@intentic/sandbox-contract 1.345.0 → 1.346.0

package/src/schemas/hosts.ts

@@ -21,6 +21,22 @@ export const MachineIdSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{7,1
 export const derivedMachineId = (card: string): string => `card:${card}`;
 export const isDerivedMachineId = (machineId: string): boolean => machineId.startsWith("card:");
 
+// Which computer and which OS install on it is enrolling (`environmentKeyOf`), as the machine agent says it when it
+// redeems a pairing. Both optional, since an agent older than either says nothing.
+export const MachineIdentitySchema = z.object({
+    machineId: MachineIdSchema.optional(),
+    environment: z.string().min(1).optional(),
+});
+export type MachineIdentity = z.infer<typeof MachineIdentitySchema>;
+
+// (2026-10-20) The body of POST /system/hosts/enroll: the redeeming agent's identity, so the enrollment is written with
+// its real machine id instead of the card's derived one and joins that machine's sync row from its first write. Before
+// this the route took no body and the id was learned only at the agent's first connect, which left a freshly paired
+// computer as two machine cards until then. An agent older than it sends none, and the daemon reads one it cannot parse
+// as none. Kept here rather than beside the answer (peer-enrollment.ts), which the browser extension bundles.
+export const PeerEnrollmentRequestSchema = MachineIdentitySchema;
+export type PeerEnrollmentRequest = MachineIdentity;
+
 // How many skipped lines an agent sends in its upkeep summary at most; the counts cover the rest.
 export const UPKEEP_SKIPPED_SHOWN = 10;
 
@@ -115,6 +131,9 @@ export type DeviceFacts = z.infer<typeof DeviceFactsSchema>;
 //   type a secret.
 // - `sleep`: the `sleep` op, a sandbox put to sleep now (`ic sandbox sleep <slug>`): stopped, and started again by
 //   itself when somebody opens it; advertised only when the agent's `ic` has `sandbox sleep`.
+// - `reachable-ways-back`: not an op but what a listing means: a sandbox's `rollbackTargets` are only the ways back a
+//   rollback can reach (ic 2026-10-19 on). Said by ic itself (`ic features`, golden/ic-features.json); without it the
+//   rows are an older ic's, which also listed pruned dev builds no download can bring back (state/ways-back.ts).
 export const DeviceFeatureSchema = z.enum([
     "reshape-later",
     "set-shape",
@@ -125,6 +144,7 @@ export const DeviceFeatureSchema = z.enum([
     "programs",
     "keyring",
     "sleep",
+    "reachable-ways-back",
 ]);
 export type DeviceFeature = z.infer<typeof DeviceFeatureSchema>;
 export const DEVICE_FEATURE_RESHAPE_LATER: DeviceFeature = "reshape-later";
@@ -136,6 +156,11 @@ export const DEVICE_FEATURE_PROJECT_DELIVERY: DeviceFeature = "project-delivery"
 export const DEVICE_FEATURE_PROGRAMS: DeviceFeature = "programs";
 export const DEVICE_FEATURE_KEYRING: DeviceFeature = "keyring";
 export const DEVICE_FEATURE_SLEEP: DeviceFeature = "sleep";
+export const DEVICE_FEATURE_REACHABLE_WAYS_BACK: DeviceFeature = "reachable-ways-back";
+// What `ic features --json` answers (_sandbox/ic/src/features.rs, golden/ic-features.json): the optional ops that ic
+// implements, as strings, since a newer ic's word means nothing to an older agent.
+export const IcFeaturesAnswerSchema = z.object({ features: z.array(z.string()) });
+
 // The features an agent advertised that this build knows; an unknown one is a newer agent's and means nothing here.
 export const deviceFeatures = (facts: Pick<DeviceFacts, "features"> | undefined): DeviceFeature[] =>
     (facts?.features ?? []).flatMap((feature) => {
@@ -208,6 +233,34 @@ export const HostEnvironmentSchema = z.object({
 });
 export type HostEnvironment = z.infer<typeof HostEnvironmentSchema>;
 
