@ours.network/fleet 1.1.0-nightly.2 → 1.1.0-nightly.21

package/dist/watchdog/run.js

@@ -10,7 +10,7 @@ import { applyRole } from '../ops.js';
 import { daemonIdentityInventoryProvisioner, ensureIdentity, } from '../creation.js';
 import { runOnce, START_STAGGER_FILE } from '../runner.js';
 import { agentDir, tmpRoot } from '../paths.js';
-import { loadConfig, resolveMonitorConfig, resolveWorklogPolicy, ROLE_NAME_RE, } from '../config.js';
+import { loadConfig, ROLE_NAME_RE, } from '../config.js';
 import { getAdapter } from '../harness/registry.js';
 import { redactLogLine } from '../application/log-service.js';
 import { controlRequest, controlSocketPath } from '../session/control.js';
@@ -84,19 +84,10 @@ function readTail(runDir) {
     }
 }
 /** The temp role every watchdog-family run launches under. Isolation is opt-in. */
-function buildWatchdogRole(wd, cfg) {
+function buildWatchdogRole(wd, _cfg) {
     return {
-        name: wd.identity, sourceFile: '(watchdog)',
-        harness: wd.harness, session: wd.session,
-        identity: wd.identity, model: wd.model,
-        // Watchdogs are observe-only by contract, but their sanctioned status commands
-        // must reach host control sockets. Keep approvals/unattended escalation denied
-        // while disabling the harness's native filesystem/network sandbox.
-        permissions: { approval: 'deny', filesystem: 'unrestricted', unattended: 'deny' },
-        permissionsDeclared: true,
-        monitor: resolveMonitorConfig(cfg.defaults.monitor, undefined),
-        worklog: resolveWorklogPolicy(cfg.defaults.worklog, undefined),
-        isolation: wd.isolation,
+        ...structuredClone(wd.resolvedAgent),
+        name: wd.identity, sourceFile: '(watchdog)', identity: wd.identity,
     };
 }
 /** Discover temporary sessions that are live now, not merely stale dirs on disk. */

package/dist/web/fleet-config-service.d.ts

@@ -3,6 +3,7 @@ export declare const REDACTED_ENV_VALUE = "__OURS_FLEET_SECRET_REDACTED__";
 export interface EditableFleetModel {
     manifest: Record<string, unknown>;
     agents: Record<string, Record<string, unknown>>;
+    agent_templates: Record<string, Record<string, unknown>>;
 }
 export interface ConfigReadResult {
     path: string;

