@ours.network/fleet 1.0.5 → 1.1.0-nightly.10

package/dist/isolation/resources.d.ts

@@ -4,13 +4,9 @@ export interface ResourceArgs {
     warnings: string[];
 }
 /**
- * Build the `systemd-run --user --scope -p … --` prefix that caps the pane's
- * cgroup-v2 scope. Composed OUTSIDE the sandbox wrap: a tmux pane is
- * a child of a tmux SERVER rather than of the role's own runner process, so the
- * only reliable per-agent limit is a transient scope at the pane itself. (Since
- * #32 that server is per role rather than fleet-wide, which is what keeps one
- * role's `stop` off every other role's pane — the limit still belongs on the
- * pane.)
+ * Build the `systemd-run --user --scope -p … --` prefix that caps the agent
+ * process's cgroup-v2 scope. It composes outside the sandbox wrapper so both
+ * the adapter and its sandboxed child remain inside the transient scope.
  *
  * mem/pids are always enforced (their controllers are delegated to `--user` by
  * default). cpu degrades to a warning when the cpu controller is not delegated.

package/dist/isolation/resources.js

@@ -1,12 +1,8 @@
 import { readFileSync } from 'node:fs';
 /**
- * Build the `systemd-run --user --scope -p … --` prefix that caps the pane's
- * cgroup-v2 scope. Composed OUTSIDE the sandbox wrap: a tmux pane is
- * a child of a tmux SERVER rather than of the role's own runner process, so the
- * only reliable per-agent limit is a transient scope at the pane itself. (Since
- * #32 that server is per role rather than fleet-wide, which is what keeps one
- * role's `stop` off every other role's pane — the limit still belongs on the
- * pane.)
+ * Build the `systemd-run --user --scope -p … --` prefix that caps the agent
+ * process's cgroup-v2 scope. It composes outside the sandbox wrapper so both
+ * the adapter and its sandboxed child remain inside the transient scope.
  *
  * mem/pids are always enforced (their controllers are delegated to `--user` by
  * default). cpu degrades to a warning when the cpu controller is not delegated.

package/dist/model-env.d.ts

@@ -3,22 +3,20 @@ import type { ResolvedRole } from './config.js';
  * Which environment variable a harness reads to pin the model it RUNS.
  *
  * This is not a convenience: for `claude-code` it is the only channel that
- * reaches the ACP backend at all. `buildLaunch` (tmux) passes `--model`, but
- * `buildAcpLaunch` launches the ACP adapter with no model argument, and that
- * adapter resolves its model in this order — ANTHROPIC_MODEL, then
+ * reaches the Claude Code ACP adapter. The adapter resolves its model in this
+ * order — ANTHROPIC_MODEL, then
  * `settings.model`, then a resumed session's live model, then its first
  * catalogue entry. A role's declared model was therefore invisible to every
  * ACP role, and a fleet-wide `defaults.env.ANTHROPIC_MODEL` silently outranked
  * an explicitly requested one.
  */
-export declare const MODEL_ENV_BY_HARNESS: Readonly<Record<string, string>>;
 /** The model-pin variable for a harness, or undefined if it pins no model by env. */
 export declare function modelEnvVar(harness: string | undefined): string | undefined;
 export interface RoleModelEnvInput {
     harness: string;
     /** Already resolved by `resolveRoleModel` — may come from the fleet default. */
     model: string | undefined;
-    /** True when the role (or `--model`) named a model, including `model: null`. */
+    /** True when the resolved Brain named a model, including `model: null`. */
     modelWasExplicit: boolean;
     defaultsEnv?: Record<string, string>;
     roleEnv?: Record<string, string>;
@@ -37,7 +35,7 @@ export interface RoleModelEnv {
  * never disagree.
  *
  * Precedence, highest first:
- *   1. an explicit `model:` / `--model` on the role
+ *   1. an explicit `model:` on the resolved Brain
  *   2. the role's own `env:` pin
  *   3. the fleet `defaults.model`
  *   4. the fleet `defaults.env` pin