+// HOW MUCH OF ONE COMPUTER ANSWERS RIGHT NOW (2026-10-20), read off its environments' own sockets: the one answer
+// /capabilities, the Devices board and a call's routing give about a machine. `online` while its native side answers
+// (the one named after the card, which owns the screen and every tool but `run_command`'s crossing), whatever its
+// distros do, since a distro asleep beside a live Windows is the ordinary state of a PC; `partly` while the native side
+// does not and another environment does (a call naming that side still reaches it); `offline` while nothing does. Before
+// this the card read the native side alone and the board any side, so one PC was offline on one screen and live on the
+// next (2026-10-13), and "partly" was worked out twice more. A list with no native side at all (a machine seen only
+// through a distro's sync) is online while anything of it answers.
+export type MachinePresence =
+    | { readonly kind: "online" }
+    | { readonly kind: "partly"; readonly awake: readonly string[] }
+    | { readonly kind: "offline" };
+
+export const machinePresence = (environments: readonly Pick<HostEnvironment, "key" | "online">[]): MachinePresence => {
+    const native = environments.find((environment) => environment.key === HOST_NATIVE_ENVIRONMENT);
+    const awake = environments
+        .filter((environment) => environment.key !== HOST_NATIVE_ENVIRONMENT && environment.online)
+        .map((environment) => environment.key)
+        .toSorted();
+    if (native?.online === true || (native === undefined && awake.length > 0)) {
+        return { kind: "online" };
+    }
+    return awake.length > 0 ? { kind: "partly", awake } : { kind: "offline" };
+};
+
+// An environment by the name a person and `run_command`'s `in` know it by: a distro by its WSL name, the rest by key.
+export const environmentName = (key: string): string => (key.startsWith("wsl:") ? key.slice("wsl:".length) : key);
+
 export const HostSummarySchema = z.object({
     // The capability id, the machine's name, and the prefix of its tools (mcp__<id>__run_command). On a per-connection
     // row (`hostConnections`) it is that connection's key instead, and `card` names the machine.
@@ -225,6 +278,9 @@ export const HostSummarySchema = z.object({
     // Epoch ms of the last held socket; absent means not since this daemon booted (liveness resets on restart).
     lastSeen: z.number().optional(),
     facts: DeviceFactsSchema.optional(),
+    // The card's "Manage sandboxes on this device" switch is on: a container verb sent to this machine (create, start,
+    // remove…) is let through rather than refused by the machine. Absent from a daemon older than it.
+    manages: z.boolean().optional(),
 });
 export type HostSummary = z.infer<typeof HostSummarySchema>;
 export const HostsListSchema = z.object({ hosts: z.array(HostSummarySchema) });

package/src/schemas/machine-presence.test.ts

@@ -0,0 +1,33 @@
+import { environmentName, machinePresence } from "./hosts.js";
+
+// One answer to "does this computer answer", read by /capabilities, the Devices board and a call's routing alike
+// (2026-10-13/15: one PC was offline on the card, live on the board, and partly connected by a third reading).
+
+const side = (key: string, online: boolean) => ({ key, online });
+
+test("a PC whose native side answers is online, whatever its distros do", () => {
+    expect(machinePresence([side("native", true), side("wsl:archlinux", false)])).toEqual({ kind: "online" });
+    expect(machinePresence([side("native", true), side("wsl:archlinux", true)])).toEqual({ kind: "online" });
+});
+
+test("a PC answering only through its distros is partly connected, and names them in order", () => {
+    expect(machinePresence([side("native", false), side("wsl:ubuntu", true), side("wsl:archlinux", true)])).toEqual({
+        kind: "partly",
+        awake: ["wsl:archlinux", "wsl:ubuntu"],
+    });
+});
+
+test("a computer nothing of which answers is offline", () => {
+    expect(machinePresence([side("native", false), side("wsl:archlinux", false)])).toEqual({ kind: "offline" });
+    expect(machinePresence([])).toEqual({ kind: "offline" });
+});
+
+// A machine seen only through a distro's sync has no native side to be missing.
+test("a computer with no native side is online while anything of it answers", () => {
+    expect(machinePresence([side("wsl:archlinux", true)])).toEqual({ kind: "online" });
+});
+
+test("names a distro the way WSL and `in` do", () => {
+    expect(environmentName("wsl:archlinux")).toBe("archlinux");
+    expect(environmentName("native")).toBe("native");
+});

