@ours.network/fleet 0.13.2 → 0.13.3

package/dist/owner-channel/state.js

@@ -1,6 +1,11 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
 import { dirname } from 'node:path';
 import { replaceFileAtomically } from '../atomic-file.js';
+import { canonicalCid } from '../config.js';
+/** A send whose (dedupe-scoped) digest was already recorded: it must not repeat. */
+export class DuplicateSendError extends Error {
+}
 /** Durable bounded dedupe containing wire IDs only — never message or reply plaintext. */
 export class OwnerChannelState {
     path;
@@ -36,6 +41,181 @@ export class OwnerChannelState {
         renameSync(tmp, this.path);
     }
 }
+const CONVERSATION_LIMIT = 64;
+const PROACTIVE_SEND_LIMIT = 256;
+const PROACTIVE_MIN_INTERVAL_MS = 30_000;
+const HEX_64_LOWER = /^[a-f0-9]{64}$/;
+const CID = /^[A-Fa-f0-9]{64}$/;
+/**
+ * Durable destination history for unscoped owner messages. It stores only
+ * authenticated CIDs, wire IDs, timestamps and content digests; never bodies,
+ * filenames or display names. A pre-send marker prevents blind replay after a
+ * crash or transport ambiguity.
+ */
+export class OwnerConversationState {
+    path;
+    conversations = [];
+    sends = [];
+    corruptReason;
+    constructor(path) {
+        this.path = path;
+        if (!existsSync(path))
+            return;
+        try {
+            const raw = JSON.parse(readFileSync(path, 'utf8'));
+            if (raw.version !== 1 || !Array.isArray(raw.conversations) || !Array.isArray(raw.sends)
+                || raw.conversations.length > CONVERSATION_LIMIT
+                || raw.sends.length > PROACTIVE_SEND_LIMIT
+                || !raw.conversations.every(record => this.validConversation(record))
+                || !raw.sends.every(send => this.validSend(send)))
+                throw new Error('invalid or unbounded conversation state');
+            if (new Set(raw.conversations.map(record => record.contact)).size !== raw.conversations.length
+                || new Set(raw.sends.map(send => send.id)).size !== raw.sends.length)
+                throw new Error('duplicate conversation state entry');
+            this.conversations = raw.conversations.map(record => ({ ...record }));
+            this.sends = raw.sends.map(send => ({ ...send }));
+            let recovered = false;
+            for (const send of this.sends) {
+                if (send.status === 'sending') {
+                    send.status = 'uncertain';
+                    recovered = true;
+                }
+            }
+            chmodSync(path, 0o600);
+            if (recovered)
+                this.persist();
+        }
+        catch {
+            this.corruptReason = 'invalid persisted owner conversation state';
+            this.conversations = [];
+            this.sends = [];
+            try {
+                chmodSync(path, 0o600);
+            }
+            catch { /* remain fail-closed */ }
+        }
+    }
+    integrity() {
+        return this.corruptReason ? { ok: false, error: this.corruptReason } : { ok: true };
+    }
+    recordInbound(contact, wireId, now = Date.now()) {
+        this.assertHealthy();
+        if (!CID.test(contact) || !wireId || wireId.length > 1_024)
+            throw new Error('owner conversation route is invalid');
+        const current = this.conversations.find(record => record.contact === contact);
+        const latest = this.conversations.reduce((maximum, record) => Math.max(maximum, record.lastInboundAt), 0);
+        // Date.now() can repeat (or move backwards). Preserve the actual accepted
+        // inbound order so two devices messaging in the same millisecond still
+        // produce one deterministic "last conversation" route.
