@elpapi42/pi-fleet 0.1.0-beta.0 → 0.1.0-beta.2

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## Unreleased
+
+### Reliability
+
+- Added deterministic fault-injection coverage for receive timeout/cancellation, delivery recovery, runtime crashes, Pi RPC failures, SQLite worker/storage failures, protocol framing, command races, raw session boundaries, and public-error redaction.
+- Serialized create, send, and destroy transitions per agent so cross-command races cannot orphan or resurrect an agent generation.
+- Made SQLite-worker failures terminal for current and future calls and made send recovery safe when an operation exists but no send record was committed.
+- Redacted Pi stderr and unexpected internal exceptions from public errors while retaining stable typed error codes.
+- Contained asynchronous coordinator event/store failures by stopping the affected Pi process and rejecting waiters instead of producing unhandled promise rejections.
+- Added a nightly reliability workflow and an isolated soak suite covering 500 concurrent ordered sends and 100 name lifecycle cycles.
+- Reject invalid UTF-8 in stdin and Pi RPC stdout instead of silently replacing bytes at either protocol boundary.
+
+## 0.1.0-beta.2 — 2026-07-20
+
+Reliability-focused beta maintenance release. No intentional product-contract changes.
+
+### Reliability
+
+- Added deterministic fault coverage and reproducible randomized lifecycle-race soak testing.
+- Fixed timeout/cancellation classification, ambiguous-delivery recovery, no-replay behavior, and coordinator/store failure containment.
+- Validated inbound protocol majors, strict and concurrent runtime materialization, and released beta.0/beta.1 CLI-runtime compatibility.
+- Added unclean SQLite `quick_check` validation, redacted error handling, fatal UTF-8 checks, process cleanup coverage, and nightly resource-stability checks.
+
+### Validation limits
+
+- Real disk exhaustion, host logout/reboot, macOS launchd/containment, and multi-hour platform resource soak remain unvalidated.
+
+## 0.1.0-beta.1 — 2026-07-20
+
+Release-pipeline validation beta. No product-contract changes from `0.1.0-beta.0`.
+
+### Changed
+
+- Publishes through the tag-driven GitHub Actions workflow using npm trusted publishing and provenance.
+- Retains the same Linux x64 validation scope, beta limitations, and user-owned Pi session guarantees as `0.1.0-beta.0`.
+
 ## 0.1.0-beta.0 — 2026-07-20
 
 First public beta of Pi Fleet.

package/README.md

@@ -8,7 +8,7 @@ create · send · receive · status · list · watch · destroy
 
 Fleet keeps a Pi process resident when possible, restores it from the same native Pi session when absent, accepts repeated steering input, and returns the latest assistant message after Pi becomes idle. Pi sessions remain under your control: Fleet references them but never copies or deletes them.
 
-> **Beta:** `0.1.0-beta.0` is release-validated on Linux x64 with Pi `0.80.10`. macOS, actual logout/reboot recovery, automatic upgrades, and public service-management UX are not yet release-validated.
+> **Beta:** `0.1.0-beta.2` is validated on Linux x64 with Pi `0.80.10`, including deterministic fault, recovery, package-compatibility, and resource-stability testing. Actual logout/reboot recovery, macOS launchd/containment, automatic upgrades, and public service-management UX are not yet release-validated.
 
 ## Install
 
@@ -173,9 +173,10 @@ Do not include API keys, message contents, session contents, or private paths un
 
