@intentic/sandbox-contract 1.345.0 → 1.346.0

package/src/state/history-state.ts

@@ -1,313 +0,0 @@
-import type { StateFile } from "./state-portability.js";
-
-// /history holds daemon state outside /work's `.intentic/`: real git dirs (in-tree .git is a pointer file), the fleet's
-// database and each conversation's directory, ledgers, checkpoint scopes, isolated checkouts. Nothing here is watched,
-// unlike `.intentic`. history-state-coverage.test.ts enforces this list stays complete.
-
-// historyRoot-relative paths, forward-slash, matched by prefix; a directory keeps its trailing slash so it can't
-// prefix-match a sibling file.
-export const HISTORY_STATE_FILES: readonly StateFile[] = [
-    /* ---- the machinery a restored workspace is inert without ---- */
-
-    // Every repo's real git dir, including root's own; missing it breaks a repo outright. Branches live here too.
-    { path: "gits/", portability: "carry" },
-    // Checkpoint timeline (one bare repo per scope); lets "restore to before that turn" still reach back.
-    { path: "scopes/", portability: "carry" },
-    // The fleet and everything keyed by a conversation that must agree with it: each card's record, its checkout's
-    // per-repo provenance, what each message restores to, its turn in flight and its armed watches, plus automation
-    // fires in flight. Packed as a snapshot taken for the bundle, never as the live file and its WAL, and landed row
-    // by row into the target's own database. Watches carry safely: they hold no credential, only names.
-    { path: "conversations.db", portability: "carry" },
-    // One directory per conversation: its transcript, what its last turn was told before its own words, and a fenced
-    // conversation's own runtime session store (what `.intentic/records/sessions/claude/` holds for every other).
-    // Carried whole, like the conversation it is.
-    { path: "conversations/", portability: "carry" },
-    // The tasks this sandbox's conversations handed to linked sandboxes (links/linked-children.ts), followed until they
-    // settle: part of the conversations' own record, so it goes where they go.
-    { path: "links/linked-children.json", portability: "carry" },
-    // One file per agent a conversation spawned (agent/subagents/spawned-children.ts): what its parent supervises it by
-    // (its run, session, last report and result), read back at boot so a restart does not orphan it. Part of the
-    // conversations' own record, so it goes where they go.
-    { path: "spawned-children/", portability: "carry" },
-    // One file per workflow run a conversation started (agent/subagents/workflows/script-runs.ts): its script, its calls and what
-    // each handed back, so a restart picks it up where it was and a later run can resume from its finished calls. Part of
-    // the conversations' own record, so it goes where they go.
-    { path: "script-runs/", portability: "carry" },
-    // The long tool outputs those transcripts name rather than hold, stored once by content for every record naming
-    // them; a transcript without them keeps only each output's start.
-    { path: "blobs/", portability: "carry" },
-    // Index of published-page conversations; the pages travel with /work anyway, this makes one withdrawable.
-    { path: "shares.json", portability: "carry" },
-    // Each person's own answer to which words their editor uses here (developer or maker), keyed by sign-in address
-    // (settings/member-audience.ts). Carried: it is theirs, and asking again after a move would be a question already
-    // answered.
-    { path: "member-audience.json", portability: "carry" },
-    // Each person's own answers to the editor's getting-started checklist (put away, a step passed over), keyed by sign-in
-    // address (settings/member-getting-started.ts). Carried for the same reason: a checklist someone put away should not
-    // come back after a move.
-    { path: "member-getting-started.json", portability: "carry" },
-    // Who confirmed the AI notice, and which wording (settings/member-ai-literacy.ts). Carried: it is the record an office
-    // shows for the AI Act's literacy duty, and a move must not make everyone confirm again or lose who already did.
-    { path: "member-ai-literacy.json", portability: "carry" },
-    { path: "activity.jsonl", portability: "carry" },
-    // The audit trail (one hash-chained file per month, the checkpoint retention leaves, the forwarder's cursor and the
-    // audit settings last seen). Carried: an office's trail has to survive the sandbox moving, and a fresh chain on the
-    // target would read as the old one having been deleted.
