@ours.network/fleet 0.18.1 → 0.19.0-nightly.2

package/dist/owner-channel/attachments.js

@@ -6,8 +6,14 @@ import { replaceFileAtomically } from '../atomic-file.js';
 const WIRE = /^[A-Fa-f0-9]{64}$/;
 const CID = /^[A-Fa-f0-9]{64}$/;
 const MAX_PENDING_REQUESTS = 32;
+/**
+ * Admit the daemon's file listing. The rows are typed now, but every field is
+ * still re-validated here: sender CID, wire id, sizes and ids all cross the
+ * trust boundary and decide routing, so a daemon-side shape change must drop a
+ * row rather than produce a half-built attachment.
+ */
 export function parseIncomingAttachments(raw) {
-    const values = raw?.files;
+    const values = raw;
     if (!Array.isArray(values))
         return [];
     const out = [];
@@ -40,12 +46,12 @@ export function parseIncomingAttachments(raw) {
 export function parseRetrievedAttachments(raw, expected, recovered = false) {
     const values = raw?.files;
     if (!Array.isArray(values) || values.length !== expected.length)
-        throw new Error('ours-mcp returned an incomplete selected attachment set');
+        throw new Error('the ours daemon returned an incomplete selected attachment set');
     const byWire = new Map(expected.map(file => [file.wireId, file]));
     const out = [];
     for (const value of values) {
         if (!value || typeof value !== 'object')
-            throw new Error('ours-mcp returned invalid attachment metadata');
+            throw new Error('the ours daemon returned invalid attachment metadata');
         const file = value;
         const wireId = String(file.wire_id ?? '');
         const listed = byWire.get(wireId);
@@ -58,7 +64,7 @@ export function parseRetrievedAttachments(raw, expected, recovered = false) {
             || !Number.isSafeInteger(size) || size !== listed.size || mime !== listed.mime
             || kind !== listed.kind || !/^[a-f0-9]{64}$/.test(sha256)
             || typeof file.path !== 'string' || !file.path)
-            throw new Error('ours-mcp selected attachment provenance or integrity metadata mismatched');
+            throw new Error('selected attachment provenance or integrity metadata mismatched');
         out.push({
             ...listed, filename: safeField(file.filename, 255), mime, size, path: file.path, sha256, kind,
             ...(recovered ? {} : parseTranscription(file.transcription, wireId)),
@@ -66,7 +72,7 @@ export function parseRetrievedAttachments(raw, expected, recovered = false) {
         byWire.delete(wireId);
     }
     if (byWire.size)
-        throw new Error('ours-mcp omitted a selected attachment');
+        throw new Error('the ours daemon omitted a selected attachment');
     return out;
 }
 function parseTranscription(value, wireId) {
@@ -219,6 +225,56 @@ export async function admitAttachments(files, dir, config, options = {}) {
     }
     return admitted;
 }
+/**
+ * Land crash-recovered file bytes inside an already-prepared request directory.
+ *
+ * The MCP path handed the daemon a `dest_path` and let its connector write the
+ * file. Nothing writes on our behalf any more, so this owns both halves of that
+ * contract: the destination is DERIVED from a validated wire id inside `dir`
+ * rather than accepted from a caller, and the file is published by link-after-
+ * fsync, so a crash or a short write can never leave a partial file where the
+ * admission step would read it as complete.
+ */
+export async function writeRecoveredAttachment(dir, wireId, bytes, deps = {}) {
+    if (!WIRE.test(wireId))
+        throw new Error('recovered attachment wire id is not a 64-hex value');
+    const dirStat = await lstat(dir);
+    if (!dirStat.isDirectory() || dirStat.isSymbolicLink())
+        throw new Error('recovered attachment directory is not a safe directory');
+    const write = deps.write
+        ?? ((handle, buffer, offset) => handle.write(buffer, offset, buffer.length - offset)
+            .then(result => result.bytesWritten));
+    const finalPath = join(dir, `.recovered-${wireId}-${randomUUID()}`);
+    const tmp = join(dir, `.${basename(finalPath)}.${randomUUID()}.tmp`);
+    const handle = await open(tmp, 'wx', 0o600);
+    try {
+        for (let written = 0; written < bytes.length;) {
+            const advanced = await write(handle, bytes, written);
+            if (advanced <= 0)
+                throw new Error(`recovered attachment write made no progress at byte ${written}`);
+            written += advanced;
+        }
+        await handle.sync();
+    }
+    catch (error) {
+        await handle.close().catch(() => undefined);
+        await rm(tmp, { force: true });
+        throw error;
+    }
+    await handle.close();
+    // link publishes the finished bytes under a name that never existed in a
+    // partial state; the temp is only ever removed after it succeeded.
+    try {
+        await link(tmp, finalPath);
+    }
+    catch (error) {
+        await rm(tmp, { force: true });
+        throw error;
+    }
+    await rm(tmp, { force: true });
+    await chmod(finalPath, 0o600);
+    return finalPath;
+}
 export async function recoveredAttachment(file, path) {
     const stat = await lstat(path);
     if (!stat.isFile() || stat.isSymbolicLink() || stat.size !== file.size)