package/src/schemas/privacy-egress.test.ts

@@ -0,0 +1,83 @@
+import { DEFAULT_PRIVACY_SHIELD, type PrivacyShieldMode, type PrivacyShieldPolicy, withConversationTrust } from "./privacy.js";
+import { isPrivacyRefusal, ownerTrusted, type PrivacyEgress, type PrivacyRoute, shieldVerdict, turnRoute } from "./privacy-egress.js";
+
+// One verdict for every place bytes leave for a model, and for the editor's word before a send. Each scenario the shield
+// once got wrong at one of those places is a row here, so a place that reads the verdict cannot get it wrong again.
+
+const policy = (mode: PrivacyShieldMode, extra: Partial<PrivacyShieldPolicy> = {}): PrivacyShieldPolicy => ({ ...DEFAULT_PRIVACY_SHIELD, mode, ...extra });
+const egress = (route: PrivacyRoute, extra: Partial<PrivacyEgress> = {}): PrivacyEgress => ({ provider: "cursor", local: false, route, ...extra });
+
+const ROUTES: readonly PrivacyRoute[] = ["gateway", "hooks", "sealed", "runtime", "runner", "own-key", "shared-server"];
+
+describe(`shieldVerdict`, () => {
+    it(`passes everything while the shield is off, and only reads while it watches`, () => {
+        for (const route of ROUTES) {
+            expect(shieldVerdict(policy(`off`), egress(route))).toEqual({ kind: `pass`, because: `off` });
+        }
+        expect(ROUTES.map((route) => shieldVerdict(policy(`watch`), egress(route)).kind)).toEqual([
+            `watch`,
+            `watch`,
+            `watch`,
+            `pass`,
+            `pass`,
+            `pass`,
+            `pass`,
+        ]);
+    });
+
+    it(`masks every seam and refuses every bypass while it is on`, () => {
+        expect(ROUTES.map((route) => shieldVerdict(policy(`on`), egress(route)))).toEqual([
+            { kind: `mask` },
+            { kind: `mask` },
+            { kind: `mask` },
+            { kind: `refuse`, route: `runtime` },
+            { kind: `refuse`, route: `runner` },
+            { kind: `refuse`, route: `own-key` },
+            { kind: `refuse`, route: `shared-server` },
+        ]);
+    });
+
+    it(`passes a local model, a trusted provider and a granted conversation on every route`, () => {
+        const granted = withConversationTrust(policy(`on`), `c-1`, `cursor`, true);
+        for (const route of ROUTES) {
+            expect(shieldVerdict(policy(`on`), egress(route, { local: true }))).toEqual({ kind: `pass`, because: `local` });
+            expect(shieldVerdict(policy(`on`, { trusted: [`cursor`] }), egress(route))).toEqual({ kind: `pass`, because: `trusted` });
+            expect(shieldVerdict(granted, egress(route, { conversationId: `c-1` }))).toEqual({ kind: `pass`, because: `granted` });
+            // The grant is that conversation's alone, and a request outside any conversation (a helper) has none.
+            expect(shieldVerdict(granted, egress(route, { conversationId: `c-2` })).kind).not.toBe(`pass`);
+            expect(shieldVerdict(granted, egress(route)).kind).not.toBe(`pass`);
+        }
+    });
+
+    // grand-mesa-dsjg (2026-10-07): commit messages on Composer were refused before a word was read, while a turn on the
+    // same provider ran. A helper's prompt is sealed, so it is read and masked like a turn's, never refused for its runtime.
+    it(`reads a helper's sealed prompt exactly as a hooked turn is read`, () => {
+        expect(shieldVerdict(policy(`on`), egress(`sealed`))).toEqual(shieldVerdict(policy(`on`), egress(`hooks`)));
+    });
+
+    // calm-lichen-5wrn (2026-10-08): opening a Cursor composer warned before anything was sent. A hooked runtime is a seam.
+    // deft-shale-590s (2026-10-11): the same conversation on a runner was refused only after the send.
+    it(`refuses a turn by its placement, not by its runtime`, () => {
+        expect(shieldVerdict(policy(`on`), egress(turnRoute(`hooks`)))).toEqual({ kind: `mask` });
+        expect(shieldVerdict(policy(`on`), egress(turnRoute(`hooks`, `omen`)))).toEqual({ kind: `refuse`, route: `runner` });
+        expect(shieldVerdict(policy(`on`), egress(turnRoute(`gateway`, `omen`)))).toEqual({ kind: `refuse`, route: `runner` });
+        expect(shieldVerdict(policy(`on`), egress(turnRoute(`none`)))).toEqual({ kind: `refuse`, route: `runtime` });
+    });
+
+    it(`calls only the owner's own choices trusted`, () => {
+        expect(ownerTrusted({ kind: `pass`, because: `granted` })).toBe(true);
+        expect(ownerTrusted({ kind: `pass`, because: `local` })).toBe(true);
+        expect(ownerTrusted({ kind: `pass`, because: `off` })).toBe(false);
+        expect(ownerTrusted({ kind: `pass`, because: `unwatched` })).toBe(false);
+        expect(ownerTrusted({ kind: `mask` })).toBe(false);
+    });
+});
+
+describe(`isPrivacyRefusal`, () => {
+    it(`knows the shield's own refusals and nothing else`, () => {
+        expect(isPrivacyRefusal(`privacy-unshielded`)).toBe(true);
+        expect(isPrivacyRefusal(`privacy-instructions`)).toBe(true);
+        expect(isPrivacyRefusal(`model-unavailable`)).toBe(false);
+        expect(isPrivacyRefusal(undefined)).toBe(false);
+    });
+});

