@intentic/sandbox-contract 1.337.0 → 1.338.0

package/src/protocol/peer-dial.test.ts

@@ -158,11 +158,11 @@ test("a far end that never answers is reported a few times, then retried quietly
     try {
         const { link, sockets, said } = dialling(60_000);
         for (let attempt = 1; attempt <= 20; attempt += 1) {
-            // oxlint-disable-next-line eslint/no-await-in-loop -- one attempt after another is the thing under test
+            // one attempt after another is the thing under test
             await waitFor(() => expect(sockets).toHaveLength(attempt));
             sockets.at(-1)?.errors();
             sockets.at(-1)?.drops(1006);
-            // oxlint-disable-next-line eslint/no-await-in-loop -- the ladder's own wait, serial by construction
+            // the ladder's own wait, serial by construction
             await advanceTimersByTimeAsync(60_000);
         }
 
@@ -197,10 +197,10 @@ test("a link that comes back is loud again about the outage after it", async ()
     try {
         const { link, sockets, said } = dialling();
         for (let attempt = 1; attempt <= 5; attempt += 1) {
-            // oxlint-disable-next-line eslint/no-await-in-loop -- one attempt after another is the thing under test
+            // one attempt after another is the thing under test
             await waitFor(() => expect(sockets).toHaveLength(attempt));
             sockets.at(-1)?.drops(1006);
-            // oxlint-disable-next-line eslint/no-await-in-loop -- the ladder's own wait, serial by construction
+            // the ladder's own wait, serial by construction
             await advanceTimersByTimeAsync(1_000);
         }
         const whileQuiet = said.length;
@@ -273,10 +273,10 @@ test("a link nobody has answered in a long time rests between tries, and is neve
         const { link, sockets, said } = dialling(RUNG_MS);
         // Up to the threshold on the ordinary ladder: drop, wait its rung, get the next socket.
         for (let attempt = 1; attempt < LONG_OUTAGE_ATTEMPTS; attempt += 1) {
-            // oxlint-disable-next-line eslint/no-await-in-loop -- one drop per attempt is serial by definition
+            // one drop per attempt is serial by definition
             await waitFor(() => expect(sockets).toHaveLength(attempt));
             sockets.at(-1)?.drops(1006);
-            // oxlint-disable-next-line eslint/no-await-in-loop -- ditto
+            // ditto
             await advanceTimersByTimeAsync(RUNG_MS);
         }
         await waitFor(() => expect(sockets).toHaveLength(LONG_OUTAGE_ATTEMPTS));

package/src/protocol/peer-mcp-server.test.ts

@@ -1,3 +1,4 @@
+import { errorMessage } from "@intentic/base/errors";
 import { z } from "zod";
 import { createMcpServer, type McpAuditEntry, textResult, tool } from "./peer-mcp-server.js";
 
@@ -32,7 +33,7 @@ const build = () => {
         ],
         noSuchTool: (name) => `This peer has no tool called "${name}".`,
         refused: (error) => error instanceof Refused,
-        errorMessage: (error) => (error instanceof Error ? error.message : String(error)),
+        errorMessage,
         audit: (entry) => void audits.push(entry),
     });
     return { handle, audits };

