@intentius/chant-lexicon-fountain 0.89.0 → 0.91.0

package/dist/composites/box.d.ts

@@ -0,0 +1,166 @@
+/**
+ * Box — a persistent machine that serves an app repo and its tools (#2705).
+ *
+ * A box is an `Environment` whose `setup_script` provisions the machine (for
+ * an arugula studio box, the studio's `box/provision-template.sh`), an
+ * `Agent` on a persistent sandbox provisioned from it, and optionally a
+ * `Vault` for the secrets every box of this kind shares. `repo` is optional:
+ * when given, the Environment's `repositories` clones it in before setup
+ * runs; when omitted (#2759 — a blank-slate app, such as the one hud's
+ * `init` makes, has no git remote yet), the Environment holds no
+ * `repositories` at all and `setup_script` still runs, against whatever
+ * working tree is already on the sandbox (a self-hosted `runner`'s own).
+ *
+ * ```ts
+ * export const { environment, agent, vault } = Box({
+ *   name: "studio-box",
+ *   repo: { url: "https://github.com/arugula-salad/studio", ref: "main" },
+ *   setupScript: readFileSync("box/provision-template.sh", "utf8"),
+ *   permissionPolicy: { default: "auto_allow" },
+ *   allowedHosts: ["registry.npmjs.org", "github.com"],
+ *   vault: { secrets: [{ key: "STUDIO_SECRET", value: "${STUDIO_SECRET}" }] },
+ * });
+ * ```
+ *
+ * Beside `Steward`: a steward is an environment's one writer, an `acp` agent
+ * whose every turn is a chant command line, bound to a teammate with a
+ * standing thread and schedules. A box is where people and their agents work
+ * on an app: a conversational runtime (`claude` by default), the app repo
+ * cloned in (when there is one), the provisioning script run as setup, and
+ * one served port. It declares no teammate and no schedule, and nothing here
+ * starts a conversation. Starting and reaping a box stays a runtime act, as
+ * it is in hud's box runtime.
+ *
+ * The defaults are the closed ones, as `ConciergeStack`'s are, and loosening
+ * one is a visible parameter: networking is `limited` with an empty allowlist
+ * until `allowedHosts` names hosts or `unrestrictedNetworking: true` opens it
+ * (which FTN011 then warns about); `allowed_vault_ids` holds the box's own
+ * vault, or nothing, until `allowedVaults` widens it; `sandbox_provider` is
+ * unset (the instance default) until `sandboxProvider` names one of the
+ * pinned spec's `sprites`, `e2b`, `daytona` or `runner`. `permission_policy`
+ * has no default at all, because fountain's unset policy is `auto_allow` and
+ * that should be a choice someone wrote down.
+ *
+ * ## Credentials
+ *
+ * A box holds no credential (#2726). What it reaches outside itself
+ * (inference, Fountain's own API) goes through a broker, such as a studio's
+ * lobby, that holds the key and enforces a scope. Those capabilities are
+ * declared in the workspace declaration's `box` block on the member that
+ * holds this composite, not here: `chant workspace check` and the read
+ * contract read the declaration without running this code. Here, a vault
+ * secret's value and an `envVars` value are references (`${VAR}`, `op://`,
+ * `bws://`, `infisical://`) that resolve at apply, never a literal, and never
+ * `process.env.X`, which writes the secret into the built manifest. `chant
+ * workspace check` fails a box member whose files hold one
+ * (`box-credential-declared`).
+ *
+ * ## The port
+ *
+ * fountain's `Environment` and `Agent` have no field for a served port (the
+ * pinned spec, v0.21.0). The port is recorded in the metadata of both, under
+ * `box-port`, and returned as `port`, so whatever builds the box's URL reads
+ * it from the declaration or from fountain's own record without a guess.
+ *
+ * ## Allowed vaults in the read contract
+ *
+ * `sandbox_provider` is a plain `Agent` field, so `chant workspace graph
+ * --json` (and `chant graph`) already carry it on the agent's node like any
+ * other declared attribute. `allowed_vault_ids` is not as plain to read:
+ * fountain's own convention (and this composite's, per `allowedVaults`
+ * above) is that an *unset* list means "any vault the tenant owns", so a
+ * graph reader can't tell "no vaults declared" from "any vault" just by the
+ * key's absence. #2759 — a runtime that creates a vault per box (hud's box
+ * runtime) needs to check that the declaration permits it — so the resolved
+ * list, or the literal string `"any"`, is also recorded in the agent's
+ * metadata under `box-allowed-vault-ids` (`BOX_ALLOWED_VAULTS_METADATA_KEY`).
+ * It is read-only bookkeeping, alongside `box-port`: the manifest's real
+ * `allowed_vault_ids` field is what fountain applies.
+ */
+import { Agent, Environment, Vault } from "../generated/index.js";
+/** The metadata key a box's served port is recorded under, on its Environment and Agent. */
