@intentic/sandbox-contract 1.343.0 → 1.345.0

package/src/schemas/keyring-native.ts

@@ -0,0 +1,101 @@
+// Named imports rather than the `z` namespace, and nothing from schemas/keyring.ts: this module is bundled into the
+// browser extension, where the namespace keeps zod's locales (~330 kB) that esbuild can otherwise drop
+// (_devices/webext/scripts/size-budget.mjs holds the ceiling). The three schemas it shares with keyring.ts are spelled
+// again below, and keyring-native.test.ts holds them equal.
+import { array, boolean, discriminatedUnion, enum as zEnum, literal, number, object, string, union } from "zod";
+import type * as z from "zod";
+
+// What the browser extension and `intentic-keyring native-host` say to each other over Chrome's native messaging: one
+// JSON message each way per request, length-prefixed by the browser, correlated by `id`. The native host is a process
+// the browser starts as the person's user; it seals a captured value to the vault's inbox key before it reaches the
+// keyring's pipe, and asks the keyring (which asks the person, with Windows Hello or polkit) before any value goes back
+// to the page. A site's host, never a full address, is all the extension ever names.
+//
+// `@intentic/sandbox-contract/webext` re-exports it.
+
+/** The name the extension connects to (`chrome.runtime.connectNative`), and the native host's manifest declares. */
+export const KEYRING_NATIVE_HOST = "dev.intentic.keyring";
+
+const id = string().min(1).max(64);
+const host = string().min(1).max(253);
+
+/** keyring.ts's secret name, refusal code and capture outcome, as the extension sees them. */
+export const KeyringNativeNameSchema = string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,127}$/u);
+export const KeyringNativeRefusalCodeSchema = zEnum([
+    "no-keyring",
+    "locked",
+    "declined",
+    "unknown",
+    "not-shared",
+    "bad-grant",
+    "expired",
+    "replayed",
+    "guard",
+    "unavailable",
+    "busy",
+    "pending",
+]);
+export const KeyringNativeOutcomeSchema = zEnum(["saved", "updated", "unchanged", "pending", "skipped"]);
+
+export const KeyringNativeRequestSchema = discriminatedUnion("type", [
+    // What the extension needs before it shows anything: whether remembering is on for browsers, and the vault's state.
+    object({
+        type: literal("hello"),
+        id,
+        browser: string().min(1).max(100).describe("The browser's own name, `Brave`, for the title line."),
+    }).strict(),
+    // A sign-in, sign-up or password change the page just submitted.
+    object({
+        type: literal("capture"),
+        id,
+        browser: string().min(1).max(100),
+        host,
+        username: string().max(256).optional(),
+        password: string().min(1).max(4096),
+        title: string().max(200).optional().describe("The site's own name (`og:site_name`, the title), when it has one."),
+        failed: boolean().optional().describe("The form came back for the same user: the last value saved for it did not work."),
+    }).strict(),
+    // What the keyring holds for this site: names, titles and users, never values.
+    object({ type: literal("candidates"), id, host }).strict(),
+    // One entry's value for the focused field, after the person's yes at the computer.
+    object({ type: literal("fill"), id, host, name: KeyringNativeNameSchema }).strict(),
+    // Take back a capture made moments ago (the toast's Undo).
+    object({ type: literal("undo"), id, name: KeyringNativeNameSchema, at: number().int() }).strict(),
+    // Never save for this site (the toast's "Never for this site").
+    object({ type: literal("never"), id, host }).strict(),
+]);
+export type KeyringNativeRequest = z.infer<typeof KeyringNativeRequestSchema>;
+
+const refused = object({ ok: literal(false), code: KeyringNativeRefusalCodeSchema, refusal: string() });
+
+export const KeyringNativeCandidateSchema = object({ name: KeyringNativeNameSchema, title: string(), username: string().optional() });
+export type KeyringNativeCandidate = z.infer<typeof KeyringNativeCandidateSchema>;
+
+// A plain union: a refusal shares its `type` with the answer it stands in for, which a discriminated union cannot hold.
+export const KeyringNativeResponseSchema = union([
+    object({
+        type: literal("hello"),
+        id,
+        ok: literal(true),
+        setUp: boolean(),
+        locked: boolean(),
+        remember: boolean().describe("Whether the person turned on remembering for browsers."),
+        version: string(),
+    }),
+    object({
+        type: literal("capture"),
+        id,
+        ok: literal(true),
+        outcome: KeyringNativeOutcomeSchema,
+        name: KeyringNativeNameSchema.optional(),
+        title: string().optional(),
+        at: number().int(),
+    }),
+    object({ type: literal("candidates"), id, ok: literal(true), items: array(KeyringNativeCandidateSchema) }),
+    object({ type: literal("fill"), id, ok: literal(true), username: string().optional(), password: string() }),
+    object({ type: literal("undo"), id, ok: literal(true) }),
+    object({ type: literal("never"), id, ok: literal(true) }),
+    // Any request refused, under the type it was asked as.
+    refused.extend({ type: zEnum(["hello", "capture", "candidates", "fill", "undo", "never"]), id }),
+]);
+export type KeyringNativeResponse = z.infer<typeof KeyringNativeResponseSchema>;

