sandbox-remote v0.1.0

Chore

• add automated THIRD-PARTY file generation with license enforcement
  Generates a plaintext THIRD-PARTY attribution file combining:

  • Rust dependencies via cargo-about (grouped by license, full text)
  • npm dependencies from infinity-ui/ and agent/ via license-checker

  Both ecosystems enforce an allowlist of permissive licenses:

  • Rust (about.toml): Apache-2.0, MIT, ISC, BSD-3-Clause, CC0-1.0,
    CDLA-Permissive-2.0, MPL-2.0, Unicode-3.0, Zlib
  • npm (script): MIT, Apache-2.0, ISC, BSD-2-Clause, BSD-3-Clause, 0BSD,
    CC0-1.0, Unlicense, BlueOak-1.0.0, MPL-2.0

  The script fails if any dependency uses a license not in the allowlist.

  New files:

  • about.toml — cargo-about config
  • about.hbs — plaintext Handlebars template
  • scripts/generate-third-party.sh — orchestration script
  • scripts/license-checker-format.json — tells license-checker to include text
  • THIRD-PARTY — the generated file

• add workspace lints and fix all lint violations

New Features

• add remote host migration UI and daemon orchestration

Bug Fixes

• prevent git from resolving outer repo in sandboxes
• delete child metadata on squash to prevent migration failure

Other

• set up cargo-smart-release release workflow (mirroring hydro)

  • chore: set up cargo-smart-release release workflow (mirroring hydro)

  Sets up the release tooling for this workspace following the same
  cargo-smart-release setup as hydro-project/hydro (per its RELEASING.md).

  • .github/workflows/release.yml: new manually-dispatched Release workflow,
    adapted from hydro's. Supports major/minor/patch/keep/auto bumps, optional
    pre-release ids, and a dry-run mode (execute unchecked). Uses the
    hydro-project-bot GitHub App token to push past branch protection, and the
    pinned hydro-project fork of cargo-smart-release (rev e6f3368337a0).
  • RELEASING.md: releasing guide adapted from hydro's, including which crates
    are published and why the others are not, plus an addendum explaining why
    [patch.crates-io] on rig-bedrock blocks publishing the bedrock provider.
  • Crate manifests, 14 publishable crates (rap-protocol, rap-client,
    rap-steering-server, rap-github-event-poller, infinity-protocol,
    infinity-provider-protocol, infinity-agent-core, infinity-mcp-bridge,
    infinity-rap-bridge, infinity-daemon, infinity-agent-cli, sandbox-core,
    sandbox-local, sandbox-remote):
  • publish = true, description, documentation (docs.rs), and
    repository = { workspace = true } (new [workspace.package] in the root
    Cargo.toml).
  • version = "^0.1.0" added to all intra-workspace path dependencies
    (including dev-deps between publishable crates), as required for
    publishing.
  • New empty CHANGELOG.md per crate so cargo-smart-release will generate
    and track changelogs.
  • publish = false added to crates that must not be published:
  • rig-mock, rap-test-servers (test-only; left as path-only dev-deps so
    cargo strips them at publish time),
  • rig-bedrock-patched (vendored fork of crates-io rig-bedrock),
  • infinity-provider-bedrock + infinity-agent-lambda (depend on the
    patched rig-bedrock; publishing would silently drop the patches),
  • infinity-slack-bot (deployment artifact).

Refactor

• replace all .unwrap() with .expect() and fix clippy warnings
• add precheck script, lints

New Features (BREAKING)

• extensible sandbox modes via ModeProvider, with jj and git as built-in providers
  Adds an extension mechanism for custom VCS backends and makes the built-in
  Jujutsu and Git modes plain instances of it, so every non-Direct mode flows
  through the same interface end to end.

  Core (sandbox-core)

  • New ModeProvider trait: the extension point for sandbox modes. A provider
    claims a repository during clone_repo (detect → ModeInit) and then
    handles all mode-specific behavior: create_sandbox, refresh_sandbox,
    describe, detect_external_change (e.g. bookmark-move warnings),
    push_sandbox, squash, diff_files, cleanup, cleanup_blocking
    (sync, for Drop), and extra_writable_paths.
  • New SandboxMode::Custom { id, data } variant carrying an opaque,
    provider-defined JSON payload; existing Jj/Git/Direct serialization
    is unchanged, so persisted metadata stays compatible.
  • SandboxBackend reshaped around providers:
  • init_repo is gone — detect_mode(ctx) is the single clone_repo
    entry point where each backend does its repository setup and then
    consults its providers. ModeInit::repo_root (canonicalized) becomes
    the repo's remote_uri.
  • Direct mode, which bypasses providers, gets its own init_direct hook
    (default: unsupported).
  • New delegating methods describe_sandbox, detect_external_change,
    squash_sandbox, and diff_files.
  • server.rs is now mode-agnostic: clone detection, the describe and
    external-change logic in with_sandbox, squash_sandbox, and the diff
    view all delegate to the backend instead of matching on Jj/Git. The diff
    view is now also pushed after git/custom squashes (previously jj-only).
    Session migration remains enum-based since it operates on git bundles and
    rejects custom modes.
  • The reusable jj/git mode logic (detect, describe, external-change warning,
    squash, diff) lives in jj.rs/git.rs, shared by the local providers and
    the EFS backend. git::detect_mode is the documented fallback that claims
    any repo not claimed earlier, preserving the friendly
    "use open_sandbox_direct" error for commit-less repos.