package/src/protocol/raw/raw-json-routes.ts

@@ -19,7 +19,7 @@ import { MemberEmailSchema, MemberGrantSchema, MemberSelfSchema, MembersListSche
 import { PhonesListSchema, PhoneWakeRegistrationSchema } from "../../schemas/phone.js";
 import { OkSchema } from "../../schemas/shared.js";
 import { EnrollCodeAnswerSchema, EnrollCodeRequestSchema, PeerPairingAnswerSchema, SyncPairAnswerSchema, SyncPairRequestSchema } from "../../schemas/short-codes.js";
-import { SpeechStatusSchema, SpeechTranscriptSchema } from "../../schemas/speech.js";
+import { SpeechStatusSchema, SpeechTranscriptSchema, SpeechWakeClaimSchema, SpeechWakeGrantSchema } from "../../schemas/speech.js";
 import {
     AuthenticationOptionsSchema,
     DaemonSessionSchema,
@@ -35,6 +35,20 @@ import {
     SessionRecoveredSchema,
 } from "../../schemas/system.js";
 import { WebExtsListSchema } from "../../schemas/webext.js";
+import {
+    InboundLinkMintedSchema,
+    InboundLinkMintSchema,
+    InboundLinksListSchema,
+    InboundLinkSummarySchema,
+    InboundLinkTermsUpdateSchema,
+    LinkAnswerSchema,
+    LinkHelloSchema,
+    LinkMessageReceiptSchema,
+    LinkMessageSchema,
+    LinkRequestDecisionSchema,
+    LinkTaskSchema,
+    LinkTaskStatusSchema,
+} from "../../schemas/links.js";
 import { UploadManifestSchema, UploadSkipSchema } from "../../schemas/workspace/workspace-upload.js";
 import {
     ArrivalAbandonedSchema,
@@ -128,6 +142,20 @@ export const RAW_JSON_ROUTES = {
     "DELETE /system/authorized-key/{machine}": { output: OkSchema },
     // Every browser session revoked, the owner's own included.
     "POST /system/sessions/revoke": { output: OkSchema },
+    // Inbound links: the roster, a mint (its token shown once), new terms, a revoke, and the owner's answer to a waiting task.
+    "GET /system/links": { output: InboundLinksListSchema },
+    "POST /system/links": { input: InboundLinkMintSchema, output: InboundLinkMintedSchema },
+    "POST /system/links/{id}": { input: InboundLinkTermsUpdateSchema, output: InboundLinkSummarySchema },
+    "DELETE /system/links/{id}": { output: OkSchema },
+    "POST /system/links/{id}/requests/{request}": { input: LinkRequestDecisionSchema, output: InboundLinkSummarySchema },
+    // The link doors, as the asking sandbox's daemon reads them. A status takes `?after=<version>&wait=<seconds>` to
+    // be held until it moves past that version.
+    "GET /link": { output: LinkHelloSchema },
+    "POST /link/conversations": { input: LinkTaskSchema, output: LinkTaskStatusSchema },
+    "GET /link/conversations/{id}": { output: LinkTaskStatusSchema },
+    "POST /link/conversations/{id}/messages": { input: LinkMessageSchema, output: LinkMessageReceiptSchema },
+    "POST /link/conversations/{id}/answer": { input: LinkAnswerSchema, output: OkSchema },
+    "POST /link/conversations/{id}/stop": { output: LinkTaskStatusSchema },
     "GET /system/control/tokens": { output: ControlTokensListSchema },
     "POST /system/control/tokens": { input: ControlTokenMintSchema, output: ControlTokenMintedSchema },
     "DELETE /system/control/tokens/{id}": { output: OkSchema },
@@ -151,6 +179,8 @@ export const RAW_JSON_ROUTES = {
     "GET /speech/status": { output: SpeechStatusSchema },
     "POST /speech/prepare": { output: SpeechStatusSchema },
     "POST /speech/transcribe": { bytes: true, output: SpeechTranscriptSchema },
+    // One device's claim on a wake word it heard, so two devices hearing the same "Leon" open one session between them.
+    "POST /speech/wake": { input: SpeechWakeClaimSchema, output: SpeechWakeGrantSchema },
     // A file written into the tree (`?path=`, the body its bytes, `x-intentic-base-hash` refusing a stale save), and the
     // pre-drop check of which dropped files are already there.
     "POST /workspace/upload": { bytes: true, output: OkSchema },

