@intentic/sandbox-contract 1.217.0 → 1.218.0

package/src/schemas.ts

@@ -185,7 +185,7 @@ export const AgentTurnSchema = z
         // first turn keeps its user-chosen title); an existing entry's title always wins.
         title: z.string().max(80).optional(),
         // Workspace-relative paths of files the user attached, already uploaded via /workspace/upload
-        // (the browser puts them under .intentic/artifacts/attachments/<uuid>/<name>). The daemon hands them to the
+        // (the browser puts them under .intentic/records/artifacts/attachments/<uuid>/<name>). The daemon hands them to the
         // provider: Claude reads them from disk via its Read tool; Codex gets images as native inputs.
         attachments: z.array(z.string().min(1)).max(20).optional(),
         // Which provider (model + account) serves the turn; absent = claude. A sessionId only resumes on the
@@ -278,7 +278,7 @@ export const AgentTurnSchema = z
          * It is the birth half of the turn's taint (guard/turn-taint.ts). The other half marks itself as the
          * turn works — a fetched page, a foreign MCP server's answer — and together they are what the command
          * gate reads before letting a command read credential material unasked. Distinct from `unattended`,
-         * which is about whether anyone is WATCHING: a Doorbell wake is both, an owner asking the agent to read
+         * which is about whether anyone is WATCHING: a Front Desk wake is both, an owner asking the agent to read
          * a web page is neither, and each flag governs a different decision. */
         outsideWake: z.string().min(1).optional(),
         // How tool calls are gated for this turn (the SDK's permissionMode, verbatim). 'plan' runs the
@@ -289,7 +289,7 @@ export const AgentTurnSchema = z
         /* Narrows the turn to these tool names (the SDK option of the same name — not to be confused with the
          * daemon's MCP `tools`, which are servers). Absent ⇒ every tool the runtime has, which is what an
          * owner-driven chat wants. Set by the automation dispatchers from Automation.allowedTools: a wake driven
-         * by an OUTSIDE message runs bypassPermissions like any other automation turn, so for a public Doorbell
+         * by an OUTSIDE message runs bypassPermissions like any other automation turn, so for a public Front Desk
          * this list is the actual boundary — prompt wording is advice, an empty toolbox is not. */
         allowedTools: z.array(z.string().min(1)).optional(),
         effort: z.string().optional(),
@@ -505,13 +505,13 @@ export type Loop = z.infer<typeof LoopSchema>;
 // saved loop that cannot converge is a trap everyone who picks it afterwards pays a full run to discover.
 export const loopCanConverge = (loop: Pick<Loop, "output" | "checks">): boolean => loop.output.kind !== "none" || loop.checks.length > 0;
 
-/* Where a loop keeps what it must not lose between iterations: <workspace>/.intentic/artifacts/loops/<conversationId>/.
+/* Where a loop keeps what it must not lose between iterations: <workspace>/.intentic/records/artifacts/loops/<conversationId>/.
  *
  * Under `.intentic` for the reason the acceptance runs are — it is outside every repo and bound back SHARED
  * into an isolated turn's worktree, so the agent writes and the browser reads the same tree, with nothing to
  * land and no git noise. `progress.md` is the loop's memory in `fresh` mode and its audit trail in `continue`
  * mode; `iteration-<n>.json` is the verdict a `claim` stop reads. */
-export const LOOP_DIR = `${STATE_DIR}/artifacts/loops`;
+export const LOOP_DIR = `${STATE_DIR}/records/artifacts/loops`;
 
 // Why an iteration ended, which is not the same question as how the LOOP ended. `continue` is the ordinary
 // "not done yet"; `error` is a turn that surfaced an error frame, which does NOT end the loop by itself — a
@@ -1501,7 +1501,7 @@ export const SessionSummarySchema = z.object({
 export type SessionSummary = z.infer<typeof SessionSummarySchema>;
 export const SessionsListSchema = z.object({ sessions: z.array(SessionSummarySchema) });
 
-// ---- settings: per-sandbox agent settings (.intentic/settings.json) ----
+// ---- settings: per-sandbox agent settings (.intentic/config/settings.json) ----
 
