npm - @ours.network/fleet - Versions diffs - 0.17.9 → 0.17.11 - Mend

@ours.network/fleet 0.17.9 → 0.17.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (23) hide show

package/README.md +38 -3
package/dist/briefing.js +4 -2
package/dist/build-info.json +4 -4
package/dist/config.d.ts +6 -3
package/dist/config.js +28 -14
package/dist/docs.d.ts +1 -1
package/dist/docs.js +32 -4
package/dist/model-env.d.ts +71 -0
package/dist/model-env.js +106 -0
package/dist/runner.d.ts +9 -0
package/dist/runner.js +27 -3
package/dist/session/acp.d.ts +3 -0
package/dist/session/acp.js +29 -2
package/dist/session/conversation-normalizer.d.ts +6 -0
package/dist/session/conversation-normalizer.js +153 -10
package/dist/session/conversation-types.d.ts +23 -4
package/dist/spawn.js +28 -16
package/dist/web-app/assets/{TerminalView-BAVk1Bot.js → TerminalView-C_G1ID2P.js} +1 -1
package/dist/web-app/assets/{index-C3S-xFRU.js → index-BCBK78hw.js} +5 -5
package/dist/web-app/index.html +1 -1
package/dist/worklog.d.ts +7 -1
package/dist/worklog.js +191 -39
package/package.json +1 -1

package/dist/web-app/index.html CHANGED Viewed

@@ -8,7 +8,7 @@
     <link rel="manifest" href="/manifest.webmanifest" />
     <link rel="icon" href="/icons/ours-fleet.svg" type="image/svg+xml" />
     <title>ours fleet console</title>
-    <script type="module" crossorigin src="/assets/index-C3S-xFRU.js"></script>
+    <script type="module" crossorigin src="/assets/index-BCBK78hw.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DuC-xnX4.css">
   </head>
   <body>

package/dist/worklog.d.ts CHANGED Viewed

@@ -1,4 +1,5 @@
 import type { WorklogPolicy } from './config.js';
+export declare const WORKLOG_ARCHIVE_DIR = "WORKLOG.archives";
 export interface WorklogInspection {
     enabled: boolean;
     bytes: number;
@@ -12,6 +13,11 @@ export interface WorklogRotation {
     archivePath?: string;
 }
 export declare function inspectWorklog(path: string, policy?: WorklogPolicy): WorklogInspection;
+/**
+ * Keep a bounded set of recent archives beside WORKLOG.md without deleting
+ * history. Older archives move atomically-by-link into WORKLOG.archives/.
+ * The legacy name remains exported for source compatibility.
+ */
 export declare function pruneWorklogArchives(path: string, maxArchives: number): void;
 /**
  * Conservatively rotate a stable snapshot. A changed size/mtime/inode aborts
@@ -20,6 +26,6 @@ export declare function pruneWorklogArchives(path: string, maxArchives: number):
 export declare function rotateWorklog(path: string, policy?: WorklogPolicy, deps?: {
     now?: () => Date;
     beforeCommit?: () => void;
-    /** Deterministic test hook for the rename→link commit window. */
+    /** Deterministic test hook after the full archive is published. */
     afterArchiveRename?: () => void;
 }): WorklogRotation;

