@sellable/install 0.1.800 → 0.1.802

package/lib/sellable-agent/hermes-memory-snapshot.mjs

@@ -16,10 +16,8 @@ import {
   readdirSync,
   renameSync,
   rmSync,
-  statfsSync,
   writeFileSync,
 } from "node:fs";
-import { tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { promisify } from "node:util";
 import { parseDocument } from "yaml";
@@ -213,18 +211,11 @@ export const HERMES_SNAPSHOT_MAX_ARCHIVE_BYTES = 512 * 1024 * 1024;
 const MAX_PLUGIN_DATA_BYTES = 10 * 1024 * 1024;
 const MAX_PORTABLE_EXTERNAL_BYTES = 32 * 1024 * 1024;
 const MAX_PORTABLE_CONFIG_BYTES = 64 * 1024;
-// Portable snapshots contain user-authored/customizable state plus the compact
-// Hermes session database and routing records required to continue an existing
-// Slack thread after a Machine/volume migration. If native Hermes cannot
-// package that bounded set within two minutes, abort the helper and let the
-// persistent retry scheduler back off instead of contending with the live
-// Slack gateway for a full ten minutes.
+// Portable snapshots contain only state that compounds (see
+// HERMES_SNAPSHOT_USER_STATE_ENTRIES), a few megabytes. If native Hermes cannot
+// package that within two minutes, abort the helper and let the persistent
+// retry scheduler back off instead of contending with the live Slack gateway.
 const NATIVE_COMMAND_TIMEOUT_MS = 120_000;
-// A healthy established Admin state DB can exceed 500 MiB. Keep compaction
-// bounded inside the 15-minute Upgrade backup stage without killing SQLite's
-// final VACUUM on shared Fly CPU.
-const STATE_DB_COMPACTION_TIMEOUT_MS = 600_000;
-export const HERMES_SNAPSHOT_CRON_SESSION_RETENTION_HOURS = 48;
 const TRANSIENT_PROFILE_ROOTS = new Set([
   ".artifact-venv",
   ".cache",
@@ -259,11 +250,11 @@ export function isHermesTransientProfilePath(relativePath) {
     TRANSIENT_PROFILE_PATHS.has(relativePath)
   );
 }
-// The encrypted Fly volume remains the authoritative full profile. The
-// portable disaster-recovery archive also carries state.db and sessions so a
-// replacement volume retains chat history and Slack thread routing. Caches,
-// dependency trees, secrets, and live logs remain excluded.
-export const HERMES_SNAPSHOT_USER_STATE_ENTRIES = Object.freeze([
+// Durable profile entries the pre-profile layout kept directly under
+// HERMES_HOME. The one-time legacy move carries all of them, run history
+// included, because it moves live state on the volume rather than packing a
+// recovery archive.
+const HERMES_LEGACY_USER_STATE_ENTRIES = Object.freeze([
   "AGENTS.md",
   "SOUL.md",
   "artifacts",
@@ -286,6 +277,26 @@ export const HERMES_SNAPSHOT_USER_STATE_ENTRIES = Object.freeze([
   "state.db",
   "workspace",
 ]);
+// The encrypted Fly volume remains the authoritative full profile and keeps
+// everything across an in-place Upgrade. The portable archive, used only to
+// rebuild an Agent on a replacement volume, carries just the state that
+// compounds: who the Agent is (SOUL, AGENTS), what it remembers, the skills it
+// learned, its scheduled work (cron and the scripts cron runs), hooks and
+// plugins. Run history (state.db, sessions), task boards and scratch areas
+// never travel: a rebuilt Agent starts fresh conversations with all of the
+// above. Caches, dependency trees, secrets and live logs remain excluded.
+export const HERMES_SNAPSHOT_USER_STATE_ENTRIES = Object.freeze([
+  "AGENTS.md",
+  "SOUL.md",
+  "cron",
+  "hooks",
+  "memories",
+  "memory",
+  "plugin-data",
+  "plugins",
+  "scripts",
+  "skills",
+]);
 export const HERMES_SNAPSHOT_RETRY_BACKOFF_MS = Object.freeze([
   15 * 60_000,
   60 * 60_000,
@@ -998,272 +1009,6 @@ const childRunner = (runChild) => runChild ?? runBoundedHermesChild;
 const childFailed = (result) =>
   result?.exitCode !== 0 || result?.timedOut || result?.outputLimitExceeded;
 
