@intentic/sandbox-contract 1.330.0 → 1.332.0

package/src/policy/credential-material.ts

@@ -1,3 +1,5 @@
+import { escapeRegExp } from "@intentic/base/escape";
+
 // Whether a file's text actually holds a credential, the fact command-classes.ts's path table can only guess at from a
 // name. Pure over the text (no fs, no config), so it stays testable and works where there's no filesystem. Biased
 // toward yes: a false positive costs one card, a false negative un-gates a real credential read.
@@ -25,24 +27,62 @@ const STRUCTURAL_SHAPES = [
     /\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:(?!\*+@)[^\s/@]{3,}@/i,
 ];
 
-const ISSUED_TOKENS = [
-    /\bnpm_[A-Za-z0-9]{30,}/,
-    /\bgh[pousr]_[A-Za-z0-9]{20,}/,
-    /\bgithub_pat_[A-Za-z0-9_]{50,}/,
-    /\bglpat-[A-Za-z0-9_-]{16,}/,
-    /\bxox[baprs]-[A-Za-z0-9-]{10,}/,
-    /\bsk-[A-Za-z0-9_-]{20,}/,
-    /\b(?:sk|rk)_live_[A-Za-z0-9]{16,}/,
-    /\bAKIA[0-9A-Z]{16}\b/,
-    /\bASIA[0-9A-Z]{16}\b/,
-    /\bAIza[0-9A-Za-z_-]{35}\b/,
-    /\bhf_[A-Za-z0-9]{30,}/,
-    /\bdop_v1_[a-f0-9]{60,}/,
-    // A JWT: three base64url segments, the first two of which decode from {" and so always begin "ey".
-    /\bey[A-Za-z0-9_-]{10,}\.ey[A-Za-z0-9_-]{10,}\./,
+// An issuer's literal prefix and the regex source of the body it mints after it.
+export interface CredentialIssuer {
+    readonly prefix: string;
+    readonly body: string;
+}
+
+// Credentials that name their own issuer. Kept as data, not regexes, so the terminal filter's copy
+// (CREDENTIAL_ISSUERS in _sandbox/output-cleaners/src/cleaners.mjs, builtins only, so it cannot import this) can be
+// compared entry by entry: the daemon's src/secrets/terminal-masking-parity.test.ts fails the moment the two part. Only
+// the whole shape counts here, never the prefix alone: the outbox reads text nobody said holds a credential, where a
+// bare `sk-` in prose is not one. The terminal side also takes the prefix alone beside a credential-shaped name, where
+// the name already said so.
+export const CREDENTIAL_ISSUERS: readonly CredentialIssuer[] = [
+    { prefix: "npm_", body: "[A-Za-z0-9]{30,}" },
+    { prefix: "ghp_", body: "[A-Za-z0-9]{20,}" },
+    { prefix: "gho_", body: "[A-Za-z0-9]{20,}" },
+    { prefix: "ghu_", body: "[A-Za-z0-9]{20,}" },
+    { prefix: "ghs_", body: "[A-Za-z0-9]{20,}" },
+    { prefix: "ghr_", body: "[A-Za-z0-9]{20,}" },
+    { prefix: "github_pat_", body: "[A-Za-z0-9_]{50,}" },
+    { prefix: "glpat-", body: "[A-Za-z0-9_-]{16,}" },
+    { prefix: "xoxa-", body: "[A-Za-z0-9-]{10,}" },
+    { prefix: "xoxb-", body: "[A-Za-z0-9-]{10,}" },
+    { prefix: "xoxo-", body: "[A-Za-z0-9-]{10,}" },
+    { prefix: "xoxp-", body: "[A-Za-z0-9-]{10,}" },
+    { prefix: "xoxr-", body: "[A-Za-z0-9-]{10,}" },
+    { prefix: "xoxs-", body: "[A-Za-z0-9-]{10,}" },
+    { prefix: "sk-", body: "[A-Za-z0-9_-]{20,}" },
+    { prefix: "pk-", body: "[A-Za-z0-9_-]{20,}" },
+    { prefix: "rk-", body: "[A-Za-z0-9_-]{20,}" },
+    { prefix: "sk_live_", body: "[A-Za-z0-9]{16,}" },
+    { prefix: "rk_live_", body: "[A-Za-z0-9]{16,}" },
+    { prefix: "AKIA", body: String.raw`[0-9A-Z]{16}\b` },
+    { prefix: "ASIA", body: String.raw`[0-9A-Z]{16}\b` },
+    { prefix: "AIza", body: String.raw`[0-9A-Za-z_-]{35}\b` },
+    { prefix: "ya29.", body: "[0-9A-Za-z_-]{20,}" },
+    { prefix: "hf_", body: "[A-Za-z0-9]{30,}" },
+    { prefix: "dop_v1_", body: "[a-f0-9]{60,}" },
+    { prefix: "shpat_", body: "[a-fA-F0-9]{32,}" },
+    // SendGrid: a key id and its secret, dot-separated.
+    { prefix: "SG.", body: String.raw`[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}` },
+    // A JWT: three base64url segments, the first two of which decode from `{"` and so always begin `eyJ` and `ey`.
+    { prefix: "eyJ", body: String.raw`[A-Za-z0-9_-]{9,}\.ey[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]*` },
 ];
+export const CREDENTIAL_ISSUER_PREFIXES: readonly string[] = CREDENTIAL_ISSUERS.map(({ prefix }) => prefix);
+
+// Starts where no word or kebab-case word runs into it: `task-sk-runner-config-file` is a name, not a key. The other
+// side builds its patterns the same way.
+const ISSUED_TOKENS = CREDENTIAL_ISSUERS.map(({ prefix, body }) => new RegExp(String.raw`(?<![\w-])${escapeRegExp(prefix)}${body}`));
+
+// An opaque bearer credential, which names no issuer: the scheme word, then an RFC 6750 token holding a letter and a
+// digit and longer than prose puts after "Bearer" (`Bearer <token>`, `Bearer YOUR_TOKEN`, an already-masked `***`).
+const BEARER_VALUE = String.raw`(?=[\w.~+/-]*\d)(?=[\w.~+/-]*[A-Za-z])[\w.~+/-]{16,}=*`;
+const BEARER_TOKEN = new RegExp(String.raw`\bBearer[ \t]+${BEARER_VALUE}`, "i");
 