+        const acceptedAt = Math.max(now, latest + 1);
+        this.mutate(() => {
+            if (current) {
+                current.lastInboundAt = acceptedAt;
+                current.lastInboundWireId = wireId;
+            }
+            else {
+                if (this.conversations.length >= CONVERSATION_LIMIT)
+                    throw new Error(`owner conversations are limited to ${CONVERSATION_LIMIT}`);
+                this.conversations.push({ contact, lastInboundAt: acceptedAt, lastInboundWireId: wireId });
+            }
+        });
+    }
+    remove(contact) {
+        this.assertHealthy();
+        const canonical = canonicalCid(contact);
+        if (!this.conversations.some(record => canonicalCid(record.contact) === canonical))
+            return;
+        this.mutate(() => {
+            this.conversations = this.conversations.filter(record => canonicalCid(record.contact) !== canonical);
+        });
+    }
+    route(effective) {
+        this.assertHealthy();
+        // Membership is decided canonically (hex case is not identity); the
+        // returned contact keeps its stored form, which the daemon can route.
+        const canonical = new Set([...effective].map(canonicalCid));
+        const candidates = this.conversations
+            .filter(record => canonical.has(canonicalCid(record.contact)))
+            .sort((a, b) => b.lastInboundAt - a.lastInboundAt);
+        if (candidates.length) {
+            if (candidates[1]?.lastInboundAt === candidates[0].lastInboundAt)
+                throw new Error('proactive owner route is ambiguous');
+            return { contact: candidates[0].contact, basis: 'last-inbound' };
+        }
+        if (canonical.size === 1)
+            return { contact: [...effective][0], basis: 'sole-owner' };
+        throw new Error('no authenticated owner conversation route is available yet');
+    }
+    beginSend(contact, digest, now = Date.now(), minIntervalMs = PROACTIVE_MIN_INTERVAL_MS, dedupe = 'contact') {
+        this.assertHealthy();
+        if (!CID.test(contact) || !HEX_64_LOWER.test(digest))
+            throw new Error('proactive owner send metadata is invalid');
+        const canonical = canonicalCid(contact);
+        const recent = this.sends.filter(send => canonicalCid(send.contact) === canonical).slice(-128);
+        // 'all' scope serves wire-keyed idempotency: a crash replay must not
+        // deliver the same wire to a second owner after the route moved.
+        const scope = dedupe === 'all' ? this.sends.slice(-128) : recent;
+        if (scope.some(send => send.digest === digest))
+            throw new DuplicateSendError('duplicate proactive owner message refused');
+        const last = recent.at(-1);
+        if (last && now - last.at < minIntervalMs)
+            throw new Error(`proactive owner messages are rate-limited to one every ${minIntervalMs}ms`);
+        const send = {
+            id: randomBytes(32).toString('hex'), contact, digest, at: now, status: 'sending',
+        };
+        this.mutate(() => {
+            this.sends.push(send);
+            this.sends = this.sends.slice(-PROACTIVE_SEND_LIMIT);
+        });
+        return { ...send };
+    }
+    finishSend(id, status) {
+        this.assertHealthy();
+        const send = this.sends.find(item => item.id === id);
+        if (!send || send.status !== 'sending')
+            throw new Error('proactive owner send state changed unexpectedly');
+        this.mutate(() => { send.status = status; });
+    }
+    mutate(change) {
+        const snapshot = JSON.stringify({ conversations: this.conversations, sends: this.sends });
+        change();
+        try {
+            this.persist();
+        }
+        catch (error) {
+            const old = JSON.parse(snapshot);
+            this.conversations = old.conversations;
+            this.sends = old.sends;
+            throw error;
+        }
+    }
+    persist() {
+        replaceFileAtomically(this.path, JSON.stringify({
+            version: 1, conversations: this.conversations, sends: this.sends,
+        }) + '\n', 0o600);
