
     outagePolicy: RetryPolicySchema.optional(),
     stopPolicy: RetryPolicySchema.optional(),
+    memoryPolicy: RoomPolicySchema.optional(),
     // A collaborator's ask to land (collaborators can't merge themselves); cleared by whichever merge or discard
     // answers it.
     landRequested: z
@@ -907,9 +908,11 @@ export const AgentUnsentSchema = z.object({
 // verbs is how the surfaces drifted apart in the first place.
 export const AgentBreakPolicySchema = z.object({
     id: z.string().min(1).describe("Which conversation."),
-    ending: TurnBreakSchema.describe("Which wall this answers for: a spent usage limit, a provider outage, or a turn that stopped short."),
+    ending: TurnBreakSchema.describe(
+        "Which wall this answers for: a spent usage limit, a provider outage, a turn that stopped short, or a message the sandbox held because it was short of memory.",
+    ),
     policy: TurnBreakPolicySchema.nullable().describe(
-        "What happens next for that ending. `wait` holds the turn for a press; `retry` re-runs it on a bounded ladder (outage, stop); `resend` sends it again at the published reset and `move` also tries another account with room (limit only). An answer the ending does not allow is refused. Null clears the override and goes back to following the sandbox-wide policy, so a conversation does not sit holding a frozen copy of a default it has quietly stopped following.",
+        "What happens next for that ending. `wait` holds the turn for a press; `retry` re-runs it on a bounded ladder (outage, stop); `resend` sends it again at the published reset (limit) or once memory frees up (memory), and `move` also tries another account with room (limit only). An answer the ending does not allow is refused. Null clears the override and goes back to following the sandbox-wide policy, so a conversation does not sit holding a frozen copy of a default it has quietly stopped following.",
     ),
 });
 export const AgentFileDiffQuerySchema = z.object({

package/src/schemas/capabilities.ts

@@ -215,6 +215,10 @@ export const DeviceScopesSchema = z.object({
     // Its own switch under `shell`, default off while `shell` defaults on: a laptop has no disposable image to recreate
     // from.
     destructive: hostScope.default("off"),
+    // Its own switch, default off: receiving a program this sandbox built (`devices push`) and running it under the
+    // agent's supervision (app_start). Narrower than `shell` in what it reaches and wider in what it trusts: the program
+    // is the sandbox's, not one already on the machine.
+    programs: hostScope.default("off"),
     // One directory per line. Empty ⇒ the machine's home directory, which is what the agent reports at connect.
     roots: z.string().optional(),
 });

