@fungi.computer/oyster 0.3.2 → 0.4.1

package/dist/agent-computer-source.d.ts

@@ -0,0 +1,42 @@
+import { type ComputerConnectionOptions, type FilesPort, type KnapsackComputer } from "@fungi.computer/knapsack";
+import type { CapabilitySource } from "@fungi.computer/mycelium";
+import type { AgentComputerAdmission, AgentComputerProjection } from "./agent-computers.js";
+/** The host's captured authority namespace, Agent and attachment projection. */
+export type AgentComputerSnapshot = Readonly<{
+    scopeId: string;
+    agentId: string;
+    projection: AgentComputerProjection;
+}>;
+/** Host adapters supply transport, not a second attachment owner. */
+export type AgentComputerPorts = Readonly<{
+    files: FilesPort;
+    computer: KnapsackComputer;
+}>;
+export type AgentComputerConnection = Readonly<{
+    scopeId: string;
+    agentId: string;
+    attachment: AgentComputerProjection["attachments"][number];
+    /** Re-read on every operation; captured handles cannot follow a reattachment. */
+    admission: () => AgentComputerAdmission | null;
+}>;
+/** A host-owned projection reader and the transport for its captured attachments. */
+export type AgentComputerSourceOptions = Readonly<{
+    read: () => AgentComputerSnapshot | null;
+    subscribe: (invalidate: () => void) => () => void;
+    connect: (connection: AgentComputerConnection) => AgentComputerPorts;
+    onUnavailable?: (detail: {
+        computerId: string;
+        reason: unknown;
+    }) => void;
+}>;
+/** Capture each named Computer and its Files port under the same authority. */
+export declare function readAgentComputerConnections(options: Pick<AgentComputerSourceOptions, "read" | "connect">): readonly (ComputerConnectionOptions & {
+    attachmentId: string;
+    files: {
+        port: FilesPort;
+    };
+})[];
+/** Discover the captured connections; current admission remains a per-call host check. */
+export declare function createAgentComputerSource(options: AgentComputerSourceOptions): CapabilitySource;
+/** Advertise only the denied shape; no attachment lookup or Computer wake. */
+export declare function createAgentComputerSurface(): CapabilitySource;

package/dist/agent-computer-source.js

@@ -0,0 +1,88 @@
+import { Knapsack, } from "@fungi.computer/knapsack";
+import { computerCapabilities, computerValueSchema, } from "@fungi.computer/computer-contract";
+/** Capture each named Computer and its Files port under the same authority. */
+export function readAgentComputerConnections(options) {
+    return capturedConnections(options, options.read());
+}
+function capturedConnections(options, captured) {
+    if (captured === null)
+        return [];
+    return captured.projection.attachments.map((attachment) => {
+        const ports = options.connect({
+            scopeId: captured.scopeId,
+            agentId: captured.agentId,
+            attachment,
+            admission: () => {
+                const current = options.read();
+                if (current?.scopeId !== captured.scopeId ||
+                    current.agentId !== captured.agentId)
+                    return null;
+                return (current.projection.attachments.find((candidate) => candidate.attachmentId === attachment.attachmentId &&
+                    candidate.computerId === attachment.computerId &&
+                    candidate.version === attachment.version)?.admission ?? null);
+            },
+        });
+        return {
+            id: `computer:${attachment.attachmentId}`,
+            attachmentId: attachment.attachmentId,
+            name: attachment.name,
+            namespace: ["computers"],
+            files: { port: ports.files },
+            computer: ports.computer,
+        };
+    });
+}
+/** Discover the captured connections; current admission remains a per-call host check. */
+export function createAgentComputerSource(options) {
+    return Knapsack.computers({
+        id: "agent-computers",
+        subscribe: options.subscribe,
+        onUnavailable: (detail) => {
+            console.warn("Agent Computer unavailable", detail);
+            options.onUnavailable?.(detail);
+        },
+        read: () => {
+            const captured = options.read();
+            return {
+                version: JSON.stringify([
+                    captured?.scopeId ?? null,
+                    captured?.agentId ?? null,
+                    captured?.projection.revision ?? 0,
+                ]),
+                connections: capturedConnections(options, captured),
+            };
+        },
+    });
+}
+const refusedBeforeRun = () => Promise.reject(new Error("The tool gate refuses this call before it runs"));
+/** Advertise only the denied shape; no attachment lookup or Computer wake. */
+export function createAgentComputerSurface() {
+    return Knapsack.computers({
+        id: "agent-computers-surface",
+        subscribe: () => () => undefined,
+        onUnavailable: () => undefined,
+        read: () => ({
+            version: "surface",
+            connections: [
+                {
+                    id: "computer:surface",
+                    name: "computer",
+                    namespace: ["computers"],
+                    files: {
+                        port: {
+                            read: refusedBeforeRun,
+                            list: refusedBeforeRun,
+                            glob: refusedBeforeRun,
+                            grep: refusedBeforeRun,
+                            replace: refusedBeforeRun,
+                        },
+                    },
+                    computer: {
+                        getCapabilities: () => Promise.resolve(computerValueSchema.parse(computerCapabilities())),
+                        call: refusedBeforeRun,
+                    },
+                },
+            ],
+        }),
+    });
+}

