@intentic/sandbox-contract 1.337.0 → 1.339.0

package/src/state/contract-lock.ts

@@ -1,8 +1,8 @@
 // contract.lock.json is every exported schema serialized to canonical JSON Schema, so git can flag a wire-contract
 // change. contract-shrink demands a `!` commit with a Breaking-Note when a schema, field or type shrinks; additions
-// pass freely. Derived from the package's exports, not a hand-kept list, plus the wire no oRPC route carries: the
-// manifests the Rust crates that define it write beside their TypeScript (the tunnel, what a browser sees of netd
-// and the edge, and netd's control socket with Node), under `wire:` names no export can take.
+// pass freely. Derived from every module's exports (contract-modules.ts), not a hand-kept list, plus the wire no oRPC
+// route carries: the manifests the Rust crates that define it write beside their TypeScript (the tunnel, what a browser
+// sees of netd and the edge, and netd's control socket with Node), under `wire:` names no export can take.
 //
 // And who reaches each route: every raw route's and every procedure's RouteMeta, each reach field with its default
 // resolved (route-meta.ts `routeAccess`), under `access:METHOD /path`. Resolved, so every field is a value on every
@@ -15,7 +15,10 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { packageRoot } from "@intentic/constants/node";
 import { z } from "zod";
-import * as contract from "../index.js";
+import { SANDBOX_ROUTES } from "../index.js";
+import { RAW_ROUTE_LIST } from "../protocol/raw/raw-routes.js";
+import { routeAccess } from "../protocol/route-meta.js";
+import { contractModules } from "./contract-modules.js";
 
 // Canonical key order so two runs are byte-identical and a diff is a real contract change, not key-order noise. Arrays
 // keep zod's own (stable) order.
@@ -39,12 +42,12 @@ const ACCESS_PREFIX = "access:";
 // route moving between procedures is seen.
 const accessEntries = (): Record<string, Readonly<Record<string, string | boolean>>> => {
     const entries = new Map<string, Readonly<Record<string, string | boolean>>>();
-    for (const route of [...contract.RAW_ROUTE_LIST, ...contract.SANDBOX_ROUTES]) {
+    for (const route of [...RAW_ROUTE_LIST, ...SANDBOX_ROUTES]) {
         const key = `${ACCESS_PREFIX}${route.method} ${route.path}`;
         if (entries.has(key)) {
             throw new Error(`two routes declare ${route.method} ${route.path}; the lock can record only one reach for it`);
         }
-        const access = contract.routeAccess(route.method, route.meta);
+        const access = routeAccess(route.method, route.meta);
         const fields = route.name === `${route.method} ${route.path}` ? access : { ...access, procedure: route.name };
         entries.set(key, Object.fromEntries(Object.entries(fields).toSorted(([a], [b]) => a.localeCompare(b))));
     }
@@ -84,13 +87,41 @@ export const accessChanges = (baseText: string, headText: string): string[] => {
 // Each written by its crate's own test: `tunnel`, `browser-wire` and `netd-wire` under _sandbox/netd/crates.
 const WIRE_MANIFESTS = ["browser-wire", "netd-wire", "tunnel"] as const;
 
-export const currentLock = (): Record<string, unknown> => {
-    const lock: Record<string, unknown> = {};
-    for (const name of Object.keys(contract).sort()) {
-        const value = (contract as Record<string, unknown>)[name];
-        if (!(value instanceof z.ZodType)) {
-            continue;
+// Schemas exported where the barrel never re-exported them, so the lock never recorded them; recording one is an addition.
+const UNRECORDED = new Map<string, readonly string[]>([
+    ["contracts/usage.contract", ["RefreshPlanLimitsSchema"]],
+    ["policy/identity-assertion", ["IdentityAssertionMethodSchema"]],
+    // Its ExtensionHealthSchema is not schemas/extension-updates.ts's, so it can only be recorded once one is renamed.
+    [
+        "protocol/raw/extension-protocol",
+        ["ExtensionEventSchema", "ExtensionHealthSchema", "ExtensionOwnSettingsSchema", "ExtensionPermissionsSchema"],
+    ],
+    ["schemas/internal", ["RefNameSchema", "autoStart", "entryId"]],
+]);
+
+// Every schema the lock records, by its export name. A name two modules export as different schemas throws: the lock
+// is keyed by name, and either one recorded alone would hide a change to the other.
+export const lockedSchemas = async (): Promise<ReadonlyMap<string, z.ZodType>> => {
+    const found = new Map<string, { readonly schema: z.ZodType; readonly module: string }>();
+    for (const [module, exports] of await contractModules()) {
+        const skipped = new Set(UNRECORDED.get(module));
+        for (const [name, value] of exports) {
+            if (!(value instanceof z.ZodType) || skipped.has(name)) {
+                continue;
+            }
+            const held = found.get(name);
+            if (held !== undefined && held.schema !== value) {
+                throw new Error(`${held.module} and ${module} both export a schema named ${name}; the lock can record only one`);
+            }
+            found.set(name, { schema: value, module: held?.module ?? module });
         }
+    }
+    return new Map([...found].toSorted(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)).map(([name, { schema }]) => [name, schema]));
+};
+
+export const currentLock = async (): Promise<Record<string, unknown>> => {
+    const lock: Record<string, unknown> = {};
+    for (const [name, value] of await lockedSchemas()) {
         try {
             const schema = sorted(z.toJSONSchema(value, { unrepresentable: "any" })) as Record<string, unknown>;
             // The dialect banner is identical on every entry; pure weight, no signal.