package/dist/owner-channel/channel.d.ts

@@ -1,10 +1,8 @@
-import { type ChildProcessWithoutNullStreams } from 'node:child_process';
 import { type OwnerChannelConfig } from '../config.js';
-import { type FetchLike } from '../monitor.js';
 import { type SessionHandle } from '../session/types.js';
 import { type OwnerFleetOps } from './commands.js';
 import type { ManagedFleetSpawnResult } from '../fleet-proxy.js';
-import { type OursToolClient } from './mcp.js';
+import { type OursOps } from './ours-client.js';
 import { type OwnerUpdatePhase } from './notices.js';
 import { type OwnerEntry } from './state.js';
 import { type OwnerTaskPhase } from './tasks.js';
@@ -17,15 +15,8 @@ export interface OwnerChannelOptions {
     session: SessionHandle;
     stateDir: string;
     env?: Record<string, string>;
-    command?: string;
     log(line: string): void;
-    client?: OursToolClient;
-    /** Legacy child-process test seam; production uses the direct notification API. */
-    watch?: (identity: string) => ChildProcessWithoutNullStreams;
-    /** Test seam for the production direct notification long-poll. */
-    watchFetch?: FetchLike;
-    /** Test seam for the long-poll stall bound; production uses OWNER_WATCH_STALL_MS. */
-    watchStallMs?: number;
+    client?: OursOps;
     /** Test seam; production uses the detached ours-fleet CLI (`fleetCliOps`). */
     fleet?: OwnerFleetOps;
     /** Forwarded to fleet CLI invocations spawned for owner commands. */
@@ -118,7 +109,13 @@ export type { OwnerUpdatePhase } from './notices.js';
 export interface OwnerContact {
     cid: string;
     name: string;
+    /** Structural, from which daemon collection the row came: established or pending. */
     status: string;
+    /**
+     * Retained for the `ours-fleet owner contact list` column. The daemon's typed
+     * contact view has no such field, so it is always absent; it is not inferred
+     * from anything a contact controls.
+     */
     kind?: string;
     human?: {
         cid?: string;
@@ -136,6 +133,7 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private readonly authorizations;
     private readonly conversations;
     private readonly tasks;
+    private readonly messageRecovery;
     private readonly attachmentRecovery;
     private readonly attachmentConfig;
     private readonly attachmentRoot;
@@ -144,7 +142,7 @@ export declare class OwnerChannel implements OwnerChannelHandle {
      * (a crash must replay them) but must not be queued twice while live.
      */
     private readonly inFlight;
-    /** Wires already NACKed to the managed agent, so a deferred replay stays quiet. */
+    /** Wires already NACKed to the managed agent, so a history replay stays quiet. */
     private readonly relayNacks;
     /**
      * fleet.yaml declares the restart baseline; `/comments on|off` changes only
@@ -155,7 +153,6 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private readonly commentsBaseline;
     private commentsEnabled;
     private stopping;
-    private watchProcess?;
     private watchTask?;
     private watchAbort?;
     private drainTask?;
@@ -174,6 +171,12 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     manage(request: OwnerChannelManagementRequest): Promise<OwnerChannelManagementResult>;
     notifyFleetSpawn(event: ManagedFleetSpawnResult): Promise<void>;
     private manageNow;
+    /**
+     * The daemon reports established contacts and pending introductions as two
+     * separate collections, so the status is structural rather than a word parsed
+     * out of a rendered line. Nothing here can be spoofed by a contact's own
+     * display name.
+     */
     private contacts;
     private contact;
     private assertCid;
@@ -187,6 +190,15 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private safeTaskReport;
     private safeProactiveMessage;
     private drainAll;
+    /**
+     * Claim the exact oldest unread SQLite batch before marking it read.
+     * The journal contains only wire IDs and sequence numbers; bodies remain in
+     * the daemon's persistent history and are recovered with getHistoryItem.
+     */
+    private claimMessages;
+    private messageClaim;
+    private historyMessage;
+    private attachmentMetadata;
     private attachmentGroups;
     private handleAttachmentGroup;
     private handle;
@@ -224,7 +236,7 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private managedAttachmentReplyWire;
     /**
      * One bounded NACK per wire: an unroutable or refused relay must be visible
-     * to the authenticated agent, while its deferred replays stay quiet. NACK
+     * to the authenticated agent, while its history replays stay quiet. NACK
      * delivery is best-effort — it must never make the failure worse.
      */
     private nackManagedAgent;
@@ -238,16 +250,6 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private warnOwnerOfUnauthorizedSender;
     private effectiveOwners;
     private authorizationIntegrity;
-    /**
-     * Report what the session actually did with the prompt, not what the config
-     * asked for. `interrupt: true` used to be reported as "your request
-     * interrupted the previous task" unconditionally; the session now answers
-     * whether anything was cancelled, whether the request is queued behind
-     * earlier prompts, or whether it is held until the current task reaches a
-     * safe stopping point. Backends that report no delivery state keep the old
-     * queuedBehind-based wording.
-     */
-    private acceptanceNotice;
     private complete;
     private commentsState;
     /** Model-authored commentary only; raw protocol/tool data never reaches here. */
@@ -267,15 +269,12 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private progressPhase;
     private watchLoop;
     /**
-     * `recovered` distinguishes a first-ever start (no state, nothing lost) from a
-     * cursor we HAD and can no longer read. Only the latter is a recovery, and the
-     * caller needs to know because the reason it reports is the only evidence a
-     * durable cursor was ever lost.
+     * `recovered` distinguishes a first-ever start from unreadable persisted
+     * diagnostics. Notification correctness does not depend on this state: every
+     * establishment drains and then replays SDK hints from offset zero.
      */
     private readWatchState;
     private writeWatchState;
-    /** Compatibility path for injected child-process tests; production is direct. */
-    private legacyWatchLoop;
     private errorText;
     private logError;
 }