package/dist/agent-computers.d.ts

@@ -0,0 +1,104 @@
+import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
+import { z } from "zod";
+declare const attachmentIdentitySchema: z.ZodObject<{
+    attachmentId: z.ZodString;
+    agentId: z.ZodString;
+    computerId: z.ZodString;
+    version: z.ZodNumber;
+}, z.core.$strict>;
+export declare const projectionSchema: z.ZodObject<{
+    revision: z.ZodNumber;
+    attachments: z.ZodArray<z.ZodObject<{
+        attachmentId: z.ZodString;
+        agentId: z.ZodString;
+        computerId: z.ZodString;
+        version: z.ZodNumber;
+        name: z.ZodString;
+        admission: z.ZodNullable<z.ZodObject<{
+            grantId: z.ZodString;
+            agentId: z.ZodString;
+            attachmentId: z.ZodString;
+            operations: z.ZodArray<z.ZodEnum<{
+                "computer.list": "computer.list";
+                "computer.readFile": "computer.readFile";
+                "computer.writeFile": "computer.writeFile";
+                "computer.execute": "computer.execute";
+            }>>;
+            attachmentVersion: z.ZodNumber;
+            revision: z.ZodNumber;
+            expiresAt: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AgentComputerProjection = z.output<typeof projectionSchema>;
+/** The parsed admission fields shared by the projection and the host's read port. */
+export type AgentComputerAdmissionFields = NonNullable<AgentComputerProjection["attachments"][number]["admission"]>;
+/** Host-issued attachment admission; the host owns its policy and delivery. */
+export type AgentComputerAdmission = Readonly<Omit<AgentComputerAdmissionFields, "operations"> & {
+    operations: readonly AgentComputerAdmissionFields["operations"][number][];
+}>;
+export type ComputerAttachmentInput = Readonly<{
+    agentId: string;
+    attachmentId: string;
+    computerId: string;
+    requestId: string;
+}>;
+export type AttachComputer = ComputerAttachmentInput;
+export type DetachComputer = ComputerAttachmentInput;
+export type AttachmentVersion = Readonly<{
+    computerId: string;
+    agentId: string;
+    attachmentId: string;
+    version: number;
+}>;
+/** Renew a held Computer admission before its delivered grant expires. */
+export declare const AGENT_ADMISSION_RENEW_BEFORE_MS = 30000;
+export type AgentComputers = Readonly<{
+    attachComputer(c: AttachComputer): AgentComputerProjection;
+    detachComputer(c: DetachComputer): AgentComputerProjection;
+    /** The attachment owner's transactionally advanced projection generation. */
+    revision(agentId: string): number;
+    read(agentId: string): AgentComputerProjection;
+    refresh(agentId: string, force?: boolean): AgentComputerProjection;
+    /** Every live attachment, for host-wide admission renewal or suspension. */
+    attachments(): readonly AttachmentVersion[];
+    /** Git admission reads live links through their owner, without foreign SQL. */
+    attachedComputers(agentId: string): readonly string[];
+    attachedAgents(computerId: string): readonly string[];
+    nextRenewal(): number | null;
+    /** Void every live attachment's decision by moving its version past it. */
+    onLifecycle(status: "active" | "suspended", revision: number): void;
+}>;
+export declare const attachComputerInputSchema: z.ZodObject<{
+    agentId: z.ZodString;
+    attachmentId: z.ZodString;
+    computerId: z.ZodString;
+    requestId: z.ZodString;
+}, z.core.$strict>;
+export declare const detachComputerInputSchema: z.ZodObject<{
+    agentId: z.ZodString;
+    attachmentId: z.ZodString;
+    computerId: z.ZodString;
+    requestId: z.ZodString;
+}, z.core.$strict>;
+export declare const readAgentComputersInputSchema: z.ZodObject<{
+    agentId: z.ZodString;
+}, z.core.$strict>;
+export declare function createAgentComputers(options: Readonly<{
+    sql: WatchdogSqliteOwner["sql"];
+    transactionSync: <T>(body: () => T) => T;
+    /** Record Computer denial in the same transaction that detaches this relationship. */
+    revoke: (requestId: string, attachment: z.output<typeof attachmentIdentitySchema>) => void;
+    /** Read the host-owned friendly name for one attached Computer. */
+    readComputerName: (computerId: string) => string;
+    /** Stage a host-owned projection in the mutation transaction. */
+    enqueueProjection?: (agentId: string, projection: AgentComputerProjection) => void;
+    ensureAdmissions?: (attachments: AgentComputerProjection["attachments"]) => boolean;
+    readAdmission?: (attachment: {
+        agentId: string;
+        attachmentId: string;
+        computerId: string;
+        version: number;
+    }) => AgentComputerAdmission | null;
+}>): AgentComputers;
+export {};