+export declare const BOX_PORT_METADATA_KEY = "box-port";
+/** The metadata key a box agent's resolved allowed vaults (or `"any"`) are recorded under, for the read contract. */
+export declare const BOX_ALLOWED_VAULTS_METADATA_KEY = "box-allowed-vault-ids";
+/** `Agent.sandbox_provider`'s values at the pinned spec. */
+export declare const BOX_SANDBOX_PROVIDERS: readonly ["sprites", "e2b", "daytona", "runner"];
+/** A sandbox backend, per the pinned spec's `sandbox_provider` enum. */
+export type BoxSandboxProvider = (typeof BOX_SANDBOX_PROVIDERS)[number];
+/** The port a box serves when none is given: the door's. */
+export declare const BOX_DEFAULT_PORT = 8080;
+/** Where the app repo is cloned when no `mountPath` is given. */
+export declare const BOX_DEFAULT_MOUNT_PATH = "/workspace/app";
+/** A permission verdict, or a number of seconds under the `ask_timeout` key. */
+export type BoxPermissionPolicy = Record<string, "ask" | "auto_allow" | "auto_deny" | number>;
+/** The app repo the box serves. Shape of fountain's `Repository`. */
+export interface BoxRepositoryOpts {
+    /** https clone url. */
+    url: string;
+    /** Absolute path the repo is cloned to. Default `/workspace/app`. */
+    mountPath?: string;
+    /** Branch or tag. The default branch when omitted. */
+    ref?: string;
+    /** Name of the secret holding a clone token. Required for a private repo. */
+    secretKey?: string;
+}
+/** The secrets every box of this kind shares, held in a Vault of the box's own. */
+export interface BoxVaultOpts {
+    /** Vault name. Default `<name>-secrets`. */
+    name?: string;
+    description?: string;
+    /** Written at apply. A reference such as `${VAR}` or `op://...` that resolves at apply, never a literal (FTN001, and `box-credential-declared` in `chant workspace check`). */
+    secrets?: {
+        key: string;
+        value: string;
+    }[];
+}
+export interface BoxOpts {
+    /** The Agent's name. The Environment is `<name>-env`. */
+    name: string;
+    /** The app repo the box serves, cloned into the sandbox before setup runs. Omit for a blank-slate app with no repo yet: the Environment declares no `repositories`, and `setupScript` runs against whatever working tree the sandbox already has. */
+    repo?: BoxRepositoryOpts;
+    /** The provisioning script's text, run as the Environment's `setup_script`. */
+    setupScript: string;
+    /** Setup exec timeout, 1 to 900 seconds (FTN024). fountain's default is 120. */
+    setupTimeoutSeconds?: number;
+    /** Agent runtime. Default `claude`. */
+    runtime?: "claude" | "codex" | "gemini" | "opencode";
+    /** Canonical provider/model_id. Omitted, fountain's default for the runtime. */
+    model?: string;
+    /** Sandbox backend override. Omitted, the instance default (`SANDBOX_PROVIDER`). A plain `Agent.sandbox_provider` field, so it is already visible on the graph node without extra bookkeeping (unlike `allowedVaults`; see "Allowed vaults in the read contract" above). */
+    sandboxProvider?: BoxSandboxProvider;
+    /** Per-tool permission policy. Required: fountain's unset policy is `auto_allow`. */
+    permissionPolicy: BoxPermissionPolicy;
+    /** Environment packages, passed through. */
+    packages?: Record<string, unknown>;
+    /** Environment variables, passed through. Not for secrets: use `vault`. */
+    envVars?: Record<string, string>;
+    /** Egress allowlist under `limited` networking. Default [], deny-all. */
+    allowedHosts?: string[];
+    /** Open the sandbox's network. FTN011 warns on it. Refused with `allowedHosts`. */
+    unrestrictedNetworking?: boolean;
+    /** Declare a Vault for the box's shared secrets. */
+    vault?: BoxVaultOpts;
+    /**
+     * Vaults a conversation may attach. Default: the box's own vault, or none.
+     * `"any"` leaves the list unset, which fountain reads as any vault the
+     * tenant owns: what a runtime that makes a vault per box (hud's) needs.
+     */
+    allowedVaults?: "any" | Array<InstanceType<typeof Vault> | string>;
+    /** The port the box serves. Default 8080, the door's. Recorded as `box-port` metadata. */
+    port?: number;
+    system?: string;
+    skills?: Array<Record<string, unknown>>;
+    mcpServers?: Record<string, unknown>;
+    /** Extra metadata, merged over the ownership marker on every resource the box declares. */
+    metadata?: Record<string, unknown>;
+}
+export interface BoxResources {
+    environment: InstanceType<typeof Environment>;
+    agent: InstanceType<typeof Agent>;
+    vault?: InstanceType<typeof Vault>;
+    /** The served port, as recorded under `box-port`. */
+    port: number;
+}
+export declare function Box(opts: BoxOpts): BoxResources;
+//# sourceMappingURL=box.d.ts.map