-const TOKEN_SHAPES = [...STRUCTURAL_SHAPES, ...ISSUED_TOKENS];
+const TOKEN_SHAPES = [...STRUCTURAL_SHAPES, BEARER_TOKEN, ...ISSUED_TOKENS];
 
 // Deferred references, stripped first: unstripped, each reads as a credential twice over.
 const DEFERRED_VALUE = /\{\{[^}\n]*\}\}|\$\{[^}\n]*\}/g;
@@ -91,6 +131,7 @@ const PRIVATE_KEY_BLOCK = new RegExp(
 );
 const PUTTY_KEY = new RegExp(String.raw`(PuTTY-User-Key-File-\d:)${MASKED_NEXT}[^\n\\]*${ARMOR_LINES}`, "g");
 const URL_PASSWORD = /(\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:)(?!\*+@)[^\s/@]{3,}@/gi;
+const BEARER_TOKEN_G = new RegExp(String.raw`(\bBearer[ \t]+)${BEARER_VALUE}`, "gi");
 
 // The truncated opener left once the bare-value arm stops at its first `}`, anchored at the start.
 const DEFERRED_OPENER = /^(?:\{\{|\$)/;
@@ -106,6 +147,7 @@ export const maskCredentialMaterial = (text: string): string =>
             .replace(PUTTY_KEY, `$1 ${MASK}`),
     )
         .replace(URL_PASSWORD, `$1${MASK}@`)
+        .replace(BEARER_TOKEN_G, `$1${MASK}`)
         // Masks just the value, leaving key/separator/quoting readable; skips mirror the detector's own.
         .replace(CREDENTIAL_ASSIGNMENT_G, (match, ...groups: unknown[]) => {
             const value = (groups[0] ?? groups[1] ?? groups[2] ?? "") as string;