package/src/state/contract-modules.ts

@@ -0,0 +1,41 @@
+// Every module of this package, loaded by walking src/ rather than through index.ts, so what reads the package's whole
+// surface (the lock, the daemon's shape seed) sees every module whether or not the barrel re-exports it. The list comes
+// from src/ even when this runs from dist/, since a dist/ file whose source is gone is never cleaned away.
+
+import { readdirSync } from "node:fs";
+import { join, relative } from "node:path";
+import { pathToFileURL } from "node:url";
+import { packageRoot } from "@intentic/constants/node";
+
+// Package-relative to src/, forward slashes, without the extension: the specifier after `@intentic/sandbox-contract/`.
+export type ContractModuleId = string;
+
+const sourceModules = (dir: string): string[] =>
+    readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+        const path = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            return sourceModules(path);
+        }
+        return entry.name.endsWith(".ts") && !entry.name.endsWith(".test.ts") && !entry.name.endsWith(".d.ts") ? [path] : [];
+    });
+
+// What one module exports, by name.
+export type ContractModuleExports = ReadonlyMap<string, unknown>;
+
+// Each module's exports by id, in id order; `index` is left out, being what this walk stands in for.
+export const contractModules = async (): Promise<ReadonlyMap<ContractModuleId, ContractModuleExports>> => {
+    const root = packageRoot(import.meta.url);
+    const source = join(root, "src");
+    const fromSource = import.meta.url.endsWith(".ts");
+    const ids = sourceModules(source)
+        .map((path) => relative(source, path).replaceAll("\\", "/").replace(/\.ts$/, ""))
+        .filter((id) => id !== "index")
+        .toSorted();
+    const modules = new Map<ContractModuleId, ContractModuleExports>();
+    for (const id of ids) {
+        const file = fromSource ? join(source, `${id}.ts`) : join(root, "dist", `${id}.js`);
+        const namespace: object = await import(pathToFileURL(file).href);
+        modules.set(id, new Map(Object.entries(namespace)));
+    }
+    return modules;
+};

