@intentic/sandbox-contract 1.360.0 → 1.362.0

package/src/models/agent-lanes.ts

@@ -1,6 +1,7 @@
 import type { AgentAttention } from "../schemas/agents.js";
 import type { AutomationApproval } from "../schemas/automations.js";
 import { goesBySelf } from "../schemas/agent-next.js";
+import { automationOf, movedAt, type StackMember, stackHeads } from "./agent-stack.js";
 import { parentOf } from "./agent-starter.js";
 import { type AgentStanding, blocked, heardByParent, onlyOwnerCanAnswer, turnInFlight, turnWorking, watching } from "./agent-standing.js";
 
@@ -24,6 +25,15 @@ export const callsOwner = (
     onlyOwnerCanAnswer(child) ||
     (family.child === "attention" && (family.parent !== "active" || child.fresh !== undefined) && !heardByParent(child, family.parentAt));
 
+// Whether an automation's earlier run, riding the card of its latest (agent-stack.ts), calls the reader through that card.
+// Nothing supervises a run, so unlike a child's stop (callsOwner) its stop is nobody else's news: what only the reader can
+// give always calls, and any other stop calls until a later run of the same automation has moved since (`headAt`, its
+// movedAt), which is the automation's own account of whether the trouble still stands: a run that failed at 02:30 behind
+// one that went through at 02:40 is history in the tray, and one that failed behind a run failing the same way is news on
+// the card already.
+export const runCallsOwner = (run: AgentStanding & { readonly updatedAt: number }, stack: { readonly run: FleetLane; readonly headAt: number }): boolean =>
+    onlyOwnerCanAnswer(run) || (stack.run === "attention" && !heardByParent(run, stack.headAt));
+
 export type FleetLane = "attention" | "active" | "finished";
 
 // Nothing owed to the user. The one "no attention" block in the app: a client-only card has no daemon account of
@@ -80,18 +90,18 @@ export const laneOf = (agent: AgentStanding): FleetLane => {
 // How many cards the board's Attention lane draws for one fleet, as the board folds child agents under their parents
 // (models/fleet/board/childFold.ts): an agent in Attention is a card of its own, except a child agent whose parent is in the
 // fleet, which rides under its family's one card and lifts that card to Attention only when it calls the reader
-// (callsOwner). A family counts once however many of its children call, and not again when its own card is in
-// Attention already; a child with words left in its composer keeps a card of its own, as on the board. The rail
-// badge's count, for this sandbox's fleet and another's alike, so the badge cannot disagree with the lane it names.
+// (callsOwner). An automation's earlier runs ride the card of its latest the same way (agent-stack.ts, runCallsOwner). A
+// family counts once however many of its children call, and not again when its own card is in Attention already; a
+// child with words left in its composer keeps a card of its own, as on the board. The rail badge's count, for this
+// sandbox's fleet and another's alike, so the badge cannot disagree with the lane it names.
 export const attentionCards = (agents: readonly CallerStanding[]): number => new Set(attentionCalls(agents).map((call) => call.card)).size;
 
 // Enough of a fleet's agent to say whether it calls the reader, and through which card.
-export type CallerStanding = AgentStanding & {
-    readonly id: string;
-    readonly updatedAt: number;
-    readonly startedBy?: string | undefined;
-    readonly unsent?: boolean | undefined;
-};
+export type CallerStanding = AgentStanding &
+    StackMember & {
+        readonly startedBy?: string | undefined;
+        readonly unsent?: boolean | undefined;
+    };
 