package/dist/agent-computers.js

@@ -0,0 +1,227 @@
+import { z } from "zod";
+const text = z.string().min(1).max(256);
+const noChange = Symbol("no-change");
+const attachmentRowSchema = z.strictObject({
+    attachment_id: z.string(),
+    agent_id: z.string(),
+    computer_id: z.string(),
+    version: z.number().int().positive(),
+});
+const attachmentIdentitySchema = z.strictObject({
+    attachmentId: text,
+    agentId: text,
+    computerId: text,
+    version: z.number().int().nonnegative(),
+});
+const attachmentProjectionSchema = attachmentIdentitySchema.extend({
+    name: text,
+    admission: z
+        .strictObject({
+        grantId: text,
+        agentId: text,
+        attachmentId: text,
+        operations: z.array(z.enum([
+            "computer.list",
+            "computer.readFile",
+            "computer.writeFile",
+            "computer.execute",
+        ])),
+        attachmentVersion: z.number().int().positive(),
+        revision: z.number().int().positive(),
+        expiresAt: z.number().int().positive(),
+    })
+        .nullable(),
+});
+export const projectionSchema = z.strictObject({
+    revision: z.number().int().nonnegative(),
+    attachments: z.array(attachmentProjectionSchema),
+});
+class AgentComputersError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}
+/** Renew a held Computer admission before its delivered grant expires. */
+export const AGENT_ADMISSION_RENEW_BEFORE_MS = 30_000;
+const computerAttachmentInputSchema = z.strictObject({
+    agentId: text,
+    attachmentId: text,
+    computerId: text,
+    requestId: text,
+});
+export const attachComputerInputSchema = computerAttachmentInputSchema;
+export const detachComputerInputSchema = computerAttachmentInputSchema;
+export const readAgentComputersInputSchema = z.strictObject({ agentId: text });
+export function createAgentComputers(options) {
+    const { sql, transactionSync } = options;
+    const ensure = () => {
+        sql.exec("CREATE TABLE IF NOT EXISTS hub_agent_computers (attachment_id TEXT PRIMARY KEY, agent_id TEXT NOT NULL, computer_id TEXT NOT NULL, version INTEGER NOT NULL, attached INTEGER NOT NULL CHECK (attached IN (0, 1)), UNIQUE (agent_id, computer_id)) STRICT");
+        sql.exec("CREATE TABLE IF NOT EXISTS hub_agent_computer_revisions (agent_id TEXT PRIMARY KEY, revision INTEGER NOT NULL) STRICT");
+        sql.exec("CREATE TABLE IF NOT EXISTS hub_agent_computer_receipts (request_id TEXT PRIMARY KEY, agent_id TEXT NOT NULL, operation TEXT NOT NULL, input TEXT NOT NULL, attachment_id TEXT, revision INTEGER NOT NULL, result TEXT NOT NULL) STRICT");
+    };
+    transactionSync(ensure);
+    const revision = (agentId) => z
+        .number()
+        .int()
+        .nonnegative()
+        .parse(sql
+        .exec("SELECT revision FROM hub_agent_computer_revisions WHERE agent_id = ?", agentId)
+        .toArray()[0]?.revision ?? 0);
+    const read = (agentId) => {
+        const attachments = sql
+            .exec("SELECT attachment_id, agent_id, computer_id, version FROM hub_agent_computers WHERE agent_id = ? AND attached = 1 ORDER BY attachment_id", agentId)
+            .toArray()
+            .map((row) => attachmentRowSchema.parse(row))
+            .map((r) => ({
+            attachmentId: r.attachment_id,
+            agentId: r.agent_id,
+            computerId: r.computer_id,
+            version: r.version,
+            name: options.readComputerName(r.computer_id),
+            admission: options.readAdmission?.({
+                attachmentId: r.attachment_id,
+                agentId: r.agent_id,
+                computerId: r.computer_id,
