@ours.network/fleet 1.1.0-nightly.6 → 1.1.0-nightly.8

package/README.md

@@ -43,7 +43,7 @@ brain: { inline: { harness: codex, session: acp } }
 ## How it works
 
 ```
-~/fleet.yaml + ~/fleet/{agents,roles,brains}/*.yaml   your declaration
+~/fleet.yaml + ~/fleet/{agents,roles,brains,room_templates}/*.yaml   your declaration
         │  ours-fleet up
         ▼
 briefing.md per role  ──►  agent session adapter  ──►  ACP client/session  ──►  ACP agent
@@ -91,7 +91,7 @@ equivalent); logs land in `~/.ours-fleet/logs/`.
 
 ```sh
 npm i -g @ours.network/fleet
-ours-fleet init      # units/dirs/linger for this user
+ours-fleet init      # units/dirs/linger + missing standard presets
 ours-fleet doctor    # verifies everything above, with actionable messages
 ```
 
@@ -107,8 +107,8 @@ become that account and repeat.
 ## Quickstart
 
 ```sh
-cp -R "$(npm root -g)/@ours.network/fleet/examples/fleet" ~/fleet
-cp "$(npm root -g)/@ours.network/fleet/examples/fleet.yaml" ~/fleet.yaml
+ours-fleet init               # safe to repeat: creates missing files, never replaces edits
+ours-fleet config             # validates Agents, Roles, Brains, and Room templates
 $EDITOR ~/fleet/agents/*.yaml # compose Role + Brain and operational settings
 ours-fleet up                 # boot the fleet (staggered)
 ours-fleet ls                 # running consoles
@@ -442,6 +442,25 @@ installer/setup flows remain responsible for starting it.
 
 ### Rooms and tasks
 
+Init installs editable `single`, `pair`, and `team` definitions under
+`~/fleet/room_templates/`, plus every exact-cased Agent, Role, and Brain they
+reference. Inspect them with `ours-fleet template list` and
+`ours-fleet template show team`. After configuring the authenticated owner below:
+
+```sh
+ours-fleet task create --title "Solo task" --template single
+ours-fleet task create --title "Reviewed change" --template pair
+ours-fleet task create --title "Phased delivery" --template team
+```
+
+`ours-fleet init -c /path/custom.yaml` seeds `/path/custom/` instead. Init reports
+the packaged preset revision and source directory and only seeds missing files.
+It never upgrades an edited preset. To adopt a newer packaged file explicitly,
+copy the reported source file beside the existing target as `.new-default`, review
+`diff -u`, then replace the target yourself. This is the sole adoption operation;
+rerunning init is not an update. Users upgrading from hardcoded templates should
+run init once (with the same `-c` selection they normally use).
+
 Rooms always use `ours-cowork`; there is no room-provider selector. Configure
 the cowork daemon connection and the room owner directly:
 

package/dist/agent-recovery-gate.d.ts

@@ -0,0 +1,17 @@
+import type { ConversationEventV1 } from './session/conversation-types.js';
+import type { AgentSession } from './session/types.js';
+export interface AgentRecoveryEvidence {
+    ok: boolean;
+    reason: 'RECOVERY_TOOLS_VERIFIED' | 'RECOVERY_PROMPT_MISSING' | 'RECOVERY_TURN_INCOMPLETE' | 'RECOVERY_TURN_FAILED' | 'RECOVERY_CHOOSE_MISSING' | 'RECOVERY_CURRENT_MISSING' | 'RECOVERY_GET_MESSAGES_MISSING' | 'RECOVERY_TOOL_ORDER_INVALID';
+    chooseIdentity: boolean;
+    currentIdentity: boolean;
+    getMessages: boolean;
+    turnCompleted: boolean;
+}
+/**
+ * Verify one exact recovery turn from its durable conversation ledger. Tool
+ * arguments/results are inspected only to derive these booleans and are never
+ * returned or persisted by this gate.
+ */
+export declare function evaluateAgentRecovery(events: readonly ConversationEventV1[], promptId: string, identity: string): AgentRecoveryEvidence;
+export declare function recoverAgentIdentity(session: AgentSession, identity: string): Promise<AgentRecoveryEvidence>;