package/src/schemas/device-artifacts.ts

@@ -0,0 +1,99 @@
+import { z } from "zod";
+
+// A PROGRAM THIS SANDBOX BUILT, CARRIED TO A CONNECTED COMPUTER TO RUN THERE (`devices push`, then the device's app_start).
+// The agent's CLI hands the daemon the bytes as the agent's own shell sees them; the daemon carries them over the device
+// link in chunks through `stageArtifact`, and the machine files them under its own runs folder, one folder per content
+// hash, so a second push of the same build is answered from what is already there and a running copy is never
+// overwritten. Behind the device's "Run programs this sandbox sends" switch (`programs`), checked on the machine.
+
+// One chunk's decoded size: small enough that a tunnel never sees a frame it would refuse, large enough that a 100 MB
+// build is fifty calls.
+export const ARTIFACT_CHUNK_BYTES = 2 * 1024 * 1024;
+// The most one push carries, decoded. A build bigger than this is a disk image, not a program to try.
+export const ARTIFACT_MAX_BYTES = 4 * 1024 * 1024 * 1024;
+
+const Sha256Schema = z.string().regex(/^[0-9a-f]{64}$/, "a lowercase hex sha256");
+// Names the folder a push lands in, so it is one plain path segment on every OS: no separators, no dots alone, nothing
+// Windows reserves.
+export const ArtifactNameSchema = z
+    .string()
+    .regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/, "letters, digits, dot, dash and underscore, starting with a letter or digit, at most 64");
+// The file's own name as it was in the sandbox, kept so a Windows program still ends in `.exe`.
+export const ArtifactFileNameSchema = z
+    .string()
+    .regex(/^[A-Za-z0-9 ._()+-]{1,200}$/, "a plain file name")
+    .refine((name) => name !== "." && name !== ".." && !name.endsWith(".") && !name.endsWith(" "), "a plain file name");
+// `file` is one file, filed as it is; `tar` a folder the CLI packed, unpacked on the machine.
+export const ArtifactKindSchema = z.enum(["file", "tar"]);
+export type ArtifactKind = z.infer<typeof ArtifactKindSchema>;
+const UploadIdSchema = z.string().regex(/^[0-9a-f]{32}$/);
+
+export const StageArtifactSchema = z.discriminatedUnion("op", [
+    // Whether this exact build is already staged here: the answer carries its path when it is, and nothing is sent.
+    z.object({ op: z.literal("have"), name: ArtifactNameSchema, sha256: Sha256Schema, kind: ArtifactKindSchema, fileName: ArtifactFileNameSchema }).strict(),
+    // One piece, at its offset; pieces arrive in order and a gap is refused.
+    z
+        .object({
+            op: z.literal("chunk"),
+            upload: UploadIdSchema,
+            offset: z.int().nonnegative(),
+            data: z.string().max(Math.ceil(ARTIFACT_CHUNK_BYTES / 3) * 4),
+        })
+        .strict(),
+    // The last word: the machine checks size and hash, then files it. A mismatch throws the upload away.
+    z
+        .object({
+            op: z.literal("commit"),
+            upload: UploadIdSchema,
+            name: ArtifactNameSchema,
+            kind: ArtifactKindSchema,
+            fileName: ArtifactFileNameSchema,
+            size: z.int().nonnegative().max(ARTIFACT_MAX_BYTES),
+            sha256: Sha256Schema,
+        })
+        .strict(),
+    // A push the daemon gave up on; what arrived is deleted.
+    z.object({ op: z.literal("abort"), upload: UploadIdSchema }).strict(),
+]);
+export type StageArtifact = z.infer<typeof StageArtifactSchema>;
+
+export const StageArtifactResultSchema = z.object({
+    // Where the build is on the machine: the file itself, or the folder a `tar` was unpacked into. Absent for a `have`
+    // that found nothing, a chunk and an abort.
+    path: z.string().optional(),
+    // How many bytes of this upload the machine holds, answered to every chunk.
+    received: z.int().nonnegative().optional(),
+});
+export type StageArtifactResult = z.infer<typeof StageArtifactResultSchema>;
+
+// What `POST /devices/{name}/artifacts` answers the CLI.
+export const PushedArtifactSchema = z.object({
+    device: z.string(),
+    path: z.string(),
+    size: z.int().nonnegative(),
+    sha256: Sha256Schema,
+    // True when the machine already had this exact build and nothing was sent.
+    reused: z.boolean(),
+});
+export type PushedArtifact = z.infer<typeof PushedArtifactSchema>;
+
+// A DEVICE'S LOOPBACK PORT, REACHED FROM THE SANDBOX (`devices reach`, hosts/device-tunnels.ts). The sandbox listens on
+// its own 127.0.0.1:<localPort>; each connection asks the device to dial its own 127.0.0.1:<devicePort> and open a
+// WebSocket back to /system/hosts/tunnel carrying the ticket below, and the two are pumped together.
+export const DialLoopbackSchema = z
+    .object({
+        ticket: z.string().regex(/^[0-9a-f]{48}$/),
+        port: z.int().min(1).max(65535),
+    })
+    .strict();
+export type DialLoopback = z.infer<typeof DialLoopbackSchema>;
+
+export const DeviceTunnelSchema = z.object({
+    device: z.string(),
+    devicePort: z.int().min(1).max(65535),
+    localPort: z.int().min(1).max(65535),
+    // What a program in the sandbox opens to reach the device's port.
+    url: z.string(),
+    openedAt: z.string(),
+});
+export type DeviceTunnel = z.infer<typeof DeviceTunnelSchema>;

