@ours.network/fleet 0.18.0-nightly.5 → 0.18.0

package/dist/loops/state.js

@@ -100,6 +100,9 @@ export class ScheduledLoopStateStore {
             if (old?.definitionHash === definition.definitionHash) {
                 next[definition.name] = {
                     ...old, promptHash: definition.promptHash, enabled: definition.enabled,
+                    // A file written before this field existed restores as undefined; an
+                    // unreported gap is absent, not lost, so normalize rather than trust.
+                    missedGap: old.missedGap ?? null,
                 };
             }
             else {
@@ -119,6 +122,7 @@ export class ScheduledLoopStateStore {
                     activeRunId: old?.activeRunId ?? null,
                     counts: old?.counts ?? zeroCounts(), lastError: old?.lastError ?? null,
                     operatorDisabled: old?.operatorDisabled ?? false,
+                    missedGap: old?.missedGap ?? null,
                 };
             }
             if (recoverActive && next[definition.name].activeRunId) {

package/dist/model-env.d.ts

@@ -0,0 +1,71 @@
+import type { ResolvedRole } from './config.js';
+/**
+ * Which environment variable a harness reads to pin the model it RUNS.
+ *
+ * This is not a convenience: for `claude-code` it is the only channel that
+ * reaches the ACP backend at all. `buildLaunch` (tmux) passes `--model`, but
+ * `buildAcpLaunch` launches the ACP adapter with no model argument, and that
+ * adapter resolves its model in this order — ANTHROPIC_MODEL, then
+ * `settings.model`, then a resumed session's live model, then its first
+ * catalogue entry. A role's declared model was therefore invisible to every
+ * ACP role, and a fleet-wide `defaults.env.ANTHROPIC_MODEL` silently outranked
+ * an explicitly requested one.
+ */
+export declare const MODEL_ENV_BY_HARNESS: Readonly<Record<string, string>>;
+/** The model-pin variable for a harness, or undefined if it pins no model by env. */
+export declare function modelEnvVar(harness: string | undefined): string | undefined;
+export interface RoleModelEnvInput {
+    harness: string;
+    /** Already resolved by `resolveRoleModel` — may come from the fleet default. */
+    model: string | undefined;
+    /** True when the role (or `--model`) named a model, including `model: null`. */
+    modelWasExplicit: boolean;
+    defaultsEnv?: Record<string, string>;
+    roleEnv?: Record<string, string>;
+    authProxyBaseUrl?: string;
+}
+export interface RoleModelEnv {
+    env: Record<string, string>;
+    /**
+     * The model the harness will actually run. Equal to `env[pin]` for a harness
+     * that pins by env, so anything reporting this value reports the runtime.
+     */
+    model: string | undefined;
+}
+/**
+ * Resolve a role's environment and its runtime model TOGETHER, so the two can
+ * never disagree.
+ *
+ * Precedence, highest first:
+ *   1. an explicit `model:` / `--model` on the role
+ *   2. the role's own `env:` pin
+ *   3. the fleet `defaults.model`
+ *   4. the fleet `defaults.env` pin
+ *
+ * Inheriting the fleet default remains correct when the role names no model
+ * (2, 3, 4); an explicitly named one wins (1). Where both are explicit and they
+ * disagree, there is no defensible winner, so this refuses rather than picking
+ * one silently — the silence is what let a day of "Fable" work run on Opus.
+ *
+ * `model: null` explicitly asks for no fleet-chosen model, so it also clears an
+ * inherited pin instead of leaving one in place to act as a hidden default.
+ */
+export declare function resolveRoleModelEnv(input: RoleModelEnvInput, describe?: (message: string) => Error): RoleModelEnv;
+/**
+ * The model a role will actually run, read back from the environment it was
+ * resolved with. Use this wherever a model is reported to a human.
+ */
+export declare function effectiveRoleModel(role: ResolvedRole): string | undefined;
+/**
+ * Move a role's env pin onto a new model. Anything that changes the model a
+ * role runs after resolution — model-chain recovery is the live example — must
+ * go through this, or it changes only the label.
+ */
+export declare function repinModelEnv(role: ResolvedRole, model: string | undefined): Record<string, string> | undefined;
+/**
+ * Last line of defence, at the exact point a child's environment is composed:
+ * refuse to launch a role whose child would run a model other than the one the
+ * role declares and the banner reports. A spawn that cannot keep those two in
+ * agreement must fail loudly, not start and be believed.
+ */
+export declare function assertModelPinReachesChild(role: ResolvedRole, childEnv: Record<string, string | undefined>): void;