-const STATE_DB_COMPACTION_SCRIPT = String.raw`
-import json
-import os
-import sqlite3
-import sys
-import time
-
-source_path, target_path = sys.argv[1], sys.argv[2]
-retention_hours = int(sys.argv[3])
-# VACUUM INTO writes one consistent, compact copy of the live pages only, so
-# space the live database has freed never travels with the backup.
-source = sqlite3.connect("file:" + source_path + "?mode=ro", uri=True)
-try:
-    source.execute("VACUUM INTO ?", (target_path,))
-finally:
-    source.close()
-destination = sqlite3.connect(target_path)
-
-try:
-    if destination.execute("PRAGMA quick_check").fetchone()[0] != "ok":
-        raise RuntimeError("source backup failed quick_check")
-    destination.execute("PRAGMA foreign_keys=ON")
-    table_names = {
-        row[0]
-        for row in destination.execute(
-            "SELECT name FROM sqlite_master WHERE type='table'"
-        )
-    }
-    pruned_sessions = 0
-    pruned_messages = 0
-    if {"sessions", "messages"}.issubset(table_names):
-        cutoff = time.time() - retention_hours * 60 * 60
-        session_columns = {
-            row[1] for row in destination.execute("PRAGMA table_info(sessions)")
-        }
-        pinned_clause = (
-            "AND COALESCE(pinned, 0) = 0" if "pinned" in session_columns else ""
-        )
-        destination.execute(
-            "CREATE TEMP TABLE snapshot_pruned_sessions(id TEXT PRIMARY KEY)"
-        )
-        destination.execute(
-            "WITH RECURSIVE doomed(id) AS ("
-            # Hermes never ends an endpoint run's (api_server) session; past
-            # the retention it is as finished as an ended cron session.
-            " SELECT id FROM sessions"
-            " WHERE ((source = 'cron' AND ended_at IS NOT NULL)"
-            " OR source = 'api_server')"
-            " AND COALESCE(last_activity_at, ended_at, started_at) < ? "
-            + pinned_clause
-            + " UNION"
-            " SELECT child.id FROM sessions child"
-            " JOIN doomed parent ON child.parent_session_id = parent.id"
-            ") INSERT OR IGNORE INTO snapshot_pruned_sessions(id)"
-            " SELECT id FROM doomed",
-            (cutoff,),
-        )
-        pruned_sessions = destination.execute(
-            "SELECT COUNT(*) FROM snapshot_pruned_sessions"
-        ).fetchone()[0]
-        pruned_messages = destination.execute(
-            "SELECT COUNT(*) FROM messages WHERE session_id IN "
-            "(SELECT id FROM snapshot_pruned_sessions)"
-        ).fetchone()[0]
-        destination.execute(
-            "DELETE FROM messages WHERE session_id IN "
-            "(SELECT id FROM snapshot_pruned_sessions)"
-        )
-        if "session_model_usage" in table_names:
-            destination.execute(
-                "DELETE FROM session_model_usage WHERE session_id IN "
-                "(SELECT id FROM snapshot_pruned_sessions)"
-            )
-        destination.execute(
-            "DELETE FROM sessions WHERE id IN "
-            "(SELECT id FROM snapshot_pruned_sessions)"
-        )
-        if "system_prompts" in table_names:
-            destination.execute(
-                "DELETE FROM system_prompts WHERE NOT EXISTS ("
-                " SELECT 1 FROM sessions"
-                " WHERE sessions.system_prompt_hash = system_prompts.hash"
-                ")"
-            )
-        destination.commit()
-    if pruned_sessions:
-        for table in ("messages_fts", "messages_fts_trigram", "messages_fts_cjk"):
-            if table in table_names:
-                destination.execute(
-                    'INSERT INTO "' + table + '" ("' + table + '") VALUES (\'optimize\')'
-                )
-        destination.commit()
-        destination.execute("VACUUM")
-    if destination.execute("PRAGMA quick_check").fetchone()[0] != "ok":
