@ours.network/fleet 1.1.0-nightly.5 → 1.1.0-nightly.7

package/dist/agent-recovery-gate.d.ts

@@ -0,0 +1,17 @@
+import type { ConversationEventV1 } from './session/conversation-types.js';
+import type { AgentSession } from './session/types.js';
+export interface AgentRecoveryEvidence {
+    ok: boolean;
+    reason: 'RECOVERY_TOOLS_VERIFIED' | 'RECOVERY_PROMPT_MISSING' | 'RECOVERY_TURN_INCOMPLETE' | 'RECOVERY_TURN_FAILED' | 'RECOVERY_CHOOSE_MISSING' | 'RECOVERY_CURRENT_MISSING' | 'RECOVERY_GET_MESSAGES_MISSING' | 'RECOVERY_TOOL_ORDER_INVALID';
+    chooseIdentity: boolean;
+    currentIdentity: boolean;
+    getMessages: boolean;
+    turnCompleted: boolean;
+}
+/**
+ * Verify one exact recovery turn from its durable conversation ledger. Tool
+ * arguments/results are inspected only to derive these booleans and are never
+ * returned or persisted by this gate.
+ */
+export declare function evaluateAgentRecovery(events: readonly ConversationEventV1[], promptId: string, identity: string): AgentRecoveryEvidence;
+export declare function recoverAgentIdentity(session: AgentSession, identity: string): Promise<AgentRecoveryEvidence>;