package/dist/model-env.js

@@ -0,0 +1,106 @@
+/**
+ * Which environment variable a harness reads to pin the model it RUNS.
+ *
+ * This is not a convenience: for `claude-code` it is the only channel that
+ * reaches the ACP backend at all. `buildLaunch` (tmux) passes `--model`, but
+ * `buildAcpLaunch` launches the ACP adapter with no model argument, and that
+ * adapter resolves its model in this order — ANTHROPIC_MODEL, then
+ * `settings.model`, then a resumed session's live model, then its first
+ * catalogue entry. A role's declared model was therefore invisible to every
+ * ACP role, and a fleet-wide `defaults.env.ANTHROPIC_MODEL` silently outranked
+ * an explicitly requested one.
+ */
+export const MODEL_ENV_BY_HARNESS = {
+    'claude-code': 'ANTHROPIC_MODEL',
+};
+/** The model-pin variable for a harness, or undefined if it pins no model by env. */
+export function modelEnvVar(harness) {
+    return harness === undefined ? undefined : MODEL_ENV_BY_HARNESS[harness];
+}
+/**
+ * Resolve a role's environment and its runtime model TOGETHER, so the two can
+ * never disagree.
+ *
+ * Precedence, highest first:
+ *   1. an explicit `model:` / `--model` on the role
+ *   2. the role's own `env:` pin
+ *   3. the fleet `defaults.model`
+ *   4. the fleet `defaults.env` pin
+ *
+ * Inheriting the fleet default remains correct when the role names no model
+ * (2, 3, 4); an explicitly named one wins (1). Where both are explicit and they
+ * disagree, there is no defensible winner, so this refuses rather than picking
+ * one silently — the silence is what let a day of "Fable" work run on Opus.
+ *
+ * `model: null` explicitly asks for no fleet-chosen model, so it also clears an
+ * inherited pin instead of leaving one in place to act as a hidden default.
+ */
+export function resolveRoleModelEnv(input, describe = message => new Error(message)) {
+    const env = {
+        ...(input.defaultsEnv ?? {}),
+        ...(input.roleEnv ?? {}),
+        ...(input.authProxyBaseUrl ? { ANTHROPIC_BASE_URL: input.authProxyBaseUrl } : {}),
+    };
+    const pin = modelEnvVar(input.harness);
+    if (!pin)
+        return { env, model: input.model };
+    const rolePin = input.roleEnv?.[pin];
+    if (input.modelWasExplicit) {
+        if (rolePin !== undefined && rolePin !== input.model)
+            throw describe(`model '${input.model ?? '(none)'}' contradicts env.${pin} '${rolePin}'; `
+                + `remove one — ${pin} is what the harness actually runs`);
+        if (input.model === undefined)
+            delete env[pin];
+        else
+            env[pin] = input.model;
+        return { env, model: input.model };
+    }
+    // Not explicit: a role-level pin is the most specific thing said about this
+    // role, so it decides — and the reported model follows it.
+    if (rolePin !== undefined)
+        return { env, model: rolePin };
+    if (input.model !== undefined)
+        env[pin] = input.model;
+    return { env, model: input.model ?? env[pin] };
+}
+/**
+ * The model a role will actually run, read back from the environment it was
+ * resolved with. Use this wherever a model is reported to a human.
+ */
+export function effectiveRoleModel(role) {
+    const pin = modelEnvVar(role.harness);
+    return (pin ? role.env?.[pin] : undefined) ?? role.model;
+}
+/**
+ * Move a role's env pin onto a new model. Anything that changes the model a
+ * role runs after resolution — model-chain recovery is the live example — must
+ * go through this, or it changes only the label.
+ */
+export function repinModelEnv(role, model) {
+    const pin = modelEnvVar(role.harness);
+    if (!pin)
+        return role.env;
+    const env = { ...(role.env ?? {}) };
+    if (model === undefined)
+        delete env[pin];
+    else
+        env[pin] = model;
+    return Object.keys(env).length ? env : undefined;
+}
+/**
+ * Last line of defence, at the exact point a child's environment is composed:
+ * refuse to launch a role whose child would run a model other than the one the
+ * role declares and the banner reports. A spawn that cannot keep those two in
+ * agreement must fail loudly, not start and be believed.
+ */
+export function assertModelPinReachesChild(role, childEnv) {
+    const pin = modelEnvVar(role.harness);
+    if (!pin || role.model === undefined)
+        return;
+    const actual = childEnv[pin];
+    if (actual === role.model)
+        return;
+    throw new Error(`[${role.name}] refusing to launch: role model is '${role.model}' but the child's `
+        + `${pin} is ${actual === undefined ? 'unset' : `'${actual}'`} — the session would run a `
+        + 'different model than the one reported');
+}