package/dist/agent-recovery-gate.js

@@ -0,0 +1,135 @@
+const TOOL_NAMES = {
+    choose: new Set(['choose_identity', 'ours.choose_identity', 'mcp__ours__choose_identity']),
+    current: new Set(['current_identity', 'ours.current_identity', 'mcp__ours__current_identity']),
+    messages: new Set(['get_messages', 'ours.get_messages', 'mcp__ours__get_messages']),
+};
+function recordFor(records, event) {
+    if (event.kind !== 'tool.upsert' || !event.toolCallId)
+        return undefined;
+    const payload = event.payload;
+    const previous = records.get(event.toolCallId) ?? {};
+    const next = {
+        ...previous,
+        ...(payload.title !== undefined ? { title: payload.title } : {}),
+        ...(payload.status !== undefined ? { status: payload.status } : {}),
+        ...(payload.rawInput !== undefined ? { rawInput: payload.rawInput } : {}),
+        ...(payload.status === 'completed' ? { completedSeq: event.seq } : {}),
+    };
+    records.set(event.toolCallId, next);
+    return next;
+}
+function objectInput(input) {
+    if (!input || input.truncated || input.redacted || !input.json
+        || typeof input.json !== 'object' || Array.isArray(input.json))
+        return undefined;
+    return input.json;
+}
+function safeChoose(record, identity) {
+    if (!record.title || !TOOL_NAMES.choose.has(record.title) || record.status !== 'completed')
+        return false;
+    const input = objectInput(record.rawInput);
+    if (!input)
+        return false;
+    const keys = Object.keys(input).sort();
+    if (keys.some(key => key !== 'force' && key !== 'name'))
+        return false;
+    return input.name === identity && (input.force === undefined || input.force === false);
+}
+function safeNoOrBoundedInput(record, names, allowed) {
+    if (!record.title || !names.has(record.title) || record.status !== 'completed')
+        return false;
+    if (!record.rawInput)
+        return allowed({});
+    const input = objectInput(record.rawInput);
+    return input !== undefined && allowed(input);
+}
+function safeCurrent(record) {
+    return safeNoOrBoundedInput(record, TOOL_NAMES.current, input => Object.keys(input).length === 0);
+}
+function safeMessages(record) {
+    return safeNoOrBoundedInput(record, TOOL_NAMES.messages, input => {
+        const keys = Object.keys(input);
+        if (keys.some(key => key !== 'limit'))
+            return false;
+        return input.limit === undefined
+            || (Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 200);
+    });
+}
+/**
+ * Verify one exact recovery turn from its durable conversation ledger. Tool
+ * arguments/results are inspected only to derive these booleans and are never
+ * returned or persisted by this gate.
+ */
+export function evaluateAgentRecovery(events, promptId, identity) {
+    const ordered = [...events].sort((a, b) => a.seq - b.seq);
+    const admitted = ordered.find(event => event.kind === 'prompt.admitted' && event.promptId === promptId);
+    const empty = (reason) => ({
+        ok: false, reason, chooseIdentity: false, currentIdentity: false,
+        getMessages: false, turnCompleted: false,
+    });
+    if (!admitted)
+        return empty('RECOVERY_PROMPT_MISSING');
+    const terminal = ordered.find(event => event.seq > admitted.seq
+        && event.kind === 'turn.completed'
+        && event.promptId === promptId
+        && event.sessionGeneration === admitted.sessionGeneration);
+    if (!terminal)
+        return empty('RECOVERY_TURN_INCOMPLETE');
+    const outcome = terminal.payload.outcome;
+    if (outcome !== 'completed')
+        return empty('RECOVERY_TURN_FAILED');
+    const records = new Map();
+    for (const event of ordered) {
+        if (event.seq <= admitted.seq || event.seq >= terminal.seq
+            || event.promptId !== promptId
+            || event.sessionGeneration !== admitted.sessionGeneration)
+            continue;
+        recordFor(records, event);
+    }
+    const values = [...records.values()];
+    const chooses = values.filter(record => safeChoose(record, identity));
+    const currents = values.filter(safeCurrent);
+    const messages = values.filter(safeMessages);
+    const chooseIdentity = chooses.length > 0;
+    const currentIdentity = currents.length > 0;
+    const getMessages = messages.length > 0;
+    const base = { chooseIdentity, currentIdentity, getMessages, turnCompleted: true };
+    if (!chooseIdentity)
+        return { ok: false, reason: 'RECOVERY_CHOOSE_MISSING', ...base };
+    if (!currentIdentity)
+        return { ok: false, reason: 'RECOVERY_CURRENT_MISSING', ...base };
+    if (!getMessages)
+        return { ok: false, reason: 'RECOVERY_GET_MESSAGES_MISSING', ...base };
+    const orderedChain = chooses.some(choose => currents.some(current => messages.some(message => choose.completedSeq !== undefined && current.completedSeq !== undefined
+        && message.completedSeq !== undefined
+        && choose.completedSeq < current.completedSeq
+        && current.completedSeq < message.completedSeq)));
+    if (!orderedChain)
+        return { ok: false, reason: 'RECOVERY_TOOL_ORDER_INVALID', ...base };
+    return { ok: true, reason: 'RECOVERY_TOOLS_VERIFIED', ...base };
+}
+export async function recoverAgentIdentity(session, identity) {
+    if (!session.subscribeConversation)
+        return {
+            ok: false, reason: 'RECOVERY_PROMPT_MISSING', chooseIdentity: false,
+            currentIdentity: false, getMessages: false, turnCompleted: false,
+        };
+    const events = [];
+    const unsubscribe = session.subscribeConversation(event => events.push(event));
+    try {
+        const queued = await session.queuePrompt([
+            '[fleet-recovery] The shared ours daemon restarted.',
+            `Call ours choose_identity with name ${JSON.stringify(identity)} and force false.`,
+            'Then call current_identity, then get_messages. Complete all three in that order.',
+            'Do not create/delete identities, force-bind, interrupt, or restart any service/session.',
+        ].join('\n'), { origin: { kind: 'fleet-monitor' } });
+        await queued.completion;
+        // Conversation publication is synchronous with terminal settlement in the
+        // in-tree ACP store; filtering by exact promptId/sessionGeneration remains
+        // the authority even if unrelated events arrived concurrently.
+        return evaluateAgentRecovery(events, queued.promptId, identity);
+    }
+    finally {
+        unsubscribe();
+    }
+}