package/dist/agent-recovery-gate.js

@@ -0,0 +1,135 @@
+const TOOL_NAMES = {
+    choose: new Set(['choose_identity', 'ours.choose_identity', 'mcp__ours__choose_identity']),
+    current: new Set(['current_identity', 'ours.current_identity', 'mcp__ours__current_identity']),
+    messages: new Set(['get_messages', 'ours.get_messages', 'mcp__ours__get_messages']),
+};
+function recordFor(records, event) {
+    if (event.kind !== 'tool.upsert' || !event.toolCallId)
+        return undefined;
+    const payload = event.payload;
+    const previous = records.get(event.toolCallId) ?? {};
+    const next = {
+        ...previous,
+        ...(payload.title !== undefined ? { title: payload.title } : {}),
+        ...(payload.status !== undefined ? { status: payload.status } : {}),
+        ...(payload.rawInput !== undefined ? { rawInput: payload.rawInput } : {}),
+        ...(payload.status === 'completed' ? { completedSeq: event.seq } : {}),
+    };
+    records.set(event.toolCallId, next);
+    return next;
+}
+function objectInput(input) {
+    if (!input || input.truncated || input.redacted || !input.json
+        || typeof input.json !== 'object' || Array.isArray(input.json))
+        return undefined;
+    return input.json;
+}
+function safeChoose(record, identity) {
+    if (!record.title || !TOOL_NAMES.choose.has(record.title) || record.status !== 'completed')
+        return false;
+    const input = objectInput(record.rawInput);
+    if (!input)
+        return false;
+    const keys = Object.keys(input).sort();
+    if (keys.some(key => key !== 'force' && key !== 'name'))
+        return false;
+    return input.name === identity && (input.force === undefined || input.force === false);
+}
+function safeNoOrBoundedInput(record, names, allowed) {
+    if (!record.title || !names.has(record.title) || record.status !== 'completed')
+        return false;
+    if (!record.rawInput)
+        return allowed({});
+    const input = objectInput(record.rawInput);
+    return input !== undefined && allowed(input);
+}
+function safeCurrent(record) {
+    return safeNoOrBoundedInput(record, TOOL_NAMES.current, input => Object.keys(input).length === 0);
+}
+function safeMessages(record) {
+    return safeNoOrBoundedInput(record, TOOL_NAMES.messages, input => {
+        const keys = Object.keys(input);
+        if (keys.some(key => key !== 'limit'))
+            return false;
+        return input.limit === undefined
+            || (Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 200);
+    });
+}
+/**
+ * Verify one exact recovery turn from its durable conversation ledger. Tool
+ * arguments/results are inspected only to derive these booleans and are never
+ * returned or persisted by this gate.
+ */
+export function evaluateAgentRecovery(events, promptId, identity) {
+    const ordered = [...events].sort((a, b) => a.seq - b.seq);
+    const admitted = ordered.find(event => event.kind === 'prompt.admitted' && event.promptId === promptId);
+    const empty = (reason) => ({
+        ok: false, reason, chooseIdentity: false, currentIdentity: false,
+        getMessages: false, turnCompleted: false,
+    });
+    if (!admitted)
+        return empty('RECOVERY_PROMPT_MISSING');
+    const terminal = ordered.find(event => event.seq > admitted.seq
+        && event.kind === 'turn.completed'
+        && event.promptId === promptId
+        && event.sessionGeneration === admitted.sessionGeneration);
+    if (!terminal)
+        return empty('RECOVERY_TURN_INCOMPLETE');
+    const outcome = terminal.payload.outcome;
+    if (outcome !== 'completed')
+        return empty('RECOVERY_TURN_FAILED');
+    const records = new Map();
+    for (const event of ordered) {
+        if (event.seq <= admitted.seq || event.seq >= terminal.seq
+            || event.promptId !== promptId
+            || event.sessionGeneration !== admitted.sessionGeneration)
+            continue;
+        recordFor(records, event);
+    }
+    const values = [...records.values()];
+    const chooses = values.filter(record => safeChoose(record, identity));
+    const currents = values.filter(safeCurrent);
+    const messages = values.filter(safeMessages);
+    const chooseIdentity = chooses.length > 0;
+    const currentIdentity = currents.length > 0;
+    const getMessages = messages.length > 0;
+    const base = { chooseIdentity, currentIdentity, getMessages, turnCompleted: true };
+    if (!chooseIdentity)
+        return { ok: false, reason: 'RECOVERY_CHOOSE_MISSING', ...base };
+    if (!currentIdentity)
+        return { ok: false, reason: 'RECOVERY_CURRENT_MISSING', ...base };
+    if (!getMessages)
+        return { ok: false, reason: 'RECOVERY_GET_MESSAGES_MISSING', ...base };
+    const orderedChain = chooses.some(choose => currents.some(current => messages.some(message => choose.completedSeq !== undefined && current.completedSeq !== undefined
+        && message.completedSeq !== undefined
+        && choose.completedSeq < current.completedSeq
+        && current.completedSeq < message.completedSeq)));
+    if (!orderedChain)
+        return { ok: false, reason: 'RECOVERY_TOOL_ORDER_INVALID', ...base };
+    return { ok: true, reason: 'RECOVERY_TOOLS_VERIFIED', ...base };
+}
+export async function recoverAgentIdentity(session, identity) {
+    if (!session.subscribeConversation)
+        return {
+            ok: false, reason: 'RECOVERY_PROMPT_MISSING', chooseIdentity: false,
+            currentIdentity: false, getMessages: false, turnCompleted: false,
+        };
+    const events = [];
+    const unsubscribe = session.subscribeConversation(event => events.push(event));
+    try {
+        const queued = await session.queuePrompt([
+            '[fleet-recovery] The shared ours daemon restarted.',
+            `Call ours choose_identity with name ${JSON.stringify(identity)} and force false.`,
+            'Then call current_identity, then get_messages. Complete all three in that order.',
+            'Do not create/delete identities, force-bind, interrupt, or restart any service/session.',
+        ].join('\n'), { origin: { kind: 'fleet-monitor' } });
+        await queued.completion;
+        // Conversation publication is synchronous with terminal settlement in the
+        // in-tree ACP store; filtering by exact promptId/sessionGeneration remains
+        // the authority even if unrelated events arrived concurrently.
+        return evaluateAgentRecovery(events, queued.promptId, identity);
+    }
+    finally {
+        unsubscribe();
+    }
+}

