@intentic/sandbox-contract 1.209.0 → 1.210.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentic/sandbox-contract",
-  "version": "1.209.0",
+  "version": "1.210.0",
   "description": "oRPC wire contract for the intentic sandbox daemon — shared by the daemon and its browser client",
   "license": "MIT",
   "type": "module",
@@ -89,9 +89,9 @@
     "@orpc/contract": "1.14.13",
     "tslib": "2.8.1",
     "zod": "4.4.3",
-    "@intentic/constants": "1.209.0",
-    "@intentic/extension-manifest": "1.209.0",
-    "@intentic/registry": "1.209.0"
+    "@intentic/constants": "1.210.0",
+    "@intentic/extension-manifest": "1.210.0",
+    "@intentic/registry": "1.210.0"
   },
   "devDependencies": {
     "@types/node": "24.13.2",

package/src/conversation-ids.test.ts

@@ -1,7 +1,25 @@
-import { expect, test } from "vitest";
+import { afterEach, expect, test, vi } from "vitest";
 import { newConversationId } from "./conversation-ids.js";
 import { ConversationIdSchema } from "./schemas.js";
 
+const mockRandomValues = (values: readonly number[]) => {
+    const remaining = [...values];
+    const getRandomValues = vi.spyOn(crypto, "getRandomValues").mockImplementation(<T extends ArrayBufferView | null>(array: T): T => {
+        if (!(array instanceof Uint32Array)) {
+            throw new TypeError(`Expected a Uint32Array`);
+        }
+        const value = remaining.shift();
+        if (value === undefined) {
+            throw new Error(`No mocked random value remains`);
+        }
+        array[0] = value;
+        return array;
+    });
+    return { getRandomValues, remaining };
+};
+
+afterEach(() => vi.restoreAllMocks());
+
 // The one property that is not a matter of taste: this string becomes a git branch and a filesystem path, and
 // the id guard is what stands between those and an injection. Held over a large sample rather than one draw,
 // because the generator picks from three independent spaces and any of them could produce the bad character.
@@ -18,6 +36,24 @@ test("an id reads as a word pair with a short tail, and stays short", () => {
     expect(id.length).toBeLessThan(24);
 });
 
+test("retries a random draw outside the last complete bucket", () => {
+    const bucketSize = Math.floor(2 ** 32 / 36);
+    const { getRandomValues, remaining } = mockRandomValues([0, 0, 0xffff_ffff, 0, bucketSize, bucketSize * 2, bucketSize * 3]);
+
+    expect(newConversationId()).toBe(`amber-alder-0123`);
+    expect(getRandomValues).toHaveBeenCalledTimes(7);
+    expect(remaining).toEqual([]);
+});
+
+test("maps complete random buckets to equal-width base36 characters", () => {
+    const bucketSize = Math.floor(2 ** 32 / 36);
+    const limit = bucketSize * 36;
+    const { remaining } = mockRandomValues([0, 0, bucketSize - 1, bucketSize, bucketSize * 35, limit - 1]);
+
+    expect(newConversationId()).toBe(`amber-alder-01zz`);
+    expect(remaining).toEqual([]);
+});
+
 // The tail is what makes the readable half safe to repeat: names may rhyme, ids may not.
 test("ids are unique across a burst", () => {
     const ids = new Set(Array.from({ length: 5_000 }, newConversationId));

package/src/conversation-ids.ts

@@ -146,14 +146,27 @@ const NOUNS = [
 // collision far past the life of any workspace, and is still short enough to be ignored while reading.
 const TAIL_LENGTH = 4;
 
+// A Uint32Array draw has 2^32 possible values. Reject the short remainder above the last full bucket before
+// dividing it into `upperBound` equal ranges; folding that remainder back with `%` makes its first few answers
+// slightly more likely, which is exactly the bias a CSPRNG is meant to avoid.
+const UINT32_RANGE = 0x1_0000_0000;
+const randomBelow = (upperBound: number): number => {
+    const bucketSize = Math.floor(UINT32_RANGE / upperBound);
+    const limit = bucketSize * upperBound;
+    while (true) {
+        const value = crypto.getRandomValues(new Uint32Array(1))[0]!;
+        if (value < limit) {
+            return Math.floor(value / bucketSize);
+        }
+    }
+};
+
 // Uniform over the array, drawn from the platform CSPRNG — `Math.random()` is seeded per process, and two
 // browser tabs opened in the same instant are exactly the case this must not produce the same name for.
-const pick = <T>(values: readonly T[]): T => values[randomInts(1)[0]! % values.length]!;
-
-const randomInts = (count: number): Uint32Array => crypto.getRandomValues(new Uint32Array(count));
+const pick = <T>(values: readonly T[]): T => values[randomBelow(values.length)]!;
 
