@ours.network/fleet 1.0.5 → 1.1.0-nightly.10

package/dist/owner-channel/channel.js

@@ -1,8 +1,9 @@
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
-import { mkdir, readFile, readdir, rm } from 'node:fs/promises';
+import { mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { canonicalCid } from '../config.js';
+import { DAEMON_RECOVERY_DEADLINE_MS } from '../daemon-recovery.js';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { TaskRoomApplicationService } from '../application/task-room-service.js';
 import { RoleLifecycleService } from '../application/role-command-service.js';
@@ -14,6 +15,7 @@ import { ACP_CANCEL_DEADLINE_EXCEEDED, SessionControlError, } from '../session/t
 import { VERSION } from '../version.js';
 import { renderMarkdownFailure, renderMarkdownResult, roomStatus, taskStatus, } from '../rooms-tasks/markdown.js';
 import { dispatchOwnerCommand, fleetCliOps, isOwnerCommandText, } from './commands.js';
+import { FleetCommandAuditStore, lifecycleEventDigestBasis, renderFleetLifecycleEvent, } from '../fleet-command-audit.js';
 import { OURS_BOUND_ELSEWHERE, OursSdkClient, oursErrorCode, } from './ours-client.js';
 import { ownerNotices, } from './notices.js';
 import { DuplicateSendError, OwnerAuthorizationState, OwnerChannelState, OwnerConversationState, } from './state.js';
@@ -21,6 +23,24 @@ import { OwnerTaskState, ownerTaskAuditId, ownerTaskDigest, } from './tasks.js';
 import { AttachmentRecoveryState, admitAttachments, cleanupAttachmentRoot, parseIncomingAttachments, parseRetrievedAttachments, prepareAttachmentDirectory, recoveredAttachment, removeRequestDirectory, safeField, validateAttachmentSelection, validateAttachmentRelaySelection, writeRecoveredAttachment, } from './attachments.js';
 import { acquireOwnerBinderLease, OWNER_BIND_HANDOFF_TIMEOUT_MS, } from './binder.js';
 import { MessageRecoveryState } from './message-recovery.js';
+export const OWNER_RECOVERY_QUEUE_CAPACITY = 32;
+export const OWNER_RECOVERY_DEGRADED = 'OWNER_RECOVERY_DEGRADED';
+export class OwnerRecoveryDegradedError extends Error {
+    code = OWNER_RECOVERY_DEGRADED;
+    constructor() {
+        super('owner channel recovery is degraded');
+        this.name = 'OwnerRecoveryDegradedError';
+    }
+}
+export class OwnerRecoveryTimeoutError extends Error {
+    stage;
+    code = OWNER_RECOVERY_DEGRADED;
+    constructor(stage) {
+        super(`owner channel recovery timed out at ${stage}`);
+        this.stage = stage;
+        this.name = 'OwnerRecoveryTimeoutError';
+    }
+}
 const OWNER_UPDATE_MIN_INTERVAL_MS = 5_000;
 const OWNER_UPDATE_MAX_COUNT = 20;
 const OWNER_UPDATE_MAX_CHARS = 280;
@@ -76,11 +96,22 @@ export class OwnerChannel {
     completionTasks = new Set();
     activeRequests = new Map();
     managementTail = Promise.resolve();
+    recoveryEpoch;
+    recoveryTask;
+    recoveryToken = 0;
+    recoveryQueued = 0;
+    watchGeneration = 0;
+    /** A timed-out client operation that must settle before replacement is safe. */
+    recoveryQuiescence;
+    releaseSafe = true;
     ready = false;
+    startedOnce = false;
+    shutdownDegraded = false;
     binder;
     binderOwnedInternally = false;
     fleetOps;
     prepareRestart;
+    commandAudits;
     constructor(options) {
         this.options = options;
         this.client = options.client ?? new OursSdkClient(options.env, line => options.log(`[${options.role}] owner channel ${line}`));
@@ -96,6 +127,7 @@ export class OwnerChannel {
             await lifecycle.prepareRestart({ roleIds: [role], mode });
         });
         this.state = new OwnerChannelState(join(options.stateDir, '.owner-channel-state.json'));
+        this.commandAudits = new FleetCommandAuditStore(join(options.stateDir, '.owner-channel-command-audit.json'));
         this.authorizations = new OwnerAuthorizationState(join(options.stateDir, '.owner-channel-owners.json'), options.config.owners);
         this.conversations = new OwnerConversationState(join(options.stateDir, '.owner-channel-conversations.json'));
         this.tasks = new OwnerTaskState(join(options.stateDir, '.owner-channel-tasks.json'));
@@ -124,6 +156,7 @@ export class OwnerChannel {
     }
     async start() {
         this.stopping = false;
+        this.shutdownDegraded = false;
         this.binderOwnedInternally = !this.options.binderLease;
         this.binder = this.options.binderLease ?? await acquireOwnerBinderLease(this.options.stateDir, this.options.role, this.options.config.identity, this.options.binderDeps);
         try {
@@ -164,11 +197,12 @@ export class OwnerChannel {
             this.attachmentRecovery.cleanup(Date.now(), this.attachmentConfig.retention_ms);
             void cleanupAttachmentRoot(this.attachmentRoot, Date.now(), this.attachmentConfig.retention_ms).catch(error => this.logError('attachment crash cleanup failed', error));
         }
+        this.startedOnce = true;
         this.ready = true;
         // Do not make role startup wait for an old owner request to finish a turn.