package/dist/application/fleet-query-service.js

@@ -4,6 +4,7 @@ import { classifyActivity } from '../session/activity.js';
 import { controlRequest } from '../session/control.js';
 import { SessionControlError } from '../session/types.js';
 import { readExitRecord, readRestartLedger } from '../runner.js';
+import { readDaemonRecoveryStatus } from '../daemon-recovery.js';
 import { roleCapabilities } from './capabilities.js';
 import { FleetError } from './errors.js';
 const clean = (value, max = 512) => value.replace(/[\0-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '').trim().slice(0, max);
@@ -46,7 +47,8 @@ function readIsolation(dir) {
 function sessionOverall(supervisor, session, restart, monitor, isolation, problems) {
     if (restart.circuit === 'open' || monitor.health === 'failed' || monitor.health === 'degraded'
         || isolation.degraded
-        || problems.some(problem => problem.severity === 'error' || problem.source === 'watchdog')
+        || problems.some(problem => problem.severity === 'error'
+            || problem.source === 'watchdog' || problem.source === 'daemon-recovery')
         || session.readiness === 'failed')
         return 'attention';
     // A reachable agent session is the user's live interaction surface. Its
@@ -103,6 +105,16 @@ export class FleetQueryService {
         const lastExit = dir ? readExitRecord(join(dir, '.exit-status')) ?? undefined : undefined;
         const session = await this.session(role, dir, live.state);
         const problems = [...role.problems];
+        const recovery = dir ? readDaemonRecoveryStatus(dir) : undefined;
+        if (recovery && recovery.state !== 'recovered') {
+            const paths = ['agent', 'owner']
+                .filter(name => recovery.paths[name].state !== 'recovered')
+                .map(name => `${name}:${recovery.paths[name].state}`);
+            problems.push({
+                code: 'daemon_recovery', severity: 'warning', source: 'daemon-recovery',
+                detail: `${recovery.state}; ${paths.join(', ') || 'no degraded path'}; epoch ${recovery.epoch || 'unavailable'}`,
+            });
+        }
         if (live.state === 'running' && session.reachability !== 'online')
             problems.push({
                 code: 'supervisor_session_disagreement', severity: 'warning',

package/dist/application/task-room-service.d.ts

@@ -179,7 +179,7 @@ export declare class TaskRoomApplicationService {
         name: string;
         version: number;
         description: string;
-        builtin?: boolean;
+        sourceFile?: string;
         room?: import("../rooms-tasks/types.js").TemplateRoomConfig;
         contract?: string;
         members: import("../rooms-tasks/types.js").TemplateMemberSlot[];

