@ours.network/fleet 0.11.0 → 0.12.0

package/dist/session/acp.d.ts

@@ -38,6 +38,7 @@ export declare class AcpSession implements SessionHandle {
     private steeringSupported;
     private capabilities?;
     private controllerCount;
+    private activeTurn?;
     private constructor();
     static start(options: AcpSessionOptions): Promise<AcpSession>;
     isAlive(): boolean;

package/dist/session/acp.js

@@ -40,6 +40,7 @@ export class AcpSession {
     steeringSupported = false;
     capabilities;
     controllerCount = 0;
+    activeTurn;
     constructor(options, child, connection) {
         this.options = options;
         this.child = child;
@@ -162,6 +163,7 @@ export class AcpSession {
         this.pendingPermissions.delete(permissionId);
         pending.resolve({ outcome: { outcome: 'selected', optionId } });
         this.events.emit('permission', {
+            turnId: this.activeTurn?.id,
             permissionId,
             status: 'completed',
             decision: chosen.kind.startsWith('reject') ? 'denied' : 'allowed',
@@ -241,6 +243,7 @@ export class AcpSession {
         if (!this.sessionId || !this.isAlive())
             return turnResult(false, 'failed', this.lastError ?? 'ACP session is offline');
         this.readiness = 'running';
+        this.activeTurn = { id: turnId, output: '' };
         this.events.emit('state', { turnId, status: 'running' });
         try {
             const response = await this.connection.agent.request(acp.methods.agent.session.prompt, {
@@ -252,7 +255,7 @@ export class AcpSession {
             this.events.emit('state', { status: 'idle' });
             // The prompt was accepted either way — the agent answered. Whether the
             // turn SUCCEEDED is a separate question, and only `stopReason` answers it.
-            return turnResult(true, classifyStopReason(response.stopReason), response.stopReason);
+            return turnResult(true, classifyStopReason(response.stopReason), response.stopReason, this.activeTurn?.id === turnId ? this.activeTurn.output : undefined);
         }
         catch (error) {
             this.lastError = error?.message ?? String(error);
@@ -260,7 +263,11 @@ export class AcpSession {
             this.events.emit('error', { turnId, text: this.lastError });
             if (this.isAlive())
                 this.events.emit('state', { status: 'idle' });
-            return turnResult(false, 'failed', this.lastError);
+            return turnResult(false, 'failed', this.lastError, this.activeTurn?.id === turnId ? this.activeTurn.output : undefined);
+        }
+        finally {
+            if (this.activeTurn?.id === turnId)
+                this.activeTurn = undefined;
         }
     }
     async steerPrompt(text) {
@@ -312,6 +319,7 @@ export class AcpSession {
         const permissionId = randomUUID();
         this.readiness = 'awaiting_permission';
         this.events.emit('permission', {
+            turnId: this.activeTurn?.id,
             permissionId,
             toolCallId: params.toolCall.toolCallId,
             title: params.toolCall.title ?? 'Permission requested',
@@ -332,6 +340,7 @@ export class AcpSession {
     settleAutomatically(params, option, decision, policy, reason) {
         const settled = option ? decision : 'cancelled';
         this.events.emit('permission', {
+            turnId: this.activeTurn?.id,
             permissionId: randomUUID(),
             toolCallId: params.toolCall.toolCallId,
             title: params.toolCall.title ?? 'Permission requested',
@@ -366,17 +375,22 @@ export class AcpSession {
     recordUpdate(update) {
         switch (update.sessionUpdate) {
             case 'agent_message_chunk':
+                if (this.activeTurn && update.content.type === 'text')
+                    this.activeTurn.output += update.content.text;
                 this.events.emit('agent_text', {
+                    turnId: this.activeTurn?.id,
                     text: update.content.type === 'text' ? update.content.text : `[${update.content.type}]`,
                 });
                 break;
             case 'agent_thought_chunk':
                 this.events.emit('thought', {
+                    turnId: this.activeTurn?.id,
                     text: update.content.type === 'text' ? update.content.text : `[${update.content.type}]`,
                 });
                 break;
             case 'tool_call':
                 this.events.emit('tool_call', {
+                    turnId: this.activeTurn?.id,
                     toolCallId: update.toolCallId,
                     title: update.title,
                     status: update.status,
@@ -384,6 +398,7 @@ export class AcpSession {
                 break;
             case 'tool_call_update':
                 this.events.emit('tool_update', {
+                    turnId: this.activeTurn?.id,
                     toolCallId: update.toolCallId,
                     title: update.title ?? undefined,
                     status: update.status ?? undefined,