 // Every agent calling the reader, each with the card it is drawn on: its own, or its family's where it rides one. The
 // count above is the cards; the browser tab's chime wants the callers, so a second child calling under a family already
@@ -103,12 +113,22 @@ export const attentionCalls = (agents: readonly CallerStanding[]): readonly { re
         const id = parentOf(agent.startedBy);
         return id === undefined ? undefined : byId.get(id);
     };
+    // A conversation another one started rides its parent, never a stack, whether or not that parent is in this fleet.
+    const runOf = (agent: Standing): string | undefined => (parentOf(agent.startedBy) === undefined ? automationOf(agent) : undefined);
+    const heads = stackHeads(agents, runOf);
+    // The latest run of this one's automation, whose card it rides; undefined for that latest run itself.
+    const headIn = (agent: Standing): Standing | undefined => {
+        const automation = runOf(agent);
+        const head = automation === undefined ? undefined : heads.get(automation);
+        return head === agent ? undefined : head;
+    };
+    const aboveIn = (agent: Standing): Standing | undefined => parentIn(agent) ?? headIn(agent);
     // The card a child rides under: its eldest ancestor in this fleet, walked with a guard against a record naming its
     // own descendant as its parent.
     const familyOf = (agent: Standing): string => {
         const seen = new Set([agent.id]);
         let top = agent;
-        for (let above = parentIn(top); above !== undefined && !seen.has(above.id); above = parentIn(top)) {
+        for (let above = aboveIn(top); above !== undefined && !seen.has(above.id); above = aboveIn(top)) {
             seen.add(above.id);
             top = above;
         }
@@ -117,13 +137,18 @@ export const attentionCalls = (agents: readonly CallerStanding[]): readonly { re
     const calls: { readonly id: string; readonly card: string }[] = [];
     for (const agent of agents) {
         const parent = parentIn(agent);
+        const above = parent ?? headIn(agent);
         // Words left in a child's composer give it a card of its own (childFold.standsAlone), except a fresh session's:
         // its composer is the person's anyway, and it rides its origin's card whatever it holds.
-        if (parent === undefined || (agent.unsent === true && agent.fresh === undefined)) {
+        if (above === undefined || (agent.unsent === true && agent.fresh === undefined)) {
             if (laneOf(agent) === "attention") {
                 calls.push({ id: agent.id, card: agent.id });
             }
-        } else if (callsOwner(agent, { child: laneOf(agent), parent: laneOf(parent), parentAt: parent.updatedAt })) {
+        } else if (
+            parent === undefined
+                ? runCallsOwner(agent, { run: laneOf(agent), headAt: movedAt(above) })
+                : callsOwner(agent, { child: laneOf(agent), parent: laneOf(parent), parentAt: parent.updatedAt })
+        ) {
             calls.push({ id: agent.id, card: familyOf(agent) });
         }
     }

package/src/models/agent-runtimes.ts

@@ -6,6 +6,16 @@
 // that grants it.
 export type ExecutionBackend = "shell" | "js";
 
+// Which origins of skills a runtime's loader reads by itself (AgentCapabilities.skillDiscovery).
+export interface SkillDiscovery {
+    readonly workspace: boolean;
+    readonly builtIn: boolean;
+    readonly kit: boolean;
+}
+
+const EVERY_SKILL: SkillDiscovery = { workspace: true, builtIn: true, kit: true };
+const NO_SKILL_LOADER: SkillDiscovery = { workspace: false, builtIn: false, kit: false };
+
 export interface AgentCapabilities {
     // Which loop serves the turn; `opencode-gemini` stays separate since adapter health keys off this field.
     readonly runtime: "claude-code" | "codex" | "opencode" | "opencode-gemini" | "acp" | "devin" | "kimi-cli" | "grok-build" | "pi" | "cursor" | "muse";
@@ -41,8 +51,12 @@ export interface AgentCapabilities {
     readonly warm: boolean;
     // How much of the owner's instructions this runtime takes: replace the base, append to it, or no seam at all.
     readonly instructions: "replace" | "append" | "none";
-    // How the runtime discovers loaded skills: scans its own filesystem, or the daemon names them in the opener.
-    readonly skillDiscovery: "native" | "prompt";
+    // Which of a turn's skills the runtime's own loader finds; the rest are named, with their paths, in the note a fresh
+    // session opens with (the sandbox's agent/run/decide/turn-skills.ts), less the ones the turn may not use:
+    // workspace - the workspace's loaded skills (.agents/skills, or the .claude/skills projection of them);
+    // builtIn - the product's own skills the image bakes (/root/.claude/skills);
+    // kit - the worn persona's own skills, which the daemon hands the loader per turn.
+    readonly skillDiscovery: SkillDiscovery;
     // Whether the owner's safety policy reaches this runtime, and how:
     // hooks - its own pre-execution hook can park a call and wait for a card (Claude Code only).
     // approval - a vendor approval channel the daemon answers from policy; the vendor picks which calls to raise.
@@ -69,6 +83,12 @@ export interface AgentCapabilities {
     // every tool call the loop makes passes a check the daemon answers, or the loop is built with only the listed tools.
     // A runtime that runs some tool without asking anyone cannot keep it, so a turn carrying a list never starts on one.
     readonly toolAllowlist: boolean;
+    // When the owner's per-edit checks (the `file.edited` rules, the byte scan) reach the model: `after-edit` where the
+    // loop's own hook answers each edit or write as it lands (Claude Code's PostToolUse, Codex's and Pi's gate), so the
+    // model reads them beside the call; `turn-end` where nothing stands after a call, so the daemon reads the files the
+    // turn's edit calls touched as it ends and says the findings back as one more prompt, beside the repositories' turn
+    // checks (runtimes/decorators/ending-checks.ts).
+    readonly editChecks: "after-edit" | "turn-end";
 }
 