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.1.0-nightly.6",
-  "buildId": "e174f2cdb42c",
-  "commit": "53aa98d46005a693784fbc11957d6118048249c8",
+  "version": "1.1.0-nightly.8",
+  "buildId": "871d3c2bae20",
+  "commit": "cfd589d27e88eb95710df1f037a4c13e22eedb79",
   "dirty": true,
-  "builtAt": "2026-08-31T06:49:46.839Z",
+  "builtAt": "2026-08-31T09:40:52.301Z",
   "capabilities": [
     "monitor.interrupt.after_tool"
   ]

package/dist/cli.js

@@ -8,6 +8,7 @@ import { createInterface } from 'node:readline';
 import { Command } from 'commander';
 import { VERSION } from './version.js';
 import { INIT_COMPLETION_GUIDANCE } from './init-guidance.js';
+import { bootstrapPresets } from './preset-bootstrap.js';
 import { analyzeInstalls, buildInfo, buildLabel, discoverInstalls, runningLabel, } from './provenance.js';
 import { agentDir, agentsRoot, tmpRoot, logsRoot, deriveXdgRuntimeDir } from './paths.js';
 import { findRole, loadConfig, ROLE_NAME_RE } from './config.js';
@@ -1264,12 +1265,15 @@ cOpt(program.command('doctor').description('prerequisite report'))
     if (!rep.ok)
         throw new FleetCliExit(1);
 });
-program.command('init').description('one-time host setup (units, dirs, linger)')
-    .action(async () => {
+cOpt(program.command('init').description('idempotent host setup plus missing packaged presets'))
+    .action(async (opts) => {
     for (const d of [agentsRoot(), tmpRoot(), logsRoot()])
         mkdirSync(d, { recursive: true });
     for (const m of await pickBackend().init(binPath))
         console.log(m);
+    const seeded = bootstrapPresets(opts.configuration);
+    console.log(`Packaged preset revision ${seeded.revision}: ${seeded.sourceRoot}`);
+    console.log(`Created ${seeded.created.length}; preserved ${seeded.preserved.length} existing file(s).`);
     console.log(INIT_COMPLETION_GUIDANCE);
 });
 const webCommand = cOpt(program.command('web').description('start or open the secure localhost fleet web console'))

package/dist/config-yaml.d.ts

@@ -1,5 +1,5 @@
 export type YamlMode = 'compat' | 'strict';
-export type ConfigDiagnosticKind = 'anchor' | 'alias' | 'explicit-tag' | 'non-scalar-key' | 'multiple-documents';
+export type ConfigDiagnosticKind = 'anchor' | 'alias' | 'explicit-tag' | 'non-scalar-key' | 'multiple-documents' | 'deprecated-field';
 export interface ConfigDiagnostic {
     severity: 'warning';
     kind: ConfigDiagnosticKind;

package/dist/config.d.ts

@@ -220,7 +220,7 @@ export interface FleetConfig {
     files: string[];
     configMode?: 'split-v2';
     sourceDocuments?: Array<{
-        kind: 'Manifest' | 'Agent' | 'Role' | 'Brain';
+        kind: 'Manifest' | 'Agent' | 'Role' | 'Brain' | 'RoomTemplate';
         id?: string;
         path: string;
     }>;