package/src/policy/search-globs.ts

@@ -58,3 +58,138 @@ export const includeGlobs = (include: string | undefined): IncludeGlobs => {
         notGlobs: segments.filter((segment) => segment.startsWith(`!`)).flatMap((segment) => expand(segment.slice(1))),
     };
 };
+
+// ONE GLOB MATCHER, with Bun.Glob's reading of every construct, so the daemon, the desktop folder server (which runs
+// Bun.Glob itself) and the demo admit the same files for the same pattern. Before this the daemon's copy took
+// `[!t]` as a set of the characters `!` and `t`, where Bun.Glob reads "anything but t".
+// - `*` is any run within one path segment, `?` one character of it
+// - `**` as a whole segment is any number of segments, none included (`**/x` matches `x`); inside a segment it is `*`
+// - `[abc]`, `[a-z]`, and `[!abc]` or `[^abc]` for "none of these"; a `]` first in the set is literal
+// - `{a,b}` is either, nested groups and globs inside included; `\` makes the next character literal
+// - an unclosed `[` or `{` is literal, where Bun.Glob matches nothing: a half-typed pattern then still finds its text
+const REGEXP_SPECIAL = /[.*+?^${}()|[\]\\/]/;
+
+const literal = (char: string): string => (REGEXP_SPECIAL.test(char) ? `\\${char}` : char);
+
+// The index of the `]` closing the set opened at `open`, or -1.
+const setEnd = (glob: string, open: number): number => {
+    let index = open + 1;
+    if (glob[index] === `!` || glob[index] === `^`) {
+        index += 1;
+    }
+    // A `]` straight after the opening (or its negation) is a member, not the close.
+    if (glob[index] === `]`) {
+        index += 1;
+    }
+    for (; index < glob.length; index += 1) {
+        if (glob[index] === `\\`) {
+            index += 1;
+        } else if (glob[index] === `]`) {
+            return index;
+        }
+    }
+    return -1;
+};
+
+const setSource = (body: string): string => {
+    const negated = body.startsWith(`!`) || body.startsWith(`^`);
+    const members = (negated ? body.slice(1) : body).replaceAll(/\\(.)/g, `$1`).replaceAll(/[\\\]^[]/g, (char) => `\\${char}`);
+    return `[${negated ? `^` : ``}${members}]`;
+};
+
+// The index of the `}` closing the group opened at `open`, and where its top-level commas fall; undefined if unclosed.
+const groupOf = (glob: string, open: number): { readonly end: number; readonly commas: readonly number[] } | undefined => {
+    const commas: number[] = [];
+    let depth = 0;
+    for (let index = open; index < glob.length; index += 1) {
+        const char = glob[index];
+        if (char === `\\`) {
+            index += 1;
+        } else if (char === `[`) {
+            const end = setEnd(glob, index);
+            index = end === -1 ? index : end;
+        } else if (char === `{`) {
+            depth += 1;
+        } else if (char === `}`) {
+            depth -= 1;
+            if (depth === 0) {
+                return { end: index, commas };
+            }
+        } else if (char === `,` && depth === 1) {
+            commas.push(index);
+        }
+    }
+    return undefined;
+};
+
+// `**` filling a whole segment: the source it stands for and how many characters of the glob it consumed.
+const globstar = (glob: string, index: number, segmentStart: boolean): { readonly source: string; readonly length: number } | undefined => {
+    if (!segmentStart || glob[index + 1] !== `*`) {
+        return undefined;
+    }
+    const after = glob[index + 2];
+    if (after === `/`) {
+        return { source: `(?:[^/]*/)*`, length: 3 };
+    }
+    return after === undefined ? { source: `.*`, length: 2 } : undefined;
+};
+
+const compileGlob = (glob: string, segmentStart: boolean): string => {
+    let source = ``;
+    let atStart = segmentStart;
+    for (let index = 0; index < glob.length; index += 1) {
+        const char = glob[index]!;
+        const star = char === `*` ? globstar(glob, index, atStart) : undefined;
+        if (star !== undefined) {
+            source += star.source;
+            index += star.length - 1;
+            atStart = true;
+            continue;
+        }
+        if (char === `*`) {
+            // A run of stars inside a segment is one star.
+            while (glob[index + 1] === `*`) {
+                index += 1;
+            }
+            source += `[^/]*`;
+        } else if (char === `?`) {
+            source += `[^/]`;
+        } else if (char === `\\` && index + 1 < glob.length) {
+            index += 1;
+            source += literal(glob[index]!);
+        } else if (char === `[` && setEnd(glob, index) !== -1) {
+            const end = setEnd(glob, index);
+            source += setSource(glob.slice(index + 1, end));
+            index = end;
+        } else if (char === `{` && groupOf(glob, index) !== undefined) {
+            const group = groupOf(glob, index)!;
+            const bounds = [index, ...group.commas, group.end];
+            const alternatives = bounds.slice(1).map((end, at) => compileGlob(glob.slice(bounds[at]! + 1, end), atStart));
+            source += `(?:${alternatives.join(`|`)})`;
+            index = group.end;
+        } else {
+            source += literal(char);
+        }
+        atStart = char === `/`;
+    }
+    return source;
+};
+
+// The whole path must match: `*.ts` is a name at the root, not a suffix anywhere.
+export const globRegExp = (glob: string): RegExp => new RegExp(`^${compileGlob(glob, true)}$`);
+
+// A matcher for slash-separated relative paths, compiled once.
+export const globMatcher = (glob: string): ((path: string) => boolean) => {
+    const pattern = globRegExp(glob);
+    return (path) => pattern.test(path);
+};
+
+// The search box's whole second field as one test over a relative path: admitted by any include (or by none being
+// typed), and by no exclude. An anchored include's `./` is the root, so it is dropped before matching.
+export const includeMatcher = (include: string | undefined): ((path: string) => boolean) => {
+    const { globs, notGlobs } = includeGlobs(include);
+    const rooted = (glob: string): string => glob.replace(/^\.\//, ``);
+    const admits = globs.map((glob) => globMatcher(rooted(glob)));
+    const refuses = notGlobs.map((glob) => globMatcher(rooted(glob)));
+    return (path) => (admits.length === 0 || admits.some((test) => test(path))) && !refuses.some((test) => test(path));
+};

package/src/policy/secret-hosts.ts

@@ -42,6 +42,13 @@ export const normalizeHost = (raw: string): string | undefined => {
 export const hostMatches = (pattern: string, host: string): boolean =>
     pattern.startsWith(WILDCARD) ? host.endsWith(pattern.slice(1)) : host === pattern;
 