package/dist/composites/box.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"box.d.ts","sourceRoot":"","sources":["../../src/composites/box.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAEH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE/D,4FAA4F;AAC5F,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAEhD,qHAAqH;AACrH,eAAO,MAAM,+BAA+B,0BAA0B,CAAC;AAEvE,4DAA4D;AAC5D,eAAO,MAAM,qBAAqB,kDAAmD,CAAC;AAEtF,wEAAwE;AACxE,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,4DAA4D;AAC5D,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAErC,iEAAiE;AACjE,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AAEvD,gFAAgF;AAChF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,CAAC,CAAC;AAE9F,qEAAqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+KAA+K;IAC/K,OAAO,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,OAAO;IACtB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,qPAAqP;IACrP,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uCAAuC;IACvC,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;IACrD,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4QAA4Q;IAC5Q,eAAe,CAAC,EAAE,kBAAkB,CAAC;IACrC,qFAAqF;IACrF,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,mFAAmF;IACnF,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,oDAAoD;IACpD,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,aAAa,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC;IACnE,0FAA0F;IAC1F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;IAC9C,KAAK,EAAE,YAAY,CAAC,OAAO,KAAK,CAAC,CAAC;IAClC,KAAK,CAAC,EAAE,YAAY,CAAC,OAAO,KAAK,CAAC,CAAC;IACnC,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,CAgF/C"}