package/dist/application/fleet-query-service.js

@@ -4,6 +4,7 @@ import { classifyActivity } from '../session/activity.js';
 import { controlRequest } from '../session/control.js';
 import { SessionControlError } from '../session/types.js';
 import { readExitRecord, readRestartLedger } from '../runner.js';
+import { readDaemonRecoveryStatus } from '../daemon-recovery.js';
 import { roleCapabilities } from './capabilities.js';
 import { FleetError } from './errors.js';
 const clean = (value, max = 512) => value.replace(/[\0-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '').trim().slice(0, max);
@@ -46,7 +47,8 @@ function readIsolation(dir) {
 function sessionOverall(supervisor, session, restart, monitor, isolation, problems) {
     if (restart.circuit === 'open' || monitor.health === 'failed' || monitor.health === 'degraded'
         || isolation.degraded
-        || problems.some(problem => problem.severity === 'error' || problem.source === 'watchdog')
+        || problems.some(problem => problem.severity === 'error'
+            || problem.source === 'watchdog' || problem.source === 'daemon-recovery')
         || session.readiness === 'failed')
         return 'attention';
     // A reachable agent session is the user's live interaction surface. Its
@@ -103,6 +105,16 @@ export class FleetQueryService {
         const lastExit = dir ? readExitRecord(join(dir, '.exit-status')) ?? undefined : undefined;
         const session = await this.session(role, dir, live.state);
         const problems = [...role.problems];
+        const recovery = dir ? readDaemonRecoveryStatus(dir) : undefined;
+        if (recovery && recovery.state !== 'recovered') {
+            const paths = ['agent', 'owner']
+                .filter(name => recovery.paths[name].state !== 'recovered')
+                .map(name => `${name}:${recovery.paths[name].state}`);
+            problems.push({
+                code: 'daemon_recovery', severity: 'warning', source: 'daemon-recovery',
+                detail: `${recovery.state}; ${paths.join(', ') || 'no degraded path'}; epoch ${recovery.epoch || 'unavailable'}`,
+            });
+        }
         if (live.state === 'running' && session.reachability !== 'online')
             problems.push({
                 code: 'supervisor_session_disagreement', severity: 'warning',

package/dist/application/role-creation-service.js

@@ -61,6 +61,16 @@ export class RoleCreationService {
         const creationActionId = randomUUID();
         plan.options.creationActionId = creationActionId;
         const statePath = await this.launchSync(plan.options);
+        const selectionSummary = (kind) => {
+            const value = plan.options[kind];
+            const provenance = plan.inherited.includes(kind) ? 'inherited' : 'explicit';
+            if (!value)
+                return `unresolved (${provenance})`;
+            if ('ref' in value)
+                return `ref:${value.ref} (${provenance})`;
+            const fingerprint = createHash('sha256').update(JSON.stringify(value.inline)).digest('hex').slice(0, 16);
+            return `inline:sha256:${fingerprint} (${provenance})`;
+        };
         return {
             caller: plan.caller, role: plan.options.name,
             lifetime: plan.options.temp ? 'temporary' : 'permanent', statePath,
@@ -69,6 +79,7 @@ export class RoleCreationService {
             monitor: { mode: plan.preview.resolvedRole.monitor.mode, interrupt: plan.preview.resolvedRole.monitor.interrupt },
             permissionMode: effectivePermissionMode(plan.preview.resolvedRole), inherited: plan.inherited,
             creationActionId,
+            brainSummary: selectionSummary('brain'), roleSummary: selectionSummary('role'),
         };
     }
     launchSync(options, creation) {

package/dist/briefing.js

@@ -172,12 +172,16 @@ export function generateBriefing(role, v, opts) {
     if (role.session === 'acp') {
         L.push('', '### Managed fleet commands');
         L.push('This ACP role has a supervisor-scoped ours-fleet proxy. Use the ordinary');
-        L.push('`ours-fleet spawn` command; the CLI routes it through your live supervisor, which');
-        L.push('records you as the caller and reports successful creation to your owner channel.');
+        L.push('`ours-fleet` command; the CLI opens an authenticated audit attempt with your live');
+        L.push('supervisor before parsing or side effects. Your existing OS sandbox remains the executor.');
+        L.push('Every allowed attempt writes a redacted raw invocation and correlated outcome to your');
+        L.push('Owner-visible channel; denied, invalid, failed, and read-only attempts are visible too.');
         L.push('A minimal call is `ours-fleet spawn DeveloperName --temp`.');
         L.push('For omitted settings, the supervisor inherits your canonical Brain and Role selections,');
         L.push('working directory, neutral permissions, coordinator, and fleet monitor policy. Every');
         L.push('explicit option wins; identity/session-local and secret material never inherit.');
+        L.push('Operator lifecycle/control and hidden worker commands are denied through this route.');
+        L.push('Invocation delivery failure denies execution; outcome uncertainty is reported without retrying effects.');
         L.push('This proxy is attribution and convenience, not a security boundary for unisolated roles.');
     }
     if (role.coordinator) {