 // Which prompt the agent is, before this turn composes anything on top. Two built-in bases and an escape
 // hatch: Intentic's own (the default), Claude Code's preset, or the owner's text. Declared out here rather
@@ -1625,7 +1625,7 @@ export type RuleFirings = z.infer<typeof RuleFiringsSchema>;
  * adding it.
  *
  *   builtin      this image ships it — a baked tool's cheatsheet, or a core feature's
- *   own          the owner wrote it (.intentic/skills/), and only these are editable here
+ *   own          the owner wrote it (.intentic/config/skills/), and only these are editable here
  *   capability   something connected brought it: a CLI tool, a machine, a browser account, a VPN
  *   extension    an installed extension ships it inside its checkout
  *   plugin       a plugin capability cloned a repo that holds it
@@ -3168,7 +3168,7 @@ export const EnrollHostInputSchema = z.object({
 });
 export type EnrollHostInput = z.infer<typeof EnrollHostInputSchema>;
 
-// ---- capabilities: the sandbox's unified capability manifest (.intentic/capabilities.json) ----
+// ---- capabilities: the sandbox's unified capability manifest (.intentic/config/capabilities.json) ----
 // Everything a user adds to a sandbox is a capability with an idempotent apply + a status check. The manifest is
 // the source of truth for what's active; `mcp`-kind entries also feed the agent's MCP servers each turn. DevOps
 // is the capability that scaffolds the intent/desired-state repos — until it's active the sandbox is empty.
@@ -3422,7 +3422,7 @@ export const DockerConfigSchema = z.object({
 });
 // A logged-in browser session the AGENT drives via Playwright MCP tools — for social platforms whose APIs can't
 // cover "all the actions" (X reads are paywalled; X community-join and YouTube community-posts have no API). The
-// session lives in a persisted Chromium profile under .intentic/browser/<id>, established through the guided-login
+// session lives in a persisted Chromium profile under .intentic/local/browser/<id>, established through the guided-login
 // WebSocket (/system/browser-login) or by the agent signing in itself. Chromium itself rides this kind's
 // Dockerfile fragment, applied on an owner rebuild.
 //
@@ -3793,12 +3793,12 @@ export type Persona = z.infer<typeof PersonaSchema>;
 /* THE ONE CARD ID THE PRODUCT NAMES ITSELF — the read-only persona a public web chat answers through.
  *
  * Nothing else is stock: a fresh workspace has no personas at all, and every card on the Personas page is one
- * the owner wrote. This id is the exception because a Doorbell is driven by a stranger with nobody watching, so
+ * the owner wrote. This id is the exception because a Front Desk is driven by a stranger with nobody watching, so
  * it is the one wake whose bounds cannot be left to the prompt's wording — the daemon writes the card the moment
- * a Doorbell is saved (personas/front-desk.ts) and the automations form fills a blank Doorbell persona with it.
+ * a Front Desk is saved (personas/front-desk.ts) and the automations form fills a blank Front Desk persona with it.
  *
  * It lives HERE because those two are in different packages and must agree exactly. A literal in each would
- * drift into a Doorbell pinned to a card nobody creates, and turnPersona answers a missing card by denying
+ * drift into a Front Desk pinned to a card nobody creates, and turnPersona answers a missing card by denying
  * everything — a public chat that cannot even read, which is safe and useless.
  *
  * It is FRONT DESK and not "visitor": the card is who answers the people who arrive, not the person arriving. */
@@ -4211,10 +4211,10 @@ export const ExtensionSummarySchema = z.object({
     commit: z.string(),
     /* Where the code comes from — which is also what the web varies per row: `builtin` (image-baked, no git
      * checkout, not removable) hides the uninstall affordance, `installed` (a git capability) shows the pinned
-     * commit, `workspace` (a directory under .intentic/workspace-extensions/, created and edited in place —
+     * commit, `workspace` (a directory under .intentic/config/workspace-extensions/, created and edited in place —
      * typically by an agent) is "uninstalled" by deleting its directory. */
     source: z.enum(["builtin", "installed", "workspace"]),
-    // The owner's switch (.intentic/extension-enablement.json). A disabled extension is still listed — that's
+    // The owner's switch (.intentic/config/extension-enablement.json). A disabled extension is still listed — that's
     // what makes it switchable back on — but the daemon wires none of its contributions up and the web host
     // doesn't activate it.
     enabled: z.boolean(),
@@ -4268,7 +4268,7 @@ export const ExtensionsListSchema = z.object({
     // what lets the tab say "checked an hour ago" instead of presenting staleness as certainty.
     updatesCheckedAt: z.string().optional(),
 });
-// The extension's contributes.settings values, persisted daemon-side (.intentic/extension-settings.json) keyed
+// The extension's contributes.settings values, persisted daemon-side (.intentic/config/extension-settings.json) keyed
 // by the manifest-derived extension id — the checkout stays pristine, so a re-clone update never loses them.
 // Secret-marked values are stripped from `settings`; `secretsSet` lists the secret keys that DO hold a value,
 // so the UI renders "•••• (set)" without ever receiving the secret back.
@@ -4310,7 +4310,7 @@ export const ExtensionProcessStatusSchema = z.object({
 });
 export type ExtensionProcessStatus = z.infer<typeof ExtensionProcessStatusSchema>;
 
