@ours.network/fleet 1.1.0-nightly.2 → 1.1.0-nightly.21

package/dist/rooms-tasks/close.d.ts

@@ -1,5 +1,6 @@
 import { withFileLock } from '../atomic-file.js';
-import type { CoworkAdapter } from './cowork-adapter.js';
+import { type TempLifecycleDeps } from '../temp-lifecycle.js';
+import { type CoworkAdapter } from './cowork-adapter.js';
 import type { RoomMemberSeat, RoomOrchestrationRecord } from './types.js';
 export interface RoomCloseDeps {
     inspectMember?(seat: RoomMemberSeat): Promise<{
@@ -11,6 +12,13 @@ export interface RoomCloseDeps {
     removeIdentity?(seat: RoomMemberSeat): Promise<void>;
     lock?: typeof withFileLock;
 }
+export declare function inspectMember(seat: RoomMemberSeat): Promise<{
+    launchId: string;
+}>;
+export declare function waitForLivenessAbsent(role: string, launchId: string, lifecycleDeps?: TempLifecycleDeps): Promise<void>;
+/** Report whether any daemon identity — under any name — carries this exact CID. */
+export declare function identityCidPresent(cid: string): Promise<boolean>;
+export declare function removeExactMemberIdentity(seat: RoomMemberSeat): Promise<void>;
 /** One forward-only room close saga shared by every Fleet entry point. */
 export declare function acceptManagedRoomClose(roomId: string): Promise<RoomOrchestrationRecord>;
 export declare function recordManagedRoomCloseError(roomId: string, error: string, recoveryHint: string): Promise<RoomOrchestrationRecord>;

package/dist/rooms-tasks/close.js

@@ -5,6 +5,7 @@ import { attachOursClient } from '@ours.network/sdk/client';
 import { withFileLock } from '../atomic-file.js';
 import { agentDir, stateRoot } from '../paths.js';
 import { readTempSupervisor, secureStoppedTempArchive, stopTempSupervisor, tempSupervisorLiveness, } from '../temp-lifecycle.js';
+import { CoworkProtocolError } from './cowork-adapter.js';
 import { advanceMemberRetirement, advanceRoomClose, beginRoomClose, closeRoom, deleteRoomRecord, getRoomRecord, listRoomRecords, setRoomCloseError, } from './room-state.js';
 const CLOSE_LOCK_STALE_MS = 5 * 60_000;
 const STOP_POLLS = 50;
@@ -26,7 +27,7 @@ function exactMemberIdentity(seat) {
         throw new Error(`room member '${seat.role_name}' temp state binds identity '${identity}'; refusing mismatched retirement`);
     }
 }
-async function inspectMember(seat) {
+export async function inspectMember(seat) {
     exactMemberIdentity(seat);
     const supervisor = readTempSupervisor(agentDir(seat.role_name, true));
     if (!supervisor || supervisor.role !== seat.role_name) {
@@ -34,7 +35,7 @@ async function inspectMember(seat) {
     }
     return { launchId: supervisor.launchId };
 }
-async function waitForLivenessAbsent(role, launchId, lifecycleDeps = {}) {
+export async function waitForLivenessAbsent(role, launchId, lifecycleDeps = {}) {
     const dir = agentDir(role, true);
     const sleep = lifecycleDeps.sleep ?? ((ms) => new Promise(resolve => setTimeout(resolve, ms)));
     for (let attempt = 0; attempt < STOP_POLLS; attempt++) {
@@ -68,7 +69,14 @@ async function withIdentityClient(work) {
 function listedIdentity(rows, name) {
     return rows.find(row => row.name === name);
 }
-async function removeExactMemberIdentity(seat) {
+/** Report whether any daemon identity — under any name — carries this exact CID. */
+export async function identityCidPresent(cid) {
+    return withIdentityClient(async (client) => {
+        const rows = await client.listIdentities();
+        return rows.some(row => row.cid?.toLowerCase() === cid.toLowerCase());
+    });
+}
+export async function removeExactMemberIdentity(seat) {
     await withIdentityClient(async (client) => {
         const before = listedIdentity(await client.listIdentities(), seat.role_name);
         if (!before)
@@ -172,7 +180,15 @@ export async function closeManagedRoom(input) {
 export async function deleteLegacyClosedRooms(input) {
     const deleted = [];
     for (const room of listRoomRecords({ state: 'closed' })) {
-        await input.cowork.deleteRoom(room.room_id);
+        try {
+            await input.cowork.deleteRoom(room.room_id);
+        }
+        catch (error) {
+            // The retained Fleet record is the legacy state being migrated. If the
+            // exact Cowork room is already absent, the desired deletion is complete.
+            if (!(error instanceof CoworkProtocolError && error.code === 'not_found'))
+                throw error;
+        }
         deleteRoomRecord(room.room_id);
         deleted.push(room.room_id);
     }