+        chmodSync(this.path, 0o600);
+    }
+    assertHealthy() {
+        if (this.corruptReason)
+            throw new Error(`owner conversation state is corrupt; refusing operation: ${this.corruptReason}`);
+    }
+    validConversation(value) {
+        if (!value || typeof value !== 'object')
+            return false;
+        const record = value;
+        return CID.test(record.contact) && Number.isSafeInteger(record.lastInboundAt)
+            && record.lastInboundAt >= 0 && typeof record.lastInboundWireId === 'string'
+            && record.lastInboundWireId.length > 0 && record.lastInboundWireId.length <= 1_024;
+    }
+    validSend(value) {
+        if (!value || typeof value !== 'object')
+            return false;
+        const send = value;
+        return HEX_64_LOWER.test(send.id) && CID.test(send.contact) && HEX_64_LOWER.test(send.digest)
+            && Number.isSafeInteger(send.at) && send.at >= 0
+            && ['sending', 'delivered', 'uncertain'].includes(send.status);
+    }
+}
 const MAX_OVERLAY_CIDS = 1_000;
 const MAX_AUDIT_ENTRIES = 500;
 /**
@@ -73,9 +253,11 @@ export class OwnerAuthorizationState {
             this.added = new Set(raw.added);
             this.revoked = new Set(raw.revoked);
             this.audit = raw.audit;
-            if (this.added.size !== raw.added.length || this.revoked.size !== raw.revoked.length)
+            if (new Set(raw.added.map(canonicalCid)).size !== raw.added.length
+                || new Set(raw.revoked.map(canonicalCid)).size !== raw.revoked.length)
                 throw new Error('duplicate overlay CID');
-            if ([...this.added].some(cid => this.revoked.has(cid)))
+            const revokedCanonical = new Set([...this.revoked].map(canonicalCid));
+            if ([...this.added].some(cid => revokedCanonical.has(canonicalCid(cid))))
                 throw new Error('CID appears in both added and revoked overlays');
             chmodSync(path, 0o600);
         }
@@ -96,32 +278,44 @@ export class OwnerAuthorizationState {
     effective() {
         if (this.corruptReason)
             return new Set();
+        // Stored forms stay verbatim (the daemon routes them case-exactly); the
+        // revocation check is canonical so a casing change can never resurrect a
+        // revoked owner.
+        const revoked = new Set([...this.revoked].map(canonicalCid));
         const effective = new Set([...this.baseline, ...this.added]);
-        for (const cid of this.revoked)
-            effective.delete(cid);
+        for (const cid of [...effective])
+            if (revoked.has(canonicalCid(cid)))
+                effective.delete(cid);
         return effective;
     }
     entries() {
-        const effective = this.effective();
-        return [...new Set([...this.baseline, ...this.added, ...this.revoked])]
-            .sort().map(cid => ({
+        const effective = new Set([...this.effective()].map(canonicalCid));
+        const seen = new Set();
+        const all = [];
+        for (const cid of [...this.baseline, ...this.added, ...this.revoked]) {
+            if (seen.has(canonicalCid(cid)))
+                continue;
+            seen.add(canonicalCid(cid));
+            all.push(cid);
+        }
+        return all.sort().map(cid => ({
             cid,
-            source: this.baseline.has(cid) ? 'baseline' : 'dynamic',
-            effective: effective.has(cid),
+            source: this.inBaseline(cid) ? 'baseline' : 'dynamic',
+            effective: effective.has(canonicalCid(cid)),
         }));
     }
     authorize(cid) {
         this.assertHealthy();
-        if (this.effective().has(cid))
+        if (this.hasCanonical(this.effective(), cid))
             throw new Error(`owner '${cid}' is already authorized`);
         const rollback = this.snapshot();
-        if (this.baseline.has(cid))
-            this.revoked.delete(cid);
+        if (this.inBaseline(cid))
+            this.deleteCanonical(this.revoked, cid);
         else {
             if (this.added.size + this.revoked.size >= MAX_OVERLAY_CIDS)