-// ---- automations: scheduled agent wake-ups (.intentic/automations.json) ----
+// ---- automations: scheduled agent wake-ups (.intentic/config/automations.json) ----
 // An automation wakes the agent autonomously: the daemon's scheduler fires each enabled automation on its
 // trigger, runs the optional guard command (a shell command in the workspace; non-zero exit skips the wake),
 // then runs one agent turn with the prompt. The manifest is user config; run history is daemon-recorded.
@@ -4412,7 +4412,7 @@ export const TriggerSchema = z.discriminatedUnion("kind", [
 ]);
 export type Trigger = z.infer<typeof TriggerSchema>;
 
-/* The Doorbell widget's settings — everything about the embeddable chat that isn't the automation's prompt.
+/* The Front Desk widget's settings — everything about the embeddable chat that isn't the automation's prompt.
  * Present only on `webchat` listener automations; the trigger keeps `allowedOrigins` because that one is the
  * admission gate the message route reads, not a rendering choice.
  *
@@ -4422,7 +4422,7 @@ export type Trigger = z.infer<typeof TriggerSchema>;
  * the second: a field added here is invisible to the widget until it is listed there. */
 export const WebchatConfigSchema = z.object({
     // `public` admits anyone; `google` refuses a message that carries no verifiable Google ID token. Absent ⇒
-    // public — a Doorbell with no access setting is the anonymous support box it looks like.
+    // public — a Front Desk with no access setting is the anonymous support box it looks like.
     access: z.enum(["public", "google"]).optional(),
     // Ask an anonymous visitor for a display name before the first message. Cosmetic: the name is typed, so it
     // reaches the model as untrusted `displayName`, never as identity.
@@ -4456,7 +4456,7 @@ export const WebchatConfigSchema = z.object({
      *
      * `dailyMessageMax` absent ⇒ WEBCHAT_DAILY_MAX_DEFAULT, not uncapped. Every message here is an agent turn
      * billed to the owner, and the per-minute window bounds the RATE without bounding the DAY — twenty a minute,
-     * sustained, is tens of thousands of turns before anyone notices. A Doorbell nobody configured should not be
+     * sustained, is tens of thousands of turns before anyone notices. A Front Desk nobody configured should not be
      * able to spend that, so the safe number is the one you get for free and the owner raises it deliberately.
      * `conversationMessageMax` stays optional-means-uncapped: it is per visitor thread, which the daily ceiling
      * already bounds in aggregate. */
@@ -4469,18 +4469,18 @@ export const WebchatConfigSchema = z.object({
 });
 export type WebchatConfig = z.infer<typeof WebchatConfigSchema>;
 
