@ours.network/fleet 0.10.0 → 0.10.1

package/dist/monitor.d.ts

@@ -142,7 +142,9 @@ export interface MonitorOpts {
 }
 /** The lifecycle surface the runner drives: prime pre-launch, run, stop on pid death. */
 export interface MonitorHandle {
-    prime(): Promise<void>;
+    prime(options?: {
+        resetCursor?: boolean;
+    }): Promise<void>;
     run(pid: number): Promise<void>;
     stop(): void;
 }
@@ -167,8 +169,14 @@ export declare class Monitor {
     /** Active degradations, keyed by cause. Empty means armed. */
     private readonly causes;
     constructor(o: MonitorOpts);
-    /** Resume the last delivered cursor; only a brand-new monitor primes at stream tip. */
-    prime(): Promise<void>;
+    /**
+     * Resume the last delivered cursor during ordinary fleet-owned restarts.
+     * A native→fleet ownership transition resets at stream tip because the native
+     * owner was responsible for arrivals while the supervisor was inactive.
+     */
+    prime(options?: {
+        resetCursor?: boolean;
+    }): Promise<void>;
     /** Long-poll → filter → coalesce → inject, until the pane pid dies or stop(). */
     run(pid: number): Promise<void>;
     stop(): void;

package/dist/monitor.js

@@ -336,9 +336,13 @@ export class Monitor {
         const n = o.cfg.turn_fail_threshold;
         this.turnFailThreshold = typeof n === 'number' && n >= 1 ? n : DEFAULT_TURN_FAIL_THRESHOLD;
     }
-    /** Resume the last delivered cursor; only a brand-new monitor primes at stream tip. */
-    async prime() {
-        const persisted = this.readPersistedCursor();
+    /**
+     * Resume the last delivered cursor during ordinary fleet-owned restarts.
+     * A native→fleet ownership transition resets at stream tip because the native
+     * owner was responsible for arrivals while the supervisor was inactive.
+     */
+    async prime(options = {}) {
+        const persisted = options.resetCursor ? null : this.readPersistedCursor();
         if (persisted !== null) {
             this.cursor = persisted;
             this.deliveredCursor = persisted;

package/dist/runner.d.ts

@@ -19,6 +19,13 @@ export interface RunnerDeps {
     /** Lets a test (or a shutdown path) end the supervised restart loop. */
     shouldStop?(): boolean;
 }
+/**
+ * Record who owns wake delivery for this run. Returning true means a fleet
+ * monitor is taking ownership back from a native harness and must start at the
+ * current stream tip rather than replay notifications the native owner was
+ * responsible for.
+ */
+export declare function recordMonitorOwner(dir: string, owner: 'fleet' | 'native'): boolean;
 /**
  * Compose the tmux pane shell command: env prefix + argv + exit-status capture.
  * `paneArgv` defaults to `launch.argv`; when isolation is active the caller passes

package/dist/runner.js

@@ -32,6 +32,24 @@ const defaultDeps = () => ({
     fetch: (url, init) => globalThis.fetch(url, init),
     createMonitor: opts => createMonitor(opts),
 });
+const MONITOR_OWNER_FILE = '.monitor-owner';
+/**
+ * Record who owns wake delivery for this run. Returning true means a fleet
+ * monitor is taking ownership back from a native harness and must start at the
+ * current stream tip rather than replay notifications the native owner was
+ * responsible for.
+ */
+export function recordMonitorOwner(dir, owner) {
+    let previous = null;
+    try {
+        const path = join(dir, MONITOR_OWNER_FILE);
+        if (existsSync(path))
+            previous = readFileSync(path, 'utf8').trim();
+        writeFileSync(path, `${owner}\n`);
+    }
+    catch { /* ownership diagnostics must never take the role down */ }
+    return owner === 'fleet' && previous === 'native';
+}
 /**
  * Compose the tmux pane shell command: env prefix + argv + exit-status capture.
  * `paneArgv` defaults to `launch.argv`; when isolation is active the caller passes
@@ -334,18 +352,21 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     // leave wake ownership to the harness. Temp snapshots predating `monitor:` are
     // treated as native (monitor may be undefined on an old role.yaml).
     const resolvedMonitorDeps = monitorDeps(deps, role.env);
-    const monitor = role.monitor?.mode === 'fleet' ? deps.createMonitor({
+    const monitorOwner = role.monitor?.mode === 'fleet' ? 'fleet' : 'native';
+    const resetMonitorCursor = recordMonitorOwner(dir, monitorOwner);
+    const monitor = monitorOwner === 'fleet' ? deps.createMonitor({
         name, identity: role.identity, agentDir: dir, cfg: role.monitor,
         deps: resolvedMonitorDeps,
     }) : null;
     if (monitor)
-        await monitor.prime();
+        await monitor.prime({ resetCursor: resetMonitorCursor });
     rmSync(exitFile, { force: true });
     let pid;
     let sessionHandle;
     let acpSession;
     let control;
     let monitorLoop;
+    let acpStartupComplete = false;
     if (sessionBackend === 'acp') {
         const perms = role.permissions ?? resolvePermissions(undefined, undefined);
         // Say once, at startup, that this role will decide permission requests by
@@ -373,7 +394,12 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             // refusal or a cancellation reached the agent and was not acted on, so
             // the monitor must keep its cursor and try again.
             submit: async (text, options) => {
-                const result = await acpSession.submitPrompt(text, { ...options, steer: true });
+                // Cancelling the runner-owned startup prompt makes startup look failed
+                // and closes the session before the wake turn can run. During startup,
+                // steer into the live turn instead; after it completes, honor the
+                // configured interrupt policy normally.
+                const interrupt = options?.interrupt === true && acpStartupComplete;
+                const result = await acpSession.submitPrompt(text, { ...options, interrupt, steer: true });
                 const steered = result.accepted
                     && (result.detail === 'injected' || result.detail === 'startedNewTurn');
                 return {
@@ -390,8 +416,9 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         // startup prompt and then refuses it has not started; logging the role as
         // up would hide a role that never read its briefing.
         const starting = acpSession.submitPrompt(firstPrompt);
-        // Start monitoring as soon as the initial prompt has been submitted. ACP
-        // steering can deliver a wake into that turn without a boot-time deaf gap.
+        // Monitoring starts immediately. The delivery adapter above downgrades
+        // interruption to steering until this startup turn reaches a terminal
+        // success, so there is neither a deaf gap nor a boot-cancellation loop.
         monitorLoop = monitor?.run(pid);
         const started = await starting;
         if (!started.succeeded) {
@@ -401,6 +428,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             throw new Error(`[${name}] ACP startup prompt ${started.outcome}` +
                 `${started.detail ? `: ${started.detail}` : ''}`);
         }
+        acpStartupComplete = true;
     }
     else {
         await deps.tmux.kill(name);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux or ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",