@intentic/sandbox-contract 1.325.0 → 1.327.0

package/src/schemas/terminal.ts

@@ -120,6 +120,18 @@ export const BrowserSessionSchema = z.object({
     pages: z
         .array(BrowserPageSchema)
         .describe("Every page it has open. A browser holds several at once, which is the reason it is listed apart from the terminals."),
+    // Opened from the browser view by the person, not by an agent's tool; absent on an agent's and from an older daemon.
+    own: z
+        .boolean()
+        .optional()
+        .describe("Your own window, opened from the browser view rather than by an agent. Yours to use whenever it is open; no agent drives it."),
+    // The conversation whose agent opened it; the client reads that agent's turn to know whether it is driving now.
+    owner: z
+        .string()
+        .optional()
+        .describe(
+            "The conversation whose agent opened it. While that conversation has a turn running the agent may act in this window at any moment; once it has not, the window is yours to use.",
+        ),
 });
 export type BrowserPage = z.infer<typeof BrowserPageSchema>;
 export type BrowserSession = z.infer<typeof BrowserSessionSchema>;
@@ -128,6 +140,44 @@ export const BrowsersListSchema = z.object({
 });
 export type BrowsersList = z.infer<typeof BrowsersListSchema>;
 export const BrowserNameParamSchema = z.object({ name: z.string().describe("Which browser.") });
+export const OpenBrowserInputSchema = z.object({
+    url: z.string().optional().describe("Where the new tab goes. Absent opens a blank tab, the way a browser's own new tab does."),
+});
+export type OpenBrowserInput = z.infer<typeof OpenBrowserInputSchema>;
+export const OpenBrowserResultSchema = z.object({
+    name: z.string().describe("The window it opened in: what the browser view, the live picture and the close route take."),
+    pageId: z.string().optional().describe("The tab it opened, once the window has it. Absent when the tab had not appeared in time."),
+});
+export type OpenBrowserResult = z.infer<typeof OpenBrowserResultSchema>;
+// One window on the sandbox's desktop, as its window manager lists it. The id is what /system/desktop-view takes as
+// `window` to stream that window alone, and what the agent's own desktop tools name it by.
+export const DesktopWindowSchema = z.object({
+    id: z.string().describe("The window, as the desktop's window manager names it. Open a picture of it alone by passing this to the desktop view."),
+    app: z.string().describe("The program it belongs to, as the system names it (`xterm`, `Code`), not what a person calls it."),
+    title: z.string().describe("What its title bar says. Empty for a window that has none."),
+    focused: z.boolean().describe("Whether it has the keyboard: typing on the desktop goes to this window."),
+});
+export type DesktopWindow = z.infer<typeof DesktopWindowSchema>;
+// The sandbox's own desktop (desktop/agent-desktop.ts): one screen, so a state rather than a roster. `windows` is what
+// tells an empty desktop from a broken picture of one, and what puts its tile on the rail; `list` is what each of them
+// is, for a tab that shows one window alone.
+export const DesktopStateSchema = z.object({
+    running: z
+        .boolean()
+        .describe("Whether the desktop is up. It starts the first time anyone looks at it, you or an agent, and stays up until the sandbox restarts."),
+    display: z.string().optional().describe("The X display it is, present while it runs: a program started with DISPLAY set to this opens its window there."),
+    windows: z
+        .number()
+        .int()
+        .nonnegative()
+        .optional()
+        .describe("How many windows are open on it. None is an empty desktop. Absent while it is not running, or when it has no window manager to ask."),
+    list: z
+        .array(DesktopWindowSchema)
+        .optional()
+        .describe("Each window open on it, absent when it is not running or has no window manager to ask."),
+});
+export type DesktopState = z.infer<typeof DesktopStateSchema>;
 // A subagent is any agent another agent started, and every surface shows one the same way whichever mechanism started
 // it. The kind names the mechanism, never a second sort of thing:
 // subagent: in-process, the runtime's own Agent/Task tool, tracked via SubagentStart/Stop hooks and task_* messages

