@intentic/sandbox-contract 1.359.2 → 1.361.0

package/src/models/agent-runtimes.ts

@@ -6,6 +6,16 @@
 // that grants it.
 export type ExecutionBackend = "shell" | "js";
 
+// Which origins of skills a runtime's loader reads by itself (AgentCapabilities.skillDiscovery).
+export interface SkillDiscovery {
+    readonly workspace: boolean;
+    readonly builtIn: boolean;
+    readonly kit: boolean;
+}
+
+const EVERY_SKILL: SkillDiscovery = { workspace: true, builtIn: true, kit: true };
+const NO_SKILL_LOADER: SkillDiscovery = { workspace: false, builtIn: false, kit: false };
+
 export interface AgentCapabilities {
     // Which loop serves the turn; `opencode-gemini` stays separate since adapter health keys off this field.
     readonly runtime: "claude-code" | "codex" | "opencode" | "opencode-gemini" | "acp" | "devin" | "kimi-cli" | "grok-build" | "pi" | "cursor" | "muse";
@@ -41,8 +51,12 @@ export interface AgentCapabilities {
     readonly warm: boolean;
     // How much of the owner's instructions this runtime takes: replace the base, append to it, or no seam at all.
     readonly instructions: "replace" | "append" | "none";
-    // How the runtime discovers loaded skills: scans its own filesystem, or the daemon names them in the opener.
-    readonly skillDiscovery: "native" | "prompt";
+    // Which of a turn's skills the runtime's own loader finds; the rest are named, with their paths, in the note a fresh
+    // session opens with (the sandbox's agent/run/decide/turn-skills.ts), less the ones the turn may not use:
+    // workspace - the workspace's loaded skills (.agents/skills, or the .claude/skills projection of them);
+    // builtIn - the product's own skills the image bakes (/root/.claude/skills);
+    // kit - the worn persona's own skills, which the daemon hands the loader per turn.
+    readonly skillDiscovery: SkillDiscovery;
     // Whether the owner's safety policy reaches this runtime, and how:
     // hooks - its own pre-execution hook can park a call and wait for a card (Claude Code only).
     // approval - a vendor approval channel the daemon answers from policy; the vendor picks which calls to raise.
@@ -69,6 +83,12 @@ export interface AgentCapabilities {
     // every tool call the loop makes passes a check the daemon answers, or the loop is built with only the listed tools.
     // A runtime that runs some tool without asking anyone cannot keep it, so a turn carrying a list never starts on one.
     readonly toolAllowlist: boolean;
+    // When the owner's per-edit checks (the `file.edited` rules, the byte scan) reach the model: `after-edit` where the
+    // loop's own hook answers each edit or write as it lands (Claude Code's PostToolUse, Codex's and Pi's gate), so the
+    // model reads them beside the call; `turn-end` where nothing stands after a call, so the daemon reads the files the
+    // turn's edit calls touched as it ends and says the findings back as one more prompt, beside the repositories' turn
+    // checks (runtimes/decorators/ending-checks.ts).
+    readonly editChecks: "after-edit" | "turn-end";
 }
 
 // The Claude Code Agent SDK loop, the ceiling every other runtime is measured against: the only one that owns the whole
@@ -89,7 +109,7 @@ export const CLAUDE_CODE: AgentCapabilities = {
     recovery: true,
     warm: true,
     instructions: "replace",
-    skillDiscovery: "native",
+    skillDiscovery: EVERY_SKILL,
     // The only runtime with its own pre-execution hook, so the only one where a hold can park instead of refusing.
     rulebook: "hooks",
     secrets: "masked",
@@ -98,6 +118,7 @@ export const CLAUDE_CODE: AgentCapabilities = {
     // A PreToolUse hook refuses every call off the list, under bypassPermissions and in subagents too
     // (agent/tools/tool-allowlist.ts).
     toolAllowlist: true,
+    editChecks: "after-edit",
 };
 