package/src/protocol/raw/raw-routes.ts

@@ -18,6 +18,8 @@ export const RAW_ROUTES = {
     "GET /speech/status": { guest: true },
     "POST /speech/prepare": { guest: true },
     "POST /speech/transcribe": { floor: "collaborator", guest: true },
+    // A device claiming a wake word it heard (schemas/speech.ts): what it opens is a turn, so the collaborator's.
+    "POST /speech/wake": { floor: "collaborator" },
     // The live phrase stream (schemas/speech.ts): a WebSocket, so the query ticket, floored at the collaborator in the
     // handler like the transcribe it streams.
     "GET /speech/stream": { auth: "door" },
@@ -27,6 +29,9 @@ export const RAW_ROUTES = {
     "GET /speech/voices": { guest: true },
     "POST /speech/say": { floor: "collaborator" },
     "GET /speech/say": { auth: "door" },
+    // A conversation's recorded documents as bytes, for whoever owns it, a guest with no Files included; the route
+    // serves those paths alone (the daemon's conversations/produced-files.ts).
+    "GET /agents/{id}/documents/raw": { guest: true, lane: "bulk" },
     // The bytes behind the workspace reads; each applies the caller's fence itself.
     "GET /workspace/raw": { guest: true, lane: "bulk" },
     // No door, unlike media: the page fetches a thumbnail itself, so the request carries the header.
@@ -118,9 +123,10 @@ export const RAW_ROUTES = {
     "ALL /x/*": {},
     // The `capabilities` CLI's discovery by name; its ask is the needs door (contracts/needs.contract.ts).
     "GET /capabilities/connectable": { floor: "maintainer", agent: true, control: "never" },
-    // The `sandboxes` CLI; every create parks on a card in the owner's chat first.
+    // The `sandboxes` CLI; every create and every removal parks on a card in the owner's chat first.
     "GET /sandboxes": { agent: true },
     "POST /sandboxes": { agent: true },
+    "POST /sandboxes/remove": { agent: true },
     // The `wallet` CLI; spend is bounded by the owner's policy and the key never enters the container.
     "GET /wallet/status": { agent: true, control: "never" },
     "POST /wallet/fetch": { agent: true, control: "never" },
@@ -135,6 +141,10 @@ export const RAW_ROUTES = {
     "POST /children/answer": { agent: true, control: "never" },
     "POST /children/cancel": { agent: true, control: "never" },
     "POST /children/merge": { agent: true, control: "never" },
+    // Handing a task to another of the owner's sandboxes over a link card (`agents delegate`), and which links this
+    // conversation's turn may hand work to (`agents links`); held to the cards the turn was granted, like the tool.
+    "POST /children/delegate": { agent: true, control: "never" },
+    "GET /children/links": { agent: true, control: "never" },
     "GET /children": { agent: true, control: "never" },
     // The fleet reads, and the one write: words in front of another conversation, which a person can do by typing.
     "GET /fleet": { agent: true },
@@ -203,6 +213,12 @@ export const RAW_ROUTES = {
     // A connected browser's credential doors, on its durable token: a sign-in moves in (`session`) or out (`lend`).
     "POST /system/webext/session": { auth: "door", control: "never" },
     "POST /system/webext/lend": { auth: "door", control: "never" },
+    // A secret the browser types for the agent (`type_secret` aimed at it): one value for one ticket the daemon minted
+    // for this browser and one host, handed back on the browser's own request rather than over the tool socket.
+    "POST /system/webext/secret": { auth: "door", control: "never" },
+    // This sandbox's keyring keys (schemas/keyring.ts), public halves only: a keyring fetches them here over TLS, from the
+    // sandbox's own address, before it shares anything with it, rather than take them from whoever relays the share.
+    "GET /keyring/keys": { auth: "door", control: "never" },
     "POST /system/runners/{id}/definition/sync": { control: "never" },
     // A runner's git door and credential doors, each on the runner's own bearer.
     "GET /system/runners/git/{repo}/info/refs": { auth: "door", control: "never", lane: "bulk" },
@@ -218,6 +234,21 @@ export const RAW_ROUTES = {
     // Its sibling for MCP: a hooked runtime's (Cursor's) calls to its turn's MCP servers, on a session signed the same
     // way, naming the provider and the one server it may forward to. Held open while a server streams its answer.
     "ALL /privacy/mcp/{session}": { auth: "door", control: "never", stream: true },
+    // Inbound links: another of the owner's sandboxes handing this one tasks (schemas/links.ts). Minted, re-termed and
+    // revoked by the owner alone, checked in the handler like a control token; a waiting task is the owner's to allow.
+    "GET /system/links": { control: "never" },
+    "POST /system/links": { control: "never" },
+    "POST /system/links/{id}": { control: "never" },
+    "DELETE /system/links/{id}": { control: "never" },
+    "POST /system/links/{id}/requests/{request}": { control: "never" },
+    // The link doors, called by the asking sandbox's daemon: each checks the link token itself (x-intentic-link) and
+    // reaches only the conversations that link opened, which is the whole of a link's reach.
+    "GET /link": { auth: "door", control: "never" },
+    "POST /link/conversations": { auth: "door", control: "never" },
+    "GET /link/conversations/{id}": { auth: "door", control: "never" },
+    "POST /link/conversations/{id}/messages": { auth: "door", control: "never" },
+    "POST /link/conversations/{id}/answer": { auth: "door", control: "never" },
+    "POST /link/conversations/{id}/stop": { auth: "door", control: "never" },
     "POST /system/control/tokens": { control: "never" },
     "GET /system/control/tokens": { control: "never" },
     "DELETE /system/control/tokens/{id}": { control: "never" },
@@ -249,6 +280,9 @@ export const RAW_ROUTES = {
 
 export type RawRouteKey = keyof typeof RAW_ROUTES;
 
+// The raw routes the daemon registers itself: every one but those netd answers before a request reaches the daemon.
+export type DaemonRawRouteKey = { [K in RawRouteKey]: (typeof RAW_ROUTES)[K] extends { readonly netd: true } ? never : K }[RawRouteKey];
+
 // A raw route's path, for a caller that builds a URL to it rather than registering it.
 export const rawRoutePath = (key: RawRouteKey): string => key.slice(key.indexOf(" ") + 1);
 

package/src/protocol/route-meta.ts

@@ -6,7 +6,8 @@ import type { MemberRole } from "../schemas/shared.js";
 // declare nothing; the daemon's bearer, boot, timer, role-floor and grant decisions all derive from this.
 