package/dist/rooms-tasks/config.js

@@ -1,7 +1,6 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
-import { ROOMS_KEYS as RK, ROOMS_OWNER_KEYS as ROK, ROOMS_COWORK_KEYS as RCK, ROOMS_DEFAULTS_KEYS as RDK, TASKS_KEYS as TK, TEMPLATE_KEYS as TPK, TEMPLATE_MEMBER_KEYS as TMK, TEMPLATE_OVERRIDE_KEYS as TOK, } from './types.js';
-import { BUILTIN_TEMPLATES } from './templates.js';
+import { ROOMS_KEYS as RK, ROOMS_OWNER_KEYS as ROK, ROOMS_COWORK_KEYS as RCK, ROOMS_DEFAULTS_KEYS as RDK, TASKS_KEYS as TK, TEMPLATE_KEYS as TPK, TEMPLATE_MEMBER_KEYS as TMK, TEMPLATE_ROOM_KEYS as TRK, } from './types.js';
 const isPlainObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
 const CID_RE = /^[0-9a-fA-F]{64}$/;
 export class RoomsTasksConfigError extends Error {
@@ -116,9 +115,6 @@ export function validateRoomTemplatesConfig(raw, path) {
         if (!isPlainObject(tplRaw))
             throw new RoomsTasksConfigError(path, `room_templates.${name}: must be a mapping`);
         rejectUnknown(tplRaw, [...TPK, 'name'], path, `room_templates.${name}`);
-        const isBuiltinOverride = BUILTIN_TEMPLATES.some(b => b.name === name);
-        if (isBuiltinOverride && !tplRaw.override_builtin)
-            throw new RoomsTasksConfigError(path, `room_templates.${name}: overrides built-in template; set override_builtin: true and bump version`);
         const version = tplRaw.version;
         if (version === undefined || !Number.isInteger(version) || version < 1)
             throw new RoomsTasksConfigError(path, `room_templates.${name}.version: required positive integer`);
@@ -136,25 +132,31 @@ export function validateRoomTemplatesConfig(raw, path) {
                 throw new RoomsTasksConfigError(path, `room_templates.${name}.members[${i}].role: required string`);
             if (!Number.isInteger(m.count) || m.count < 1)
                 throw new RoomsTasksConfigError(path, `room_templates.${name}.members[${i}].count: required positive integer`);
-            if (!m.role_ref || typeof m.role_ref !== 'string')
-                throw new RoomsTasksConfigError(path, `room_templates.${name}.members[${i}].role_ref: required string`);
-            if (m.overrides !== undefined) {
-                if (!isPlainObject(m.overrides))
-                    throw new RoomsTasksConfigError(path, `room_templates.${name}.members[${i}].overrides: must be a mapping`);
-                rejectUnknown(m.overrides, TOK, path, `room_templates.${name}.members[${i}].overrides`);
-            }
+            if (m.agent !== undefined)
+                throw new RoomsTasksConfigError(path, `room_templates.${name}.members[${i}].agent: persistent Agent references are no longer allowed; use agent_template: <ID>`);
+            if (typeof m.agent_template !== 'string' || !m.agent_template.trim())
+                throw new RoomsTasksConfigError(path, `room_templates.${name}.members[${i}].agent_template: required non-blank Agent Template ID`);
             return {
                 slot: m.slot,
                 role: m.role,
                 count: m.count,
-                role_ref: m.role_ref,
-                overrides: m.overrides,
+                agent_template: m.agent_template,
             };
         });
+        const slots = new Set();
+        for (const member of members) {
+            if (slots.has(member.slot))
+                throw new RoomsTasksConfigError(path, `room_templates.${name}.members: duplicate slot '${member.slot}'`);
+            slots.add(member.slot);
+        }
         let room;
         if (tplRaw.room !== undefined) {
             if (!isPlainObject(tplRaw.room))
                 throw new RoomsTasksConfigError(path, `room_templates.${name}.room: must be a mapping`);
+            rejectUnknown(tplRaw.room, TRK, path, `room_templates.${name}.room`);
+            for (const key of TRK)
+                if (tplRaw.room[key] !== undefined && typeof tplRaw.room[key] !== 'boolean')
+                    throw new RoomsTasksConfigError(path, `room_templates.${name}.room.${key}: must be a boolean`);
             room = {
                 quiet_membership: tplRaw.room.quiet_membership,
                 anonymous: tplRaw.room.anonymous,