-        raise RuntimeError("compacted backup failed quick_check")
-    if destination.execute("PRAGMA foreign_key_check").fetchone() is not None:
-        raise RuntimeError("compacted backup failed foreign_key_check")
-finally:
-    destination.close()
-
-os.chmod(target_path, 0o600)
-print(json.dumps({
-    "ok": True,
-    "prunedSessions": pruned_sessions,
-    "prunedMessages": pruned_messages,
-    "retentionHours": retention_hours,
-    "archiveStateBytes": os.path.getsize(target_path),
-}, separators=(",", ":")))
-`;
-
-// Room the volume keeps after the compact copy lands, so a backup never
-// leaves the live gateway without space to write.
-const STATE_DB_VOLUME_HEADROOM_BYTES = 64 * 1024 * 1024;
-
-function freeBytesAt(directory) {
-  const stats = statfsSync(directory);
-  return stats.bavail * stats.bsize;
-}
-
-const compactionFailure = (reason) =>
-  new Error("hermes_snapshot_state_db_compaction_failed", { cause: reason });
-
-// A bounded reason for the operator log; never the child's raw output.
-function compactionChildFailureReason(result) {
-  if (result?.timedOut) return "timeout";
-  if (result?.outputLimitExceeded) return "output_limit";
-  const stderr = String(result?.stderr ?? "");
-  if (/database or disk is full|No space left on device/i.test(stderr)) {
-    return "disk_full";
-  }
-  if (/quick_check|foreign_key_check/.test(stderr)) return "integrity";
-  if (/sqlite3\.\w*Error/.test(stderr)) return "sqlite_error";
-  return "child_failed";
-}
-
-export async function compactHermesSnapshotStateDb({
-  sourcePath,
-  targetPath,
-  retentionHours = HERMES_SNAPSHOT_CRON_SESSION_RETENTION_HOURS,
-  hermesPython = HERMES_PYTHON,
-  scratchDirectory = tmpdir(),
-  volumeFreeBytes = freeBytesAt,
-  runChild = /** @type {typeof runBoundedHermesChild | undefined} */ (
-    undefined
-  ),
-}) {
-  if (
-    !isAbsolute(sourcePath) ||
-    !isAbsolute(targetPath) ||
-    !isAbsolute(scratchDirectory) ||
-    resolve(sourcePath) === resolve(targetPath) ||
-    !existsSync(sourcePath) ||
-    existsSync(targetPath) ||
-    !existsSync(scratchDirectory) ||
-    !Number.isSafeInteger(retentionHours) ||
-    retentionHours < 1 ||
-    retentionHours > 30 * 24
-  ) {
-    throw new Error("hermes_snapshot_state_db_compaction_rejected");
-  }
-  regularFile(sourcePath);
-  const scratchStat = lstatSync(scratchDirectory);
-  if (scratchStat.isSymbolicLink() || !scratchStat.isDirectory()) {
-    throw new Error("hermes_snapshot_state_db_compaction_rejected");
-  }
-  mkdirSync(dirname(targetPath), { recursive: true, mode: 0o700 });
-  let scratchRoot;
-  let finalTemporaryPath;
-  let targetCreated = false;
-  try {
-    // Keep SQLite's destination plus VACUUM journal on the Machine's
-    // ephemeral root filesystem. Building both beside the protected staging
-    // tree can briefly require multiple full state.db copies on the small
-    // persistent Fly volume and strand an otherwise healthy Upgrade at
-    // BACKING_UP with ENOSPC. Only the verified compact database crosses back
-    // onto the volume.
-    scratchRoot = mkdtempSync(
-      join(scratchDirectory, ".sellable-hermes-state-db-")
-    );
-    chmodSync(scratchRoot, 0o700);
-    const scratchTargetPath = join(scratchRoot, "state.db");
-    const result = await childRunner(runChild)({
-      command: hermesPython,
-      args: [
-        "-c",
-        STATE_DB_COMPACTION_SCRIPT,
-        sourcePath,
-        scratchTargetPath,
-        String(retentionHours),
-      ],
-      env: { ...process.env, NO_COLOR: "1" },
-      shell: false,
-      timeoutMs: STATE_DB_COMPACTION_TIMEOUT_MS,
-      maxOutputBytes: 64 * 1024,
-    });
-    if (childFailed(result) || !existsSync(scratchTargetPath)) {
-      throw compactionFailure(compactionChildFailureReason(result));
-    }
-    const scratchTarget = regularFile(scratchTargetPath);