package/src/schemas/privacy-egress.ts

@@ -0,0 +1,86 @@
+import { z } from "zod";
+import { type PrivacyShieldPolicy, trustedInConversation } from "./privacy.js";
+
+// THE ONE DECISION about bytes bound for a model provider: pass them as they are, watch them, mask them, or refuse them.
+// Every place they leave by asks it (the gateway, a hooked runtime's channels, a sealed helper prompt, a turn's
+// admission, a runner's placement, a credential that would go around the gateway), and so does the editor before a
+// send, so the warning above the composer is this verdict and never a guess of its own. Before 2026-10-20 the formula
+// was written out at each of those places, and they drifted: helpers refused where turns ran, a child kept here where
+// its parent could go, a strip that warned on opening a composer and stayed silent about a runner.
+
+// How bytes reach the provider. Through a seam the shield reads every byte at: the gateway a runtime is pointed at, the
+// hooks a runtime hands each channel's text to before its model reads it, a sealed prompt (a helper's whole request, in
+// hand before any runtime has it). Or past every seam: a runtime with neither (an ACP agent, Pi), a runner calling its
+// provider from its own machine, a key the provider is called with directly (Codex on the container's OpenAI key), a
+// shared server started before the shield was on.
+export type PrivacySeam = "gateway" | "hooks" | "sealed";
+export const PrivacyBypassSchema = z.enum(["runtime", "runner", "own-key", "shared-server"]);
+export type PrivacyBypass = z.infer<typeof PrivacyBypassSchema>;
+export type PrivacyRoute = PrivacySeam | PrivacyBypass;
+
+const SEAMS: ReadonlySet<PrivacyRoute> = new Set<PrivacySeam>(["gateway", "hooks", "sealed"]);
+const isSeam = (route: PrivacyRoute): route is PrivacySeam => SEAMS.has(route);
+
+// The route of a turn on a runtime, from its `privacy` capability (agent-runtimes.ts), placed on `runner` or here.
+export const turnRoute = (privacy: "gateway" | "hooks" | "none", runner?: string): PrivacyRoute =>
+    runner !== undefined ? "runner" : privacy === "none" ? "runtime" : privacy;
+
+export interface PrivacyEgress {
+    readonly provider: string;
+    // A model this machine serves: nothing it reads leaves.
+    readonly local: boolean;
+    // A conversation's own grant counts there; a request outside any conversation has none.
+    readonly conversationId?: string | undefined;
+    readonly route: PrivacyRoute;
+}
+
+// Why bytes pass as they are: the shield is off, the model is on this machine, the owner trusts the provider everywhere
+// or let it read this conversation, or the shield only watches and cannot see this route at all.
+export type PassReason = "off" | "local" | "trusted" | "granted" | "unwatched";
+
+export type ShieldVerdict =
+    | { readonly kind: "pass"; readonly because: PassReason }
+    | { readonly kind: "watch" }
+    | { readonly kind: "mask" }
+    | { readonly kind: "refuse"; readonly route: PrivacyBypass };
+
+const pass = (because: PassReason): ShieldVerdict => ({ kind: "pass", because });
+
+export const shieldVerdict = (policy: Pick<PrivacyShieldPolicy, "mode" | "trusted" | "conversations">, egress: PrivacyEgress): ShieldVerdict => {
+    if (policy.mode === "off") {
+        return pass("off");
+    }
+    if (egress.local) {
+        return pass("local");
+    }
+    if (policy.trusted.includes(egress.provider)) {
+        return pass("trusted");
+    }
+    if (trustedInConversation(policy, egress.provider, egress.conversationId)) {
+        return pass("granted");
+    }
+    if (!isSeam(egress.route)) {
+        return policy.mode === "on" ? { kind: "refuse", route: egress.route } : pass("unwatched");
+    }
+    return policy.mode === "on" ? { kind: "mask" } : { kind: "watch" };
+};
+
+// Whether the owner let the provider read what it is sent as it is (here, everywhere, or in this conversation): what
+// the log calls trusted.
+export const ownerTrusted = (verdict: ShieldVerdict): boolean =>
+    verdict.kind === "pass" && (verdict.because === "local" || verdict.because === "trusted" || verdict.because === "granted");
+
+// The failure codes a turn the shield turned away ends with: refused by its verdict (`privacy-unshielded`), or for what
+// it found where it could not mask (`privacy-instructions`). The way through both is the same grant.
+const REFUSAL_CODES = ["privacy-unshielded", "privacy-instructions"] as const;
+export type PrivacyRefusalCode = (typeof REFUSAL_CODES)[number];
+const REFUSAL_CODE_SET: ReadonlySet<string> = new Set(REFUSAL_CODES);
+export const isPrivacyRefusal = (code: string | undefined): code is PrivacyRefusalCode => code !== undefined && REFUSAL_CODE_SET.has(code);
+
+// A refusal as the shield both words and types it: the sentence a turn ends with, and the route its verdict refused,
+// which rides the turn's error frame (`privacyRoute`) so a reader acts on the route rather than on the sentence. Absent
+// for a policy that could not be read, which refuses whatever the route.
+export interface PrivacyRefusal {
+    readonly sentence: string;
+    readonly route?: PrivacyBypass;
+}