         // watchLoop itself drains before every establishment, including this first
         // one, so there is no drain-to-tip race.
-        this.watchTask = this.watchLoop();
+        this.watchTask = this.watchLoop(++this.watchGeneration);
     }
     drain() {
         this.drainRequested = true;
@@ -183,46 +217,239 @@ export class OwnerChannel {
         return this.drainTask;
     }
     async close() {
+        if (this.recoveryTask)
+            this.shutdownDegraded = true;
         this.stopping = true;
         this.ready = false;
-        this.watchAbort?.abort();
-        await this.watchTask?.catch(error => this.logError('watch shutdown failed', error));
+        this.recoveryToken++;
+        this.watchGeneration++;
+        const staleWatch = this.watchTask;
         this.watchTask = undefined;
-        await this.managementTail;
+        this.watchAbort?.abort();
+        const now = this.options.recoveryDeps?.now ?? (() => Date.now());
+        const deadlineAt = now()
+            + (this.options.recoveryDeps?.deadlineMs ?? DAEMON_RECOVERY_DEADLINE_MS);
+        let disposed = false;
         try {
-            await this.client.close();
+            await this.recoveryStage('shutdown_quiescence', Promise.all([
+                staleWatch?.catch(error => this.logError('watch shutdown failed', error)),
+                this.drainTask?.catch(error => this.logError('drain shutdown failed', error)),
+                this.managementTail.then(() => undefined),
+                this.recoveryQuiescence,
+            ]), deadlineAt);
+            await this.recoveryStage('shutdown_close', this.client.close(), deadlineAt);
+            disposed = true;
+            this.writeShutdownState('closed', 'OWNER_SHUTDOWN_CLOSED', now());
+        }
+        catch (error) {
+            this.shutdownDegraded = true;
+            this.releaseSafe = false;
+            const stage = error instanceof OwnerRecoveryTimeoutError ? error.stage : 'shutdown_unknown';
+            this.writeShutdownState('degraded', `OWNER_${stage.toUpperCase()}_TIMEOUT`, now());
+            this.options.log(`[${this.options.role}] owner shutdown degraded stage=${stage}`);
         }
         finally {
-            if (this.binderOwnedInternally)
+            if (disposed && this.binderOwnedInternally)
                 this.binder?.release();
-            this.binder = undefined;
+            if (disposed)
+                this.binder = undefined;
         }
     }
+    binderReleaseSafe() { return this.releaseSafe; }
     manage(request) {
-        const run = this.managementTail.then(() => this.manageNow(request));
-        this.managementTail = run.then(() => undefined, () => undefined);
-        return run;
+        return this.queueManagement(() => this.manageNow(request));
     }
     notifyFleetSpawn(event) {
-        const run = this.managementTail.then(async () => {
+        return this.queueManagement(async () => {
             if (!this.ready || this.stopping)
                 throw new Error('owner-channel MCP client is unavailable');
-            const model = event.model ? `, model ${event.model}` : '';
-            const monitorPolicy = event.monitor.interrupt === true
-                ? ' with interruption'
-                : event.monitor.interrupt === 'after_tool' ? ' with after-tool steering' : '';
-            const monitor = `${event.monitor.mode} monitor${monitorPolicy}`;
             const permission = event.permissionMode
-                ? `; permission ${event.permissionMode.fleetMode}, native ${event.permissionMode.nativeMode}`
-                : '';
-            const inherited = event.inherited.length
-                ? ` Supervisor inherited omitted defaults: ${event.inherited.join(', ')}.` : '';
-            await this.sendProactiveMessage(`🧑‍💻 ${event.caller} spawned ${event.lifetime} agent ${event.role} `
-                + `(${event.harness}/${event.session}${model}; ${monitor}${permission}).${inherited}`, `fleet-spawn\0${event.creationActionId}`, 0);
+                ? `${event.permissionMode.fleetMode}/${event.permissionMode.nativeMode}` : undefined;
+            await this.sendProactiveMessage(renderFleetLifecycleEvent({ kind: 'agent_started', eventId: event.creationActionId,
+                id: event.role, name: event.role,
+                lifetime: event.lifetime, brain: event.brainSummary, role: event.roleSummary,
+                harness: event.harness, session: event.session, model: event.model,
