@intentic/sandbox-contract 1.349.0 → 1.351.0

package/src/schemas/agents.ts

@@ -10,6 +10,8 @@ import { AgentNeedSchema } from "./needs.js";
 import { EMOJI_MAX_LENGTH, isSingleEmoji } from "../text/emoji.js";
 import { ProgramAskSchema } from "../events/requests.js";
 import { ReviewTallySchema, TurnProofSchema } from "./work-assurance.js";
+import { AgentReactionSchema, SessionOwnerSchema } from "./agent-people.js";
+export { AgentReactionSchema, ReactorSchema, SessionOwnerSchema, type AgentReaction, type Reactor, type SessionOwner } from "./agent-people.js";
 // A fleet agent is any conversation with a registry entry, keyed by conversationId. Isolated ones own a git worktree
 // (branch agent/<id>); workspace conversations have none, but both share one status/activity/cost lifecycle.
 
@@ -237,37 +239,6 @@ export type LandedMessageDraft = z.infer<typeof LandedMessageDraftSchema>;
 // offer the press that clears a refusal without knowing whose refusal it is.
 export const LandConflictReasonSchema = z.enum(["workspace", "diverged", "binary"]);
 export type LandConflictReason = z.infer<typeof LandConflictReasonSchema>;
-// One person behind one mark. The instant rides along so the group can be ordered by who was first, which is also the
-// order the names read in.
-export const ReactorSchema = z.object({
-    email: z.string().describe("Who it was, as the sandbox verified them."),
-    name: z.string().optional().describe("What to call them, when their sign-in carried a name. Absent leaves the address to stand for them."),
-    at: z.number().describe("When they marked it, in milliseconds."),
-});
-export type Reactor = z.infer<typeof ReactorSchema>;
-// The member answerable for a conversation: whose questions its cards are, who a reviewer asks about its work. Derived
-// once from the starter, moved only by `agents.assign`; never a program, which is what `startedBy` is for.
-export const SessionOwnerSchema = z.object({
-    email: z.string().describe("Who answers for this conversation, as the sandbox verified them."),
-    name: z
-        .string()
-        .optional()
-        .describe("What to call them, when the sign-in that made them its owner carried a name. Absent leaves the address to stand for them."),
-    since: z.number().describe("When they became its owner, in milliseconds."),
-});
-export type SessionOwner = z.infer<typeof SessionOwnerSchema>;
-// Grouped by emoji on the wire, not as a flat list of presses: every surface draws one chip per emoji, and grouping
-// here is what stops three of them each grouping it differently.
-export const AgentReactionSchema = z.object({
-    emoji: z.string().describe("The mark itself, one emoji, carried as the character rather than as a name that would need a table on both sides."),
-    by: z
-        .array(ReactorSchema)
-        .min(1)
-        .describe(
-            "Everyone wearing this mark, oldest first, each by name. Carried whole rather than as a count, because a chip reading 3 that cannot say whose is a number nobody can answer. Never empty: the last person taking theirs back takes the whole chip with it.",
-        ),
-});
-export type AgentReaction = z.infer<typeof AgentReactionSchema>;
 export const AgentSummarySchema = z.object({
     id: z.string().describe("The conversation id, which is how every other call addresses it."),
     sessionId: z.string().optional().describe("The provider session behind the last turn. It is retired whenever the model or account changes."),
@@ -412,6 +383,14 @@ export const AgentSummarySchema = z.object({
     fresh: FreshSessionSchema.optional().describe(
         "Set on a conversation started on another conversation's work without its messages (a code review, a test pass, a person's own ask): which one, for what, and when. Absent for every other conversation.",
     ),
+    // Latched on the opening turn (ids/conversation-ids.ts homeConversationId). Rides the summary because it decides who
+    // may see the row at all (auth/fleet-scope.ts visibleTo): its owner, and the sandbox's owner.
+    home: z
+        .literal(true)
+        .optional()
+        .describe(
+            "This is its owner's home conversation in this sandbox: the one long-running chat the master view opens, which orchestrates its own subagents, holds their work until it accepts it, and lands and commits by itself. Only its owner and the sandbox's owner see it. Absent for every other conversation.",
+        ),
     // Root repo's short base sha; per-repo bases stay daemon-internal.
     base: z.string().optional().describe("The commit its private copy started from, shortened."),
     costUsd: z.number().optional().describe("What it has cost so far, in dollars. A subagent's spend is its own and is not folded in here."),