-    { path: "audit/", portability: "carry" },
-    { path: "usage.jsonl", portability: "carry" },
-    { path: "account-usage.json", portability: "carry" },
-    // What each provider's usage answers have been made of (their paths, and one redacted sample), so an answer that
-    // changes is noticed. Carried: the provider answers the same wherever the sandbox runs, and a fresh record would
-    // take the next changed answer as the first one.
-    { path: "provider-answers.json", portability: "carry" },
-    // Per-account stay-away for a provider's usage endpoint. Carried, not re-earned: earning one costs the very read it
-    // holds off, and is answered with a deadline measured from that moment. Entries past their instant are inert.
-    { path: "usage-parks.json", portability: "carry" },
-    { path: "provider-refusals.json", portability: "carry" },
-    // Models refused to this sandbox's credentials; expires daily, same subscriptions apply elsewhere.
-    { path: "model-refusals.json", portability: "carry" },
-    // When a model every credential is benched on reopens. Carried for the same reason as the refusals around it: the
-    // wait belongs to the subscription, not to the machine that hit it, and entries past their instant are inert.
-    { path: "model-cooldowns.json", portability: "carry" },
-    // What each account has run out of, for a plan publishing no allowance to poll — the refusal is the reading.
-    // Carried like the refusals above: an allowance belongs to the account, not to the machine that spent it.
-    { path: "observed-limits.json", portability: "carry" },
-    // When each provider's allowance last ran out and under how many agents, which the spawn listing quotes beside the
-    // figure left. Carried like the refusals: it describes the subscription's windows, not the machine that spent them.
-    { path: "run-outs.json", portability: "carry" },
-    // First-time dependency setup requests; carried so an interrupted queue survives export, entries self-remove.
-    { path: "dependency-requests.json", portability: "carry" },
-    // Which device cards were already offered; carry, not identity, since it holds ids, never a token.
-    { path: "host-setup-seeded.json", portability: "carry" },
-    // The deploy engine's own ledgers: a run's events and check results the Pipelines view reads.
-    { path: "apply-events.ndjson", portability: "carry" },
-    { path: "check-events/", portability: "carry" },
-
-    // User-started operator panels resume on this sandbox after a restart; a moved sandbox starts inert.
-    { path: "panels.json", portability: "derived" },
-    // Receipts name kept commands lost with container-local capture storage; never replay arbitrary commands.
-    { path: "kept-jobs/", portability: "derived" },
-    // The last hour's turns `agents message` and each link started (the daemon's store/start-window.ts), so a restart does
-    // not reopen their hourly ceilings; a moved sandbox starts its hour afresh.
-    { path: "turn-starts.json", portability: "derived" },
-
-    /* ---- regenerated by the target ---- */
-
-    // Deliberately omitted: the branch lives in gits/, the registry in conversations.db; regenerated on the next turn.
-    {
-        path: "worktrees/",
-        portability: "derived",
-        note: "Each conversation re-attaches its checkout from its branch on its next turn.",
-    },
-    // Search phrase index, derived from the conversations' transcripts; rebuilt by the first boot's backfill instead.
-    { path: "said-index/", portability: "derived", note: "Rebuilt from the carried transcripts by the first boot's backfill." },
-    // What each connected machine and browser publishes as its tools, so one that is asleep still appears in a turn
-    // (peers/peer-tool-memory.ts). Re-asked of every peer the moment it reconnects, and about software that stayed
-    // behind on somebody else's computer, so it is not worth carrying.
-    { path: "peer-tools.json", portability: "derived" },
-    { path: "overlays/", portability: "derived" },
-    { path: "logs/", portability: "derived" },
-    { path: "trash/", portability: "derived" },
-    { path: ".isolation-probe", portability: "derived" },
-    // Finished bundles, excluded so an export doesn't pack every prior export in; kept off /work, unwatched.
-    { path: "exports/", portability: "derived" },
-    // Each transcript as it was before this format converted it, zstd-compressed: a local way back, never read here.
-    { path: "backups/", portability: "derived" },
-    // Bundles being taken in, mid-review; excluded as someone else's. Deleted on apply/abandon, swept after a crash.
-    { path: "arrivals/", portability: "derived" },
-    // The agent engines this sandbox installed beside the image's own, each with its pointer file; reinstalled on demand.