-/* The daily agent-turn ceiling a Doorbell gets when its owner sets none. Lives here rather than beside the
+/* The daily agent-turn ceiling a Front Desk gets when its owner sets none. Lives here rather than beside the
  * route that enforces it because both ends need the number: the daemon to apply it, and the automation editor
  * to show the owner what they are already protected by (an invisible limit is one people hit and file as a bug).
  *
- * 200 is chosen to be irrelevant to real support traffic and decisive against a script. A Doorbell answering
+ * 200 is chosen to be irrelevant to real support traffic and decisive against a script. A Front Desk answering
  * two hundred questions in one UTC day is a busy one; a scripted flood reaches that in ten seconds and then
  * stops costing anything. */
 export const WEBCHAT_DAILY_MAX_DEFAULT = 200;
 
 /* ---- the widget wire: three shapes GET /webchat/<id>/config, GET …/challenge and POST …/message speak ----
  *
- * They live here, beside the stored config they derive from, because the Doorbell widget is a SECOND client of
+ * They live here, beside the stored config they derive from, because the Front Desk widget is a SECOND client of
  * this daemon — a bundle running on a stranger's page — and the reason this package exists is that both ends of
  * a wire read one definition. The widget imports these as types only (`import type`), so zod never reaches a
  * visitor's browser. */
@@ -4538,13 +4538,13 @@ export const AutomationSchema = z.object({
     // Shell command run in the workspace root before waking; exit 0 ⇒ wake, non-zero ⇒ the run is "skipped".
     guard: z.string().min(1).optional(),
     prompt: z.string().min(1),
-    // The Doorbell widget's settings — `webchat` listener automations only, ignored on every other trigger.
+    // The Front Desk widget's settings — `webchat` listener automations only, ignored on every other trigger.
     webchat: WebchatConfigSchema.optional(),
     /* NARROW THIS ONE JOB FURTHER than the persona it runs as — raw tool names, and the escape hatch under the
      * shelves rather than the way anyone is expected to answer this question.
      *
      * The persona (`actsAs` below) is where a session's toolbox is decided now, because the answer is worth
-     * reusing: the same bounds apply to the chat, the workflow and the Doorbell that name the same card. This
+     * reusing: the same bounds apply to the chat, the workflow and the Front Desk that name the same card. This
      * stays for the job that needs LESS than its persona allows — and only less, which is a rule the composer
      * enforces rather than a convention: an edit here can never hand back a shelf the persona switched off. */
     allowedTools: z.array(z.string().min(1)).optional(),
@@ -4557,14 +4557,14 @@ export const AutomationSchema = z.object({
      * A sandbox holds several accounts side by side, and when the first one is out of headroom — or belongs to
      * an organization that has disabled the plan — every fire of every automation errors against it until a
      * human happens to read the row. Pinning the wake to an account that can actually run is the difference
-     * between "my nightly sweep is quiet" and a Doorbell that turns visitors away all day. */
+     * between "my nightly sweep is quiet" and a Front Desk that turns visitors away all day. */
     account: z.string().optional(),
     /* WHICH FACE THE WAKE SHOWS THE OUTSIDE WORLD (AgentTurnSchema.actsAs — read its note for why this is not
      * spelled `account`, which is the field directly above and means who PAYS).
      *
      * Absent ⇒ the wake reaches NO logged-in account at all. That is the one place this whole layer stops being
      * a convenience and becomes a boundary, and it is deliberately the strictest default in the schema: an
-     * automation fires with nobody at the composer, on a prompt that — for a Doorbell — a stranger helped write.
+     * automation fires with nobody at the composer, on a prompt that — for a Front Desk — a stranger helped write.
      * `allowedTools` above already carries this exact reasoning for tools; an unrepeatable public post deserves
      * it at least as much. An automation that genuinely means "post as us" says so, once, in a field a reviewer
      * can see. */
@@ -4590,7 +4590,7 @@ export const AutomationSchema = z.object({
 });
 export type Automation = z.infer<typeof AutomationSchema>;
 