+                version: r.version,
+            }) ?? null,
+        }));
+        return projectionSchema.parse({ revision: revision(agentId), attachments });
+    };
+    const commit = (agentId, operation, requestId, payload, mutate) => transactionSync(() => {
+        const input = JSON.stringify({ agentId, operation, payload });
+        const old = sql
+            .exec("SELECT agent_id, operation, input, result FROM hub_agent_computer_receipts WHERE request_id = ?", requestId)
+            .toArray()[0];
+        if (old) {
+            if (old.agent_id !== agentId ||
+                old.operation !== operation ||
+                old.input !== input)
+                throw new AgentComputersError("request_conflict");
+            return projectionSchema.parse(JSON.parse(z.string().parse(old.result)));
+        }
+        const changed = mutate();
+        const before = read(agentId);
+        if (changed === noChange) {
+            sql.exec("INSERT INTO hub_agent_computer_receipts (request_id,agent_id,operation,input,attachment_id,revision,result) VALUES (?,?,?,?,NULL,?,?)", requestId, agentId, operation, input, before.revision, JSON.stringify(before));
+            return before;
+        }
+        const revision = before.revision + 1;
+        sql.exec("INSERT INTO hub_agent_computer_revisions (agent_id,revision) VALUES (?,?) ON CONFLICT (agent_id) DO UPDATE SET revision=excluded.revision", agentId, revision);
+        const beforeAdmission = read(agentId);
+        options.ensureAdmissions?.(beforeAdmission.attachments);
+        const current = read(agentId);
+        sql.exec("INSERT INTO hub_agent_computer_receipts (request_id,agent_id,operation,input,attachment_id,revision,result) VALUES (?,?,?,?,?,?,?)", requestId, agentId, operation, input, changed, revision, JSON.stringify(current));
+        options.enqueueProjection?.(agentId, current);
+        return current;
+    });
+    const attachComputer = (raw) => {
+        const c = attachComputerInputSchema.parse(raw);
+        const payload = { attachmentId: c.attachmentId, computerId: c.computerId };
+        return commit(c.agentId, "attachComputer", c.requestId, payload, () => {
+            const row = sql
+                .exec("SELECT agent_id, computer_id, attached FROM hub_agent_computers WHERE attachment_id=?", c.attachmentId)
+                .toArray()[0];
+            if (row !== undefined &&
+                (row.agent_id !== c.agentId || row.computer_id !== c.computerId))
+                throw new AgentComputersError("attachment_identity_conflict");
+            let changed = false;
+            if (row?.attached === 0) {
+                sql.exec("UPDATE hub_agent_computers SET attached=1,version=version+1 WHERE attachment_id=?", c.attachmentId);
+                changed = true;
+            }
+            else if (row === undefined) {
+                sql.exec("INSERT INTO hub_agent_computers (attachment_id,agent_id,computer_id,version,attached) VALUES (?,?,?,1,1)", c.attachmentId, c.agentId, c.computerId);
+                changed = true;
+            }
+            return changed ? c.attachmentId : noChange;
+        });
+    };
+    const detachComputer = (raw) => {
+        const c = detachComputerInputSchema.parse(raw);
+        return commit(c.agentId, "detachComputer", c.requestId, {
+            attachmentId: c.attachmentId,
+            computerId: c.computerId,
+        }, () => {
+            const stored = sql
+                .exec("SELECT agent_id, computer_id, attached, version FROM hub_agent_computers WHERE attachment_id=?", c.attachmentId)
+                .toArray()[0];