package/dist/monitor.js

@@ -42,7 +42,7 @@ class AuthError extends Error {
 }
 /** Path to the daemon config the MCP client uses: OURS_CONFIG ?? real ~/.ours/config.json. */
 const daemonConfigPath = (env) => env.OURS_CONFIG ?? join(homedir(), '.ours', 'config.json');
-/** Preserve the daemon's legacy env integer semantics: parseInt, invalid → absent. */
+/** Match ours-mcp's env integer semantics: parseInt, invalid → absent. */
 function envInt(env, name) {
     const raw = env[name];
     if (raw === undefined)

package/dist/ops.js

@@ -16,7 +16,7 @@ import { realExec } from './exec.js';
 /** Materialize a role's state dir from config: briefing + markers. Returns the dir. */
 export function applyRole(role, opts = {}) {
     const adapter = getAdapter(role.harness);
-    const errs = adapter.validateOptions(role.harness_options);
+    const errs = adapter.validateOptions(role.harness_options, role);
     if (errs.length)
         throw new Error(`role '${role.name}': ` + errs.map(e => `${e.path}: ${e.message}`).join('; '));
     const dir = agentDir(role.name, opts.temp === true);

package/dist/owner-channel/attachments.d.ts

@@ -1,6 +1,4 @@
-import { type FileHandle } from 'node:fs/promises';
 import type { OwnerAttachmentConfig } from '../config.js';
-import type { OursIncomingFile, OursRetrievedFiles } from './ours-client.js';
 export interface AttachmentReplyRef {
     wire_id: string;
     sentence?: number;
@@ -44,14 +42,8 @@ export interface AdmittedAttachment {
     kind: 'file' | 'voice_message';
     transcription?: Omit<VoiceTranscription, 'audioPath'>;
 }
-/**
- * Admit the daemon's file listing. The rows are typed now, but every field is
- * still re-validated here: sender CID, wire id, sizes and ids all cross the
- * trust boundary and decide routing, so a daemon-side shape change must drop a
- * row rather than produce a half-built attachment.
- */
-export declare function parseIncomingAttachments(raw: OursIncomingFile[] | undefined): IncomingAttachment[];
-export declare function parseRetrievedAttachments(raw: OursRetrievedFiles | undefined, expected: IncomingAttachment[], recovered?: boolean): RetrievedAttachment[];
+export declare function parseIncomingAttachments(raw: unknown): IncomingAttachment[];
+export declare function parseRetrievedAttachments(raw: unknown, expected: IncomingAttachment[], recovered?: boolean): RetrievedAttachment[];
 export declare function validateAttachmentSelection(files: IncomingAttachment[], config: OwnerAttachmentConfig): string | undefined;
 /**
  * Managed-agent -> owner egress limits. This intentionally does not consult
@@ -62,21 +54,6 @@ export declare function prepareAttachmentDirectory(root: string, requestId: stri
 export declare function admitAttachments(files: RetrievedAttachment[], dir: string, config: OwnerAttachmentConfig, options?: {
     mimePolicy?: 'strict' | 'report-only';
 }): Promise<AdmittedAttachment[]>;
-/** Injectable short-write seam, so partial writes are provably handled. */
-export interface AttachmentWriteDeps {
-    write?(handle: FileHandle, bytes: Uint8Array, offset: number): Promise<number>;
-}
-/**
- * Land crash-recovered file bytes inside an already-prepared request directory.
- *
- * The MCP path handed the daemon a `dest_path` and let its connector write the
- * file. Nothing writes on our behalf any more, so this owns both halves of that
- * contract: the destination is DERIVED from a validated wire id inside `dir`
- * rather than accepted from a caller, and the file is published by link-after-
- * fsync, so a crash or a short write can never leave a partial file where the
- * admission step would read it as complete.
- */
-export declare function writeRecoveredAttachment(dir: string, wireId: string, bytes: Uint8Array, deps?: AttachmentWriteDeps): Promise<string>;
 export declare function recoveredAttachment(file: IncomingAttachment, path: string): Promise<RetrievedAttachment>;
 export declare function removeRequestDirectory(path: string): Promise<void>;
 export declare function cleanupAttachmentRoot(root: string, now: number, retentionMs: number, limit?: number): Promise<number>;