-// A wake held for owner approval (.intentic/approvals/<id>.json, one file per held wake). It snapshots the
+// A wake held for owner approval (.intentic/records/approvals/<id>.json, one file per held wake). It snapshots the
 // trigger payload so an approved run replays exactly what fired, even across a daemon restart. The id is minted
 // by the daemon (an entryId-safe filename).
 export const AutomationApprovalSchema = z.object({
@@ -4606,7 +4606,7 @@ export const AutomationApprovalSchema = z.object({
      * already opened for it and the provider session that conversation last ran on.
      *
      * Snapshotted for the same reason the payload is, and it is the half that was missing: without it an
-     * approved wake fell through to minting a fresh conversation, so a Doorbell visitor's chat became one card
+     * approved wake fell through to minting a fresh conversation, so a Front Desk visitor's chat became one card
      * per approved message instead of the single thread the dispatcher had opened for them — a second worktree
      * each time, and an agent that met the visitor again on every turn. Absent for a schedule or a webhook,
      * which own no thread. */
@@ -4718,7 +4718,7 @@ export type TriggerSource = z.infer<typeof TriggerSourceSchema>;
  *   create    — a shelf card on the page that makes the automation in one click, switched off, ready to read.
  *               The chores are all of these: upkeep nobody opens an automations page hunting for.
  *   configure — a shelf card that opens the dialog PREFILLED, for a template that cannot work unconfigured (a
- *               Doorbell with no allowed sites admits nobody, and a row that silently does nothing is worse
+ *               Front Desk with no allowed sites admits nobody, and a row that silently does nothing is worse
  *               than a form). */
 export const TemplateOfferSchema = z.enum(["create", "configure"]);
 
@@ -4889,14 +4889,14 @@ export const WorkflowGateSchema = z.object({
     /* Runs per UTC day, across every caller. A gate is a paid endpoint reachable with no person in the loop:
      * one of these wired into a push-triggered pipeline is a fan-out of sessions per commit, and the
      * per-request deadline bounds one call's WALL CLOCK without bounding the day's SPEND. Absent ⇒
-     * GATE_DAILY_MAX_DEFAULT, not uncapped, for the reason the Doorbell's ceiling is not optional either.
+     * GATE_DAILY_MAX_DEFAULT, not uncapped, for the reason the Front Desk's ceiling is not optional either.
      */
     dailyMax: z.number().int().positive().optional(),
 });
 export type WorkflowGate = z.infer<typeof WorkflowGateSchema>;
 
-/* The gate's daily ceiling when its author sets none. Deliberately small next to the Doorbell's 200: a
- * Doorbell message is one turn, a gate run is a whole graph of sessions, and the honest comparison is cost
+/* The gate's daily ceiling when its author sets none. Deliberately small next to the Front Desk's 200: a
+ * Front Desk message is one turn, a gate run is a whole graph of sessions, and the honest comparison is cost
  * rather than count. Twenty is a busy day of merges and a script's first minute. */
 export const GATE_DAILY_MAX_DEFAULT = 20;
 
@@ -5235,7 +5235,7 @@ export const PrepushRunSchema = z.object({
 });
 export type PrepushRun = z.infer<typeof PrepushRunSchema>;
 
-// ---- drafts: agent-proposed posts awaiting owner approval (.intentic/drafts/<id>.json) ----
+// ---- drafts: agent-proposed posts awaiting owner approval (.intentic/config/drafts/<id>.json) ----
 // One JSON file per draft. The AGENT creates drafts with its normal file tools — it can't call daemon routes,
 // the same split as the environment proposal — while the daemon edits/deletes them on the owner's behalf, so
 // the two writers never share a file. The id IS the filename (entryId charset ⇒ path-safe); the body never
@@ -5275,7 +5275,7 @@ export const DraftSchema = z.object({
      * address and one comment's permalink is the difference between talking to the room and answering the
      * person: the publisher opens exactly this and replies where it lands. */
     target: z.string().optional(),
-    // Workspace-relative attachment paths, e.g. ".intentic/drafts/media/chart.png".
+    // Workspace-relative attachment paths, e.g. ".intentic/config/drafts/media/chart.png".
     media: z.array(z.string()).optional(),
     // Suggested post time (epoch ms, the at/nextRun convention). Optional — the agent may propose without a
     // date and the owner sets one at approval; an approved draft with no date posts as soon as it's picked up.
@@ -5305,7 +5305,7 @@ export type DraftSummary = z.infer<typeof DraftSummarySchema>;
 // draft would silently never post.
 export const DraftsListSchema = z.object({ drafts: z.array(DraftSummarySchema), invalid: z.array(z.string()) });
 export type DraftsList = z.infer<typeof DraftsListSchema>;
-// entryId, not a bare string: the id becomes a filename under .intentic/drafts/.
+// entryId, not a bare string: the id becomes a filename under .intentic/config/drafts/.
 export const DraftIdParamSchema = z.object({ id: entryId });
 