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.1.0-nightly.5",
-  "buildId": "7a0d408032b9",
-  "commit": "f5fd6cbade0e4f19e4c65d76b4ac170388a13665",
+  "version": "1.1.0-nightly.7",
+  "buildId": "a09aa98e92aa",
+  "commit": "d79160ae66847305a109bed339d8c8830a20bba7",
   "dirty": true,
-  "builtAt": "2026-08-30T19:55:15.112Z",
+  "builtAt": "2026-08-31T07:32:26.852Z",
   "capabilities": [
     "monitor.interrupt.after_tool"
   ]

package/dist/cli.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { spawn as spawnChild } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { realpathSync } from 'node:fs';
 import { join as joinPath, resolve as resolvePath } from 'node:path';
@@ -37,6 +38,7 @@ import { requestWebControl } from './web/control.js';
 import { WebServiceManager } from './web/service.js';
 import { WebAccessStore, passwordAccess, validatePublicOrigin } from './web/access.js';
 import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, } from './fleet-proxy.js';
+import { beginFleetAuditCollection, consumeFleetAuditCollection, FleetCliExit, recordFleetAuditPresentation, recordFleetAuditResource, } from './fleet-command-audit.js';
 import './harness/claude-code.js'; // registers the claude-code adapter
 import './harness/codex.js'; // registers the codex adapter
 import { registerTemplateCommands, registerTaskCommands, registerRoomCommands } from './rooms-tasks/cli.js';
@@ -66,7 +68,10 @@ const roleLifecycle = (configPath, operationDeps) => {
     return new RoleLifecycleService({ repository, ops: operationDeps, configPath,
         status: async (roleId) => (await query.detail(roleId)).status });
 };
-const die = (e) => { console.error(String(e instanceof Error ? e.message : e)); process.exit(1); };
+const die = (e) => {
+    console.error(String(e instanceof Error ? e.message : e));
+    throw new FleetCliExit(1);
+};
 /** Exec a child with our stdio (logs/attach). */
 const passthrough = (cmd, args) => new Promise(resolve => {
     const c = spawnChild(cmd, args, { stdio: 'inherit' });
@@ -76,6 +81,7 @@ const program = new Command()
     .name('ours-fleet')
     .description('Fleet of persistent, identity-bound AI agents — canonical Brain + Role definitions over ACP sessions.')
     .enablePositionalOptions()
+    .exitOverride()
     .version(VERSION);
 const cOpt = (cmd) => cmd.option('-c, --configuration <file>', 'manifest (default: ~/fleet.yaml; documents under ~/fleet/)');
 const collect = (value, previous) => [...previous, value];
@@ -1192,6 +1198,13 @@ cOpt(program.command('spawn [name]').description('spawn a new agent (permanent b
             if (!response.ok)
                 throw new SessionControlError(response.kind ?? 'backend', response.error ?? 'managed spawn failed');
             const result = response.result;
+            recordFleetAuditResource('agent', result.role);
+            recordFleetAuditPresentation({ kind: 'agent_started', name: result.role,
+                lifetime: result.lifetime, brain: result.brainSummary, role: result.roleSummary,
+                harness: result.harness, session: result.session, model: result.model,
+                permissions: result.permissionMode
+                    ? `${result.permissionMode.fleetMode}/${result.permissionMode.nativeMode}` : undefined,
+                parent: result.caller, actionId: result.creationActionId, inherited: result.inherited });
             const expectedCaller = process.env[FLEET_PROXY_CALLER_ENV];
             if (expectedCaller && result.caller !== expectedCaller)
                 throw new Error(`fleet proxy caller mismatch: expected '${expectedCaller}', got '${result.caller}'`);
@@ -1248,7 +1261,8 @@ cOpt(program.command('doctor').description('prerequisite report'))
     });
     for (const c of rep.checks)
         console.log(`${c.ok ? 'ok  ' : 'MISS'} ${c.name.padEnd(22)} ${c.detail}`);
-    process.exit(rep.ok ? 0 : 1);
+    if (!rep.ok)
+        throw new FleetCliExit(1);
 });
 program.command('init').description('one-time host setup (units, dirs, linger)')
     .action(async () => {