+// Whether one entry of a domain list covers a host: a plain entry names a domain and every host under it at any depth
+// (`example.com` covers `example.com` and `api.example.com`, never `notexample.com`), a wildcard only the hosts under it.
+// Both sides are expected normalized. The wallet's allow and deny lists read their entries this way; a secret's host
+// guard reads its own exactly (hostMatches).
+export const hostCovers = (entry: string, host: string): boolean =>
+    entry.startsWith(WILDCARD) ? hostMatches(entry, host) : host === entry || host.endsWith(`.${entry}`);
+
 export const hostAllowed = (patterns: readonly string[], host: string): boolean => patterns.some((pattern) => hostMatches(pattern, host));
 
 // Whether every host `pattern` matches is already matched by `patterns`: an exact host by any pattern that matches it, a

package/src/policy/tests/command-classes.test.ts

@@ -656,3 +656,38 @@ describe("git.branch-switch", () => {
         expect(marked("cd repo && git switch main && pnpm build", "git.branch-switch")).toEqual(["git switch"]);
     });
 });
+
+describe("Windows' own shells", () => {
+    test("PowerShell's and cmd's recursive deletes are files.destructive, the way a device's run_command meets them", () => {
+        for (const command of [
+            "Remove-Item -Recurse -Force C:\\Users\\me\\thesis",
+            "Remove-Item C:\\x -Recurse",
+            "Remove-Item -Recurse:$true x",
+            "ri -r C:\\x",
+            "rm -Recurse x",
+            "rd /s /q C:\\x",
+            "rmdir /S C:\\x",
+            "del /s /q *.tmp",
+            "[System.IO.Directory]::Delete('C:\\x', $true)",
+            "powershell -Command 'Remove-Item -Recurse -Force C:\\x'",
+            "cmd /c 'rmdir /s /q C:\\x'",
+        ]) {
+            expect(classify(command), command).toContain("files.destructive");
+        }
+    });
+
+    test("what only looks like one is not: a single file, a read that recurses, POSIX rm's asking -r", () => {
+        for (const command of ["Remove-Item C:\\x\\file.txt", "del file.txt", "Get-ChildItem -Recurse C:\\x", "Copy-Item -Recurse a b", "rmdir empty", "rm -r build", "git rm -r --cached x"]) {
+            expect(classify(command), command).not.toContain("files.destructive");
+        }
+    });
+
+    test("a volume formatted or a disk cleared is system.destructive", () => {
+        for (const command of ["Format-Volume -DriveLetter D", "Clear-Disk -Number 1 -RemoveData", "format D: /q"]) {
+            expect(classify(command), command).toContain("system.destructive");
+        }
+        for (const command of ["npm run format", "prettier --write . && echo format done", "dotnet format"]) {
+            expect(classify(command), command).not.toContain("system.destructive");
+        }
+    });
+});

package/src/policy/tests/credential-material.test.ts

@@ -202,6 +202,26 @@ describe("a credential token in text that is not a credential file", () => {
         expect(holdsCredentialToken("-----BEGIN PRIVATE KEY-----\nMIIEvQ")).toBe(true);
     });
 
+    // The issuers the terminal filter already knew; the two tables are one list now (ISSUERS).
+    test.each([
+        ["an opaque bearer", "curl -H 'Authorization: Bearer 8f3kQ2mZ9xLp4RtV7wNb' https://api.example.com", "curl -H 'Authorization: Bearer ***' https://api.example.com"],
+        // Prefixes split from bodies so push protection does not read these fixtures as live keys.
+        ["a shopify admin token", `token ${"shpat_"}0123456789abcdef0123456789abcdef in use`, "token *** in use"],
+        ["a sendgrid key", `key ${"SG."}aB3dE5fG7hJ9kL1mN3pQ5r.sT7uV9wX1yZ3aB5cD7eF9gH1jK3lM5nP7qR9sT1uV3w set`, "key *** set"],
+        ["a google oauth token", "refreshed ya29.a0AfB_byC3dE5fG7hJ9kL1mN3pQ5 ok", "refreshed *** ok"],
+        ["a public-prefixed key", "langfuse pk-lf-0a1b2c3d-4e5f-6a7b-8c9d now", "langfuse *** now"],
+    ])("names itself and masks: %s", (_label, text, masked) => {
+        expect(holdsCredentialToken(text)).toBe(true);
+        expect(maskCredentialMaterial(text)).toBe(masked);
+        expect(holdsCredentialToken(masked)).toBe(false);
+    });
+
+    test("a bearer in prose or a template is not one", () => {
+        for (const text of ["Authorization: Bearer <token>", "Authorization: Bearer YOUR_API_TOKEN_HERE", "Bearer ${TOKEN}", "the Bearer scheme"]) {
+            expect(holdsCredentialToken(text), text).toBe(false);
+        }
+    });
+
     test("is never a credential-named key beside a value", () => {
         expect(holdsCredentialToken("const config={apiKey:process.env.API_KEY,password:hunter22x}")).toBe(false);
         expect(holdsCredentialMaterial("const config={apiKey:process.env.API_KEY,password:hunter22x}")).toBe(true);