package/src/schemas/hosts.ts

@@ -94,9 +94,11 @@ export type DeviceFacts = z.infer<typeof DeviceFactsSchema>;
 // - `background-prepare`: the `prepare-background` op, the next update downloaded under the unattended rules of the
 //   agent's own timer (`ic sandbox prepare --auto`), which the update card sends when it opens; advertised only when
 //   the agent's `ic sandbox prepare` takes `--auto`.
+// - `programs`: the `stageArtifact` procedure and the app_* tools, a program this sandbox built pushed to the machine and
+//   run under the agent's supervision (device-artifacts.ts); an agent without it is told to update rather than sent one.
 // - `project-delivery`: the `deliverProject` procedure, landed work written into a folder attached to this computer's
 //   sandbox (project-delivery.ts); an agent without it is never sent one, and the land waits for Bring back.
-export const DeviceFeatureSchema = z.enum(["reshape-later", "set-shape", "rollback-to", "loopback-catch", "background-prepare", "project-delivery"]);
+export const DeviceFeatureSchema = z.enum(["reshape-later", "set-shape", "rollback-to", "loopback-catch", "background-prepare", "project-delivery", "programs"]);
 export type DeviceFeature = z.infer<typeof DeviceFeatureSchema>;
 export const DEVICE_FEATURE_RESHAPE_LATER: DeviceFeature = "reshape-later";
 export const DEVICE_FEATURE_SET_SHAPE: DeviceFeature = "set-shape";
@@ -104,6 +106,7 @@ export const DEVICE_FEATURE_ROLLBACK_TO: DeviceFeature = "rollback-to";
 export const DEVICE_FEATURE_LOOPBACK_CATCH: DeviceFeature = "loopback-catch";
 export const DEVICE_FEATURE_BACKGROUND_PREPARE: DeviceFeature = "background-prepare";
 export const DEVICE_FEATURE_PROJECT_DELIVERY: DeviceFeature = "project-delivery";
+export const DEVICE_FEATURE_PROGRAMS: DeviceFeature = "programs";
 // The features an agent advertised that this build knows; an unknown one is a newer agent's and means nothing here.
 export const deviceFeatures = (facts: Pick<DeviceFacts, "features"> | undefined): DeviceFeature[] =>
     (facts?.features ?? []).flatMap((feature) => {

package/src/schemas/run-targets.ts

@@ -0,0 +1,93 @@
+import { z } from "zod";
+import { ArtifactNameSchema } from "./device-artifacts.js";
+
+// WHAT A REPOSITORY SAYS IT CAN BE RUN AS, ON ONE OF THE OWNER'S COMPUTERS (`<repo>/.intentic/run.json`). Beside the
+// build scripts it names and tracked with them, like `.intentic/checks.json`. One file serves two doors that must do the
+// same thing: an agent's `devices run <target>` in its own shell, and the editor's "Run on <device>" button, which runs
+// that very command in a terminal the owner watches. Each run builds in the sandbox, carries the build to the device
+// (`devices push`), opens the device ports the target says the sandbox needs (`devices reach`), and starts the program
+// there (the device's app_start). Nothing here runs by itself: a target runs when someone runs it.
+//
+//   {
+//     "targets": [{
+//       "name": "desktop",
+//       "device": "rog",
+//       "build": "bash _tools/scripts/desktop/build-desktop.sh 0.0.0 --windows-only",
+//       "artifact": {
+//         "intentic-desktop.exe": "_editor/desktop-app/src-tauri/target/x86_64-pc-windows-msvc/release/intentic-desktop.exe",
+//         "intentic-files.exe": "_editor/desktop-app/src-tauri/binaries/intentic-files-x86_64-pc-windows-msvc.exe"
+//       },
+//       "program": "intentic-desktop.exe"
+//     }]
+//   }
+
+export const RUN_TARGETS_FILE = ".intentic/run.json";
+
+const RepoPathSchema = z
+    .string()
+    .min(1)
+    .max(500)
+    .refine((path) => !path.startsWith("/") && !path.split(/[\\/]/).includes(".."), "a path inside the repository, relative to its root");
+const BundleNameSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9 ._()+-]{0,199}(\/[A-Za-z0-9][A-Za-z0-9 ._()+-]{0,199})*$/, "a relative name, folders by /");
+
+export const RunTargetSchema = z
+    .object({
+        // What `devices run <name>` and the button call it.
+        name: ArtifactNameSchema,
+        description: z.string().max(300).optional(),
+        // The computer it runs on unless one is named at the run; the device's name as its tools are mounted.
+        device: z.string().min(1).max(100).optional(),
+        // A shell command run from the repository's root, in the sandbox, before every run; absent means the artifact
+        // is already there.
+        build: z.string().min(1).max(4000).optional(),
+        // What is carried: one file or one folder, or a set of files and folders gathered into one folder under names of
+        // their own (an .exe beside the sidecars, DLLs and resource folders it looks for next to itself).
+        artifact: z.union([RepoPathSchema, z.record(BundleNameSchema, RepoPathSchema)]),
+        // Which file to start when the artifact is a folder or a set; a lone file is started as itself.
+        program: BundleNameSchema.optional(),
+        args: z.array(z.string().max(4000)).max(100).default([]),
+        env: z.record(z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/), z.string().max(4000)).default({}),
+        // Run it inside Windows Sandbox, a throwaway VM that sees the build read-only and nothing else of the machine.
+        isolated: z.boolean().default(false),
+        // The device's own loopback ports the sandbox needs to reach while it runs (its local API, a dev server), each
+        // opened at the same port in the sandbox.
+        reach: z.array(z.int().min(1).max(65535)).max(16).default([]),
+    })
+    .strict();
+export type RunTarget = z.infer<typeof RunTargetSchema>;
+
+export const RunTargetsFileSchema = z
+    .object({
+        targets: z
+            .array(RunTargetSchema)
+            .min(1)
+            .max(50)
+            .refine((targets) => new Set(targets.map((target) => target.name)).size === targets.length, "two targets share a name"),
+    })
+    .strict();
+
+// One repository's file as the editor lists it: its targets, or what is wrong with the file.
+export const RepoRunTargetsSchema = z.object({
+    repo: z.string(),
+    path: z.string(),
+    targets: z.array(RunTargetSchema),
+    error: z.string().optional(),
+});
+
+export const RunTargetsListSchema = z.object({
+    repos: z.array(RepoRunTargetsSchema),
+    // The owner's computers: whether each is connected, whether its agent is new enough to take a program, and whether
+    // its card's "Run programs this sandbox sends" switch is on. A run needs all three.
+    devices: z.array(z.object({ id: z.string(), online: z.boolean(), programs: z.boolean(), allowed: z.boolean() })),
+});
+export type RunTargetsList = z.infer<typeof RunTargetsListSchema>;
+
+export const RunStartSchema = z.object({
+    repo: z.string().min(1),
+    target: ArtifactNameSchema,
+    device: z.string().min(1).max(100),
+});
+export type RunStart = z.infer<typeof RunStartSchema>;
+
+// The terminal session the run is in, for the editor to open.
+export const RunStartedSchema = z.object({ session: z.string() });