+                permissions: permission, parent: event.caller, actionId: event.creationActionId,
+                inherited: event.inherited }), `fleet-spawn\0${event.creationActionId}`, 0);
+        });
+    }
+    beginFleetCommandAudit(requestId, argv) {
+        const run = this.managementTail.then(async () => {
+            let attempt = this.commandAudits.begin(requestId, this.options.role, argv);
+            if (attempt.invocation === 'delivered')
+                return attempt;
+            if (attempt.invocation === 'uncertain')
+                return attempt;
+            this.options.log(`[${this.options.role}] fleet proxy command ${attempt.correlationId} `
+                + `route=${attempt.classification.route} decision=${attempt.classification.decision}`);
+            attempt = this.commandAudits.invocation(attempt.correlationId, this.options.role, 'delivered');
+            return attempt;
+        });
+        this.managementTail = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    finishFleetCommandAudit(input) {
+        const run = this.managementTail.then(async () => {
+            let attempt = this.commandAudits.finish(input.correlationId, this.options.role, {
+                class: input.class, effect: input.effect,
+                ...(input.exitCode === undefined ? {} : { exitCode: input.exitCode }),
+                ...(input.resourceIds ? { resourceIds: input.resourceIds } : {}),
+                ...(input.presentations ? { presentations: input.presentations } : {}),
+            });
+            if (attempt.outcome?.delivery === 'delivered')
+                return attempt;
+            if (attempt.outcome?.delivery === 'uncertain')
+                return attempt;
+            let uncertain = false;
+            try {
+                for (const event of attempt.outcome?.presentations ?? []) {
+                    try {
+                        await this.sendProactiveMessage(renderFleetLifecycleEvent(event), `fleet-lifecycle\0${lifecycleEventDigestBasis(event)}`, 0);
+                    }
+                    catch (error) {
+                        if (error instanceof DuplicateSendError) {
+                            if (error.status !== 'delivered')
+                                uncertain = true;
+                            this.options.log(`[${this.options.role}] duplicate Fleet lifecycle event suppressed`);
+                            continue;
+                        }
+                        throw error;
+                    }
+                }
+            }
+            catch (error) {
+                uncertain = true;
+                this.logError(`fleet lifecycle delivery uncertain correlation=${attempt.correlationId}`, error);
+            }
+            attempt = this.commandAudits.outcome(attempt.correlationId, this.options.role, uncertain ? 'uncertain' : 'delivered');
+            return attempt;
         });
         this.managementTail = run.then(() => undefined, () => undefined);
         return run;
     }
+    recover(epoch) {
+        if (this.stopping)
+            return Promise.reject(new Error('owner channel is stopping'));
+        if (this.recoveryEpoch === epoch && this.recoveryTask)
+            return this.recoveryTask;
+        this.recoveryEpoch = epoch;
+        this.ready = false;
+        const token = ++this.recoveryToken;
+        const watchGeneration = ++this.watchGeneration;
+        const staleWatch = this.watchTask;
+        this.watchTask = undefined;
+        this.watchAbort?.abort();
+        const superseded = () => this.stopping || token !== this.recoveryToken;
+        const now = this.options.recoveryDeps?.now ?? (() => Date.now());
+        const deadlineAt = now()
+            + (this.options.recoveryDeps?.deadlineMs ?? DAEMON_RECOVERY_DEADLINE_MS);
+        const run = this.managementTail.then(async () => {
+            if (superseded())
+                throw new Error('owner recovery epoch superseded');
+            if (this.recoveryQuiescence) {
+                const debt = this.recoveryQuiescence;
+                await this.recoveryStage('prior_quiescence', debt, deadlineAt);
+                if (this.recoveryQuiescence === debt)
+                    this.recoveryQuiescence = undefined;
+            }
+            // Quiesce every stale-client reader before replacing its transport. A
+            // watch can be inside the shared drain task when its abort lands.