package/dist/model-env.js

@@ -1,28 +1,25 @@
+import { getAdapter } from './harness/registry.js';
 /**
  * Which environment variable a harness reads to pin the model it RUNS.
  *
  * This is not a convenience: for `claude-code` it is the only channel that
- * reaches the ACP backend at all. `buildLaunch` (tmux) passes `--model`, but
- * `buildAcpLaunch` launches the ACP adapter with no model argument, and that
- * adapter resolves its model in this order — ANTHROPIC_MODEL, then
+ * reaches the Claude Code ACP adapter. The adapter resolves its model in this
+ * order — ANTHROPIC_MODEL, then
  * `settings.model`, then a resumed session's live model, then its first
  * catalogue entry. A role's declared model was therefore invisible to every
  * ACP role, and a fleet-wide `defaults.env.ANTHROPIC_MODEL` silently outranked
  * an explicitly requested one.
  */
-export const MODEL_ENV_BY_HARNESS = {
-    'claude-code': 'ANTHROPIC_MODEL',
-};
 /** The model-pin variable for a harness, or undefined if it pins no model by env. */
 export function modelEnvVar(harness) {
-    return harness === undefined ? undefined : MODEL_ENV_BY_HARNESS[harness];
+    return harness === undefined ? undefined : getAdapter(harness).agentSession.modelEnvironmentVariable();
 }
 /**
  * Resolve a role's environment and its runtime model TOGETHER, so the two can
  * never disagree.
  *
  * Precedence, highest first:
- *   1. an explicit `model:` / `--model` on the role
+ *   1. an explicit `model:` on the resolved Brain
  *   2. the role's own `env:` pin
  *   3. the fleet `defaults.model`
  *   4. the fleet `defaults.env` pin

package/dist/monitor.d.ts

@@ -26,15 +26,8 @@ export type FetchLike = (url: string, init?: {
     headers?: Record<string, string>;
     signal?: AbortSignal;
 }) => Promise<FetchResponse>;
-export interface MonitorTmux {
-    has(name: string): Promise<boolean>;
-    capture(name: string, lines?: number): Promise<string>;
-    sendText(name: string, text: string): Promise<void>;
-    sendKey(name: string, key: string): Promise<void>;
-}
 export interface MonitorDeps {
     fetch: FetchLike;
-    tmux: MonitorTmux;
     isAlive(pid: number): boolean;
     sleep(ms: number): Promise<void>;
     now(): number;
@@ -45,7 +38,7 @@ export interface MonitorDeps {
         clear(t: ReturnType<typeof setTimeout>): void;
     };
     /**
-     * Structured prompt delivery used by ACP sessions. Tmux remains the fallback.
+     * Structured prompt delivery used by agent sessions.
      * `succeeded` is the turn's TERMINAL result, not merely that the session took
      * the prompt: a refused or cancelled wake was seen and not acted on, and must
      * not commit the cursor.
@@ -208,14 +201,6 @@ export declare class Monitor {
     /** Gather stragglers arriving within batch_ms so a burst lands as one line. */
     private coalesce;
     private deliver;
-    /**
-     * Watch the pane until the just-triggered turn settles, then fold its outcome
-     * into the API-error streak and republish `.monitor-status`. A completed turn
-     * (or an inconclusive give-up) resets/keeps the streak; an `API Error:` tail
-     * grows it. Once the streak reaches the threshold the status degrades; a later
-     * completed turn flips it back to armed. Detection only — no remediation (#19).
-     */
-    private observeTurnOutcome;
     /** Update the consecutive-API-error streak and derive `.monitor-status` from it. */
     private recordTurn;
     /**
@@ -226,14 +211,6 @@ export declare class Monitor {
      * the composer is cleared by hand. Best-effort: a dead pane just makes the keys
      * no-ops (delivery is still verified downstream).
      */
-    private clearComposer;
-    /**
-     * Block until the console can accept input; classify offline/stopped/ready, or
-     * `modal` when the pane still looks modal after `MODAL_GIVE_UP_MS`. The bound is
-     * what keeps a modal from wedging delivery silently: we still never `Enter` into
-     * the dialog, but the give-up is reported instead of retried forever.
-     */
-    private awaitInjectable;
     private doFetch;
     private advance;
     private persistCursor;