package/dist/owner-channel/attachments.js

@@ -6,14 +6,8 @@ import { replaceFileAtomically } from '../atomic-file.js';
 const WIRE = /^[A-Fa-f0-9]{64}$/;
 const CID = /^[A-Fa-f0-9]{64}$/;
 const MAX_PENDING_REQUESTS = 32;
-/**
- * Admit the daemon's file listing. The rows are typed now, but every field is
- * still re-validated here: sender CID, wire id, sizes and ids all cross the
- * trust boundary and decide routing, so a daemon-side shape change must drop a
- * row rather than produce a half-built attachment.
- */
 export function parseIncomingAttachments(raw) {
-    const values = raw;
+    const values = raw?.files;
     if (!Array.isArray(values))
         return [];
     const out = [];
@@ -46,12 +40,12 @@ export function parseIncomingAttachments(raw) {
 export function parseRetrievedAttachments(raw, expected, recovered = false) {
     const values = raw?.files;
     if (!Array.isArray(values) || values.length !== expected.length)
-        throw new Error('the ours daemon returned an incomplete selected attachment set');
+        throw new Error('ours-mcp returned an incomplete selected attachment set');
     const byWire = new Map(expected.map(file => [file.wireId, file]));
     const out = [];
     for (const value of values) {
         if (!value || typeof value !== 'object')
-            throw new Error('the ours daemon returned invalid attachment metadata');
+            throw new Error('ours-mcp returned invalid attachment metadata');
         const file = value;
         const wireId = String(file.wire_id ?? '');
         const listed = byWire.get(wireId);
@@ -64,7 +58,7 @@ export function parseRetrievedAttachments(raw, expected, recovered = false) {
             || !Number.isSafeInteger(size) || size !== listed.size || mime !== listed.mime
             || kind !== listed.kind || !/^[a-f0-9]{64}$/.test(sha256)
             || typeof file.path !== 'string' || !file.path)
-            throw new Error('selected attachment provenance or integrity metadata mismatched');
+            throw new Error('ours-mcp selected attachment provenance or integrity metadata mismatched');
         out.push({
             ...listed, filename: safeField(file.filename, 255), mime, size, path: file.path, sha256, kind,
             ...(recovered ? {} : parseTranscription(file.transcription, wireId)),
@@ -72,7 +66,7 @@ export function parseRetrievedAttachments(raw, expected, recovered = false) {
         byWire.delete(wireId);
     }
     if (byWire.size)
-        throw new Error('the ours daemon omitted a selected attachment');
+        throw new Error('ours-mcp omitted a selected attachment');
     return out;
 }
 function parseTranscription(value, wireId) {
@@ -225,56 +219,6 @@ export async function admitAttachments(files, dir, config, options = {}) {
     }
     return admitted;
 }
-/**
- * Land crash-recovered file bytes inside an already-prepared request directory.
- *
- * The MCP path handed the daemon a `dest_path` and let its connector write the
- * file. Nothing writes on our behalf any more, so this owns both halves of that
- * contract: the destination is DERIVED from a validated wire id inside `dir`
- * rather than accepted from a caller, and the file is published by link-after-
- * fsync, so a crash or a short write can never leave a partial file where the
- * admission step would read it as complete.
- */
-export async function writeRecoveredAttachment(dir, wireId, bytes, deps = {}) {
-    if (!WIRE.test(wireId))
-        throw new Error('recovered attachment wire id is not a 64-hex value');
-    const dirStat = await lstat(dir);
-    if (!dirStat.isDirectory() || dirStat.isSymbolicLink())
-        throw new Error('recovered attachment directory is not a safe directory');
-    const write = deps.write
-        ?? ((handle, buffer, offset) => handle.write(buffer, offset, buffer.length - offset)
-            .then(result => result.bytesWritten));
-    const finalPath = join(dir, `.recovered-${wireId}-${randomUUID()}`);
-    const tmp = join(dir, `.${basename(finalPath)}.${randomUUID()}.tmp`);
-    const handle = await open(tmp, 'wx', 0o600);
-    try {
-        for (let written = 0; written < bytes.length;) {
-            const advanced = await write(handle, bytes, written);
-            if (advanced <= 0)
-                throw new Error(`recovered attachment write made no progress at byte ${written}`);
-            written += advanced;
-        }
-        await handle.sync();
-    }
-    catch (error) {
-        await handle.close().catch(() => undefined);
-        await rm(tmp, { force: true });
-        throw error;
-    }
-    await handle.close();
-    // link publishes the finished bytes under a name that never existed in a
-    // partial state; the temp is only ever removed after it succeeded.
-    try {
-        await link(tmp, finalPath);
-    }
-    catch (error) {
-        await rm(tmp, { force: true });
-        throw error;
-    }
-    await rm(tmp, { force: true });
-    await chmod(finalPath, 0o600);
-    return finalPath;
-}
 export async function recoveredAttachment(file, path) {
     const stat = await lstat(path);
     if (!stat.isFile() || stat.isSymbolicLink() || stat.size !== file.size)