 // How far a control token reaches a route beyond what its floor alone gives the `read`/`drive` rungs.
-// `never`: no rung; `editor`: the editor slice too; `read`: the read rung, though no GET; `land`: the land rung too.
+// `never`: no rung; `editor`: the editor slice too; `read`: the read rung and the editor slice, though no GET (watching
+// a turn is part of driving one); `land`: the land rung too.
 export type ControlReach = "never" | "editor" | "read" | "land";
 
 export interface RouteMeta {

package/src/protocol/routes.test.ts

@@ -1,6 +1,7 @@
 import { eventIterator, oc } from "@orpc/contract";
 import { z } from "zod";
-import { SANDBOX_ROUTE_NAMES, SANDBOX_ROUTES, sandboxRouteName, sandboxRouteFingerprints } from "../index.js";
+import { RAW_JSON_ROUTES } from "./raw/raw-json-routes.js";
+import { RAW_ROUTE_NAMES, rawRouteFingerprints, SANDBOX_ROUTE_NAMES, SANDBOX_ROUTES, sandboxRouteName, sandboxRouteFingerprints } from "../index.js";
 import { procedure } from "./route-meta.js";
 import { contractRoutes, routeNameForRequest, routeShapes, servedRoute, streamOf } from "./routes.js";
 
@@ -273,6 +274,37 @@ describe(`the real sandbox contract`, () => {
         expect(Object.keys(sandboxRouteFingerprints()).length).toBe(SANDBOX_ROUTE_NAMES.length);
     });
 
+    // The other half of the surface. Unfingerprinted and unnamed, these were the routes no version check could see:
+    // a browser calling one an older daemon predates got a bare 404 and nothing to say about it.
+    it(`names every hand-written route beside the procedures, and keeps the two sets apart`, () => {
+        expect(RAW_ROUTE_NAMES).toContain(`GET /system/links`);
+        expect(RAW_ROUTE_NAMES.filter((name) => SANDBOX_ROUTE_NAMES.includes(name))).toEqual([]);
+        expect(new Set(RAW_ROUTE_NAMES).size).toBe(RAW_ROUTE_NAMES.length);
+    });
+
+    it(`fingerprints every hand-written route whose schemas can be expressed`, () => {
+        const prints = rawRouteFingerprints();
+        // The two exceptions are `z.custom()` (schemas/system.ts: the WebAuthn options the browser's own parser reads,
+        // checked here for a challenge and nothing else), which has no JSON Schema to hash. They are still advertised
+        // by name, so a daemon that lacks them is caught; only a change in their fields passes unnoticed. A third name
+        // here is a schema that quietly stopped being comparable, not a licence to add one.
+        expect(Object.keys(RAW_JSON_ROUTES).filter((name) => !(name in prints))).toEqual([
+            `POST /system/passkeys/register/options`,
+            `POST /system/passkeys/assert/options`,
+        ]);
+        // Only those: a WebSocket upgrade or a byte stream declares nothing to compare, and an unfingerprinted route
+        // is compared on nothing rather than read as a disagreement.
+        expect(Object.keys(prints).every((name) => name in RAW_JSON_ROUTES)).toBe(true);
+    });
+
+    it(`fingerprints a route by what it carries, so a changed field is a different print`, () => {
+        const prints = rawRouteFingerprints();
+        expect(prints[`GET /system/links`]).toEqual(expect.any(String));
+        expect(prints[`GET /system/links`]).not.toBe(prints[`GET /members`]);
+        // A body of bytes has no input schema, and the answer alone decides its print.
+        expect(prints[`POST /workspace/upload`]).toBe(prints[`POST /workspace/upload-archive`]);
+    });
+
     it(`derives a route table with no duplicate names`, () => {
         expect(SANDBOX_ROUTE_NAMES.length).toBe(SANDBOX_ROUTES.length);
         expect(new Set(SANDBOX_ROUTE_NAMES).size).toBe(SANDBOX_ROUTE_NAMES.length);

package/src/protocol/routes.ts

@@ -150,6 +150,24 @@ export const routeShapes = (contract: Record<string, unknown>): Record<string, s
     return shapes;
 };
 