-    const summary = JSON.parse(String(result.stdout ?? ""));
-    if (
-      summary?.ok !== true ||
-      summary.retentionHours !== retentionHours ||
-      !Number.isSafeInteger(summary.prunedSessions) ||
-      summary.prunedSessions < 0 ||
-      !Number.isSafeInteger(summary.prunedMessages) ||
-      summary.prunedMessages < 0 ||
-      summary.archiveStateBytes !== scratchTarget.size
-    ) {
-      throw compactionFailure("invalid_result");
-    }
-    // Only this compact copy lands on the persistent volume (the rest of the
-    // staged profile is hard links). Refuse up front when it cannot fit,
-    // rather than half-writing it and failing as a generic error.
-    if (
-      volumeFreeBytes(dirname(targetPath)) <
-      scratchTarget.size + STATE_DB_VOLUME_HEADROOM_BYTES
-    ) {
-      throw compactionFailure("disk_full");
-    }
-    finalTemporaryPath = join(
-      dirname(targetPath),
-      `.${basename(targetPath)}.${randomUUID()}`
-    );
-    copyFileSync(
-      scratchTargetPath,
-      finalTemporaryPath,
-      constants.COPYFILE_EXCL
-    );
-    chmodSync(finalTemporaryPath, 0o600);
-    const targetFd = openSync(finalTemporaryPath, constants.O_RDONLY);
-    try {
-      fsyncSync(targetFd);
-    } finally {
-      closeSync(targetFd);
-    }
-    // link(2) gives this staged publication no-replace semantics. If another
-    // writer created targetPath after admission, fail without deleting or
-    // overwriting the other writer's file.
-    linkSync(finalTemporaryPath, targetPath);
-    targetCreated = true;
-    rmSync(finalTemporaryPath, { force: true });
-    finalTemporaryPath = undefined;
-    fsyncDirectory(dirname(targetPath));
-    if (regularFile(targetPath).size !== scratchTarget.size) {
-      throw new Error("hermes_snapshot_state_db_compaction_failed");
-    }
-    return summary;
-  } catch (error) {
-    if (targetCreated) rmSync(targetPath, { force: true });
-    const reason =
-      error?.cause ?? (error?.code === "ENOSPC" ? "disk_full" : "copy_failed");
-    process.stderr.write(
-      `${JSON.stringify({
-        ok: false,
-        code: "hermes_snapshot_state_db_compaction_failed",
-        reason,
-      })}\n`
-    );
-    throw new Error("hermes_snapshot_state_db_compaction_failed");
-  } finally {
-    if (finalTemporaryPath) rmSync(finalTemporaryPath, { force: true });
-    if (scratchRoot) rmSync(scratchRoot, { recursive: true, force: true });
-  }
-}
-
 function nativeSummaryAccepted(result, complete, incomplete) {
   const output = `${result?.stdout ?? ""}\n${result?.stderr ?? ""}`;
   return (
@@ -1387,8 +1132,8 @@ function stageHermesUserState({ profileId, profileRoot, hermesRoot }) {
         }
         const target = join(stagedProfileRoot, name);
         // Hermes rejects the live SOUL when its link count is not exactly one.
-        // Snapshot compaction can run for minutes, so a staged hard link would
-        // make otherwise healthy Agent turns fail for the whole capture window.
+        // A capture can run for a while, so a staged hard link would make
+        // otherwise healthy Agent turns fail for the whole capture window.
         copyFileSync(source, target, constants.COPYFILE_EXCL);
         chmodSync(target, 0o600);
         if (regularFile(target).nlink !== 1) {
@@ -1396,10 +1141,6 @@ function stageHermesUserState({ profileId, profileRoot, hermesRoot }) {
         }
         continue;
       }
-      // state.db is copied online and compacted after the rest of the staged
-      // tree is assembled. Never hard-link this one file: pruning the staged
-      // recovery copy must be physically incapable of touching the live DB.
-      if (name === "state.db") continue;
       stageUserStateEntry(
         source,
         join(stagedProfileRoot, name),