@@ -1497,11 +1511,84 @@ cOpt(program.command('_run-watchdogs', { hidden: true }))
         die(e);
     }
 });
-const spawnIndex = process.argv.indexOf('spawn');
-if (spawnIndex >= 0 && process.argv.slice(spawnIndex + 1).some(arg => arg === '--harness' || arg.startsWith('--harness=') || arg === '--model' || arg.startsWith('--model='))) {
-    console.error('error: --harness and --model were removed; select a Brain with --brain');
-    process.exitCode = 1;
+async function parseFleetCli() {
+    const spawnIndex = process.argv.indexOf('spawn');
+    if (spawnIndex >= 0 && process.argv.slice(spawnIndex + 1).some(arg => arg === '--harness' || arg.startsWith('--harness=') || arg === '--model' || arg.startsWith('--model='))) {
+        console.error('error: --harness and --model were removed; select a Brain with --brain');
+        throw new FleetCliExit(1);
+    }
+    try {
+        await program.parseAsync(process.argv);
+    }
+    catch (error) {
+        const commander = error;
+        if (commander.exitCode === 0)
+            return;
+        if (typeof commander.exitCode === 'number')
+            throw new FleetCliExit(commander.exitCode, 'validation', 'not_started');
+        throw error;
+    }
 }
-else {
-    program.parseAsync(process.argv);
+async function runFleetCli() {
+    const stateDir = process.env[FLEET_PROXY_STATE_DIR_ENV];
+    const caller = process.env[FLEET_PROXY_CALLER_ENV];
+    if (!stateDir || !caller) {
+        await parseFleetCli();
+        return;
+    }
+    const requestId = randomUUID();
+    let attempt;
+    const begun = await controlRequest(stateDir, {
+        command: 'fleet_audit_begin', audit: { requestId, argv: process.argv.slice(2) },
+    });
+    if (!begun.ok)
+        throw new SessionControlError(begun.kind ?? 'rejected', begun.error ?? 'fleet command audit refused');
+    attempt = begun.result;
+    if (attempt.caller !== caller)
+        throw new SessionControlError('rejected', `fleet audit caller mismatch: expected '${caller}', got '${attempt.caller}'`);
+    let exitCode = 0;
+    let outcomeClass = 'success';
+    let effect = 'completed';
+    beginFleetAuditCollection();
+    if (attempt.classification.decision !== 'allow') {
+        exitCode = 1;
+        outcomeClass = 'denied';
+        effect = 'not_started';
+        console.error(`fleet supervisor proxy ${attempt.classification.decision}: ${attempt.classification.command}`);
+    }
+    else {
+        const originalExit = process.exit;
+        process.exit = ((code) => { throw new FleetCliExit(code ?? 0); });
+        try {
+            await parseFleetCli();
+        }
+        catch (error) {
+            exitCode = error instanceof FleetCliExit ? error.exitCode : 1;
+            outcomeClass = error instanceof FleetCliExit ? error.outcomeClass : 'runtime';
+            effect = error instanceof FleetCliExit ? error.effect : 'unknown';
+            if (!(error instanceof FleetCliExit))
+                console.error(error instanceof Error ? error.message : String(error));
+        }
+        finally {
+            process.exit = originalExit;
+        }
+    }
+    const metadata = consumeFleetAuditCollection();
+    if (metadata.failure) {
+        outcomeClass = metadata.failure.class;
+        effect = metadata.failure.effect;
+    }
+    const finished = await controlRequest(stateDir, { command: 'fleet_audit_finish', audit: {
+            correlationId: attempt.correlationId, class: outcomeClass, exitCode, effect,
+            ...(metadata.resourceIds ? { resourceIds: metadata.resourceIds } : {}),
+            ...(metadata.presentation ? { presentation: metadata.presentation } : {}),
+        } });
+    if (!finished.ok)
+        throw new SessionControlError(finished.kind ?? 'backend', finished.error ?? `audit delivery failed after execution; effect status=${effect}`);
+    process.exitCode = exitCode;
 }
+void runFleetCli().catch(error => {
+    if (!(error instanceof FleetCliExit))
+        console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = error instanceof FleetCliExit ? error.exitCode : 1;
+});