 // The Claude Code Agent SDK loop, the ceiling every other runtime is measured against: the only one that owns the whole
@@ -89,7 +109,7 @@ export const CLAUDE_CODE: AgentCapabilities = {
     recovery: true,
     warm: true,
     instructions: "replace",
-    skillDiscovery: "native",
+    skillDiscovery: EVERY_SKILL,
     // The only runtime with its own pre-execution hook, so the only one where a hold can park instead of refusing.
     rulebook: "hooks",
     secrets: "masked",
@@ -98,6 +118,7 @@ export const CLAUDE_CODE: AgentCapabilities = {
     // A PreToolUse hook refuses every call off the list, under bypassPermissions and in subagents too
     // (agent/tools/tool-allowlist.ts).
     toolAllowlist: true,
+    editChecks: "after-edit",
 };
 
 // Codex app-server: item-level events, the turn's remote MCP servers and the daemon's own over http, per-thread hooks
@@ -131,7 +152,8 @@ export const CODEX: AgentCapabilities = {
     // thread/start's own fields: baseInstructions replaces Codex's base prompt, developerInstructions adds a developer
     // message.
     instructions: "replace",
-    skillDiscovery: "native",
+    // Codex reads the workspace's `.agents/skills` itself; the built-ins and a persona's kit are named in the note.
+    skillDiscovery: { workspace: true, builtIn: false, kit: false },
     // A per-thread PreToolUse hook puts every function tool (the shell, apply_patch, every MCP tool, spawn_agent) to the
     // door's gate before it runs, which may park it on a card (codex-hooks.ts). Codex fails a hook open, so the gate is
     // confirmed connected before the turn starts, a command or patch Codex asks approval for runs only if the gate
@@ -139,7 +161,7 @@ export const CODEX: AgentCapabilities = {
     // connect the gate, so there the rules reach only the commands and patches Codex asks about.
     rulebook: "hooks",
     // Shell commands resolve `{{secret:…}}` in the gate's rewrite and run under a wrapper that masks stored values in
-    // their output (codex-mask-script.ts); apply_patch, view_image and hosted tools pass no wrapper.
+    // their output (mask-script.ts); apply_patch, view_image and hosted tools pass no wrapper.
     secrets: "shell",
     // Its model provider's base_url is the daemon's, written into the per-thread config.
     privacy: "gateway",
@@ -148,6 +170,7 @@ export const CODEX: AgentCapabilities = {
     // too unless listed, and each MCP server is cut to its listed tools (`enabled_tools`). The residual: a known-safe
     // read-only command off the list runs if the in-process gate fails after it connected, and the turn is then stopped.
     toolAllowlist: true,
+    editChecks: "after-edit",
 };
 
 // OpenCode (the Grok runtime): its own agentic loop and tools, with the turn's remote MCP servers mounted on the shared
@@ -196,7 +219,9 @@ export const OPENCODE: AgentCapabilities = {
     // A prompt that replaces the base (the owner's own under `custom`, a small window's paragraph) runs on the daemon's
     // twin agents, whose base is blank, so it is the whole system text; anything else is added to OpenCode's own base.
     instructions: "replace",
-    skillDiscovery: "prompt",
+    // The server's skill roots are the workspace's loaded skills and the built-ins (opencode.ts serverConfig); a persona's
+    // kit, which changes per turn on a server shared by every turn, is named in the note.
+    skillDiscovery: { workspace: true, builtIn: true, kit: false },
     // OpenCode raises its permission asks for every shell command, a subagent's included (the server's own rules ask about
     // them all, and a child session inherits them); the daemon answers from the rulebook, a hold parked on a card while
     // the turn's inactivity watchdog is held. The JS backend consults the same gate. Not `hooks`: which calls ask is still
@@ -213,6 +238,7 @@ export const OPENCODE: AgentCapabilities = {
     // session inherits them. Every built-in tool has its own permission action (checked against 2.0.26), and a shell entry
     // narrowed to a command is checked against each command's ask (runtimes/opencode/allowlist/opencode-allowlist.ts).
     toolAllowlist: true,
+    editChecks: "turn-end",
 };
 