package/src/schemas/keyring.ts

@@ -82,15 +82,28 @@ export const KeyringSandboxKeysSchema = z.object({
 });
 export type KeyringSandboxKeys = z.infer<typeof KeyringSandboxKeysSchema>;
 
+// The one-time "let Intentic remember the passwords you type", per source. All off until the person turns them on;
+// each switches off on its own. Imports, an agent's `secrets ask` and adding by hand are deliberate acts and need none.
+export const KeyringRememberSchema = z.object({
+    browser: z.boolean().describe("Sign-ins in a browser with the Intentic extension."),
+    terminal: z.boolean().describe("ssh, sudo and git prompts on this computer, and git's credential helper."),
+    apps: z.boolean().describe("Password fields in programs on this computer, typed once into the keyring's own box."),
+    phone: z.boolean().describe("The paired phone's autofill."),
+    sandbox: z.boolean().describe("Prompts that hide what is typed, in a sandbox terminal the person types into."),
+});
+export type KeyringRemember = z.infer<typeof KeyringRememberSchema>;
+
 export const KeyringStateSchema = z.object({
     version: z.string().describe("The keyring's own release."),
     locked: z.boolean().describe("Whether the vault is locked. Locked, `while-here` entries ask like `each-use` ones."),
     unlockedUntil: z.number().optional().describe("When the current unlock ends, in milliseconds. Absent while locked."),
     unlock: z
-        .array(z.enum(["hello", "passphrase"]))
-        .describe("How a person unlocks it here: Windows Hello, or the keyring's passphrase."),
+        .array(z.enum(["hello", "passphrase", "polkit"]))
+        .describe("How a person unlocks it here: Windows Hello, the keyring's passphrase (its recovery key), or polkit's own check on Linux."),
     keys: KeyringDeviceKeysSchema.optional().describe("Absent until the keyring is set up: there is no vault, so no inbox to seal a value to."),
     pendingInbox: z.number().int().nonnegative().describe("Values sent to be kept that wait for the next unlock."),
+    pendingCaptures: z.number().int().nonnegative().optional().describe("Credentials seen in use while locked, kept sealed until the next unlock. Absent from a keyring older than 2026-10-19."),
+    remember: KeyringRememberSchema.optional().describe("Which sources the person let the keyring remember passwords from, so a collector knows whether to send one. Absent before setup and from an older keyring."),
 });
 export type KeyringState = z.infer<typeof KeyringStateSchema>;
 
@@ -173,9 +186,9 @@ export const SealedBoxSchema = z
 export type SealedBox = z.infer<typeof SealedBoxSchema>;
 
 export const KeyringRefusalCodeSchema = z
-    .enum(["no-keyring", "locked", "declined", "unknown", "not-shared", "bad-grant", "expired", "replayed", "guard", "unavailable", "busy"])
+    .enum(["no-keyring", "locked", "declined", "unknown", "not-shared", "bad-grant", "expired", "replayed", "guard", "unavailable", "busy", "pending"])
     .describe(
-        "Why: no keyring here; locked with nobody to unlock it; the person said no; no such entry; not shared with this sandbox; a grant that does not verify; one past its time; one already spent; the focused window or field is not one it may go to; its password manager did not answer; another prompt is open.",
+        "Why: no keyring here; locked with nobody to unlock it; the person said no; no such entry; not shared with this sandbox; a grant that does not verify; one past its time; one already spent; the focused window or field is not one it may go to; its password manager did not answer; another prompt is open; nobody has answered yet, and the request waits in the Passwords app.",
     );
 export type KeyringRefusalCode = z.infer<typeof KeyringRefusalCodeSchema>;
 
