Interactive Agent Turns Stay on the Laptop

A staff engineer opened a refactor chat while a test suite was still running on the same sixteen-gigabyte laptop. The first two agent turns completed against files already in memory, and the editor stayed responsive throughout those replies. The third turn uploaded a compressed workspace to a remote endpoint, and the cursor froze until a two-second round trip returned. The engineer cancelled the job, because an interactive review cannot wait on a remote host that sits a network away.

That scene is common in local-first agent setups that treat every hard task as a candidate for remote compute. The failure was not a missing accelerator, and it was not a context window that had already overflowed RAM. The failure was a turn class mistake: an interactive reply crossed the network while a human stared at the editor. The rest of this article treats that class mistake as a gate, with a small classifier that teams can run before any spill.

Public threads this week keep arguing whether models already outcode most developers, while editor freezes from remote hops go unmeasured in those debates. Quality arguments skip the residency question that actually decides whether a person keeps the agent open. Latency, secret handling, and offline vetoes are less glamorous than model scoreboards, yet they decide whether the next turn belongs on the laptop. The workflow below stays useful even if every product name in it is removed.

Interactive latency is a different axis from working-set size

Many local-first writeups treat working-set overflow as the only honest reason to leave the laptop. That framing misses the turn that still fits in RAM and still fails the person waiting on a reply. An interactive agent turn is a conversation with a human on the other side of the editor cursor. A batch turn is a job that can finish after lunch, after a commute, or after the laptop lid closes.

Free remote compute can win the batch case and still lose the interactive case on round-trip time alone. The network hop adds serialization, queueing, and TLS before the first model token even appears on screen. Local inference on a warm process avoids that tax even when the on-device model is the smaller of the two. The point is not that local models are stronger; the point is that waiting humans experience latency before they experience quality.

A local refuse is therefore a product decision, not a hardware confession. Teams that skip the refuse will keep shipping interactive work to whichever host looks idle in a dashboard. Idle remote capacity is the wrong signal when the user is mid-keystroke and the secret scanner has not run. The classifier in this article ignores host idle time on purpose.

Secrets and offline status veto a spill even when latency looks fine

Latency is only the first veto, and a fast remote answer remains a leak if the prompt carried a live secret. API keys, session cookies, and private environment files often ride along in helpful context packs built for agents. Offline work adds a third veto, because a closed lid and a dead radio cannot reach a remote host at all. A spill policy that ignores those two vetoes will ship secrets or hang at the worst possible moment for the user.

Secret scanning has to happen before serialization, not after a retry loop has already posted the bundle. Once bytes leave the machine, deleting a chat log does not rewind the upload. Offline detection has to happen before the agent blocks the editor on a socket that will never complete. Fail-closed local residency is the only safe default when either veto fires.

A turn-class table before any host choice

The classifier below maps a turn to a residency decision without pretending to measure model quality or dollar cost. Teams should treat the table as a starting policy and replace the waiting-human column with a real product SLO. The default for interactive work is a hard refuse, even when a remote host is idle and willing to accept the job. The default for batch work is a conditional allow, and only after a secret scan and a reachability probe both pass.

This table is a policy, not a benchmark, and the cells are not measurements of any hosted model. Operators who need different SLO numbers should edit the YAML file in the artifact rather than argue about the labels. The refuse for interactive turns stays hard in every row that marks a human as waiting. Remote residency appears only where the human is not waiting, the bundle is clean, and the network is actually up.

A five-step workflow for each agent turn

The following steps run before the agent runtime selects a host, and they are deliberately boring on purpose. Boring gates survive better than clever routers when an editor freeze is the failure the user will remember. Each step records a reason code so a later log can explain a refuse without reconstructing the original prompt. The agent then either continues locally or, for surviving batch turns only, may spill.

1. Classify the turn as interactive or batch

Mark a turn interactive when a human is blocked on the next token, diff, or test diagnosis in the editor. Mark a turn batch when the job can complete without a person watching the stream, including overnight repairs and index rebuilds. Persist that label on the turn record before any file packer runs, because packers tend to assume remote residency by default. Refuse to infer the label from job size alone, since a small interactive fix and a small batch fix look identical on disk.

2. Scan the outbound bundle for secrets

Run a local scanner across the prompt, the attached diffs, and any .env fragments the agent proposed to include. Treat known key prefixes, bearer headers, and private PEM blocks as automatic refuses, even for batch jobs that would otherwise spill. Write only a boolean and a rule name into the log, never the secret material that tripped the rule. If the scanner cannot complete, fail closed and keep the turn on the laptop.