package/src/policy/tests/search-globs.test.ts

@@ -1,4 +1,4 @@
-import { includeGlobs } from "../search-globs.js";
+import { globMatcher, includeGlobs, includeMatcher } from "../search-globs.js";
 
 test("an empty field scopes nothing", () => {
     expect(includeGlobs(undefined)).toEqual({ globs: [], notGlobs: [] });
@@ -43,3 +43,48 @@ test("a leading ! excludes instead", () => {
     // A lone "!" excludes nothing: expanded, it would have matched everything.
     expect(includeGlobs(`!`)).toEqual({ globs: [], notGlobs: [] });
 });
+
+describe("globMatcher", () => {
+    // Every construct, held against Bun.Glob itself: the desktop folder server matches with Bun.Glob, so any
+    // disagreement here is two machines admitting different files for one pattern.
+    const patterns = [
+        `*.ts`, `**/*.ts`, `**/*.[!t]s`, `**/*.[^t]s`, `src/**`, `src/**/*.ts`, `a/**/b`, `a?c`, `[a-c]x`, `[!a]`, `[]]`,
+        `*.{ts,js}`, `{a,{b,c}}/*`, `a/{b,c/**}`, `{**/x,y}`, `a**b`, `**`, `**/`, `**/**/x`, `{,a}b`, `\\*x`, `**.ts`, `a/**b`,
+    ];
+    const paths = [
+        `a.ts`, `a.js`, `a/b.ts`, `a/b.js`, `.hidden.ts`, `.x/y.ts`, `src`, `src/a.ts`, `src/a/b.ts`, `a/b`, `a/x/b`, `abc`, `a/c`,
+        `bx`, `dx`, `/`, `a`, `]`, `c/x`, `a/c/d`, `a/x`, `x`, `y`, `axxb`, `ax/xb`, `b`, `ab`, `*x`, `a/xb`, `a/c/xb`, `a/`, `a/b/`,
+    ];
+    for (const pattern of patterns) {
+        test(`reads ${pattern} as Bun.Glob does`, () => {
+            const glob = new Bun.Glob(pattern);
+            const matches = globMatcher(pattern);
+            expect(paths.filter((path) => matches(path))).toEqual(paths.filter((path) => glob.match(path)));
+        });
+    }
+
+    test("[!t] means anything but t", () => {
+        const matches = globMatcher(`**/*.[!t]s`);
+        expect([matches(`src/a.js`), matches(`src/a.ts`)]).toEqual([true, false]);
+    });
+
+    test("an unclosed set or group is literal", () => {
+        expect([globMatcher(`[ab`)(`[ab`), globMatcher(`{a,b`)(`{a,b`)]).toEqual([true, true]);
+    });
+});
+
+describe("includeMatcher", () => {
+    test("admits by any include and refuses by any exclude", () => {
+        const matches = includeMatcher(`src, !*.test.ts`);
+        expect([`src/a.ts`, `src/a.test.ts`, `lib/src/b.ts`, `docs/c.md`].map(matches)).toEqual([true, false, true, false]);
+    });
+
+    test("an anchored include matches from the root only", () => {
+        const matches = includeMatcher(`./src`);
+        expect([matches(`src/a.ts`), matches(`lib/src/a.ts`)]).toEqual([true, false]);
+    });
+
+    test("nothing typed admits every path", () => {
+        expect(includeMatcher(undefined)(`any/where.ts`)).toBe(true);
+    });
+});

package/src/policy/tests/secret-hosts.test.ts

@@ -1,4 +1,4 @@
-import { hostAllowed, hostMatches, normalizeHost, normalizeHostPattern, tightensHostGuard } from "../secret-hosts.js";
+import { hostAllowed, hostCovers, hostMatches, normalizeHost, normalizeHostPattern, tightensHostGuard } from "../secret-hosts.js";
 