package/src/state/daemon-floor.test.ts

@@ -0,0 +1,81 @@
+import { HelloSchema, type SystemEvent, SystemEventSchema } from "../events/system-events.js";
+import { daemonBelowFloor, daemonVersionOfBuild, OLDEST_SUPPORTED_DAEMON } from "./daemon-floor.js";
+import { DEV_VERSION, parseVersion } from "./versions.js";
+
+describe(`the oldest supported daemon`, () => {
+    it(`names a released version`, () => {
+        expect(parseVersion(OLDEST_SUPPORTED_DAEMON)?.prerelease).toEqual([]);
+        expect(OLDEST_SUPPORTED_DAEMON).not.toBe(DEV_VERSION);
+    });
+
+    it(`reads the version off the head of a hello's build id`, () => {
+        expect(daemonVersionOfBuild(`1.337.0:1760000000000`)).toBe(`1.337.0`);
+        expect(daemonVersionOfBuild(`0.0.0:1760000000000`)).toBe(`0.0.0`);
+        // A bare version, should the mtime ever go, still reads.
+        expect(daemonVersionOfBuild(`1.249.0`)).toBe(`1.249.0`);
+    });
+
+    it(`reads no version where the build names none`, () => {
+        expect(daemonVersionOfBuild(undefined)).toBeUndefined();
+        expect(daemonVersionOfBuild(``)).toBeUndefined();
+        expect(daemonVersionOfBuild(`test`)).toBeUndefined();
+        expect(daemonVersionOfBuild(`:1760000000000`)).toBeUndefined();
+    });
+
+    it(`calls a release older than the floor too old, and the floor itself and anything newer supported`, () => {
+        expect(daemonBelowFloor(`1.248.0`)).toBe(true);
+        expect(daemonBelowFloor(`1.0.0`)).toBe(true);
+        expect(daemonBelowFloor(OLDEST_SUPPORTED_DAEMON)).toBe(false);
+        expect(daemonBelowFloor(`1.337.0`)).toBe(false);
+        expect(daemonBelowFloor(`2.0.0`)).toBe(false);
+    });
+
+    // A checkout's build never checks for updates and has none to take; an unknown version is no evidence at all.
+    it(`never calls a build from a checkout, or an unknown version, too old`, () => {
+        expect(daemonBelowFloor(DEV_VERSION)).toBe(false);
+        expect(daemonBelowFloor(undefined)).toBe(false);
+        expect(daemonBelowFloor(`unknown`)).toBe(false);
+    });
+});
+
+// WHAT KEEPS THE FLOOR HONEST. A daemon at the floor sends every /events frame with the fields it had then. A field
+// made required since is one such a daemon leaves out, and the editor reads the gap as something gone wrong (a
+// heartbeat with no `rev` re-reads the whole roster every two seconds). So the fields each frame requires are frozen
+// here, every kind by name (the `satisfies` makes a kind left out a type error). Adding a frame kind is fine (an older
+// daemon simply never sends it): add its required fields below. Making a field of an existing kind required is not:
+// make it optional, or raise OLDEST_SUPPORTED_DAEMON to the first release that sends it, with a dated line saying why.
+const REQUIRED_SINCE_FLOOR = {
+    hello: [`kind`, `workspaceId`],
+    heartbeat: [`kind`, `rev`],
+    boot: [`kind`, `ready`, `startedAt`, `steps`],
+    workspaceChanged: [`kind`, `paths`],
+    treeChanged: [`dirs`, `from`, `generation`, `kind`],
+    derivedChanged: [`kind`, `paths`],
+    reposChanged: [`kind`, `repos`],
+    refsChanged: [`kind`, `repos`],
+    runtimeChanged: [`domains`, `kind`],
+    presence: [`kind`, `users`],
+    agents: [`agents`, `kind`, `rev`],
+    accountUsage: [`account`, `kind`, `provider`],
+    providerRefusal: [`kind`, `provider`],
+} satisfies Record<SystemEvent[`kind`], readonly string[]>;
+
+// What a frame of this kind cannot go without: every field a frame carrying nothing but its kind is refused for.
+const requiredOf = (kind: string): string[] => {
+    const parsed = SystemEventSchema.safeParse({ kind });
+    const missing = parsed.success ? [] : parsed.error.issues.map((issue) => String(issue.path[0]));
+    return [...new Set([`kind`, ...missing])].toSorted();
+};
+
+describe(`the /events frames a daemon at the floor sends`, () => {
+    it(`require no field the floor did not send`, () => {
+        for (const [kind, fields] of Object.entries(REQUIRED_SINCE_FLOOR)) {
+            expect({ kind, required: requiredOf(kind) }).toEqual({ kind, required: [...fields] });
+        }
+    });
+
+    // What the editor reads its verdict off: the route list, the fingerprints and the build that opens with the version.
+    it(`keep the hello fields the editor gates on`, () => {
+        expect(HelloSchema.keyof().options).toEqual(expect.arrayContaining([`routes`, `shapes`, `build`]));
+    });
+});