package/dist/session/types.d.ts

@@ -19,6 +19,8 @@ export interface TurnResult {
     outcome: TurnOutcome;
     succeeded: boolean;
     detail?: string;
+    /** Final assistant text captured structurally by a backend, when available. */
+    output?: string;
 }
 /**
  * Why a control operation failed. The distinctions exist because collapsing
@@ -75,7 +77,7 @@ export declare function classifyChildExit(code: number | null, signal: string |
 /** The single definition of terminal success. Nothing else may re-derive it. */
 export declare const isTerminalSuccess: (outcome: TurnOutcome) => boolean;
 /** Build a TurnResult with `succeeded` always consistent with `outcome`. */
-export declare function turnResult(accepted: boolean, outcome: TurnOutcome, detail?: string): TurnResult;
+export declare function turnResult(accepted: boolean, outcome: TurnOutcome, detail?: string, output?: string): TurnResult;
 export interface SubmitPromptOptions {
     /** Cancel active work before delivering this prompt. */
     interrupt?: boolean;

package/dist/session/types.js

@@ -37,6 +37,6 @@ export function classifyChildExit(code, signal) {
 /** The single definition of terminal success. Nothing else may re-derive it. */
 export const isTerminalSuccess = (outcome) => outcome === 'completed';
 /** Build a TurnResult with `succeeded` always consistent with `outcome`. */
-export function turnResult(accepted, outcome, detail) {
-    return { accepted, outcome, succeeded: isTerminalSuccess(outcome), detail };
+export function turnResult(accepted, outcome, detail, output) {
+    return { accepted, outcome, succeeded: isTerminalSuccess(outcome), detail, output };
 }

package/dist/spawn.js

@@ -4,7 +4,7 @@ import { join } from 'node:path';
 import { parse, stringify } from 'yaml';
 import { agentDir, fleetDDir } from './paths.js';
 import { validateIsolationConfig } from './isolation/policy.js';
-import { loadConfig, resolveAuthProxy, resolveModelChain, resolveMonitorConfig, resolvePermissions, resolveRoleModel, resolveWorklogPolicy, validateMonitorConfig, } from './config.js';
+import { loadConfig, resolveAuthProxy, resolveModelChain, resolveMonitorConfig, resolveOwnerChannelConfig, resolvePermissions, resolveRoleModel, resolveWorklogPolicy, validateMonitorConfig, } from './config.js';
 import { applyRole, up } from './ops.js';
 import { START_STAGGER_FILE } from './runner.js';
 import { buildProvenance, daemonIdentityProvisioner, ensureIdentity, provenanceOf, withCreationTransaction, writeProvenance, writeRoleFile, } from './creation.js';
@@ -186,12 +186,13 @@ export function spawnDryRun(o) {
     const defaultHarness = cfg.defaults.harness ?? 'claude-code';
     const inheritsModelDefaults = harness === defaultHarness && raw.model !== null;
     const model = resolveRoleModel(raw.model, raw.harness, cfg.defaults);
+    const session = raw.session ?? cfg.defaults.session ?? 'tmux';
     const resolvedRole = {
         ...raw,
         name: o.name,
         sourceFile: o.temp ? '(temp dry-run)' : join(fleetDDir(), `${o.name}.yaml`),
         harness,
-        session: raw.session ?? cfg.defaults.session ?? 'tmux',
+        session,
         session_options: raw.session_options,
         permissions: resolvePermissions(cfg.defaults.permissions, raw.permissions),
         permissionsDeclared: raw.permissions !== undefined || cfg.defaults.permissions !== undefined,
@@ -203,6 +204,7 @@ export function spawnDryRun(o) {
         harness_options: Object.keys(harnessOptions).length ? harnessOptions : undefined,
         isolation: raw.isolation ?? cfg.defaults.isolation,
         monitor: resolveMonitorConfig(cfg.defaults.monitor, raw.monitor),
+        owner_channel: resolveOwnerChannelConfig(cfg.defaults.owner_channel, raw.owner_channel, session),
         worklog: resolveWorklogPolicy(cfg.defaults.worklog, raw.worklog),
         auth_proxy: resolveAuthProxy(cfg.defaults.auth_proxy, raw.auth_proxy),
     };
@@ -378,11 +380,12 @@ async function spawnTempInner(o, binPath, launch, tx, guarantee, onStage) {
     const harness = o.harness ?? defaultHarness ?? 'claude-code';
     const inheritsModelDefaults = harness === (defaultHarness ?? 'claude-code') && o.model !== null;
     const model = resolveRoleModel(o.model, o.harness, cfg.defaults);
+    const session = o.session ?? cfg.defaults.session ?? 'tmux';
     const role = {
         ...fromOpts, // includes `isolation` when --isolation-file was given
         name: o.name,
         harness,
-        session: o.session ?? cfg.defaults.session ?? 'tmux',
+        session,
         identity: o.identity ?? o.name,
         model,
         model_chain: resolveModelChain(model, fromOpts.model_chain ?? (inheritsModelDefaults
@@ -393,6 +396,7 @@ async function spawnTempInner(o, binPath, launch, tx, guarantee, onStage) {
         permissionsDeclared: fromOpts.permissions !== undefined || cfg.defaults.permissions !== undefined,
         // Temp agents inherit the fleet-wide monitor defaults via the snapshot (design §2).
         monitor: resolveMonitorConfig(cfg.defaults.monitor, fromOpts.monitor),
+        owner_channel: resolveOwnerChannelConfig(cfg.defaults.owner_channel, fromOpts.owner_channel, session),
         worklog: resolveWorklogPolicy(cfg.defaults.worklog, fromOpts.worklog),
         auth_proxy: resolveAuthProxy(cfg.defaults.auth_proxy, fromOpts.auth_proxy),
         sourceFile: '(temp)',