-    { path: "engines/", portability: "derived" },
-    // An update the host downloaded and built for this sandbox (`ic sandbox prepare`); about this machine only.
-    { path: "update-staged.json", portability: "derived" },
-    // A download the host is running for this sandbox right now (ic rewrites it every few seconds, removes it when done).
-    { path: "update-preparing.json", portability: "derived" },
-    // What the host last did about this sandbox's version (ic writes it), the owner's skipped release, and why the
-    // last boot could not start (the daemon writes it, the host's probation reads it): all rebuilt by whoever next says.
-    { path: "update-outcome.json", portability: "derived" },
-    { path: "update-skipped.json", portability: "derived" },
-    // Whether this sandbox takes downloaded updates by itself, a pause, and the update it last started unasked
-    // (system/updates/update-policy.ts): about this machine's restarts, so a moved sandbox starts on the default.
-    { path: "update-policy.json", portability: "derived" },
-    { path: "boot-failure.json", portability: "derived" },
-    // A rebuild's ask that the next boot resume the turns it cuts (restart-resume.ts): about this machine's next boot only,
-    // read once by it, so a moved sandbox starts without one.
-    { path: "restart-resume.json", portability: "derived" },
-    // Spawned children paused on a re-run the sandbox booked for them (agent/subagents/paused-children.ts): the booking
-    // is this process's memory, so the next boot tells each parent that its child stays stopped, then forgets the entry.
-    // About this machine's restarts, so a moved sandbox starts without it.
-    { path: "paused-children.json", portability: "derived" },
-    // When this machine's daemon booted (system/boot/boot-history.ts), for telling a restart storm from a restart: about
-    // this machine's restarts, so a moved sandbox starts without it.
-    { path: "boot-history.json", portability: "derived" },
-    // When each housekeeping chore last ran (system/chore-clock.ts), so a restart does not run a daily one again; a moved
-    // sandbox runs each once at its first boot.
-    { path: "chore-clock.json", portability: "derived" },
-    // The last disk measurement (system/resources/storage/disk-storage.ts), kept so a restart still shows one, dated. About
-    // this machine's volumes, so a moved sandbox measures its own.
-    { path: "storage-scan.json", portability: "derived" },
-
-    /* ---- the unprivileged agent's execution domain (the daemon's workload/domain/agent-domain-view.ts) ---- */
-
-    // The agent's own HOME and the per-runtime homes beside it: what the agent keeps outlives a recreate, which includes
-    // any login a command-line tool it ran saved there. `secret` for that, since the daemon cannot tell one from the rest.
-    {
-        path: "agent-home/",
-        portability: "secret",
-        note: "Sign the agent's own command-line tools in again where it used them.",
-    },
-    {
-        path: "agent-homes/",
-        portability: "secret",
-        note: "Sign the agent's own command-line tools in again where it used them.",
-    },
-    // Container storage a domain's runtime filled, pulled again on demand.
-    { path: "agent-containers/", portability: "derived" },
-    // Each domain view's staging directory (`agent-domain-` and a random suffix), removed when its domain ends.
-    { path: "agent-domain-", portability: "derived" },
-
-    /* ---- credentials ---- */
-
-    // The ssh alias dir ~/.ssh/intentic-hosts symlinks to: per-host config, each key's public half, password files, and a
-    // key with a passphrase. Every other private key is in the key store under the auth root (ssh-keys/).
-    {
-        path: "ssh-hosts/",
-        portability: "secret",
-        note: "Re-add each ssh host on the Capabilities view, its key does not travel.",
-    },
-    // The container sshd's host key (docker-entrypoint.sh generates it once): the sandbox's SSH identity, which desktop
-    // sync pins. A private key, so it stays; the target makes its own on first boot.
-    {
-        path: "ssh-host-keys/",
-        portability: "secret",
-        note: "Clear this sandbox's old host key from your computer's known_hosts before syncing it again.",
-    },
-    // The cli-proxy's config, which holds the routed subscriptions' provider tokens.
-    {
-        path: "translator/",
-        portability: "secret",
-        note: "Sign the routed AI subscriptions in again on the Agent tab.",
-    },
-
-    /* ---- identity: what binds this sandbox to its owner, its browsers and its host ---- */
-
-    // Signs every browser session cookie; carrying it would let the holder mint sessions against the target.