3. Probe reachability without uploading the bundle

Check that the network is up with a cheap probe that does not include source files, prompts, or tool traces. A failed probe is an offline veto, not a hint to retry with a larger payload on the next timer tick. Record probe latency as telemetry for operators, and do not treat that number as a model quality score. Skip the probe entirely when the turn is already classified interactive, because the refuse does not depend on the network.

4. Enforce a hard refuse for interactive turns

If the turn is interactive, select local residency and stop, regardless of remote idle capacity. Interactive work includes inline completions, review replies, and debug questions asked from a breakpoint. Shipping those turns remotely trades a warm local process for a round trip the waiting human will feel on every keystroke. The refuse is the feature; a dashboard that overrides it should require an explicit break-glass flag.

5. Spill only the surviving batch turns

A batch turn may leave the laptop only when the secret scan passed and the reachability probe passed. Keep a local copy of the scaffold and the reason code, so a failed remote hop can resume without re-packing secrets. Do not spill because the laptop fans spun up, and do not spill because a free remote queue looks empty. Thermal discomfort is a scheduling hint for later, not a license to ignore the interactive refuse.

Artifact: a proposed spill classifier in Python

The script below is a proposed harness, not a production agent, and it has not been executed against a live fleet. It reads a JSON turn descriptor, applies the vetoes, and prints a residency decision with a stable reason code. Operators can wrap it around an existing local agent by calling it from the same shell that launches the chat. Placeholder latency fields are illustrative only and are not measurements of any vendor endpoint.

Policy file spill_policy.yaml:

# Proposed policy. Not a measured SLO.
interactive_refuse: true
fail_closed_on_scan_error: true
fail_closed_when_offline: true
secret_rules:
  - name: env_assignment
    pattern: "(?i)(api[_-]?key|secret|token|password)\\s*=\\s*['\"][^'\"]+['\"]"
  - name: bearer_header
    pattern: "(?i)authorization\\s*:\\s*bearer\\s+\\S+"
  - name: private_pem
    pattern: "-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----"

Classifier spill_gate.py:

#!/usr/bin/env python3
"""Proposed turn-class spill gate. Unexecuted example; not a hosted client."""

from __future__ import annotations

import json
import re
import sys
from dataclasses import dataclass
from pathlib import Path
from typing import Iterable


@dataclass(frozen=True)
class Decision:
    residency: str
    reason: str
    spill_allowed: bool


DEFAULT_RULES = (
    ("env_assignment", re.compile(r"(?i)(api[_-]?key|secret|token|password)\s*=\s*['\"][^'\"]+['\"]")),
    ("bearer_header", re.compile(r"(?i)authorization\s*:\s*bearer\s+\S+")),
    ("private_pem", re.compile(r"-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----")),
)


def scan_secrets(text: str, rules: Iterable[tuple[str, re.Pattern[str]]] = DEFAULT_RULES) -> str | None:
    for name, pattern in rules:
        if pattern.search(text):
            return name
    return None


def classify(turn: dict) -> Decision:
    kind = turn.get("kind", "interactive")
    bundle = turn.get("bundle_text", "")
    offline = bool(turn.get("offline", False))
    scan_error = bool(turn.get("scan_error", False))

    if scan_error:
        return Decision("local", "scan_error_fail_closed", False)
    if kind == "interactive":
        return Decision("local", "interactive_hard_refuse", False)

    hit = scan_secrets(bundle)
    if hit:
        return Decision("local", f"secret_rule:{hit}", False)
    if offline:
        return Decision("local", "offline_fail_closed", False)
    return Decision("remote_allowed", "batch_clean_online", True)


def main(argv: list[str]) -> int:
    if len(argv) != 2:
        sys.stderr.write("usage: spill_gate.py TURN.json\n")
        return 2
    payload = json.loads(Path(argv[1]).read_text(encoding="utf-8"))
    decision = classify(payload)
    json.dump(decision.__dict__, sys.stdout)
    sys.stdout.write("\n")
    return 0 if decision.residency == "local" or decision.spill_allowed else 1


if __name__ == "__main__":
    raise SystemExit(main(sys.argv))