package/dist/composites/steward.d.ts

@@ -44,7 +44,43 @@
  * the server does not keep. And a webhook url FTN022 would reject is refused
  * here rather than at synth, because a composite that constructed it would be
  * handing the author a lint error about a resource they never typed.
+ *
+ * ## One steward whatever the preset (#2731)
+ *
+ * The composite also returns `declaration`, the steward as core reads it
+ * (`declareSteward` in `@intentius/chant/op`): its name, its Ops and its
+ * `form`. A box whose preset has no Fountain in some environment (a docker
+ * compose box, a Sprites box) sets `form` so that environment is `local`, and
+ * there `chant operator --steward <name>` runs the same Ops on the same crons,
+ * one at a time, each under its operator lease and the whole process under the
+ * steward's own. `chant operator --steward` refuses an environment whose form
+ * is `fountain`, because this Agent and Teammate are the steward there. Export
+ * `declaration` from an `*.op.ts` file so the operator and `chant workspace
+ * status` find it.
+ *
+ * ## Credentials (#2726)
+ *
+ * A box's steward holds no credential. Name the box capabilities its Ops use
+ * in `capabilities` (the names the member's `box` block in the workspace
+ * declaration gives them) and leave `vault` out: the broker holds the key and
+ * enforces the scope. `vault` together with `capabilities` is refused.
+ * `chant workspace check` fails a box member whose files hold a literal secret
+ * (`box-credential-declared`), and `chant workspace status --json` lists each
+ * capability the steward names with the broker the box block gives it.
+ *
+ * ## The coding agent beside it
+ *
+ * A box also has a coding agent editing the app. They share the checkout by
+ * writing different things. The steward's writes are chant writes: run,
+ * converge and gate records on the `chant/lifecycle` branch and lease refs
+ * under `refs/chant/lease/`, made with git plumbing that never reads or writes
+ * the index or the working tree. The app's files, the index and commits on the
+ * working branch are the coding agent's. An Op a steward runs does not edit the
+ * app. A change to the checkout that an Op has to make (applying a build, a
+ * workspace upgrade) belongs under the work item's lease (ws-055), on a branch
+ * of its own, never in the coding agent's working tree.
  */
+import { type StewardDeclaration, type StewardFormSpec } from "@intentius/chant/op";
 import type { OpConfig, OpResource } from "@intentius/chant/op";
 import { Agent, Environment, Schedule, Teammate, Vault, Webhook } from "../generated/index.js";
 /**
@@ -71,8 +107,18 @@ export interface StewardOpts {
     name: string;
     /** The environment its computer is provisioned from: repo, chant, tooling. */
     environment: InstanceType<typeof Environment>;
-    /** Secrets layered on top. Omit under the egress broker, which holds them. */
+    /**
+     * Secrets layered on top, for a steward that isn't behind a broker. Omit it
+     * under a broker, which holds them, and name `capabilities` instead.
+     */
     vault?: InstanceType<typeof Vault>;
+    /**
+     * The box capabilities this steward's Ops reach through the box's broker
+     * (#2726), by the names the member's `box` block declares, such as
+     * `fountain` or `inference`. Refused together with `vault`: a brokered
+     * steward holds no credential.
+     */
+    capabilities?: string[];
     /**
      * The ops this steward runs. An op with a `schedule` gets a `Schedule`; one
      * without is still listed, so `chant run <op> --on fountain` knows which
@@ -82,6 +128,16 @@ export interface StewardOpts {
     webhook?: StewardWebhookOpts;
     /** Extra metadata merged over the `managed-by` marker on the Agent. */
     metadata?: Record<string, unknown>;
+    /**
+     * Where this steward runs (#2731). Default `fountain`: this composite's
+     * Agent and Teammate are the steward. A box whose preset has no Fountain in
+     * some environment names it here, e.g. `{ default: "fountain", environments:
+     * { minimal: "local" } }`, and `chant operator --steward <name> --env minimal`
+     * runs the same Ops there. The Fountain resources are declared either way; a
+     * form that is `local` everywhere is refused, since it needs none of them
+     * (use core's `declareSteward` for that).
+     */
+    form?: StewardFormSpec;
 }
 export interface StewardResources {
     agent: InstanceType<typeof Agent>;
@@ -89,6 +145,12 @@ export interface StewardResources {
     /** One per op that carries a `schedule`, in `ops` order. */
     schedules: InstanceType<typeof Schedule>[];
     webhook?: InstanceType<typeof Webhook>;
+    /**
+     * The steward as core reads it (#2731): name, Ops and form. Export it from
+     * an `*.op.ts` file so `chant operator --steward` and `chant workspace
+     * status` find it.
+     */
+    declaration: StewardDeclaration;
 }
 /** The command an `acp` agent speaks the protocol over (#2125). */
 export declare const STEWARD_RUNTIME_COMMAND = "chant acp";