+            if (stored !== undefined &&
+                (stored.agent_id !== c.agentId || stored.computer_id !== c.computerId))
+                throw new AgentComputersError("attachment_identity_conflict");
+            if (stored === undefined || stored.attached === 0)
+                return noChange;
+            sql.exec("UPDATE hub_agent_computers SET attached=0,version=version+1 WHERE attachment_id=?", c.attachmentId);
+            options.revoke(c.requestId, attachmentIdentitySchema.parse({
+                attachmentId: c.attachmentId,
+                agentId: stored.agent_id,
+                computerId: stored.computer_id,
+                version: stored.version,
+            }));
+            return c.attachmentId;
+        });
+    };
+    const refresh = (agentId, force = false) => transactionSync(() => {
+        const before = read(agentId);
+        const renewed = options.ensureAdmissions?.(before.attachments) ?? false;
+        if (!force && !renewed)
+            return before;
+        const revision = before.revision + 1;
+        sql.exec("INSERT INTO hub_agent_computer_revisions (agent_id,revision) VALUES (?,?) ON CONFLICT (agent_id) DO UPDATE SET revision=excluded.revision", agentId, revision);
+        const current = read(agentId);
+        options.enqueueProjection?.(agentId, current);
+        return current;
+    });
+    const attachments = () => sql
+        .exec("SELECT agent_id,attachment_id,computer_id,version FROM hub_agent_computers WHERE attached=1 ORDER BY agent_id,attachment_id")
+        .toArray()
+        .map((row) => attachmentRowSchema.parse(row))
+        .map((row) => ({
+        agentId: row.agent_id,
+        attachmentId: row.attachment_id,
+        computerId: row.computer_id,
+        version: row.version,
+    }));
+    const advanceAttachedVersions = () => {
+        sql.exec("UPDATE hub_agent_computers SET version=version+1 WHERE attached=1");
+    };
+    return {
+        attachComputer,
+        detachComputer,
+        revision,
+        read,
+        refresh,
+        attachments,
+        attachedComputers: (agentId) => sql
+            .exec("SELECT computer_id FROM hub_agent_computers WHERE agent_id=? AND attached=1", agentId)
+            .toArray()
+            .map(({ computer_id }) => z.string().parse(computer_id)),
+        attachedAgents: (computerId) => sql
+            .exec("SELECT agent_id FROM hub_agent_computers WHERE computer_id=? AND attached=1", computerId)
+            .toArray()
+            .map(({ agent_id }) => z.string().parse(agent_id)),
+        nextRenewal: () => {
+            const agentIds = new Set(attachments().map(({ agentId }) => agentId));
+            const deadlines = [...agentIds].flatMap((agentId) => read(agentId).attachments.map(({ admission }) => admission === null
+                ? Date.now()
+                : admission.expiresAt - AGENT_ADMISSION_RENEW_BEFORE_MS));
+            return deadlines.length === 0 ? null : Math.min(...deadlines);
+        },
+        onLifecycle: (status, revision) => {
+            const current = attachments();
+            if (status === "suspended") {
+                for (const attachment of current)
+                    options.revoke(JSON.stringify([
+                        "team-suspension",
+                        revision,
+                        attachment.agentId,
+                        attachment.attachmentId,
+                    ]), attachment);
+                advanceAttachedVersions();
+            }
+            for (const agentId of new Set(current.map(({ agentId }) => agentId)))
+                refresh(agentId, true);
+        },
+    };
+}