package/dist/monitor.js

@@ -1,7 +1,6 @@
 import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { classifyFailureText } from './model-recovery.js';
 // Code constants rather than user configuration.
 const DEFAULT_PORT = 3050;
 // The daemon normally holds for 25s, but that value is operator-configurable
@@ -522,7 +521,11 @@ export class Monitor {
     }
     async deliver(pid, batch) {
         const line = formatNotificationLine(batch);
-        if (this.deps.delivery) {
+        if (!this.deps.delivery) {
+            this.degrade('delivery', 'structured agent-session delivery is unavailable');
+            return false;
+        }
+        {
             const result = await this.deps.delivery.submit(line, { interrupt: this.cfg.interrupt });
             if (!result.succeeded) {
                 // Name the reason: "refused" and "cancelled" are the agent's answer,
@@ -540,101 +543,6 @@ export class Monitor {
                 this.recordTurn('completed');
             return true;
         }
-        // Tmux exposes no authenticated tool lifecycle. `after_tool` therefore
-        // degrades to the existing non-cancelling injection path; never guess a
-        // boundary from pane text and never send C-c for this mode.
-        if (this.cfg.interrupt === true)
-            await this.deps.tmux.sendKey(this.name, 'C-c');
-        if (this.cfg.interrupt === 'after_tool')
-            this.degrade('safe-boundary', 'after_tool unsupported by tmux; using non-cancelling delivery');
-        const state = await this.awaitInjectable(pid);
-        if (state !== 'ready') {
-            if (state === 'offline')
-                this.degrade('offline', 'offline during delivery');
-            else if (state === 'modal')
-                this.degrade('modal', `modal wedge — pane held a dialog for ` +
-                    `${MODAL_GIVE_UP_MS / 1000}s, wake not injected`);
-            return false;
-        }
-        await this.clearComposer(); // start from an empty composer
-        await this.deps.tmux.sendText(this.name, line); // send-keys -l + Enter
-        let delivered = false;
-        // Verify submission for THIS line even if stop() arrives mid-flight: the text
-        // is already in the composer and we want it submitted (at-least-once). A truly
-        // dead pane makes safeCapture return '' ⇒ not-in-composer ⇒ breaks, no wasted Enter.
-        for (let i = 0; i < MAX_ENTER_RETRIES;) {
-            await this.deps.sleep(POST_VERIFY_MS);
-            const capture = await safeCapture(this.deps.tmux, this.name);
-            if (!capture.ok) {
-                this.degrade('delivery', 'capture failed during injection verification');
-                return false;
-            }
-            // A dialog can appear after the initial send. Never let a verification
-            // retry confirm it. Wait under the same bounded modal policy as initial
-            // injection, then re-capture immediately before considering Enter.
-            if (looksModal(capture.pane)) {
-                const state = await this.awaitInjectable(pid);
-                if (state === 'ready')
-                    continue;
-                if (state === 'offline')
-                    this.degrade('offline', 'offline during injection verification');
-                else if (state === 'modal')
-                    this.degrade('modal', `modal wedge during injection verification — ` +
-                        `no Enter sent for ${MODAL_GIVE_UP_MS / 1000}s`);
-                return false;
-            }
-            if (!stillInComposer(capture.pane, line)) {
-                delivered = true;
-                break;
-            }
-            await this.deps.tmux.sendKey(this.name, 'Enter');
-            i++;
-        }
-        if (!delivered) {
-            this.degrade('delivery', 'injection unverified');
-            return false;
-        }
-        this.recover('delivery', 'modal');
-        // The wake landed and a turn started; observe how that turn terminates so a
-        // refusal-wedge (every turn dies with `API Error:` while delivery stays green)
-        // becomes visible in `.monitor-status` instead of masquerading as armed (#19).
-        const recoveryTriggered = await this.observeTurnOutcome(pid);
-        return !recoveryTriggered;
-    }
-    /**
-     * Watch the pane until the just-triggered turn settles, then fold its outcome
-     * into the API-error streak and republish `.monitor-status`. A completed turn
-     * (or an inconclusive give-up) resets/keeps the streak; an `API Error:` tail
-     * grows it. Once the streak reaches the threshold the status degrades; a later
-     * completed turn flips it back to armed. Detection only — no remediation (#19).
-     */
-    async observeTurnOutcome(pid) {
-        for (let i = 0; i < TURN_OBSERVE_POLLS; i++) {
-            if (this.stopped)
-                return false; // shutting down — leave status
-            if (!this.deps.isAlive(pid) || !(await this.deps.tmux.has(this.name)))
-                return false; // loop marks offline
-            const capture = await safeCapture(this.deps.tmux, this.name);
-            if (!capture.ok) {
-                this.degrade('delivery', 'capture failed during turn observation');
-                return false;
-            }
-            if (looksApiError(capture.pane)) {
-                const evidence = classifyFailureText(capture.pane);
-                const recoveryTriggered = evidence
-                    ? this.deps.onFailureEvidence?.(evidence) === true
-                    : false;
-                this.recordTurn('api-error');
-                return recoveryTriggered;
-            }
-            if (!looksRunning(capture.pane)) {
-                this.recordTurn('completed');
-                return false;
-            }
-            await this.deps.sleep(TURN_OBSERVE_INTERVAL_MS);
-        }
-        this.recordTurn('inconclusive'); // still running at give-up: hold the streak, don't re-arm
-        return false;
     }
     /** Update the consecutive-API-error streak and derive `.monitor-status` from it. */
     recordTurn(outcome) {
@@ -658,41 +566,6 @@ export class Monitor {
      * the composer is cleared by hand. Best-effort: a dead pane just makes the keys
      * no-ops (delivery is still verified downstream).
      */
-    async clearComposer() {
-        for (const key of COMPOSER_CLEAR_KEYS)
-            await this.deps.tmux.sendKey(this.name, key);
-    }
-    /**
-     * Block until the console can accept input; classify offline/stopped/ready, or
-     * `modal` when the pane still looks modal after `MODAL_GIVE_UP_MS`. The bound is
-     * what keeps a modal from wedging delivery silently: we still never `Enter` into
-     * the dialog, but the give-up is reported instead of retried forever.
-     */
-    async awaitInjectable(pid) {
-        let modalWaits = 0;
-        for (;;) {
-            if (this.stopped)
-                return 'stopped';
-            if (!this.deps.isAlive(pid) || !(await this.deps.tmux.has(this.name)))
-                return 'offline';
-            const now = this.deps.now();
-            if (now < this.bootDeadline) {
-                await this.deps.sleep(this.bootDeadline - now);
-                continue;
-            }
-            const capture = await safeCapture(this.deps.tmux, this.name);
-            if (!capture.ok) {
-                this.degrade('delivery', 'capture failed while checking session readiness');
-                await this.deps.sleep(MODAL_RETRY_MS);
-                continue;
-            }
-            if (!looksModal(capture.pane))
-                return 'ready';
-            if (modalWaits++ >= MAX_MODAL_WAITS)
-                return 'modal';
-            await this.deps.sleep(MODAL_RETRY_MS);
-        }
-    }
     async doFetch(since, timeoutMs, timeoutKind) {
         const ctrl = new AbortController();
         this.currentAbort = ctrl;
@@ -820,12 +693,4 @@ export class Monitor {
 export function createMonitor(o) {
     return new Monitor(o);
 }
-async function safeCapture(tmux, name) {
-    try {
-        return { ok: true, pane: await tmux.capture(name) };
-    }
-    catch {
-        return { ok: false, pane: '' };
-    }
-}
 const msg = (e) => e?.message ?? String(e);