 ## Beta limitations
 
-- Release validation currently covers Linux x64 only.
+- Current deterministic reliability and package validation covers Linux x64 only.
 - Actual logout and host reboot recovery remain unvalidated.
 - launchd and macOS descendant containment remain unvalidated.
+- Real disk-exhaustion behavior and multi-hour resource growth remain unvalidated; bounded SQLite and in-process resource tests are covered.
 - Native service install/repair/uninstall exists internally but has no supported public UX yet.
 - Runtime upgrades are not automatic; active runtimes are not silently replaced.
 - Session tails cannot promise exactly-once behavior under arbitrary external mutation.
@@ -189,12 +190,14 @@ npm run typecheck
 npm run lint
 npm run format:check
 npm test
+npm run test:faults
 npm run build
 npm run test:package
 npm run test:platform
+npm run test:soak
 ```
 
-See [`IMPLEMENTATION_PLAN.md`](./IMPLEMENTATION_PLAN.md) for architecture, completed evidence, and remaining release gates.
+See [`IMPLEMENTATION_PLAN.md`](./IMPLEMENTATION_PLAN.md) for architecture and release gates, and [`TESTING_PLAN.md`](./TESTING_PLAN.md) for failure injection, crash recovery, concurrency, privacy, and soak testing. Deterministic fault tests run in the full suite; heavier reliability checks run nightly.
 
 ## License
 

package/dist/cli-meta.json

@@ -156,7 +156,7 @@
       "format": "esm"
     },
     "src/cli/input.ts": {
-      "bytes": 824,
+      "bytes": 977,
       "imports": [],
       "format": "esm"
     },
@@ -392,7 +392,7 @@
       "format": "esm"
     },
     "src/client/socket-fleet-client.ts": {
-      "bytes": 8696,
+      "bytes": 9121,
       "imports": [
         {
           "path": "node:crypto",
@@ -444,7 +444,7 @@
       "format": "esm"
     },
     "src/platform/install/runtime-release.ts": {
-      "bytes": 4620,
+      "bytes": 9583,
       "imports": [
         {
           "path": "node:crypto",
@@ -593,7 +593,7 @@
       "imports": [],
       "exports": [],
       "inputs": {},
-      "bytes": 251175
+      "bytes": 260315
     },
     "dist/cli.mjs": {
       "imports": [
@@ -780,7 +780,7 @@
           "bytesInOutput": 140
         },
         "src/cli/input.ts": {
-          "bytesInOutput": 696
+          "bytesInOutput": 841
         },
         "src/cli/output.ts": {
           "bytesInOutput": 1016
@@ -816,7 +816,7 @@
           "bytesInOutput": 2440
         },
         "src/client/socket-fleet-client.ts": {
-          "bytesInOutput": 6835
+          "bytesInOutput": 7258
         },
         "src/protocol/version.ts": {
           "bytesInOutput": 70
@@ -828,7 +828,7 @@
           "bytesInOutput": 4658
         },
         "src/platform/install/runtime-release.ts": {
-          "bytesInOutput": 4008
+          "bytesInOutput": 8505
         },
         "src/platform/install/tree-integrity.ts": {
           "bytesInOutput": 1879
@@ -837,7 +837,7 @@
           "bytesInOutput": 1191
         }
       },
-      "bytes": 139855
+      "bytes": 144920
     }
   }
 }

package/dist/cli.mjs

@@ -3385,7 +3385,7 @@ function splitArgv(argv) {
 
 // src/shared/product-identity.ts
 var PRODUCT_BINARY = "pifleet";
-var PRODUCT_VERSION = "0.1.0-beta.0";
+var PRODUCT_VERSION = "0.1.0-beta.2";
 
 // src/cli/commands/create.ts
 import { resolve } from "node:path";
@@ -3408,7 +3408,13 @@ async function resolveMessageInput(value, stdin, maxBytes = DEFAULT_MAX_INPUT_BY
     if (bytes > maxBytes) throw new Error(`stdin exceeds the ${maxBytes}-byte limit`);
     chunks.push(buffer);
   }
-  return requireContent(Buffer.concat(chunks).toString("utf8"));
+  let decoded;
+  try {
+    decoded = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks));
+  } catch {
+    throw new Error("stdin must be valid UTF-8");
+  }
+  return requireContent(decoded);
 }
 function requireContent(value) {
   if (value.trim().length === 0) throw new Error("message must not be empty or whitespace-only");
@@ -3693,6 +3699,13 @@ var SocketFleetClient = class {
     try {
       for await (const frame of frames) {
         if (!isRecord(frame) || frame.requestId !== requestId) continue;
+        if (frame.v !== PROTOCOL_VERSION) {
+          yield err({
+            code: "protocol_error",