package/dist/agents.d.ts

@@ -12,6 +12,8 @@ import * as Schema from "effect/Schema";
 import { type OysterCapability, type OysterEnv, type OysterPrincipal } from "./host.js";
 import type { HostActor } from "@fungi.computer/puffball/app";
 import type { Avatar } from "@fungi.computer/sprite/avatar";
+import type { AgentModelChoice, AgentModelRefusal } from "./standalone/agent-model-choice.js";
+export type { AgentModelChoice, AgentModelRefusal, } from "./standalone/agent-model-choice.js";
 import type { MemberInboxItem, MemberInboxSession } from "@fungi.computer/puffball/inbox";
 /** One agent as Apps see it, in Agar's `appAgentSchema` shape. */
 export type OysterAgent = Readonly<{
@@ -87,6 +89,14 @@ export type OysterAgents = Readonly<{
     setAvatar(agentId: string, avatar: Avatar, principal: OysterPrincipal): Promise<OysterAgent | Readonly<{
         error: "not_found" | "not_granted";
     }>>;
+    /** Owner-only, secret-free Agent default; an unknown Agent cannot be configured. */
+    readModelChoice(agentId: string): Promise<AgentModelChoice | null>;
+    /** Parse the owner's JSON through the deployable Agent's model preference schema. */
+    decodeModelChoice(json: string): AgentModelChoice | null;
+    /** Persist a supported model and source reference for this Agent, or return an explicit refusal. */
+    setModelChoice(agentId: string, choice: AgentModelChoice, principal: OysterPrincipal): Promise<AgentModelChoice | Readonly<{
+        error: "not_found" | "not_granted" | AgentModelRefusal;
+    }>>;
     /** This Agent's App-tool policy status, or `null` for no such Agent. */
     policyStatus(agentId: string): Promise<AgentToolPolicyStatus | null>;
     /** Read this Agent's stored App-tool approval; absence requires re-approval. A key's App access is its own grants (Ear Tag), not this policy. */