 // Codex app-server: item-level events, the turn's remote MCP servers and the daemon's own over http, per-thread hooks
@@ -131,7 +152,8 @@ export const CODEX: AgentCapabilities = {
     // thread/start's own fields: baseInstructions replaces Codex's base prompt, developerInstructions adds a developer
     // message.
     instructions: "replace",
-    skillDiscovery: "native",
+    // Codex reads the workspace's `.agents/skills` itself; the built-ins and a persona's kit are named in the note.
+    skillDiscovery: { workspace: true, builtIn: false, kit: false },
     // A per-thread PreToolUse hook puts every function tool (the shell, apply_patch, every MCP tool, spawn_agent) to the
     // door's gate before it runs, which may park it on a card (codex-hooks.ts). Codex fails a hook open, so the gate is
     // confirmed connected before the turn starts, a command or patch Codex asks approval for runs only if the gate
@@ -139,7 +161,7 @@ export const CODEX: AgentCapabilities = {
     // connect the gate, so there the rules reach only the commands and patches Codex asks about.
     rulebook: "hooks",
     // Shell commands resolve `{{secret:…}}` in the gate's rewrite and run under a wrapper that masks stored values in
-    // their output (codex-mask-script.ts); apply_patch, view_image and hosted tools pass no wrapper.
+    // their output (mask-script.ts); apply_patch, view_image and hosted tools pass no wrapper.
     secrets: "shell",
     // Its model provider's base_url is the daemon's, written into the per-thread config.
     privacy: "gateway",
@@ -148,6 +170,7 @@ export const CODEX: AgentCapabilities = {
     // too unless listed, and each MCP server is cut to its listed tools (`enabled_tools`). The residual: a known-safe
     // read-only command off the list runs if the in-process gate fails after it connected, and the turn is then stopped.
     toolAllowlist: true,
+    editChecks: "after-edit",
 };
 
 // OpenCode (the Grok runtime): its own agentic loop and tools, with the turn's remote MCP servers mounted on the shared
@@ -196,7 +219,9 @@ export const OPENCODE: AgentCapabilities = {
     // A prompt that replaces the base (the owner's own under `custom`, a small window's paragraph) runs on the daemon's
     // twin agents, whose base is blank, so it is the whole system text; anything else is added to OpenCode's own base.
     instructions: "replace",
-    skillDiscovery: "prompt",
+    // The server's skill roots are the workspace's loaded skills and the built-ins (opencode.ts serverConfig); a persona's
+    // kit, which changes per turn on a server shared by every turn, is named in the note.
+    skillDiscovery: { workspace: true, builtIn: true, kit: false },
     // OpenCode raises its permission asks for every shell command, a subagent's included (the server's own rules ask about
     // them all, and a child session inherits them); the daemon answers from the rulebook, a hold parked on a card while
     // the turn's inactivity watchdog is held. The JS backend consults the same gate. Not `hooks`: which calls ask is still
@@ -213,6 +238,7 @@ export const OPENCODE: AgentCapabilities = {
     // session inherits them. Every built-in tool has its own permission action (checked against 2.0.26), and a shell entry
     // narrowed to a command is checked against each command's ask (runtimes/opencode/allowlist/opencode-allowlist.ts).
     toolAllowlist: true,
+    editChecks: "turn-end",
 };
 
 // The same OpenCode loop, serving Gemini instead of xAI, identical abilities. The Claude Code loop announces itself in
@@ -252,13 +278,14 @@ export const ACP: AgentCapabilities = {
     isolation: "cwd",
     commands: true,
     terminals: true,
-    // A failure the agent words as a spent allowance or an outgrown window is coded (error-frames.ts codedFailure), but the
-    // words are each agent's own and the protocol marks no outage, so nothing promises the codes auto-resume keys off.
-    recovery: false,
+    // A failure the agent words as a spent allowance or an outgrown window is coded at the turn's one exit
+    // (error-frames.ts codedFailure), and an agent gone silent mid-turn is coded an outage by the shared watchdog
+    // (turn-watchdog.ts expiredFrame), so a turn the provider dropped is re-run once it is back, as every loop's is.
+    recovery: true,
     warm: false,
     // ACP's calls carry no system field: the agent owns its instructions, the persona note rides the message.
     instructions: "none",
-    skillDiscovery: "prompt",
+    skillDiscovery: NO_SKILL_LOADER,
     // In the protocol floor, so every agent has it; which calls it asks about is entirely its own choice. A terminal the
     // daemon runs for it (terminal/create) is asked about here too, unless the permission for it already was.
     rulebook: "approval",
@@ -267,6 +294,7 @@ export const ACP: AgentCapabilities = {
     privacy: "none",
     // Which calls the agent asks permission for is its own choice, and most run reads without asking.
     toolAllowlist: false,
+    editChecks: "turn-end",
 };
 
 // Devin's own CLI (`devin acp`), the ACP floor with one seam an installed agent lacks: the daemon picks the model, from
@@ -339,7 +367,8 @@ export const PI: AgentCapabilities = {
     // keeps Pi from loading AGENTS.md a second time beside the daemon's own note.
     instructions: "replace",
     // `--skill` per loaded skill, the persona's filter applied, with Pi's own discovery off (`--no-skills`).
-    skillDiscovery: "native",
+    // Pi's own discovery is off, and every skill the turn may use is handed to it by path (`--skill`, pi-adapter.ts).
+    skillDiscovery: EVERY_SKILL,
     // The daemon's extension, loaded with `-e` ahead of any other and whatever the card's command says of discovery, puts
     // every tool call (MCP and codemode calls included) to the turn's own hook socket before it runs, where a held one
     // parks on a card while Pi waits (pi-hooks.ts). A call it cannot ask about is refused, as a handler that throws is,
@@ -356,6 +385,7 @@ export const PI: AgentCapabilities = {
     // The same socket refuses every call off the turn's list, Pi's tools read under the Claude loop's names (bash as
     // Bash, find as Glob) and MCP tools under the same `mcp__<server>__<tool>`; fail closed as above.
     toolAllowlist: true,
+    editChecks: "after-edit",
 };
 