package/dist/web/fleet-config-service.js

@@ -12,7 +12,7 @@ import { isSensitiveConfigKey } from '../sensitive-config.js';
 export const REDACTED_ENV_VALUE = '__OURS_FLEET_SECRET_REDACTED__';
 const MAX_CONFIG_BYTES = 256 * 1024;
 const DIFF_CONTEXT_LINES = 3;
-const KINDS = ['agents', 'roles', 'brains'];
+const KINDS = ['agents', 'agent_templates', 'roles', 'brains', 'room_templates'];
 const emptyReport = () => ({ ok: true, checks: [] });
 export class FleetConfigService {
     path;
@@ -176,7 +176,8 @@ function readSources(manifest) {
         }
         trustedDirectory(dir);
         for (const name of readdirSync(dir).sort()) {
-            if (kind === 'agents' && !['.yaml', '.yml'].includes(extname(name).toLowerCase()))
+            if ((kind === 'agents' || kind === 'agent_templates' || kind === 'room_templates')
+                && !['.yaml', '.yml'].includes(extname(name).toLowerCase()))
                 continue;
             documents.set(join(kind, name), trustedFile(join(dir, name)));
         }
@@ -187,20 +188,26 @@ function modelFrom(sources) {
     const manifestKey = basename(sources.manifest);
     const manifest = parseFleetDocument(sources.manifest, sources.documents.get(manifestKey), 'strict').value;
     const agents = {};
+    const agent_templates = {};
     for (const [rel, source] of sources.documents)
         if (rel.startsWith(`agents/`)) {
             const id = basename(rel, extname(rel));
             agents[id] = parseFleetDocument(absoluteFor(sources.manifest, rel), source, 'strict').value;
         }
-    return { manifest, agents };
+    for (const [rel, source] of sources.documents)
+        if (rel.startsWith(`agent_templates/`)) {
+            const id = basename(rel, extname(rel));
+            agent_templates[id] = parseFleetDocument(absoluteFor(sources.manifest, rel), source, 'strict').value;
+        }
+    return { manifest, agents, agent_templates };
 }
 function assertModel(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         throw new FleetError('invalid_request', 'model must be an object');
     const input = value;
-    if (Object.keys(input).sort().join(',') !== 'agents,manifest')
-        throw new FleetError('invalid_request', 'model allows exactly manifest and agents');
-    for (const key of ['manifest', 'agents'])
+    if (Object.keys(input).sort().join(',') !== 'agent_templates,agents,manifest')
+        throw new FleetError('invalid_request', 'model allows exactly manifest, agents, and agent_templates');
+    for (const key of ['manifest', 'agents', 'agent_templates'])
         if (!input[key] || typeof input[key] !== 'object' || Array.isArray(input[key]))
             throw new FleetError('invalid_request', `${key} must be an object`);
     for (const [id, doc] of Object.entries(input.agents)) {
@@ -209,6 +216,12 @@ function assertModel(value) {
         if (!doc || typeof doc !== 'object' || Array.isArray(doc))
             throw new FleetError('invalid_request', `Agent '${id}' must be an object`);
     }
+    for (const [id, doc] of Object.entries(input.agent_templates)) {
+        if (!ROLE_NAME_RE.test(id))
+            throw new FleetError('invalid_request', `invalid Agent Template ID '${id}'`);
+        if (!doc || typeof doc !== 'object' || Array.isArray(doc))
+            throw new FleetError('invalid_request', `Agent Template '${id}' must be an object`);
+    }
     return structuredClone(input);
 }
 function renderProposal(current, model) {
@@ -221,8 +234,14 @@ function renderProposal(current, model) {
         next.set(oldRel ?? join('agents', `${id}.yaml`), oldRel
             ? render(current.documents.get(oldRel), doc) : stringify(doc));
     }
+    for (const [id, doc] of Object.entries(model.agent_templates).sort(([a], [b]) => a.localeCompare(b))) {
+        const oldRel = [...current.documents.keys()].find(rel => rel.startsWith('agent_templates/')
+            && basename(rel, extname(rel)) === id);
+        next.set(oldRel ?? join('agent_templates', `${id}.yaml`), oldRel
+            ? render(current.documents.get(oldRel), doc) : stringify(doc));
+    }
     for (const [rel, source] of current.documents)
-        if (rel.startsWith('roles/') || rel.startsWith('brains/'))
+        if (rel.startsWith('roles/') || rel.startsWith('brains/') || rel.startsWith('room_templates/'))
             next.set(rel, source);
     return next;
 }
@@ -424,7 +443,7 @@ function sourceSensitiveValues(sources) {
             continue;
         try {
             const parsed = parse(source);
-            values.push(...sensitiveValues({ manifest: {}, agents: { source: parsed } }));
+            values.push(...sensitiveValues({ manifest: {}, agents: { source: parsed }, agent_templates: {} }));
         }
         catch { /* the authoritative parser reports malformed YAML */ }
     }

package/dist/web/runtime.js

@@ -4,7 +4,7 @@ import { resolve } from 'node:path';
 import { loadConfig } from '../config.js';
 import { RoleRepository } from '../application/role-repository.js';
 import { FleetQueryService } from '../application/fleet-query-service.js';
-import { AcpRoleSessionAdapter } from '../application/session-control.js';
+import { RoleSessionControlAdapter } from '../application/session-control.js';
 import { StructuredLogService } from '../application/log-service.js';
 import { RoleCommandService } from '../application/role-command-service.js';
 import { RoleCreationService } from '../application/role-creation-service.js';
@@ -64,18 +64,22 @@ export async function startWebConsole(options) {
     const repository = new RoleRepository({
         configPath: options.configPath,
         probeBackend: async (name) => {
-            let acp = false;
+            let backend;
             const permanent = resolve(home(), '.ours-fleet', 'agents', name);
             const temporary = resolve(home(), '.ours-fleet', 'tmp', name);
             for (const dir of [permanent, temporary]) {
                 if (!existsSync(controlSocketPath(dir)))
                     continue;
                 try {
-                    acp = (await controlRequest(dir, { command: 'snapshot' }, 500)).ok;
+                    const response = await controlRequest(dir, { command: 'snapshot' }, 500);
+                    const snapshot = response.result;
+                    if (response.ok && (snapshot?.backend === 'acp'
+                        || snapshot?.backend === 'codex-app-server'))
+                        backend = snapshot.backend;
                 }
                 catch { /* stale socket is evidence, not reachability */ }
             }
-            return { acp };
+            return { backend };
         },
     });
     const events = new FleetEventBus();
@@ -161,11 +165,12 @@ export async function startWebConsole(options) {
                 const role = await repository.get(roleId);
                 if (!role)
                     throw new FleetError('role_not_found', `no such role '${roleId}'`);
-                if (role.configuredBackend === 'acp') {
+                if (role.configuredBackend === 'acp'
+                    || role.configuredBackend === 'codex-app-server') {
                     const dir = repository.stateDir(role);
                     if (!dir)
                         throw new FleetError('control_unavailable', 'role state directory is unavailable');
-                    return new AcpRoleSessionAdapter(dir);
+                    return new RoleSessionControlAdapter(dir);
                 }
                 throw new FleetError('capability_unavailable', 'role session backend is unavailable');
             },