+            await this.recoveryStage('stale_quiescence', Promise.all([
+                staleWatch?.catch(error => this.logError('stale watch shutdown failed', error)),
+                this.drainTask?.catch(error => this.logError('stale drain shutdown failed', error)),
+            ]), deadlineAt);
+            if (superseded())
+                throw new Error('owner recovery epoch superseded');
+            await this.recoveryStage('close', this.client.close(), deadlineAt);
+            if (superseded())
+                throw new Error('owner recovery epoch superseded');
+            try {
+                await this.recoveryStage('start', this.client.start(), deadlineAt);
+                if (superseded())
+                    throw new Error('owner recovery epoch superseded');
+                await this.recoveryStage('bind', this.client.bindIdentity(this.options.config.identity), deadlineAt);
+                if (superseded())
+                    throw new Error('owner recovery epoch superseded');
+                // Journal-aware drain is the only operation allowed to mark owner mail
+                // read. The final listing is a typed, read-only channel probe.
+                await this.recoveryStage('drain', this.drain(), deadlineAt);
+                await this.recoveryStage('list', this.client.listIncomingMessages(), deadlineAt);
+                if (superseded())
+                    throw new Error('owner recovery epoch superseded');
+                this.ready = true;
+                this.watchTask = this.watchLoop(watchGeneration);
+            }
+            catch (error) {
+                this.ready = false;
+                if (token === this.recoveryToken)
+                    this.recoveryToken++;
+                // A timed-out operation may still be using this client. Never overlap
+                // its disposal; the recorded quiescence debt gates the next retry.
+                if (!this.recoveryQuiescence) {
+                    try {
+                        await this.recoveryStage('close_after_failure', this.client.close(), deadlineAt);
+                    }
+                    catch (closeError) {
+                        this.logError('recovery client close failed', closeError);
+                    }
+                }
+                throw error;
+            }
+        });
+        this.managementTail = run.then(() => undefined, () => undefined);
+        const task = run.finally(() => {
+            if (this.recoveryTask === task)
+                this.recoveryTask = undefined;
+        });
+        this.recoveryTask = task;
+        return task;
+    }
+    recoveryStage(stage, operation, deadlineAt) {
+        const now = this.options.recoveryDeps?.now ?? (() => Date.now());
+        const remaining = Math.max(0, deadlineAt - now());
+        const setTimer = this.options.recoveryDeps?.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
+        const clearTimer = this.options.recoveryDeps?.clearTimer ?? (timer => clearTimeout(timer));
+        let timer;
+        const timeout = new Promise((_resolve, reject) => {
+            timer = setTimer(() => reject(new OwnerRecoveryTimeoutError(stage)), remaining);
+        });
+        return Promise.race([operation, timeout]).catch(error => {
+            if (error instanceof OwnerRecoveryTimeoutError) {
+                const debt = operation.then(() => undefined, () => undefined);
+                this.recoveryQuiescence = debt;
+            }
+            throw error;
+        }).finally(() => clearTimer(timer));
+    }
+    writeShutdownState(state, reason, at) {
+        try {
+            replaceFileAtomically(join(this.options.stateDir, '.owner-channel-shutdown.json'), JSON.stringify({ version: 1, state, reason, at: new Date(at).toISOString() }, null, 2) + '\n');
+        }
+        catch (error) {
+            this.logError('shutdown status write failed', error);
+        }
+    }
+    queueManagement(operation) {
+        const deferred = this.recoveryTask !== undefined && !this.ready;
+        if (!this.ready && !deferred)
+            return Promise.reject(!this.startedOnce || (this.stopping && !this.shutdownDegraded)
+                ? new Error('owner-channel MCP client is unavailable')
+                : new OwnerRecoveryDegradedError());
+        if (deferred && this.recoveryQueued >= OWNER_RECOVERY_QUEUE_CAPACITY)
+            return Promise.reject(new Error('owner recovery queue is full'));
+        if (deferred)
+            this.recoveryQueued++;