@@ -1411,20 +1152,6 @@ function stageHermesUserState({ profileId, profileRoot, hermesRoot }) {
             }
           : null
       );
-      // Keep live SQLite sidecars beside their database hard link so Hermes'
-      // sqlite3.backup() observes committed WAL data. Hermes excludes the
-      // sidecars themselves from the resulting ZIP.
-      if (name.endsWith(".db")) {
-        for (const suffix of ["-wal", "-shm", "-journal"]) {
-          const sidecar = `${source}${suffix}`;
-          if (existsSync(sidecar)) {
-            stageUserStateEntry(
-              sidecar,
-              join(stagedProfileRoot, `${name}${suffix}`)
-            );
-          }
-        }
-      }
     }
   }
   for (const external of HERMES_SNAPSHOT_EXTERNAL_USER_STATE) {
@@ -1485,7 +1212,7 @@ function readLegacyUserStateMigration(path, profileId) {
     value.entries.some(
       (name) =>
         typeof name !== "string" ||
-        !HERMES_SNAPSHOT_USER_STATE_ENTRIES.includes(name)
+        !HERMES_LEGACY_USER_STATE_ENTRIES.includes(name)
     ) ||
     new Set(value.entries).size !== value.entries.length
   ) {
@@ -1501,9 +1228,9 @@ function readLegacyUserStateMigration(path, profileId) {
  * (for example /opt/data/skills and /opt/data/cron). Profile isolation moved
  * those paths under profiles/<id>. Snapshot restore cannot discover that
  * unscoped state because it intentionally restores profile archives only.
- * Stage only the same bounded user-state allowlist used by snapshots, merge
- * without overwriting newer profile bytes, then mark the resulting profile
- * dirty so the next portable snapshot becomes self-contained.
+ * Stage only the bounded legacy user-state allowlist, merge without
+ * overwriting newer profile bytes, then mark the resulting profile dirty so the
+ * next portable snapshot becomes self-contained.
  */
 export function migrateLegacyHermesUserState({
   profileId,
@@ -1524,7 +1251,7 @@ export function migrateLegacyHermesUserState({
         entries: receipt.entries,
       };
     }
-    const entries = HERMES_SNAPSHOT_USER_STATE_ENTRIES.filter((name) =>
+    const entries = HERMES_LEGACY_USER_STATE_ENTRIES.filter((name) =>
       existsSync(join(hermesRoot, name))
     );
     if (entries.length === 0) {
@@ -2565,10 +2292,7 @@ export async function captureHermesBackup({
   hermesVersion,
   archiveDirectory = "/tmp",
   hermesCli = HERMES,
-  hermesPython = HERMES_PYTHON,
   maxArchiveBytes = HERMES_SNAPSHOT_MAX_ARCHIVE_BYTES,
-  cronSessionRetentionHours = HERMES_SNAPSHOT_CRON_SESSION_RETENTION_HOURS,
-  stateDbCompactor = compactHermesSnapshotStateDb,
   runChild,
   operationIdentity = /** @type {any} */ (undefined),
 }) {
@@ -2607,16 +2331,6 @@ export async function captureHermesBackup({
   try {
     stagingRoot = stageHermesUserState({ profileId, profileRoot, hermesRoot });
     const stagedProfileRoot = join(stagingRoot, "profiles", profileId);
-    const sourceStateDb = join(profileRoot, "state.db");
-    if (existsSync(sourceStateDb)) {
-      await stateDbCompactor({
-        sourcePath: sourceStateDb,
-        targetPath: join(stagedProfileRoot, "state.db"),
-        retentionHours: cronSessionRetentionHours,
-        hermesPython,
-        runChild,
-      });
-    }
     assertStagedCronDependencies(stagedProfileRoot);
     const result = await childRunner(runChild)(
       invocation(["backup", "-o", archivePath], stagingRoot, hermesCli)
@@ -2652,7 +2366,7 @@ export async function captureHermesBackup({
   } catch (error) {
     const code = error instanceof Error ? error.message : "";
     return failed(
-      /^hermes_snapshot_(?:external_state|plugin_data|portable_config|dependency|state_db|soul_metadata)/.test(
+      /^hermes_snapshot_(?:external_state|plugin_data|portable_config|dependency|soul_metadata)/.test(
         code
       )
         ? code