package/dist/worklog.js CHANGED Viewed

@@ -1,10 +1,59 @@
-import { existsSync, linkSync, readdirSync, readFileSync, renameSync, rmSync, statSync, } from 'node:fs';
+import { closeSync, constants, existsSync, fstatSync, linkSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, unlinkSync, } from 'node:fs';
+import { createHash } from 'node:crypto';
 import { basename, dirname, join } from 'node:path';
-import { randomUUID } from 'node:crypto';
 import { replaceFileAtomically } from './atomic-file.js';
-const ARCHIVE_RE = /^WORKLOG\.\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z(?:\.\d+)?\.md$/;
+const ARCHIVE_RE = /^WORKLOG\.(\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}\.\d{3}Z)(?:\.(\d+))?\.md$/;
+export const WORKLOG_ARCHIVE_DIR = 'WORKLOG.archives';
+const entryStat = (path) => {
+    try {
+        return lstatSync(path);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+};
+const requireRegularFile = (path, label) => {
+    const stat = entryStat(path);
+    if (!stat)
+        throw new Error(`${label} disappeared before it could be preserved`);
+    if (!stat.isFile()) {
+        const kind = stat.isSymbolicLink() ? 'symbolic link' : 'non-regular file';
+        throw new Error(`refusing worklog rotation: ${label} is a ${kind}`);
+    }
+    return stat;
+};
+const sameInode = (left, right) => left.dev === right.dev && left.ino === right.ino;
+const sameSnapshot = (left, right) => sameInode(left, right) && left.size === right.size
+    && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs;
+const sha256 = (content) => createHash('sha256').update(content).digest('hex');
+/** Remove a newly published duplicate only while the source inode is still available. */
+const cleanupDuplicateLink = (source, target, expected) => {
+    try {
+        const sourceStat = entryStat(source);
+        const targetStat = entryStat(target);
+        if (sourceStat && targetStat && sameInode(expected, sourceStat) && sameInode(expected, targetStat))
+            unlinkSync(target);
+    }
+    catch { /* cleanup is best-effort; preserve the primary failure */ }
+};
+const validateArchiveBoundary = (path) => {
+    const archiveDir = join(dirname(path), WORKLOG_ARCHIVE_DIR);
+    const stat = entryStat(archiveDir);
+    if (stat && !stat.isDirectory()) {
+        const kind = stat.isSymbolicLink() ? 'symbolic link' : 'non-directory';
+        throw new Error(`refusing worklog retention: ${WORKLOG_ARCHIVE_DIR} is a ${kind}`);
+    }
+    return stat;
+};
 export function inspectWorklog(path, policy) {
-    const bytes = existsSync(path) ? statSync(path).size : 0;
+    const stat = entryStat(path);
+    if (policy && stat && !stat.isFile()) {
+        const kind = stat.isSymbolicLink() ? 'symbolic link' : 'non-regular file';
+        throw new Error(`refusing worklog rotation: WORKLOG.md is a ${kind}`);
+    }
+    const bytes = stat?.isFile() ? stat.size : 0;
     return {
         enabled: policy !== undefined,
         bytes,
@@ -22,11 +71,70 @@ const archiveName = (path, now, collision) => {
     const stamp = now.toISOString().replace(/:/g, '-');
     return join(dirname(path), `WORKLOG.${stamp}${collision ? `.${collision}` : ''}.md`);
 };
+/**
+ * Keep a bounded set of recent archives beside WORKLOG.md without deleting
+ * history. Older archives move atomically-by-link into WORKLOG.archives/.
+ * The legacy name remains exported for source compatibility.
+ */
 export function pruneWorklogArchives(path, maxArchives) {
     const dir = dirname(path);
-    const archives = readdirSync(dir).filter(name => ARCHIVE_RE.test(name)).sort().reverse();
-    for (const old of archives.slice(maxArchives))
-        rmSync(join(dir, old), { force: true });
+    const archives = readdirSync(dir).filter(name => ARCHIVE_RE.test(name)).sort((a, b) => {
+        const left = ARCHIVE_RE.exec(a);
+        const right = ARCHIVE_RE.exec(b);
+        return left[1].localeCompare(right[1])
+            || Number(left[2] ?? 0) - Number(right[2] ?? 0);
+    }).reverse();
+    const older = archives.slice(maxArchives);
+    if (!older.length)
+        return;
+    const archiveDir = join(dir, WORKLOG_ARCHIVE_DIR);
+    let boundary = validateArchiveBoundary(path);
+    if (!boundary) {
+        try {
+            mkdirSync(archiveDir, { mode: 0o700 });
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