 // The same OpenCode loop, serving Gemini instead of xAI, identical abilities. The Claude Code loop announces itself in
@@ -252,13 +278,14 @@ export const ACP: AgentCapabilities = {
     isolation: "cwd",
     commands: true,
     terminals: true,
-    // A failure the agent words as a spent allowance or an outgrown window is coded (error-frames.ts codedFailure), but the
-    // words are each agent's own and the protocol marks no outage, so nothing promises the codes auto-resume keys off.
-    recovery: false,
+    // A failure the agent words as a spent allowance or an outgrown window is coded at the turn's one exit
+    // (error-frames.ts codedFailure), and an agent gone silent mid-turn is coded an outage by the shared watchdog
+    // (turn-watchdog.ts expiredFrame), so a turn the provider dropped is re-run once it is back, as every loop's is.
+    recovery: true,
     warm: false,
     // ACP's calls carry no system field: the agent owns its instructions, the persona note rides the message.
     instructions: "none",
-    skillDiscovery: "prompt",
+    skillDiscovery: NO_SKILL_LOADER,
     // In the protocol floor, so every agent has it; which calls it asks about is entirely its own choice. A terminal the
     // daemon runs for it (terminal/create) is asked about here too, unless the permission for it already was.
     rulebook: "approval",
@@ -267,6 +294,7 @@ export const ACP: AgentCapabilities = {
     privacy: "none",
     // Which calls the agent asks permission for is its own choice, and most run reads without asking.
     toolAllowlist: false,
+    editChecks: "turn-end",
 };
 
 // Devin's own CLI (`devin acp`), the ACP floor with one seam an installed agent lacks: the daemon picks the model, from
@@ -339,7 +367,8 @@ export const PI: AgentCapabilities = {
     // keeps Pi from loading AGENTS.md a second time beside the daemon's own note.
     instructions: "replace",
     // `--skill` per loaded skill, the persona's filter applied, with Pi's own discovery off (`--no-skills`).
-    skillDiscovery: "native",
+    // Pi's own discovery is off, and every skill the turn may use is handed to it by path (`--skill`, pi-adapter.ts).
+    skillDiscovery: EVERY_SKILL,
     // The daemon's extension, loaded with `-e` ahead of any other and whatever the card's command says of discovery, puts
     // every tool call (MCP and codemode calls included) to the turn's own hook socket before it runs, where a held one
     // parks on a card while Pi waits (pi-hooks.ts). A call it cannot ask about is refused, as a handler that throws is,
@@ -356,6 +385,7 @@ export const PI: AgentCapabilities = {
     // The same socket refuses every call off the turn's list, Pi's tools read under the Claude loop's names (bash as
     // Bash, find as Glob) and MCP tools under the same `mcp__<server>__<tool>`; fail closed as above.
     toolAllowlist: true,
+    editChecks: "after-edit",
 };
 
 // Cursor's own runtime, driven through `@cursor/sdk` from this daemon's process; an embedding surface, so most seams
@@ -372,7 +402,9 @@ export const CURSOR: AgentCapabilities = {
     permissions: "modes",
     // True since the daemon supplies its own ask tool; Cursor's own can fabricate an answer, so it's disallowed.
     questions: true,
-    // The turn's remote MCP servers plus host callbacks; everything but a Claude Code plugin checkout.
+    // The turn's remote MCP servers, the daemon's own door servers among them (accounts, secrets, watch, deps,
+    // diagnostics), plus host callbacks for the three it runs in the daemon's process instead (ask, code, the subagent
+    // tools: cursor-tools.ts); everything but a Claude Code plugin checkout.
     mcp: "tools",
     // The JS backend rides Cursor's custom-tool seam rather than an MCP server, and consults the rulebook in its
     // handler, since the hook file only covers the shell.
@@ -401,7 +433,9 @@ export const CURSOR: AgentCapabilities = {
     // Cursor's own loader reads every SKILL.md under `.agents/skills/` of each workspace root it is given: the cwd holds
     // the loaded skills, and the worn persona's kit is laid out as a second root (`local.dirs`); a skill the persona
     // withholds is refused at the read tool, the seam the Claude loop's `Skill(<name>)` denial is (cursor-skills.ts).
-    skillDiscovery: "native",
+    // The workspace's skills from the turn's own tree and the persona's kit as a projected root (cursor-skills.ts); the
+    // built-ins, outside every root it is given, are named in the note.
+    skillDiscovery: { workspace: true, builtIn: false, kit: true },
     // The full hook tier, the only foreign runtime to reach it: a hold parks since the vendor waits on the hook.
     rulebook: "hooks",
     // Every shell command runs through the hook script: a `{{secret:name}}` reference resolves into what the script runs once
@@ -421,6 +455,7 @@ export const CURSOR: AgentCapabilities = {
     // cannot place in a turn. A turn carrying a list does not start unless those hooks are installed, and a hook the
     // daemon cannot answer refuses a live turn's call.
     toolAllowlist: true,
+    editChecks: "turn-end",
 };
 