 // Cursor's own runtime, driven through `@cursor/sdk` from this daemon's process; an embedding surface, so most seams
@@ -372,7 +402,9 @@ export const CURSOR: AgentCapabilities = {
     permissions: "modes",
     // True since the daemon supplies its own ask tool; Cursor's own can fabricate an answer, so it's disallowed.
     questions: true,
-    // The turn's remote MCP servers plus host callbacks; everything but a Claude Code plugin checkout.
+    // The turn's remote MCP servers, the daemon's own door servers among them (accounts, secrets, watch, deps,
+    // diagnostics), plus host callbacks for the three it runs in the daemon's process instead (ask, code, the subagent
+    // tools: cursor-tools.ts); everything but a Claude Code plugin checkout.
     mcp: "tools",
     // The JS backend rides Cursor's custom-tool seam rather than an MCP server, and consults the rulebook in its
     // handler, since the hook file only covers the shell.
@@ -401,7 +433,9 @@ export const CURSOR: AgentCapabilities = {
     // Cursor's own loader reads every SKILL.md under `.agents/skills/` of each workspace root it is given: the cwd holds
     // the loaded skills, and the worn persona's kit is laid out as a second root (`local.dirs`); a skill the persona
     // withholds is refused at the read tool, the seam the Claude loop's `Skill(<name>)` denial is (cursor-skills.ts).
-    skillDiscovery: "native",
+    // The workspace's skills from the turn's own tree and the persona's kit as a projected root (cursor-skills.ts); the
+    // built-ins, outside every root it is given, are named in the note.
+    skillDiscovery: { workspace: true, builtIn: false, kit: true },
     // The full hook tier, the only foreign runtime to reach it: a hold parks since the vendor waits on the hook.
     rulebook: "hooks",
     // Every shell command runs through the hook script: a `{{secret:name}}` reference resolves into what the script runs once
@@ -421,6 +455,7 @@ export const CURSOR: AgentCapabilities = {
     // cannot place in a turn. A turn carrying a list does not start unless those hooks are installed, and a hook the
     // daemon cannot answer refuses a live turn's call.
     toolAllowlist: true,
+    editChecks: "turn-end",
 };
 
 // Muse Code, Meta's coding agent, driven over the Muse Session Protocol: one `muse serve` host per turn, born in the turn's
@@ -460,7 +495,7 @@ export const MUSE: AgentCapabilities = {
     instructions: "none",
     // Muse loads a trusted workspace's own skills from its own directories, which are not the daemon's; the daemon names
     // the loaded ones in the opener.
-    skillDiscovery: "prompt",
+    skillDiscovery: NO_SKILL_LOADER,
     // Muse's approval channel, answered from the rulebook; which commands Muse runs without asking (its own allow rules)
     // is its choice.
     rulebook: "approval",
@@ -469,4 +504,5 @@ export const MUSE: AgentCapabilities = {
     privacy: "none",
     // Edits and reads run without asking anyone, so no answer the daemon gives can keep a call off a list.
     toolAllowlist: false,
+    editChecks: "turn-end",
 };