A tiny self-check, still labeled as a proposed test rather than a recorded run:

import unittest

class SpillGateTests(unittest.TestCase):
    def test_interactive_never_spills(self):
        d = classify({"kind": "interactive", "bundle_text": "rename Foo to Bar", "offline": False})
        self.assertEqual(d.residency, "local")
        self.assertFalse(d.spill_allowed)
        self.assertEqual(d.reason, "interactive_hard_refuse")

    def test_batch_secret_stays_local(self):
        d = classify({
            "kind": "batch",
            "bundle_text": "API_KEY='ak_live_example'",
            "offline": False,
        })
        self.assertEqual(d.residency, "local")
        self.assertIn("secret_rule", d.reason)

    def test_batch_clean_online_may_spill(self):
        d = classify({
            "kind": "batch",
            "bundle_text": "recompute fixture hashes for module payments",
            "offline": False,
        })
        self.assertTrue(d.spill_allowed)
        self.assertEqual(d.reason, "batch_clean_online")

    def test_offline_batch_fails_closed(self):
        d = classify({
            "kind": "batch",
            "bundle_text": "recompute fixture hashes for module payments",
            "offline": True,
        })
        self.assertEqual(d.reason, "offline_fail_closed")

if __name__ == "__main__":
    unittest.main()

Shell wiring that keeps the probe off the secret path:

# Proposed local wrapper. Replace TURN.json with a real descriptor from the agent.
python3 spill_gate.py TURN.json
case $? in
  0) printf '%s\n' "gate passed; runtime may select local or classified batch spill" ;;
  2) printf '%s\n' "usage error" >&2 ;;
  *) printf '%s\n' "gate refused spill; continue on the laptop" ;;
esac

Operators who want a latency breadcrumb can time a reachability probe in a separate process that never receives the bundle. That probe belongs in operations telemetry, not in the residency rule for interactive turns. Mixing the two numbers reintroduces the original bug, where a slow ping becomes an excuse to upload source. Keep the refuse cheap, local, and independent of remote queue depth.

When a free server still wins

Batch jobs that outgrow laptop thermals, or that need a long unattended window, remain the honest case for remote residency. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode provides free model access and a free server option for classified batch turns after the local gate refuses interactive spills. The product does not change the residency rule in this article, and it does not remove the need to scan prompts for secrets.

A surviving batch turn is usually a large generate, a long test-repair loop, or an index rebuild that nobody is watching. Those jobs can sit on a free server without stealing the next keystroke from the person at the editor. Interactive completions, review replies, and breakpoint questions should never take that path, even when the same free server is empty. The gate exists so the free option is used as overflow for batch work, not as a default brain for every chat turn.

Limitations

The classifier does not estimate model quality, token burn, or wall-clock runtime on any host. It cannot see secrets that are assembled at tool-call time after the scan, so agents that interpolate env vars late still need a second scan. It also cannot prove that a remote provider will retain or forget a bundle, which is why secret-positive turns never leave the machine. Teams that need contractual deletion, regional pinning, or audited isolation must add those controls outside this script.

Placeholder latency comments in the narrative are scene-setting, not measurements, and they should not be copied into dashboards as facts. The YAML patterns will both over-match documentation and under-match novel secret formats. Fail-closed behavior will annoy people who wanted a remote answer more than they wanted a correct refuse. That annoyance is cheaper than an editor freeze or a leaked token, but it is still a real cost.

Who should skip this gate

Cloud-only IDEs with no local runtime should skip this design, because there is no laptop residency to protect. Teams that already run every agent behind a locked-down remote enclave with no local secrets may want the inverse policy. Interactive pair-programming products that stream tokens as the core experience should still refuse secret spills, yet they may need a different latency budget than a staff engineer's editor. Anyone hoping the gate will rank models, cut inference cost, or replace code review should use a different artifact.

The refuse also does not help a machine that cannot run a local agent at all. In that case the honest move is to shrink the bundle, strip secrets, and treat every turn as a reviewed upload, not to pretend a classifier created local compute. Borrowing a free server without the scan is worse than waiting. The laptop-first rule only pays off when a local process can actually answer the interactive turn.

Interactive agent work fails in the editor long before it fails on a leaderboard. Classify the turn, scan the bundle, and keep waiting humans on the warm local process. Spill only the batch residue that is clean, online, and nobody is watching. Teams that already pin interactive work to the laptop can try the same classifier against a free server only on batch turns that survive the secret scan.