package/src/state/daemon-floor.ts

@@ -0,0 +1,32 @@
+import { compareVersions, DEV_VERSION, parseVersion } from "./versions.js";
+
+// THE OLDEST SANDBOX DAEMON THIS EDITOR SUPPORTS. The hosted editor deploys from every green push to main, and a
+// sandbox runs whatever release it last took, so the editor always talks to daemons older than itself. Above this
+// floor an older daemon is met feature by feature (the route list and shape fingerprints on its /events hello, read by
+// the editor's useDaemonRoutes). Below it the editor draws one page saying the sandbox is too old and offering the
+// update, instead of the faults that page would otherwise be built from.
+//
+// Raise it deliberately, with a dated line below naming what the editor now depends on and the first release that has
+// it (`git tag --contains <sha> | sort -V | head -1`). COMPATIBILITY.md quotes the current value.
+//
+// 2026-10-15: 1.249.0, the first release whose /events stream carries everything the editor reads off it. The hello's
+// route list and its `build`, which opens with the version (1.0.0), the hello's shape fingerprints (1.187.0), and the
+// roster revision on every heartbeat (`rev`, 1.249.0). Against a daemon without `rev`, every heartbeat reads as a
+// missed roster snapshot, so the editor reads GET /agents again every two seconds and logs `fleet.roster-behind`
+// each time. Since 1.249.0 every frame has only gained optional fields and new kinds, which daemon-floor.test.ts
+// holds to.
+export const OLDEST_SUPPORTED_DAEMON = `1.249.0`;
+
+// The version a hello's `build` names. The daemon's build id is `<version>:<newest mtime of its compiled tree>`
+// (_sandbox/sandbox/src/version.ts `buildId`), and has been since 1.0.0. Undefined when there is no build, or its head is
+// not a version.
+export const daemonVersionOfBuild = (build: string | undefined): string | undefined => {
+    const head = build?.split(`:`, 1)[0]?.trim();
+    return head === undefined || head === `` || parseVersion(head) === undefined ? undefined : head;
+};
+
+// True only on evidence: a released version older than the floor. A daemon that names no version, one whose version
+// does not parse, and a build from a checkout (0.0.0, which never checks for updates and has nothing to update to) are
+// never too old.
+export const daemonBelowFloor = (version: string | undefined, floor: string = OLDEST_SUPPORTED_DAEMON): boolean =>
+    version !== undefined && version !== DEV_VERSION && parseVersion(version) !== undefined && compareVersions(version, floor) < 0;

package/src/state/history-state.ts

@@ -22,6 +22,9 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
     // conversation's own runtime session store (what `.intentic/records/sessions/claude/` holds for every other).
     // Carried whole, like the conversation it is.
     { path: "conversations/", portability: "carry" },
+    // The tasks this sandbox's conversations handed to linked sandboxes (links/linked-children.ts), followed until they
+    // settle: part of the conversations' own record, so it goes where they go.
+    { path: "links/linked-children.json", portability: "carry" },
     // The long tool outputs those transcripts name rather than hold, stored once by content for every record naming
     // them; a transcript without them keeps only each output's start.
     { path: "blobs/", portability: "carry" },
@@ -57,6 +60,9 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
     // What each account has run out of, for a plan publishing no allowance to poll — the refusal is the reading.
     // Carried like the refusals above: an allowance belongs to the account, not to the machine that spent it.
     { path: "observed-limits.json", portability: "carry" },
+    // When each provider's allowance last ran out and under how many agents, which the spawn listing quotes beside the
+    // figure left. Carried like the refusals: it describes the subscription's windows, not the machine that spent them.
+    { path: "run-outs.json", portability: "carry" },
     // First-time dependency setup requests; carried so an interrupted queue survives export, entries self-remove.
     { path: "dependency-requests.json", portability: "carry" },
     // Which device cards were already offered; carry, not identity, since it holds ids, never a token.
@@ -166,6 +172,9 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
 
     // Signs every browser session cookie; carrying it would let the holder mint sessions against the target.
     { path: "session-secret", portability: "identity", note: "Sign in again, the target signs its own sessions." },
+    // The platform's id for this sandbox's row, as its announce last said (system/boot/platform-row.ts): the target is
+    // its own row, and learns its own id at its first announce.
+    { path: "platform-row.json", portability: "identity", note: "The target learns its own platform id when it first announces." },
     // Who owns this sandbox, who else may reach it and at what tier, and the hashed control tokens programs present:
     // the daemon's to decide, so kept off the workspace every turn writes (auth/members/identity-off-workspace.ts moved
     // them from `.intentic/identity/` on 2026-10-06). An access list that traveled would let a source sandbox hand
@@ -177,6 +186,14 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
         note: "Re-invite collaborators from the Access tab, a grant is the platform's record, and the target enforces its own copy.",
     },
     { path: "identity/control-tokens.json", portability: "identity", note: "Mint fresh control tokens, the old ones authenticate against the source sandbox." },
+    // The links other sandboxes hand this one tasks through (links/inbound-links.ts): hashed tokens like the control
+    // tokens, each minted here, and the tasks filed under them; elsewhere they would let the paired sandboxes reach the
+    // target in this one's name.
+    {
+        path: "identity/links.json",
+        portability: "identity",
+        note: "Pair the sandboxes that hand this one tasks again from its Access tab: their links name the source sandbox.",
+    },
     // Public keys, the owner's require-a-passkey switch and the hashes of their recovery codes, moved from
     // `.intentic/identity/passkeys.json` the same way (the passkeys-off-workspace step), since a passkey sign-in trusts
     // the row it finds: a copy that traveled would let a source sandbox's passkeys open the target.