-    { path: "session-secret", portability: "identity", note: "Sign in again, the target signs its own sessions." },
-    // The platform's id for this sandbox's row, as its announce last said (system/boot/platform-row.ts): the target is
-    // its own row, and learns its own id at its first announce.
-    { path: "platform-row.json", portability: "identity", note: "The target learns its own platform id when it first announces." },
-    // Who owns this sandbox, who else may reach it and at what tier, and the hashed control tokens programs present:
-    // the daemon's to decide, so kept off the workspace every turn writes (auth/members/identity-off-workspace.ts moved
-    // them from `.intentic/identity/` on 2026-10-06). An access list that traveled would let a source sandbox hand
-    // itself the target's ownership, and a token authenticates against the sandbox that minted it.
-    { path: "identity/owner.json", portability: "identity", note: "The target is bound by its own owner's first sign-in." },
-    {
-        path: "identity/members.json",
-        portability: "identity",
-        note: "Re-invite collaborators from the Access tab, a grant is the platform's record, and the target enforces its own copy.",
-    },
-    {
-        path: "identity/control-tokens.json",
-        portability: "identity",
-        note: "Mint fresh control tokens, the old ones authenticate against the source sandbox.",
-    },
-    // The links other sandboxes hand this one tasks through (links/inbound-links.ts): hashed tokens like the control
-    // tokens, each minted here, and the tasks filed under them; elsewhere they would let the paired sandboxes reach the
-    // target in this one's name.
-    {
-        path: "identity/links.json",
-        portability: "identity",
-        note: "Pair the sandboxes that hand this one tasks again from its Access tab: their links name the source sandbox.",
-    },
-    // Public keys, the owner's require-a-passkey switch and the hashes of their recovery codes, moved from
-    // `.intentic/identity/passkeys.json` the same way (the passkeys-off-workspace step), since a passkey sign-in trusts
-    // the row it finds: a copy that traveled would let a source sandbox's passkeys open the target.
-    {
-        path: "identity/passkeys.json",
-        portability: "identity",
-        note: "Passkeys are bound to the sandbox they were registered with: add them again on the new one from its Access tab.",
-    },
-    {
-        path: "browser-access-disabled",
-        portability: "identity",
-        note: "Account-deletion retirement belongs to the source sandbox; the imported copy starts with fresh browser access.",
-    },
-    {
-        path: "push.json",
-        portability: "identity",
-        note: "Re-enable notifications in the browsers you use, a push subscription is bound to the sandbox that minted it.",
-    },
-    { path: "sync-enrollments.json", portability: "identity", note: "Re-pair desktop sync from the Sync tab." },
-    { path: "sync-pair-consumed.json", portability: "identity" },
-    { path: "host-enrollments.json", portability: "identity" },
-    // A connected browser's enrollment, paired to this sandbox; carrying it elsewhere is dead weight or worse.
-    { path: "webext-enrollments.json", portability: "identity", note: "Pair your browser again from its card: the extension is still installed." },
-    // The browser pairing burn list; a redeemed pairing must not read as fresh wherever this file travels.
-    { path: "webext-pair-consumed.json", portability: "identity" },
-    // A phone's enrollment and its wake channel, paired to this sandbox; the app on the phone stays installed.
-    { path: "phone-enrollments.json", portability: "identity", note: "Pair your phone again from its card: the app is still installed." },
-    { path: "phone-pair-consumed.json", portability: "identity" },
-    { path: "phone-wake.json", portability: "identity" },
-    // Which computers' keyrings each phone paired with for Passwords (phones/phone-pairings.ts): a shortcut over the
-    // keyrings' own pinned keys, keyed by phones paired to this sandbox, so it stays with the pairings above.
-    { path: "phone-pairings.json", portability: "identity" },
-    // Setup-device pairing burn list; carrying it would mark another sandbox's fresh pairing as spent.
-    { path: "host-pair-consumed.json", portability: "identity" },
-    // Lands waiting for the computer whose folder they go to, and which computer last held each attached folder
-    // (conversations/land/project-delivery.ts): about the machine this sandbox runs beside, whose folders a moved
-    // sandbox does not have.