package/dist/ops.js

@@ -1,7 +1,7 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, unlinkSync, } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID, createHash } from 'node:crypto';
-import { agentDir, fleetDDir, watchdogsRoot } from './paths.js';
+import { agentDir, watchdogsRoot } from './paths.js';
 import { findRole } from './config.js';
 import { getAdapter } from './harness/registry.js';
 import { generateBriefing } from './briefing.js';
@@ -9,6 +9,7 @@ import { resetRestartLedger } from './runner.js';
 import { archiveTempState, stopTempSupervisor, tempSupervisorLiveness, } from './temp-lifecycle.js';
 import { realExec } from './exec.js';
 import { daemonIdentityProvisioner, reconcilePermanentRoleIdentities, } from './creation.js';
+import { provesGeneratedAgentSource } from './generated-agent-source.js';
 // Launch staggering now lives at the harness-launch point (the runner's start
 // gate, driven by `start_stagger_ms`), so it covers systemd host-boot too — not
 // just the `up`/`restart` command loop below. The old in-loop FLEET_START_STAGGER
@@ -264,9 +265,10 @@ export async function rmRole(cfg, name, deps) {
         return;
     }
     const role = findRole(cfg, name);
+    const generatedSource = provesGeneratedAgentSource(agentDir(name), cfg.files[0], role.sourceFile);
     await deps.backend.uninstall(name);
     rmSync(agentDir(name), { recursive: true, force: true });
-    if (role.sourceFile.startsWith(fleetDDir() + '/')) {
+    if (generatedSource && existsSync(role.sourceFile)) {
         unlinkSync(role.sourceFile);
         deps.log(`removed ${role.sourceFile}`);
     }