+        const run = this.managementTail.then(() => {
+            if (!this.ready || this.stopping)
+                throw new OwnerRecoveryDegradedError();
+            return operation();
+        });
+        this.managementTail = run.then(() => undefined, () => undefined);
+        return run.finally(() => {
+            if (deferred)
+                this.recoveryQueued = Math.max(0, this.recoveryQueued - 1);
+        });
+    }
     async manageNow(request) {
         if (!this.ready || this.stopping)
             throw new Error('owner-channel MCP client is unavailable');
@@ -989,6 +1216,7 @@ export class OwnerChannel {
      */
     async handleCommand(sender, text, wireId) {
         const ctx = {
+            authenticatedCid: sender.id,
             role: this.options.role,
             harness: this.options.harness,
             version: VERSION,
@@ -1054,6 +1282,18 @@ export class OwnerChannel {
             recentEvents: limit => this.options.session.eventsSince(0).slice(-limit),
             readWorklogTail: maxChars => this.readWorklogTail(maxChars),
             reply: async (replyText) => { await this.send(sender.id, replyText, wireId); },
+            replyHtml: async (filename, html) => {
+                const directory = join(this.options.stateDir, '.owner-channel-report-outbox', this.requestId(wireId));
+                const path = join(directory, filename);
+                await mkdir(directory, { recursive: true, mode: 0o700 });
+                try {
+                    await writeFile(path, html, { flag: 'wx', mode: 0o600 });
+                    await this.client.sendFile({ contact: sender.id, path, filename, replyToWireId: wireId });
+                }
+                finally {
+                    await rm(directory, { recursive: true, force: true });
+                }
+            },
         };
         try {
             await dispatchOwnerCommand(text, ctx);
@@ -1876,7 +2116,7 @@ export class OwnerChannel {
         }
         return undefined;
     }
-    async watchLoop() {
+    async watchLoop(generation) {
         const sleep = this.options.binderDeps?.sleep
             ?? (ms => new Promise(resolve => setTimeout(resolve, ms)));
         const restored = this.readWatchState();
@@ -1885,7 +2125,7 @@ export class OwnerChannel {
             state = this.writeWatchState(state, 'OWNER_WATCH_STATE_RECOVERED');
         let delayMs = 1_000;
         let attempts = 0;
-        while (!this.stopping) {
+        while (!this.stopping && generation === this.watchGeneration) {
             const ctrl = new AbortController();
             this.watchAbort = ctrl;
             try {
@@ -1895,12 +2135,12 @@ export class OwnerChannel {
                 // fall into a gap. Persistent history plus fleet's body-free claim
                 // journal is authoritative; durable wire-ID dedupe makes hints harmless.
                 await this.drain();
-                if (this.stopping)
+                if (this.stopping || generation !== this.watchGeneration)
                     return;
                 state = this.writeWatchState(state, 'OWNER_WATCH_CONNECTING', { reconnected: attempts > 0 });
                 attempts++;
                 for await (const _event of this.client.watchNotifications(this.options.config.identity, { since: 0, signal: ctrl.signal })) {
-                    if (this.stopping)
+                    if (this.stopping || generation !== this.watchGeneration)
                         return;
                     state = this.writeWatchState(state, 'OWNER_WATCH_CONNECTED', { resetFailures: true });
                     delayMs = 1_000;
@@ -1909,11 +2149,11 @@ export class OwnerChannel {
                     // recorded before a managed request is dispatched.
                     await this.drain();
                 }
-                if (!this.stopping)
+                if (!this.stopping && generation === this.watchGeneration)
                     throw new Error('ours SDK notification stream ended');
             }
             catch (error) {
-                if (this.stopping)
+                if (this.stopping || generation !== this.watchGeneration)
                     return;
                 // SDK 2 deliberately hides transport status behind its typed stream.
                 // Do not parse error prose to rediscover it: every failure follows the

package/dist/owner-channel/commands.d.ts

@@ -25,6 +25,7 @@ export interface OwnerFleetOps {
  * cannot name another agent or another recipient.