package/src/models/agent-stack.test.ts

@@ -0,0 +1,86 @@
+import type { AgentStatus } from "../schemas/agents.js";
+import { attentionCalls, attentionCards } from "./agent-lanes.js";
+import { automationOf, stackHeads } from "./agent-stack.js";
+
+const none = { plan: false, question: false, permission: false, capability: false, credential: false, conflict: false };
+const LANDED: AgentStatus = `landed`;
+const ERROR: AgentStatus = `error`;
+
+type Over = { status?: AgentStatus; updatedAt?: number; startedAt?: number; startedBy?: string; failureCode?: string; attention?: typeof none };
+
+// One run of the automation `x-follow`, as the daemon now records it, settled at `updatedAt`.
+const run = (id: string, over: Over = {}) => ({
+    id,
+    status: LANDED,
+    attention: none,
+    updatedAt: 0,
+    origin: { automationId: `x-follow`, provider: `schedule` },
+    ...over,
+});
+const person = (id: string, over: Over = {}) => ({ id, status: LANDED, attention: none, updatedAt: 0, ...over });
+
+describe("automationOf", () => {
+    test("names the automation from the origin, else from the id the daemon minted the run under", () => {
+        expect(automationOf({ id: `anything`, origin: { automationId: `x-follow` } })).toBe(`x-follow`);
+        // Runs a schedule fired before origins were recorded: `a-<automation>-<base36 stamp>`.
+        expect(automationOf({ id: `a-x-follow-mvn5x1jtu` })).toBe(`x-follow`);
+        expect(automationOf({ id: `a-nightly-mvn5x1j16` })).toBe(`nightly`);
+    });
+
+    test("names none for a conversation a person started", () => {
+        expect(automationOf({ id: `witty-harbor-pknz` })).toBeUndefined();
+        expect(automationOf({ id: `home-1a2b3c4d5e6f7a8b` })).toBeUndefined();
+        expect(automationOf({ id: `a-` })).toBeUndefined();
+    });
+});
+
+describe("stackHeads", () => {
+    test("picks each automation's latest run, a running turn by its start so two at work never trade places", () => {
+        const heads = stackHeads(
+            [run(`r1`, { updatedAt: 100 }), run(`r2`, { updatedAt: 300 }), run(`r3`, { status: `running`, startedAt: 200, updatedAt: 900 })],
+            automationOf,
+        );
+        expect(heads.get(`x-follow`)?.id).toBe(`r2`);
+        const working = stackHeads([run(`old`, { status: `running`, startedAt: 100, updatedAt: 990 }), run(`new`, { status: `running`, startedAt: 200, updatedAt: 210 })], automationOf);
+        expect(working.get(`x-follow`)?.id).toBe(`new`);
+    });
+
+    test("keeps out whatever the key names no automation for", () => {
+        expect(stackHeads([person(`p`, { updatedAt: 5 })], automationOf).size).toBe(0);
+    });
+});
+
+// The rail badge counts an automation's runs as the board draws them: one card, its latest run's.
+describe("attentionCards over an automation's runs", () => {
+    const failed = { status: ERROR };
+
+    test("counts nothing for earlier failures a later run has moved past", () => {
+        const fleet = [run(`r1`, { ...failed, updatedAt: 100 }), run(`r2`, { ...failed, updatedAt: 200 }), run(`r3`, { updatedAt: 300 })];
+        expect(attentionCards(fleet)).toBe(0);
+    });
+
+    test("counts the stack once when its latest run failed, however many before it did", () => {
+        const fleet = [run(`r1`, { ...failed, updatedAt: 100 }), run(`r2`, { ...failed, updatedAt: 200 }), run(`r3`, { ...failed, updatedAt: 300 })];
+        expect(attentionCards(fleet)).toBe(1);
+        expect(attentionCalls(fleet).map((call) => call.card)).toEqual([`r3`]);
+    });
+
+    test("counts an earlier run asking what only the reader can give, through the stack's card", () => {
+        const fleet = [run(`r1`, { status: `awaiting`, attention: { ...none, credential: true }, updatedAt: 100 }), run(`r2`, { updatedAt: 300 })];
+        expect(attentionCalls(fleet)).toEqual([{ id: `r1`, card: `r2` }]);
+    });
+
+    test("keeps a person's own work out of any stack", () => {
+        const fleet = [run(`r1`, { updatedAt: 300 }), person(`mine`, { ...failed, updatedAt: 100 })];
+        expect(attentionCalls(fleet)).toEqual([{ id: `mine`, card: `mine` }]);
+    });
+
+    test("lets a run's own child ride its parent run, and so the stack", () => {
+        const fleet = [
+            run(`r1`, { updatedAt: 100 }),
+            run(`r2`, { updatedAt: 300 }),
+            person(`helper`, { startedBy: `agent:r1`, status: `awaiting`, attention: { ...none, permission: true }, updatedAt: 150 }),
+        ];
+        expect(attentionCalls(fleet)).toEqual([{ id: `helper`, card: `r2` }]);
+    });
+});

