@ours.network/fleet 0.9.1 → 0.9.3

package/dist/config.d.ts

@@ -13,6 +13,13 @@ export interface MonitorConfig {
     wake_sources: string[];
     batch_ms: number;
     inject: InjectMode;
+    /**
+     * Consecutive delivered wakes that must end in an `API Error:`-terminated turn
+     * (with no completed turn in between) before `.monitor-status` degrades to
+     * `turns failing (api error)` — the refusal-wedge detector (issue #19). Must be
+     * a positive integer; resolved default is 3. Optional so old snapshots resolve.
+     */
+    turn_fail_threshold?: number;
 }
 /** Default wake sources when a role does not list its own (design §2). */
 export declare const DEFAULT_WAKE_SOURCES: NotifyEventType[];

package/dist/config.js

@@ -10,9 +10,10 @@ export const NOTIFY_EVENT_TYPES = [
 ];
 /** Default wake sources when a role does not list its own (design §2). */
 export const DEFAULT_WAKE_SOURCES = ['message_received', 'file_received', 'local_contact_request', 'pending_message'];
-const MONITOR_KEYS = ['enabled', 'wake_sources', 'batch_ms', 'inject'];
+const MONITOR_KEYS = ['enabled', 'wake_sources', 'batch_ms', 'inject', 'turn_fail_threshold'];
 const INJECT_MODES = ['notification', 'full'];
 const MONITOR_DEFAULT_BATCH_MS = 2000;
+const MONITOR_DEFAULT_TURN_FAIL_THRESHOLD = 3;
 const isPlainObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
 /** Validate a raw (role-level or merged) `monitor:` block; returns human-readable problems. */
 export function validateMonitorConfig(raw) {
@@ -30,6 +31,10 @@ export function validateMonitorConfig(raw) {
         problems.push('monitor.batch_ms: must be a non-negative number');
     if (m.inject !== undefined && !INJECT_MODES.includes(m.inject))
         problems.push(`monitor.inject: invalid value '${m.inject}'; allowed: ${INJECT_MODES.join(', ')}`);
+    if (m.turn_fail_threshold !== undefined
+        && (typeof m.turn_fail_threshold !== 'number' || !Number.isInteger(m.turn_fail_threshold)
+            || m.turn_fail_threshold < 1))
+        problems.push('monitor.turn_fail_threshold: must be a positive integer');
     if (m.wake_sources !== undefined) {
         if (!Array.isArray(m.wake_sources))
             problems.push('monitor.wake_sources: must be a list');
@@ -168,6 +173,7 @@ export function resolveMonitorConfig(defMonitor, roleMonitor, labels = {}) {
         wake_sources: merged.wake_sources ?? [...DEFAULT_WAKE_SOURCES],
         batch_ms: merged.batch_ms ?? MONITOR_DEFAULT_BATCH_MS,
         inject: merged.inject ?? 'notification',
+        turn_fail_threshold: merged.turn_fail_threshold ?? MONITOR_DEFAULT_TURN_FAIL_THRESHOLD,
     };
 }
 export function findRole(cfg, name) {