  */
 export interface OwnerCommandContext {
+    authenticatedCid?: string;
     role: string;
     /** Harness id of the role (e.g. 'claude-code', 'codex'); gates forwarding. */
     harness: string;
@@ -94,6 +95,7 @@ export interface OwnerCommandContext {
     recentEvents(limit: number): SessionEvent[];
     readWorklogTail(maxChars: number): Promise<string | undefined>;
     reply(text: string): Promise<void>;
+    replyHtml(filename: string, html: string): Promise<void>;
 }
 export interface OwnerCommand {
     /** Primary name without the leading slash. */

package/dist/owner-channel/commands.js

@@ -6,6 +6,16 @@ import { markdownCode, markdownProse, renderMarkdownFailure, renderMarkdownList,
 import { OWNER_COMMENT_LABEL, ownerNotices } from './notices.js';
 import { TaskRoomApplicationError } from '../application/task-room-service.js';
 import { TaskListError } from '../rooms-tasks/task-lists.js';
+import { createTasksReport } from '../reports/index.js';
+async function ownerTaskReport(ctx) {
+    return createTasksReport({
+        viewer: { surface: 'messenger', authenticatedCid: ctx.authenticatedCid ?? 'owner-command-context', roomCids: [] },
+        collect: () => {
+            return { lists: ctx.listTaskLists(), tasks: ctx.listTasks() };
+        },
+        source: { name: 'ours-fleet', version: ctx.version },
+    });
+}
 /** A malformed invocation; the dispatcher answers it with annotated help. */
 class OwnerCommandUsageError extends Error {
 }
@@ -242,10 +252,18 @@ export const ownerCommands = [
         execute: noArgs('/version', async (ctx) => ctx.reply(`ℹ️ ours-fleet ${ctx.version}`)),
     },
     {
-        name: 'tasks', usage: '/tasks [state]',
-        summary: 'list tasks (optionally filter by state)',
+        name: 'tasks', usage: '/tasks [state|html]',
+        summary: 'list tasks, or attach the HTML report with /tasks html',
         execute: async (ctx, args) => {
             const stateFilter = args?.trim() || undefined;
+            if (stateFilter === 'html') {
+                const artifact = await ownerTaskReport(ctx);
+                await ctx.replyHtml(artifact.metadata.filename, artifact.html);
+                await ctx.reply(`HTML report attached: ${artifact.metadata.filename}`);
+                return;
+            }
+            if (stateFilter && /\s/u.test(stateFilter))
+                throw new OwnerCommandUsageError('usage: /tasks [state|html]');
             const tasks = ctx.listTasks(stateFilter && stateFilter !== 'all' ? { state: stateFilter } : undefined);
             await ctx.reply(renderMarkdownList({
                 icon: '📋', title: 'Tasks', empty: 'No tasks found.',
@@ -309,6 +327,9 @@ export const ownerCommands = [
                         break;
                     }
                     case 'list': {
+                        if (rest.some(value => value.startsWith('--')
+                            && value !== '--group-by-list' && !value.startsWith('--list=')))
+                            throw new OwnerCommandUsageError('usage: /task list [state] [--list=<name>] [--group-by-list]');
                         const listFlag = rest.find(r => r.startsWith('--list='));
                         const list = trailingLines ?? listFlag?.slice('--list='.length);
                         const grouped = rest.includes('--group-by-list');
@@ -345,6 +366,8 @@ export const ownerCommands = [
                         break;
                     }
                     case 'lists': {
+                        if (rest.length || trailingLines)
+                            throw new OwnerCommandUsageError('usage: /task lists');
                         const lists = ctx.listTaskLists();
                         await ctx.reply(renderMarkdownList({ icon: '📚', title: 'Task lists', empty: 'No task lists found.',
                             records: lists.map(list => `${markdownCode(list.name)}${list.built_in ? ' — built-in' : ''}`) }));
@@ -388,7 +411,7 @@ export const ownerCommands = [
                         break;
                     }
                     case 'show': {
-                        if (!rest[0])
+                        if (rest.length !== 1 || rest[0].startsWith('--'))
                             throw new OwnerCommandUsageError('usage: /task show <id>');
                         await showTask(rest[0]);
