@intentic/sandbox-contract 1.232.0 → 1.234.0

package/src/workspace-state.ts

@@ -187,7 +187,7 @@ const STATE_FILES = [
     },
 
     /* The named personas this sandbox shows the outside world, which connected accounts each one speaks for,
-     * what a session wearing it may do, where it works (schemas.ts PersonaSchema). It invalidates `capabilities` as well as
+     * what a session wearing it may do, where it works (PersonaSchema, schemas/personas.ts). It invalidates `capabilities` as well as
      * its own key because a card and the accounts it names are read together everywhere they are shown: connect
      * a second Reddit and the persona list has a new candidate; remove one and a card points at nothing.
      *
@@ -301,6 +301,24 @@ const STATE_FILES = [
         why: "Declared by the intentic.automations extension's contributes.files, `automation-approvals` is its query key, not core's.",
         portability: "carry",
     },
+    /* The bug-report inbox, one file per fingerprint, written by the daemon's issues-store as reports arrive
+     * from the owner's own sites and apps, and rendered by the intentic.issues extension. Its invalidation is
+     * the extension's own (`issues`), declared in that manifest, the automations shape exactly.
+     *
+     * `carry` rather than `local`: an issue is a fact about the PRODUCT, not about this container. A workspace
+     * exported and restored elsewhere that arrived claiming nothing had ever crashed would have thrown away
+     * the one record that says which bug is worth fixing first, and the counts are the whole of that record.
+     *
+     * NOT `versioned`, and the drafts entry is the contrast worth reading: a draft is authored, reviewable and
+     * goes out under the owner's name, so it earns a diff. An issue is machine-recorded telemetry whose count
+     * moves on every crash: tracking it would put a commit's worth of churn in `git log` per bad afternoon,
+     * and nothing in it is a decision anybody made. */
+    {
+        path: ".intentic/records/issues/",
+        invalidates: [],
+        why: "Declared by the intentic.issues extension's contributes.files, `issues` is its query key, not core's.",
+        portability: "carry",
+    },
     /* The maintenance ledger and probe evidence, written by the daemon's chores-store and rendered by the
      * intentic.maintenance extension, the automations shape exactly: the path is the daemon's, the query keys
      * (`maintenance-report`, `maintenance-runs`) are the extension's own contributes.files. Point-in-time
@@ -359,6 +377,12 @@ const STATE_FILES = [
         why: "Which origins have loaded a Front Desk's widget, written on a 30s flush timer while a customer's site serves page views. The install panel that renders it fetches on open and polls itself while it is on screen, which is the whole window in which the answer changes for anyone. Pushing instead would bill every connected browser a refetch per flush, for a panel almost nobody has open.",
         portability: "carry",
     },
+    {
+        path: ".intentic/records/issue-installs.json",
+        invalidates: [],
+        why: "The same probe for the bug reporter's script, on the same flush timer and read by the same kind of panel, so it is outside the push path for the same reason the Front Desk's is.",
+        portability: "carry",
+    },
     {
         path: ".intentic/records/thread-sessions.json",
         invalidates: [],
@@ -476,20 +500,15 @@ const STATE_FILES = [
         portability: "secret",
         note: "Sign the agent's AI accounts in again on the Agent tab, then re-enter each connection's credential on Capabilities and each extension's secret settings on Extensions, both arrived listed but unauthenticated.",
     },
-    /* Agent session transcripts, rewritten on every streamed token.
-     *
-     * The memory notes under it (`projects/<slug>/memory/**`) ARE user-facing and the /memory view polls them
-     * every 30s, which is the one place in this table where a poll survives a real change feed being available.
-     * It stays a poll deliberately: the watcher's exclusion is a DESCENT filter, so reaching those notes means
-     * letting it walk `.intentic/records/sessions/claude` → `projects` → every project slug. Measured on the live
-     * workspace that is +119 watched directories against ~593 today (a fifth more), with 314 continuously-
-     * rewritten transcripts inside the newly-watched set, to make ONE memory directory live. Notes change at
-     * agent-turn cadence, so the poll costs a request a minute and the alternative costs a permanent 20% on the
-     * watcher. */
+    /* Agent session transcripts, rewritten on every streamed token: nothing renders them off disk, so nothing
+     * under here is watched. The exclusion is a DESCENT filter, which is what makes it cheap: the watcher never
+     * walks `projects` and its per-slug subtrees at all. Measured on the live workspace, descending would add
+     * +119 watched directories against ~593 (a fifth more), with 314 continuously-rewritten transcripts inside
+     * the newly-watched set. If a surface here ever needs to be live, weigh that 20% against a poll first. */
     {
         path: ".intentic/records/sessions/claude/",
         invalidates: [],
-        why: "Agent session transcripts, see the note above on why the memory notes under it stay polled.",
+        why: "Agent session transcripts; nothing derives from watching them, and descending into them would cost a fifth of the watcher.",
         portability: "carry",
     },
     {
@@ -501,7 +520,7 @@ const STATE_FILES = [
     {
         path: ".intentic/local/cache/",
         invalidates: [],
-        why: "Rebuildable indexes and caches, the iq index and its vector sidecar, the whisper model; ignored by the watcher and recreated from carried workspace content.",
+        why: "Rebuildable indexes and caches, the iq index and its vector sidecar, the whisper model, fileq's derived/ markdown shadows of binary files; ignored by the watcher and recreated from carried workspace content.",
         portability: "derived",
     },
     /* Connector and extension scratch, one directory per extension under runtime/extensions/<id>
@@ -810,34 +829,6 @@ export const REPORTED_MANIFEST_PATHS: readonly string[] = WORKSPACE_STATE_FILES.
 // them relative at the last moment, and normalizing at each call site is the one that eventually gets forgotten.
 export const isReportedManifest = (relPath: string): boolean => REPORTED_MANIFEST_PATHS.includes(relPath.replaceAll("\\", "/"));
 