package/src/schemas/conversation-links.ts

@@ -36,6 +36,11 @@ export const FreshSessionSchema = z.object({
     of: ConversationIdSchema.describe("The conversation whose work it started from."),
     kind: FreshKindSchema.describe("What it was opened for: a code review, a test pass, or the person's own ask."),
     at: z.number().describe("When it started, in milliseconds. Work its origin changed after this is work it has not seen."),
+    // An orchestrator judging its own subagent's work (spawn with `freshOf`): the session is still the origin's child, cut
+    // from its work and landing back into it, but it reports to the agent that opened it, which supervises it.
+    by: ConversationIdSchema.optional().describe(
+        "The agent that opened it, when an agent did rather than a person: an orchestrator judging the work of a subagent it spawned. Its report goes to that agent. Absent for a person's session.",
+    ),
 });
 export type FreshSession = z.infer<typeof FreshSessionSchema>;
 

package/src/schemas/devices.ts

@@ -304,8 +304,7 @@ export const DevicePortSchema = z.object({
     command: z.string().optional(),
 });
 export type DevicePort = z.infer<typeof DevicePortSchema>;
-// The device's one agent process as a single block; `running` also gates whether the rest of the report is still
-// current, a dead loop leaves every other row reading as it did before it died.
+// The device's one agent process; `running` gates whether the rest of a report is current (a dead loop freezes it).
 export const DeviceAgentSchema = z.object({
     running: z.boolean(),
     pid: z.number().int().optional(),
@@ -313,12 +312,13 @@ export const DeviceAgentSchema = z.object({
     installed: z.string().optional(),
     // Build actually serving, stamped in the pidfile; can lag `installed` indefinitely (see `agentBuildSkew`).
     build: z.string().optional(),
-    // When the loop last finished a pass; a live process can have a dead loop (see `agentStalled`).
+    // When the sync loop last moved; absent while nothing is paired (no loop runs). A live process can have a dead loop.
     lastTickAt: z.number().optional(),
 });
 export type DeviceAgent = z.infer<typeof DeviceAgentSchema>;
-// Loop polls every 5s with two 10s network timeouts per pairing; a minute is several passes of slack.
-export const AGENT_STALL_AFTER_MS = 60_000;
+// Stalled only once the agent's own restart of a loop that stopped moving (machine sync/mirror.ts) is overdue.
+export const WATCHER_STALL_MS = 20 * 60_000;
+export const AGENT_STALL_AFTER_MS = WATCHER_STALL_MS + 2 * 60_000;
 export const agentStalled = (agent: DeviceAgent, now: number): boolean =>
     agent.running && agent.lastTickAt !== undefined && now - agent.lastTickAt > AGENT_STALL_AFTER_MS;
 export const DeviceReportSchema = z.object({

package/src/state/workspace-state.test.ts

@@ -398,6 +398,8 @@ describe(`VERSIONED_STATE_PATHS`, () => {
             // Which commands count as heavy, and how many may run at once; a shared-box decision worth a `git log`
             // line.
             `${STATE_DIR}/config/heavy-commands.json`,
+            // What a home conversation reviews, merges and asks a person about; same reason as the safety policy.
+            `${STATE_DIR}/config/home.md`,
             `${STATE_DIR}/config/loop-designs.json`,
             `${STATE_DIR}/config/personas.json`,
             // A persona's prompt and reachable skills: the text that decides how it behaves, same reason as its card.

package/src/state/workspace-state.ts

@@ -100,6 +100,10 @@ const STATE_FILES = [
     // may do unasked, so a fresh sandbox should start already governed and changes should show in review. Absent falls
     // back to `DEFAULT_SAFETY_POLICY`, not unconfigured.
     { path: ".intentic/config/safety.md", invalidates: ["safety-policy"], portability: "carry", versioned: true },
+    // What every home conversation works by (conversations/home/home-policy.ts): when it reviews, tests, merges and asks a
+    // person. `carry`+`versioned` like the safety policy, since it governs what an orchestrator lands unasked. Absent falls
+    // back to `DEFAULT_HOME_POLICY`.
+    { path: ".intentic/config/home.md", invalidates: [], portability: "carry", versioned: true, why: "Read per home turn; no view shows it." },
     // Verdicts the policy above produced, newest first. `derived`/`local`: evidence about this machine, self-trimming,
     // not carried. Own query key, separate from the policy's, since a verdict must not invalidate the document someone
     // is editing.
@@ -305,12 +309,7 @@ const STATE_FILES = [
     // Unlike the settings file, this switch is observed by the Extensions tab's query, so a flip elsewhere shows up
     // live. Toggling doesn't itself rerun the host, that happens via the loader's reconcile, triggered by the tab's own
     // toggle.
-    {
-        path: ".intentic/config/extension-enablement.json",
-        invalidates: ["extensions"],
-        portability: "carry",
-        versioned: true,
-    },
+    { path: ".intentic/config/extension-enablement.json", invalidates: ["extensions"], portability: "carry", versioned: true },
     // Workspace extensions: one directory per extension, written directly by the agent's file tools and live
     // immediately (no clone, no install step). `authored`, unlike `.intentic/extensions/` below which holds clones.
     // `versioned`: every other load path is already reviewable (a git-installed extension's sha, a baked one's image);