+// The same, for the hand-written routes that answer plain JSON (raw-json-routes.ts). They carry their schemas directly
+// rather than through oRPC, so they need their own walk — and without one they were the half of the surface no version
+// check could see: a browser calling a raw route an older daemon predates got a bare 404 with nothing to say about it.
+// The table is passed in rather than imported, so this file stays free of the raw tables that read its types.
+export const rawRouteFingerprintsOf = (table: Record<string, { readonly input?: unknown; readonly output?: unknown }>) => {
+    const prints: Record<string, string> = {};
+    for (const [name, route] of Object.entries(table)) {
+        try {
+            // A `text` or `bytes` route declares no input schema; its body is the document or the bytes, and the
+            // fingerprint is its answer alone.
+            prints[name] = fingerprint({ in: wireShape(route.input, "input"), out: wireShape(route.output, "output") });
+        } catch {
+            continue;
+        }
+    }
+    return prints;
+};
+
 // A template split once: a literal segment, or undefined for a `{param}`; `tail` for a raw route's trailing `/*`.
 interface Pattern {
     readonly route: ContractRoute;

package/src/protocol/sse.ts

@@ -144,7 +144,7 @@ export async function* sseEvents(body: ReadableStream<Uint8Array>, idleMs: numbe
             const idle = new Promise<`idle`>((resolve) => {
                 timer = setTimeout(() => resolve(`idle`), idleMs);
             });
-            // oxlint-disable-next-line eslint/no-await-in-loop -- streaming reader; each chunk must be awaited in order as it arrives
+            // streaming reader; each chunk must be awaited in order as it arrives
             const result = await Promise.race([reader.read(), idle]);
             clearTimeout(timer);
             if (result === `idle`) {

package/src/schemas/agent.ts

@@ -182,7 +182,7 @@ const AgentTurnFieldsSchema = z.object({
     // (withRuntimeDefaults), rather than refusing a turn a stale composer setting named.
     harness: AgentHarnessSchema.optional().describe("Which agentic loop runs the turn. Leave it out to use each provider's own."),
     // Intent, not a guess: absent continues on the conversation's own account, or picks by serviceability where there is
-    // none on this provider yet (agent/providers/accounts/routing.ts).
+    // none on this provider yet (conversations/registry/routing.ts).
     account: z
         .string()
         .optional()

package/src/schemas/agents.ts

@@ -997,6 +997,7 @@ export type AgentSpan = z.infer<typeof AgentSpanSchema>;
 // the rest of the turn lands on top of it later. Doesn't apply to a turn parked on a question, which needs no override
 // at all.
 export const AgentLandSchema = z.object({
+    includeDocuments: z.boolean().optional().describe("Include recorded result documents, even when ignored or classified as scratch."),
     id: z.string().min(1).describe("Which conversation's work to merge."),
     mode: LandModeSchema.optional().describe(
         "How to apply it. The default applies every repository or none, so a refusal leaves the workspace exactly as it was. The other carries the whole composition and leaves conflicted paths with markers to resolve by hand.",

package/src/schemas/approvals.ts

@@ -94,6 +94,20 @@ export const ActionApprovalSchema = z.object({
         .describe(
             "What to do once approved, written for the fresh turn that will do it: names, ids and steps, since it has none of this conversation.",
         ),
+    // Written by a connection's own command when it holds an act (e-urzad's office acts), never by hand. Part of what
+    // the yes pins, like every field but the bookkeeping, so an item edited after the yes no longer matches it.
+    performer: z
+        .object({
+            extension: z.string().min(1).describe("The extension that carries it out, by its publisher.name (\"intentic.e-urzad\")."),
+            digest: z
+                .string()
+                .regex(/^[0-9a-f]{64}$/)
+                .describe("The SHA-256 of exactly what it will do, which the extension recomputes before acting and refuses on any difference."),
+        })
+        .optional()
+        .describe(
+            "Who carries this out instead of an agent turn: once you approve it, the sandbox hands it to that extension's backend, which acts only if what it holds still matches the digest. Written by the extension's own command when it holds an act; an item written by hand never needs one.",
+        ),
     ...envelope,
 });
 export type ActionApproval = z.infer<typeof ActionApprovalSchema>;