package/dist/monitor.d.ts

@@ -85,6 +85,21 @@ export declare function formatNotificationLine(events: NotifyEvent[]): string;
  * open question (a): refine empirically). A running turn is NOT modal.
  */
 export declare function looksModal(pane: string): boolean;
+/**
+ * Heuristic: did the turn shown in this pane TERMINATE in an API-level error?
+ * Claude Code renders a failed turn's tail as an `API Error:` line (a Usage-Policy
+ * refusal, a 4xx, etc.). We scan a generous tail window so the marker survives a
+ * trailing idle composer redrawn beneath it (design §3.2, refine empirically).
+ * The N-consecutive threshold in the Monitor debounces the odd false match.
+ */
+export declare function looksApiError(pane: string): boolean;
+/**
+ * Heuristic: is a turn still RUNNING in this pane? Claude Code shows a live
+ * "esc to interrupt" footer (often with an elapsed-seconds meter) while a turn
+ * streams. Absence of any running marker — and no API error — means the turn has
+ * settled (completed). Kept a positive check so a quiet idle pane reads as done.
+ */
+export declare function looksRunning(pane: string): boolean;
 export interface MonitorOpts {
     name: string;
     agentDir: string;
@@ -109,6 +124,8 @@ export declare class Monitor {
     private stopped;
     private bootDeadline;
     private currentAbort;
+    private apiErrorStreak;
+    private readonly turnFailThreshold;
     constructor(o: MonitorOpts);
     /** Prime at the stream tip (or resume a persisted cursor if the daemon is down). */
     prime(): Promise<void>;
@@ -118,6 +135,25 @@ export declare class Monitor {
     /** Gather stragglers arriving within batch_ms so a burst lands as one line. */
     private coalesce;
     private deliver;
+    /**
+     * Watch the pane until the just-triggered turn settles, then fold its outcome
+     * into the API-error streak and republish `.monitor-status`. A completed turn
+     * (or an inconclusive give-up) resets/keeps the streak; an `API Error:` tail
+     * grows it. Once the streak reaches the threshold the status degrades; a later
+     * completed turn flips it back to armed. Detection only — no remediation (#19).
+     */
+    private observeTurnOutcome;
+    /** Update the consecutive-API-error streak and derive `.monitor-status` from it. */
+    private recordTurn;
+    /**
+     * Reset the composer to empty before typing a wake. Without this, any
+     * unsubmitted text a human left in the input concatenates with the injected
+     * line (`stray[fleet-monitor] …`) or, when it has opened a slash-command menu,
+     * swallows the submit Enter entirely — wedging every subsequent injection until
+     * the composer is cleared by hand. Best-effort: a dead pane just makes the keys
+     * no-ops (delivery is still verified downstream).
+     */
+    private clearComposer;
     /** Block until the console can accept input; classify offline/stopped/ready. */
     private awaitInjectable;
     private doFetch;