  Local backend (sandbox-local)

  • New providers module with LocalJjProvider and LocalGitProvider
    (jj workspaces / git worktrees under {repo}/.infinity/.sandboxes/).
  • LocalBackend holds an ordered Vec<Arc<dyn ModeProvider>> — jj then git
    by default; LocalBackend::new(enabled).with_provider(p) prepends an
    external provider ahead of the built-ins. All mode dispatch (creation,
    push, squash, diff, cleanup, Drop-time cleanup, per-mode writable paths)
    goes through the registry. Dropping a cached sandbox whose mode has no
    registered provider logs a warning instead of silently leaking it.
  • The old init_repo root resolution became the private resolve_repo_root,
    used by both detect_mode and init_direct (Direct mode still works on
    non-VCS directories).

  Remote backend (sandbox-remote)

  • EfsBackend (jj-only) implements the backend methods via the shared
    sandbox_core::jj helpers; the old init_repo became the private
    mirror_repo step of detect_mode, making the URL-mirror-then-detect
    flow explicit in one place. open_sandbox_direct now fails immediately on
    the remote backend (previously it stored Direct state that failed at
    first use).

  Verified with cargo fmt --check, clippy (-D warnings) on the touched
  crates, workspace-wide cargo check --all-targets, and the
  sandbox-core/local test suites — all pass except 4 pre-existing
  sandboxed-execution tests that cannot run in this environment (nested macOS
  sandbox-exec is not permitted).

Refactor (BREAKING)

• introduce typed ThreadId for RAP group ids

  • refactor(rap-protocol)!: introduce typed ThreadId for RAP group ids

  Stage 1 of the string-ID to typed-ID migration (#108). Defines ThreadId
  via the published strkind 0.0.1 macro and converts every RAP group_id
  on the wire types, plus all consumers. Serialization is transparent, so
  the wire format and persisted metadata are byte-identical (verified: no
  insta snapshot changes; full test suite passes).

  • rap-protocol: strkind! { pub ThreadId; } with docs (RAP calls it
    group_id on the wire; UUIDs in the daemon, caller-chosen conversation
    keys in the Lambda runtime). group_id: ThreadId on RapInvocation,
    RapToolResult, RapUserChoice, RapSubscriptionEvent,
    RapViewUpdate, RapOAuth; thread_ancestors: Option<Vec<ThreadId>>;
    send_subscription_event/send_view_update take ThreadId
  • sandbox-core/local/remote (via sub-agent): ThreadId re-exported from
    sandbox-core root; MetadataStore::get/delete(&ThreadId);
    SandboxBackend::push_sandbox/cleanup_sandbox_permanently typed;
    RepoState.{group_id, root_thread_id}, CloneRepoArgs.base_thread_id,
    SquashSandboxArgs.from_thread_id, CloneContext.group_id,
    SandboxError::RepoNotFound, and server request payload structs typed
  • infinity-agent-core: rap_tool boundary converts ToolContext strings
    into ThreadId when building invocations (context types themselves are
    Stage 2)
  • infinity-rap-bridge: callback conversion unwraps ThreadId into
    InputMessage.group_id (String until Stage 2)
  • rap-github-event-poller: Subscription.group_id: ThreadId
  • infinity-daemon: view-update routing + test fixture conversions
  • Workspace: strkind = "0.0.1" added to workspace dependencies

• extract shared agent system engine
  Extract the daemon's agent execution machinery into a shared infinity_agent_core::system engine, migrate the daemon and Lambda runtimes onto it, and extract the protocol components those embeddings share.

  This PR intentionally stops at the engine and embedding boundary. Static builder conveniences, local MCP/RAP tool-set adapters, ThreadHandle, launcher mode, per-thread launch configuration, and the new usage guides are introduced by #92.