@@ -275,3 +288,188 @@ export const KeyringSyncPairResultSchema = z.discriminatedUnion("ok", [z.object(
 export const KeyringSyncOutboxSchema = z.object({ items: z.array(KeyringSyncItemSchema) });
 export const KeyringSyncDeliverSchema = z.object({ items: z.array(KeyringSyncItemSchema).max(64) }).strict();
 export const KeyringSyncDeliverResultSchema = z.object({ accepted: z.number().int().nonnegative().describe("How many it took; the rest were not from a paired keyring or did not open.") });
+
+// ---- origins: where a credential is used, and where it was seen ----
+
+// One place a credential belongs to. An entry's rules (programs, packages, hosts, askpass matchers) are the keyring's
+// own record of the same thing; policy/keyring-origins.ts maps one onto the other, so a captured credential gets its
+// rules without anyone typing them and the Passwords app can say "Works on github.com, git https://github.com".
+export const KeyringOriginSchema = z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("site"), host: z.string().min(1).max(253).describe("The page's host, `github.com`; never a path.") }).strict(),
+    z
+        .object({
+            kind: z.literal("program"),
+            program: KeyringProgramSchema,
+            label: z.string().max(200).optional().describe("The program's own name for people, `FortiClient VPN`, when the window says it."),
+        })
+        .strict(),
+    z.object({ kind: z.literal("package"), package: KeyringPackageSchema, label: z.string().max(200).optional() }).strict(),
+    z.object({ kind: z.literal("ssh"), target: z.string().min(1).max(300).describe("`user@host`, as ssh's prompt names it.") }).strict(),
+    z.object({ kind: z.literal("ssh-key"), path: z.string().min(1).max(1000) }).strict(),
+    z.object({ kind: z.literal("sudo"), user: z.string().max(64).optional() }).strict(),
+    z.object({ kind: z.literal("git"), url: z.string().min(1).max(500).describe("`https://host`, as git's credential helper or askpass names it.") }).strict(),
+    z
+        .object({
+            kind: z.literal("prompt"),
+            text: z.string().min(1).max(300).describe("The prompt's own words, `Password for npm:`."),
+            command: z.string().max(200).optional().describe("The command that asked, `npm login`, when known."),
+            sandbox: z.string().url().optional().describe("The sandbox whose terminal asked, for a prompt seen there rather than on this computer."),
+        })
+        .strict(),
+]);
+export type KeyringOrigin = z.infer<typeof KeyringOriginSchema>;
+
+// Where a capture came from, for its title line ("saved from Brave") and its record.
+export const KeyringCaptureSourceSchema = z
+    .enum(["browser", "askpass", "git", "app", "phone", "terminal", "import", "agent", "manual"])
+    .describe(
+        "What saw it: the browser extension, an ssh/sudo/git prompt answered through the keyring, git's credential helper, a password field in an app on this computer, the phone's autofill, a sandbox terminal's prompt, an import, an agent's `secrets ask`, or the person adding it by hand.",
+    );
+export type KeyringCaptureSource = z.infer<typeof KeyringCaptureSourceSchema>;
+
+// A credential seen in use, sent to be kept. The value is sealed to the vault's inbox key for `{ kind: "capture" }`
+// (policy/keyring-seal.ts), so whoever carries it (the native-messaging host, the sandbox for a phone or a terminal)
+// holds ciphertext. Taken in without asking once the person turned remembering on for its source: bringing a value IN
+// reveals nothing, and an update keeps the old value in the entry's history, so a capture can be undone.
+export const KEYRING_CAPTURE_BATCH_MAX = 5000;
+export const KeyringCaptureItemSchema = z
+    .object({
+        origin: KeyringOriginSchema,
+        username: z.string().max(256).optional().describe("The account it signs in as, when the form or prompt said. Not a secret."),
+        sealed: SealedBoxSchema,
+        source: KeyringCaptureSourceSchema,
+        via: z.string().min(1).max(200).describe("Who saw it, in words for the title line: `Brave`, `Pixel 8`, `intentic-dev`. Also bound into the seal."),
+        kind: z.enum(["password", "text"]).default("password"),
+        title: z.string().max(200).optional().describe("The site's or app's own name, when it said one; the keyring derives one otherwise."),
+        at: z.number().int().describe("When it was seen, in milliseconds. Also bound into the seal."),
+        failed: z
+            .boolean()
+            .optional()
+            .describe("The last value captured for this origin and user did not work (ssh asked again, git erased it, the form came back): replace it rather than keep it as history."),
+    })
+    .strict();
+export type KeyringCaptureItem = z.infer<typeof KeyringCaptureItemSchema>;
+
+export const KeyringCaptureOutcomeSchema = z
+    .enum(["saved", "updated", "unchanged", "pending", "skipped"])
+    .describe(
+        "A new entry; a new value for an existing one (the old kept in its history); the same value it already had; kept sealed until the next unlock; not kept, because remembering is off for its source or its origin is on the never-save list.",
+    );
+export type KeyringCaptureOutcome = z.infer<typeof KeyringCaptureOutcomeSchema>;
+
+export const KeyringCaptureResultSchema = z.discriminatedUnion("ok", [
+    z.object({
+        ok: z.literal(true),
+        outcome: KeyringCaptureOutcomeSchema,
+        name: KeyringSecretNameSchema.optional().describe("The entry it went to. Absent while pending or skipped."),
+        title: z.string().optional().describe("That entry's title, for the 'Saved github.com' notice."),
+    }),
+    refusal,
+]);