package/src/schemas/updates.test.ts

@@ -0,0 +1,47 @@
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { packageRoot } from "@intentic/constants/node";
+import { PreparingUpdateSchema } from "./system.js";
+import { UpdateOutcomeSchema } from "./updates.js";
+
+// The update markers `ic` writes onto /history for the daemon to read, spelled once here: golden/update-outcome.json
+// and golden/update-preparing.json are these examples as JSON, and ic's Rust test (_sandbox/ic/src/sandbox/host_files.rs)
+// holds what it writes to them field for field. Where each file lives is the daemon's to say (its own golden,
+// host-files.json). A change here that the committed file does not carry fails, naming the file;
+// `INTENTIC_WRITE_GOLDEN=1` rewrites them, and the Rust test then says whether ic still writes them.
+
+const GOLDEN = join(packageRoot(import.meta.url), "golden");
+
+// Every field set, and the result whose spelling is easiest to get wrong.
+const outcome = UpdateOutcomeSchema.parse({
+    result: "rolled-back",
+    verb: "update",
+    at: 1_791_240_330_000,
+    from: "1.399.0",
+    to: "1.400.0",
+    reason: "the new version's daemon kept crashing (3 restarts)",
+    log: "/home/owner/.intentic/logs/update-sandbox-0123456789ab.log",
+    keepUntil: 1_791_326_730_000,
+});
+
+const preparing = PreparingUpdateSchema.parse({
+    channel: "stable",
+    startedAt: 1_791_240_300_000,
+    at: 1_791_240_330_000,
+    phase: "download",
+    percent: 42,
+});
+
+const goldens = [
+    { file: "update-outcome.json", value: outcome },
+    { file: "update-preparing.json", value: preparing },
+];
+
+test.each(goldens)("golden/$file is the contract's example, as the host writes it", ({ file, value }) => {
+    const path = join(GOLDEN, file);
+    const expected = `${JSON.stringify(value, undefined, 2)}\n`;
+    if (process.env["INTENTIC_WRITE_GOLDEN"] === "1") {
+        writeFileSync(path, expected);
+    }
+    expect(readFileSync(path, "utf8")).toBe(expected);
+});

package/src/schemas/updates.ts

@@ -52,6 +52,10 @@ export type SkipUpdateInput = z.infer<typeof SkipUpdateInputSchema>;
 export const RollbackTargetSchema = z.object({
     image: z.string().describe("The local image a rollback would run, pinned under a tag no other flow writes."),
     version: z.string().optional().describe("What that image says it is. Absent when it would not say."),
+    download: z
+        .boolean()
+        .optional()
+        .describe("The local pin is gone (pruned outside ic); going back downloads the published image of `version`."),
 });
 export type RollbackTarget = z.infer<typeof RollbackTargetSchema>;
 

package/src/schemas/workspace/workspace-search.ts

@@ -33,6 +33,8 @@ export const WorkspaceSearchQuerySchema = z.object({
     limit: z.coerce.number().int().positive().optional().describe("How many results to return."),
     after: z.string().optional().describe("Resume from the cursor a previous answer handed back."),
 });
+// The query's verb enum.
+export type WorkspaceSearchMode = NonNullable<z.infer<typeof WorkspaceSearchQuerySchema>["mode"]>;
 export const WorkspaceSearchTagSchema = z.object({
     kind: z
         .enum(["def", "text", "sem", "bm25", "rerank", "path", "import", "call", "type", "write", "fuzzy", "heuristic"])

package/src/schemas/workspace/workspace-tree.ts

@@ -35,6 +35,9 @@ export interface WorkspaceTreeEntry {
     readonly path: string;
     readonly type: "file" | "dir";
     readonly size?: number | undefined;
+    // When a file last changed, in epoch milliseconds, from the stat that already reads its size; a directory has none,
+    // since a plain one is listed from its dirent alone. The home's date grouping reads it (homeOrder.ts).
+    readonly mtime?: number | undefined;
     // Ignored by tooling (node_modules, .git, gitignored paths, browser profiles); client greys the row.
     readonly ignored?: boolean | undefined;
     // Set when this entry is a symlink; `type` above is then its target's type.
@@ -47,6 +50,10 @@ export const WorkspaceTreeEntrySchema: z.ZodType<WorkspaceTreeEntry> = z.object(
     path: z.string().describe("Its full path from the workspace root, which feeds straight back into the file routes."),
     type: z.enum(["file", "dir"]).describe("What it is. For a link, what it points at, so a link to a folder opens like a folder."),
     size: z.number().optional().describe("Size in bytes, for a file."),
+    mtime: z
+        .number()
+        .optional()
+        .describe("When a file last changed, in milliseconds since 1970. A folder has none. Absent too where the listing could not read it."),
     ignored: z
         .boolean()
         .optional()
@@ -84,7 +91,11 @@ export const WorkspaceTreeSchema = z.object({
 export type WorkspaceTree = z.infer<typeof WorkspaceTreeSchema>;
 // What moved in the shared tree between two generations: every folder whose own entries changed, parents first.
 export const WorkspaceTreeDeltaSchema = z.object({
-    from: z.number().int().nonnegative().describe("The generation this applies on top of. A reader holding any other fetches the tree afresh instead."),
+    from: z
+        .number()
+        .int()
+        .nonnegative()
+        .describe("The generation this applies on top of. A reader holding any other fetches the tree afresh instead."),
     generation: z.number().int().nonnegative().describe("The generation it leaves the tree at."),
     dirs: z
         .array(
@@ -143,7 +154,9 @@ export const WorkspaceDownloadTicketQuerySchema = WorkspaceScopeSchema.extend({
         .describe("The files and folders to download together, as workspace paths. A folder brings everything inside it."),
 });
 export const WorkspaceDownloadTicketSchema = z.object({
-    ticket: z.string().describe("Hand this to the download route in the query string. It buys exactly the selection it was minted for, once resolved."),
+    ticket: z
+        .string()
+        .describe("Hand this to the download route in the query string. It buys exactly the selection it was minted for, once resolved."),
     expiresAt: z.number().describe("When it stops working, in milliseconds. It is meant to be used at once."),
     filename: z.string().describe("What the archive is saved as, so a caller can say what is on its way."),
 });
@@ -182,7 +195,8 @@ export const WorkspaceFilePresentSchema = z.object({
         .describe(
             "Which tree answered. True when no conversation was named, and also when one was but its own copy has no such file, which is the case a reader has to be told about rather than left to assume.",
         ),
-    // Absent means the window decoded cleanly. Set by a server that checks (the desktop app's folder server does).
+    // Absent means the window decoded cleanly. Both servers set it the same way (@intentic/base/utf8-text): the daemon
+    // for /work and the desktop app's folder server, for a UTF-16 file and for any window that is not UTF-8.
     lossy: z
         .literal(true)
         .optional()
@@ -190,6 +204,8 @@ export const WorkspaceFilePresentSchema = z.object({
             "The bytes are not valid UTF-8, so `content` holds replacement characters where they failed to decode. Saving that text back would change the file, so treat it as read-only.",
         ),
 });
+// One window of a file's text; `size` is the whole file, `offset`/`bytes` the byte range `content` decodes from.
+export type WorkspaceFileWindow = z.infer<typeof WorkspaceFilePresentSchema>;
 // Nothing there is an answer, not a failure: most reads here are read-it-if-there, and a 404 would spam the browser's
 // network log per miss. A refused read (an escape, a denylisted path) is still an error.
 export const WorkspaceFileAbsentSchema = z.object({
@@ -201,6 +217,7 @@ export const WorkspaceFileAbsentSchema = z.object({
     path: z.string().describe("The path, as asked for."),
 });
 export const WorkspaceFileSchema = z.discriminatedUnion("present", [WorkspaceFilePresentSchema, WorkspaceFileAbsentSchema]);
+export type WorkspaceFile = z.infer<typeof WorkspaceFileSchema>;
 // A file's derived text: the markdown shadow fileq keeps beside every document, picture, recording and archive, which
 // is what an agent reads instead of the bytes. About the shared tree only, since a conversation's own checkout is never
 // shadowed; no scope field, for that reason.
@@ -208,7 +225,9 @@ export const WorkspaceDerivedQuerySchema = z.object({
     path: z
         .string()
         .min(1)
-        .describe("The file you want the text of, as a workspace path. The real file, not its shadow: where the text is kept is this route's business."),
+        .describe(
+            "The file you want the text of, as a workspace path. The real file, not its shadow: where the text is kept is this route's business.",
+        ),
 });
 // Where one file stands, which is the question a reader looking at a missing or stale rendering is actually asking.
 // Nothing renders in the background: a file has text once someone asks for it, and fileq keeps it until the file changes.
@@ -225,7 +244,10 @@ export const WorkspaceDerivedPresentSchema = z.object({
     path: z.string().describe("The file it was derived from, as asked for."),
     content: z.string().describe("The text itself, as markdown."),
     deriver: z.string().describe("Which reader wrote it, and at which version, such as `pdf+ocr v1`. A file re-derives when this changes."),
-    derivedAt: z.string().optional().describe("When it was written, as an ISO timestamp. Absent only for a shadow whose front matter was edited by hand."),
+    derivedAt: z
+        .string()
+        .optional()
+        .describe("When it was written, as an ISO timestamp. Absent only for a shadow whose front matter was edited by hand."),
     title: z.string().optional().describe("The title the format carried, where it carried one."),
     notes: z
         .array(z.string())
@@ -233,7 +255,9 @@ export const WorkspaceDerivedPresentSchema = z.object({
             "Every cap and degradation the derivation hit: a sheet cut to 200 rows, a book cut at 2 MB, a scan recognised rather than read. Show these with the text, since text that was cut reading as complete is the one failure this whole feature cannot afford.",
         ),
     tokens: z.number().describe("Roughly what an agent spends reading it, by the same four-chars-a-token estimate every budget here uses."),
-    truncated: z.boolean().describe("Whether this is only the start of the shadow, cut to keep the response sendable. The file on disk holds the rest."),
+    truncated: z
+        .boolean()
+        .describe("Whether this is only the start of the shadow, cut to keep the response sendable. The file on disk holds the rest."),
     stale: z
         .boolean()
         .describe(
@@ -242,15 +266,21 @@ export const WorkspaceDerivedPresentSchema = z.object({
 });
 export const WorkspaceDerivedAbsentSchema = z.object({
     ...DerivedStandingShape,
-    present: z.literal(false).describe("There is no derived text for that file. Read `state` before saying so to anyone: absent and being read are different answers."),
+    present: z
+        .literal(false)
+        .describe("There is no derived text for that file. Read `state` before saying so to anyone: absent and being read are different answers."),
     path: z.string().describe("The file, as asked for."),
     derivable: z
         .boolean()
-        .describe("Whether this format can be turned into text at all. True means asking for it to be derived is worth offering; false means nothing here reads this format."),
+        .describe(
+            "Whether this format can be turned into text at all. True means asking for it to be derived is worth offering; false means nothing here reads this format.",
+        ),
     reason: z
         .string()
         .optional()
-        .describe("Why there is none, when deriving was just attempted and produced nothing: the file is too large, corrupt, or of a format no reader claims."),
+        .describe(
+            "Why there is none, when deriving was just attempted and produced nothing: the file is too large, corrupt, or of a format no reader claims.",
+        ),
 });
 export const WorkspaceDerivedSchema = z.discriminatedUnion("present", [WorkspaceDerivedPresentSchema, WorkspaceDerivedAbsentSchema]);
 export type WorkspaceDerived = z.infer<typeof WorkspaceDerivedSchema>;
@@ -291,9 +321,7 @@ export const WorkspaceDeletedSchema = z.object({
     trashed: z
         .string()
         .optional()
-        .describe(
-            "The trash id that brings it back through the restore call, for a day. Absent when there was nothing at that path to delete.",
-        ),
+        .describe("The trash id that brings it back through the restore call, for a day. Absent when there was nothing at that path to delete."),
 });
 export type WorkspaceDeleted = z.infer<typeof WorkspaceDeletedSchema>;
 export const WorkspaceRestoreSchema = z.object({

package/src/state/arrival.ts

@@ -111,3 +111,43 @@ export const ArrivalHostsSchema = z.object({ hosts: z.array(ArrivalHostSchema) }
 // Reads a setup off a connected device instead of an upload; answers with a plan exactly like the upload door does.
 export const ArrivalScanSchema = z.object({ host: z.string().min(1) });
 export type ArrivalScan = z.infer<typeof ArrivalScanSchema>;
+
+// A model provider's API key found on one of the owner's devices, offered as a model endpoint. Only plain API keys are
+// read: an OAuth login is bound to the install that holds it, and copying one signs either side out. The key itself
+// never crosses this wire, only its last four characters.
+export const ProviderKeySourceSchema = z.enum(["hermes", "openclaw", "opencode", "gemini", "codex"]);
+export type ProviderKeySource = z.infer<typeof ProviderKeySourceSchema>;
+export const ProviderKeySchema = z.object({
+    // A digest of the key, never the key: the same key reads as the same row from any device, and on every read.
+    id: z.string(),
+    // The provider as this sandbox names it (`openrouter`, `anthropic`), or the source's own name for one it does not
+    // know.
+    provider: z.string(),
+    // What to call it ("OpenRouter").
+    label: z.string(),
+    // The tool whose files held it; a key held by several is attributed to the first in this enum's order.
+    source: ProviderKeySourceSchema,
+    // The device it was read from.
+    host: z.string(),
+    // The key's last four characters.
+    hint: z.string(),
+    // This sandbox knows where the provider serves models; false is a key reported and not offered.
+    applicable: z.boolean(),
+    // A model endpoint here already holds this key.
+    added: z.boolean(),
+});
+export type ProviderKey = z.infer<typeof ProviderKeySchema>;
+// No connected device is an empty list, not an error.
+export const ProviderKeysSchema = z.object({ keys: z.array(ProviderKeySchema) });
+export type ProviderKeys = z.infer<typeof ProviderKeysSchema>;
+
+// The rows to add, by id. The daemon reads the devices again rather than trusting a value the browser never held.
+export const ProviderKeysApplySchema = z.object({ ids: z.array(z.string().min(1)).min(1) });
+export type ProviderKeysApply = z.infer<typeof ProviderKeysApplySchema>;
+export const ProviderKeysAppliedSchema = z.object({
+    // Each row that now has an endpoint, with that endpoint's capability id; one already added is listed, not added twice.
+    added: z.array(z.object({ id: z.string(), capability: z.string() })),
+    // Each row that did not land, in its own words: gone from the device since it was listed, or refused by the apply.
+    failed: z.array(z.object({ id: z.string(), error: z.string() })),
+});
+export type ProviderKeysApplied = z.infer<typeof ProviderKeysAppliedSchema>;

package/src/state/contract-lock.test.ts

@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { shrunkSurfaces } from "@intentic/constants/contract-shrink";
 import { packageRoot } from "@intentic/constants/node";
-import { RAW_ROUTE_LIST } from "../protocol/raw-routes.js";
+import { RAW_ROUTE_LIST } from "../protocol/raw/raw-routes.js";
 import type { RouteMeta } from "../protocol/route-meta.js";
 import { accessChanges, currentLock, serializeLock } from "./contract-lock.js";
 

package/src/state/contract-lock.ts

@@ -1,8 +1,8 @@
 // contract.lock.json is every exported schema serialized to canonical JSON Schema, so git can flag a wire-contract
 // change. contract-shrink demands a `!` commit with a Breaking-Note when a schema, field or type shrinks; additions
 // pass freely. Derived from the package's exports, not a hand-kept list, plus the wire no oRPC route carries: the
-// manifests the Rust crates that define it write beside their TypeScript (the tunnel, what a browser sees of the front
-// and the edge, and the front's control socket with Node), under `wire:` names no export can take.
+// manifests the Rust crates that define it write beside their TypeScript (the tunnel, what a browser sees of netd
+// and the edge, and netd's control socket with Node), under `wire:` names no export can take.
 //
 // And who reaches each route: every raw route's and every procedure's RouteMeta, each reach field with its default
 // resolved (route-meta.ts `routeAccess`), under `access:METHOD /path`. Resolved, so every field is a value on every
@@ -81,8 +81,8 @@ export const accessChanges = (baseText: string, headText: string): string[] => {
     });
 };
 
-// Each written by its crate's own test: `tunnel`, `browser-wire` and `front-wire` under _sandbox/front/crates.
-const WIRE_MANIFESTS = ["browser-wire", "front-wire", "tunnel"] as const;
+// Each written by its crate's own test: `tunnel`, `browser-wire` and `netd-wire` under _sandbox/netd/crates.
+const WIRE_MANIFESTS = ["browser-wire", "netd-wire", "tunnel"] as const;
 
 export const currentLock = (): Record<string, unknown> => {
     const lock: Record<string, unknown> = {};
@@ -103,7 +103,7 @@ export const currentLock = (): Record<string, unknown> => {
     }
     for (const manifest of WIRE_MANIFESTS) {
         // Read from src/ whether this runs from src/ or dist/: the manifests are data `cargo test` writes, never compiled.
-        const text = readFileSync(join(packageRoot(import.meta.url), "src", "front", "generated", `${manifest}.json`), "utf8");
+        const text = readFileSync(join(packageRoot(import.meta.url), "src", "netd", "generated", `${manifest}.json`), "utf8");
         lock[`wire:${manifest}`] = sorted(JSON.parse(text));
     }
     return { ...lock, ...accessEntries() };

package/src/state/history-state.ts

@@ -95,10 +95,43 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
     // A rebuild's ask that the next boot resume the turns it cuts (restart-resume.ts): about this machine's next boot only,
     // read once by it, so a moved sandbox starts without one.
     { path: "restart-resume.json", portability: "derived" },
+    // Spawned children paused on a re-run the sandbox booked for them (agent/subagents/paused-children.ts): the booking
+    // is this process's memory, so the next boot tells each parent that its child stays stopped, then forgets the entry.
+    // About this machine's restarts, so a moved sandbox starts without it.
+    { path: "paused-children.json", portability: "derived" },
+    // When this machine's daemon booted (system/boot/boot-history.ts), for telling a restart storm from a restart: about
+    // this machine's restarts, so a moved sandbox starts without it.
+    { path: "boot-history.json", portability: "derived" },
+    // When each housekeeping chore last ran (system/chore-clock.ts), so a restart does not run a daily one again; a moved
+    // sandbox runs each once at its first boot.
+    { path: "chore-clock.json", portability: "derived" },
+    // The last disk measurement (system/resources/storage/disk-storage.ts), kept so a restart still shows one, dated. About
+    // this machine's volumes, so a moved sandbox measures its own.
+    { path: "storage-scan.json", portability: "derived" },
+
+    /* ---- the unprivileged agent's execution domain (the daemon's workload/domain/agent-domain-view.ts) ---- */
+
+    // The agent's own HOME and the per-runtime homes beside it: what the agent keeps outlives a recreate, which includes
+    // any login a command-line tool it ran saved there. `secret` for that, since the daemon cannot tell one from the rest.
+    {
+        path: "agent-home/",
+        portability: "secret",
+        note: "Sign the agent's own command-line tools in again where it used them.",
+    },
+    {
+        path: "agent-homes/",
+        portability: "secret",
+        note: "Sign the agent's own command-line tools in again where it used them.",
+    },
+    // Container storage a domain's runtime filled, pulled again on demand.
+    { path: "agent-containers/", portability: "derived" },
+    // Each domain view's staging directory (`agent-domain-` and a random suffix), removed when its domain ends.
+    { path: "agent-domain-", portability: "derived" },
 
     /* ---- credentials ---- */
 
-    // The ssh alias dir ~/.ssh/intentic-hosts symlinks to: per-host config, keys and passphrases.
+    // The ssh alias dir ~/.ssh/intentic-hosts symlinks to: per-host config, each key's public half, password files, and a
+    // key with a passphrase. Every other private key is in the key store under the auth root (ssh-keys/).
     {
         path: "ssh-hosts/",
         portability: "secret",
@@ -122,6 +155,25 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
 
     // Signs every browser session cookie; carrying it would let the holder mint sessions against the target.
     { path: "session-secret", portability: "identity", note: "Sign in again, the target signs its own sessions." },
+    // Who owns this sandbox, who else may reach it and at what tier, and the hashed control tokens programs present:
+    // the daemon's to decide, so kept off the workspace every turn writes (auth/members/identity-off-workspace.ts moved
+    // them from `.intentic/identity/` on 2026-10-06). An access list that traveled would let a source sandbox hand
+    // itself the target's ownership, and a token authenticates against the sandbox that minted it.
+    { path: "identity/owner.json", portability: "identity", note: "The target is bound by its own owner's first sign-in." },
+    {
+        path: "identity/members.json",
+        portability: "identity",
+        note: "Re-invite collaborators from the Access tab, a grant is the platform's record, and the target enforces its own copy.",
+    },
+    { path: "identity/control-tokens.json", portability: "identity", note: "Mint fresh control tokens, the old ones authenticate against the source sandbox." },
+    // Public keys, the owner's require-a-passkey switch and the hashes of their recovery codes, moved from
+    // `.intentic/identity/passkeys.json` the same way (the passkeys-off-workspace step), since a passkey sign-in trusts
+    // the row it finds: a copy that traveled would let a source sandbox's passkeys open the target.
+    {
+        path: "identity/passkeys.json",
+        portability: "identity",
+        note: "Passkeys are bound to the sandbox they were registered with: add them again on the new one from its Access tab.",
+    },
     {
         path: "browser-access-disabled",
         portability: "identity",
@@ -139,8 +191,20 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
     { path: "webext-enrollments.json", portability: "identity", note: "Pair your browser again from its card: the extension is still installed." },
     // The browser pairing burn list; a redeemed pairing must not read as fresh wherever this file travels.
     { path: "webext-pair-consumed.json", portability: "identity" },
+    // A phone's enrollment and its wake channel, paired to this sandbox; the app on the phone stays installed.
+    { path: "phone-enrollments.json", portability: "identity", note: "Pair your phone again from its card: the app is still installed." },
+    { path: "phone-pair-consumed.json", portability: "identity" },
+    { path: "phone-wake.json", portability: "identity" },
     // Setup-device pairing burn list; carrying it would mark another sandbox's fresh pairing as spent.
     { path: "host-pair-consumed.json", portability: "identity" },
+    // Lands waiting for the computer whose folder they go to, and which computer last held each attached folder
+    // (conversations/land/project-delivery.ts): about the machine this sandbox runs beside, whose folders a moved
+    // sandbox does not have.
+    { path: "project-deliveries.json", portability: "identity" },
+    // The folders attached to this computer's own sandbox, by name (the daemon's system/projects-registry.ts): which of the
+    // computer's folders sync in, so it stays with the sandbox that runs beside them. The folders' copies and repos travel
+    // with /work and gits/; a moved sandbox treats them as ordinary repos.
+    { path: "projects.json", portability: "identity", note: "Attach the folders again from the desktop app on the computer that holds them." },
     // A runner's enrollment names this sandbox as parent; elsewhere its digest would dial the old parent.
     { path: "runner-enrollments.json", portability: "identity" },
     { path: "runner-pair-consumed.json", portability: "identity" },
@@ -152,6 +216,13 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
     { path: "hook-requests.json", portability: "derived" },
     // The owner's yes to each workspace extension's declared powers, decided again by the target's owner.
     { path: "extension-approvals.json", portability: "identity", note: "Approve the extensions written in this workspace again from Extensions." },
+    // The owner's yes to each item in the approvals queue, pinned to what it will do: the queue travels with /work, and
+    // an item that arrives approved without its yes is not carried out until the target's owner gives it again.
+    {
+        path: "approval-decisions.json",
+        portability: "identity",
+        note: "Approve again from Approvals anything that was approved and had not run yet.",
+    },
     { path: "local-cert/", portability: "identity" },
 
     /* ---- the state engine's own bookkeeping (the daemon's store/evolution/state-journal.ts) ---- */

package/src/state/runtime-state.ts

@@ -27,6 +27,9 @@ const RUNTIME_DOMAINS = [
     // The agent's Chromiums and open pages, daemon-held, minted from its own browser tool-call hooks.
     { domain: "browsers", invalidates: [["browsers"]] },
 
+    // The sandbox's own desktop: up, and how many windows are open on it, watched off its window manager's client list.
+    { domain: "desktop", invalidates: [["desktop"]] },
+
     // A connection's status as its last probe found it: pushed when a probe behind a served answer finds another one, and
     // when a browser sign-in is saved or cleared, which is what moves an account's card off "log in".
     { domain: "capabilities", invalidates: [["capabilities"]] },
@@ -39,6 +42,7 @@ const RUNTIME_DOMAINS = [
     // carries a device reading that landed too late for the reader waiting on it (hosts/device-reports.ts).
     { domain: "hosts", invalidates: [["capabilities"], ["devices"]] },
     { domain: "webext", invalidates: [["capabilities"]] },
+    { domain: "phones", invalidates: [["capabilities"], ["phones"]] },
     { domain: "runners", invalidates: [["runners"]] },
 
     // Watched because rows act on their own while nobody's watching (coming due, a turn writing back).