  Breaking changes

  • Removes batch_processor (process_batch, process_input_item, and core DisplayEvent) in favor of AgentSystem::step and observer-based local execution.
  • Thread is internal and AgentSystem is not Clone.
  • ThreadObserver replaces inline daemon persistence/display hooks; it has no on_commit.
  • EventCollector::take returns (thread_id, event) pairs.
  • ConversationStore gains thread_exists, which checks exact root or child records without creating them.
  • StateStore gains the provided is_thread_stopped policy hook. User text may resume stopped threads; event-style input may not.
  • Builder tools are stored as Rc; Tool gains defaulted is_passive.
  • ToolContext and its builder lose input_queue_arn.
  • Resident runtime types such as RunningSystem, SubscribeHandle, ChannelSender, and ChannelSendError live under system::local.
  • The daemon no longer exports its old worker/loop/session implementation modules, sleep/RAP tool wrappers, or boot_rap_servers.
  • SessionManager::send_input no longer accepts a thread ID or user_driven flag and performs no status admission; router admission and lifecycle events own those concerns.
  • rap_callback::start_callback_server is replaced by infinity_daemon::launch_session_manager; callback serving accepts a RapCallbackBridge.
  • SessionManager::switch_model accepts the requester's sender and returns Result<(), String>; SharedSessionManager is Rc.
  • CLI DisplayEvent lives in infinity_agent_cli::display.

Commit Statistics

• 33 commits contributed to the release.
• 11 commits were understood as conventional.
• 5 unique issues were worked on: #107, #113, #78, #8, #96

Commit Details

view details

• #107
  • Set up cargo-smart-release release workflow (mirroring hydro) (ffc27d0)
• #113
  • Introduce typed ThreadId for RAP group ids (4b18b37)
• #78
  • Extensible sandbox modes via ModeProvider, with jj and git as built-in providers (c431616)
• #8
  • Add automated THIRD-PARTY file generation with license enforcement (e2e0719)
• #96
  • Extract shared agent system engine (9c921fd)
• Uncategorized
  • Release infinity-agent-cli v0.1.0, sandbox-core v0.1.0, sandbox-local v0.1.0, sandbox-remote v0.1.0 (ac467e4)
  • Release infinity-agent-core v0.1.0, infinity-mcp-bridge v0.1.0, infinity-rap-bridge v0.1.0, infinity-daemon v0.1.0, infinity-agent-cli v0.1.0, sandbox-core v0.1.0, sandbox-local v0.1.0, sandbox-remote v0.1.0 (7599fbb)
  • Release infinity-provider-protocol v0.1.0, infinity-provider-bedrock v0.1.0, infinity-provider-rig v0.1.0, infinity-agent-core v0.1.0, infinity-mcp-bridge v0.1.0, infinity-rap-bridge v0.1.0, infinity-daemon v0.1.0, infinity-agent-cli v0.1.0, sandbox-core v0.1.0, sandbox-local v0.1.0, sandbox-remote v0.1.0 (7e1cd1d)
  • Release rap-protocol v0.1.0, rap-client v0.1.0, rap-steering-server v0.1.0, rap-github-event-poller v0.1.0, infinity-protocol v0.1.0, infinity-provider-protocol v0.1.0, infinity-provider-bedrock v0.1.0, infinity-provider-rig v0.1.0, infinity-agent-core v0.1.0, infinity-mcp-bridge v0.1.0, infinity-rap-bridge v0.1.0, infinity-daemon v0.1.0, infinity-agent-cli v0.1.0, sandbox-core v0.1.0, sandbox-local v0.1.0, sandbox-remote v0.1.0 (dd8c7f4)
  • Remove unused _keepalive field from SpawnedCommand (24820fe)
  • Prevent git from resolving outer repo in sandboxes (a0b74f2)
  • Add workspace lints and fix all lint violations (b92b7a1)
  • Delete child metadata on squash to prevent migration failure (2759040)
  • Add remote host migration UI and daemon orchestration (ba10ffd)
  • Replace all .unwrap() with .expect() and fix clippy warnings (7634b82)
  • Add precheck script, lints (9757071)
  • Add write:/path permissions, thread_ancestors protocol field, and ancestor-aware grant system (3464fad)
  • Add Direct sandbox mode and better error for empty repos (12b7454)
  • Add support for UserChoice prompts in RAP protocol and use for permissions expansion in sandbox (b0db6a7)
  • Shift core agent runtime into a daemon with a network protocol for clients (141d697)
  • Add steering file instructions to the default agent prompt (40b1f78)
  • Add SandboxMode enum with Jj/Git variants; thread description through push_sandbox (bc26456)
  • Refactor JJ sandbox lifecycle: absolute revisions, cleanup on shutdown (f525abf)
  • Add squash_sandbox tool and base_thread_id to clone_repo (5ffac5f)
  • Fix escaping of grep tool arguments and detect cd to original folder (8b32a63)
  • Implement output streaming for execute_command using RAP subscriptions with debouncing. (b2fb764)
  • Persist display_as mapping in store.json and use it during history replay, document (1ca626a)
  • Improve jj config management and shift spinner to top (40a3ac5)
  • Run clippy (ea864bf)
  • Clean up dependencies (fcef65d)
  • Cache jj workspaces for local sandboxes (ba0ba4e)
  • Use jj workspaces (8d6bc44)
  • Initial functional Jujutsu filesystem sandbox (4118c89)