package/src/schemas/capabilities.ts

@@ -33,6 +33,7 @@ export const CapabilityKindSchema = z.enum([
     "localmodel",
     "wallet",
     "fleet",
+    "link",
 ]);
 export type CapabilityKind = z.infer<typeof CapabilityKindSchema>;
 export const CapabilityStateSchema = z.enum(["active", "pending", "error", "inactive"]);
@@ -372,6 +373,16 @@ export const FleetConfigSchema = z.object({
     token: z.string().min(1).describe("A provisioning token from Settings ▸ Tokens. Stored, never echoed back."),
 });
 export type FleetConfig = z.infer<typeof FleetConfigSchema>;
+// Another of the owner's sandboxes this one may hand tasks to (schemas/links.ts). The token is an inbound link that
+// sandbox's owner minted, held by this daemon and never put in the agent's env, like the fleet's: the agent gets the
+// `delegate` tool, not the credential. What a task may do over there is that sandbox's terms, never this card's.
+export const LinkConfigSchema = z.object({
+    url: z.url().describe("The other sandbox's own address, the one its editor reaches it at."),
+    token: z.string().min(1).describe("The link token that sandbox minted for this one. Stored, never echoed back."),
+    name: z.string().max(100).optional().describe("What the other sandbox is called, as its owner named it."),
+    sandboxId: z.string().max(100).optional().describe("The other sandbox's id on the owner's account."),
+});
+export type LinkConfig = z.infer<typeof LinkConfigSchema>;
 export type McpConfig = z.infer<typeof McpConfigSchema>;
 export type CliConfig = z.infer<typeof CliConfigSchema>;
 export type PluginConfig = z.infer<typeof PluginConfigSchema>;
@@ -426,6 +437,8 @@ export const CapabilitySchema = z.discriminatedUnion("kind", [
     z.object({ id: entryId, kind: z.literal("wallet"), config: WalletConfigSchema }),
     // The owner's account, one per sandbox: the box holding this may provision sandboxes on it.
     z.object({ id: entryId, kind: z.literal("fleet"), config: FleetConfigSchema }),
+    // Another of the owner's sandboxes, one card per sandbox: the id is the agent's name for it (`delegate`'s `to`).
+    z.object({ id: entryId, kind: z.literal("link"), config: LinkConfigSchema }),
 ]);
 export type Capability = z.infer<typeof CapabilitySchema>;
 // A credential the owner must type elsewhere (a WhatsApp pairing code); rendered large and copyable, not buried in
@@ -505,6 +518,18 @@ export const CapabilitySecretInputSchema = z.object({
     id: z.string().describe("Which connection."),
     value: z.string().min(1).describe("The new credential. Its other settings are left alone."),
 });
+// POST /capabilities/{id}/oauth-token: a delegated sign-in's refresh token, stored on the card that declares
+// `refreshToken` in its manifest. Write-only: the caller proves it holds the card's current token (empty before the
+// first sign-in) and names the settings it signed in against, so a card edited meanwhile, or another card, is refused.
+export const CapabilityRefreshTokenInputSchema = z.object({
+    id: z.string().describe("Which connection."),
+    binding: z
+        .record(z.string(), z.string())
+        .describe("The card's settings the sign-in was made against, by field key: those its manifest's `refreshToken.boundTo` names."),
+    previous: z.string().max(32768).describe("The token the caller holds for this card, empty before its first sign-in."),
+    refreshToken: z.string().min(1).max(32768).describe("The new refresh token. Never echoed back."),
+    login: z.boolean().optional().describe("A fresh interactive sign-in rather than a rotation: restarts the card's listener."),
+});
 // POST /capabilities/{id}/rename: a capability's id is the agent's handle for it (skill file, tool prefix, env suffix,
 // ssh alias), so renaming is a migration, not a label edit. Which kinds may be renamed is the handler's own answer, not
 // this schema's.

package/src/schemas/data-protection.ts

@@ -5,6 +5,7 @@
 // data protection page, never through a changed default: most sandboxes belong to developers and individuals, and a
 // stricter default would take away something they rely on.
 import { z } from "zod";
+import type { AdmissionRule } from "./agent.js";
 
 export const RETENTION_DAYS_MAX = 3650;
 const retentionDays = () => z.number().int().min(0).max(RETENTION_DAYS_MAX).default(0);
@@ -71,6 +72,52 @@ export const AuditSettingsSchema = z.object({
 });
 export type AuditSettings = z.infer<typeof AuditSettingsSchema>;
 