+export type KeyringCaptureResult = z.infer<typeof KeyringCaptureResultSchema>;
+
+// ---- an agent's need: asked for by what it is for, not by name ----
+
+// A sandbox asking for a credential by where it is to be used. The keyring matches its entries by origin and asks the
+// person (with their OS's own check: Windows Hello, polkit, a phone's biometric signature) whether this sandbox may use
+// the one it found, and on what terms. Nothing about entries that do not match, nor about one the person declines,
+// reaches the sandbox. A match nobody answers waits in the Passwords app's Requests, and the sandbox learns of the yes
+// from its next `shares` read.
+export const KeyringNeedSchema = z
+    .object({
+        origin: KeyringOriginSchema,
+        username: z.string().max(256).optional().describe("The account wanted, when the agent knows it."),
+        detail: z.string().min(1).max(300).describe("What it is for, in words for the prompt: `sign in to push the release branch`."),
+        conversation: z.string().max(200).optional(),
+        purpose: z.enum(["agent", "owner"]).default("agent"),
+        typeOnce: z
+            .boolean()
+            .default(false)
+            .describe(
+                "Nothing matched on any of the owner's computers: offer the person here the keyring's type-once box. Without it, a keyring with no match answers `unknown` at once, so the sandbox can ask the next computer without a box opening on each.",
+            ),
+    })
+    .strict();
+export type KeyringNeed = z.infer<typeof KeyringNeedSchema>;
+
+export const KeyringNeedAnswerSchema = z
+    .enum(["once", "while-here", "always", "deny"])
+    .describe("The person's answer: this one use (an `each-use` share), unasked while unlocked, a copy in the sandbox, or no.");
+export type KeyringNeedAnswer = z.infer<typeof KeyringNeedAnswerSchema>;
+
+export const KeyringNeedResultSchema = z.discriminatedUnion("ok", [
+    z.object({
+        ok: z.literal(true),
+        pointer: KeyringPointerSchema.describe("The entry now shared with the asking sandbox, as its next `shares` read will also list it."),
+        asked: z.boolean(),
+        saved: z.boolean().describe("Nothing matched, and the person typed it once into the keyring's own box: a new entry, kept here and shared."),
+    }),
+    refusal,
+]);
+export type KeyringNeedResult = z.infer<typeof KeyringNeedResultSchema>;
+
+// A need that waits for an answer, as the Passwords app lists it.
+export const KeyringPendingNeedSchema = z.object({
+    id: z.string().regex(KEYRING_NONCE_RE),
+    sandbox: z.string().url(),
+    need: KeyringNeedSchema,
+    matches: z.array(KeyringSecretNameSchema).describe("The entries that fit, best first. Empty: none yet, the app offers to type one once."),
+    at: z.number().int(),
+});
+export type KeyringPendingNeed = z.infer<typeof KeyringPendingNeedSchema>;
+
+// ---- the owner's phone as a place to save and fill ----
+
+// A phone paired with the keyring holds two keys made in its Android Keystore: `seal` (X25519, kept in software, which
+// Android's Keystore cannot do natively) that a value released for autofill is sealed to, and `presence` (ECDSA P-256,
+// `setUserAuthenticationRequired`, so it signs only after the person's fingerprint, face or screen lock). A signature by
+// `presence` over a fill request is the person's yes, checked by the keyring against the key it pinned at pairing, the
+// way a Windows Hello signature is. Pairing is carried by a sandbox both are linked to, with both fingerprints shown.
+export const KeyringPhoneKeysSchema = z
+    .object({
+        device: z.string().min(1).max(128).describe("The phone, by its device card."),
+        label: z.string().min(1).max(200).describe("The phone's name for people, `Pixel 8`."),
+        seal: KeyringPublicKeySchema,
+        presence: z.string().min(1).max(512).describe("The presence key, X.509 SubjectPublicKeyInfo DER, base64."),
+    })
+    .strict();
+export type KeyringPhoneKeys = z.infer<typeof KeyringPhoneKeysSchema>;
+
+export const KeyringPhonePairResultSchema = z.discriminatedUnion("ok", [
+    z.object({ ok: z.literal(true), fingerprint: z.string().describe("The keyring's own fingerprint, for the phone to show beside its own.") }),
+    refusal,
+]);
+export type KeyringPhonePairResult = z.infer<typeof KeyringPhonePairResultSchema>;
+
+export const KeyringPhoneFillSchema = z
+    .object({
+        v: z.literal(1),
+        device: z.string().min(1).max(128),
+        origin: KeyringOriginSchema.describe("Where the phone is filling: a `package`, or a `site` for a browser on the phone."),
+        username: z.string().max(256).optional(),
+        nonce: z.string().regex(KEYRING_NONCE_RE),
+        issuedAt: z.number().int(),
+        expiresAt: z.number().int(),
+    })
+    .strict();
+export type KeyringPhoneFill = z.infer<typeof KeyringPhoneFillSchema>;
+
+export const SignedKeyringPhoneFillSchema = z
+    .object({
+        payload: z.string().min(1).max(4096).describe("The fill request's JSON, base64url."),
+        sig: z.string().min(1).max(256).describe("The presence key's ECDSA P-256 signature (DER) over the payload, base64url."),
+    })
+    .strict();
+export type SignedKeyringPhoneFill = z.infer<typeof SignedKeyringPhoneFillSchema>;
+
+export const KeyringPhoneFillResultSchema = z.discriminatedUnion("ok", [
+    z.object({
+        ok: z.literal(true),
+        username: z.string().max(256).optional(),
+        sealed: SealedBoxSchema.describe("The value, sealed to the phone's `seal` key for `{ kind: \"phone\" }`."),
+        name: KeyringSecretNameSchema,
+        title: z.string(),
+    }),
+    refusal,
+]);
+export type KeyringPhoneFillResult = z.infer<typeof KeyringPhoneFillResultSchema>;