 // ---- panels: per-repository dev servers + the content facts extensions detect on ----
@@ -5505,6 +5505,12 @@ export const MachinePairingSchema = z.object({
     // product surfaces these, so a file edited on both ends stays stuck until someone runs the CLI.
     conflicts: z.number().int().nonnegative().optional(),
     paused: z.boolean().optional(),
+    /* The SECOND session's word — the one-way mirror carrying the sandbox's state dir down (sync's backupSpec).
+     * Reported separately rather than folded into the status above, because the two fail independently and mean
+     * different things: the first going quiet stops the owner's edits moving, the second going quiet stops their
+     * personas, skills, automations, drafts and transcripts from surviving the sandbox. A backup that is not
+     * running is only dangerous while nobody knows, so it gets its own word on the line. */
+    backupStatus: z.string().optional(),
 });
 export type MachinePairing = z.infer<typeof MachinePairingSchema>;
 
@@ -5942,9 +5948,9 @@ export const SubagentIdParamSchema = z.object({ id: z.string() });
 
 // ---- environment: the overlay Dockerfile extending the sandbox image ----
 // The approved file is DAEMON-COMPOSED: pinned FROM + capability fragments + the owner-approved custom section.
-// The agent drafts one file per thing it needs (.intentic/environment.d/<tool>.Dockerfile — custom-section
+// The agent drafts one file per thing it needs (.intentic/config/environment.d/<tool>.Dockerfile — custom-section
 // content only, no FROM) with its normal file tools, and the daemon folds those into the single proposal file
-// (.intentic/environment.Dockerfile) the owner reads. The owner approves it in the browser, which stores it as
+// (.intentic/config/environment.Dockerfile) the owner reads. The owner approves it in the browser, which stores it as
 // the custom file and recomposes the approved artifact whose sha256 the rebuild executor pins. Both composed
 // files are written only when the composition CHANGES — see writeComposed, and the read loop it exists to end.
 // Status is derived, never stored:
@@ -5954,7 +5960,7 @@ export const SubagentIdParamSchema = z.object({ id: z.string() });
 const environmentFileSchema = z.object({ content: z.string(), hash: z.string() });
 export const EnvironmentSchema = z.object({
     proposal: environmentFileSchema.optional(),
-    // The owner-approved agent-written custom section (.intentic/environment.custom.Dockerfile).
+    // The owner-approved agent-written custom section (.intentic/config/environment.custom.Dockerfile).
     custom: environmentFileSchema.optional(),
     approved: environmentFileSchema.optional(),
     // sha256 of the overlay the running container was built from (SANDBOX_ENVIRONMENT_HASH); absent = stock image.
@@ -6334,7 +6340,7 @@ export const ManifestProblemSchema = z.object({
 });
 export type ManifestProblem = z.infer<typeof ManifestProblemSchema>;
 
-// Workspace-relative path (`.intentic/settings.json`) and everything currently wrong with that file. A file
+// Workspace-relative path (`.intentic/config/settings.json`) and everything currently wrong with that file. A file
 // with nothing wrong is absent from the list rather than present and empty.
 export const ManifestProblemReportSchema = z.object({ path: z.string(), problems: z.array(ManifestProblemSchema) });
 export type ManifestProblemReport = z.infer<typeof ManifestProblemReportSchema>;