                         break;
@@ -598,10 +621,7 @@ export const ownerCommands = [
             const templates = ctx.listTemplateQueries();
             if (!templates.length)
                 return ctx.reply('📐 No templates.');
-            const lines = templates.map(t => {
-                const tag = t.builtin ? ' (built-in)' : '';
-                return `${t.name}@${t.version}${tag}  ${t.description}`;
-            });
+            const lines = templates.map(t => `${t.name}@${t.version}  ${t.description}  [file: ${t.sourceFile ?? 'manifest'}]`);
             await ctx.reply(`📐 Templates:\n${lines.join('\n')}`);
         }),
     },
@@ -627,10 +647,11 @@ export const ownerCommands = [
                 const lines = [
                     `📐 Template: ${t.name}@${t.version}`,
                     `Description: ${t.description}`,
-                    ...(t.builtin ? ['Source: built-in'] : []),
+                    `Source: ${t.sourceFile ?? 'manifest'}`,
                     ...(t.contract ? [`Contract: ${t.contract}`] : []),
                     'Members:',
-                    ...t.members.map(m => `  ${m.slot} (${m.role}) ×${m.count} → role_ref: ${m.role_ref}`),
+                    ...t.members.map(m => `  ${m.slot} (${m.role}) ×${m.count} → `
+                        + `${'ref' in m.agent ? `Agent ref: ${m.agent.ref}` : 'inline Agent'}`),
                 ];
                 await ctx.reply(lines.join('\n'));
             };
@@ -645,10 +666,7 @@ export const ownerCommands = [
                     const templates = ctx.listTemplateQueries();
                     if (!templates.length)
                         return ctx.reply('📐 No templates.');
-                    const lines = templates.map(t => {
-                        const tag = t.builtin ? ' (built-in)' : '';
-                        return `${t.name}@${t.version}${tag}  ${t.description}`;
-                    });
+                    const lines = templates.map(t => `${t.name}@${t.version}  ${t.description}  [file: ${t.sourceFile ?? 'manifest'}]`);
                     await ctx.reply(`📐 Templates:\n${lines.join('\n')}`);
                     break;
                 }

package/dist/owner-channel/state.d.ts

@@ -1,5 +1,7 @@
 /** A send whose (dedupe-scoped) digest was already recorded: it must not repeat. */
 export declare class DuplicateSendError extends Error {
+    readonly status: OwnerProactiveSend['status'];
+    constructor(status: OwnerProactiveSend['status']);
 }
 /** Durable bounded dedupe containing wire IDs only — never message or reply plaintext. */
 export declare class OwnerChannelState {

package/dist/owner-channel/state.js

@@ -5,6 +5,11 @@ import { replaceFileAtomically } from '../atomic-file.js';
 import { canonicalCid } from '../config.js';
 /** A send whose (dedupe-scoped) digest was already recorded: it must not repeat. */
 export class DuplicateSendError extends Error {
+    status;
+    constructor(status) {
+        super('duplicate proactive owner message refused');
+        this.status = status;
+    }
 }
 /** Durable bounded dedupe containing wire IDs only — never message or reply plaintext. */
 export class OwnerChannelState {
@@ -184,8 +189,9 @@ export class OwnerConversationState {
         // 'all' scope serves wire-keyed idempotency: a crash replay must not
         // deliver the same wire to a second owner after the route moved.
         const scope = dedupe === 'all' ? this.sends : recent;
-        if (scope.some(send => send.digest === digest))
-            throw new DuplicateSendError('duplicate proactive owner message refused');
+        const duplicate = scope.find(send => send.digest === digest);
+        if (duplicate)
+            throw new DuplicateSendError(duplicate.status);
         const last = recent.at(-1);
         if (last && now - last.at < minIntervalMs)
             throw new Error(`proactive owner messages are rate-limited to one every ${minIntervalMs}ms`);

package/dist/preset-bootstrap.d.ts

@@ -0,0 +1,10 @@
+export interface BootstrapResult {
+    revision: number;
+    sourceRoot: string;
+    configPath: string;
+    created: string[];
+    preserved: string[];
+}
+export declare const packagedPresetRoot: () => string;
+/** Seed packaged defaults without replacing a single existing byte. */
+export declare function bootstrapPresets(configuration?: string): BootstrapResult;