+        boundary = validateArchiveBoundary(path);
+    }
+    if (!boundary)
+        throw new Error(`refusing worklog retention: ${WORKLOG_ARCHIVE_DIR} is unavailable`);
+    for (const old of older) {
+        const source = join(dir, old);
+        const sourceBefore = requireRegularFile(source, `archive ${old}`);
+        let collision = 0;
+        for (;;) {
+            const name = collision === 0 ? old : old.replace(/\.md$/, `.${collision}.md`);
+            const target = join(archiveDir, name);
+            try {
+                const currentBoundary = validateArchiveBoundary(path);
+                if (!currentBoundary || !sameInode(boundary, currentBoundary))
+                    throw new Error(`refusing worklog retention: ${WORKLOG_ARCHIVE_DIR} changed`);
+                // Link then unlink: a crash can leave a duplicate, never lose the only
+                // archive. EEXIST chooses a new name rather than overwriting history.
+                linkSync(source, target);
+                const published = requireRegularFile(target, `cold archive ${name}`);
+                const sourceCurrent = requireRegularFile(source, `archive ${old}`);
+                const finalBoundary = validateArchiveBoundary(path);
+                if (!sameInode(sourceBefore, published) || !sameInode(sourceBefore, sourceCurrent)
+                    || !finalBoundary || !sameInode(boundary, finalBoundary)) {
+                    throw new Error(`refusing worklog retention: archive boundary changed during move`);
+                }
+                unlinkSync(source);
+                break;
+            }
+            catch (error) {
+                if (error.code === 'EEXIST') {
+                    collision++;
+                    continue;
+                }
+                cleanupDuplicateLink(source, target, sourceBefore);
+                throw error;
+            }
+        }
+    }
 }
 /**
  * Conservatively rotate a stable snapshot. A changed size/mtime/inode aborts
@@ -36,57 +144,101 @@ export function rotateWorklog(path, policy, deps = {}) {
     const inspection = inspectWorklog(path, policy);
     if (!policy || !inspection.overLimit)
         return { rotated: false, beforeBytes: inspection.bytes, afterBytes: inspection.bytes };
-    const before = statSync(path);
-    const content = readFileSync(path);
+    // Refuse a pre-existing symlink/non-directory even before publishing an
+    // archive or replacing the live path. Cold retention must remain inside the
+    // role's state boundary.
+    validateArchiveBoundary(path);
+    const pathBeforeOpen = requireRegularFile(path, 'WORKLOG.md');
+    let fd;
+    let before;
+    let content;
+    try {
+        fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        before = fstatSync(fd);
+        if (!before.isFile() || !sameInode(pathBeforeOpen, before))
+            throw new Error('refusing worklog rotation: WORKLOG.md changed while opening');
+        content = readFileSync(fd);
+        const afterRead = fstatSync(fd);
+        if (!sameSnapshot(before, afterRead))
+            return {
+                rotated: false, deferred: true,
+                beforeBytes: before.size, afterBytes: afterRead.size,
+            };
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
     const start = safeTailStart(content, policy.keep_tail_kb * 1024);
     const tail = content.subarray(start);
+    const tailStartsMidLine = start > 0 && content[start - 1] !== 0x0a;
     deps.beforeCommit?.();
-    const current = statSync(path);
-    if (current.ino !== before.ino || current.size !== before.size
-        || current.mtimeMs !== before.mtimeMs) {
+    const current = requireRegularFile(path, 'WORKLOG.md');
+    if (!sameSnapshot(current, before)) {
         return {
             rotated: false, deferred: true,
             beforeBytes: before.size, afterBytes: current.size,
         };
     }
-    let collision = 0;
-    let archivePath = archiveName(path, deps.now?.() ?? new Date(), collision);
-    while (existsSync(archivePath))
-        archivePath = archiveName(path, deps.now?.() ?? new Date(), ++collision);
-    // Prepare the intended tail before moving the live inode. replaceFileAtomically
-    // gives us a fully written/fsynced inode; hard-linking it below publishes that
-    // inode without ever overwriting a path a concurrent appender may create.