-    { path: "project-deliveries.json", portability: "identity" },
-    // The folders attached to this computer's own sandbox, by name (the daemon's system/projects-registry.ts): which of the
-    // computer's folders sync in, so it stays with the sandbox that runs beside them. The folders' copies and repos travel
-    // with /work and gits/; a moved sandbox treats them as ordinary repos.
-    { path: "projects.json", portability: "identity", note: "Attach the folders again from the desktop app on the computer that holds them." },
-    // A runner's enrollment names this sandbox as parent; elsewhere its digest would dial the old parent.
-    { path: "runner-enrollments.json", portability: "identity" },
-    { path: "runner-pair-consumed.json", portability: "identity" },
-    // This container's own identity and reconnect token; elsewhere it would dial the parent as this runner.
-    { path: "runner-identity.json", portability: "identity" },
-    // The owner's yes to a workspace's hooks, pinned to their bytes: a trust decision the target's owner makes again.
-    { path: "hook-approvals.json", portability: "identity", note: "Approve the workspace's Claude Code hooks again from Approvals." },
-    // The hook sets waiting for that yes; the next turn that finds them lists them again.
-    { path: "hook-requests.json", portability: "derived" },
-    // The owner's yes to each workspace extension's declared powers, decided again by the target's owner.
-    { path: "extension-approvals.json", portability: "identity", note: "Approve the extensions written in this workspace again from Extensions." },
-    // The owner's yes to each item in the approvals queue, pinned to what it will do: the queue travels with /work, and
-    // an item that arrives approved without its yes is not carried out until the target's owner gives it again.
-    {
-        path: "approval-decisions.json",
-        portability: "identity",
-        note: "Approve again from Approvals anything that was approved and had not run yet.",
-    },
-    // The wakes automations hold for a person, one file each (the daemon's automations/held-wakes-store.ts): daemon-minted, so
-    // kept where no turn writes. They travel with the workspace as they always did; a countdown hold arrives waiting for a
-    // person, since the key that signed it stays behind.
-    { path: "automation-holds/", portability: "carry" },
-    { path: "automation-holds.key", portability: "identity", note: "A held wake that was counting down arrives waiting for your yes instead." },
-    // What waits for an automation fire not journalled yet (the daemon's automations/durable/inbox-store.ts): a channel
-    // message in its debounce or behind a running fire, a workspace event behind its chore. Travels with the turn journal
-    // in conversations.db, which names the rows a fire already took.
-    { path: "automation-listener-inbox.json", portability: "carry" },
-    { path: "automation-workspace-inbox.json", portability: "carry" },
-    { path: "local-cert/", portability: "identity" },
-
-    /* ---- the state engine's own bookkeeping (the daemon's store/evolution/state-journal.ts) ---- */
-
-    // Pre-images of the history files an update's conversions changed; `secret` since identity files are among them.
-    { path: "converting/", portability: "secret", note: "An update's undo record stays with the sandbox it happened on." },
-    // Which conversion episodes are open or recently committed, and earlier addresses awaiting removal.
-    { path: "state-journal.json", portability: "derived" },
-    // Every conversation the import of the pre-1.308 layout settled (the daemon's conversations/registry/pre-1308-import.ts),
-    // so one deleted after its import is not brought back from the old files still on disk. About this volume only.
-    { path: "pre-1308-import.json", portability: "derived" },
-
-    /* ---- written beside the daemon, by the image, the host's ic and the package manager ---- */
-
-    // The terminal's typed history (the image's HISTFILE, made by docker-entrypoint.sh): the owner's own, kept so its
-    // suggestions survive a rebuild. `secret`, since a typed line can hold a pasted token.
-    { path: "shell/", portability: "secret" },
-    // ic's copy of its records for this sandbox (ic's sandbox/mirror.rs): its channel and rollback target, the machine
-    // that keeps it, its backups and repairs. About the machine it runs on, so the target's ic writes its own.
-    { path: ".ic/", portability: "identity" },
-    // pnpm's package store for installs in a checkout under /history, kept at the top of the mount pnpm finds it on.
-    { path: ".pnpm-store/", portability: "derived" },
-];