package/src/models/agent-stack.ts

@@ -0,0 +1,48 @@
+// ONE AUTOMATION, ONE CARD. Every fire of an automation that starts an agent opens a conversation of its own, so an
+// automation on a ten-minute clock fills the board with a card per run, each named afresh by the naming pass, until a
+// person's own work is lost among a hundred cards telling one story. So the runs of one automation ride under one card,
+// as a spawned child rides under its parent (agent-lanes.ts attentionCalls, and the editor's childFold.ts, which draws
+// it): the card of its latest run, with the earlier runs as rows in its tray. Which card that is, and which runs ride
+// it, is decided here once, so the board and the daemon's count of what needs the person (`agents.attention`) agree.
+
+// Enough of a conversation to say which automation's run it is and when it last moved; a FleetAgent, a roster
+// AgentSummary and a test literal all fit.
+export interface StackMember {
+    readonly id: string;
+    readonly origin?: { readonly automationId: string } | undefined;
+    readonly startedAt?: number | undefined;
+    readonly updatedAt: number;
+}
+
+// How the daemon names a conversation an automation minted (automations/fire/fire-sessions.ts mintConversationId): `a-`,
+// the automation's id cut to 40 characters, `-`, then a base36 stamp with no `-` in it. Read only for a run with no
+// origin, which is every run a schedule fired before the daemon recorded one, so the board stacks those too.
+const MINTED = /^a-(.+)-[0-9a-z]+$/;
+
+// The automation whose run this conversation is, or undefined for one a person or another agent started.
+export const automationOf = (agent: Pick<StackMember, "id" | "origin">): string | undefined =>
+    agent.origin?.automationId ?? MINTED.exec(agent.id)?.[1];
+
+// When a run last moved, as a stack orders its runs: a running turn's start, which holds still for the turn's life so
+// two runs at work at once never trade places on every tick, else its last move.
+export const movedAt = (run: Pick<StackMember, "startedAt" | "updatedAt">): number => run.startedAt ?? run.updatedAt;
+
+// Whether `a` is the later of two runs; the id breaks a tie, so every surface picks the same one.
+const later = (a: StackMember, b: StackMember): boolean => movedAt(a) > movedAt(b) || (movedAt(a) === movedAt(b) && a.id > b.id);
+
+// The latest run of each automation among `agents`, by the key `stackOf` gives it (the automation, and on a board that
+// holds several sandboxes' cards, the sandbox too); undefined skips a conversation that is no automation's run.
+export const stackHeads = <T extends StackMember>(agents: Iterable<T>, stackOf: (agent: T) => string | undefined): ReadonlyMap<string, T> => {
+    const heads = new Map<string, T>();
+    for (const agent of agents) {
+        const key = stackOf(agent);
+        if (key === undefined) {
+            continue;
+        }
+        const head = heads.get(key);
+        if (head === undefined || later(agent, head)) {
+            heads.set(key, agent);
+        }
+    }
+    return heads;
+};

package/src/models/capability-ledger.test.ts

@@ -23,7 +23,7 @@ const LEDGER: Record<keyof AgentCapabilities, Backing> = {
     isolation: "enforced",
     // system-prompt.ts composes standing instructions against this: replace, append, or a user-message note.
     instructions: "enforced",
-    // turn-plan.ts notes the catalogue only for "prompt"; "native" runtimes use their own loader instead.
+    // agent/run/decide/turn-skills.ts names in the opening note only the skills whose origin the loader does not read.
     skillDiscovery: "enforced",
     // turn-plan.ts plans jsExecution only where "js" is declared; without it no Code tool is mounted.
     execution: "enforced",
@@ -41,6 +41,9 @@ const LEDGER: Record<keyof AgentCapabilities, Backing> = {
     // automation ladder passes such rungs over, and agent/tools/tool-allowlist.ts refuses every off-list call on the
     // Claude Code loop.
     toolAllowlist: "enforced",
+    // runtimes/decorators/ending-checks.ts reads a "turn-end" loop's edited files as its turn ends and says the
+    // owner's per-edit checks back with the repositories' turn checks; an "after-edit" loop's own hook said them.
+    editChecks: "enforced",
 
     // Descriptive: true of the runtime but nothing consults these; wiring one up moves it to enforced.
     questions: "descriptive",

package/src/models/module-of.ts

@@ -0,0 +1,20 @@
+import type { WorkspaceModule } from "../schemas/git/git.js";
+
+// Which package a repository-relative path lives in, the one rule every reader buckets files by: the review panels
+// group a change list with it, and the sandbox names the packages a conversation's work falls in for its card, so the
+// two can never put one file in different packages.
+
+// Longest matching module dir wins, so a nested package claims its own files before its parent.
+// dir "" claims what nothing deeper claims; the trailing separator keeps `_apps/webx` from matching `_editor/web`.
+export const moduleOf = (path: string, modules: readonly WorkspaceModule[]): WorkspaceModule | undefined => {
+    let best: WorkspaceModule | undefined;
+    for (const candidate of modules) {
+        if (candidate.dir !== `` && !path.startsWith(`${candidate.dir}/`)) {
+            continue;
+        }
+        if (best === undefined || candidate.dir.length > best.dir.length) {
+            best = candidate;
+        }
+    }
+    return best;
+};