package/src/schemas/privacy.ts

@@ -42,6 +42,10 @@ export type PrivacyNames = z.infer<typeof PrivacyNamesSchema>;
 
 export const PRIVACY_TRUSTED_MAX = 200;
 export const PRIVACY_ALLOW_MAX = 1000;
+
+// How a never-masked value (policy `allow`) is compared with what the shield finds, by the detectors and by the editor
+// that keeps the list: case, Unicode composition and runs of whitespace do not tell two values apart.
+export const allowKey = (value: string): string => value.normalize("NFC").toLowerCase().replace(/\s+/g, " ").trim();
 export const PRIVACY_CONVERSATIONS_MAX = 200;
 
 // The owner's own additions to what the shield finds. The policy travels whole on every write, so each is kept to what a

package/src/schemas/project-delivery.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 
-// LANDED WORK DELIVERED TO THE OWNER'S FOLDER. A folder attached to this computer's own sandbox is copied one way into
+// LANDED WORK DELIVERED TO THE OWNER'S FOLDER. A folder with a sandbox made for it is copied one way into
 // `/work/<name>`; when a conversation's work lands there, the daemon hands the same change to the machine agent that
 // holds the folder, which applies it file by file under a restore point and never over an edit of the owner's own.
 // The daemon asks (`deliverProject` on the device contract), the machine decides and writes; nothing an agent runs can

package/src/schemas/providers/plan-limits.test.ts

@@ -0,0 +1,16 @@
+import { sandboxAnswerSchema } from "../../index.js";
+import { ProviderRefusalsSchema } from "./plan-limits.js";
+
+// 2026-10-21: /agent/refusals went from one refusal per provider to a list per provider, and the editor parses every
+// answer with its own build's schema. Against a released daemon (1.249.0 to 1.345.0) the parse failed, the read was kept
+// as nothing, and every spent account and model read as ready.
+test("reads a released daemon's one refusal per provider as a list of one, and today's lists as they are", () => {
+    const spent = { at: 1_760_000_000_000, kind: "limit", message: "Claude AI usage limit reached", account: "acct-1", resetsAt: 1_760_010_000 };
+    const schema = sandboxAnswerSchema(["agent", "refusals"]);
+    const older = schema?.safeParse({ refusals: { claude: spent } });
+    expect(older?.success).toBe(true);
+    expect(older?.data).toEqual({ refusals: { claude: [spent] } });
+    const today = { refusals: { claude: [spent, { at: 1_760_000_000_001, kind: "auth", message: "OAuth token revoked", account: "acct-2" }], codex: [] } };
+    expect(schema?.safeParse(today).data).toEqual(today);
+    expect(ProviderRefusalsSchema.safeParse({ refusals: { claude: "spent" } }).success).toBe(false);
+});