 // Muse Code, Meta's coding agent, driven over the Muse Session Protocol: one `muse serve` host per turn, born in the turn's
@@ -460,7 +495,7 @@ export const MUSE: AgentCapabilities = {
     instructions: "none",
     // Muse loads a trusted workspace's own skills from its own directories, which are not the daemon's; the daemon names
     // the loaded ones in the opener.
-    skillDiscovery: "prompt",
+    skillDiscovery: NO_SKILL_LOADER,
     // Muse's approval channel, answered from the rulebook; which commands Muse runs without asking (its own allow rules)
     // is its choice.
     rulebook: "approval",
@@ -469,4 +504,5 @@ export const MUSE: AgentCapabilities = {
     privacy: "none",
     // Edits and reads run without asking anyone, so no answer the daemon gives can keep a call off a list.
     toolAllowlist: false,
+    editChecks: "turn-end",
 };

package/src/models/agent-stack.test.ts

@@ -0,0 +1,86 @@
+import type { AgentStatus } from "../schemas/agents.js";
+import { attentionCalls, attentionCards } from "./agent-lanes.js";
+import { automationOf, stackHeads } from "./agent-stack.js";
+
+const none = { plan: false, question: false, permission: false, capability: false, credential: false, conflict: false };
+const LANDED: AgentStatus = `landed`;
+const ERROR: AgentStatus = `error`;
+
+type Over = { status?: AgentStatus; updatedAt?: number; startedAt?: number; startedBy?: string; failureCode?: string; attention?: typeof none };
+
+// One run of the automation `x-follow`, as the daemon now records it, settled at `updatedAt`.
+const run = (id: string, over: Over = {}) => ({
+    id,
+    status: LANDED,
+    attention: none,
+    updatedAt: 0,
+    origin: { automationId: `x-follow`, provider: `schedule` },
+    ...over,
+});
+const person = (id: string, over: Over = {}) => ({ id, status: LANDED, attention: none, updatedAt: 0, ...over });
+
+describe("automationOf", () => {
+    test("names the automation from the origin, else from the id the daemon minted the run under", () => {
+        expect(automationOf({ id: `anything`, origin: { automationId: `x-follow` } })).toBe(`x-follow`);
+        // Runs a schedule fired before origins were recorded: `a-<automation>-<base36 stamp>`.
+        expect(automationOf({ id: `a-x-follow-mvn5x1jtu` })).toBe(`x-follow`);
+        expect(automationOf({ id: `a-nightly-mvn5x1j16` })).toBe(`nightly`);
+    });
+
+    test("names none for a conversation a person started", () => {
+        expect(automationOf({ id: `witty-harbor-pknz` })).toBeUndefined();
+        expect(automationOf({ id: `home-1a2b3c4d5e6f7a8b` })).toBeUndefined();
+        expect(automationOf({ id: `a-` })).toBeUndefined();
+    });
+});
+
+describe("stackHeads", () => {
+    test("picks each automation's latest run, a running turn by its start so two at work never trade places", () => {
+        const heads = stackHeads(
+            [run(`r1`, { updatedAt: 100 }), run(`r2`, { updatedAt: 300 }), run(`r3`, { status: `running`, startedAt: 200, updatedAt: 900 })],
+            automationOf,
+        );
+        expect(heads.get(`x-follow`)?.id).toBe(`r2`);
+        const working = stackHeads([run(`old`, { status: `running`, startedAt: 100, updatedAt: 990 }), run(`new`, { status: `running`, startedAt: 200, updatedAt: 210 })], automationOf);
+        expect(working.get(`x-follow`)?.id).toBe(`new`);
+    });
+
+    test("keeps out whatever the key names no automation for", () => {
+        expect(stackHeads([person(`p`, { updatedAt: 5 })], automationOf).size).toBe(0);
+    });
+});
+
+// The rail badge counts an automation's runs as the board draws them: one card, its latest run's.
+describe("attentionCards over an automation's runs", () => {
+    const failed = { status: ERROR };
+
+    test("counts nothing for earlier failures a later run has moved past", () => {
+        const fleet = [run(`r1`, { ...failed, updatedAt: 100 }), run(`r2`, { ...failed, updatedAt: 200 }), run(`r3`, { updatedAt: 300 })];
+        expect(attentionCards(fleet)).toBe(0);
+    });
+
+    test("counts the stack once when its latest run failed, however many before it did", () => {
+        const fleet = [run(`r1`, { ...failed, updatedAt: 100 }), run(`r2`, { ...failed, updatedAt: 200 }), run(`r3`, { ...failed, updatedAt: 300 })];
+        expect(attentionCards(fleet)).toBe(1);
+        expect(attentionCalls(fleet).map((call) => call.card)).toEqual([`r3`]);
+    });
+
+    test("counts an earlier run asking what only the reader can give, through the stack's card", () => {
+        const fleet = [run(`r1`, { status: `awaiting`, attention: { ...none, credential: true }, updatedAt: 100 }), run(`r2`, { updatedAt: 300 })];
+        expect(attentionCalls(fleet)).toEqual([{ id: `r1`, card: `r2` }]);
+    });
+
+    test("keeps a person's own work out of any stack", () => {
+        const fleet = [run(`r1`, { updatedAt: 300 }), person(`mine`, { ...failed, updatedAt: 100 })];
+        expect(attentionCalls(fleet)).toEqual([{ id: `mine`, card: `mine` }]);
+    });
+
+    test("lets a run's own child ride its parent run, and so the stack", () => {
+        const fleet = [
+            run(`r1`, { updatedAt: 100 }),
+            run(`r2`, { updatedAt: 300 }),
+            person(`helper`, { startedBy: `agent:r1`, status: `awaiting`, attention: { ...none, permission: true }, updatedAt: 150 }),
+        ];
+        expect(attentionCalls(fleet)).toEqual([{ id: `helper`, card: `r2` }]);
+    });
+});