package/src/models/provider-specs.test.ts

@@ -155,9 +155,13 @@ test("cursor holds every mode, a tool list, the terminal panel and its own skill
     const cursor = capabilitiesOf("cursor", "native");
     expect(cursor.permissions).toBe("modes");
     expect(cursor.terminals).toBe(true);
-    expect(cursor.skillDiscovery).toBe("native");
+    expect(cursor.skillDiscovery).toEqual({ workspace: true, builtIn: false, kit: true });
     expect(cursor.toolAllowlist).toBe(true);
-    expect(limitationsOf(cursor)).toEqual(["no plugins", "secrets masked in shell output only, not in files the agent reads"]);
+    expect(limitationsOf(cursor)).toEqual([
+        "no plugins",
+        "secrets masked in shell output only, not in files the agent reads",
+        "edit checks said as the turn ends, not after each edit",
+    ]);
 });
 
 // Devin runs the ACP floor under its own name: what the floor gained (approvals, questions) it has too, and the effort

package/src/models/provider-specs.ts

@@ -421,6 +421,13 @@ export const MINTED_PROVIDERS: readonly MintedProvider[] = PROVIDER_SPECS.filter
     (spec): spec is Extract<Spec, { auth: { kind: "minted" } }> => spec.auth.kind === "minted",
 ).map((spec) => spec.id);
 
+// OpenCode's id for Gemini through the translator; not "google", OpenCode's own API-key provider, which bypasses the fleet.
+export const OPENCODE_GEMINI_PROVIDER = "intentic-gemini";
+
+// The provider an id names everywhere outside OpenCode's own config. A model running there sees the alias above as its
+// provider and repeats it when it names one (a subagent's spawn or move), so the doors that take such a name read it here.
+export const canonicalProvider = (provider: string): string => (provider === OPENCODE_GEMINI_PROVIDER ? "gemini" : provider);
+
 // This provider's CLIProxyAPI id, where it has one; not always ours (grok/xai, gemini/antigravity).
 export const cliProxyIdOf = (provider: string): string | undefined => {
     const auth = providerSpec(provider)?.auth;

package/src/policy/persona-capability.ts

@@ -18,8 +18,13 @@ export interface PersonaShelves {
     readonly mcp?: readonly string[] | undefined;
 }
 
-/** The kinds that are someone signed in: a site account, and the identity whose browser holds every account born of it. */
-export const isSignedInAccount = (kind: string): boolean => kind === "browser" || kind === "identity";
+/**
+ * The kinds that are someone signed in: a site account, the identity whose browser holds every account born of it, and
+ * the owner's own browser (its extension), which holds every session they have. The last one was missing until
+ * 2026-10-25, and it fell through to "passes untouched": an X-only persona's unattended run reached the owner's Brave,
+ * and an unpinned wake that lost every sandbox account kept it.
+ */
+export const isSignedInAccount = (kind: string): boolean => kind === "browser" || kind === "identity" || kind === "webext";
 
 const listed = (list: readonly string[] | undefined, id: string): boolean => list === undefined || list.includes(id);
 
@@ -31,9 +36,11 @@ const listed = (list: readonly string[] | undefined, id: string): boolean => lis
 export const personaAllowsCapability = (capability: CapabilityRef, accounts: readonly string[], shelves: PersonaShelves): boolean => {
     switch (capability.kind) {
         // The signed-in browsers: the persona's own `capabilities` list, and the field that predates the shelves. Granting
-        // an account (`reddit-work`) grants its hands; granting the identity itself grants the someone.
+        // an account (`reddit-work`) grants its hands; granting the identity itself grants the someone. The owner's own
+        // browser is named the same way: a persona reaches it only when its list says so.
         case "browser":
         case "identity":
+        case "webext":
             return accounts.includes(capability.id);
         // Connector credentials reach the shell; an ungranted id keeps its env vars out of the turn entirely.
         case "cli":

package/src/schemas/agents.ts

@@ -247,7 +247,7 @@ export const AgentSummarySchema = z.object({
         .string()
         .optional()
         .describe(
-            "One word for the kind of work the naming pass read in it (fix, audit, redesign). Never part of the displayed name: a board tints and glyphs a card by it. Absent for a title nothing named an action for.",
+            "One word for the kind of work the naming pass read in it (fix, audit, redesign). Never part of the displayed name. Absent for a title nothing named an action for.",
         ),
     status: AgentStatusSchema.describe(
         "What it is doing. Stopping and stopped are the two halves of somebody pressing stop, because a cancel is not instant; dismissing is the same window for a question waved away, which ends the turn too but owes the user nothing; resuming means the sandbox is already putting right whatever killed the turn; landing means its work is being carried into the workspace right now, and nothing may act on its branch until that settles.",
@@ -554,6 +554,13 @@ export const AgentSummarySchema = z.object({
         })
         .optional()
         .describe("Everything it has written, measured from where it started. Independent of how much has been merged."),
+    // Read off the same changes `diff` counts, so the two can't disagree.
+    modules: z
+        .array(z.string())
+        .optional()
+        .describe(
+            "The packages its changes fall in, most-changed first, at most three: each the folder name of the nearest manifest (package.json, Cargo.toml, pyproject.toml, go.mod) above a changed file, or the repository's name for a file outside every package. Absent until it has changed something.",
+        ),
     // How much of what this agent landed is still in the working tree, since a discard after landing is invisible to
     // commit-based readings; absent is the steady state and carries no line.
     landedPresence: z