package/src/schemas/providers/plan-limits.ts

@@ -86,9 +86,9 @@ export type AccountUsage = z.infer<typeof AccountUsageSchema>;
 // words for a person, never a key.
 export const AccountFixSchema = z.enum(["reconnect", "admin", "verify", "wait"]);
 export type AccountFix = z.infer<typeof AccountFixSchema>;
-// Whether an account can serve a turn, decided once by the daemon (models/plan-pools.ts `serviceState`) from every fact
-// it holds about it: a revoked sign-in, a lost seat, a translator bench, a refusal still standing, and its plan limits.
-// Every picker (an unnamed turn, a limit move, a keep-warm refresh) and every surface reads this one verdict.
+// Whether an account can serve a turn, judged by one rule (models/plan-pools.ts `serviceStates`) from every fact on file
+// about it: a revoked sign-in, a lost seat, a translator bench, every refusal still standing, and its plan limits. The
+// daemon and the editor run that rule on the same facts; nothing publishes or keeps a judged copy.
 export const AccountStateSchema = z.discriminatedUnion("kind", [
     z.object({
         kind: z.literal("ready"),
@@ -104,6 +104,10 @@ export const AccountStateSchema = z.discriminatedUnion("kind", [
             .number()
             .optional()
             .describe("When every full pool has reopened, in epoch seconds, where the plan publishes it. Absent means unknown, never now."),
+        pool: z
+            .string()
+            .optional()
+            .describe("The pool holding it shut, by the plan's own name for it, where the plan meters it apart from other models. Absent for an undivided allowance."),
     }),
     z.object({
         kind: z.literal("blocked"),
@@ -145,49 +149,7 @@ export const LimitResetClaimSchema = z.object({
     detail: z.string().optional().describe("What went wrong, in words, for the two outcomes that are this sandbox's fault rather than the plan's."),
 });
 export type LimitResetClaim = z.infer<typeof LimitResetClaimSchema>;
-// Observed and exact, unlike a polled usage snapshot that can be stale; keyed by provider, not account, since a routed
-// turn doesn't know which served it. `kind` is read off what the provider said, not the frame code.
-export const ProviderRefusalSchema = z.object({
-    // Read side by side with `AccountUsage.measuredAt` (also ms).
-    at: z.number().describe("When it refused, in milliseconds."),
-    // Only a turn that actually runs settles an entitlement refusal — nothing else can.
-    kind: z
-        .enum(["limit", "auth", "entitlement"])
-        .describe(
-            "Three different noes, kept apart because what fixes each is different. A spent allowance is answered by waiting; a refused credential by signing in again; and an entitlement refusal, where somebody has switched this off for your seat, by neither of those. That last one authenticates fine and reports healthy limits the whole time it refuses everything.",
-        ),
-    message: z.string().describe("The provider's own words, verbatim. The only part that says which limit or which credential."),
-    // Known for native turns only; a routed turn doesn't say which account served it.
-    account: z.string().optional().describe("Which account was serving, where that is known."),
-    // Lets a `limit` refusal be read against the pool that model spends (`UsageWindow.gates`), not the account's
-    // fullest pool.
-    model: z.string().optional().describe("Which model the refused turn was on, where that is known."),
-    // The provider's own "try again at …", which a polled reading cannot contradict: a usage endpoint can keep showing
-    // room while the plan refuses every turn.
-    resetsAt: z
-        .number()
-        .optional()
-        .describe(
-            "When the provider said to try again, in epoch seconds, for a spent allowance where it named one. Until then the refusal stands whatever a reading says; after it, it is over.",
-        ),
-    // Cursor's "ask your admin to increase your limit": a team's spend limit, which no usage endpoint reads. Not Codex's
-    // "send a request to your admin", which names a window its reading measures (failure-sentences.ts ADMIN_GRANTED).
-    unmetered: z
-        .literal(true)
-        .optional()
-        .describe(
-            "Set on a spent allowance no usage reading measures, such as a credit an organisation's admin grants. No reading answers it: it stands until the provider's own reset, or until a turn is answered.",
-        ),
-});
-export type ProviderRefusal = z.infer<typeof ProviderRefusalSchema>;
-export const ProviderRefusalsSchema = z.object({
-    refusals: z
-        .record(z.string(), ProviderRefusalSchema)
-        .describe(
-            "The most recent refusal per provider. Read alongside an account's usage: that says how full it was when last checked, this says whether it has since started saying no.",
-        ),
-});
-export type ProviderRefusals = z.infer<typeof ProviderRefusalsSchema>;
+export { type ProviderRefusal, ProviderRefusalSchema, type ProviderRefusals, ProviderRefusalsSchema } from "./refusals.js";
 // `name` is CLIProxyAPI's auth-file name, the stable key a disconnect addresses; `label` is the reported sign-in
 // identity (email, else the file name).
 export const TranslatorAccountSchema = z.object({
@@ -212,9 +174,6 @@ export const TranslatorAccountSchema = z.object({
             verify: z.string().optional(),
         })
         .optional(),
-    state: AccountStateSchema.optional().describe(
-        "Whether it can serve a turn now, judged from everything above plus the provider's last refusal. Absent from a daemon older than this field.",
-    ),
 });
 export type TranslatorAccount = z.infer<typeof TranslatorAccountSchema>;
 // A list per provider, not a flag: CLIProxyAPI holds several auth files per provider and balances across them. Built