-/* Old directory names are never read or migrated. Keep that finite set in one quarantine record so access,
- * export, and search cannot reinterpret abandoned machine state as ordinary workspace content after a rename.
- * `artifacts` still carry; the distinction here tells portability only which retired roots are secrets or
- * derived, and tells the state janitor which it may DELETE: a retired `derived` root is a rebuildable cache
- * by its own classification, so leaving 466 MB of abandoned model where only a manual `rm` reaches it was
- * quarantine doing half its job. Secret and artifact roots stay until an owner removes them by hand: deleting
- * content is not the janitor's call, only deleting what the class already says is disposable. */
-export const RETIRED_WORKSPACE_STATE_DIRS = {
-    /* The flat spellings, from before the state dir was grouped into its five folders. Every entry in the table
-     * used to sit directly under `.intentic/`, and a sandbox that predates the move still has those directories
-     * on disk with real contents in them. They are quarantined rather than migrated, the workspace rule is fresh
-     * state and no compatibility layers, but quarantine is exactly what they need, because the alternative is
-     * worse than leaving them: `auth` at the old spelling is a real credential store that the classifier no
-     * longer recognises, so without these names it would read as ordinary workspace content and be indexed by
-     * search, carried by an export and copied down by the backup. Being listed here keeps the old copy as
-     * untouchable as the new one, and lets the janitor delete the rebuildable half. */
-    secret: ["claude", "codex", "kimi", "opencode", "cliproxy", "auth", "ci.json"],
-    /* The ownership records at their OLD flat spelling, and a bucket of their own rather than a few more names
-     * in `secret`, because the two classes differ on exactly the thing that matters for a leftover. A `secret`
-     * travels when the owner opts in at export; an `identity` never travels at all, since a list of who may
-     * drive this sandbox arriving in another one is how a source hands itself the target's ownership. Filed under
-     * `secret` these would have become carryable by ticking a box, which is the one outcome their live entries
-     * are written to prevent. */
-    identity: ["owner.json", "members.json", "workspace.json", "control-tokens.json"],
-    derived: ["iq", "extensions-runtime", "whisper", "browser/output", "browser", "cache", "runtime", "tmp", ".pnpm-store", "extensions", "verify"],
-    artifacts: ["attachments", "acceptance", "loops", "workflow-runs", "transcripts", "artifacts", "sessions"],
-} as const;
-
 /* THE DAEMON'S OWN CONTROL PLANE, the entries directly under the workspace root's `.intentic/` that the file
  * API refuses to read, write, move or delete for anyone, the owner included (workspace/workspace-files.ts holds
  * the enforcement and the full reasoning for each name).
@@ -889,15 +880,9 @@ export const isLockedWorkspacePath = (relPath: string): boolean => {
     if (segments[0] !== STATE_DIR) {
         return false;
     }
-    /* Two shapes, because two layouts exist on disk. A current entry is `<group>/<name>`; a leftover from before
-     * the regrouping is a bare name directly under the state dir, and the quarantine record is what still knows
-     * those are credentials. Both are locked, a stale `auth/` full of real tokens is no safer to open than the
-     * live one, and the whole point of quarantining the old spellings was that nothing downstream reclassifies
-     * them as ordinary content. */
-    return (
-        LOCKED_STATE_ENTRIES.has(segments.slice(1, 3).join("/")) ||
-        (segments.length >= 2 && RETIRED_WORKSPACE_STATE_DIRS.secret.includes(segments[1] as never))
-    );
+    // Two segments, which covers both spellings in the set above: a grouped entry (`secrets/auth`) matches as
+    // written, and a bare root entry (`claude.json`) joins to itself because there is no second segment to add.
+    return LOCKED_STATE_ENTRIES.has(segments.slice(1, 3).join("/"));
 };
 
 /* THE LOCKED ENTRIES THE ROOT REPO TRACKS, refused by the file API, and diffable anyway.