+            message: "Runtime protocol version is incompatible with this client."
+          });
+          return;
+        }
         if (frame.stream === "ready") continue;
         if (frame.stream === "end") {
           endedExplicitly = true;
@@ -3746,6 +3759,12 @@ var SocketFleetClient = class {
       if (!isRecord(frame) || frame.requestId !== requestId || typeof frame.ok !== "boolean") {
         return err({ code: "protocol_error", message: "Invalid runtime response." });
       }
+      if (frame.v !== PROTOCOL_VERSION) {
+        return err({
+          code: "protocol_error",
+          message: "Runtime protocol version is incompatible with this client."
+        });
+      }
       if (frame.ok) return ok(frame.result);
       if (isErrorRecord(frame.error)) return err(frame.error);
       return err({ code: "protocol_error", message: "Runtime returned an invalid error." });
@@ -3888,8 +3907,8 @@ import { promisify } from "node:util";
 
 // src/platform/install/runtime-release.ts
 import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
-import { chmod, cp, lstat as lstat2, mkdir, readFile as readFile2, rename, rm, stat as stat2 } from "node:fs/promises";
-import { join as join2, resolve as resolve3, sep as sep2 } from "node:path";
+import { chmod, cp, lstat as lstat2, mkdir, readFile as readFile2, rename, rm } from "node:fs/promises";
+import { join as join2, posix, resolve as resolve3, sep as sep2 } from "node:path";
 
 // src/platform/install/tree-integrity.ts
 import { createHash } from "node:crypto";
@@ -3943,12 +3962,21 @@ async function collectFiles(root, directory) {
 }
 
 // src/platform/install/runtime-release.ts
+var requiredRuntimeArtifacts = /* @__PURE__ */ new Set([
+  "package.json",
+  "bin/pifleet.mjs",
+  "bin/pifleet-runtime.mjs",
+  "dist/cli.mjs",
+  "dist/runtime.mjs",
+  "dist/sqlite-worker.mjs"
+]);
 async function materializeRuntime(options) {
   const sourceRoot = resolve3(options.sourceRoot);
+  const manifestBytes = await readFile2(join2(sourceRoot, "dist", "runtime-manifest.json"));
+  const manifest = await parseRuntimeManifest(manifestBytes, sourceRoot);
+  await verifyRuntime(sourceRoot, manifest);
   const applicationRoot = resolve3(options.applicationRoot);
   await ensurePrivateDirectory(applicationRoot);
-  const manifestBytes = await readFile2(join2(sourceRoot, "dist", "runtime-manifest.json"));
-  const manifest = JSON.parse(manifestBytes.toString("utf8"));
   const manifestHash = createHash2("sha256").update(manifestBytes).digest("hex").slice(0, 16);
   const releasesRoot = join2(applicationRoot, "releases");
   await ensurePrivateDirectory(releasesRoot);
@@ -3974,21 +4002,30 @@ async function materializeRuntime(options) {
     }
     await verifyRuntime(staging, manifest);
     await chmod(staging, 448);
-    await rename(staging, destination);
+    try {
+      await rename(staging, destination);
+    } catch (error) {
+      if (!isDestinationRace(error) || !await pathExists(destination)) throw error;
+      await verifyRuntime(destination, manifest);
+    }
     return destination;
-  } catch (error) {
+  } finally {
     await rm(staging, { recursive: true, force: true });
-    throw error;
   }
 }
 async function verifyRuntime(root, manifest) {
-  const expected = manifest ?? JSON.parse(
-    await readFile2(join2(root, "dist", "runtime-manifest.json"), "utf8")
-  );
   const resolvedRoot = resolve3(root);
+  const expected = manifest ?? await parseRuntimeManifest(
+    await readFile2(join2(resolvedRoot, "dist", "runtime-manifest.json")),
+    resolvedRoot
+  );
+  if (manifest !== void 0) await validateRuntimeManifest(manifest, resolvedRoot);
   for (const file of expected.files) {
     const path2 = resolveInside(resolvedRoot, file.path);
-    const info = await stat2(path2);
+    const info = await lstat2(path2);
+    if (info.isSymbolicLink()) {
+      throw new Error(`Runtime artifact ${file.path} must not be a symbolic link`);
+    }
     if (!info.isFile() || info.size !== file.bytes) {
       throw new Error(`Runtime artifact ${file.path} has changed`);
     }
@@ -4005,13 +4042,100 @@ async function verifyRuntime(root, manifest) {
     }
   }
 }
+async function parseRuntimeManifest(bytes, root) {