package/dist/watchdog/config.d.ts

@@ -1,4 +1,5 @@
 import type { FleetConfig, ResolvedRole, SessionBackendId } from '../config.js';
+import type { IsolationConfig } from '../isolation/types.js';
 export interface WatchdogConfig {
     coordinator?: string;
     enabled?: boolean;
@@ -12,6 +13,7 @@ export interface WatchdogConfig {
     keep_reports?: number;
     alert_cooldown?: string;
     prompt_file?: string;
+    isolation?: IsolationConfig;
 }
 export interface ResolvedWatchdog {
     name: string;
@@ -19,6 +21,7 @@ export interface ResolvedWatchdog {
     enabled: boolean;
     intervalMs: number;
     watch: string[];
+    watchExplicit: boolean;
     harness: string;
     session: SessionBackendId;
     model?: string;
@@ -27,6 +30,7 @@ export interface ResolvedWatchdog {
     keepReports: number;
     alertCooldownMs: number;
     promptFile?: string;
+    isolation?: IsolationConfig;
     sourceFile: string;
 }
 export declare const WATCHDOG_DEFAULT_INTERVAL_MS = 600000;

package/dist/watchdog/config.js

@@ -2,9 +2,10 @@ import { existsSync } from 'node:fs';
 import { isAbsolute } from 'node:path';
 import { parseDuration } from '../duration.js';
 import { ConfigError, ROLE_NAME_RE, resolveRoleModel } from '../config.js';
+import { validateIsolationConfig } from '../isolation/policy.js';
 const WATCHDOG_KEYS = [
     'coordinator', 'enabled', 'interval', 'watch', 'harness', 'model', 'session',
-    'identity', 'timeout', 'keep_reports', 'alert_cooldown', 'prompt_file',
+    'identity', 'timeout', 'keep_reports', 'alert_cooldown', 'prompt_file', 'isolation',
 ];
 export const WATCHDOG_DEFAULT_INTERVAL_MS = 600_000;
 export const WATCHDOG_MIN_INTERVAL_MS = 60_000;
@@ -69,6 +70,11 @@ export function resolveWatchdogs(baseDoc, baseFile, roles, vars, defaults) {
             if (!existsSync(w.prompt_file))
                 throw new ConfigError(`${where}: prompt_file not found: ${w.prompt_file}`);
         }
+        if (w.isolation !== undefined) {
+            const problems = validateIsolationConfig(w.isolation);
+            if (problems.length)
+                throw new ConfigError(`${where} ${problems.join('; ')}`);
+        }
         const dur = (v, key, fallback, minMs) => {
             if (v === undefined)
                 return fallback;
@@ -88,13 +94,13 @@ export function resolveWatchdogs(baseDoc, baseFile, roles, vars, defaults) {
             name, coordinator: w.coordinator.trim(),
             enabled: w.enabled ?? true,
             intervalMs: dur(w.interval, 'interval', WATCHDOG_DEFAULT_INTERVAL_MS, WATCHDOG_MIN_INTERVAL_MS),
-            watch, harness, session: sessionRaw,
+            watch, watchExplicit: w.watch !== undefined, harness, session: sessionRaw,
             model: resolveRoleModel(w.model, w.harness, defaults),
             identity,
             timeoutMs: dur(w.timeout, 'timeout', WATCHDOG_DEFAULT_TIMEOUT_MS),
             keepReports,
             alertCooldownMs: dur(w.alert_cooldown, 'alert_cooldown', WATCHDOG_DEFAULT_COOLDOWN_MS),
-            promptFile: w.prompt_file, sourceFile: baseFile,
+            promptFile: w.prompt_file, isolation: w.isolation, sourceFile: baseFile,
         });
     }
     return out;