package/dist/agents.js

@@ -290,6 +290,39 @@ async function approvePolicy(agents, principal, actor, agentId, body) {
 /** Host-owned direct approval under the admitted owner; never an App capability. */
 export function agentApprovalRoutes(agents) {
     return new Hono()
+        .get("/api/agent-models/:agentId", async (context) => {
+        if (context.req.raw.headers.has("X-Oyster-Installation") ||
+            !oysterPrincipalIsOwner(context.get("principal")))
+            return refusal(403, "Owner only");
+        const agentId = context.req.param("agentId");
+        if (!agentIdPattern.test(agentId))
+            return refusal(404, "No such agent");
+        const choice = await agents.readModelChoice(agentId);
+        return choice === null
+            ? refusal(404, "No such agent")
+            : Response.json(choice);
+    })
+        .put("/api/agent-models/:agentId", async (context) => {
+        if (context.req.raw.headers.has("X-Oyster-Installation") ||
+            !oysterPrincipalIsOwner(context.get("principal")))
+            return refusal(403, "Owner only");
+        const agentId = context.req.param("agentId");
+        if (!agentIdPattern.test(agentId))
+            return refusal(404, "No such agent");
+        const input = agents.decodeModelChoice(await context.req.text());
+        if (input === null)
+            return refusal(400, "Invalid model choice");
+        const choice = await agents.setModelChoice(agentId, input, context.get("principal"));
+        if ("error" in choice && choice.error === "invalid_model_choice")
+            return refusal(400, "Invalid model choice");
+        return "error" in choice
+            ? refusal(choice.error === "not_found"
+                ? 404
+                : choice.error === "not_granted"
+                    ? 403
+                    : 409, choice.error)
+            : Response.json(choice);
+    })
         .get("/api/agent-policies/:agentId", async (context) => {
         if (context.req.raw.headers.has("X-Oyster-Installation"))
             return refusal(403, "Owner direct only");

package/dist/app-builds.d.ts

@@ -97,7 +97,7 @@ export type OysterBuildView = Readonly<{
     appId: string;
     releaseId: string;
     sourceRevision: string;
-    status: "running" | "succeeded" | "failed" | "revoked";
+    status: "running" | "succeeded" | "failed" | "interrupted" | "revoked";
     detail: string | null;
     release: Release | null;
     installation: OysterBuildInstallation | null;

package/dist/app-builds.js

@@ -19,6 +19,7 @@
 import * as Schema from "effect/Schema";
 import * as Data from "effect/Data";
 import * as Option from "effect/Option";
+import { candidateFailureDiagnostic } from "./build/candidate-diagnostic.js";
 import { parseArtifactRef, parseReleaseId, } from "@fungi.computer/puffball";
 import { appIdSchema, releaseSchema, sha256DigestSchema, sourceRevisionSchema, } from "@fungi.computer/puffball/effect";
 import { capturedPinnedRecipeSchema, normalizeAppPublisherRecipe, digestPinnedRecipe, fitsPinnedRecipe, pinnedRecipeObjectBound, } from "./build/effect.js";
@@ -116,7 +117,13 @@ const jobRow = Schema.Struct({
     credential_id: Schema.String,
     upload_grant_digest: Schema.String,
     request_id: Schema.NullOr(Schema.String),
-    status: Schema.Literals(["running", "succeeded", "failed", "revoked"]),
+    status: Schema.Literals([
+        "running",
+        "succeeded",
+        "failed",
+        "interrupted",
+        "revoked",
+    ]),
     artifact_digest: Schema.NullOr(Schema.String),
     artifact_bytes: Schema.NullOr(Schema.Number),
     detail: Schema.NullOr(Schema.String),
@@ -186,12 +193,12 @@ export function createOysterAppBuilds(options) {
     // A job outlives the owner instance that started it: the Computer keeps
     // building and its own reports (objects, candidate, status) settle the
     // job, so an owner restart must not fail it. A job that reaches its expiry
-    // without a result can never settle, so it fails then instead of reading
+    // without a result can never settle, so it is interrupted instead of reading
     // as running for as long as anyone asks.
     const failedInstallation = `CASE WHEN installation IS NULL THEN NULL ELSE
     json_object('kind', 'failed', 'installationId', json_extract(installation, '$.installationId'),
       'detail', COALESCE(?, 'Build did not succeed')) END`;
-    const expire = () => owner.sql.exec(`UPDATE oyster_build_jobs SET installation=${failedInstallation}, status='failed', detail=? WHERE status='running' AND expires_at<=?`, "Build expired without a result", "Build expired without a result", now());
+    const expire = () => owner.sql.exec(`UPDATE oyster_build_jobs SET installation=${failedInstallation}, status='interrupted', detail=? WHERE status='running' AND expires_at<=?`, "Build expired without a result", "Build expired without a result", now());
     expire();
     const decodeRecipe = (recipe) => Schema.decodeUnknownSync(recipeCodec)(recipe);
     const grantAdmits = async (job, grant) => sameDigest(job.upload_grant_digest, await sha256Hex(new TextEncoder().encode(grant)));
@@ -269,6 +276,9 @@ export function createOysterAppBuilds(options) {
                 return Promise.resolve();
             },
             execute: async (input) => {
+                // The Computer's connection may close without a terminal execution
+                // reply. A missing output is not an exit; a rejected RPC carrying an
+                // Error (including an admission refusal) remains a definite failure.
                 const result = await options.computer.port.runBuild({
                     jobId: input.jobId,
                     command: input.command,
@@ -298,10 +308,10 @@ export function createOysterAppBuilds(options) {
             });
         }
         catch (cause) {
-            // Without a terminal result the build may still be running on the
-            // Computer; its own reports settle the job, or its expiry fails it.
+            // An unknown output can belong to a live builder. Its reports can
+            // still succeed; the existing build expiry interrupts it if abandoned.
             if (!(cause instanceof BuildOutcomeUnknown))
-                settle(jobId, "failed", cause instanceof Error ? cause.message : "Build failed");
+                settle(jobId, "failed", candidateFailureDiagnostic(cause));
         }
         return view(required(jobId));
     };