package/dist/web/server.js

@@ -183,12 +183,39 @@ export async function buildWebServer(services, boundary, options = {}) {
             throw new FleetError('invalid_request', 'invalid task state filter');
         if (query.groupByList !== undefined && !['true', 'false'].includes(query.groupByList))
             throw new FleetError('invalid_request', 'groupByList must be true or false');
+        if (query.includeDeleting !== undefined && !['true', 'false'].includes(query.includeDeleting))
+            throw new FleetError('invalid_request', 'includeDeleting must be true or false');
         const state = query.state && query.state !== 'all' ? query.state : undefined;
-        const filter = { ...(state ? { state } : {}), ...(query.list ? { list: query.list } : {}) };
+        const filter = { ...(state ? { state } : {}), ...(query.list ? { list: query.list } : {}),
+            ...(query.includeDeleting === 'true' ? { includeDeleting: true } : {}) };
         return taskApi(() => query.groupByList === 'true'
             ? { groups: requireTaskRooms().groupedTasks(filter) }
             : { tasks: requireTaskRooms().listTasks(filter) });
     });
+    app.delete('/api/v1/tasks/:id', async (request, reply) => {
+        auth.authenticate(request, true);
+        const taskId = request.params.id;
+        const confirm = request.query.confirm;
+        // Exact-ID-twice confirmation is validated before existence or idempotency.
+        if (confirm !== taskId)
+            throw new FleetError('invalid_request', 'confirm must exactly repeat the task id');
+        const accepted = await taskApi(() => requireTaskRooms().requestTaskDeletion({
+            actor: { kind: 'local_control', surface: 'web' }, taskId,
+        }));
+        if (accepted.status === 'already_absent')
+            return { task_id: taskId, deleted: false, already_absent: true };
+        // Cleanup runs in an external worker outside the request lifecycle; the
+        // request waits boundedly and reports pending — never fabricated success.
+        const outcome = await requireTaskRooms().launchTaskDeletionWorker({ taskId, waitMs: 5_000 });
+        if (outcome.deleted)
+            return { task_id: taskId, deleted: true };
+        reply.code(202);
+        return {
+            task_id: taskId, accepted: true, deletion: 'pending',
+            ...(outcome.error ? { error: outcome.error } : {}),
+            recovery: `Repeat DELETE /api/v1/tasks/${taskId}?confirm=${taskId} or run 'ours-fleet task recover ${taskId}'.`,
+        };
+    });
     app.post('/api/v1/tasks', async (request, reply) => {
         auth.authenticate(request, true);
         const body = request.body;

package/dist/web/topology-promote.js

@@ -126,7 +126,14 @@ function agentEntry(node) {
  */
 function watchdogEntry(node, merged) {
     const scoped = linked(merged, node.id, 'watches');
-    return { ...pick(node, WATCHDOG_FIELDS), ...(scoped.length ? { watch: scoped } : {}) };
+    return {
+        ...pick(node, WATCHDOG_FIELDS),
+        agent: {
+            role: { inline: {} },
+            brain: { inline: { harness: 'claude-code', ...pick(node, BRAIN_FIELDS) } },
+        },
+        ...(scoped.length ? { watch: scoped } : {}),
+    };
 }
 function loopEntry(node, merged) {
     const roles = linked(merged, node.id, 'targets');