package/src/models/agent-stack.ts

@@ -0,0 +1,48 @@
+// ONE AUTOMATION, ONE CARD. Every fire of an automation that starts an agent opens a conversation of its own, so an
+// automation on a ten-minute clock fills the board with a card per run, each named afresh by the naming pass, until a
+// person's own work is lost among a hundred cards telling one story. So the runs of one automation ride under one card,
+// as a spawned child rides under its parent (agent-lanes.ts attentionCalls, and the editor's childFold.ts, which draws
+// it): the card of its latest run, with the earlier runs as rows in its tray. Which card that is, and which runs ride
+// it, is decided here once, so the board and the daemon's count of what needs the person (`agents.attention`) agree.
+
+// Enough of a conversation to say which automation's run it is and when it last moved; a FleetAgent, a roster
+// AgentSummary and a test literal all fit.
+export interface StackMember {
+    readonly id: string;
+    readonly origin?: { readonly automationId: string } | undefined;
+    readonly startedAt?: number | undefined;
+    readonly updatedAt: number;
+}
+
+// How the daemon names a conversation an automation minted (automations/fire/fire-sessions.ts mintConversationId): `a-`,
+// the automation's id cut to 40 characters, `-`, then a base36 stamp with no `-` in it. Read only for a run with no
+// origin, which is every run a schedule fired before the daemon recorded one, so the board stacks those too.
+const MINTED = /^a-(.+)-[0-9a-z]+$/;
+
+// The automation whose run this conversation is, or undefined for one a person or another agent started.
+export const automationOf = (agent: Pick<StackMember, "id" | "origin">): string | undefined =>
+    agent.origin?.automationId ?? MINTED.exec(agent.id)?.[1];
+
+// When a run last moved, as a stack orders its runs: a running turn's start, which holds still for the turn's life so
+// two runs at work at once never trade places on every tick, else its last move.
+export const movedAt = (run: Pick<StackMember, "startedAt" | "updatedAt">): number => run.startedAt ?? run.updatedAt;
+
+// Whether `a` is the later of two runs; the id breaks a tie, so every surface picks the same one.
+const later = (a: StackMember, b: StackMember): boolean => movedAt(a) > movedAt(b) || (movedAt(a) === movedAt(b) && a.id > b.id);
+
+// The latest run of each automation among `agents`, by the key `stackOf` gives it (the automation, and on a board that
+// holds several sandboxes' cards, the sandbox too); undefined skips a conversation that is no automation's run.
+export const stackHeads = <T extends StackMember>(agents: Iterable<T>, stackOf: (agent: T) => string | undefined): ReadonlyMap<string, T> => {
+    const heads = new Map<string, T>();
+    for (const agent of agents) {
+        const key = stackOf(agent);
+        if (key === undefined) {
+            continue;
+        }
+        const head = heads.get(key);
+        if (head === undefined || later(agent, head)) {
+            heads.set(key, agent);
+        }
+    }
+    return heads;
+};

package/src/models/capability-ledger.test.ts

@@ -23,7 +23,7 @@ const LEDGER: Record<keyof AgentCapabilities, Backing> = {
     isolation: "enforced",
     // system-prompt.ts composes standing instructions against this: replace, append, or a user-message note.
     instructions: "enforced",
-    // turn-plan.ts notes the catalogue only for "prompt"; "native" runtimes use their own loader instead.
+    // agent/run/decide/turn-skills.ts names in the opening note only the skills whose origin the loader does not read.
     skillDiscovery: "enforced",
     // turn-plan.ts plans jsExecution only where "js" is declared; without it no Code tool is mounted.
     execution: "enforced",
@@ -41,6 +41,9 @@ const LEDGER: Record<keyof AgentCapabilities, Backing> = {
     // automation ladder passes such rungs over, and agent/tools/tool-allowlist.ts refuses every off-list call on the
     // Claude Code loop.
     toolAllowlist: "enforced",
+    // runtimes/decorators/ending-checks.ts reads a "turn-end" loop's edited files as its turn ends and says the
+    // owner's per-edit checks back with the repositories' turn checks; an "after-edit" loop's own hook said them.
+    editChecks: "enforced",
 