+// Every outward action the agent can take that the action rules (SandboxSettings.actionRules) gate, by the key its gate
+// consults: the outbound sniffer's (the daemon's activity/outbound.ts: discord, slack, telegram, whatsapp) and the
+// subagent gate's (guard/actions.ts childSpawn). Writes only: a rule on `messages.read` would hold a bot reading its own
+// channel. Email sending is the key the IMAP extension's sender consults (_extensions/imap/src/send.ts); the three
+// `microsoft365.*` keys are what `m365` consults before sending, changing a calendar or uploading
+// (_extensions/microsoft-365/src/actions.ts); the `ezdrp.*` and `edoreczenia.*` keys are the office acts the e-urzad
+// extension's guard consults (_extensions/e-urzad/src/core/guard.ts): registering mail and adding files in EZD RP, sending
+// an e-Doręczenia delivery, and opening one, the one read here with legal effect (it can make the delivery received).
+// One list for the public-office preset, which holds every one of them, and the editor's Guardrails page, which sets them.
+export const OUTWARD_ACTION_KEYS = [
+    "discord.message.send",
+    "discord.reaction.add",
+    "slack.message.send",
+    "slack.message.edit",
+    "slack.reaction.add",
+    "slack.reaction.remove",
+    "telegram.message.send",
+    "telegram.message.edit",
+    "telegram.reaction.add",
+    "whatsapp.message.send",
+    "imap.message.send",
+    "microsoft365.mail.send",
+    "microsoft365.calendar.write",
+    "microsoft365.files.upload",
+    "ezdrp.document.register-incoming",
+    "ezdrp.document.register-outgoing",
+    "ezdrp.case.attach-draft",
+    "edoreczenia.delivery.send",
+    "edoreczenia.delivery.open",
+    "agents.spawn",
+] as const;
+export type OutwardActionKey = (typeof OUTWARD_ACTION_KEYS)[number];
+
+// The service an action key belongs to: its first segment (`discord`, `imap`, `agents`).
+export const outwardActionService = (key: string): string => key.split(".")[0] ?? key;
+
+// The rule an action's gate applies today: the exact key, else the service's wildcard (guard/actions.ts outboundSend).
+// `agents.spawn` has no wildcard of its own. Undefined is no rule, which every gate reads as allowed, except the
+// subagent gate, which holds a spawn after outside content.
+export const effectiveActionRule = (rules: Readonly<Record<string, AdmissionRule>>, key: string): AdmissionRule | undefined => {
+    if (rules[key] !== undefined) {
+        return rules[key];
+    }
+    return key === "agents.spawn" ? undefined : rules[`${outwardActionService(key)}.*`];
+};
+
 export const AI_NOTICE_TEXT_MAX = 4000;
 
 // The AI Act's literacy duty (Art. 4) falls on whoever puts staff in front of an AI system. This is the card that tells

package/src/schemas/devices.ts

@@ -619,7 +619,14 @@ export const DeviceSchema = z.object({
     gap: DeviceGapSchema.optional(),
 });
 export type Device = z.infer<typeof DeviceSchema>;
-export const DevicesListSchema = z.object({ devices: z.array(DeviceSchema) });
+// (2026-10-15) A device enrollment no capability card holds: a key into this sandbox for which no board draws a machine,
+// since a machine is drawn from its card. Listed so the owner can withdraw it (`DELETE /system/hosts/{id}`, `id` being the
+// connection key); never withdrawn by the daemon itself, since the manifest the cards live in is a workspace file a land
+// can rewrite for a moment, and withdrawing on that would unpair real devices.
+export const CardlessHostSchema = z.object({ id: z.string(), card: z.string(), environment: z.string() });
+export type CardlessHost = z.infer<typeof CardlessHostSchema>;
+// `cardlessHosts` is absent when there are none, and from a daemon older than the field.
+export const DevicesListSchema = z.object({ devices: z.array(DeviceSchema), cardlessHosts: z.array(CardlessHostSchema).optional() });
 export type DevicesList = z.infer<typeof DevicesListSchema>;
 
 // The physical computer a device is an environment of. Windows and every WSL distro on it are one machine with one