package/dist/composites/steward.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"steward.d.ts","sourceRoot":"","sources":["../../src/composites/steward.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAK5F;;;;;;;;;GASG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;AAQnE,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,WAAW,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;IAC9C,8EAA8E;IAC9E,KAAK,CAAC,EAAE,YAAY,CAAC,OAAO,KAAK,CAAC,CAAC;IACnC;;;;OAIG;IACH,GAAG,EAAE,SAAS,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,YAAY,CAAC,OAAO,KAAK,CAAC,CAAC;IAClC,QAAQ,EAAE,YAAY,CAAC,OAAO,QAAQ,CAAC,CAAC;IACxC,4DAA4D;IAC5D,SAAS,EAAE,YAAY,CAAC,OAAO,QAAQ,CAAC,EAAE,CAAC;IAC3C,OAAO,CAAC,EAAE,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;CACxC;AAED,mEAAmE;AACnE,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAiBnD,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE3D;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C;AA8BD,wBAAgB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,gBAAgB,CAsF3D"}
+{"version":3,"file":"steward.d.ts","sourceRoot":"","sources":["../../src/composites/steward.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AAEH,OAAO,EAAkB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpG,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAK5F;;;;;;;;;GASG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;AAQnE,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,WAAW,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;IAC9C;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC,OAAO,KAAK,CAAC,CAAC;IACnC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,GAAG,EAAE,SAAS,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,YAAY,CAAC,OAAO,KAAK,CAAC,CAAC;IAClC,QAAQ,EAAE,YAAY,CAAC,OAAO,QAAQ,CAAC,CAAC;IACxC,4DAA4D;IAC5D,SAAS,EAAE,YAAY,CAAC,OAAO,QAAQ,CAAC,EAAE,CAAC;IAC3C,OAAO,CAAC,EAAE,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;IACvC;;;;OAIG;IACH,WAAW,EAAE,kBAAkB,CAAC;CACjC;AAED,mEAAmE;AACnE,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAiBnD,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE3D;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C;AA8BD,wBAAgB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,gBAAgB,CAuG3D"}

