@ours.network/fleet 0.17.3 → 0.17.4

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "0.17.3",
-  "buildId": "789acfed6bbd",
-  "commit": "47f1efd0f90321cf233edc694a9af5fb5ba05647",
+  "version": "0.17.4",
+  "buildId": "b94609824510",
+  "commit": "094a6fcb714541b03404e0fb39605105e390510b",
   "dirty": false,
-  "builtAt": "2026-08-14T20:15:30.780Z",
+  "builtAt": "2026-08-14T21:36:46.539Z",
   "capabilities": [
     "monitor.interrupt.after_tool"
   ]

package/dist/runner.d.ts

@@ -3,7 +3,9 @@ import type { Launch } from './harness/types.js';
 import { Tmux } from './tmux.js';
 import { type MonitorHandle, type MonitorOpts, type FetchLike } from './monitor.js';
 import { type Exec } from './exec.js';
-import type { ExitRecord } from './session/types.js';
+import { type AcpSessionOptions } from './session/acp.js';
+import { RoleControlServer } from './session/control.js';
+import type { ExitRecord, SessionHandle, TurnResult } from './session/types.js';
 import { type OwnerChannelHandle, type OwnerChannelOptions } from './owner-channel/channel.js';
 import { type OwnerBinderLease } from './owner-channel/binder.js';
 export interface RunnerDeps {
@@ -20,6 +22,10 @@ export interface RunnerDeps {
     createMonitor(opts: MonitorOpts): MonitorHandle;
     /** Construct trusted owner ingress (injectable for lifecycle tests). */
     createOwnerChannel(opts: OwnerChannelOptions): OwnerChannelHandle;
+    /** Start the ACP transport (injectable for deterministic runner lifecycle tests). */
+    startAcpSession(opts: AcpSessionOptions): Promise<SessionHandle>;
+    /** Construct the authenticated role control route (injectable where sockets are unavailable). */
+    createControlServer(stateDir: string, session: SessionHandle, log: (line: string) => void): Pick<RoleControlServer, 'start' | 'close' | 'setFleetSpawner' | 'setOwnerChannel' | 'setConfigReloader' | 'setLoopManager'>;
     /** Acquire the cross-process owner-channel binder lease before replacing the control socket. */
     acquireOwnerBinder(stateDir: string, role: string, identity: string): Promise<OwnerBinderLease>;
     /** Ask the still-authenticated predecessor to emit the fixed recovery notice. */
@@ -107,6 +113,8 @@ export interface AttemptResult {
 export declare const TEMP_IDENTITY_CLOSE_DEBOUNCE_MS = 5000;
 /** Lifecycle polling is deliberately slower than the 500ms stop-signal loop. */
 export declare const TEMP_IDENTITY_POLL_MS = 2000;
+/** Only authenticated wake interrupts may turn a temp startup cancellation into readiness. */
+export declare function isRecoverableTempStartupCancellation(temp: boolean, result: TurnResult): boolean;
 /** One session lifecycle. `runSupervised` (or a one-shot caller) drives it. */
 export declare function runOnce(name: string, opts?: {
     temp?: boolean;

package/dist/runner.js

@@ -42,6 +42,8 @@ const defaultDeps = () => ({
     fetch: (url, init) => globalThis.fetch(url, init),
     createMonitor: opts => createMonitor(opts),
     createOwnerChannel: opts => new OwnerChannel(opts),
+    startAcpSession: opts => AcpSession.start(opts),
+    createControlServer: (stateDir, session, log) => new RoleControlServer(stateDir, session, log),
     acquireOwnerBinder: (stateDir, role, identity) => acquireOwnerBinderLease(stateDir, role, identity),
     reportOwnerStartupFailure: async (stateDir) => {
         const response = await controlRequest(stateDir, {
@@ -352,6 +354,12 @@ function resolveConfigPath(dir, explicit) {
 export const TEMP_IDENTITY_CLOSE_DEBOUNCE_MS = 5_000;
 /** Lifecycle polling is deliberately slower than the 500ms stop-signal loop. */
 export const TEMP_IDENTITY_POLL_MS = 2_000;
+/** Only authenticated wake interrupts may turn a temp startup cancellation into readiness. */
+export function isRecoverableTempStartupCancellation(temp, result) {
+    return temp && result.accepted && result.outcome === 'cancelled'
+        && (result.cancellationSource === 'local-console'
+            || result.cancellationSource === 'fleet-monitor');
+}
 /** One session lifecycle. `runSupervised` (or a one-shot caller) drives it. */
 export async function runOnce(name, opts = {}, partialDeps = {}) {
     const deps = { ...defaultDeps(), ...partialDeps };
@@ -512,7 +520,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         if (perms.unattended === 'deny')
             deps.log(`[${name}] permission policy: unattended=deny — with no console attached, ` +
                 `permission requests are automatically denied once each (reject_once) and the turn continues`);
-        acpSession = await AcpSession.start({
+        acpSession = await deps.startAcpSession({
             name,
             argv: wrappedArgv,
             cwd: runCwd,
@@ -555,7 +563,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                     + `${error?.message ?? String(error)}`);
             }
         }
-        control = new RoleControlServer(dir, arbiter, deps.log);
+        control = deps.createControlServer(dir, arbiter, deps.log);
         try {
             await control.start();
         }
@@ -640,7 +648,14 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         // success, so there is neither a deaf gap nor a boot-cancellation loop.
         monitorLoop = monitor?.run(pid);
         const started = await starting;
-        if (!started.succeeded) {
+        // A temporary role's first turn can be the active turn when an ours wake
+        // needs immediate attention. A typed console/monitor cancellation ends
+        // only that turn: the already-live ACP session and any queued wake remain
+        // valid. Keep every unproven cancellation, refusal, shutdown, and genuine
+        // failure terminal so a role that never accepted its briefing is not
+        // silently reported as healthy.
+        const interruptedForWake = isRecoverableTempStartupCancellation(temp, started);
+        if (!started.succeeded && !interruptedForWake) {
             monitor?.stop();
             await control.close();
             ownerBinder?.release();
@@ -664,6 +679,9 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             throw new Error(`[${name}] ACP startup prompt ${started.outcome}` +
                 `${started.detail ? `: ${started.detail}` : ''}`);
         }
+        if (interruptedForWake)
+            deps.log(`[${name}] ACP startup prompt cancelled by ${started.cancellationSource}; `
+                + 'keeping temporary supervisor alive');
         acpStartupComplete = true;
         if (role.owner_channel) {
             ownerChannel = deps.createOwnerChannel({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.17.3",
+  "version": "0.17.4",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux or ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",