 // The pattern a person writes against the host a use would reach. Every boundary a limit turns on is pinned by value:
 // the apex a wildcard leaves out, the look-alike that only shares a suffix, and which edits take hosts away.
@@ -87,3 +87,19 @@ describe("tightensHostGuard", () => {
         expect(tightensHostGuard(on("api.github.com"), on("*.api.github.com"))).toBe(false);
     });
 });
+
+describe("hostCovers", () => {
+    it("reads a plain entry as a domain and every host under it, never a lookalike", () => {
+        expect(hostCovers("example.com", "example.com")).toBe(true);
+        expect(hostCovers("example.com", "api.example.com")).toBe(true);
+        expect(hostCovers("example.com", "a.b.example.com")).toBe(true);
+        expect(hostCovers("example.com", "notexample.com")).toBe(false);
+        expect(hostCovers("example.com", "example.com.evil.net")).toBe(false);
+    });
+
+    it("reads a wildcard as the hosts under it only", () => {
+        expect(hostCovers("*.example.com", "api.example.com")).toBe(true);
+        expect(hostCovers("*.example.com", "example.com")).toBe(false);
+        expect(hostCovers("*.example.com", "notexample.com")).toBe(false);
+    });
+});

package/src/policy/turned-away.ts

@@ -13,6 +13,8 @@ const TURNED_AWAY: ReadonlySet<string> = new Set([
     "model-helper-only",
     // The privacy shield refused an untrusted provider on a runtime it cannot read by content at all.
     "privacy-unshielded",
+    // The turn carries a tool list its runtime cannot keep.
+    "tools-unenforced",
     // The protected execution boundary refused admission, not an executed provider/runtime failure.
     "agent-domain-refused",
     // The privacy shield found personal data in instructions a runtime loads itself, where it could not mask them.

package/src/protocol/doors/runner-protocol.ts

@@ -20,6 +20,10 @@ export const RunnerHelloSchema = z.object({
     // Compared against what the parent runs to report parity (outdated → rebuild action); an outdated runner still runs
     // turns rather than being refused.
     image: z.string(),
+    // The image `image` was composed from (SANDBOX_BASE_IMAGE). Parity compares this, not `image`: an overlay build's
+    // tag names its own container (`intentic-sandbox-env-<slug>:<hash>`), so two sides on one base and one overlay
+    // never share it. Absent on an old image, which is then compared by `image` alone.
+    baseImage: z.string().optional(),
     channel: z.string().optional(),
     overlayHash: z.string().optional(),
     // Runner's declared settings-only sandbox.toml (definition.ts), diffed against the parent's to itemize drift;
@@ -106,13 +110,22 @@ export type RunnerCredentialRefreshRequest = z.infer<typeof RunnerCredentialRefr
 export const RunnerCredentialRefreshSchema = z.object({ accessToken: z.string().optional() });
 export type RunnerCredentialRefresh = z.infer<typeof RunnerCredentialRefreshSchema>;
 
-// What a runner is, hardware-wise: what the placement picker shows and a future scheduler would weigh.
+// What a runner is, hardware-wise, and how full it is right now: what the placement picker shows and the fleet advice
+// (runners/fleet-advice.ts) weighs. Re-asked on demand rather than only at connect, so the live half stays live.
 export const RunnerFactsSchema = z.object({
     cpus: z.number().int().positive(),
     memoryMb: z.number().int().positive(),
     freeDiskMb: z.number().int().nonnegative(),
     // 0..1 over the last minute; a coarse busy signal for a picker, not a metrics feed.
     load: z.number().nonnegative(),
+    // The runner's own resource budget, the figures its turn door admits by: what is free under its memory limit, and
+    // that limit. Absent from a runner that predates them, which is then sized by `memoryMb` alone.
+    memoryFreeMb: z.number().int().nonnegative().optional(),
+    memoryLimitMb: z.number().int().positive().optional(),
+    // Pressure stall over the last ten seconds, in percent: anything waiting for a CPU, everything waiting on memory.
+    // Absent where the kernel does not report it.
+    cpuPressure: z.number().nonnegative().optional(),
+    memoryStall: z.number().nonnegative().optional(),
 });
 export type RunnerFacts = z.infer<typeof RunnerFactsSchema>;
 

