@intentic/machine 1.316.0 → 1.318.0

package/README.md

@@ -23,39 +23,227 @@ flowchart LR
   `ic sandbox list --json` passed through, and start, stop, restart, the swaps, `set-shape`, `forget-shape` and the
   logs are ic's own verbs, argv spelled by the contract (`icShapeArgs`, `icPowerArgs`). The shape reaches ic as the
   contract's own object (`--set memoryGib=12`), so no flag of ic's is spelled here; the old `reshape` op is carried
-  out through the same verb. Nothing here runs docker or reads the shape saved for a sandbox's next restart; ic
+  out through the same verb. A rollback's `to` becomes `ic sandbox rollback <slug> --to <version>`. A sandbox an
+  interrupted swap left parked is listed under its own slug and found like any other, so start, rollback and update
+  reach it; a listing field a newer ic writes in a way this agent cannot read costs that field, not the whole
+  listing. Nothing here runs docker or reads the shape saved for a sandbox's next restart; ic
   answers both. Before its first `ic` call the agent makes
   sure the installed `ic` is at least as new as itself, fetching its own release's into `~/.intentic/ic/bin` when it
   is not ([`tools/ic-binary.ts`](src/device/tools/ic-binary.ts)), since a new verb here arrives with a new verb there.
   A fetch that fails is logged with its reason and reported in the device's facts (`icOutOfDate`, beside `features`),
   so a stale `ic` explains why logs and saving a shape are missing; the next sandbox action tries again.
 - **sync** (`src/sync/`): `sync setup` enrolls an SSH key and runs Mutagen against the sandbox's sshd, reached
-  through a loopback port tunnelled over a WebSocket. It keeps a folder two-way synced, forwards every workspace
-  port to the same localhost port, and fast-forwards local git clones from the sandbox.
+  through a loopback port tunnelled over a WebSocket. It keeps a folder two-way synced (a project copy-first, below),
+  forwards every workspace port to the same localhost port, and fast-forwards local git clones from the sandbox.
+- A **project pairing** (`sync setup --remote-dir /work/<name> --project`, what the desktop app asks for when it
+  makes a sandbox for a folder the owner picked) syncs that folder with `/work/<name>` rather than `/work`, and nothing
+  of the sandbox's is written into it: no state backup session, no git bridge, and an ignore list that keeps a
+  project's own `.intentic/` and `refs/` ([`sync/config.ts`](src/sync/config.ts) holds a remote dir to those two
+  shapes, and refuses `sync.json` whole otherwise). `setup` refuses a folder that is, holds or sits inside another
+  sandbox's, and a set-up-again that would change where a paired sandbox's folder syncs. It is **copy-first** unless
+  its owner opted into two-way: see [Copy-first projects](#copy-first-projects).
+- Only the resident agent creates Mutagen sessions: `setup` records the pairing and waits for the session to
+  appear, since two creators racing left one name holding two identical sessions. The agent keeps one session per
+  name, terminating any extras, and recreates a session whose rules drifted (its ignores, its folders, its sync mode,
+  its symlink mode). A two-way session replaced by another waits until no conflicts are left and has its derived
+  residue swept first; every other replacement happens as soon as the sandbox answers (`settlesFirst` in
+  [`sync/mutagen.ts`](src/sync/mutagen.ts) says why for each).
+- `setup` replaces what this agent's `known_hosts` holds for the pairing's alias (hashed entries included): with the
+  host key the enrollment carries when it carries one (a sandbox reads its sshd's public key off its history volume and
+  answers with it, `SyncEnrollmentAnswerSchema` in the contract), else with nothing, so `accept-new` records the key
+  the sandbox presents now, as it does for an older sandbox. Outside an enrollment a changed key is still refused. A sandbox whose ports poll has failed for ten
+  minutes has its forwards taken off localhost, and they come back with its first answer. `sync uninstall` stops and
+  unregisters Mutagen's daemon only when it is this agent's own copy, never a Mutagen the user installed.
+- Symbolic links travel only where the device can create them ([`sync/symlinks.ts`](src/sync/symlinks.ts)). A
+  Windows PC without Developer Mode refuses every link, and Mutagen would try again on every cycle, so its sessions
+  use `--symlink-mode ignore`. Turning Developer Mode on brings them back at the agent's next start.
 - **Which computer this is** ([`machine-id.ts`](src/machine-id.ts)): a `machineId` minted once at install and kept
   in `~/.intentic/machine/machine-id`, sent in the connect-time facts, the sync report and the sync enrollment. The
   Windows side hands its own to the agent it starts in each distro, so every OS install of one PC answers with one id;
   a sandbox joins enrollments, sync enrollments and device rows on it, never on a hostname.
-- The features a device advertises (`set-shape`, `reshape-later`) are read off the `ic` under it, from that `ic`'s own
-  help (both need `ic sandbox shape --set`), rather than listed beside the code; the device RPC inputs are strict, so
-  an op or field this agent does not know is refused rather than dropped. `reshape-later` and the old `reshape` op
-  stay only for pages and daemons from before `set-shape` (v1.312.0 and older), and go in v1.314.0.
+- The features a device advertises (`set-shape`, `reshape-later`, `rollback-to`) are read off the `ic` under it, from
+  that `ic`'s own help (`ic sandbox shape --set` for the first two, `ic sandbox rollback --to` for the third), rather
+  than listed beside the code. The device RPC inputs are strict, so an op or field this agent does not know is refused
+  rather than dropped, and a `to` on anything but a rollback is refused. The one exception is the grant a sandbox
+  pushes ([`device/grant.ts`](src/device/grant.ts)): a switch this agent does not know is left off and logged once per
+  link, since refusing the grant dropped the link and the sandbox redialled it forever. A known switch with a value it
+  has no meaning for is still refused. `reshape-later` and the old `reshape` op stay only for pages and daemons from
+  before `set-shape` (v1.312.0 and older), and go in v1.314.0.
 - Every path under the user's home goes through `homeDir()` from [local-agent](../local-agent), which follows a `HOME`
   set after startup; a test holds the sources to it.
 - Scopes are enforced here and nowhere else: the sandbox only asks, and a refusal names the switch that is off.
   Files stay inside the configured roots, writes need their own switch, and every call is appended to
   `~/.intentic/machine/audit.jsonl`. While an agent drives input on Windows, a notice shows on screen and
-  `PAUSE_HOTKEY` pauses every link.
-- Every connection dials out; the only listeners are on loopback.
+  `PAUSE_HOTKEY` pauses every link. The one door behind no switch is this agent's own Update and Restart
+  (`runAgentFlow`, [`device/tools/agent.ts`](src/device/tools/agent.ts)): no agent tool reaches it, and the sandbox
+  admits only a maintainer to it, so the owner's maintenance does not wait on the agents' "Run commands" (2026-09-29;
+  it rode that switch before, and an owner had to widen what agents may do to update the agent).
+- Every connection dials out; the only listeners are on loopback. One of them is short-lived: while a sandbox's
+  sign-in is open, [`device/loopback-catch.ts`](src/device/loopback-catch.ts) listens on the
+  `http://localhost:<port>/…` address the provider redirects to, the one a CLI running here would have held, and
+  streams each landing back (`catchLoopback`, advertised as the `loopback-catch` feature). It checks nothing: the state
+  and the PKCE verifier stay in the sandbox, which alone can tell the sign-in from anything else that hits the port. A
+  taken port answers `busy`, and the sandbox leaves the paste to the person.
 - On Windows the Windows side is the root of the PC (`src/environments/`): it holds one `wsl.exe` session per
   distro with an agent, and `upgrade` brings every environment to the same release. The root also updates itself
   on a timer and pre-downloads sandbox updates with `ic sandbox prepare --auto`.
 - The install shims only put a first binary down and run `setup`; `install.ts` decides the rest. `status --json`
   is what the desktop app's tray reads.
 