-    const preparedTail = join(dirname(path), `.${basename(path)}.${randomUUID()}.rotate`);
-    replaceFileAtomically(preparedTail, tail.toString('utf8'), before.mode & 0o777);
-    try {
-        // Linearization point: the complete original inode becomes the archive.
-        // Writers that opened before this rename keep appending to that inode, so
-        // their acknowledged bytes remain in the archive even after the move.
-        renameSync(path, archivePath);
-        deps.afterArchiveRename?.();
+    const rotatedAt = deps.now?.() ?? new Date();
+    let archivePath = '';
+    // Publish the complete original inode under a collision-safe archive name.
+    // link(2) is create-without-overwrite; concurrent appenders holding the old
+    // inode continue into the archive after the live path is replaced.
+    for (let collision = 0;; collision++) {
+        archivePath = archiveName(path, rotatedAt, collision);
         try {
-            // Atomic create-without-overwrite. If a writer opened the missing path in
-            // the rename→link window, it created the new live file; EEXIST means leave
-            // that file untouched. The intended tail remains recoverable in the full
-            // archive, and every concurrent suffix remains in the writer-created live.
-            linkSync(preparedTail, path);
+            linkSync(path, archivePath);
+            const published = requireRegularFile(archivePath, `archive ${basename(archivePath)}`);
+            if (!sameInode(before, published)) {
+                try {
+                    unlinkSync(archivePath);
+                }
+                catch { /* keep the primary safety failure */ }
+                throw new Error('refusing worklog rotation: published archive is not the inspected file');
+            }
+            break;
         }
-        catch (e) {
-            if (e.code !== 'EEXIST')
-                throw e;
+        catch (error) {
+            if (error.code === 'EEXIST')
+                continue;
+            throw error;
         }
     }
-    finally {
-        rmSync(preparedTail, { force: true });
+    try {
+        deps.afterArchiveRename?.();
+        const liveBeforeReplace = requireRegularFile(path, 'WORKLOG.md');
+        if (!sameInode(before, liveBeforeReplace))
+            throw new Error('refusing worklog rotation: WORKLOG.md changed after archive publication');
+        // The helper writes and fsyncs a same-directory temp, atomically renames it
+        // over the live path, then fsyncs the directory. WORKLOG.md is never absent.
+        replaceFileAtomically(path, tail.toString('utf8'), before.mode & 0o777);
+    }
+    catch (error) {
+        // If the inspected inode is still the live file, the archive is only a
+        // duplicate artifact. Remove it best-effort and preserve the real error.
+        // If the live path changed, retain the archive because it may be the only
+        // remaining link to the inspected history.
+        cleanupDuplicateLink(path, archivePath, before);
+        throw error;
     }
-    const liveBytes = existsSync(path) ? statSync(path).size : 0;
+    const archiveContent = readFileSync(archivePath);
+    const liveContent = existsSync(path) ? readFileSync(path) : Buffer.alloc(0);
+    const liveBytes = liveContent.length;
     const status = {
         schemaVersion: 1,
-        rotatedAt: (deps.now?.() ?? new Date()).toISOString(),
+        rotatedAt: rotatedAt.toISOString(),
         beforeBytes: before.size,
         afterBytes: liveBytes,
         archive: basename(archivePath),
+        archiveBytes: archiveContent.length,
+        archiveSha256: sha256(archiveContent),
+        liveSha256: sha256(liveContent),
         archiveContainsFullSnapshot: true,
+        tailOmittedPrefixBytes: start,
+        ...(tailStartsMidLine ? { tailStartsMidLine: true } : {}),
+        olderArchives: WORKLOG_ARCHIVE_DIR,
+        recentArchiveLimit: policy.max_archives,
     };
     replaceFileAtomically(join(dirname(path), '.worklog-rotation.json'), `${JSON.stringify(status, null, 2)}\n`);
     pruneWorklogArchives(path, policy.max_archives);

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.17.9",
+  "version": "0.17.11",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux or ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",