package/dist/rooms-tasks/cowork-adapter.d.ts

@@ -33,6 +33,7 @@ export interface CoworkRoomInfo {
     identity_cid: string;
     room_name: string;
     state: 'provisioning' | 'active' | 'closing' | 'closed';
+    anonymous: boolean;
     seats: CoworkSeatInfo[];
     goal?: string;
     briefing?: string;

package/dist/rooms-tasks/cowork-adapter.js

@@ -47,6 +47,11 @@ function roomState(value, operation) {
         throw new CoworkProtocolError(operation, 'room state is invalid');
     return value;
 }
+function boolean(value, operation, label) {
+    if (typeof value !== 'boolean')
+        throw new CoworkProtocolError(operation, `${label} must be a boolean`);
+    return value;
+}
 function seatState(value, operation) {
     if (value !== 'pending' && value !== 'active' && value !== 'removed')
         throw new CoworkProtocolError(operation, 'seat state is invalid');
@@ -86,6 +91,7 @@ function projectRoom(value, operation) {
         identity_cid: text(room.identity_cid, operation, 'room.identity_cid'),
         room_name: string(room.room_name, operation, 'room.room_name'),
         state: roomState(room.state, operation),
+        anonymous: room.anonymous === undefined ? false : boolean(room.anonymous, operation, 'room.anonymous'),
         seats: room.seats.map((seat) => projectSeat(seat, operation)),
         role_briefings: projectedBriefings,
         ...(typeof mission?.goal === 'string' ? { goal: mission.goal } : {}),

package/dist/rooms-tasks/deletion.d.ts

@@ -0,0 +1,51 @@
+import { type RoomCloseDeps } from './close.js';
+import { type CoworkAdapter } from './cowork-adapter.js';
+import { type TaskDeletionAcceptance } from './task-state.js';
+import type { TaskDeletionActor, TaskRecord } from './types.js';
+export { DELETION_MEMBER_ABSENT_VERIFIED } from './task-state.js';
+type DeletionCowork = Pick<CoworkAdapter, 'closeRoom' | 'deleteRoom'>;
+export interface TaskDeletionSettleDeps {
+    roomClose?: RoomCloseDeps;
+    /** Test seam for the temp-state existence proof. */
+    hasTempState?(name: string): boolean;
+    /** Test seam for the CID-wide daemon identity scan. */
+    identityCidPresent?(cid: string): Promise<boolean>;
+}
+export interface TaskDeletionSettleResult {
+    task_id: string;
+    deleted: boolean;
+    /** Lifecycle state observed before unlink, for completion audit. */
+    previous_state?: TaskRecord['state'];
+    /** Title observed before unlink, for completion audit. */
+    title?: string;
+}
+/**
+ * Accept a permanent task deletion under the common task-operation lock so it
+ * serializes against terminal settlement, recovery, and the room-publication
+ * window. Acceptance is durable before any side effect and never requires
+ * Cowork availability; settlement runs separately and converges through
+ * retries.
+ */
+export declare function acceptTaskDeletion(taskId: string, actor: TaskDeletionActor): Promise<TaskDeletionAcceptance>;
+/** Persist a settlement failure under the same task-operation lock. */
+export declare function recordTaskDeletionError(taskId: string, error: string, recoveryHint: string): Promise<TaskRecord>;
+/**
+ * Converge an accepted deletion to physical absence in two lock-ordered
+ * stages. Cleanup stage (task-operation lock): per surviving room record,
+ * register late seats → close saga (retires members) → durable evidence
+ * checkpoint → tolerant remote delete → local record delete; then
+ * cursor-based retirement for members with no room record and tolerant remote
+ * close+delete of a recorded room whose local record is gone. Finalization
+ * stage (launch-snapshot lock → task-operation lock, matching the global
+ * provisioning order): re-verify quiescence, delete the owned launch snapshot
+ * while excluding only this deleting task from the reference scan, and unlink
+ * the task record LAST — every crash seam leaves the hidden intent
+ * recoverable. Failures are recorded on the intent; the task stays hidden and
+ * recoverable, never falsely settled.
+ */
+export declare function settleTaskDeletion(input: {
+    taskId: string;
+    /** Lazy: resolved only when room work exists, so no-room tasks settle without Cowork config. */
+    cowork: () => DeletionCowork;
+    deps?: TaskDeletionSettleDeps;
+}): Promise<TaskDeletionSettleResult>;

package/dist/rooms-tasks/deletion.js

@@ -0,0 +1,217 @@
+import { existsSync } from 'node:fs';
+import { withFileLock } from '../atomic-file.js';
+import { agentDir } from '../paths.js';
+import { secureStoppedTempArchive, stopTempSupervisor } from '../temp-lifecycle.js';
+import { closeManagedRoom, identityCidPresent, inspectMember, removeExactMemberIdentity, waitForLivenessAbsent, } from './close.js';
+import { CoworkProtocolError } from './cowork-adapter.js';
+import { deleteRoomRecord, getRoomRecord, listRoomRecords } from './room-state.js';
+import { acquireLaunchSnapshotLock, releaseLaunchSnapshotForDeletingTask } from './launch-snapshot.js';
+import { TASK_OPERATION_LOCK_STALE_MS, taskOperationLockPath } from './terminal.js';
+import { advanceTaskDeletionMember, beginTaskDeletionIntent, completeTaskDeletionReceipt, ensureTaskDeletionReceipt, getDeletingTask, importTaskDeletionRetirementEvidence, setTaskDeletionError, TaskStateError, unlinkDeletedTask, upsertTaskDeletionMembersFromSeats, } from './task-state.js';
+export { DELETION_MEMBER_ABSENT_VERIFIED } from './task-state.js';
+import { DELETION_MEMBER_ABSENT_VERIFIED } from './task-state.js';
+/**
+ * Accept a permanent task deletion under the common task-operation lock so it
+ * serializes against terminal settlement, recovery, and the room-publication
+ * window. Acceptance is durable before any side effect and never requires
+ * Cowork availability; settlement runs separately and converges through
+ * retries.
+ */
+export function acceptTaskDeletion(taskId, actor) {
+    return withFileLock(taskOperationLockPath(taskId), () => beginTaskDeletionIntent(taskId, actor), {}, TASK_OPERATION_LOCK_STALE_MS);
+}
+/** Persist a settlement failure under the same task-operation lock. */
+export function recordTaskDeletionError(taskId, error, recoveryHint) {
+    return withFileLock(taskOperationLockPath(taskId), () => setTaskDeletionError(taskId, error, recoveryHint), {}, TASK_OPERATION_LOCK_STALE_MS);
+}
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** Already-missing remote rooms are a settled outcome, not a failure. */
+function tolerantCowork(cowork) {
+    const tolerate = async (work) => {
+        try {
+            await work();
+        }
+        catch (error) {
+            if (error instanceof CoworkProtocolError && error.code === 'not_found')
+                return;
+            throw error;
+        }
+    };
+    return {
+        closeRoom: roomId => tolerate(() => cowork.closeRoom(roomId)),
+        deleteRoom: roomId => tolerate(() => cowork.deleteRoom(roomId)),
+    };
+}
+function cursorSeat(cursor) {
+    return {
+        role_name: cursor.name, identity_cid: cursor.identity_cid,
+        slot: cursor.name, cowork_role: 'member', seat_state: 'active',
+    };
+}
+/**
+ * Retire one member from its durable deletion cursor when no room record
+ * carries the seat: the same evidence chain as close.ts, resumed at the
+ * recorded phase. A member with no temp state is verified absent through the
+ * CID-wide identity scan; a same-name stranger identity is never touched, and
+ * the recorded CID surviving under any name blocks settlement.
+ */
+async function retireCursorMember(taskId, cursor, deps) {
+    let phase = cursor.phase;
+    let launchId = cursor.launch_id;
+    if (phase === 'identity_absent')
+        return;
+    const seat = cursorSeat(cursor);
+    const roomClose = deps.roomClose ?? {};
+    if (phase === 'pending') {
+        const hasState = (deps.hasTempState ?? (name => existsSync(agentDir(name, true))))(cursor.name);
+        if (!hasState) {
+            const present = await (deps.identityCidPresent ?? identityCidPresent)(cursor.identity_cid);
+            if (present) {
+                // Remove only an exact name+CID match; a stranger under the same name
+                // stays untouched and removeExactMemberIdentity refuses the mismatch.
+                // The recorded CID surviving under a different name throws below on
+                // its post-removal verification and blocks settlement.
+                await (roomClose.removeIdentity ?? removeExactMemberIdentity)(seat);
+                if (await (deps.identityCidPresent ?? identityCidPresent)(cursor.identity_cid))
+                    throw new TaskStateError(`deletion member '${cursor.name}' identity CID survives under another name; refusing to claim retirement`);
+            }
+            advanceTaskDeletionMember(taskId, cursor.name, 'identity_absent', DELETION_MEMBER_ABSENT_VERIFIED);
+            return;
+        }
+        const ownership = await (roomClose.inspectMember ?? inspectMember)(seat);
+        advanceTaskDeletionMember(taskId, cursor.name, 'stop_requested', ownership.launchId);
+        phase = 'stop_requested';
+        launchId = ownership.launchId;
+    }
+    if (phase === 'stop_requested') {
+        await (roomClose.requestStop
+            ?? (async (role) => { await stopTempSupervisor(role); }))(cursor.name);
+        await (roomClose.waitForLivenessAbsent ?? waitForLivenessAbsent)(cursor.name, launchId);
+        advanceTaskDeletionMember(taskId, cursor.name, 'liveness_absent');
+        phase = 'liveness_absent';
+    }
+    if (phase === 'liveness_absent') {
+        const archivePath = await (roomClose.secureArchive ?? secureStoppedTempArchive)(cursor.name, launchId);
+        advanceTaskDeletionMember(taskId, cursor.name, 'archive_secured', undefined, archivePath);
+        phase = 'archive_secured';
+    }
+    if (phase === 'archive_secured') {
+        await (roomClose.removeIdentity ?? removeExactMemberIdentity)(seat);
+        advanceTaskDeletionMember(taskId, cursor.name, 'identity_absent');
+    }
+}
+/**
+ * Converge an accepted deletion to physical absence in two lock-ordered
+ * stages. Cleanup stage (task-operation lock): per surviving room record,
+ * register late seats → close saga (retires members) → durable evidence
+ * checkpoint → tolerant remote delete → local record delete; then
+ * cursor-based retirement for members with no room record and tolerant remote
+ * close+delete of a recorded room whose local record is gone. Finalization
+ * stage (launch-snapshot lock → task-operation lock, matching the global
+ * provisioning order): re-verify quiescence, delete the owned launch snapshot
+ * while excluding only this deleting task from the reference scan, and unlink
+ * the task record LAST — every crash seam leaves the hidden intent
+ * recoverable. Failures are recorded on the intent; the task stays hidden and
+ * recoverable, never falsely settled.
+ */
+export async function settleTaskDeletion(input) {
+    const { taskId } = input;
+    const deps = input.deps ?? {};
+    const recoveryHint = `Re-run 'ours-fleet task delete ${taskId} ${taskId}' or 'ours-fleet task recover ${taskId}'.`;
+    const cleanup = await withFileLock(taskOperationLockPath(taskId), async () => {
+        let task;
+        try {
+            task = getDeletingTask(taskId);
+        }
+        catch (error) {
+            if (error instanceof TaskStateError && /task not found/.test(error.message))
+                return { kind: 'already_absent' };
+            throw error;
+        }
+        if (task.deletion?.status !== 'pending')
+            throw new TaskStateError(`task ${taskId} has no pending deletion`);
+        try {
+            // Audit evidence precedes every side effect; a receipt write failure
+            // aborts settlement (fail closed).
+            ensureTaskDeletionReceipt(taskId);
+            const records = listRoomRecords().filter(room => room.task_id === taskId);
+            const recordIds = new Set(records.map(room => room.room_id));
+            const recordedRoomId = task.deletion.room_id ?? task.room_id;
+            const needsCowork = records.length > 0 || recordedRoomId !== undefined;
+            const cowork = needsCowork ? tolerantCowork(input.cowork()) : undefined;
+            for (const record of records) {
+                upsertTaskDeletionMembersFromSeats(taskId, record.member_seats);
+                await closeManagedRoom({ roomId: record.room_id, cowork: cowork, deps: deps.roomClose });
+                const closed = getRoomRecord(record.room_id);
+                importTaskDeletionRetirementEvidence(taskId, closed?.member_seats ?? record.member_seats);
+                await cowork.deleteRoom(record.room_id);
+                deleteRoomRecord(record.room_id);
+            }
+            // Members whose room record is gone (crash after record deletion, or
+            // legacy state): resume from the durable cursors.
+            for (const cursor of getDeletingTask(taskId).deletion.members) {
+                await retireCursorMember(taskId, cursor, deps);
+            }
+            // A recorded room without a local record may still be live remotely.
+            if (recordedRoomId && !recordIds.has(recordedRoomId) && !getRoomRecord(recordedRoomId)) {
+                await cowork.closeRoom(recordedRoomId);
+                await cowork.deleteRoom(recordedRoomId);
+            }
+            return {
+                kind: 'cleaned',
+                snapshotHash: task.execution_plan?.snapshot.launch_snapshot_hash,
+                previousState: task.state,
+                title: task.title,
+            };
+        }
+        catch (error) {
+            setTaskDeletionError(taskId, errorText(error), recoveryHint);
+            throw error;
+        }
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+    if (cleanup.kind === 'already_absent') {
+        // Heal a crash between unlink and receipt completion.
+        completeTaskDeletionReceipt(taskId);
+        return { task_id: taskId, deleted: false };
+    }
+    const finalize = () => withFileLock(taskOperationLockPath(taskId), () => {
+        try {
+            const task = getDeletingTask(taskId);
+            if (task.deletion?.status !== 'pending')
+                throw new TaskStateError(`task ${taskId} has no pending deletion`);
+            if (listRoomRecords().some(room => room.task_id === taskId))
+                throw new TaskStateError(`task ${taskId} room records reappeared during deletion finalization`);
+            if (task.deletion.members.some(member => member.phase !== 'identity_absent'))
+                throw new TaskStateError(`task ${taskId} has unretired members at deletion finalization`);
+            if (cleanup.snapshotHash)
+                releaseLaunchSnapshotForDeletingTask(cleanup.snapshotHash, taskId);
+            unlinkDeletedTask(taskId);
+        }
+        catch (error) {
+            setTaskDeletionError(taskId, errorText(error), recoveryHint);
+            throw error;
+        }
+        // After unlink the task can no longer carry errors; receipt completion is
+        // idempotent and the already-absent retry path heals a crash here.
+        completeTaskDeletionReceipt(taskId);
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+    if (cleanup.snapshotHash) {
+        // Global lock order: launch-snapshot lock → task-operation lock.
+        const releaseSnapshotLock = acquireLaunchSnapshotLock();
+        try {
+            await finalize();
+        }
+        finally {
+            releaseSnapshotLock();
+        }
+    }
+    else {
+        await finalize();
+    }
+    return {
+        task_id: taskId, deleted: true,
+        previous_state: cleanup.previousState, title: cleanup.title,
+    };
+}

package/dist/rooms-tasks/external-worker.d.ts

@@ -1,2 +1,3 @@
+export declare function fleetWorkerEnv(source?: NodeJS.ProcessEnv): Record<string, string>;
 /** Launch a Fleet CLI operation outside the caller's supervisor/session lifecycle. */
 export declare function launchFleetWorker(args: string[], operation: string, configPath?: string): Promise<void>;

package/dist/rooms-tasks/external-worker.js

@@ -1,14 +1,23 @@
 import { execFile, spawn } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
-/** Launch a Fleet CLI operation outside the caller's supervisor/session lifecycle. */
-export function launchFleetWorker(args, operation, configPath) {
-    const cli = [process.argv[1], ...args, ...(configPath ? ['-c', configPath] : [])];
+import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV } from '../fleet-proxy.js';
+export function fleetWorkerEnv(source = process.env) {
     const inheritedKeys = [
         'HOME', 'PATH', 'XDG_RUNTIME_DIR', 'OURS_FLEET_HOME', 'OURS_CONFIG',
         'OURS_PORT', 'OURS_STATE_DIR', 'OURS_API_TOKEN', 'OURS_COWORK_CONFIG',
     ];
-    const inherited = inheritedKeys
-        .flatMap(key => process.env[key] === undefined ? [] : [`${key}=${process.env[key]}`]);
+    const env = Object.fromEntries(inheritedKeys.flatMap(key => source[key] === undefined ? [] : [[key, source[key]]]));
+    // Explicit defense: trusted settle/recover/delete/close workers are effects
+    // nested inside the outer audited command, never fresh agent attempts.
+    delete env[FLEET_PROXY_STATE_DIR_ENV];
+    delete env[FLEET_PROXY_CALLER_ENV];
+    return env;
+}
+/** Launch a Fleet CLI operation outside the caller's supervisor/session lifecycle. */
+export function launchFleetWorker(args, operation, configPath) {
+    const cli = [process.argv[1], ...args, ...(configPath ? ['-c', configPath] : [])];
+    const env = fleetWorkerEnv();
+    const inherited = Object.entries(env).map(([key, value]) => `${key}=${value}`);
     const suffix = randomUUID().slice(0, 8);
     const safeOperation = operation.replace(/[^A-Za-z0-9_.-]/g, '-');
     return new Promise((resolve, reject) => {
@@ -29,10 +38,6 @@ export function launchFleetWorker(args, operation, configPath) {
             ], { timeout: 15_000 }, error => error ? reject(error) : resolve());
             return;
         }
-        const env = Object.fromEntries(inherited.map(value => {
-            const split = value.indexOf('=');
-            return [value.slice(0, split), value.slice(split + 1)];
-        }));
         const child = spawn(process.execPath, cli, { detached: true, stdio: 'ignore', env });
         child.once('error', reject);
         child.once('spawn', () => { child.unref(); resolve(); });

package/dist/rooms-tasks/launch-snapshot.d.ts

@@ -0,0 +1,19 @@
+import type { AgentTemplateDefinition } from '../config.js';
+/** Cross-process exclusion used from seal through durable Room publication. */
+export declare function acquireLaunchSnapshotLock(options?: {
+    beforePublish?: (claimPath: string, lockPath: string) => void;
+}): () => void;
+export declare function redactLaunchDefinition(value: unknown, key?: string): unknown;
+export declare function sealLaunchSnapshot(definitions: Record<string, AgentTemplateDefinition>): string;
+export declare function readLaunchSnapshot(hash: string): Record<string, AgentTemplateDefinition>;
+/** Delete a sealed snapshot only after no retained Task/Room record references it. */
+export declare function releaseLaunchSnapshot(hash: string): void;
+/**
+ * Deletion-finalization variant: the caller already holds the global
+ * launch-snapshot lock and is about to unlink the deletion-pending task
+ * `taskId`. The reference scan excludes exactly that task file — every other
+ * retained Task/Room reference still protects the snapshot. Deleting the
+ * snapshot BEFORE the task unlink keeps every crash seam recoverable: the
+ * hidden intent survives, and a retry sees the snapshot already absent.
+ */
+export declare function releaseLaunchSnapshotForDeletingTask(hash: string, taskId: string): void;