package/src/state/workspace-state.ts

@@ -331,7 +331,7 @@ const STATE_FILES = [
     // Owner's per-extension update posture (notify/agent/auto, advisory opt-out). `carry`: a decision about the
     // extension, not the machine.
     { path: ".intentic/config/extension-update-policy.json", invalidates: ["extensions"], portability: "carry", versioned: true },
-    // Which installed extensions run from a source checkout instead of their pinned clone (extensions/extension-dev.ts).
+    // Which installed extensions run from a source checkout instead of their pinned clone (capabilities/extension-inventory/extension-dev.ts).
     // Local and never versioned: it can name a conversation's worktree, a path that means nothing in a commit or on
     // another machine. `extensions` because the row says where it runs from, and a rebuild reported here is what offers
     // the reload.

package/src/text/documents.test.ts

@@ -1,4 +1,5 @@
-import { deliverableKindOf, documentOf, documentTitle, isDocumentPath, isPlanDocumentPath } from "./documents.js";
+import type { TranscriptRow } from "../events/transcript.js";
+import { deliverableKindOf, documentOf, documentTitle, isDocumentPath, isPlanDocumentPath, producedDocumentPaths } from "./documents.js";
 import { PLAN_DOCUMENTS_DIR } from "../state/workspace-state.js";
 
 const write = (path: string, newText: string, extra: { oldText?: string; truncated?: boolean } = {}) => [
@@ -88,3 +89,31 @@ describe("deliverableKindOf", () => {
         ]);
     });
 });
+
+
+test("ODF text, sheets, slides and RTF are result documents", () => {
+    expect(["letter.ODT", "budget.ods", "briefing.odp", "letter.rtf"].map(deliverableKindOf)).toEqual(["odt", "ods", "odp", "rtf"]);
+});
+
+describe("producedDocumentPaths", () => {
+    const rows: TranscriptRow[] = [
+        { role: "user", text: "make me letter.odt and notes.pdf" },
+        {
+            role: "assistant",
+            text: "Done",
+            tools: [
+                { id: "1", name: "Write", category: "edit", status: "completed", content: write("./out/letter.odt", "") },
+                { id: "2", name: "Write", category: "edit", status: "failed", locations: [{ path: "broken.docx" }] },
+                { id: "3", name: "Bash", category: "execute", status: "failed", locations: [{ path: "deck.pptx" }, { path: "build.log" }] },
+                { id: "4", name: "Bash", category: "execute", status: "completed", locations: [{ path: "draft.pdf" }] },
+                { id: "5", name: "Bash", category: "delete", status: "completed", locations: [{ path: "draft.pdf" }] },
+                { id: "6", name: "Read", category: "read", status: "completed", locations: [{ path: "source.xlsx" }] },
+                { id: "7", name: "Task", category: "think", status: "completed", children: [{ id: "8", name: "Write", category: "edit", status: "completed", locations: [{ path: "budget.ods" }] }] },
+            ],
+        },
+    ];
+
+    test("lists what settled calls recorded writing, never what prose or a read named, minus what was deleted", () => {
+        expect(producedDocumentPaths(rows)).toEqual(["out/letter.odt", "deck.pptx", "budget.ods"]);
+    });
+});

package/src/text/documents.ts

@@ -1,4 +1,5 @@
 import type { RequestDocument, ToolCallContent } from "../events/requests.js";
+import type { TranscriptRow, TranscriptTool } from "../events/transcript.js";
 import { planParts } from "./title.js";
 import { PLAN_DOCUMENTS_DIR } from "../state/workspace-state.js";
 