package/src/schemas/git/git.ts

@@ -276,7 +276,7 @@ export type ScratchPath = z.infer<typeof ScratchPathSchema>;
 export const isScratch = (path: string, scratch: readonly Pick<ScratchPath, "path">[]): boolean =>
     scratch.some((entry) => (entry.path.endsWith("/") ? path.startsWith(entry.path) : path === entry.path));
 // Apart from scratch, which is left out for its shape: these are left out because the repository says so, and the
-// owner usually wants them most (a render in `out/`, a build in `dist/`).
+// owner usually wants them most (a render in `out/`, a report as a PDF). Build output an ignore rule hides is not one.
 export const IgnoredOutputKindSchema = z
     .enum(["new", "changed"])
     .describe("Whether your tree has nothing at this path yet, or holds a different file there that copying would replace.");
@@ -464,6 +464,19 @@ export const AgentRepoChangesSchema = z.object({
 export type AgentRepoChanges = z.infer<typeof AgentRepoChangesSchema>;
 // The review, plus why the last land refused: a conflict is found when the turn ends but resolved later on this
 // surface, so it rides here rather than only in the land response, and refreshes on every land.
+// A workspace repo this conversation's copy does not carry, where the copy nonetheless holds files at its path: what a
+// turn wrote into a folder that was no checkout of its own, which therefore reached no branch.
+export const OutsideCheckoutSchema = z.object({
+    repo: z.string().describe("Which repository."),
+    reason: z
+        .enum(["unborn", "unreadable", "not-carried"])
+        .describe(
+            "Why the copy does not carry it: `unborn` has no commit yet to start from, and is taken in on the conversation's next turn once it has one; `unreadable` is a repository git cannot read; `not-carried` is one the conversation was set up without, such as a persona that names other repositories.",
+        ),
+    files: z.number().describe("How many files the copy holds at its path. A floor past a thousand, which is where the count stops."),
+});
+export type OutsideCheckout = z.infer<typeof OutsideCheckoutSchema>;
+
 export const AgentChangesSchema = z.object({
     repos: z.array(AgentRepoChangesSchema).describe("One entry per repository the conversation touched."),
     // Disambiguates two opposite reasons for an empty list: nothing written, versus everything already committed.
@@ -533,7 +546,14 @@ export const AgentChangesSchema = z.object({
         )
         .optional()
         .describe(
-            "Files the conversation wrote in its copy that the repository's ignore rules exclude, such as a render in `out/` or a build in `dist/`, which your tree lacks or holds differently. No merge carries them and they never enter git; copying one puts it at the same path in your tree. Dependencies (`node_modules`), hidden files and folders, and logs, dumps and caches are never listed. Absent when there are none.",
+            "Files made for a person that the conversation wrote in its copy and the repository's ignore rules exclude, such as a render in `out/` or a report as a PDF, which your tree lacks or holds differently. Only media, documents, tables, archives and installers are listed: what a build regenerates (code, maps, a Cargo `target/` or anything else tagged CACHEDIR.TAG), dependencies, hidden files, logs and dumps never are. No merge carries them and they never enter git; copying one puts it at the same path in your tree. Absent when there are none.",
+        ),
+    // Read off the live copy like scratch: a retired copy has no holes to read.
+    outside: z
+        .array(OutsideCheckoutSchema)
+        .optional()
+        .describe(
+            "Repositories of your workspace this conversation's copy does not carry, where it nonetheless wrote files at their path. Nothing written there is on its branch, so no merge brings it; an `unborn` one is taken into the copy, with those files, on the conversation's next turn after its first commit. Absent when there are none.",
         ),
 });
 export type AgentChanges = z.infer<typeof AgentChangesSchema>;

package/src/schemas/hosts.ts

@@ -110,7 +110,19 @@ export type DeviceFacts = z.infer<typeof DeviceFactsSchema>;
 //   run under the agent's supervision (device-artifacts.ts); an agent without it is told to update rather than sent one.
 // - `project-delivery`: the `deliverProject` procedure, landed work written into a folder attached to this computer's
 //   sandbox (project-delivery.ts); an agent without it is never sent one, and the land waits for Bring back.
-export const DeviceFeatureSchema = z.enum(["reshape-later", "set-shape", "rollback-to", "loopback-catch", "background-prepare", "project-delivery", "programs"]);
+// - `keyring`: the keyring* procedures, intentic-keyring on this computer reached through the machine (keyring.ts);
+//   advertised only while a keyring is installed, so a sandbox never offers a computer without one as a place to keep or
+//   type a secret.
+export const DeviceFeatureSchema = z.enum([
+    "reshape-later",
+    "set-shape",
+    "rollback-to",
+    "loopback-catch",
+    "background-prepare",
+    "project-delivery",
+    "programs",
+    "keyring",
+]);
 export type DeviceFeature = z.infer<typeof DeviceFeatureSchema>;
 export const DEVICE_FEATURE_RESHAPE_LATER: DeviceFeature = "reshape-later";
 export const DEVICE_FEATURE_SET_SHAPE: DeviceFeature = "set-shape";
@@ -119,6 +131,7 @@ export const DEVICE_FEATURE_LOOPBACK_CATCH: DeviceFeature = "loopback-catch";
 export const DEVICE_FEATURE_BACKGROUND_PREPARE: DeviceFeature = "background-prepare";
 export const DEVICE_FEATURE_PROJECT_DELIVERY: DeviceFeature = "project-delivery";
 export const DEVICE_FEATURE_PROGRAMS: DeviceFeature = "programs";
+export const DEVICE_FEATURE_KEYRING: DeviceFeature = "keyring";
 // The features an agent advertised that this build knows; an unknown one is a newer agent's and means nothing here.
 export const deviceFeatures = (facts: Pick<DeviceFacts, "features"> | undefined): DeviceFeature[] =>
     (facts?.features ?? []).flatMap((feature) => {