package/lib/sellable-agent/host-bootstrap.mjs

@@ -38,7 +38,7 @@ import { installAgentHostServices } from "./service-installer.mjs";
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 const VERSION = "sellable-agent-host-bootstrap/v1";
 const RECEIPT_VERSION = "sellable-agent-host-registration/v1";
-const INSTALLER_PACKAGE = "@sellable/install@0.1.800";
+const INSTALLER_PACKAGE = "@sellable/install@0.1.802";
 const MCP_PACKAGE = "@sellable/mcp@0.1.957";
 const HERMES_VERSION = "0.18.0";
 const SHA256 = /^[a-f0-9]{64}$/;

package/lib/sellable-agent/host-worker.mjs

@@ -1546,7 +1546,7 @@ export function compileClaimToProfileDesired(activeClaim, config) {
       ]) ||
       pinned.hermesCli !== "hermes" ||
       pinned.hermesVersion !== "0.18.0" ||
-      pinned.installerPackage !== "@sellable/install@0.1.800" ||
+      pinned.installerPackage !== "@sellable/install@0.1.802" ||
       pinned.mcpPackage !== "@sellable/mcp@0.1.957" ||
       !Array.isArray(policy.toolInclude) ||
       policy.toolInclude.length === 0 ||

package/lib/sellable-agent/profile-materializer.mjs

@@ -312,7 +312,7 @@ function validateDesired(desired) {
     desired.serviceCredentialGeneration < 1 ||
     desired.hermesCli !== "hermes" ||
     desired.hermesVersion !== "0.18.0" ||
-    desired.installerPackage !== "@sellable/install@0.1.800" ||
+    desired.installerPackage !== "@sellable/install@0.1.802" ||
     desired.mcpPackage !== "@sellable/mcp@0.1.957" ||
     !Array.isArray(desired.toolInclude) ||
     desired.toolInclude.length === 0 ||

package/lib/sellable-agent/provisioning-adapter.mjs

@@ -25,7 +25,7 @@ import { fileURLToPath } from "node:url";
 import { deriveContainedProfileId } from "./profile-materializer.mjs";
 
 export const PROVISIONING_ACTION = "PROVISION_HERMES_PROFILE";
-export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.800";
+export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.802";
 export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.957";
 const PINNED_INSTALL_VERSION = PINNED_INSTALL_PACKAGE.slice(
   PINNED_INSTALL_PACKAGE.lastIndexOf("@") + 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.800",
+  "version": "0.1.802",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {