@ours.network/fleet 1.1.0-nightly.12 → 1.1.0-nightly.13

package/dist/rooms-tasks/launch-snapshot.d.ts

@@ -8,3 +8,12 @@ export declare function sealLaunchSnapshot(definitions: Record<string, AgentTemp
 export declare function readLaunchSnapshot(hash: string): Record<string, AgentTemplateDefinition>;
 /** Delete a sealed snapshot only after no retained Task/Room record references it. */
 export declare function releaseLaunchSnapshot(hash: string): void;
+/**
+ * Deletion-finalization variant: the caller already holds the global
+ * launch-snapshot lock and is about to unlink the deletion-pending task
+ * `taskId`. The reference scan excludes exactly that task file — every other
+ * retained Task/Room reference still protects the snapshot. Deleting the
+ * snapshot BEFORE the task unlink keeps every crash seam recoverable: the
+ * hidden intent survives, and a retry sees the snapshot already absent.
+ */
+export declare function releaseLaunchSnapshotForDeletingTask(hash: string, taskId: string): void;

package/dist/rooms-tasks/launch-snapshot.js

@@ -68,12 +68,14 @@ export function acquireLaunchSnapshotLock(options = {}) {
         }
     }
 }
-function referencedByRetainedState(hash) {
+function referencedByRetainedState(hash, excludeTaskFile) {
     for (const directory of ['tasks', 'rooms']) {
         const root = join(stateRoot(), directory);
         if (!existsSync(root))
             continue;
         for (const name of readdirSync(root).filter(entry => entry.endsWith('.json'))) {
+            if (directory === 'tasks' && excludeTaskFile !== undefined && name === excludeTaskFile)
+                continue;
             try {
                 if (readFileSync(join(root, name), 'utf8').includes(hash))
                     return true;
@@ -157,3 +159,18 @@ export function releaseLaunchSnapshot(hash) {
         release();
     }
 }
+/**
+ * Deletion-finalization variant: the caller already holds the global
+ * launch-snapshot lock and is about to unlink the deletion-pending task
+ * `taskId`. The reference scan excludes exactly that task file — every other
+ * retained Task/Room reference still protects the snapshot. Deleting the
+ * snapshot BEFORE the task unlink keeps every crash seam recoverable: the
+ * hidden intent survives, and a retry sees the snapshot already absent.
+ */
+export function releaseLaunchSnapshotForDeletingTask(hash, taskId) {
+    if (referencedByRetainedState(hash, `${taskId}.json`))
+        return;
+    const path = launchSnapshotPath(hash);
+    if (existsSync(path))
+        unlinkSync(path);
+}

package/dist/rooms-tasks/provision.js

@@ -1,15 +1,21 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { join } from 'node:path';
 import { parse } from 'yaml';
 import { advanceSaga, setSagaError, updateMemberSeats, updateMemberStartup, activateRoom, getRoomRecord, } from './room-state.js';
 import { activateTask, updateTaskMembers, blockTask, unblockTask, getTask, } from './task-state.js';
 import { spawnTemp } from '../spawn.js';
+import { effectivePermissionMode } from '../permissions.js';
+import { selectionOrigin, summarizeResolvedLaunch, } from '../lifecycle-summary.js';
 import { canonicalJson } from '../canonical-json.js';
 import { readLaunchSnapshot, redactLaunchDefinition } from './launch-snapshot.js';
 import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, } from '../fleet-proxy.js';
 import { controlRequest } from '../session/control.js';
 import { SessionControlError } from '../session/types.js';
 import { closeManagedRoom } from './close.js';
+import { withFileLock } from '../atomic-file.js';
+import { TASK_OPERATION_LOCK_STALE_MS, taskOperationLockPath } from './terminal.js';
+import { TaskStateError, taskDeletionState } from './task-state.js';
 import { buildRoomMemberTask, sha256Text } from './member-startup.js';
 import { agentDir } from '../paths.js';
 import { readProvenance } from '../creation.js';
@@ -60,8 +66,27 @@ async function spawnRoomMember(options, binPath) {
         statePath: result.statePath,
         creationActionId: result.creationActionId,
         callerRole: result.caller,
+        ...(result.configuration ? { configuration: result.configuration } : {}),
     };
 }
+/**
+ * Launch-boundary capture: the exact ResolvedRole the spawn persisted,
+ * whitelisted into the operator-facing presentation. Capture is required for
+ * every launched room member — launchMatches has already proved role.yaml
+ * readable, and effectivePermissionMode is total over registered harnesses —
+ * so a failure here is a capture defect and must surface, not degrade to the
+ * legacy rendering.
+ */
+function presentationFromStatePath(statePath, settings, coworkRole) {
+    const resolved = parse(readFileSync(join(statePath, 'role.yaml'), 'utf8'));
+    return summarizeResolvedLaunch(resolved, {
+        role: selectionOrigin(settings.definition.role),
+        brain: selectionOrigin(settings.definition.brain),
+        template: settings.template,
+        permissionMode: effectivePermissionMode(resolved),
+        missionFallback: coworkRole,
+    });
+}
 function shortId(id) { return id.slice(0, 8); }
 function expandMembers(template, prefix) {
     const result = [];
@@ -139,7 +164,7 @@ function launchMatches(dir, member, actionId, taskSha, roomId, roomIdentityCid,
     }
 }
 async function retainRunningLaunch(input) {
-    const { provision, member, task, roomIdentityCid } = input;
+    const { provision, member, settings, task, roomIdentityCid } = input;
     let seat = getRoomRecord(provision.roomId).member_seats
         .find(candidate => candidate.role_name === member.name);
     const dir = agentDir(member.name, true);
@@ -171,9 +196,14 @@ async function retainRunningLaunch(input) {
             throw new Error(`existing launch for ${member.name} has unknown liveness`);
         const retainedLaunch = seat.launch;
         if (live === 'running') {
+            // A crash between spawn and the seat update (or a pre-upgrade launch)
+            // can retain a running member without a captured presentation; backfill
+            // it from the same persisted resolved role the match was proved against.
+            const presentation = retainedLaunch.presentation
+                ?? presentationFromStatePath(dir, settings, member.coworkRole);
             updateMemberStartup(provision.roomId, member.name, { launch: {
                     ...retainedLaunch, state: 'launched', launch_id: supervisor.launchId,
-                    updated_at: new Date().toISOString(),
+                    presentation, updated_at: new Date().toISOString(),
                 } });
             return true;
         }
@@ -210,7 +240,25 @@ async function retainRunningLaunch(input) {
     }
     return false;
 }
+/**
+ * Member-launch publication window: for a task-bound room, the durable launch
+ * intent, spawn, and launch record publish under the common task-operation
+ * lock so an accepted deletion linearizes strictly before (bounded abort — no
+ * spawn happens) or strictly after (the seat's launch record is visible to
+ * deletion retirement). The lock is held per member only, never across
+ * seat-wait loops.
+ */
 async function launchMember(input) {
+    const taskId = input.provision.taskId;
+    if (!taskId)
+        return launchMemberUnlocked(input);
+    return withFileLock(taskOperationLockPath(taskId), () => {
+        if (taskDeletionState(taskId) !== 'none')
+            throw new Error(`task ${taskId} is pending deletion; aborting member launch for ${input.member.name}`);
+        return launchMemberUnlocked(input);
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+}
+async function launchMemberUnlocked(input) {
     const { provision, member, settings, startup } = input;
     const seat = getRoomRecord(provision.roomId).member_seats
         .find(candidate => candidate.role_name === member.name);
@@ -255,18 +303,25 @@ async function launchMember(input) {
         if (!supervisor || supervisor.role !== member.name || !launchMatches(launchedDir, member, launched.creationActionId, taskSha, provision.roomId, startup.room_identity_cid, startup.invite_id)) {
             throw new Error(`new launch for ${member.name} did not persist matching provenance`);
         }
+        const presentation = launched.configuration
+            ? { ...launched.configuration, template: settings.template,
+                ...(launched.configuration.mission ? {} : { mission: member.coworkRole }) }
+            : presentationFromStatePath(launchedDir, settings, member.coworkRole);
         updateMemberStartup(provision.roomId, member.name, { launch: {
                 state: 'launched', attempt, action_id: launched.creationActionId, mission_sha256: taskSha,
                 agent_definition: agentDefinition, agent_fingerprint: agentFingerprint,
                 agent_template: settings.template, agent_template_hash: settings.templateHash,
+                presentation,
                 ...(launched.callerRole ? { caller_role: launched.callerRole } : {}),
                 launch_id: supervisor.launchId, updated_at: new Date().toISOString(),
             } });
         recordFleetAuditPresentation({ kind: 'agent_started', id: member.name, name: member.name,
             lifetime: 'temporary', brain: selectionSummary(settings.definition.brain),
-            role: selectionSummary(settings.definition.role), harness: 'resolved', session: 'acp',
+            role: selectionSummary(settings.definition.role),
+            harness: presentation.harness, session: 'acp',
             permissions: permissionSummary(settings.definition), parent: provision.roomId,
-            actionId: launched.creationActionId, inherited: [] });
+            actionId: launched.creationActionId, inherited: [],
+            configuration: presentation });
     }
     catch (error) {
         updateMemberStartup(provision.roomId, member.name, { launch: {
@@ -318,6 +373,9 @@ function reconcileMemberSeats(roomId, members, observed) {
 }
 export async function provisionMembers(input) {
     const { cfg, cowork, roomId, taskId, template } = input;
+    // Deletion-epoch pre-check; each member launch re-checks under the lock.
+    if (taskId && taskDeletionState(taskId) !== 'none')
+        throw new Error(`task ${taskId} is pending deletion; refusing to provision members`);
     const prefix = taskId ? shortId(taskId) : `room-${shortId(roomId)}`;
     const members = expandMembers(template, prefix);
     // Resolve every Agent before persisting launch intent or touching Cowork membership.
@@ -376,13 +434,15 @@ export async function provisionMembers(input) {
                 .find(seat => seat.role_name === member.name);
             if (currentSeat.seat_state === 'active') {
                 if (!await retainRunningLaunch({
-                    provision: input, member, task, roomIdentityCid,
+                    provision: input, member, settings: settings.get(member.name), task, roomIdentityCid,
                 })) {
                     throw new Error(`active Cowork seat ${member.name} has no matching live Fleet launch`);
                 }
                 continue;
             }
-            if (await retainRunningLaunch({ provision: input, member, task, roomIdentityCid }))
+            if (await retainRunningLaunch({
+                provision: input, member, settings: settings.get(member.name), task, roomIdentityCid,
+            }))
                 continue;
             const issued = await cowork.issueInvite(roomId, {
                 mode: 'one_time', role: member.coworkRole, min_accepts: 1,
@@ -415,8 +475,17 @@ export async function provisionMembers(input) {
     catch (error) {
         const reason = error instanceof Error ? error.message : String(error);
         setSagaError(roomId, reason, 'Member invite or launch failed. Retry with `task recover`.', 'member_failed');
-        if (taskId)
-            blockTask(taskId, reason);
+        if (taskId) {
+            // A deletion-pending (or already-terminal) task rejects the block
+            // overlay; the original launch failure must still propagate.
+            try {
+                blockTask(taskId, reason);
+            }
+            catch (blockError) {
+                if (!(blockError instanceof TaskStateError))
+                    throw blockError;
+            }
+        }
         throw error;
     }
     advanceSaga(roomId, 'wait_seats', 5);

package/dist/rooms-tasks/task-state.d.ts

@@ -1,7 +1,12 @@
-import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent } from './types.js';
+import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent, TaskDeletionActor, TaskDeletionMemberPhase } from './types.js';
 export declare const tasksDir: () => string;
 export declare class TaskStateError extends Error {
 }
+/**
+ * Accepted deletion is the per-task epoch guard: once pending, every lifecycle
+ * mutation, terminal settlement, and room publication must fail boundedly.
+ */
+export declare function assertNoPendingDeletion(task: TaskRecord): void;
 export interface CreateTaskInput {
     title: string;
     brief?: string;
@@ -21,6 +26,7 @@ export declare function updateTaskExecutionPlan(id: string, executionPlan: NonNu
 export declare function listTasks(filter?: {
     state?: TaskState | TaskState[];
     listId?: string;
+    includeDeleting?: boolean;
 }): TaskRecord[];
 export declare function moveTaskToList(id: string, listId: string): TaskRecord;
 export declare function findByIdempotencyKey(key: string): TaskRecord | undefined;
@@ -45,5 +51,109 @@ export declare function failTask(id: string, error: string): TaskRecord;
 export declare function updateTaskRoom(id: string, roomId: string, roomIdentityCid: string): TaskRecord;
 export declare function updateTaskTemplate(id: string, template: TaskTemplateRef): TaskRecord;
 export declare function updateTaskMembers(id: string, members: TaskMemberRole[]): TaskRecord;
-/** Remove a completed task from Fleet's backlog. Missing tasks are an idempotent no-op. */
-export declare function deleteTask(id: string): boolean;
+/**
+ * Lenient read for deletion settlement and status surfaces: a broken list
+ * reference must never make a task unreadable or undeletable. Missing records
+ * throw the canonical task-not-found error; other read failures propagate.
+ */
+export declare function getDeletingTask(id: string): TaskRecord;
+/** Cheap durable deletion-epoch probe for room/member publication guards. */
+export declare function taskDeletionState(id: string): 'none' | 'pending' | 'absent';
+/**
+ * Durable, surface-independent audit evidence for a permanent deletion. The
+ * receipt outlives the task record: written with the acceptance intent, and
+ * completed before settlement is reported. Metadata only — never brief or
+ * room content.
+ */
+export interface TaskDeletionReceipt {
+    schema_version: 1;
+    task_id: string;
+    title: string;
+    accepted_at: string;
+    actor: TaskDeletionActor;
+    original_state: TaskState;
+    room_id?: string;
+    member_count: number;
+    settled_at?: string;
+    result?: 'deleted';
+}
+export declare const deletionReceiptsDir: () => string;
+export declare function readTaskDeletionReceipt(id: string): TaskDeletionReceipt | undefined;
+/**
+ * Ensure the acceptance receipt exists before any cleanup side effect,
+ * backfilling it from the durable intent (heals a crash between the intent
+ * write and the receipt write). Fails closed: a receipt write error aborts
+ * settlement rather than deleting resources without audit evidence.
+ */
+export declare function ensureTaskDeletionReceipt(id: string): void;
+/** Record settlement on the receipt; idempotent, tolerant of legacy absence. */
+export declare function completeTaskDeletionReceipt(id: string): void;
+export type TaskDeletionAcceptance = {
+    status: 'accepted' | 'pending';
+    task: TaskRecord;
+} | {
+    status: 'already_absent';
+};
+/**
+ * Persist the first-wins durable deletion intent. Accepts every lifecycle
+ * state, takes precedence over a pending terminal intent, and never touches
+ * remote resources. Repeat requests while pending re-arm settlement; a request
+ * for a missing record reports the idempotent already-absent outcome.
+ *
+ * Low-level record mutation only. Callers serialize acceptance with settlement
+ * through deletion.ts, which holds the common task-operation lock.
+ */
+export declare function beginTaskDeletionIntent(id: string, actor: TaskDeletionActor): TaskDeletionAcceptance;
+/** Record an actionable settlement failure; the task stays hidden and recoverable. */
+export declare function setTaskDeletionError(id: string, error: string, recoveryHint: string): TaskRecord;
+/** Marker proving a member never launched, mirroring close.ts's short path. */
+export declare const DELETION_MEMBER_NEVER_LAUNCHED = "never-launched";
+/** Marker proving absence verified against temp state AND the CID-wide identity scan. */
+export declare const DELETION_MEMBER_ABSENT_VERIFIED = "absent-verified";
+/**
+ * Advance a member retirement cursor carried by the deletion intent. Only
+ * adjacent forward transitions are legal — plus the explicit
+ * pending → identity_absent short path proved by the 'never-launched' marker —
+ * so no managed agent can be claimed retired without the full evidence chain.
+ * launch_id and archive_path are immutable once recorded; same-phase retries
+ * are idempotent but must not change evidence.
+ */
+export declare function advanceTaskDeletionMember(id: string, name: string, phase: TaskDeletionMemberPhase, launchId?: string, archivePath?: string): TaskRecord;
+interface SeatEvidence {
+    role_name: string;
+    identity_cid?: string;
+    retirement?: {
+        phase: TaskDeletionMemberPhase;
+        launch_id: string;
+        archive_path?: string;
+    };
+}
+/**
+ * Durably register cursors for late-provisioned members before retirement
+ * begins: provisioning publishes room seats before updateTaskMembers, so the
+ * acceptance snapshot can be empty while live seats exist. Seats without a
+ * recorded identity CID are not registered here — until a CID is recorded
+ * there is no managed identity to orphan, and the room record still carries
+ * those seats through the close saga that follows.
+ */
+export declare function upsertTaskDeletionMembersFromSeats(id: string, seats: ReadonlyArray<SeatEvidence>): TaskRecord;
+/**
+ * The pre-room-delete checkpoint: import completed retirement evidence from
+ * room seats into the deletion cursors, so a crash between room-record
+ * deletion and task unlink retries from durable cursors instead of
+ * reconstructing consumed evidence. Call ONLY after closeManagedRoom has
+ * completed retirement and BEFORE cowork.deleteRoom/deleteRoomRecord.
+ *
+ * The room saga is trusted for phase jumps, but partial or corrupt retained
+ * records must not become false success: every seat must be identity_absent;
+ * a real launch requires archive evidence; an identity-less seat is accepted
+ * only via the never-launched proof.
+ */
+export declare function importTaskDeletionRetirementEvidence(id: string, seats: ReadonlyArray<SeatEvidence>): TaskRecord;
+/**
+ * Physically remove a deletion-pending task record. Settlement-only: callers
+ * must have completed member retirement and room cleanup first. Missing
+ * records are the idempotent already-settled outcome.
+ */
+export declare function unlinkDeletedTask(id: string): boolean;
+export {};