package/dist/index.d.ts

@@ -14,6 +14,8 @@ export { ConciergeStack } from "./composites/concierge-stack.js";
 export type { ConciergeStackOpts, ConciergeStackResources } from "./composites/concierge-stack.js";
 export { Steward, stewardForOp, STEWARD_RUNTIME_COMMAND } from "./composites/steward.js";
 export type { StewardOp, StewardOpts, StewardResources, StewardWebhookOpts } from "./composites/steward.js";
+export { Box, BOX_PORT_METADATA_KEY, BOX_ALLOWED_VAULTS_METADATA_KEY, BOX_DEFAULT_PORT, BOX_DEFAULT_MOUNT_PATH, BOX_SANDBOX_PROVIDERS, } from "./composites/box.js";
+export type { BoxOpts, BoxResources, BoxRepositoryOpts, BoxVaultOpts, BoxPermissionPolicy, BoxSandboxProvider } from "./composites/box.js";
 export { acpCommandGroup } from "./acp/index.js";
 export { AcpServer } from "./acp/server.js";
 export type { AcpServerOptions } from "./acp/server.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAIlD,OAAO,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAC9D,YAAY,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAG9B,cAAc,mBAAmB,CAAC;AAIlC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AACxF,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAInH,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAChE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAIhE,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,8BAA8B,GAC/B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,wBAAwB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG5F,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACtF,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAIzG,OAAO,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAIlD,OAAO,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAC9D,YAAY,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAG9B,cAAc,mBAAmB,CAAC;AAIlC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AACxF,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAInH,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAChE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAIhE,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,8BAA8B,GAC/B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,wBAAwB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG5F,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACtF,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACzG,OAAO,EACL,GAAG,EACH,qBAAqB,EACrB,+BAA+B,EAC/B,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAIxI,OAAO,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "33090e28ff6ca41325918fd9fc2c7ceb354679308b1634834a6098b0fc03e364",
+    "manifest.json": "f55b301389d73946391200a1788013f3b7f368586b497af230a6813a0acda4e8",
     "meta.json": "3301437a2a56eaf1a5cc8f6eabb18a40767f916e09701b2d9bf20aba4066738c",
     "types/index.d.ts": "cf6b634fe0a8e9e96f1d9d07e3df53838def2683dc93dbe3c7fd971c6d3908ae",
     "rules/ftn001-no-secret-literals.ts": "a417b194cd7039911cca9a0f14c49b042dfa6b1ee48517f7c2e22b16590a8599",
@@ -21,7 +21,7 @@
     "skills/chant-fountain.md": "906a312756a02c88de634915f63ab4dfe1b1078ff4d8cfb4b6dc97eec14bc237",
     "skills/chant-fountain-secrets.md": "40aa847d62547581bebdde630b54796c4e1cbf498869392e0d396d96a75c0ab6",
     "skills/chant-fountain-ops.md": "4e72f0a0c7477a9e98f85ea45e49ba69e8a699f9c13ba0f0cf1cb20a88151373",
-    "skills/chant-fountain-locked-sandboxes.md": "de82f06cb3a08ba6bf3ae45fb9869e21d6da18b9ebe0fc769da8aebaceea7dd1"
+    "skills/chant-fountain-locked-sandboxes.md": "14def4c68b13c2bd561f75819b188968cec85073a5dd8b59e91708e1af26daae"
   },
-  "composite": "916a499797c8130a9fdcba5f55f63449f67fee870a5b93466b7b00f7515fb5a9"
+  "composite": "d961f51d2dbd943d5da0fb56f8c82649c3392c02c62222d68c81069b9c9cdefb"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "fountain",
-  "version": "0.89.0",
+  "version": "0.91.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Fountain",
   "specVersion": "v0.21.0"