package/src/schemas/providers/provider-oauth.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { AccountStateSchema, AccountUsageSchema } from "./plan-limits.js";
+import { AccountUsageSchema } from "./plan-limits.js";
 import { SignInCatcherSchema } from "../loopback-catch.js";
 import { KeyedProviderSchema } from "./provider-subscriptions.js";
 // Claude uses PKCE paste-back (start → exchange); Codex uses OpenAI's device-code flow (start → poll). A sandbox can
@@ -38,9 +38,6 @@ export const OauthAccountSchema = z.object({
     usage: AccountUsageSchema.optional().describe(
         "How full its plan limits were when last measured, so a picker can show what is left before committing work to it. Absent until a reading exists, which reads as unknown rather than as nothing left.",
     ),
-    state: AccountStateSchema.optional().describe(
-        "Whether it can serve a turn now, judged once from the sign-in, the seat, the provider's last refusal and the plan limits: the verdict every picker in the sandbox uses. Read this rather than the fields it was judged from. Absent from a daemon older than this field.",
-    ),
 });
 export type OauthAccount = z.infer<typeof OauthAccountSchema>;
 export const OauthAccountListSchema = z.object({
@@ -191,15 +188,6 @@ export const ModelSchema = z.object({
     helperOnly: HelperOnlySchema.optional().describe(
         "Set where this model may write commit messages, titles and other one-shot jobs but never run a chat turn, and why: its server says it cannot call tools, or it is the small local model kept for quick jobs. Absent means nothing has said it cannot.",
     ),
-    // Epoch seconds. A fact about the MODEL, not about any one account: a routed provider balances across credentials,
-    // so a model every one of them is benched on is unrunnable however much headroom their rings show. Absent is the
-    // ordinary case and means runnable, never "unknown".
-    availableAt: z
-        .number()
-        .optional()
-        .describe(
-            "When this model can be asked again, where every credential that serves it is currently refused. Absent means it can be asked now. A model here is still worth showing, unlike one the plan does not cover at all: the wait is the whole answer.",
-        ),
 });
 export type Model = z.infer<typeof ModelSchema>;
 export const ModelsSchema = z.object({

package/src/schemas/providers/refusals.ts

@@ -0,0 +1,62 @@
+import { z } from "zod";
+
+// WHAT A PROVIDER SAID WHEN IT REFUSED A TURN, and the ledger of them the sandbox answers with. Kept out of plan-limits.ts,
+// which re-exports both, so the plan and turn schemas there stay within one file's reach.
+
+// Observed and exact, unlike a polled usage snapshot that can be stale; keyed by provider, not account, since a routed
+// turn doesn't know which served it. `kind` is read off what the provider said, not the frame code.
+export const ProviderRefusalSchema = z.object({
+    // Read side by side with `AccountUsage.measuredAt` (also ms).
+    at: z.number().describe("When it refused, in milliseconds."),
+    // Only a turn that actually runs settles an entitlement refusal — nothing else can.
+    kind: z
+        .enum(["limit", "auth", "entitlement"])
+        .describe(
+            "Three different noes, kept apart because what fixes each is different. A spent allowance is answered by waiting; a refused credential by signing in again; and an entitlement refusal, where somebody has switched this off for your seat, by neither of those. That last one authenticates fine and reports healthy limits the whole time it refuses everything.",
+        ),
+    message: z.string().describe("The provider's own words, verbatim. The only part that says which limit or which credential."),
+    // Known for native turns only; a routed turn doesn't say which account served it.
+    account: z.string().optional().describe("Which account was serving, where that is known."),
+    // Lets a `limit` refusal be read against the pool that model spends (`UsageWindow.gates`), not the account's
+    // fullest pool.
+    model: z.string().optional().describe("Which model the refused turn was on, where that is known."),
+    // The provider's own "try again at …", which a polled reading cannot contradict: a usage endpoint can keep showing
+    // room while the plan refuses every turn.
+    resetsAt: z
+        .number()
+        .optional()
+        .describe(
+            "When the provider said to try again, in epoch seconds, for a spent allowance where it named one. Until then the refusal stands whatever a reading says; after it, it is over.",
+        ),
+    // Stamped by the daemon's ledger as it files a spent allowance naming no instant (plan-pools.ts refusedPoolReset).
+    poolResetsAt: z.number().optional().describe("Epoch seconds the refused pool reopens, for a spent allowance naming no time: it ends then."),
+    // Cursor's "ask your admin to increase your limit": a team's spend limit, which no usage endpoint reads. Not Codex's
+    // "send a request to your admin", which names a window its reading measures (failure-sentences.ts ADMIN_GRANTED).
+    unmetered: z
+        .literal(true)
+        .optional()
+        .describe(
+            "Set on a spent allowance no usage reading measures, such as a credit an organisation's admin grants. No reading answers it: it stands until the provider's own reset, or until a turn is answered.",
+        ),
+    byHand: z
+        .literal(true)
+        .optional()
+        .describe(
+            "Set by a person rather than by a refused turn, for a plan nothing can read: believed for a day, or until unmarked or a turn on it is answered.",
+        ),
+});
+export type ProviderRefusal = z.infer<typeof ProviderRefusalSchema>;
+// A released daemon (1.345.0 and earlier) answers one refusal per provider, its last: read as a list of one, as the
+// /events frame's `refusal` is (refusalsOf). What this build sends, and its output shape, is still the list.
+const RefusalsOnFileSchema = z.codec(z.union([z.array(ProviderRefusalSchema), ProviderRefusalSchema]), z.array(ProviderRefusalSchema), {
+    decode: (filed) => (Array.isArray(filed) ? filed : [filed]),
+    encode: (list) => list,
+});
+export const ProviderRefusalsSchema = z.object({
+    refusals: z
+        .record(z.string(), RefusalsOnFileSchema)
+        .describe(
+            "Every refusal on file per provider, each the latest of its kind for the account and model it names: what every verdict on that provider's accounts is judged against. Read alongside an account's usage: that says how full it was when last checked, these say whether it has since started saying no.",
+        ),
+});
+export type ProviderRefusals = z.infer<typeof ProviderRefusalsSchema>;