                 throw new Error(`owner authorization overlay is limited to ${MAX_OVERLAY_CIDS} CIDs`);
             this.added.add(cid);
-            this.revoked.delete(cid);
+            this.deleteCanonical(this.revoked, cid);
         }
         this.record('authorize', cid);
         try {
@@ -131,20 +325,20 @@ export class OwnerAuthorizationState {
             this.restore(rollback);
             throw error;
         }
-        return { cid, source: this.baseline.has(cid) ? 'baseline' : 'dynamic', effective: true };
+        return { cid, source: this.inBaseline(cid) ? 'baseline' : 'dynamic', effective: true };
     }
     revoke(cid) {
         this.assertHealthy();
         const effective = this.effective();
-        if (!effective.has(cid))
+        if (!this.hasCanonical(effective, cid))
             throw new Error(`owner '${cid}' is not authorized`);
-        if (effective.size === 1)
+        if (new Set([...effective].map(canonicalCid)).size === 1)
             throw new Error('refusing to revoke the last effective owner');
         const rollback = this.snapshot();
-        if (this.baseline.has(cid))
+        if (this.inBaseline(cid))
             this.revoked.add(cid);
         else
-            this.added.delete(cid);
+            this.deleteCanonical(this.added, cid);
         this.record('revoke', cid);
         try {
             this.persist();
@@ -153,7 +347,23 @@ export class OwnerAuthorizationState {
             this.restore(rollback);
             throw error;
         }
-        return { cid, source: this.baseline.has(cid) ? 'baseline' : 'dynamic', effective: false };
+        return { cid, source: this.inBaseline(cid) ? 'baseline' : 'dynamic', effective: false };
+    }
+    inBaseline(cid) {
+        return this.hasCanonical(this.baseline, cid);
+    }
+    hasCanonical(set, cid) {
+        const canonical = canonicalCid(cid);
+        for (const member of set)
+            if (canonicalCid(member) === canonical)
+                return true;
+        return false;
+    }
+    deleteCanonical(set, cid) {
+        const canonical = canonicalCid(cid);
+        for (const member of [...set])
+            if (canonicalCid(member) === canonical)
+                set.delete(member);
     }
     assertHealthy() {
         if (this.corruptReason)

package/dist/owner-channel/tasks.js

@@ -1,6 +1,7 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { chmodSync, existsSync, readFileSync } from 'node:fs';
 import { replaceFileAtomically } from '../atomic-file.js';
+import { canonicalCid } from '../config.js';
 export const OWNER_TASK_TTL_MS = 7 * 24 * 60 * 60 * 1_000;
 export const OWNER_TASK_MAX_OPEN = 32;
 export const OWNER_TASK_MAX_PER_OWNER = 8;
@@ -69,7 +70,8 @@ export class OwnerTaskState {
         this.cleanup(now);
         if (this.tasks.length >= OWNER_TASK_MAX_OPEN)
             throw new Error(`owner channel is limited to ${OWNER_TASK_MAX_OPEN} open tasks`);
-        if (this.tasks.filter(task => task.contact === route.contact).length >= OWNER_TASK_MAX_PER_OWNER)
+        if (this.tasks.filter(task => canonicalCid(task.contact) === canonicalCid(route.contact))
+            .length >= OWNER_TASK_MAX_PER_OWNER)
             throw new Error(`an owner is limited to ${OWNER_TASK_MAX_PER_OWNER} open tasks per role`);
         let id;
         do {
@@ -139,7 +141,7 @@ export class OwnerTaskState {
     }
     revoke(contact, now = Date.now()) {
         this.assertHealthy();
-        const revoked = this.tasks.filter(task => task.contact === contact);
+        const revoked = this.tasks.filter(task => canonicalCid(task.contact) === canonicalCid(contact));
         if (!revoked.length)
             return 0;
         this.mutate(() => { for (const task of revoked)
@@ -149,8 +151,9 @@ export class OwnerTaskState {
     cleanup(now = Date.now(), effectiveOwners) {
         this.assertHealthy();
         const expired = this.tasks.filter(task => task.expiresAt <= now);
-        const revoked = effectiveOwners
-            ? this.tasks.filter(task => !effectiveOwners.has(task.contact) && !expired.includes(task)) : [];