package/src/schemas/settings.ts

@@ -5,7 +5,7 @@ import { z } from "zod";
 import { CommandJudgeModeSchema, ProjectInstallModeSchema } from "../policy/safety-policy.js";
 import { ModelRoleSchema } from "../models/model-roles.js";
 import { AdmissionPolicySchema, AdmissionRuleSchema, ModelPinSchema } from "./agent.js";
-import { LimitPolicySchema, RetryPolicySchema } from "./turn-break.js";
+import { LimitPolicySchema, RetryPolicySchema, RoomPolicySchema } from "./turn-break.js";
 import { ZoneSchema } from "../time/zone.js";
 // Which prompt base the agent runs before this turn composes anything on top: Intentic's own (default), Claude Code's
 // preset, or the owner's text. Declared out here since both the daemon and the browser branch on it.
@@ -452,6 +452,11 @@ export const SandboxSettingsSchema = z.object({
     stopPolicy: RetryPolicySchema.default("wait").describe(
         "What happens to a turn that stopped short with nothing to repair — a hung runtime, a crashed harness. `wait` holds it for a press. `retry` re-runs the held turn on a short ladder, standing down after three tries that got nowhere rather than looping forever.",
     ),
+    // The one ending that defaults to going by itself: nothing ran, so sending it once there is room spends nothing twice,
+    // and it is what the person meant when they pressed Send.
+    memoryPolicy: RoomPolicySchema.default("resend").describe(
+        "What happens to a message the sandbox held because it was short of memory: nothing ran, so nothing was spent. `resend` sends it by itself once memory has stayed free for a while, one held conversation at a time. `wait` holds it until somebody presses Send anyway. The sandbox-wide default; any one conversation can say otherwise.",
+    ),
     limitMoveCarryUnder: z
         .number()
         .int()