package/dist/owner-channel/channel.d.ts

@@ -1,8 +1,10 @@
+import { type ChildProcessWithoutNullStreams } from 'node:child_process';
 import { type OwnerChannelConfig } from '../config.js';
+import { type FetchLike } from '../monitor.js';
 import { type SessionHandle } from '../session/types.js';
 import { type OwnerFleetOps } from './commands.js';
 import type { ManagedFleetSpawnResult } from '../fleet-proxy.js';
-import { type OursOps } from './ours-client.js';
+import { type OursToolClient } from './mcp.js';
 import { type OwnerUpdatePhase } from './notices.js';
 import { type OwnerEntry } from './state.js';
 import { type OwnerTaskPhase } from './tasks.js';
@@ -15,8 +17,15 @@ export interface OwnerChannelOptions {
     session: SessionHandle;
     stateDir: string;
     env?: Record<string, string>;
+    command?: string;
     log(line: string): void;
-    client?: OursOps;
+    client?: OursToolClient;
+    /** Legacy child-process test seam; production uses the direct notification API. */
+    watch?: (identity: string) => ChildProcessWithoutNullStreams;
+    /** Test seam for the production direct notification long-poll. */
+    watchFetch?: FetchLike;
+    /** Test seam for the long-poll stall bound; production uses OWNER_WATCH_STALL_MS. */
+    watchStallMs?: number;
     /** Test seam; production uses the detached ours-fleet CLI (`fleetCliOps`). */
     fleet?: OwnerFleetOps;
     /** Forwarded to fleet CLI invocations spawned for owner commands. */
@@ -109,13 +118,7 @@ export type { OwnerUpdatePhase } from './notices.js';
 export interface OwnerContact {
     cid: string;
     name: string;
-    /** Structural, from which daemon collection the row came: established or pending. */
     status: string;
-    /**
-     * Retained for the `ours-fleet owner contact list` column. The daemon's typed
-     * contact view has no such field, so it is always absent; it is not inferred
-     * from anything a contact controls.
-     */
     kind?: string;
     human?: {
         cid?: string;
@@ -152,6 +155,7 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private readonly commentsBaseline;
     private commentsEnabled;
     private stopping;
+    private watchProcess?;
     private watchTask?;
     private watchAbort?;
     private drainTask?;
@@ -170,12 +174,6 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     manage(request: OwnerChannelManagementRequest): Promise<OwnerChannelManagementResult>;
     notifyFleetSpawn(event: ManagedFleetSpawnResult): Promise<void>;
     private manageNow;
-    /**
-     * The daemon reports established contacts and pending introductions as two
-     * separate collections, so the status is structural rather than a word parsed
-     * out of a rendered line. Nothing here can be spoofed by a contact's own
-     * display name.
-     */
     private contacts;
     private contact;
     private assertCid;
@@ -240,6 +238,16 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private warnOwnerOfUnauthorizedSender;
     private effectiveOwners;
     private authorizationIntegrity;
+    /**
+     * Report what the session actually did with the prompt, not what the config
+     * asked for. `interrupt: true` used to be reported as "your request
+     * interrupted the previous task" unconditionally; the session now answers
+     * whether anything was cancelled, whether the request is queued behind
+     * earlier prompts, or whether it is held until the current task reaches a
+     * safe stopping point. Backends that report no delivery state keep the old
+     * queuedBehind-based wording.
+     */
+    private acceptanceNotice;
     private complete;
     private commentsState;
     /** Model-authored commentary only; raw protocol/tool data never reaches here. */
@@ -259,12 +267,15 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private progressPhase;
     private watchLoop;
     /**
-     * `recovered` distinguishes a first-ever start from unreadable persisted
-     * diagnostics. Notification correctness does not depend on this state: every
-     * establishment drains and then replays SDK hints from offset zero.
+     * `recovered` distinguishes a first-ever start (no state, nothing lost) from a
+     * cursor we HAD and can no longer read. Only the latter is a recovery, and the
+     * caller needs to know because the reason it reports is the only evidence a
+     * durable cursor was ever lost.
      */
     private readWatchState;
     private writeWatchState;
+    /** Compatibility path for injected child-process tests; production is direct. */
+    private legacyWatchLoop;
     private errorText;
     private logError;
 }