-// Lowercase base36, one character per drawn word — 0-9a-z, all of which the id guard accepts.
-const tail = (): string => Array.from(randomInts(TAIL_LENGTH), (value) => (value % 36).toString(36)).join("");
+// Lowercase base36, one character per draw — 0-9a-z, all of which the id guard accepts.
+const tail = (): string => Array.from({ length: TAIL_LENGTH }, () => randomBelow(36).toString(36)).join("");
 
 /* A fresh conversation id: `<adjective>-<noun>-<tail>`, e.g. `swift-otter-k9m2`. Sixteen characters or so
  * against a UUID's thirty-six, and the first eleven of them are the ones a person reads. */

package/src/schemas.ts

@@ -5379,14 +5379,19 @@ export type MachineSandbox = z.infer<typeof MachineSandboxSchema>;
 /* ONE OPERATION ON ONE SANDBOX ON ONE MACHINE — the Computers view's buttons, and the only thing that changes a
  * machine's fleet from a browser.
  *
- * All seven ops travel one route because they are one decision to the person clicking, however differently they
- * behave underneath: three are a docker call that returns in a second, three run the `ic` flow for minutes, and
- * one deletes. Splitting them by duration would put the same button on two doors and give the view two shapes to
- * render. So every op answers as a STREAM of lines ending in a result — the fast ones simply have little to say.
- *
- * The machine enforces which of them it will do: `sandboxes` covers the first six, removal takes its own switch,
- * and a refusal comes back as the machine's own sentence naming the control to flip. */
-export const MachineSandboxOpSchema = z.enum(["start", "stop", "restart", "update", "rebuild", "rollback", "remove"]);
+ * All eight ops travel one route because they are one decision to the person clicking, however differently they
+ * behave underneath: three are a docker call that returns in a second, three run the `ic` flow for minutes, one
+ * deletes, and one only reads. Splitting them by duration would put the same button on two doors and give the
+ * view two shapes to render. So every op answers as a STREAM of lines ending in a result — the fast ones simply
+ * have little to say, and `logs` is the case where the lines ARE the answer.
+ *
+ * `logs` is here rather than on a route of its own for the same reason: it is a button in the same row as the
+ * other seven, on a container that may be too broken to answer any other way, and the stream shape already
+ * carries "many lines, then an outcome" exactly as a log tail wants to arrive.
+ *
+ * The machine enforces which of them it will do: `sandboxes` covers the first six and the log tail, removal takes
+ * its own switch, and a refusal comes back as the machine's own sentence naming the control to flip. */
+export const MachineSandboxOpSchema = z.enum(["start", "stop", "restart", "update", "rebuild", "rollback", "remove", "logs"]);
 export type MachineSandboxOp = z.infer<typeof MachineSandboxOpSchema>;
 
 export const MachineSandboxFlowSchema = z.object({
@@ -5554,8 +5559,12 @@ export const ComputersListSchema = z.object({ computers: z.array(ComputerSchema)
 // routinely newer than the daemon it is pointed at during a rolling update.
 export const SyncStatusSchema = z.object({
     enrolled: z.boolean(),
-    // Absent when this sandbox has no SSH tunnel (loopback/preview) — which the card reads as "sync unavailable".
-    sshHostname: z.string().optional(),
+    /* Whether this sandbox can do desktop sync at all. It used to be the SSH hostname the laptop would dial, and
+     * its absence meant "this sandbox's reachability can't carry SSH" — true of every sandbox on the platform's
+     * own fabric, which is what made sync fail on the default path. The transport rides the daemon's own HTTPS
+     * surface now, so a sandbox that can answer this read can also sync. Kept as a field rather than assumed,
+     * because the card branches on it and a daemon too old to say is one that should not be offered sync. */
+    available: z.boolean().optional(),
     // The single machine holding file sync, and when its heartbeat last landed.
     syncingFrom: z.string().optional(),
     syncSeenAt: z.number().optional(),