package/src/schemas/speech.ts

@@ -0,0 +1,96 @@
+import { z } from "zod";
+
+// Dictation on this sandbox: which local model hears a language, how far it is from ready, and the live wire the
+// composer streams a spoken phrase over. The daemon's engine is src/speech; the composer's half is
+// _editor/web/src/features/chat/composer/voice.
+
+// The models a sandbox can hear with, by what they are for:
+// - `parakeet` (NVIDIA Parakeet TDT 0.6B v3): 25 European languages, punctuated, ~30x faster than real time on two
+//   cores. Baked into the standard image, and the default for any language it covers.
+// - `whisper` (OpenAI Whisper large-v3-turbo): the other ~75 languages, slower, fetched the first time one is asked for.
+export const SpeechEngineSchema = z.enum(["parakeet", "whisper"]);
+export type SpeechEngine = z.infer<typeof SpeechEngineSchema>;
+
+// The 25 Parakeet hears, as ISO 639-1 primary subtags: it detects which on its own, so a browser in English and a
+// speaker in Polish still land on it.
+export const PARAKEET_LANGUAGES: ReadonlySet<string> = new Set([
+    "bg",
+    "cs",
+    "da",
+    "de",
+    "el",
+    "en",
+    "es",
+    "et",
+    "fi",
+    "fr",
+    "hr",
+    "hu",
+    "it",
+    "lt",
+    "lv",
+    "mt",
+    "nl",
+    "pl",
+    "pt",
+    "ro",
+    "ru",
+    "sk",
+    "sl",
+    "sv",
+    "uk",
+]);
+
+// A locale's primary subtag, lowercased, or undefined for anything that is not one (`""`, `*`, `auto`).
+export const speechLanguage = (locale: string | undefined): string | undefined => {
+    const primary = (locale ?? "").trim().toLowerCase().split(/[-_]/u)[0] ?? "";
+    return /^[a-z]{2,3}$/u.test(primary) && primary !== "auto" ? primary : undefined;
+};
+
+// Which model hears a locale: Parakeet for its own languages and for anything unreadable, Whisper for the rest.
+export const speechEngineFor = (locale: string | undefined): SpeechEngine => {
+    const language = speechLanguage(locale);
+    return language === undefined || PARAKEET_LANGUAGES.has(language) ? "parakeet" : "whisper";
+};
+
+export const SpeechStatusSchema = z.object({
+    provisioned: z.boolean().describe("This sandbox can run speech recognition at all."),
+    model: z
+        .enum(["absent", "downloading", "ready", "failed"])
+        .describe("Whether the model for the asked language is on disk: baked into the image, fetched, being fetched, or its fetch failed."),
+    engine: SpeechEngineSchema.optional().describe("Which model hears the asked language."),
+    loaded: z.boolean().optional().describe("The model is in memory, so the next phrase is heard without a load first."),
+    received: z.number().optional().describe("Bytes of the model fetched so far, while it downloads."),
+    total: z.number().optional().describe("The model's whole size in bytes, while it downloads."),
+    error: z.string().optional().describe("Why the last fetch failed, when it did."),
+});
+export type SpeechStatus = z.infer<typeof SpeechStatusSchema>;
+
+// GET /speech/stream, a WebSocket: the composer cuts the microphone into phrases itself (its silence segmenter) and
+// streams each one as it is spoken. A text frame `begin` opens phrase `id`; binary frames that follow are its audio,
+// 16 kHz mono s16le; `end` closes it, keeping its first `keep` samples (the trailing pause trimmed off); `drop`
+// abandons it. The daemon answers with `partial` text while the phrase is still being spoken, one `final` per ended
+// phrase, in order, and `status` whenever the model's readiness moves. The language is the socket's `lang` query.
+export const SpeechClientMessageSchema = z.discriminatedUnion("type", [
+    z.object({ type: z.literal("begin"), id: z.number() }),
+    z.object({ type: z.literal("end"), id: z.number(), keep: z.number() }),
+    z.object({ type: z.literal("drop"), id: z.number() }),
+]);
+export type SpeechClientMessage = z.infer<typeof SpeechClientMessageSchema>;
+
+export const SpeechServerMessageSchema = z.discriminatedUnion("type", [
+    z.object({ type: z.literal("status"), status: SpeechStatusSchema }),
+    z.object({ type: z.literal("partial"), id: z.number(), text: z.string() }),
+    z.object({
+        type: z.literal("final"),
+        id: z.number(),
+        text: z.string().describe("Empty when the phrase held no words."),
+        decodeMs: z.number().describe("How long hearing it took once its audio was in."),
+    }),
+    z.object({ type: z.literal("error"), id: z.number().optional(), message: z.string() }),
+]);
+export type SpeechServerMessage = z.infer<typeof SpeechServerMessageSchema>;
+
+// The longest phrase either door takes: a minute at 16 kHz. The composer's segmenter cuts a monologue at the same
+// length, so nothing it sends is ever refused.
+export const MAX_SPEECH_SAMPLES = 60 * 16_000;