package/src/schemas/automation-events.ts

@@ -0,0 +1,35 @@
+import { z } from "zod";
+
+// What the daemon emits as the fleet works, for a code chore to react to; no token or route, since only the daemon
+// reads these.
+// turn.settled: fires once per isolated turn regardless of outcome, while the diff is still on screen
+// agent.landed: fires only once work reaches the main tree, including a later manual Land
+// deps.broken/deps.fixed: retired with the check that ran after every land (2026-09-27). Nothing emits them any more;
+// they stay so an automation written for them still reads, and it never fires. Main's failing CI is the `ci` listener's.
+export const WorkspaceEventKindSchema = z.enum(["turn.settled", "agent.landed", "deps.broken", "deps.fixed"]);
+export type WorkspaceEventKind = z.infer<typeof WorkspaceEventKindSchema>;
+// Payload of a workspace-triggered wake, delivered as JSON in $AUTOMATION_PAYLOAD and appended to the prompt.
+// `repos[].from` is each repo's state before the turn; the span runs to the working tree, not a commit, so an errored
+// turn's uncommitted work still shows.
+export const WorkspaceEventSchema = z.object({
+    event: WorkspaceEventKindSchema,
+    agentId: z.string(),
+    title: z.string().optional(),
+    branch: z.string(),
+    // `ready` is a clean turn held on the branch (auto-land off): the moment right before a deliberate Land, when a
+    // pre-land review wants to run.
+    outcome: z.enum(["landed", "conflict", "ready", "idle", "error"]),
+    repos: z.array(z.object({ repo: z.string(), from: z.string(), dir: z.string() })),
+    // Present only for `deps.*` events: which project broke, the command and exit code, a bounded log tail, and
+    // `attempt` counting consecutive failures since the last pass.
+    deps: z
+        .object({
+            project: z.string(),
+            command: z.string(),
+            exitCode: z.number(),
+            attempt: z.number(),
+            logTail: z.string(),
+        })
+        .optional(),
+});
+export type WorkspaceEvent = z.infer<typeof WorkspaceEventSchema>;

package/src/schemas/automations.ts

@@ -4,6 +4,8 @@ import { AgentOriginSchema, ModelPinSchema } from "./agent.js";
 import { entryId } from "./internal.js";
 import { IssuesConfigSchema } from "./issues.js";
 import { ZoneSchema } from "../time/zone.js";
+import { WorkspaceEventKindSchema } from "./automation-events.js";
+export { WorkspaceEventKindSchema, WorkspaceEventSchema, type WorkspaceEventKind, type WorkspaceEvent } from "./automation-events.js";
 // An automation wakes the agent: the daemon fires each enabled one on its trigger, runs the optional guard command
 // (non-zero exit skips the wake), then runs one turn with the prompt. The manifest is user config; run history is
 // daemon-recorded.
@@ -23,39 +25,6 @@ import { ZoneSchema } from "../time/zone.js";
 // pushes one branch per agent
 // workspace: fires from the sandbox's own codebase (WorkspaceEventKindSchema)
 