+        const canonicalOwners = effectiveOwners && new Set([...effectiveOwners].map(canonicalCid));
+        const revoked = canonicalOwners
+            ? this.tasks.filter(task => !canonicalOwners.has(canonicalCid(task.contact)) && !expired.includes(task)) : [];
         const oldTombstones = this.tombstones.filter(item => now - item.at > TOMBSTONE_TTL_MS);
         if (!expired.length && !revoked.length && !oldTombstones.length)
             return 0;

package/dist/session/acp.d.ts

@@ -11,6 +11,8 @@ export interface AcpSessionOptions {
     /** Native permission-mode id to request via session/set_mode; undefined keeps the agent default. */
     modeId?: string;
     log(line: string): void;
+    /** Test seam for the cancel-escalation grace period; production uses the default. */
+    cancelGraceMs?: number;
 }
 /**
  * Classify an ACP `stopReason` into a terminal outcome. A refusal and a
@@ -40,6 +42,7 @@ export declare class AcpSession implements SessionHandle {
     private steeringSupported;
     private capabilities?;
     private controllerCount;
+    private cancelEscalation?;
     private activeTurn?;
     private constructor();
     static start(options: AcpSessionOptions): Promise<AcpSession>;

package/dist/session/acp.js

@@ -6,6 +6,7 @@ import { Readable, Writable } from 'node:stream';
 import * as acp from '@agentclientprotocol/sdk';
 import { SessionEvents } from './events.js';
 import { SessionControlError, classifyChildExit, turnResult } from './types.js';
+const CANCEL_SETTLE_GRACE_MS = 15_000;
 /**
  * Classify an ACP `stopReason` into a terminal outcome. A refusal and a
  * cancellation are the two ways a delivered prompt ends without being carried
@@ -40,6 +41,7 @@ export class AcpSession {
     steeringSupported = false;
     capabilities;
     controllerCount = 0;
+    cancelEscalation;
     activeTurn;
     constructor(options, child, connection) {
         this.options = options;
@@ -165,6 +167,20 @@ export class AcpSession {
                 active.cancellationSource = previousSource;
             throw error;
         }
+        if (active) {
+            if (this.cancelEscalation)
+                clearTimeout(this.cancelEscalation);
+            const turnId = active.id;
+            this.cancelEscalation = setTimeout(() => {
+                if (this.activeTurn?.id !== turnId || !this.isAlive())
+                    return;
+                this.lastError = 'ACP turn ignored cancellation; restarting adapter';
+                this.options.log(`[${this.options.name}] ${this.lastError}`);
+                this.events.emit('error', { turnId, origin: active.origin, text: this.lastError });
+                this.child.kill('SIGTERM');
+            }, this.options.cancelGraceMs ?? CANCEL_SETTLE_GRACE_MS);
+            this.cancelEscalation.unref?.();
+        }
         for (const pending of this.pendingPermissions.values())
             pending.resolve({ outcome: { outcome: 'cancelled' } });
         this.pendingPermissions.clear();
@@ -202,6 +218,9 @@ export class AcpSession {
         return this.exit;
     }
     async close() {
+        if (this.cancelEscalation)
+            clearTimeout(this.cancelEscalation);
+        this.cancelEscalation = undefined;
         for (const pending of this.pendingPermissions.values())
             pending.resolve({ outcome: { outcome: 'cancelled' } });
         this.pendingPermissions.clear();
@@ -305,8 +324,12 @@ export class AcpSession {
             return turnResult(false, 'failed', this.lastError, this.activeTurn?.id === turnId ? this.activeTurn.output : undefined);
         }
         finally {
-            if (this.activeTurn?.id === turnId)
+            if (this.activeTurn?.id === turnId) {
+                if (this.cancelEscalation)
+                    clearTimeout(this.cancelEscalation);
+                this.cancelEscalation = undefined;
                 this.activeTurn = undefined;
+            }
         }
     }
     async steerPrompt(text) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux or ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",