package/dist/daemon-recovery.d.ts

@@ -0,0 +1,93 @@
+import { type FetchLike } from './monitor.js';
+export declare const DAEMON_RECOVERY_MAX_ATTEMPTS = 6;
+export declare const DAEMON_RECOVERY_INITIAL_BACKOFF_MS = 1000;
+export declare const DAEMON_RECOVERY_MAX_BACKOFF_MS = 5000;
+export declare const DAEMON_RECOVERY_DEADLINE_MS = 60000;
+export interface DaemonGeneration {
+    bootId: string;
+    pid: number;
+    startedAt: number;
+    stateDir: string;
+}
+export type DaemonGenerationProbe = {
+    state: 'ready';
+    generation: DaemonGeneration;
+} | {
+    state: 'unavailable';
+    reason: string;
+};
+export type DaemonGenerationObservation = {
+    kind: 'baseline' | 'stable' | 'available';
+    generation: DaemonGeneration;
+} | {
+    kind: 'changed';
+    previous: DaemonGeneration;
+    generation: DaemonGeneration;
+} | {
+    kind: 'lost' | 'unavailable';
+    previous?: DaemonGeneration;
+    reason: string;
+};
+interface GenerationProbeDeps {
+    readText?(path: string): string;
+    canonicalize?(path: string): string;
+}
+/**
+ * Corroborate the loopback daemon's unauthenticated `/info`, its credentialed
+ * identity-index readiness route, and its local boot-generation record. The
+ * index enforces auth when the daemon visibility requires it; open visibility
+ * deliberately does not. No source is sufficient
+ * alone: `/info` has no boot id, the identity index has no generation, and a
+ * stale `ready` file can outlive the process that wrote it.
+ */
+export declare function probeDaemonGeneration(fetch: FetchLike, env: NodeJS.ProcessEnv, deps?: GenerationProbeDeps): Promise<DaemonGenerationProbe>;
+export declare class DaemonGenerationObserver {
+    private current?;
+    private unavailable;
+    observe(probe: DaemonGenerationProbe): DaemonGenerationObservation;
+}
+export declare function daemonRecoveryBackoff(attempt: number): number;
+export type RecoveryPath = 'agent' | 'owner';
+export type RecoveryPathResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+export interface RoleRecoveryControllerOptions {
+    role: string;
+    identity: string;
+    stateDir: string;
+    now(): number;
+    sleep(ms: number): Promise<void>;
+    recoverAgent(epoch: string): Promise<RecoveryPathResult>;
+    recoverOwner(epoch: string): Promise<RecoveryPathResult>;
+    log(line: string): void;
+}
+export interface RecoveryStatus {
+    version: 1;
+    identity: string;
+    epoch: string;
+    state: 'recovering' | 'recovered' | 'degraded' | 'cancelled';
+    paths: Record<RecoveryPath, {
+        state: 'pending' | 'recovered' | 'degraded';
+        attempts: number;
+        reason?: string;
+    }>;
+    updatedAt: string;
+}
+export declare function readDaemonRecoveryStatus(dir: string): RecoveryStatus | undefined;
+/** Per-role, per-generation bounded recovery with path-level fault isolation. */
+export declare class RoleRecoveryController {
+    private readonly options;
+    private token;
+    private activeEpoch?;
+    private active?;
+    private status?;
+    constructor(options: RoleRecoveryControllerOptions);
+    recover(generation: DaemonGeneration): Promise<RecoveryStatus>;
+    cancel(): void;
+    noteLoss(reason: string): void;
+    private write;
+}
+export {};