package/src/protocol/pairing-redeem.test.ts

@@ -0,0 +1,86 @@
+import { redeemWhileWarming, type RedeemRetry } from "./pairing-redeem.js";
+
+/* The redeem loop both pairing peers run, over a sandbox the test plays one answer at a time. */
+
+const scripted = (answers: readonly (number | "offline" | "hang")[]) => {
+    const tries: number[] = [];
+    const send = async (attempt: number, signal: AbortSignal | undefined): Promise<Response> => {
+        tries.push(attempt);
+        const next = answers[attempt - 1] ?? answers.at(-1) ?? "offline";
+        if (next === "offline") {
+            throw new TypeError("fetch failed");
+        }
+        if (next === "hang") {
+            return new Promise<Response>((_resolve, reject) => signal?.addEventListener("abort", () => reject(signal.reason)));
+        }
+        return new Response(`status ${next}`, { status: next });
+    };
+    return { tries, send };
+};
+
+const statusOf = (outcome: Awaited<ReturnType<typeof redeemWhileWarming>>): number | undefined =>
+    outcome.kind === "answered" ? outcome.response.status : undefined;
+
+describe("redeemWhileWarming", () => {
+    it("answers the first reply below 500 without asking again", async () => {
+        const { tries, send } = scripted([200]);
+        expect(statusOf(await redeemWhileWarming(send, { attempts: 3, delayMs: 0 }))).toBe(200);
+        expect(tries).toEqual([1]);
+    });
+
+    it("asks again through a warming sandbox and an unreachable one, saying why each time", async () => {
+        const { tries, send } = scripted(["offline", 502, 200]);
+        const heard: { attempt: number; why: RedeemRetry["kind"] }[] = [];
+        const outcome = await redeemWhileWarming(send, { attempts: 5, delayMs: 0, onRetry: (attempt, why) => heard.push({ attempt, why: why.kind }) });
+        expect(statusOf(outcome)).toBe(200);
+        expect(tries).toEqual([1, 2, 3]);
+        expect(heard).toEqual([
+            { attempt: 1, why: "unreachable" },
+            { attempt: 2, why: "warming" },
+        ]);
+    });
+
+    it("hands back a 401 at once: an expired code is an answer, not a blip", async () => {
+        const { tries, send } = scripted([401, 200]);
+        expect(statusOf(await redeemWhileWarming(send, { attempts: 5, delayMs: 0 }))).toBe(401);
+        expect(tries).toEqual([1]);
+    });
+
+    it("answers the last 5xx when the sandbox is still warming after every try", async () => {
+        const { tries, send } = scripted([503]);
+        const heard: number[] = [];
+        const outcome = await redeemWhileWarming(send, { attempts: 3, delayMs: 0, onRetry: (attempt) => heard.push(attempt) });
+        expect(outcome.kind).toBe("answered");
+        expect(outcome.kind === "answered" ? await outcome.response.text() : undefined).toBe("status 503");
+        expect(tries).toEqual([1, 2, 3]);
+        // The last try is not retried, so it is not narrated as one.
+        expect(heard).toEqual([1, 2]);
+    });
+
+    it("is unreachable, with the last try's failure, when nothing ever answered", async () => {
+        const { tries, send } = scripted(["offline"]);
+        const outcome = await redeemWhileWarming(send, { attempts: 2, delayMs: 0 });
+        expect(outcome.kind).toBe("unreachable");
+        expect(outcome.kind === "unreachable" ? outcome.error : undefined).toBeInstanceOf(TypeError);
+        expect(tries).toEqual([1, 2]);
+    });
+
+    it("abandons a try that outlives its timeout and asks again", async () => {
+        const { tries, send } = scripted(["hang", 200]);
+        expect(statusOf(await redeemWhileWarming(send, { attempts: 2, delayMs: 0, timeoutMs: 10 }))).toBe(200);
+        expect(tries).toEqual([1, 2]);
+    });
+
+    it("rejects with the stop's reason rather than answering when its signal aborts", async () => {
+        const stop = new AbortController();
+        const { tries, send } = scripted([502]);
+        const running = redeemWhileWarming(send, {
+            attempts: 5,
+            delayMs: 60_000,
+            signal: stop.signal,
+            onRetry: () => stop.abort(new Error("stopped")),
+        });
+        await expect(running).rejects.toThrow("stopped");
+        expect(tries).toEqual([1]);
+    });
+});