package/src/schemas/metrics.ts

@@ -97,7 +97,9 @@ export const SandboxUsageSchema = z.object({
             countedFileCacheBytes: z
                 .number()
                 .optional()
-                .describe("File cache counted in resident usage (memory.stat file less inactive_file), in bytes. Absent unless both counters are valid."),
+                .describe(
+                    "File cache counted in resident usage (memory.stat file less inactive_file), in bytes. Absent unless both counters are valid.",
+                ),
             kernelBytes: z
                 .number()
                 .optional()
@@ -163,7 +165,9 @@ export const SandboxMetricsSchema = z.object({
         .optional()
         .describe("How long the CPU figures were measured over, in milliseconds. Absent on a first reading, and then so is every CPU figure."),
     sandbox: SandboxUsageSchema.describe("The sandbox as a whole, including the daemon."),
-    daemon: DaemonUsageSchema.describe("The daemon's own usage, included in the sandbox total and process count but excluded from roles and session sums."),
+    daemon: DaemonUsageSchema.describe(
+        "The daemon's own usage, included in the sandbox total and process count but excluded from roles and session sums.",
+    ),
     sessions: z
         .record(z.string(), SessionMetricsSchema)
         .describe(
@@ -273,8 +277,29 @@ export const StorageScanSchema = z.object({
 export type StorageScan = z.infer<typeof StorageScanSchema>;
 
 export const StorageReportSchema = z.object({
-    scan: StorageScanSchema.optional().describe("The last scan that finished, kept across restarts; its `finishedAt` says how old it is. Absent until one has."),
+    scan: StorageScanSchema.optional().describe(
+        "The last scan that finished, kept across restarts; its `finishedAt` says how old it is. Absent until one has.",
+    ),
     scanning: z.boolean().describe("Whether a scan is running now."),
+    historyDisk: z
+        .object({
+            freeBytes: z.number().describe("Space available to the sandbox on the history volume, measured now."),
+            totalBytes: z.number().describe("The history volume's total size."),
+            floorBytes: z.number().describe("Space kept free before a new checkout: 2% of this volume clamped to 5–20 GiB."),
+            low: z.boolean().describe("Whether available history space is below the checkout floor."),
+        })
+        .optional()
+        .describe("The filesystem holding conversation checkouts, independent of the workspace volume. Absent if unreadable."),
+    repositoryCheckouts: z
+        .array(
+            z.object({
+                repo: z.string().describe("The live repository's workspace-relative id, or root for the workspace repository."),
+                head: z.string().describe("The commit whose tracked blobs were measured."),
+                bytes: z.number().describe("The sum of blob sizes at this HEAD: the estimated bytes for one full checkout."),
+            }),
+        )
+        .optional()
+        .describe("Live repositories' checkout costs, cached per repository and commit. Repositories without a readable HEAD are omitted."),
 });
 export type StorageReport = z.infer<typeof StorageReportSchema>;
 

package/src/schemas/phone-passwords.ts

@@ -0,0 +1,51 @@
+import { z } from "zod";
+import {
+    KeyringCaptureItemSchema,
+    KeyringCaptureResultSchema,
+    KeyringPhoneFillResultSchema,
+    KeyringPhoneKeysSchema,
+    KeyringPhonePairResultSchema,
+    KeyringPublicKeySchema,
+    SignedKeyringPhoneFillSchema,
+} from "./keyring.js";
+
+// THE PHONE'S WAY TO THE OWNER'S PASSWORDS (2026-10-19): the Intentic Device app as Android's autofill service, saving
+// what the person signs in with and filling it back, against the keyrings on the owner's computers. The phone door is
+// the sandbox asking and the phone answering (phone-protocol.ts); these go the other way, so they are plain HTTPS
+// requests from the app to its sandbox, authorised by the phone's enrollment token (`Authorization: Bearer <token>`),
+// and the sandbox relays each to the named computer's keyring over that computer's device link. What rides is sealed
+// end to end: a capture to the keyring's inbox key, a fill's answer to the phone's own seal key.
+
+export const PHONE_PASSWORDS_PATHS = {
+    keyrings: "/system/phones/passwords/keyrings",
+    pair: "/system/phones/passwords/pair",
+    capture: "/system/phones/passwords/capture",
+    fill: "/system/phones/passwords/fill",
+} as const;
+
+/** One of the owner's computers whose keyring the phone can save to and fill from. */
+export const PhoneKeyringSchema = z.object({
+    device: z.string().min(1).max(128).describe("The computer, by its device card."),
+    label: z.string().describe("The computer's name for people."),
+    online: z.boolean(),
+    locked: z.boolean().optional(),
+    inbox: KeyringPublicKeySchema.optional().describe("What a capture is sealed to. Absent until the keyring is set up."),
+    remember: z.boolean().describe("Whether the person turned on remembering from the phone on that computer."),
+    paired: z.boolean().describe("Whether this phone's keys are pinned there, so it can fill."),
+});
+export type PhoneKeyring = z.infer<typeof PhoneKeyringSchema>;
+
+// GET keyrings → the owner's keyrings this sandbox can reach.
+export const PhoneKeyringsResultSchema = z.object({ keyrings: z.array(PhoneKeyringSchema) });
+
+// POST pair → the computer's keyring asks its person, showing the phone's fingerprint; the phone shows the keyring's.
+export const PhonePasswordsPairSchema = z.object({ keyring: z.string().min(1).max(128), phone: KeyringPhoneKeysSchema }).strict();
+export const PhonePasswordsPairResultSchema = KeyringPhonePairResultSchema;
+
+// POST capture → onSaveRequest's credential, sealed on the phone for `{ kind: "capture", via, at }`.
+export const PhonePasswordsCaptureSchema = z.object({ keyring: z.string().min(1).max(128), item: KeyringCaptureItemSchema }).strict();
+export const PhonePasswordsCaptureResultSchema = KeyringCaptureResultSchema;
+
+// POST fill → after the person's fingerprint signed the request with the presence key.
+export const PhonePasswordsFillSchema = z.object({ keyring: z.string().min(1).max(128), fill: SignedKeyringPhoneFillSchema }).strict();
+export const PhonePasswordsFillResultSchema = KeyringPhoneFillResultSchema;

package/src/schemas/providers/plan-limits.ts

@@ -36,6 +36,12 @@ export const UsageWindowSchema = z.object({
         .describe(
             "When the window this pool was last read in closed, in epoch seconds, while nothing has read the pool since. Its `utilization` is then 0, the floor every new window starts from, not a measurement, and `resetsAt` is absent because the next reset is unknown.",
         ),
+    missingSince: z
+        .number()
+        .optional()
+        .describe(
+            "When the provider stopped reporting this pool, in epoch seconds: a later reading of the account named every other pool but not this one. Its figure is the last one read, still a valid floor until its window closes, and the pool is dropped once it has.",
+        ),
 });
 export type UsageWindow = z.infer<typeof UsageWindowSchema>;
 // A failed re-read, whatever the cause: a 429 park, a 403 asking for verification, a 5xx, a timeout. Recorded as the fact
@@ -50,6 +56,12 @@ export const UsageUnreadSchema = z.object({
         ),
 });
 export type UsageUnread = z.infer<typeof UsageUnreadSchema>;
+// A turn answered against a reading that said its model could not run: the provider's own word that the reading is wrong.
+export const UsageContradictionSchema = z.object({
+    at: z.number().describe("When the turn was answered, in milliseconds."),
+    model: z.string().describe("The model the answered turn ran on."),
+});
+export type UsageContradiction = z.infer<typeof UsageContradictionSchema>;
 // Every window kept, not just the binding one, since which pool binds changes between turns. Utilization only climbs
 // within a window, so a stale reading is still a valid floor. `measuredAt` is epoch ms — windows are seconds.
 export const AccountUsageSchema = z.object({
@@ -58,6 +70,16 @@ export const AccountUsageSchema = z.object({
     unread: UsageUnreadSchema.optional().describe(
         "Present while re-reading this account keeps failing: these windows are the last reading that succeeded, and `measuredAt` will not move until a read succeeds again.",
     ),
+    uncovered: z
+        .array(z.string())
+        .optional()
+        .describe(
+            "Models this account serves that no pool in this reading gates, by id: the provider published no allowance for them, so their room is unknown, never assumed spent. Absent when every model is covered or the account's models are not known.",
+        ),
+    contradicted: UsageContradictionSchema.optional()
+        .describe(
+            "A turn on `model` was answered after this reading said every pool it spends was empty, so the reading is wrong about that model: those pools read as at the line, not spent, until a new reading replaces this one.",
+        ),
 });
 export type AccountUsage = z.infer<typeof AccountUsageSchema>;
 // Who has to act for a blocked account, which is the only thing a surface chooses its instruction by: the reason is the
@@ -148,8 +170,8 @@ export const ProviderRefusalSchema = z.object({
         .describe(
             "When the provider said to try again, in epoch seconds, for a spent allowance where it named one. Until then the refusal stands whatever a reading says; after it, it is over.",
         ),
-    // Codex's "To get more access now, send a request to your admin": a team's credit, which no usage endpoint reads,
-    // so a weekly pool at 57% says nothing about it (2026-10-17).
+    // Cursor's "ask your admin to increase your limit": a team's spend limit, which no usage endpoint reads. Not Codex's
+    // "send a request to your admin", which names a window its reading measures (failure-sentences.ts ADMIN_GRANTED).
     unmetered: z
         .literal(true)
         .optional()
@@ -408,6 +430,8 @@ export const ResumeRoutingSchema = z.object({
         ),
     // A client whose catalog hasn't loaded has nothing to send; the turn's own model is the better fallback.
     model: z.string().optional().describe("Which model. Leave it out to keep the one the refused turn named."),
+    // A tier named for one model may mean nothing on another, so a move onto a ladder rung carries that rung's own.
+    effort: z.string().optional().describe("How hard the model should think on the re-run. Leave it out to keep the refused turn's."),
     // A session is a file the daemon keeps; a credential is an env var. That's what lets a same-provider account switch
     // resume the existing session instead of opening a fresh one.
     carry: z
@@ -458,6 +482,19 @@ export const QueueResumeSchema = z.object({
         ),
 });
 export type QueueResume = z.infer<typeof QueueResumeSchema>;
+// Points a person's waiting messages at another provider, model or account without letting them go: what a pick in the
+// model picker does to the words already waiting, which would otherwise go by themselves on the pick they were sent under.
+export const QueueRerouteSchema = z.object({
+    conversationId: z.string().min(1).describe("Whose queue."),
+    routing: ResumeRoutingSchema.describe(
+        "Who serves the turn each message starts from now on. A model or effort left out keeps each message's own; an account left out goes on the conversation's own when it goes.",
+    ),
+    ids: z
+        .array(z.string().min(1))
+        .optional()
+        .describe("Which waiting messages to move. Leave it out to move every person's waiting message, held or booked; each keeps its own booking."),
+});
+export type QueueReroute = z.infer<typeof QueueRerouteSchema>;
 // Re-times what a conversation's queue holds: the same messages (or only those `ids` names), booked for another instant
 // or for after another conversation's work lands. One of the two, never both, since a booking waits on exactly one thing.
 export const QueueScheduleSchema = z
@@ -472,6 +509,12 @@ export const QueueScheduleSchema = z
         sendAfter: ConversationIdSchema.optional().describe(
             "Send what waits once that conversation has finished and all of its work has landed in the workspace, instead. Sent now when it has nothing running and nothing left to land.",
         ),
+        sendAtReopen: z
+            .literal(true)
+            .optional()
+            .describe(
+                "Says `sendAt` is the reopen of the allowance what waits would be refused by, not a time you chose; the queue records it as `reopenOf`. Only with `sendAt`.",
+            ),
         ids: z
             .array(z.string().min(1))
             .optional()
@@ -497,6 +540,10 @@ export const QueueContinueSchema = z
             .optional()
             .describe("Carry on at this instant (epoch milliseconds). At most a month ahead; an instant already past carries on now."),
         sendAfter: ConversationIdSchema.optional().describe("Carry on once that conversation has finished and all of its work has landed, instead."),
+        sendAtReopen: z
+            .literal(true)
+            .optional()
+            .describe("Says `sendAt` is the reopen of a spent allowance, not a time you chose; the queue records it as `reopenOf`. Only with `sendAt`."),
         routing: ResumeRoutingSchema.optional().describe(
             "Who serves the turn it starts. Leave it out to carry on where the conversation runs when it goes.",
         ),