package/dist/watchdog/run.d.ts

@@ -21,6 +21,8 @@ export interface WatchdogRunDeps {
     launchChild?(binPath: string, roleName: string, runDir: string): WatchdogChildHandle;
     /** Pre-loaded config (defaults inheritance). Falls back to `loadConfig()`. */
     cfg?: FleetConfig;
+    /** Live temporary-role discovery override for focused tests. */
+    discoverLiveTemporaryRoles?(): Promise<string[]>;
 }
 export interface WatchdogRunOutcome {
     report: WatchdogReport;

package/dist/watchdog/run.js

@@ -1,4 +1,4 @@
-import { closeSync, existsSync, openSync, readFileSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { closeSync, existsSync, openSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 import { spawn as spawnChild, execFile } from 'node:child_process';
 import { join } from 'node:path';
 import { promisify } from 'node:util';
@@ -10,10 +10,12 @@ import { computeDigest, reconcileLedger, readLedger, writeLedger } from './alert
 import { applyRole } from '../ops.js';
 import { daemonIdentityProvisioner, ensureIdentity, } from '../creation.js';
 import { runOnce, START_STAGGER_FILE } from '../runner.js';
-import { agentDir } from '../paths.js';
-import { loadConfig, resolveMonitorConfig, resolveWorklogPolicy, } from '../config.js';
+import { agentDir, tmpRoot } from '../paths.js';
+import { loadConfig, resolveMonitorConfig, resolveWorklogPolicy, ROLE_NAME_RE, } from '../config.js';
 import { getAdapter } from '../harness/registry.js';
 import { redactLogLine } from '../application/log-service.js';
+import { controlRequest, controlSocketPath } from '../session/control.js';
+import { Tmux } from '../tmux.js';
 const execFileAsync = promisify(execFile);
 /** How often the deadline loop polls for a completed report or a dead child. */
 const POLL_MS = 1000;
@@ -92,33 +94,49 @@ function readTail(runDir) {
         return undefined;
     }
 }
-/**
- * The temp role every watchdog-family run (inspection and notifier alike) launches under.
- * `network: 'broker'` keeps ours messaging available; no write binds beyond stateDir/cwd, which
- * resolveIsolation adds itself. ~/fleet.yaml and fleet.d are deliberately NOT bound — they're on
- * the isolation blocklist, and everything either run flavor needs is written into its own dir.
- *
- * Read access is scoped to exactly `wd.watch` (finding #3): a watchdog configured to watch one
- * role must not be able to read every other role's state dir just because they all live under
- * the same agents root. `wd.watch` defaults to every role (watchdog/config.ts's
- * resolveWatchdogs), so a watchdog that watches everything still sees everything — this only
- * narrows visibility for a watchdog scoped to fewer roles. A watched role whose state dir doesn't
- * exist (e.g. a role removed after the watchdog was configured) is simply absent from the
- * bwrap ro-bind-try set — the agent reports it unreachable from status evidence, same as any
- * other missing state dir.
- */
+/** The temp role every watchdog-family run launches under. Isolation is opt-in. */
 function buildWatchdogRole(wd, cfg) {
     return {
         name: wd.identity, sourceFile: '(watchdog)',
         harness: wd.harness, session: wd.session,
         identity: wd.identity, model: wd.model,
-        permissions: { approval: 'allow', filesystem: 'workspace', unattended: 'deny' },
+        // Watchdogs are observe-only by contract, but their sanctioned status commands
+        // must reach host control sockets. Keep approvals/unattended escalation denied
+        // while disabling the harness's native filesystem/network sandbox.
+        permissions: { approval: 'deny', filesystem: 'unrestricted', unattended: 'deny' },