     // Descriptive: true of the runtime but nothing consults these; wiring one up moves it to enforced.
     questions: "descriptive",

package/src/models/module-of.ts

@@ -0,0 +1,20 @@
+import type { WorkspaceModule } from "../schemas/git/git.js";
+
+// Which package a repository-relative path lives in, the one rule every reader buckets files by: the review panels
+// group a change list with it, and the sandbox names the packages a conversation's work falls in for its card, so the
+// two can never put one file in different packages.
+
+// Longest matching module dir wins, so a nested package claims its own files before its parent.
+// dir "" claims what nothing deeper claims; the trailing separator keeps `_apps/webx` from matching `_editor/web`.
+export const moduleOf = (path: string, modules: readonly WorkspaceModule[]): WorkspaceModule | undefined => {
+    let best: WorkspaceModule | undefined;
+    for (const candidate of modules) {
+        if (candidate.dir !== `` && !path.startsWith(`${candidate.dir}/`)) {
+            continue;
+        }
+        if (best === undefined || candidate.dir.length > best.dir.length) {
+            best = candidate;
+        }
+    }
+    return best;
+};

package/src/models/provider-specs.test.ts

@@ -155,9 +155,13 @@ test("cursor holds every mode, a tool list, the terminal panel and its own skill
     const cursor = capabilitiesOf("cursor", "native");
     expect(cursor.permissions).toBe("modes");
     expect(cursor.terminals).toBe(true);
-    expect(cursor.skillDiscovery).toBe("native");
+    expect(cursor.skillDiscovery).toEqual({ workspace: true, builtIn: false, kit: true });
     expect(cursor.toolAllowlist).toBe(true);
-    expect(limitationsOf(cursor)).toEqual(["no plugins", "secrets masked in shell output only, not in files the agent reads"]);
+    expect(limitationsOf(cursor)).toEqual([
+        "no plugins",
+        "secrets masked in shell output only, not in files the agent reads",
+        "edit checks said as the turn ends, not after each edit",
+    ]);
 });
 
 // Devin runs the ACP floor under its own name: what the floor gained (approvals, questions) it has too, and the effort

package/src/models/provider-specs.ts

@@ -421,6 +421,13 @@ export const MINTED_PROVIDERS: readonly MintedProvider[] = PROVIDER_SPECS.filter
     (spec): spec is Extract<Spec, { auth: { kind: "minted" } }> => spec.auth.kind === "minted",
 ).map((spec) => spec.id);
 
+// OpenCode's id for Gemini through the translator; not "google", OpenCode's own API-key provider, which bypasses the fleet.
+export const OPENCODE_GEMINI_PROVIDER = "intentic-gemini";
+
+// The provider an id names everywhere outside OpenCode's own config. A model running there sees the alias above as its
+// provider and repeats it when it names one (a subagent's spawn or move), so the doors that take such a name read it here.
+export const canonicalProvider = (provider: string): string => (provider === OPENCODE_GEMINI_PROVIDER ? "gemini" : provider);
+
 // This provider's CLIProxyAPI id, where it has one; not always ours (grok/xai, gemini/antigravity).
 export const cliProxyIdOf = (provider: string): string | undefined => {
     const auth = providerSpec(provider)?.auth;

package/src/policy/persona-capability.ts

@@ -18,8 +18,13 @@ export interface PersonaShelves {
     readonly mcp?: readonly string[] | undefined;
 }
 
-/** The kinds that are someone signed in: a site account, and the identity whose browser holds every account born of it. */
-export const isSignedInAccount = (kind: string): boolean => kind === "browser" || kind === "identity";
+/**
+ * The kinds that are someone signed in: a site account, the identity whose browser holds every account born of it, and
+ * the owner's own browser (its extension), which holds every session they have. The last one was missing until
+ * 2026-10-25, and it fell through to "passes untouched": an X-only persona's unattended run reached the owner's Brave,
+ * and an unpinned wake that lost every sandbox account kept it.
+ */
+export const isSignedInAccount = (kind: string): boolean => kind === "browser" || kind === "identity" || kind === "webext";
 
 const listed = (list: readonly string[] | undefined, id: string): boolean => list === undefined || list.includes(id);
 