-// What the daemon emits as the fleet works, for a code chore to react to; no token or route, since only the daemon
-// reads these.
-// turn.settled: fires once per isolated turn regardless of outcome, while the diff is still on screen
-// agent.landed: fires only once work reaches the main tree, including a later manual Land
-// deps.broken/deps.fixed: retired with the check that ran after every land (2026-09-27). Nothing emits them any more;
-// they stay so an automation written for them still reads, and it never fires. Main's failing CI is the `ci` listener's.
-export const WorkspaceEventKindSchema = z.enum(["turn.settled", "agent.landed", "deps.broken", "deps.fixed"]);
-export type WorkspaceEventKind = z.infer<typeof WorkspaceEventKindSchema>;
-// Payload of a workspace-triggered wake, delivered as JSON in $AUTOMATION_PAYLOAD and appended to the prompt.
-// `repos[].from` is each repo's state before the turn; the span runs to the working tree, not a commit, so an errored
-// turn's uncommitted work still shows.
-export const WorkspaceEventSchema = z.object({
-    event: WorkspaceEventKindSchema,
-    agentId: z.string(),
-    title: z.string().optional(),
-    branch: z.string(),
-    // `ready` is a clean turn held on the branch (auto-land off): the moment right before a deliberate Land, when a
-    // pre-land review wants to run.
-    outcome: z.enum(["landed", "conflict", "ready", "idle", "error"]),
-    repos: z.array(z.object({ repo: z.string(), from: z.string(), dir: z.string() })),
-    // Present only for `deps.*` events: which project broke, the command and exit code, a bounded log tail, and
-    // `attempt` counting consecutive failures since the last pass.
-    deps: z
-        .object({
-            project: z.string(),
-            command: z.string(),
-            exitCode: z.number(),
-            attempt: z.number(),
-            logTail: z.string(),
-        })
-        .optional(),
-});
-export type WorkspaceEvent = z.infer<typeof WorkspaceEventSchema>;
 export const TriggerSchema = z.discriminatedUnion("kind", [
     z.object({
         kind: z.literal("schedule").describe("On a clock."),
@@ -446,6 +415,16 @@ export const AutomationSchema = z.object({
         .boolean()
         .optional()
         .describe("This automation is a maintenance job, which is what files it under chores rather than among ordinary automations."),
+    // Pure filing, like `chore`: the daemon never reads it. Absent, the panel files it by its persona instead, so a set
+    // of jobs one role runs reads as one shelf without anybody naming it.
+    group: z
+        .string()
+        .min(1)
+        .max(40)
+        .optional()
+        .describe(
+            "Which shelf of the Automations panel it is filed on, like 'Marketing' or 'Releases'. Automations naming the same group are listed together. Absent files it under its persona, or with the code chores.",
+        ),
     enabled: z.boolean().describe("Whether it fires at all."),
 });
 export type Automation = z.infer<typeof AutomationSchema>;

package/src/schemas/device-commands.ts

@@ -1,21 +1,9 @@
 import { z } from "zod";
 
-// Closed set of command names; the daemon builds argv from the name alone (hosts/device-commands.ts). Never a free-text
-// command: the same socket carries `run_command`, which would grant a shell on the user's machine.
-// `sync-unpair` runs the machine's own `sync uninstall --sandbox` (terminates both Mutagen sessions, drops the pairing,
-// self-revokes enrollment); revoking from the sandbox side is a different route.
-// `dev-restart`, `dev-rebuild` and `sync-install` are the three whose argv the daemon fills from what only it knows — the
-// dev checkout on that machine, a freshly minted pairing token — which is also why none takes a path or a token from the
-// caller. The two dev commands are also why a machine-side op is the wrong shape for them: this door carries a COMMAND
-// STRING to a tool every released agent already has, so a sandbox can drive a machine whose agent predates the feature.
-// `dev-rebuild-log` is the read side of `dev-rebuild`: the build is detached out there, so its log is the only place its
-// progress exists, and polling this is what turns a fired-and-forgotten command into something with a progress bar.
-// `sync-clean` removes the build output left in directories the sandbox has deleted, which is what stops those
-// deletions from ever landing. It deletes only content the session already ignores, so it is the one command here whose
-// worst outcome is a rebuild — which is why it is a button and not a turn.
-// `mirror-ignore`/`mirror-unignore` are `mirror-off`'s per-port form, and the reason they exist: a port number that is
-// permanently taken on one machine's localhost has no answer in an all-or-nothing switch, so the choice lives where the
-// conflict does — one port, one device, durable — instead of muting every port the pairing serves.
+// Closed names let the daemon build argv without granting arbitrary shell access; dev/sync commands never accept caller paths or tokens.
+// Use existing run_command for older-agent compatibility; poll dev-rebuild-log because rebuilds are detached.
+// sync-unpair terminates sessions/revokes enrollment; sync-clean removes ignored build residue only.
+// mirror-ignore/unignore persists per-device port choices without muting all mirrored ports.
 export const DeviceCommandSchema = z.enum([
     "mirror-off",
     "mirror-on",
@@ -55,7 +43,7 @@ export const DeviceLocalDirSchema = z
     .string()
     .min(1)
     .max(4096)
-    // The curly quotes as escapes: bun's transpiler rewrites a literal one in a regex to its escape and tsgo keeps it,
+    // The curly quotes as escapes: bun's transpiler rewrites a literal one in a regex to its escape and tsc keeps it,
     // so spelled literally the pattern reads differently from source and from dist, and contract.lock.json can match
     // only one of them.
     .regex(/^(?:~|\/|[A-Za-z]:[\\/])[^"'`$;|&\n\r\u201C\u201D\u201E\u2018\u2019\u201A\u201B]*$/);