         permissionsDeclared: true,
         monitor: resolveMonitorConfig(cfg.defaults.monitor, undefined),
         worklog: resolveWorklogPolicy(cfg.defaults.worklog, undefined),
-        isolation: { fs: { read: wd.watch.map(r => agentDir(r)) }, network: 'broker' },
+        isolation: wd.isolation,
     };
 }
+/** Discover temporary sessions that are live now, not merely stale dirs on disk. */
+async function discoverLiveTemporaryRoles() {
+    let names;
+    try {
+        names = readdirSync(tmpRoot(), { withFileTypes: true })
+            .filter(entry => entry.isDirectory() && !entry.isSymbolicLink() && ROLE_NAME_RE.test(entry.name))
+            .map(entry => entry.name);
+    }
+    catch {
+        return [];
+    }
+    const tmux = new Tmux();
+    const live = await Promise.all(names.map(async (name) => {
+        const dir = agentDir(name, true);
+        const [acpAlive, tmuxAlive] = await Promise.all([
+            existsSync(controlSocketPath(dir))
+                ? controlRequest(dir, { command: 'status' }, 2_000)
+                    .then(response => response.ok
+                    && response.result?.alive === true)
+                    .catch(() => false)
+                : Promise.resolve(false),
+            tmux.has(name).catch(() => false),
+        ]);
+        return acpAlive || tmuxAlive ? name : undefined;
+    }));
+    return live.filter((name) => name !== undefined);
+}
 /**
  * Run one watchdog agent end-to-end in a clean-context temp state dir: provision
  * identity, materialize the run's contract (briefing/manifest/role snapshot),
@@ -147,14 +165,20 @@ export async function executeWatchdogRun(wd, deps) {
     try {
         const guarantee = await ensureIdentity(wd.identity, {}, deps.identityProvisioner ?? daemonIdentityProvisioner(), deps.log);
         const cfg = deps.cfg ?? loadConfig();
-        const role = buildWatchdogRole(wd, cfg);
+        const discovered = wd.watchExplicit
+            ? []
+            : await (deps.discoverLiveTemporaryRoles ?? discoverLiveTemporaryRoles)();
+        const watch = [...new Set([...wd.watch, ...discovered])]
+            .filter(name => name !== wd.identity);
+        const runWd = { ...wd, watch };
+        const role = buildWatchdogRole(runWd, cfg);
         const dir = applyRole(role, { temp: true, identityGuarantee: guarantee.state });
         const reportPath = join(dir, 'report.json');
         const manifestPath = join(dir, 'watch.json');
         const promptFocus = wd.promptFile ? readFileSync(wd.promptFile, 'utf8') : undefined;
         // applyRole wrote the generic role briefing; the watchdog contract replaces it.
         writeFileSync(join(dir, 'briefing.md'), generateWatchdogBriefing({
-            wd, manifestPath, reportPath,
+            wd: runWd, manifestPath, reportPath,
             vocabulary: getAdapter(wd.harness).vocabulary,
             identityGuarantee: guarantee.state,
             promptFocus,
@@ -163,7 +187,10 @@ export async function executeWatchdogRun(wd, deps) {
         writeFileSync(join(dir, 'role.yaml'), stringify(role));
         const manifest = {
             watchdog: wd.name, run_id: runId, coordinator: wd.coordinator, started_at: startedAt,
-            roles: wd.watch.map(r => ({ name: r, stateDir: agentDir(r) })),
+            roles: runWd.watch.map(r => ({
+                name: r,
+                stateDir: wd.watch.includes(r) ? agentDir(r) : agentDir(r, true),
+            })),
             digest: computeDigest(ledger, wd.alertCooldownMs, now()),
         };
         writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux or ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",