@@ -31,9 +36,11 @@ const listed = (list: readonly string[] | undefined, id: string): boolean => lis
 export const personaAllowsCapability = (capability: CapabilityRef, accounts: readonly string[], shelves: PersonaShelves): boolean => {
     switch (capability.kind) {
         // The signed-in browsers: the persona's own `capabilities` list, and the field that predates the shelves. Granting
-        // an account (`reddit-work`) grants its hands; granting the identity itself grants the someone.
+        // an account (`reddit-work`) grants its hands; granting the identity itself grants the someone. The owner's own
+        // browser is named the same way: a persona reaches it only when its list says so.
         case "browser":
         case "identity":
+        case "webext":
             return accounts.includes(capability.id);
         // Connector credentials reach the shell; an ungranted id keeps its env vars out of the turn entirely.
         case "cli":

package/src/schemas/agents.ts

@@ -247,7 +247,7 @@ export const AgentSummarySchema = z.object({
         .string()
         .optional()
         .describe(
-            "One word for the kind of work the naming pass read in it (fix, audit, redesign). Never part of the displayed name: a board tints and glyphs a card by it. Absent for a title nothing named an action for.",
+            "One word for the kind of work the naming pass read in it (fix, audit, redesign). Never part of the displayed name. Absent for a title nothing named an action for.",
         ),
     status: AgentStatusSchema.describe(
         "What it is doing. Stopping and stopped are the two halves of somebody pressing stop, because a cancel is not instant; dismissing is the same window for a question waved away, which ends the turn too but owes the user nothing; resuming means the sandbox is already putting right whatever killed the turn; landing means its work is being carried into the workspace right now, and nothing may act on its branch until that settles.",
@@ -554,6 +554,13 @@ export const AgentSummarySchema = z.object({
         })
         .optional()
         .describe("Everything it has written, measured from where it started. Independent of how much has been merged."),
+    // Read off the same changes `diff` counts, so the two can't disagree.
+    modules: z
+        .array(z.string())
+        .optional()
+        .describe(
+            "The packages its changes fall in, most-changed first, at most three: each the folder name of the nearest manifest (package.json, Cargo.toml, pyproject.toml, go.mod) above a changed file, or the repository's name for a file outside every package. Absent until it has changed something.",
+        ),
     // How much of what this agent landed is still in the working tree, since a discard after landing is invisible to
     // commit-based readings; absent is the steady state and carries no line.
     landedPresence: z

package/src/schemas/automation-events.ts

@@ -0,0 +1,35 @@
+import { z } from "zod";
+
+// What the daemon emits as the fleet works, for a code chore to react to; no token or route, since only the daemon
+// reads these.
+// turn.settled: fires once per isolated turn regardless of outcome, while the diff is still on screen
+// agent.landed: fires only once work reaches the main tree, including a later manual Land
+// deps.broken/deps.fixed: retired with the check that ran after every land (2026-09-27). Nothing emits them any more;
+// they stay so an automation written for them still reads, and it never fires. Main's failing CI is the `ci` listener's.
+export const WorkspaceEventKindSchema = z.enum(["turn.settled", "agent.landed", "deps.broken", "deps.fixed"]);
+export type WorkspaceEventKind = z.infer<typeof WorkspaceEventKindSchema>;
+// Payload of a workspace-triggered wake, delivered as JSON in $AUTOMATION_PAYLOAD and appended to the prompt.
+// `repos[].from` is each repo's state before the turn; the span runs to the working tree, not a commit, so an errored
+// turn's uncommitted work still shows.
+export const WorkspaceEventSchema = z.object({
+    event: WorkspaceEventKindSchema,
+    agentId: z.string(),
+    title: z.string().optional(),
+    branch: z.string(),
+    // `ready` is a clean turn held on the branch (auto-land off): the moment right before a deliberate Land, when a
+    // pre-land review wants to run.
+    outcome: z.enum(["landed", "conflict", "ready", "idle", "error"]),
+    repos: z.array(z.object({ repo: z.string(), from: z.string(), dir: z.string() })),
+    // Present only for `deps.*` events: which project broke, the command and exit code, a bounded log tail, and
+    // `attempt` counting consecutive failures since the last pass.
+    deps: z
+        .object({
+            project: z.string(),
+            command: z.string(),
+            exitCode: z.number(),
+            attempt: z.number(),
+            logTail: z.string(),
+        })
+        .optional(),
+});
+export type WorkspaceEvent = z.infer<typeof WorkspaceEventSchema>;