package/src/schemas/terminal.ts

@@ -140,6 +140,10 @@ export const BrowsersListSchema = z.object({
 });
 export type BrowsersList = z.infer<typeof BrowsersListSchema>;
 export const BrowserNameParamSchema = z.object({ name: z.string().describe("Which browser.") });
+export const BrowserPageParamSchema = z.object({
+    name: z.string().describe("Which browser."),
+    pageId: z.string().describe("Which of its tabs: a page id from the roster."),
+});
 export const OpenBrowserInputSchema = z.object({
     url: z.string().optional().describe("Where the new tab goes. Absent opens a blank tab, the way a browser's own new tab does."),
 });

package/src/schemas/turn-break.ts

@@ -7,20 +7,23 @@
 
 import { z } from "zod";
 
-// The three endings that leave finished work behind a live session and can be picked back up. Spelled exactly as
-// `TurnEndingSchema.reason` spells them, so the ending a surface reads and the question it asks are one word. A restart
-// is handled apart (SandboxSettings.autoResumeOnRestart): nobody is watching a restart, so it has no in-chat question.
-export const TurnBreakSchema = z.enum(["limit", "outage", "stopped"]);
+// The walls a turn can stop at that take a standing answer. The first three end a turn that leaves finished work behind
+// a live session, spelled exactly as `TurnEndingSchema.reason` spells them, so the ending a surface reads and the
+// question it asks are one word. `memory` is the door: the sandbox too short of memory to start the turn at all, which
+// holds the message (or the turn the sandbox kept) until a press or room comes back. A restart is handled apart
+// (SandboxSettings.autoResumeOnRestart): nobody is watching a restart, so it has no in-chat question.
+export const TurnBreakSchema = z.enum(["limit", "outage", "stopped", "memory"]);
 export type TurnBreak = z.infer<typeof TurnBreakSchema>;
 
-// Every ending that leaves a held turn behind: the three above, plus the provider's safety classifier stopping a turn
-// partway. That one has no standing answer and never re-runs by itself: the person picks, each time, between the same
-// model again and another one (2026-09-30, the owner's call over an automatic model switch).
-export const HeldEndingSchema = z.enum([...TurnBreakSchema.options, "flagged"]);
+// Every ending that leaves a held turn behind: a spent allowance, an outage, a turn that stopped short, plus the
+// provider's safety classifier stopping a turn partway. That one has no standing answer and never re-runs by itself: the
+// person picks, each time, between the same model again and another one (2026-09-30, the owner's call over an automatic
+// model switch). A low-memory hold is no ending: nothing ran, so it is never one of these.
+export const HeldEndingSchema = z.enum(["limit", "outage", "stopped", "flagged"]);
 export type HeldEnding = z.infer<typeof HeldEndingSchema>;
 
 /** Whether this ending takes a standing answer (turn-break policy), which `flagged` never does. */
-export const isTurnBreak = (ending: HeldEnding): ending is TurnBreak => ending !== "flagged";
+export const isTurnBreak = (ending: HeldEnding): ending is Exclude<HeldEnding, "flagged"> => ending !== "flagged";
 
 // `move` implies `resend`: an account with room is tried at once, and the reset appointment stands as its fallback.
 // There is deliberately no "move, else hold" — a reader willing to spend a second account is willing to wait.
@@ -31,6 +34,11 @@ export type LimitPolicy = z.infer<typeof LimitPolicySchema>;
 export const RetryPolicySchema = z.enum(["wait", "retry"]);
 export type RetryPolicy = z.infer<typeof RetryPolicySchema>;
 
+// The memory wall's two answers: hold for a press, or send once the sandbox has room again. Nothing ran, so sending it
+// then spends nothing twice.
+export const RoomPolicySchema = z.enum(["wait", "resend"]);
+export type RoomPolicy = z.infer<typeof RoomPolicySchema>;
+
 // One answer, whichever ending asked. Read against the ending: only `limit` can be `move`.
 export const TurnBreakPolicySchema = z.enum(["wait", "resend", "move", "retry"]);
 export type TurnBreakPolicy = z.infer<typeof TurnBreakPolicySchema>;
@@ -40,6 +48,7 @@ export const TURN_BREAK_POLICIES: Readonly<Record<TurnBreak, readonly TurnBreakP
     limit: ["wait", "resend", "move"],
     outage: ["wait", "retry"],
     stopped: ["wait", "retry"],
+    memory: ["wait", "resend"],
 };
 
 /** Whether this ending may be answered this way; the one gate every writer goes through. */