package/dist/boot-capability.d.ts

@@ -75,10 +75,11 @@ export declare function issueBootCapability(input: Readonly<{
     ui: BootUi;
     bucket: BootCapabilityBucket;
     capabilities: BootCapabilityStore;
-    expiresAt: number;
+    now: () => number;
 }>): Promise<Readonly<{
     token: string;
     leaseId: string;
+    deadlineAt: number;
 }>>;
 /** What one boot page report needs from its host. */
 export type BootPageReportInput = Readonly<{

package/dist/boot-capability.js

@@ -73,11 +73,14 @@ export async function issueBootCapability(input) {
             throw new BootGateError("ui_mount_failed");
         byteLengths.push(head.size);
     }
+    // Metadata may take longer than the page budget; start the lease only once
+    // every asset has been verified, immediately before issuing it.
+    const deadlineAt = input.now() + BOOT_DEADLINE_MS;
     const lease = {
         id: bootCapabilityIds.lease.generate(),
         identity: input.ui.identity,
         base: input.ui.base,
-        expiresAt: input.expiresAt,
+        expiresAt: deadlineAt + BOOT_TRANSPORT_GRACE_MS,
         assets: capabilityAssets(input.ui.assets, byteLengths),
     };
     validateCapabilityAssetSet(lease);
@@ -87,7 +90,7 @@ export async function issueBootCapability(input) {
         .replace(/=+$/u, "");
     const tokenDigest = createHash("sha256").update(token, "utf8").digest("hex");
     await input.capabilities.issue({ lease, tokenDigest });
-    return { token, leaseId: lease.id };
+    return { token, leaseId: lease.id, deadlineAt };
 }
 /**
  * One UI page check for a Release, for every host, reading no UI bytes:
@@ -102,14 +105,13 @@ export async function reportBootPage(input) {
         return { kind: "passed" };
     if (input.check === null || input.origin === null)
         return { kind: "not_checked", code: "boot_browser_binding_missing" };
-    const deadlineAt = input.now() + BOOT_DEADLINE_MS;
     let issued;
     try {
         issued = await issueBootCapability({
             ui,
             bucket: input.bucket,
             capabilities: input.capabilities,
-            expiresAt: deadlineAt + BOOT_TRANSPORT_GRACE_MS,
+            now: input.now,
         });
     }
     catch (cause) {
@@ -123,7 +125,7 @@ export async function reportBootPage(input) {
             origin: input.origin,
             releaseId: ui.identity.releaseId,
             capability: { header: BOOT_CAPABILITY_HEADER, token: issued.token },
-            deadlineAt,
+            deadlineAt: issued.deadlineAt,
         });
     }
     finally {