package/src/schemas/sessions.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { MatchSnippetSchema } from "./agents.js";
+import { MatchSnippetSchema } from "./agent-search.js";
 export const SessionIdParamSchema = z.object({ id: z.string().describe("Which past conversation.") });
 export const SessionSummarySchema = z.object({
     id: z.string().describe("Its id."),

package/src/schemas/settings.ts

@@ -602,6 +602,8 @@ export const SandboxSettingsSchema = z.object({
     childRerunHorizonHours: z.number().int().min(0).max(24).default(6).describe(
         "How long a subagent refused for a spent allowance waits for the provider's reset before it goes again by itself. Past it, or at 0, it stops and its parent hears where else the work can go. One spawned with fallbacks waits at most 90 minutes and then moves to them.",
     ),
+    subagentBudget: z.boolean().default(true).describe("Start a subagent only where an account's allowance can carry it through its windows, on the account left with the most room after it. The rest wait as pending and start by themselves as running ones end or a window reopens. Off, every subagent starts at once, wherever the most room reads now."),
+    subagentReservePercent: z.number().int().min(0).max(50).default(10).describe("How much of each allowance window, in points of 100, subagents leave for your own conversations: a fan-out is planned against what is left past it."),
     // Width again, for a team-chat automation rather than a turn: each thread a message lands in is a conversation of
     // its own, and threads of one automation are worked on side by side up to this many (automations/scheduler.ts in
     // the daemon); one more waits, told it is queued, until a slot frees. Read per fire, so a change holds from the next

package/src/schemas/system.ts

@@ -61,6 +61,17 @@ export const PreparingUpdateSchema = z.object({
     percent: z.number().min(0).max(100).optional().describe("How far through the download it is, from 0 to 100. Absent for a step with no measure of its own."),
 });
 export type PreparingUpdate = z.infer<typeof PreparingUpdateSchema>;
+// What answers (state/sandbox-build.ts RunningSandbox): the build this container runs and when its daemon started.
+export const RunningSandboxSchema = z.object({
+    build: z
+        .object({
+            base: z.string().describe("The base image as the machine that runs it named it; empty when it said nothing."),
+            baseDigest: z.string().optional().describe("That base's registry digest, when the machine read one."),
+            overlay: z.string().optional().describe("The hash of the environment recipe built on the base. Absent on a stock image."),
+        })
+        .describe("Which build this container is: its base image and the environment built on it."),
+    bootedAt: z.number().describe("When the daemon answering started, in milliseconds. A container swapped in is a new boot."),
+});
 export const InfoSchema = z.object({
     name: z.string().optional().describe("What this sandbox is called."),
     image: z.string().optional().describe("The image it is running."),
@@ -129,6 +140,10 @@ export const InfoSchema = z.object({
     autoUpdate: AutoUpdateSchema.optional().describe(
         "Whether and when this sandbox takes a downloaded update by itself, and what it is waiting on. Absent where it cannot: a hosted sandbox, one built from a checkout, or one older than automatic updates.",
     ),
+    // What answers now, for a page telling a swap it pressed from one still running; absent from a daemon older than it.
+    running: RunningSandboxSchema.optional().describe(
+        "Which build answers and when its daemon started, so a page that asked for a rebuild, an update or a rollback can tell when the new container is the one answering. Absent from a sandbox older than this field.",
+    ),
 });
 export type Info = z.infer<typeof InfoSchema>;
 // What the daemon could not read in its own `.intentic/` state files, and in the files on its volume that

package/src/state/runtime-state.ts

@@ -73,6 +73,11 @@ const RUNTIME_DOMAINS = [
     // A standing yes written or taken back outside a need's answer: a permission card's pass, a release, a purge. They
     // live under the auth root, which no file push watches, and the Allowed list must move with the card that wrote one.
     { domain: "grants", invalidates: [["grants"]] },
+
+    // Somebody's composer draft was written, cleared or sent. The frame names no conversation and carries no words, since
+    // every member hears it: each window reads back its own caller's drafts (agents.drafts). The key is the editor's draft
+    // store's, which reads them back itself rather than through a cached query (models/conversations/drafts/).
+    { domain: "drafts", invalidates: [["drafts"]] },
 ] as const satisfies readonly RuntimeDomainBinding[];
 
 export const RUNTIME_DOMAIN_BINDINGS: readonly RuntimeDomainBinding[] = RUNTIME_DOMAINS;