package/dist/owner-channel/channel.d.ts

@@ -1,7 +1,8 @@
 import { type OwnerChannelConfig } from '../config.js';
-import { type SessionHandle } from '../session/types.js';
+import { type AgentSession } from '../session/types.js';
 import { type OwnerFleetOps } from './commands.js';
 import type { ManagedFleetSpawnResult } from '../fleet-proxy.js';
+import { type FleetAuditAttempt, type FleetAuditPresentation, type FleetCommandOutcomeClass } from '../fleet-command-audit.js';
 import { type OursOps } from './ours-client.js';
 import { type OwnerUpdatePhase } from './notices.js';
 import { type OwnerEntry } from './state.js';
@@ -12,7 +13,7 @@ export interface OwnerChannelOptions {
     /** Harness id of the role (e.g. 'claude-code', 'codex'); gates which slash commands may be forwarded. */
     harness: string;
     config: OwnerChannelConfig;
-    session: SessionHandle;
+    session: AgentSession;
     stateDir: string;
     env?: Record<string, string>;
     log(line: string): void;
@@ -27,14 +28,44 @@ export interface OwnerChannelOptions {
     binderDeps?: OwnerBinderDeps;
     /** Pre-acquired by the runner so the predecessor control socket remains reachable while waiting. */
     binderLease?: OwnerBinderLease;
+    recoveryDeps?: {
+        now(): number;
+        setTimer(fn: () => void, ms: number): ReturnType<typeof setTimeout>;
+        clearTimer(timer: ReturnType<typeof setTimeout>): void;
+        deadlineMs?: number;
+    };
 }
 export interface OwnerChannelHandle {
     start(): Promise<void>;
     drain(): Promise<void>;
     close(): Promise<void>;
+    /** Reattach this same supervisor-owned channel after a daemon generation change. */
+    recover?(epoch: string): Promise<void>;
+    /** False when shutdown skipped client disposal because quiescence was unproven. */
+    binderReleaseSafe?(): boolean;
     manage(request: OwnerChannelManagementRequest): Promise<OwnerChannelManagementResult>;
     /** Fleet-owned deterministic lifecycle notice; absent on legacy test doubles. */
     notifyFleetSpawn?(event: ManagedFleetSpawnResult): Promise<void>;
+    beginFleetCommandAudit?(requestId: string, argv: string[]): Promise<FleetAuditAttempt>;
+    finishFleetCommandAudit?(input: {
+        correlationId: string;
+        class: FleetCommandOutcomeClass;
+        exitCode?: number;
+        effect: 'not_started' | 'completed' | 'unknown';
+        resourceIds?: Record<string, string>;
+        presentations?: FleetAuditPresentation[];
+    }): Promise<FleetAuditAttempt>;
+}
+export declare const OWNER_RECOVERY_QUEUE_CAPACITY = 32;
+export declare const OWNER_RECOVERY_DEGRADED = "OWNER_RECOVERY_DEGRADED";
+export declare class OwnerRecoveryDegradedError extends Error {
+    readonly code = "OWNER_RECOVERY_DEGRADED";
+    constructor();
+}
+export declare class OwnerRecoveryTimeoutError extends Error {
+    readonly stage: string;
+    readonly code = "OWNER_RECOVERY_DEGRADED";
+    constructor(stage: string);
 }
 export type OwnerChannelManagementRequest = {
     action: 'contact_list';
@@ -162,17 +193,42 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private readonly completionTasks;
     private readonly activeRequests;
     private managementTail;
+    private recoveryEpoch?;
+    private recoveryTask?;
+    private recoveryToken;
+    private recoveryQueued;
+    private watchGeneration;
+    /** A timed-out client operation that must settle before replacement is safe. */
+    private recoveryQuiescence?;
+    private releaseSafe;
     private ready;
+    private startedOnce;
+    private shutdownDegraded;
     private binder?;
     private binderOwnedInternally;
     private readonly fleetOps;
     private readonly prepareRestart;
+    private readonly commandAudits;
     constructor(options: OwnerChannelOptions);
     start(): Promise<void>;
     drain(): Promise<void>;
     close(): Promise<void>;
+    binderReleaseSafe(): boolean;
     manage(request: OwnerChannelManagementRequest): Promise<OwnerChannelManagementResult>;
     notifyFleetSpawn(event: ManagedFleetSpawnResult): Promise<void>;
+    beginFleetCommandAudit(requestId: string, argv: string[]): Promise<FleetAuditAttempt>;
+    finishFleetCommandAudit(input: {
+        correlationId: string;
+        class: FleetCommandOutcomeClass;
+        exitCode?: number;
+        effect: 'not_started' | 'completed' | 'unknown';
+        resourceIds?: Record<string, string>;
+        presentations?: FleetAuditPresentation[];
+    }): Promise<FleetAuditAttempt>;
+    recover(epoch: string): Promise<void>;
+    private recoveryStage;
+    private writeShutdownState;
+    private queueManagement;
     private manageNow;
     /**
      * The daemon reports established contacts and pending introductions as two