package/dist/op/activities/fountain-run.d.ts

@@ -1,15 +1,62 @@
 /**
  * fountainRun — start a conversation from a declared Agent and follow it
- * to a terminal status.
+ * to the end of its turn.
  *
  * Conversations are runs, not declarables (the one fountain kind the
  * lexicon deliberately does not model as a resource). This op is the
- * imperative half: resolve the agent by name, POST the conversation,
- * poll until `completed | failed | timed_out | terminated`, and terminate
- * on deadline so a hung run never outlives the op that started it.
+ * imperative half: resolve the agent by name, POST the conversation, and
+ * poll until the turn is done.
+ *
+ * What "done" means depends on the agent's `sandbox_mode` (#2718). An
+ * `ephemeral` conversation's machine is its own and this polls the
+ * conversation's own status to `completed | failed | timed_out |
+ * terminated` — none of which a running server's conversation status
+ * actually reaches on its own, so in practice this waits out `timeoutMs`
+ * and terminates, as it always has. A `persistent` agent's conversation
+ * (`Steward`, and `Box` from #2705) shares one machine across every
+ * conversation on it, and a turn ending there does not tear the sandbox
+ * down: the conversation settles on `idle`, not on any of the four
+ * statuses above. Waiting for one of those on a persistent agent is the
+ * bug this op used to have — it waited out the whole deadline after the
+ * turn had already finished, then terminated a machine that was meant to
+ * persist. For `idle`, this instead reads the finished turn back
+ * (`GET .../turns`) and returns its own outcome (`completed | failed |
+ * interrupted` — fountain's `end_turn` block, or an error) without
+ * terminating anything.
+ *
+ * Terminating the conversation's machine on deadline (a hung run should
+ * not outlive the op that started it) still happens whenever the turn has
+ * not ended — for either sandbox mode. `terminate` makes the choice
+ * explicit rather than leaving it implicit in `sandbox_mode`.
  */
 import { type FountainHttp, type FountainConnectionDeps } from "./fountain-apply.js";
+/**
+ * Conversation statuses that end an *ephemeral* agent's run. `completed`
+ * and `timed_out` are not values fountain's `Conversation.status` takes
+ * today (its enum is `pending | running | idle | failed | terminated`) —
+ * they are kept so a server that starts reporting them is handled without
+ * a further change here.
+ */
 export declare const TERMINAL_STATUSES: Set<string>;
+/**
+ * Conversation statuses that end a *persistent* agent's run: everything
+ * {@link TERMINAL_STATUSES} does, plus `idle` — the status a persistent
+ * conversation settles on once its turn ends, machine still up (#2718).
+ */
+export declare const PERSISTENT_DONE_STATUSES: Set<string>;
+/**
+ * How `fountainRun` treats the conversation's machine once its wait ends
+ * (#2718).
+ *
+ * - `on-deadline` — terminate only when `timeoutMs` is hit with the turn
+ *   still unfinished, never on a turn that ended cleanly. This was
+ *   `fountainRun`'s only behavior before this option existed.
+ * - `never` — never terminate, even past the deadline; the caller, or
+ *   fountain's own idle/max-lifetime bounds, is responsible for the machine.
+ * - `always` — terminate whenever the wait ends, whether the turn ended
+ *   cleanly or the deadline fired.
+ */
+export type TerminatePolicy = "never" | "on-deadline" | "always";
 export interface FountainRunArgs {
     /** Agent name (resolved against /api/agents) or a raw agent id. */
     agent: string;
@@ -26,19 +73,43 @@ export interface FountainRunArgs {
     profile?: string;
     /** Project root `chant.config.ts` is read from. Default: process.cwd(). */
     cwd?: string;
-    /** Give up (and terminate the conversation) after this long. Default 10 min. */
+    /** Give up after this long. Default 10 min. */
     timeoutMs?: number;
     /** Poll interval. Default 5s. */
     pollMs?: number;
+    /**
+     * When to terminate the conversation's machine (#2718). Default follows
+     * the agent's `sandbox_mode`: `on-deadline` for `ephemeral` (unchanged),
+     * `never` for `persistent` — its machine is a home meant to outlive the
+     * conversation, so a run that hits its deadline leaves it be unless this
+     * says otherwise.
+     */
+    terminate?: TerminatePolicy;
     /** Injectable clock/sleep for tests. */
     sleep?: (ms: number) => Promise<void>;
 }
 export interface FountainRunResult {
     conversationId: string;
+    /**
+     * The run's outcome. For a persistent agent whose turn ended, this is the
+     * turn's own status (`completed | failed | interrupted`); otherwise it is
+     * the conversation's status when the wait ended (`terminated` on a
+     * deadline).
+     */
     status: string;
-    /** True when the op hit its deadline and terminated the conversation. */
+    /** True when the agent's `sandbox_mode` resolved to `persistent`. */
+    persistent: boolean;
+    /** True when the op hit its deadline with the turn still unfinished. */
     terminatedByDeadline: boolean;
 }
+export interface ResolvedAgent {
+    id: string;
+    /** `ephemeral` or `persistent`; fountain's own default is `ephemeral`. */
+    sandboxMode: string;
+}
+/** Resolve an agent by name or id, along with its `sandbox_mode`. */
+export declare function resolveAgent(http: FountainHttp, agent: string): Promise<ResolvedAgent>;
+/** Agent id only — the common case, and the one call sites outside this file use. */
 export declare function resolveAgentId(http: FountainHttp, agent: string): Promise<string>;
 export declare function fountainRun(args: FountainRunArgs, http?: FountainHttp, deps?: FountainConnectionDeps): Promise<FountainRunResult>;
 //# sourceMappingURL=fountain-run.d.ts.map