package/dist/monitor.js

@@ -9,10 +9,20 @@ const BOOT_GRACE_MS = 15_000; // hold injection until the TUI is up
 const POST_VERIFY_MS = 1_000;
 const MAX_ENTER_RETRIES = 2;
 const MODAL_RETRY_MS = 5_000;
+// Keys that reset the composer to empty before we type a wake, so a human's
+// unsubmitted keystrokes can't concatenate with — or wedge (e.g. via an open
+// slash-command menu that captures Enter) — the injected line. C-e moves to end
+// of line, C-u kills to start ⇒ whole single line cleared regardless of cursor.
+const COMPOSER_CLEAR_KEYS = ['C-e', 'C-u'];
 const BACKOFF_STEP_MS = 1_000;
 const BACKOFF_MAX_MS = 5_000;
 const PREFIX = '[fleet-monitor]';
 const MAX_LINE = 260;
+// Turn-outcome observation (issue #19): after a delivered wake, watch the pane
+// until the triggered turn settles, then classify it. Code constants (not config):
+const TURN_OBSERVE_POLLS = 20; // give up after ~POLLS × INTERVAL of a still-running turn
+const TURN_OBSERVE_INTERVAL_MS = 1_500;
+const DEFAULT_TURN_FAIL_THRESHOLD = 3; // fallback when the resolved config omits it
 class AuthError extends Error {
 }
 /** Path to the daemon config the MCP client uses: OURS_CONFIG ?? real ~/.ours/config.json. */
@@ -151,6 +161,31 @@ export function looksModal(pane) {
     const hasNumbered = /(^|\n)\s*[❯>]?\s*\d+[.)]\s+\S/.test(pane);
     return hasPointer && hasNumbered;
 }
+/**
+ * Heuristic: did the turn shown in this pane TERMINATE in an API-level error?
+ * Claude Code renders a failed turn's tail as an `API Error:` line (a Usage-Policy
+ * refusal, a 4xx, etc.). We scan a generous tail window so the marker survives a
+ * trailing idle composer redrawn beneath it (design §3.2, refine empirically).
+ * The N-consecutive threshold in the Monitor debounces the odd false match.
+ */
+export function looksApiError(pane) {
+    const tail = pane.split('\n').slice(-15).join('\n');
+    return /\bAPI Error\b/i.test(tail);
+}
+/**
+ * Heuristic: is a turn still RUNNING in this pane? Claude Code shows a live
+ * "esc to interrupt" footer (often with an elapsed-seconds meter) while a turn
+ * streams. Absence of any running marker — and no API error — means the turn has
+ * settled (completed). Kept a positive check so a quiet idle pane reads as done.
+ */
+export function looksRunning(pane) {
+    const tail = pane.split('\n').slice(-6).join('\n');
+    if (/esc to interrupt/i.test(tail))
+        return true; // Claude Code's running footer
+    if (/\(\s*\d+s\b/.test(tail))
+        return true; // "(12s · … tokens)" elapsed meter
+    return false;
+}
 /** Is the injected line still sitting unsubmitted in the composer (bottom of pane)? */
 function stillInComposer(pane, line) {
     const frag = line.slice(0, 48);
@@ -169,6 +204,10 @@ export class Monitor {
     stopped = false;
     bootDeadline = 0;
     currentAbort = null;
+    // Refusal-wedge detector (issue #19): consecutive delivered wakes whose turn
+    // ended in an API error with no completed turn in between.
+    apiErrorStreak = 0;
+    turnFailThreshold;
     constructor(o) {
         this.name = o.name;
         this.cfg = o.cfg;
@@ -176,6 +215,8 @@ export class Monitor {
         this.ep = resolveEndpoint(o.deps.env);
         this.statusPath = join(o.agentDir, '.monitor-status');
         this.cursorPath = join(o.agentDir, '.notify-cursor');
+        const n = o.cfg.turn_fail_threshold;
+        this.turnFailThreshold = typeof n === 'number' && n >= 1 ? n : DEFAULT_TURN_FAIL_THRESHOLD;
     }
     /** Prime at the stream tip (or resume a persisted cursor if the daemon is down). */
     async prime() {
@@ -260,6 +301,7 @@ export class Monitor {
             return; // events remain covered by unread.json / SessionStart backlog
         }
         const line = formatNotificationLine(batch);
+        await this.clearComposer(); // start from an empty composer
         await this.deps.tmux.sendText(this.name, line); // send-keys -l + Enter
         let delivered = false;
         // Verify submission for THIS line even if stop() arrives mid-flight: the text
@@ -274,7 +316,63 @@ export class Monitor {
             }
             await this.deps.tmux.sendKey(this.name, 'Enter');
         }
-        this.setStatus(delivered ? 'armed' : 'degraded: injection unverified');
+        if (!delivered) {
+            this.setStatus('degraded: injection unverified');
+            return;
+        }
+        // The wake landed and a turn started; observe how that turn terminates so a
+        // refusal-wedge (every turn dies with `API Error:` while delivery stays green)
+        // becomes visible in `.monitor-status` instead of masquerading as armed (#19).
+        await this.observeTurnOutcome(pid);
+    }
+    /**
+     * Watch the pane until the just-triggered turn settles, then fold its outcome
+     * into the API-error streak and republish `.monitor-status`. A completed turn
+     * (or an inconclusive give-up) resets/keeps the streak; an `API Error:` tail
+     * grows it. Once the streak reaches the threshold the status degrades; a later
+     * completed turn flips it back to armed. Detection only — no remediation (#19).
+     */
+    async observeTurnOutcome(pid) {
+        for (let i = 0; i < TURN_OBSERVE_POLLS; i++) {
+            if (this.stopped)
+                return; // shutting down — leave status
+            if (!this.deps.isAlive(pid) || !(await this.deps.tmux.has(this.name)))
+                return; // loop marks offline
+            const pane = await safeCapture(this.deps.tmux, this.name);
+            if (looksApiError(pane)) {
+                this.recordTurn('api-error');
+                return;
+            }
+            if (!looksRunning(pane)) {
+                this.recordTurn('completed');
+                return;
+            }
+            await this.deps.sleep(TURN_OBSERVE_INTERVAL_MS);
+        }
+        this.recordTurn('inconclusive'); // still running at give-up: hold the streak, don't re-arm
+    }
+    /** Update the consecutive-API-error streak and derive `.monitor-status` from it. */
+    recordTurn(outcome) {
+        if (outcome === 'api-error')
+            this.apiErrorStreak++;
+        else if (outcome === 'completed')
+            this.apiErrorStreak = 0;
+        // 'inconclusive' leaves the streak (and therefore the status) unchanged.
+        this.setStatus(this.apiErrorStreak >= this.turnFailThreshold
+            ? 'degraded: turns failing (api error)'
+            : 'armed');
+    }
+    /**
+     * Reset the composer to empty before typing a wake. Without this, any
+     * unsubmitted text a human left in the input concatenates with the injected
+     * line (`stray[fleet-monitor] …`) or, when it has opened a slash-command menu,
+     * swallows the submit Enter entirely — wedging every subsequent injection until
+     * the composer is cleared by hand. Best-effort: a dead pane just makes the keys
+     * no-ops (delivery is still verified downstream).
+     */
+    async clearComposer() {
+        for (const key of COMPOSER_CLEAR_KEYS)
+            await this.deps.tmux.sendKey(this.name, key);
     }
     /** Block until the console can accept input; classify offline/stopped/ready. */
     async awaitInjectable(pid) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux consoles, systemd/launchd supervision, ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",