package/src/protocol/pairing-redeem.ts

@@ -0,0 +1,79 @@
+import { retry, withDeadline } from "@intentic/base/async";
+
+// Redeeming a pairing code's one-time token, as every peer that takes one does it (the machine agent's
+// `postWhileWarming`, the webext's `redeemPairing`): a sandbox still warming up answers 5xx through its tunnel, or
+// nothing at all, and is asked again. Any other answer, a 401 above all (the code has expired), is the caller's to read
+// at once: asking again would only delay the fresh code the person has to fetch.
+
+// Why a try is being asked again: no answer at all, or a 5xx from a sandbox not ready yet.
+export type RedeemRetry = { readonly kind: "unreachable"; readonly error: unknown } | { readonly kind: "warming"; readonly status: number };
+
+export type RedeemOutcome =
+    // The sandbox's answer: below 500 at once, or still 5xx when the tries ran out.
+    | { readonly kind: "answered"; readonly response: Response }
+    // No answer at all on the last try; `error` is that try's failure.
+    | { readonly kind: "unreachable"; readonly error: unknown };
+
+export interface RedeemOptions {
+    // Tries in all, the first included.
+    readonly attempts: number;
+    // The wait between tries.
+    readonly delayMs: number;
+    // How long one try may take before it is abandoned and counts as unreachable; none when absent.
+    readonly timeoutMs?: number | undefined;
+    // Stops the tries: a stop rejects with the signal's reason rather than answering.
+    readonly signal?: AbortSignal | undefined;
+    // Hears each try that is about to be asked again, before the wait.
+    readonly onRetry?: ((attempt: number, why: RedeemRetry) => void) | undefined;
+}
+
+// A 5xx carried out of a try so `retry` asks again, and handed back as the answer when the tries run out.
+class Warming extends Error {
+    constructor(readonly response: Response) {
+        super(`the sandbox is warming up (HTTP ${response.status})`);
+    }
+}
+
+// Runs `send` (one POST, handed the try's number and a signal to pass to its fetch, undefined when there is neither a
+// deadline nor a stop) until the sandbox answers below 500 or the tries run out.
+export const redeemWhileWarming = async (
+    send: (attempt: number, signal: AbortSignal | undefined) => Promise<Response>,
+    options: RedeemOptions,
+): Promise<RedeemOutcome> => {
+    const { attempts, delayMs, timeoutMs, signal, onRetry } = options;
+    const once = (attempt: number): Promise<Response> =>
+        timeoutMs === undefined ? send(attempt, signal) : withDeadline((bounded) => send(attempt, bounded), timeoutMs, { signal });
+    try {
+        const response = await retry(
+            async (attempt) => {
+                let answer: Response;
+                try {
+                    answer = await once(attempt);
+                } catch (error) {
+                    if (attempt < attempts && signal?.aborted !== true) {
+                        onRetry?.(attempt, { kind: "unreachable", error });
+                    }
+                    throw error;
+                }
+                if (answer.status < 500) {
+                    return answer;
+                }
+                if (attempt < attempts) {
+                    onRetry?.(attempt, { kind: "warming", status: answer.status });
+                }
+                throw new Warming(answer);
+            },
+            { attempts, delayMs: () => delayMs, signal },
+        );
+        return { kind: "answered", response };
+    } catch (error) {
+        if (signal?.aborted === true) {
+            // oxlint-disable-next-line typescript/only-throw-error -- the stop's own reason, as an aborted fetch rejects with it
+            throw signal.reason;
+        }
+        if (error instanceof Warming) {
+            return { kind: "answered", response: error.response };
+        }
+        return { kind: "unreachable", error };
+    }
+};

package/src/protocol/peer-mcp-server.ts

@@ -2,6 +2,7 @@
 // namespace keeps zod's 60 locales (~250 kB) that esbuild can otherwise drop. _devices/webext/scripts/size-budget.mjs holds the ceiling.
 import { prettifyError, toJSONSchema } from "zod";
 import type * as z from "zod";
+import { isRecord } from "@intentic/base/escape";
 
 // The MCP version every peer announces, here rather than in host-protocol.ts because a browser extension bundles this
 // module and would otherwise carry the machine handshake's schemas to a store. Also read by the daemon's peer bridge,
@@ -99,8 +100,6 @@ export interface McpServerSpec<Ctx> {
     readonly audit: (entry: McpAuditEntry) => Promise<void> | void;
 }
 
-const isRecord = (value: unknown): value is Record<string, unknown> => typeof value === "object" && value !== null && !Array.isArray(value);
-
 // Handles one JSON-RPC message; returns undefined for a notification. `ctx` is read per call, so a grant pushed
 // mid-session takes effect on the next call.
 export const createMcpServer = <Ctx>(spec: McpServerSpec<Ctx>): ((message: unknown, ctx: Ctx) => Promise<Record<string, unknown> | undefined>) => {

package/src/protocol/raw/raw-json-routes.ts

@@ -10,6 +10,7 @@ import {
 } from "../../schemas/environment.js";
 import { MemberEmailSchema, MemberGrantSchema, MembersListSchema, MembersRosterSchema } from "../../schemas/members.js";
 import { OkSchema } from "../../schemas/shared.js";
+import { EnrollCodeAnswerSchema, EnrollCodeRequestSchema } from "../../schemas/short-codes.js";
 import { DefinitionDiffSchema, DefinitionExportSchema, WorkspacePublishResultSchema, WorkspacePublishSchema, WorkspaceRemoteSchema } from "../../state/definition.js";
 import type { RawRouteKey } from "./raw-routes.js";
 
@@ -24,6 +25,8 @@ export interface RawJsonRoute {
 }
 
 export const RAW_JSON_ROUTES = {
+    // A server-connect code for the owner's command (short-codes.ts).
+    "POST /system/enroll/code": { input: EnrollCodeRequestSchema, output: EnrollCodeAnswerSchema },
     // The roster is ownership's; every write answers the roster after it.
     "GET /members": { output: MembersRosterSchema },
     "POST /members": { input: MemberGrantSchema, output: MembersListSchema },