@@ -17,10 +18,14 @@ export const isDocumentPath = (path: string): boolean => {
 // A deliverable is a file a turn hands a person to open rather than read as code: an office document, a PDF, a web
 // page. The daemon names the ones a command wrote on its card (agent/tools/produced-documents.ts) and the chat lists a
 // turn's under its answer, so the two ask this one table. Markdown stays out: the chat already draws it as a document.
-export type DeliverableKind = "docx" | "pptx" | "xlsx" | "pdf" | "html";
+export type DeliverableKind = "docx" | "pptx" | "xlsx" | "pdf" | "html" | "odt" | "ods" | "odp" | "rtf";
 
 const DELIVERABLE_BY_EXTENSION = new Map<string, DeliverableKind>([
     ["docx", "docx"],
+    ["odt", "odt"],
+    ["ods", "ods"],
+    ["odp", "odp"],
+    ["rtf", "rtf"],
     ["pptx", "pptx"],
     ["xlsx", "xlsx"],
     ["pdf", "pdf"],
@@ -64,3 +69,40 @@ export const documentOf = (name: string, content: readonly ToolCallContent[] | u
         ...(isPlanDocumentPath(diff.path) ? { plan: true } : {}),
     };
 };
+
+// The deliverables a conversation's calls recorded writing, across its whole transcript, in the order first written;
+// one a later call deleted is gone. The rule the chat's document chips follow per turn (the editor's deliverables.ts):
+// an edit's locations and diffs, a settled command's locations (what the daemon found it wrote), a delete's locations.
+// Recorded writes only, never a path named in prose or a command's text, since the daemon serves these paths' bytes
+// to the conversation's owner on the strength of this list (conversations/produced-files.ts).
+export const producedDocumentPaths = (rows: readonly TranscriptRow[]): string[] => {
+    const paths = new Set<string>();
+    for (const row of rows) {
+        for (const { path, deleted } of row.role === "assistant" ? recordedWrites(row.tools ?? []) : []) {
+            if (deleted) {
+                paths.delete(path);
+            } else {
+                paths.add(path);
+            }
+        }
+    }
+    return [...paths];
+};
+
+// What one settled call wrote or deleted, by name (a leading `./` folded away); a failed edit wrote nothing, a failed
+// command still wrote what the daemon found it wrote.
+const writesOf = (tool: TranscriptTool): readonly { readonly path: string; readonly deleted: boolean }[] => {
+    const settled = tool.status === "completed" || (tool.category === "execute" && tool.status === "failed");
+    if (!settled || (tool.category !== "edit" && tool.category !== "execute" && tool.category !== "delete")) {
+        return [];
+    }
+    const diffed = tool.category === "edit" ? (tool.content ?? []).flatMap((entry) => (entry.type === "diff" ? [entry.path] : [])) : [];
+    return [...(tool.locations ?? []).map(({ path }) => path), ...diffed].map((name) => ({
+        path: name.startsWith("./") ? name.slice(2) : name,
+        deleted: tool.category === "delete",
+    }));
+};
+
+// Depth first, a delegation's own calls right after the card that started them; deliverables only.
+const recordedWrites = (tools: readonly TranscriptTool[]): { readonly path: string; readonly deleted: boolean }[] =>
+    tools.flatMap((tool) => [...writesOf(tool).filter(({ path }) => deliverableKindOf(path) !== undefined), ...recordedWrites(tool.children ?? [])]);

package/src/text/pages.ts

@@ -2,6 +2,7 @@
 // daemon's headless check (agent/pages/page-check.ts), which lays the page out the way the chat will, and the chat's
 // own frame (the editor's chat/transcript/pages). A page runs its scripts in a frame with an opaque origin and no
 // network: the policy below is the whole of what it may load, and the bootstrap is the whole of what it may say.
+import { parseJsonOr } from "@intentic/base/json";
 
 // Everything a sealed page may load is already inside it: its own inline scripts and styles, and pictures, fonts and
 // media carried in as data. Nothing reaches the network, another frame, or a form target.
@@ -331,13 +332,10 @@ export const readMcpAppData = (html: string): McpAppData | undefined => {
     if (match === null) {
         return undefined;
     }
-    try {
-        const data = JSON.parse(match[1] ?? ``) as Partial<McpAppData>;
-        return typeof data.server === `string` && typeof data.tool === `string` ? { server: data.server, tool: data.tool, input: data.input, result: data.result } : undefined;
-    } catch {
-        // allow(silent-catch): a block that does not parse is not an app's, as the comment on this function says.
-        return undefined;
-    }
+    // A block that does not parse is not an app's, as the comment on this function says.
+    // SAFETY: server and tool are checked by type below; input and result are opaque to this reader.
+    const data = parseJsonOr(match[1] ?? ``, undefined) as Partial<McpAppData> | null | undefined;
+    return typeof data?.server === `string` && typeof data.tool === `string` ? { server: data.server, tool: data.tool, input: data.input, result: data.result } : undefined;
 };
 
 // A page's answer as the agent is handed it: JSON text, whatever the page sent, refused past the cap rather than cut.