package/dist/op/activities/fountain-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fountain-run.d.ts","sourceRoot":"","sources":["../../../src/op/activities/fountain-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,eAAO,MAAM,iBAAiB,aAA8D,CAAC;AAE7F,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAID,wBAAsB,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQvF;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,eAAe,EACrB,IAAI,CAAC,EAAE,YAAY,EACnB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CAuC5B"}
+{"version":3,"file":"fountain-run.d.ts","sourceRoot":"","sources":["../../../src/op/activities/fountain-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,aAA8D,CAAC;AAE7F;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,aAA0C,CAAC;AAKhF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEjE,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,wCAAwC;IACxC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,UAAU,EAAE,OAAO,CAAC;IACpB,wEAAwE;IACxE,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAID,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qEAAqE;AACrE,wBAAsB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAe5F;AAED,qFAAqF;AACrF,wBAAsB,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGvF;AAeD,wBAAsB,WAAW,CAC/B,IAAI,EAAE,eAAe,EACrB,IAAI,CAAC,EAAE,YAAY,EACnB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CAwD5B"}

package/dist/op/activities/index.d.ts

@@ -6,6 +6,6 @@
  */
 export { fountainApply, resolveEndpoint, resolveToken, resolveConnection, parseManifest, toApplyPayload, isChantOwned, defaultFountainHttp, DEFAULT_FOUNTAIN_BASE_URL, OWNERSHIP_KEY, OWNERSHIP_VALUE, } from "./fountain-apply.js";
 export type { FountainApplyArgs, FountainApplySummary, ManifestResource, FountainHttp, FountainConnectionDeps, } from "./fountain-apply.js";
-export { fountainRun, resolveAgentId, TERMINAL_STATUSES } from "./fountain-run.js";
-export type { FountainRunArgs, FountainRunResult } from "./fountain-run.js";
+export { fountainRun, resolveAgent, resolveAgentId, TERMINAL_STATUSES, PERSISTENT_DONE_STATUSES, } from "./fountain-run.js";
+export type { FountainRunArgs, FountainRunResult, ResolvedAgent, TerminatePolicy } from "./fountain-run.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,aAAa,EACb,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,yBAAyB,EACzB,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAChF,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,aAAa,EACb,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,yBAAyB,EACzB,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,WAAW,EACX,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/skills/chant-fountain-locked-sandboxes.md

@@ -31,4 +31,4 @@ The environment's config is the enforcement boundary, so watch it: `chant lifecy
 
 ## Running conversations
 
-Conversations are runs, not resources. Use the `fountainRun` activity: resolves the agent by name, starts (optionally with a prompt and an allowlisted vault), polls to `completed | failed | timed_out`, and terminates at its deadline so a hung sandbox never outlives the op. Multi-turn interaction (follow-up prompts, interrupt) is fountain's own conversations API — keep chant to the lifecycle edges.
+Conversations are runs, not resources. Use the `fountainRun` activity: resolves the agent by name, starts (optionally with a prompt and an allowlisted vault), and waits for the turn to end. What "end" means, and what happens to the machine, follows the agent's `sandbox_mode`: an `ephemeral` agent's conversation is polled for a terminal status and terminated on deadline, same as before; a `persistent` agent's (a `Steward` or `Box`) conversation settles on `idle` once its turn ends — machine still up for the next turn — so `fountainRun` reads the turn back and returns its outcome (`completed | failed | interrupted`) without terminating anything, by default. Pass `terminate: "on-deadline" | "always"` to opt a persistent agent's run back into ending the machine. Multi-turn interaction (follow-up prompts, interrupt) is fountain's own conversations API — keep chant to the lifecycle edges.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-fountain",
-  "version": "0.89.0",
+  "version": "0.91.0",
   "type": "module",
   "description": "Fountain lexicon for chant — sandboxed agent environments, vaults, and agents as typed estate",
   "license": "Apache-2.0",
@@ -50,7 +50,7 @@
     "bundle": "tsx src/package-cli.ts"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.89.0",
+    "@intentius/chant": "^0.91.0",
     "typescript": "^5.9.3",
     "zod": "^4.3.6"
   },