package/src/schemas/providers/usage.ts

@@ -74,6 +74,8 @@ export const UsageTurnSchema = z.object({
     iqSearchCohort: z.string().optional(),
     // Every tool call that searched, including CLI searches like `iq q`; absent means unmeasured, not zero.
     searchCalls: z.number().optional(),
+    // Of searchCalls, the ones that ran iq: the search teaching's uptake. Absent on rows written before 2026-10-19.
+    iqSearches: z.number().optional(),
     // Search calls before the first file touch; absent as searchCalls; a turn touching nothing counts them all.
     openingSearches: z.number().optional(),
     // Directory listings (ls, tree, LS tool) before the turn's first file touch, same window as openingSearches.

package/src/schemas/push.ts

@@ -3,8 +3,9 @@ import { z } from "zod";
 // The daemon is the only tier that knows what the agent is doing, so it is the sender. A registration is per-device, in
 // two kinds:
 // webpush: a browser (including the Android TWA); the daemon sends to its push service directly, end-to-end encrypted.
-// relay: a native app (iOS); its OS push service only accepts sends from the vendor, so the daemon posts through a
-// relay, which can read the payload.
+// relay: a native app (the iPhone app, the Android editor app, the Intentic Device app); its OS push service only accepts
+// sends from the vendor, so the daemon posts through a relay, which can read the payload. Only Apple is handed the words:
+// an Android app gets a data-only message and fetches them from the daemon itself.
 
 // Exact shape `web-push` consumes, from `PushManager.subscribe()`; posted back verbatim.
 export const WebPushChannelSchema = z.object({
@@ -26,7 +27,12 @@ export const RelayChannelSchema = z.object({
         ),
     url: z.url().describe("Where to post a send. Recorded rather than assumed, so the sandbox need not know any platform by name."),
     deviceId: z.string().min(1).describe("The device's id, which also identifies this registration everywhere else in this group."),
-    secret: z.string().min(1).describe("Proof that this sandbox may notify this device. The relay never learns which sandbox is calling."),
+    secret: z
+        .string()
+        .min(1)
+        .describe(
+            "Proof that this sandbox may notify this device. A send names no sandbox; the relay knows which sandbox a device belongs to only when the editor app registered it for that one sandbox, so the app can be told which sandbox to ask.",
+        ),
 });
 export type RelayChannel = z.infer<typeof RelayChannelSchema>;
 export const PushChannelSchema = z.discriminatedUnion("kind", [WebPushChannelSchema, RelayChannelSchema]);
@@ -61,6 +67,16 @@ export const PushNotificationSchema = z.object({
         ),
 });
 export type PushNotification = z.infer<typeof PushNotificationSchema>;
+export const PushSentQuerySchema = z.object({
+    tag: z.string().min(1).describe("The tag the push carried, which is all a native app's push says about what it was."),
+});
+// What a native app's data-only push leaves out, read back over the app's own session so the words never pass through
+// the push service or the relay.
+export const PushSentNotificationSchema = PushNotificationSchema.extend({
+    tag: z.string().min(1).describe("The tag it was sent under, the one asked for."),
+    sentAt: z.string().describe("When the sandbox sent it (ISO)."),
+});
+export type PushSentNotification = z.infer<typeof PushSentNotificationSchema>;
 export const PushConfigSchema = z.object({
     publicKey: z.string().describe("The key a browser needs in order to subscribe. Native apps ignore it."),
     subscribed: z