+  let candidate;
+  try {
+    candidate = JSON.parse(bytes.toString("utf8"));
+  } catch {
+    throw new Error("Runtime manifest is not valid JSON");
+  }
+  await validateRuntimeManifest(candidate, root);
+  return candidate;
+}
+async function validateRuntimeManifest(candidate, root) {
+  if (!isRecord2(candidate) || candidate.schemaVersion !== 2) {
+    throw new Error("Runtime manifest has an unsupported schema version");
+  }
+  if (!isRecord2(candidate.package) || typeof candidate.package.name !== "string" || typeof candidate.package.version !== "string") {
+    throw new Error("Runtime manifest has an invalid package identity");
+  }
+  const packageIdentity = await readPackageIdentity(root);
+  if (candidate.package.name !== packageIdentity.name || candidate.package.version !== packageIdentity.version) {
+    throw new Error("Runtime manifest package identity does not match package.json");
+  }
+  if (!Array.isArray(candidate.files) || !Array.isArray(candidate.trees)) {
+    throw new Error("Runtime manifest has invalid artifact lists");
+  }
+  const filePaths = /* @__PURE__ */ new Set();
+  for (const file of candidate.files) {
+    if (!isRecord2(file) || !isManifestPath(file.path) || !isValidSize(file.bytes) || !isSha256(file.sha256)) {
+      throw new Error("Runtime manifest contains an invalid artifact");
+    }
+    if (filePaths.has(file.path))
+      throw new Error(`Runtime manifest has duplicate path ${file.path}`);
+    filePaths.add(file.path);
+  }
+  for (const required of requiredRuntimeArtifacts) {
+    if (!filePaths.has(required)) {
+      throw new Error(`Runtime manifest is missing required artifact ${required}`);
+    }
+  }
+  const treePaths = /* @__PURE__ */ new Set();
+  for (const tree of candidate.trees) {
+    if (!isRecord2(tree) || !isManifestPath(tree.path) || !isValidSize(tree.files) || !isValidSize(tree.bytes) || !isSha256(tree.sha256)) {
+      throw new Error("Runtime manifest contains an invalid dependency tree");
+    }
+    if (treePaths.has(tree.path))
+      throw new Error(`Runtime manifest has duplicate path ${tree.path}`);
+    treePaths.add(tree.path);
+  }
+  const allPaths = [...filePaths, ...treePaths];
+  for (let index = 0; index < allPaths.length; index += 1) {
+    for (let other = index + 1; other < allPaths.length; other += 1) {
+      const left = allPaths[index];
+      const right = allPaths[other];
+      if (left === right || left.startsWith(`${right}/`) || right.startsWith(`${left}/`)) {
+        throw new Error(`Runtime manifest has overlapping paths ${left} and ${right}`);
+      }
+    }
+  }
+}
+async function readPackageIdentity(root) {
+  let candidate;
+  try {
+    candidate = JSON.parse(await readFile2(join2(root, "package.json"), "utf8"));
+  } catch {
+    throw new Error("Runtime package.json is not valid JSON");
+  }
+  if (!isRecord2(candidate) || typeof candidate.name !== "string" || typeof candidate.version !== "string") {
+    throw new Error("Runtime package.json has an invalid identity");
+  }
+  return { name: candidate.name, version: candidate.version };
+}
 function resolveInside(root, path2) {
+  if (!isManifestPath(path2)) throw new Error(`Runtime manifest contains an unsafe path ${path2}`);
   const resolved = resolve3(root, path2);
   if (!resolved.startsWith(`${root}${sep2}`)) {
     throw new Error(`Runtime manifest contains an unsafe path ${path2}`);
   }
   return resolved;
 }
+function isRecord2(value) {
+  return typeof value === "object" && value !== null;
+}
+function isManifestPath(value) {
+  return typeof value === "string" && value.length > 0 && !value.includes("\\") && !value.startsWith("/") && posix.normalize(value) === value && value.split("/").every((part) => part.length > 0 && part !== "." && part !== "..");
+}
+function isValidSize(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function isSha256(value) {
+  return typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+}
+function isDestinationRace(error) {
+  const code = error.code;
+  return code === "EEXIST" || code === "ENOTEMPTY";
+}
 async function ensurePrivateDirectory(path2) {
   await mkdir(path2, { recursive: true, mode: 448 });
   const info = await lstat2(path2);