+### Copy-first projects
+
+A project's folder flows **one way**, this device to the sandbox, so nothing an agent does in `/work/<name>` (an
+`rm -rf` included) reaches the owner's files. What an agent changed comes back only when the owner asks, through
+`sync bring-back`, which keeps a restore point first. Two-way stays one switch away.
+
+- **Direction** is the pairing's `direction` in `sync.json`: `"to-sandbox"` (Mutagen's `one-way-safe`, this device as
+  alpha) or `"both"` (`two-way-safe`, as every workspace pairing). Absent, as on every project paired before it existed,
+  means `"to-sandbox"`, and so does a value this build has no word for; it means nothing on a workspace pairing
+  ([`sync/config.ts`](src/sync/config.ts) `projectDirection`). An older agent keeps the field through every write but a
+  `setup` (which resets it, with the pairing's other switches), and keeps the copy-first session it finds, since it never
+  compared sync modes. `sync direction` rewrites the field; the watcher sees the new mode on its next tick and recreates
+  the session (`sessionMatchesSpec` compares the live session's `mode`).
+- **Replacements** into copy-first happen at once, conflicts or not, with no flush and no residue sweep: a last flush
+  of a two-way session would carry the sandbox's latest changes into the folder, and the new session never writes here.
+  Out of copy-first too: a one-way session's conflicts are the agent's kept edits, which differ whoever holds them. This
+  is how every existing project becomes copy-first on its first start of this build.
+
+**What one-way-safe does**, measured with Mutagen 0.18.1 over ssh against an sshd whose `/work` was a scratch folder,
+driving this agent's own session code and CLI (alpha is this device, beta the sandbox):
+
+| The sandbox (an agent)… | Mutagen one-way-safe |
+|---|---|
+| edits a file this folder has | keeps the sandbox's version and reports it as a conflict; this folder is untouched |
+| creates a file | keeps it in the sandbox, no conflict; nothing reaches this folder |
+| deletes a file or a folder | puts it back from this folder on the next cycle |
+| runs `rm -rf /work/<name>/*`, or removes `/work/<name>` | refills the sandbox's copy from this folder; this folder is untouched |
+
+| This device… | Mutagen one-way-safe |
+|---|---|
+| edits, creates or deletes a file | carries it to the sandbox, except over a file the sandbox changed, which is kept |
+| deletes a file the sandbox changed | the sandbox keeps its version, and the conflict clears |
+
+A fresh session over two copies that already differ (what any replacement starts from) deletes nothing on either side.
+One-way-safe copies what only this folder has into the sandbox and keeps every sandbox file that differs, as a conflict.
+Two-way-safe also copies what only the sandbox has into this folder, and reports what differs on both as a conflict.
+`mutagen sync list --template '{{json .}}'` prints the mode as a top-level `mode`, absent on a session created without
+`--sync-mode`, which Mutagen runs two-way-safe.
+
+**The commands**, all under `intentic-machine sync`, name the project by `--dir <its folder>` (links resolved, case
+folded where the platform folds it). With `--json` each prints exactly one JSON object on stdout, and on failure
+`{ "ok": false, "error": "<sentence>" }` with exit code 1. The desktop app parses these, so fields are only ever added.
+
+| Command | Success output |
+|---|---|
+| `sync changes` | `{ "ok": true, "pairing": "<id>", "direction": "to-sandbox"\|"both", "changes": [{ "path", "kind": "added"\|"modified"\|"deleted", "size"?, "conflict"?: true }], "truncated"?: true }` |
+| `sync bring-back [--path <p>]... [--paths-file <file>]` | `{ "ok": true, "point": "<id>", "applied": [{ "path", "kind" }], "skipped": [{ "path", "reason" }] }` |
+| `sync restore-points` | `{ "ok": true, "points": [{ "id", "createdAt", "entries": n }] }` |
+| `sync restore --point <id>` | `{ "ok": true, "restored": n, "skipped": [{ "path", "reason" }] }` |
+| `sync direction <to-sandbox\|both>` | `{ "ok": true, "direction": "…" }` |
+
+- **`sync changes`** lists what the sandbox did, relative paths with `/`, sorted, the first 5,000 (`truncated` when
+  there were more): `added` exists only in the sandbox's copy, `modified` on both with different content (`size` is the
+  sandbox copy's), `deleted` was removed there. The sandbox is listed by ONE command over the pairing's ssh alias, a
+  node program that walks `/work/<name>` and prints path, size and sha256 NUL-separated, so any name survives. This
+  device is walked the same way, reading a file only where its size matches the sandbox's, through a hash cache keyed
+  by path, size and times in `~/.intentic/machine/hashes/<pairing>.json`. Both walks prune by the pairing's ignore list
+  read as Mutagen reads it: a name, `*` within it, at any depth (or at the root with a leading `/`), taking a matched
+  folder's contents along; any other spelling is refused rather than approximated. Mutagen's `.mutagen-temporary-*`
+  scratch files are left out too, and so are links and anything else that is not a regular file, on either side.
+- **Whose change it is, and never over a newer edit.** The same cache file records each path's content when both
+  copies were last seen equal. A difference the sandbox did not move away from (an edit made here, still on its way) is
+  not listed at all. A file only this device holds is offered as `deleted` only when that record shows the sandbox had
+  exactly this copy. A `modified` file is written over here only when this device's copy is still what the two last
+  agreed on, which only a session that was running and whose flush just finished a whole cycle can show. Mutagen's own
+  record says so for the files it reports in conflict (ten at most, each with SHA-1 digests of what the two last agreed
+  on and of this device's copy, the latter checked against the file here now); the listing record says so for the rest.
+  Anything else is listed with `conflict: true` and skipped by bring-back with its reason, even when named by `--path`:
+  both copies moved (a record gone stale while the sync was paused, say, with the owner's own older version in the
+  sandbox), no record of the two ever agreeing on it, or a session that was paused, absent, or whose flush did not
+  finish. Since one-way-safe puts an agent's deletions back, `deleted` shows up mainly while the session is paused, and
+  a rename in the sandbox comes back as an addition (the old name is put back there). The record is written only by
+  whoever holds the folder's lock, so a listing beside a running bring-back never undoes what that one recorded.
+- **`sync bring-back`** runs with the session paused (after a flush) if it was running, and leaves one somebody paused
+  as it is. It lists both sides and fetches the `added` and `modified` files in ONE ssh stream into a private staging
+  folder, each checked against the listing's sha256 (a file that changed since is skipped with the reason). Then it
+  writes the restore point, and only then touches the folder: each file renamed into place from a copy beside it, only
+  where the folder still holds what the point kept of it. `deleted` files are removed with the folders they leave
+  empty. `--path` takes a file or a folder, repeatable; `--paths-file` names a UTF-8 file holding a JSON array of such
+  paths (a Windows command line holds 32,767 characters, fewer than a long selection), taken together with any
+  `--path`. An unreadable file, one that is not such an array, or an empty one (which would otherwise mean every change)
+  is refused before anything is listed. A new file gets the sandbox copy's executable bit. Nothing is written through a
+  link: every folder on the way is checked.
+- **Why the session pushes nothing stale back.** Paused, it runs no cycle between the listing, the fetch and the writes,
+  and on resume it rescans both sides. What was written here is byte for byte the sandbox's, so both sides moved from
+  their last agreement to the same content: Mutagen records that and transfers nothing. A sandbox file that changed
+  again meanwhile is a sandbox modification one-way-safe keeps, as a conflict. The e2e run checked all of it: no
+  conflicts after resume, the sandbox still holding the agent's content, and a later edit here carried over as usual.
+- **Restore points** live in `~/.intentic/machine/restore/<pairing>/<id>/`, the id being the creation time in ISO 8601
+  basic format (`20260928T213000.123Z`, a folder name on every system). Each holds `manifest.json`, which is
+  `{ id, createdAt, dir, entries: [{ path, kind, backedUp, applied, backup?, mode? }] }` (`applied` is the sha256
+  bring-back left, null for a deletion), and `files/<path>`, a copy of every file bring-back overwrote or deleted. Only
+  what was actually written stays in the manifest. All of it is on the disk before the first write here: each copy is
+  flushed as it is made, the manifest by a durable write, then every folder of the point up to `restore/<pairing>`, so a
+  crash right after a bring-back never finds the folder rewritten and the copies empty. Files put in the folder are
+  flushed before the rename that places them.
+- **Retention**, after each bring-back and under its lock: a pairing keeps its newest 20 points that hold files, plus
+  every such point younger than 30 days. A point that holds nothing (a bring-back that wrote nothing, or one cut off
+  before its manifest) never counts toward the 20, is never listed, and goes at the next bring-back. Until then it is
+  the `point` that bring-back answered with, so that answer always names a real point, as the desktop app expects.
+- **`sync restore --point <id>`** puts each backed-up file back and removes each file bring-back added, where the
+  folder still holds exactly what bring-back left (by sha256). Anything else is skipped and reported, one already put
+  back included. Copy-first then carries the restored files to the sandbox, as it does any edit here, so the agent's
+  versions they replace are gone from there too.
+- One bring-back or restore runs per folder at a time (`restore/<pairing>/.operation.pid`, a pid of this boot, checked
+  alive). A pause an operation made and never lifted (the process killed in between) is recorded in
+  `restore/<pairing>/.paused`, and the next command about that folder resumes the session.
+
+### Upgrades that can be undone
+
+- **A swap is never cut short by this agent.** `ic` runs in a process group of its own on POSIX, keeps its pipes, and
+  is never killed when the link or request that asked for it goes away. Every restart of the agent (the auto-upgrade
+  tick, `upgrade`, `run`, the browser's Update and Restart) waits while any channel record in this environment's ic
+  home (`INTENTIC_HOME`, else `~/.intentic`) says `swap_phase=cutover` with `swap_at` in the last 30 minutes, or while
+  this process runs a flow that moves a container ([`device/sandbox-rounds/swap-records.ts`](src/device/sandbox-rounds/swap-records.ts)); the tick
+  looks again in five minutes, a command waits and says so.
+- **The probation watch** ([`device/sandbox-rounds/probation-watch.ts`](src/device/sandbox-rounds/probation-watch.ts)) runs
+  `ic sandbox watch <slug> --json` every minute for each sandbox whose record names a `swap_phase`, and
+  `ic sandbox watch --json` over every sandbox half a minute after start (a reboot mid-swap) and every ten minutes.
+  ic finishes or undoes an interrupted cutover and rolls a failing new version back; the agent logs what it did.
+  The per-record watch runs in every environment, since only the environment that swapped holds the record; the sweep
+  over every sandbox runs on the root only, as the daily jobs below do, because a WSL distro shares the Windows
+  side's Docker engine.
+- **Daily**, on the root: `ic sandbox backup <slug> --auto --json` for each running sandbox, one at a time, twenty to
+  forty minutes after start and then every day, then one `ic sandbox tidy --json`, whose volumes nobody claims are
+  named and never deleted. Both back off from a slug that keeps failing, as auto-prepare does, and each has its switch
+  beside the update ones (`intentic-machine updates --backups off`, `--tidy off`).
+- **File sync holds still while its sandbox is swapped here** ([`sync/swap-pause.ts`](src/sync/swap-pause.ts)). A
+  pairing's local slug is the first label of its sandbox's public hostname (what ic names a sandbox with one) or the
+  id in it (what ic names one from its connect token), so the mapping is exact. Its sessions are paused through the
+  cutover and the first quarter hour of probation, and past that while the sandbox does not answer, then resumed; a
+  pause somebody made is left alone. Only this environment's records count: a distro syncing a sandbox the Windows side
+  swaps is not paused.
+- **A self-update is kept undoable** ([`agent-trial.ts`](src/agent-trial.ts)). The replaced binary stays as
+  `<bin>.previous` until the new agent has run for ten minutes and written its "healthy since" marker. Three starts of a
+  release within ten minutes, none ended by a stop, restart or upgrade, put `.previous` back (at that start, or at the
+  next upgrade pass) and record the release as `skippedAgent` in `machine.json`: neither the auto-upgrade nor an
+  `upgrade` moves this environment onto it again until a newer one is published (`upgrade --force` does). A restart
+  that throws during an upgrade puts the old binary back too.
+- **What the agent leaves behind.** Under a systemd user unit the default `KillMode` ended the unit's whole cgroup on
+  every `systemctl stop` and every agent exit, `ic` mid-swap included: the unit now says `KillMode=process`, and a
+  unit an older build wrote is rewritten at the agent's next start, since a repair now replaces an entry that starts
+  this same agent with other settings. What outlives the agent on purpose is `ic` (bounded by its own swap), Mutagen's
+  daemon and the browser it opened; what must not, the agent ends itself: every `run_command` group still running
+  when it stops, and on Linux the groups a crashed agent left, which the next agent ends at its start
+  ([`tools/command-ledger.ts`](src/device/tools/command-ledger.ts)). The login entries of the two agents this one
+  replaced on 2026-08-29 (`intentic-host`, the sync mirror) are removed once, at start.
+- `intentic-machine sandbox <verb> [slug]` passes `list`, `start`, `stop`, `restart`, `update`, `rollback [--to]`,
+  `versions`, `logs`, `doctor`, `watch`, `backup` and `backups` straight to ic, in this terminal, with ic's exit code:
+  a sandbox can be looked at and repaired from here when no browser reaches it.
+
 ## Key files
 
-- [src/commands.ts](src/commands.ts) — the CLI: `device`, `sync`, `run`, `status`, `upgrade`, `uninstall`.
+- [src/commands.ts](src/commands.ts) — the CLI: `device`, `sync`, `sandbox`, `run`, `status`, `upgrade`, `updates`, `uninstall`.
 - [src/resident.ts](src/resident.ts) — the resident process that holds links, pairings and WSL distros.
 - [src/device/mcp.ts](src/device/mcp.ts) — every tool a sandbox can call on this device.
 - [src/device/policy.ts](src/device/policy.ts) — scope checks and the file-root boundary.

package/dist/agent-trial.d.ts

@@ -0,0 +1,25 @@
+import type { Log } from "@intentic/local-agent";
+import { z } from "zod";
+export declare const HEALTHY_AFTER_MS: number;
+export declare const CRASH_LOOP_STARTS = 3;
+declare const StartLedgerSchema: z.ZodObject<{
+    version: z.ZodString;
+    starts: z.ZodArray<z.ZodObject<{
+        at: z.ZodNumber;
+        pid: z.ZodNumber;
+        clean: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type StartLedger = z.infer<typeof StartLedgerSchema>;
+export declare const withStart: (ledger: StartLedger | undefined, version: string, pid: number, now: number) => StartLedger;
+export declare const withCleanExit: (ledger: StartLedger, pid: number) => StartLedger;
+export declare const crashLooping: (ledger: StartLedger, healthy: string | undefined, now: number) => boolean;
+export declare const recordStopped: (pid: number) => Promise<void>;
+export interface Trial {
+    readonly clean: () => Promise<void>;
+    readonly prove: (log: Log) => () => void;
+}
+export declare const beginTrial: (log: Log) => Promise<Trial | "restored">;
+export declare const rollBackIfCrashLooping: (log: Log) => Promise<boolean>;
+export {};
+//# sourceMappingURL=agent-trial.d.ts.map

package/dist/agent-trial.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-trial.d.ts","sourceRoot":"","sources":["../src/agent-trial.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,eAAO,MAAM,gBAAgB,QAAc,CAAC;AAE5C,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAOnC,QAAA,MAAM,iBAAiB;;;;;;;iBAAkE,CAAC;AAC1F,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAK5D,eAAO,MAAM,SAAS,WAAY,WAAW,GAAG,SAAS,WAAW,MAAM,OAAO,MAAM,OAAO,MAAM,KAAG,WAGrG,CAAC;AAIH,eAAO,MAAM,aAAa,WAAY,WAAW,OAAO,MAAM,KAAG,WAG/D,CAAC;AAIH,eAAO,MAAM,YAAY,WAAY,WAAW,WAAW,MAAM,GAAG,SAAS,OAAO,MAAM,KAAG,OAC2D,CAAC;AAoBzJ,eAAO,MAAM,aAAa,QAAe,MAAM,KAAG,OAAO,CAAC,IAAI,CAM7D,CAAC;AAiEF,MAAM,WAAW,KAAK;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpC,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,IAAI,CAAC;CAC5C;AAOD,eAAO,MAAM,UAAU,QAAe,GAAG,KAAG,OAAO,CAAC,KAAK,GAAG,UAAU,CAsBrE,CAAC;AAIF,eAAO,MAAM,sBAAsB,QAAe,GAAG,KAAG,OAAO,CAAC,OAAO,CAMtE,CAAC"}

package/dist/agent-trial.js

@@ -0,0 +1,132 @@
+import { existsSync } from "node:fs";
+import { readFile, rename, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { errorMessage } from "@intentic/base/errors";
+import { writeFileAtomic } from "@intentic/base/fs";
+import { DEV_VERSION } from "@intentic/sandbox-contract";
+import { z } from "zod";
+import { baseDir } from "./config.js";
+import { readMachineConfig, updateMachineConfig } from "./environments/machine.js";
+import { installedBuild, runningAsInstalledAgent } from "./installed.js";
+import { agentPath, launcherPath, renameIfPresent } from "./release.js";
+import { MACHINE_VERSION } from "./version.js";
+export const HEALTHY_AFTER_MS = 10 * 60_000;
+export const CRASH_LOOP_STARTS = 3;
+const startsPath = join(baseDir, "agent-starts.json");
+const healthyPath = join(baseDir, "agent-healthy.json");
+const StartSchema = z.object({ at: z.number(), pid: z.number(), clean: z.boolean().optional() });
+const StartLedgerSchema = z.object({ version: z.string(), starts: z.array(StartSchema) });
+const HealthySchema = z.object({ version: z.string(), since: z.number() });
+export const withStart = (ledger, version, pid, now) => ({
+    version,
+    starts: [...(ledger?.version === version ? ledger.starts.filter((start) => now - start.at < HEALTHY_AFTER_MS) : []), { at: now, pid }],
+});
+export const withCleanExit = (ledger, pid) => ({
+    ...ledger,
+    starts: ledger.starts.map((start) => (start.pid === pid ? { ...start, clean: true } : start)),
+});
+export const crashLooping = (ledger, healthy, now) => ledger.version !== healthy && ledger.starts.filter((start) => start.clean !== true && now - start.at < HEALTHY_AFTER_MS).length >= CRASH_LOOP_STARTS;
+const readJson = async (path, schema) => {
+    const raw = await readFile(path, "utf8").catch(() => undefined);
+    try {
+        const parsed = raw === undefined ? undefined : schema.safeParse(JSON.parse(raw));
+        return parsed?.success === true ? parsed.data : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+const readLedger = async () => await readJson(startsPath, StartLedgerSchema);
+const readHealthyVersion = async () => (await readJson(healthyPath, HealthySchema))?.version;
+const writeLedger = async (ledger) => await writeFileAtomic(startsPath, JSON.stringify(ledger));
+export const recordStopped = async (pid) => {
+    const ledger = await readLedger();
+    if (ledger !== undefined) {
+        await writeLedger(withCleanExit(ledger, pid)).catch(() => undefined);
+    }
+};
+const previousOf = (target) => `${target}.previous`;
+const putBack = async (target) => {
+    if (!existsSync(previousOf(target))) {
+        return;
+    }
+    const aside = `${target}.old`;
+    await renameIfPresent(target, aside);
+    try {
+        await rename(previousOf(target), target);
+    }
+    catch (error) {
+        await renameIfPresent(aside, target);
+        throw error;
+    }
+};
+const rollBack = async (version, log) => {
+    try {
+        await putBack(launcherPath);
+        await putBack(agentPath);
+    }
+    catch (error) {
+        log(`the agent ${version} keeps stopping, but the one before it could not be put back (${errorMessage(error)}).`);
+        return false;
+    }
+    try {
+        await updateMachineConfig((config) => ({ ...config, skippedAgent: { version, at: Date.now() } }));
+    }
+    catch (error) {
+        log(`could not record ${version} as skipped (${errorMessage(error)}); an upgrade may offer it again.`);
+    }
+    log(`the agent ${version} stopped ${CRASH_LOOP_STARTS} times within ${HEALTHY_AFTER_MS / 60_000} minutes of starting, so the one it replaced is back in its place. ${version} is skipped here until a newer release is published.`);
+    return true;
+};
+const markHealthy = async (version, since, log) => {
+    try {
+        await proven(version, since, log);
+    }
+    catch (error) {
+        log(`could not record the agent ${version} as healthy (${errorMessage(error)}).`);
+    }
+};
+const proven = async (version, since, log) => {
+    await writeFileAtomic(healthyPath, JSON.stringify({ version, since }));
+    const kept = [previousOf(agentPath), previousOf(launcherPath)].filter((path) => existsSync(path));
+    await Promise.all(kept.map(async (path) => await rm(path, { force: true })));
+    if (kept.length > 0) {
+        log(`the agent ${version} has run for ${HEALTHY_AFTER_MS / 60_000} minutes, so the copy of the one before it, kept to undo this update, is dropped.`);
+    }
+    if ((await readMachineConfig().catch(() => undefined))?.skippedAgent?.version === version) {
+        await updateMachineConfig(({ skippedAgent: _lifted, ...rest }) => rest);
+    }
+};
+const INERT = { clean: async () => await Promise.resolve(), prove: () => () => undefined };
+export const beginTrial = async (log) => {
+    if (!runningAsInstalledAgent() || MACHINE_VERSION === DEV_VERSION) {
+        return INERT;
+    }
+    const startedAt = Date.now();
+    const ledger = withStart(await readLedger(), MACHINE_VERSION, process.pid, startedAt);
+    try {
+        await writeLedger(ledger);
+    }
+    catch (error) {
+        log(`could not record this start (${errorMessage(error)}); a crash loop of this release goes unnoticed until it can.`);
+    }
+    if (crashLooping(ledger, await readHealthyVersion(), startedAt) && existsSync(previousOf(agentPath)) && (await rollBack(MACHINE_VERSION, log))) {
+        return "restored";
+    }
+    return {
+        clean: async () => await recordStopped(process.pid),
+        prove: (say) => {
+            const timer = setTimeout(() => void markHealthy(MACHINE_VERSION, startedAt, say), HEALTHY_AFTER_MS);
+            timer.unref();
+            return () => clearTimeout(timer);
+        },
+    };
+};
+export const rollBackIfCrashLooping = async (log) => {
+    const ledger = await readLedger();
+    if (ledger === undefined || !existsSync(previousOf(agentPath)) || installedBuild() !== ledger.version) {
+        return false;
+    }
+    return crashLooping(ledger, await readHealthyVersion(), Date.now()) && (await rollBack(ledger.version, log));
+};
+//# sourceMappingURL=agent-trial.js.map

package/dist/agent-trial.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-trial.js","sourceRoot":"","sources":["../src/agent-trial.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAU/C,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAEnC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AACtD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;AAExD,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEjG,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAG1F,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAG3E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAA+B,EAAE,OAAe,EAAE,GAAW,EAAE,GAAW,EAAe,EAAE,CAAC,CAAC;IACnH,OAAO;IACP,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;CACzI,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAmB,EAAE,GAAW,EAAe,EAAE,CAAC,CAAC;IAC7E,GAAG,MAAM;IACT,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;CAChG,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAmB,EAAE,OAA2B,EAAE,GAAW,EAAW,EAAE,CACnG,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC,MAAM,IAAI,iBAAiB,CAAC;AAEzJ,MAAM,QAAQ,GAAG,KAAK,EAAK,IAAY,EAAE,MAAoB,EAA0B,EAAE;IAErF,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAChE,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,OAAO,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QAEL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,KAAK,IAAsC,EAAE,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;AAC/G,MAAM,kBAAkB,GAAG,KAAK,IAAiC,EAAE,CAAC,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC;AAC1H,MAAM,WAAW,GAAG,KAAK,EAAE,MAAmB,EAAiB,EAAE,CAAC,MAAM,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAI5H,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;IAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAEvB,MAAM,WAAW,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzE,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,MAAM,WAAW,CAAC;AAIpE,MAAM,OAAO,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;IACpD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAClC,OAAO;IACX,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,MAAM,MAAM,CAAC;IAC9B,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC;QACD,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC,CAAC;AAIF,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAe,EAAE,GAAQ,EAAoB,EAAE;IACnE,IAAI,CAAC;QACD,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;QAC5B,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,GAAG,CAAC,aAAa,OAAO,iEAAiE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClH,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,mBAAmB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACtG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,GAAG,CAAC,oBAAoB,OAAO,gBAAgB,YAAY,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC3G,CAAC;IACD,GAAG,CACC,aAAa,OAAO,YAAY,iBAAiB,iBAAiB,gBAAgB,GAAG,MAAM,sEAAsE,OAAO,sDAAsD,CACjO,CAAC;IACF,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAIF,MAAM,WAAW,GAAG,KAAK,EAAE,OAAe,EAAE,KAAa,EAAE,GAAQ,EAAiB,EAAE;IAClF,IAAI,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,GAAG,CAAC,8BAA8B,OAAO,gBAAgB,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtF,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,KAAK,EAAE,OAAe,EAAE,KAAa,EAAE,GAAQ,EAAiB,EAAE;IAC7E,MAAM,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAClG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClB,GAAG,CAAC,aAAa,OAAO,gBAAgB,gBAAgB,GAAG,MAAM,mFAAmF,CAAC,CAAC;IAC1J,CAAC;IAED,IAAI,CAAC,MAAM,iBAAiB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,KAAK,OAAO,EAAE,CAAC;QACxF,MAAM,mBAAmB,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;AACL,CAAC,CAAC;AASF,MAAM,KAAK,GAAU,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;AAKlG,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,GAAQ,EAA+B,EAAE;IACtE,IAAI,CAAC,uBAAuB,EAAE,IAAI,eAAe,KAAK,WAAW,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,UAAU,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACtF,IAAI,CAAC;QACD,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,GAAG,CAAC,gCAAgC,YAAY,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC3H,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,EAAE,MAAM,kBAAkB,EAAE,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7I,OAAO,UAAU,CAAC;IACtB,CAAC;IACD,OAAO;QACH,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;QACnD,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,WAAW,CAAC,eAAe,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,gBAAgB,CAAC,CAAC;YACpG,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;KACJ,CAAC;AACN,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,GAAQ,EAAoB,EAAE;IACvE,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,cAAc,EAAE,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;QACpG,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,EAAE,MAAM,kBAAkB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;AACjH,CAAC,CAAC"}

package/dist/autostart/autostart.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"autostart.d.ts","sourceRoot":"","sources":["../../src/autostart/autostart.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAM3D,eAAO,MAAM,iBAAiB,EAAE,aAY/B,CAAC"}

package/dist/{autostart.js → autostart/autostart.js}

@@ -1,4 +1,4 @@
-import { runLogPath } from "./config.js";
+import { runLogPath } from "../config.js";
 export const MACHINE_AUTOSTART = {
     id: "intentic-machine",
     windowsRunValue: "IntenticMachine",

package/dist/autostart/autostart.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"autostart.js","sourceRoot":"","sources":["../../src/autostart/autostart.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAK1C,MAAM,CAAC,MAAM,iBAAiB,GAAkB;IAC5C,EAAE,EAAE,kBAAkB;IACtB,eAAe,EAAE,iBAAiB;IAClC,WAAW,EAAE,wBAAwB;IACrC,cAAc,EAAE,yFAAyF;IAEzG,OAAO,EAAE,UAAU;IACnB,WAAW,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE;IAC9C,YAAY,EAAE,CAAC,KAAK,CAAC;IACrB,cAAc,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC;IACvC,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CACpB,mEAAmE,MAAM,uFAAuF,UAAU,EAAE;CACnL,CAAC"}

package/dist/autostart/legacy-autostart.d.ts

@@ -0,0 +1,4 @@
+import { type AutostartSpec, type Log } from "@intentic/local-agent";
+export declare const LEGACY_AUTOSTART: readonly AutostartSpec[];
+export declare const retireLegacyAutostart: (log: Log) => Promise<void>;
+//# sourceMappingURL=legacy-autostart.d.ts.map

package/dist/autostart/legacy-autostart.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-autostart.d.ts","sourceRoot":"","sources":["../../src/autostart/legacy-autostart.ts"],"names":[],"mappings":"AAGA,OAAO,EAAa,KAAK,aAAa,EAAE,KAAK,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAwBhF,eAAO,MAAM,gBAAgB,EAAE,SAAS,aAAa,EAGpD,CAAC;AAMF,eAAO,MAAM,qBAAqB,QAAe,GAAG,KAAG,OAAO,CAAC,IAAI,CAWlE,CAAC"}

package/dist/autostart/legacy-autostart.js

@@ -0,0 +1,33 @@
+import { existsSync } from "node:fs";
+import { writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { autostart } from "@intentic/local-agent";
+import { baseDir } from "../config.js";
+import { machineLauncher } from "../supervision.js";
+const retired = (id, windowsRunValue) => ({
+    id,
+    windowsRunValue,
+    desktopName: id,
+    desktopComment: `retired: ${id}`,
+    logPath: join(baseDir, `${id}.log`),
+    detachedArgs: [],
+    foregroundArgs: [],
+    failureNote: (reason) => reason,
+});
+export const LEGACY_AUTOSTART = [
+    retired("intentic-host", "IntenticHost"),
+    { ...retired("intentic-sync-mirror", "IntenticSyncMirror"), launchAgent: { label: "dev.intentic.sync-mirror" } },
+];
+const retiredPath = join(baseDir, "legacy-autostart-retired");
+export const retireLegacyAutostart = async (log) => {
+    if (existsSync(retiredPath)) {
+        return;
+    }
+    const quiet = () => undefined;
+    for (const spec of LEGACY_AUTOSTART) {
+        await autostart(spec, machineLauncher(), quiet).unregister();
+    }
+    await writeFile(retiredPath, `${new Date().toISOString()}\n`, { mode: 0o600 });
+    log("removed the login entries intentic-host and intentic-sync's mirror left before they became this agent, wherever any were left.");
+};
+//# sourceMappingURL=legacy-autostart.js.map

package/dist/autostart/legacy-autostart.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-autostart.js","sourceRoot":"","sources":["../../src/autostart/legacy-autostart.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAgC,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AASpD,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,eAAuB,EAAiB,EAAE,CAAC,CAAC;IACrE,EAAE;IACF,eAAe;IACf,WAAW,EAAE,EAAE;IACf,cAAc,EAAE,YAAY,EAAE,EAAE;IAChC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC;IACnC,YAAY,EAAE,EAAE;IAChB,cAAc,EAAE,EAAE;IAClB,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM;CAClC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAA6B;IACtD,OAAO,CAAC,eAAe,EAAE,cAAc,CAAC;IACxC,EAAE,GAAG,OAAO,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE;CACnH,CAAC;AAGF,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EAAE,GAAQ,EAAiB,EAAE;IACnE,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1B,OAAO;IACX,CAAC;IACD,MAAM,KAAK,GAAQ,GAAG,EAAE,CAAC,SAAS,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAElC,MAAM,SAAS,CAAC,IAAI,EAAE,eAAe,EAAE,EAAE,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,SAAS,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,GAAG,CAAC,gIAAgI,CAAC,CAAC;AAC1I,CAAC,CAAC"}

package/dist/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAkGjF,eAAO,MAAM,QAAQ,kDAmBnB,CAAC"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAoGjF,eAAO,MAAM,QAAQ,kDAoBnB,CAAC"}

package/dist/commands.js

@@ -1,5 +1,6 @@
 import { buildCommand, buildRouteMap } from "@stricli/core";
 import { deviceCommands, deviceUninstall } from "./device/commands.js";
+import { sandboxRoutes } from "./device/sandbox-cli.js";
 import { environmentRoutes, updates } from "./environments/commands.js";
 import { realMachineIo, upgradeMachine } from "./environments/machine-upgrade.js";
 import { runForeground } from "./resident.js";
@@ -46,7 +47,7 @@ const upgrade = buildCommand({
         flags: {
             force: {
                 kind: "boolean",
-                brief: "Install the published agent even over one built from source (which is otherwise left alone)",
+                brief: "Install the published agent even over one built from source, or onto a release this machine rolled back from (both otherwise left alone)",
             },
             level: { kind: "boolean", brief: "Bring every side to the newest release one of them already runs, without asking for a newer one", default: false, hidden: true },
         },
@@ -81,6 +82,7 @@ export const commands = buildRouteMap({
             routes: syncCommands,
             docs: { brief: "Mirror a sandbox's files and ports onto this machine (the Desktop sync card)" },
         }),
+        sandbox: sandboxRoutes,
         environment: environmentRoutes,
         run,
         status,

package/dist/commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAuB,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAU/C,MAAM,GAAG,GAAG,YAAY,CAAW;IAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,wGAAwG,EAAE;IACzH,UAAU,EAAE;QACR,KAAK,EAAE;YACH,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,0DAA0D,EAAE;YAClG,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,2BAA2B,EAAE;SAChE;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAe;QAC5C,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;YACjC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;YAElE,GAAG,CAAC,sJAAsJ,CAAC,CAAC;YAC5J,OAAO;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;YAClC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,IAAI,eAAe,IAAI,CAAC,CAAC;YAC5I,OAAO;QACX,CAAC;QAED,MAAM,aAAa,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC;IACnH,CAAC;CACJ,CAAC,CAAC;AAGH,MAAM,OAAO,GAAG,YAAY,CAAC;IACzB,IAAI,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE;IAC7C,UAAU,EAAE,EAAE;IACd,IAAI;QACA,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,IAAI,CAAC,CAAC;QAClD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;CACJ,CAAC,CAAC;AAQH,MAAM,OAAO,GAAG,YAAY,CAAe;IACvC,IAAI,EAAE,EAAE,KAAK,EAAE,oGAAoG,EAAE;IACrH,UAAU,EAAE;QACR,KAAK,EAAE;YACH,KAAK,EAAE;gBACH,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,6FAA6F;aACvG;YACD,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,iGAAiG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;SACrK;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAmB;QAChD,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACzB,CAAC;IACL,CAAC;CACJ,CAAC,CAAC;AAGH,MAAM,SAAS,GAAG,YAAY,CAAC;IAC3B,IAAI,EAAE,EAAE,KAAK,EAAE,0FAA0F,EAAE;IAC3G,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,IAAI;QACN,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;QACnC,GAAG,CACC,KAAK,KAAK,SAAS;YACf,CAAC,CAAC,uCAAuC;YACzC,CAAC,CAAC,gCAAgC,KAAK,CAAC,GAAG,oGAAoG,CACtJ,CAAC;IACN,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC;IAClC,MAAM,EAAE;QACJ,MAAM,EAAE,aAAa,CAAC;YAClB,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,EAAE,KAAK,EAAE,kEAAkE,EAAE;SACtF,CAAC;QACF,IAAI,EAAE,aAAa,CAAC;YAChB,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,EAAE,KAAK,EAAE,8EAA8E,EAAE;SAClG,CAAC;QACF,WAAW,EAAE,iBAAiB;QAC9B,GAAG;QACH,MAAM;QACN,OAAO;QACP,OAAO;QACP,OAAO;QACP,SAAS;KACZ;IACD,IAAI,EAAE,EAAE,KAAK,EAAE,kEAAkE,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;CACxH,CAAC,CAAC"}
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAuB,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAW/C,MAAM,GAAG,GAAG,YAAY,CAAW;IAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,wGAAwG,EAAE;IACzH,UAAU,EAAE;QACR,KAAK,EAAE;YACH,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,0DAA0D,EAAE;YAClG,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,2BAA2B,EAAE;SAChE;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAe;QAC5C,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;YACjC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;YAElE,GAAG,CAAC,sJAAsJ,CAAC,CAAC;YAC5J,OAAO;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;YAClC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,IAAI,eAAe,IAAI,CAAC,CAAC;YAC5I,OAAO;QACX,CAAC;QAED,MAAM,aAAa,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC;IACnH,CAAC;CACJ,CAAC,CAAC;AAGH,MAAM,OAAO,GAAG,YAAY,CAAC;IACzB,IAAI,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE;IAC7C,UAAU,EAAE,EAAE;IACd,IAAI;QACA,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,IAAI,CAAC,CAAC;QAClD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;CACJ,CAAC,CAAC;AAQH,MAAM,OAAO,GAAG,YAAY,CAAe;IACvC,IAAI,EAAE,EAAE,KAAK,EAAE,oGAAoG,EAAE;IACrH,UAAU,EAAE;QACR,KAAK,EAAE;YACH,KAAK,EAAE;gBACH,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,0IAA0I;aACpJ;YACD,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,iGAAiG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;SACrK;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAmB;QAChD,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACzB,CAAC;IACL,CAAC;CACJ,CAAC,CAAC;AAGH,MAAM,SAAS,GAAG,YAAY,CAAC;IAC3B,IAAI,EAAE,EAAE,KAAK,EAAE,0FAA0F,EAAE;IAC3G,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,IAAI;QACN,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACtF,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;QACnC,GAAG,CACC,KAAK,KAAK,SAAS;YACf,CAAC,CAAC,uCAAuC;YACzC,CAAC,CAAC,gCAAgC,KAAK,CAAC,GAAG,oGAAoG,CACtJ,CAAC;IACN,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC;IAClC,MAAM,EAAE;QACJ,MAAM,EAAE,aAAa,CAAC;YAClB,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,EAAE,KAAK,EAAE,kEAAkE,EAAE;SACtF,CAAC;QACF,IAAI,EAAE,aAAa,CAAC;YAChB,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,EAAE,KAAK,EAAE,8EAA8E,EAAE;SAClG,CAAC;QACF,OAAO,EAAE,aAAa;QACtB,WAAW,EAAE,iBAAiB;QAC9B,GAAG;QACH,MAAM;QACN,OAAO;QACP,OAAO;QACP,OAAO;QACP,SAAS;KACZ;IACD,IAAI,EAAE,EAAE,KAAK,EAAE,kEAAkE,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;CACxH,CAAC,CAAC"}