package/dist/config.js

@@ -265,6 +265,35 @@ function readKindDirectory(root, kind, required, yamlMode, diagnostics, files) {
     }
     return result;
 }
+function readRoomTemplateDirectory(root, yamlMode, diagnostics, files) {
+    if (!existsSync(root))
+        return {};
+    assertTrustedPath(root, 'directory');
+    const result = {};
+    const sources = new Map();
+    const names = readdirSync(root)
+        .filter(name => ['.yaml', '.yml'].includes(extname(name).toLowerCase())).sort();
+    for (const filename of names) {
+        const file = join(root, filename);
+        assertTrustedPath(file, 'file');
+        const id = basename(filename, extname(filename));
+        const previous = sources.get(id);
+        if (previous)
+            throw new ConfigError(`E_DUPLICATE_ID: room template '${id}' defined by both ${previous} and ${file}`);
+        const parsed = parseFleetDocument(file, readFileSync(file, 'utf8'), yamlMode);
+        diagnostics.push(...parsed.diagnostics);
+        if (parsed.value.override_builtin === true)
+            diagnostics.push({
+                severity: 'warning', kind: 'deprecated-field', file, line: 1, column: 1,
+                message: `${file}: override_builtin is deprecated and ignored for a file-backed Room template`,
+            });
+        files.push(file);
+        const validated = validateRoomTemplatesConfig({ [id]: parsed.value }, file)[id];
+        result[id] = { ...validated, sourceFile: file };
+        sources.set(id, file);
+    }
+    return result;
+}
 function selection(raw, kind, agentFile, presets, allowed) {
     if (!isPlainObject(raw))
         schemaError(agentFile, `/${kind}`, 'must be { ref } or { inline }');
@@ -586,6 +615,9 @@ export function loadConfig(configPath, options = {}) {
     let ownerInvite;
     let roomTemplates;
     let tasks;
+    const fileTemplates = readRoomTemplateDirectory(join(splitRootFor(base), 'room_templates'), options.yamlMode ?? 'compat', diagnostics, files);
+    if (Object.keys(fileTemplates).length)
+        roomTemplates = fileTemplates;
     for (const { file, doc } of docs) {
         if (doc.rooms !== undefined) {
             if (rooms)
@@ -598,7 +630,21 @@ export function loadConfig(configPath, options = {}) {
         }
         if (doc.room_templates !== undefined) {
             const validated = validateRoomTemplatesConfig(deepSub(doc.room_templates, vars), file);
-            roomTemplates = { ...(roomTemplates ?? {}), ...validated };
+            const raw = doc.room_templates;
+            for (const [name, template] of Object.entries(validated)) {
+                const shadowed = roomTemplates?.[name];
+                const marker = raw[name]?.override_builtin;
+                if (shadowed && (marker !== true || template.version <= shadowed.version))
+                    throw new ConfigError(`${file}: room_templates.${name} shadows file preset ${shadowed.sourceFile}; `
+                        + 'set override_builtin: true and use a higher version');
+                if (marker === true)
+                    diagnostics.push({
+                        severity: 'warning', kind: 'deprecated-field', file, line: 1, column: 1,
+                        message: `${file}: room_templates.${name}.override_builtin is deprecated; `
+                            + 'it is retained only as an explicit manifest-over-file migration marker',
+                    });
+                roomTemplates = { ...(roomTemplates ?? {}), [name]: { ...template, sourceFile: file } };
+            }
         }
         if (doc.tasks !== undefined) {
             if (tasks)
@@ -616,7 +662,8 @@ export function loadConfig(configPath, options = {}) {
                 return { kind: 'Manifest', path };
             const parent = basename(dirname(path));
             const kind = parent === 'agents' ? 'Agent'
-                : parent === 'roles' ? 'Role' : 'Brain';
+                : parent === 'roles' ? 'Role'
+                    : parent === 'room_templates' ? 'RoomTemplate' : 'Brain';
             return { kind, id: basename(path, extname(path)), path };
         }),
     };

package/dist/daemon-recovery.d.ts

@@ -0,0 +1,93 @@
+import { type FetchLike } from './monitor.js';
+export declare const DAEMON_RECOVERY_MAX_ATTEMPTS = 6;
+export declare const DAEMON_RECOVERY_INITIAL_BACKOFF_MS = 1000;
+export declare const DAEMON_RECOVERY_MAX_BACKOFF_MS = 5000;
+export declare const DAEMON_RECOVERY_DEADLINE_MS = 60000;
+export interface DaemonGeneration {
+    bootId: string;
+    pid: number;
+    startedAt: number;
+    stateDir: string;
+}
+export type DaemonGenerationProbe = {
+    state: 'ready';
+    generation: DaemonGeneration;
+} | {
+    state: 'unavailable';
+    reason: string;
+};
+export type DaemonGenerationObservation = {
+    kind: 'baseline' | 'stable' | 'available';
+    generation: DaemonGeneration;
+} | {
+    kind: 'changed';
+    previous: DaemonGeneration;
+    generation: DaemonGeneration;
+} | {
+    kind: 'lost' | 'unavailable';
+    previous?: DaemonGeneration;
+    reason: string;
+};
+interface GenerationProbeDeps {
+    readText?(path: string): string;
+    canonicalize?(path: string): string;
+}
+/**
+ * Corroborate the loopback daemon's unauthenticated `/info`, its credentialed
+ * identity-index readiness route, and its local boot-generation record. The
+ * index enforces auth when the daemon visibility requires it; open visibility
+ * deliberately does not. No source is sufficient
+ * alone: `/info` has no boot id, the identity index has no generation, and a
+ * stale `ready` file can outlive the process that wrote it.
+ */
+export declare function probeDaemonGeneration(fetch: FetchLike, env: NodeJS.ProcessEnv, deps?: GenerationProbeDeps): Promise<DaemonGenerationProbe>;
+export declare class DaemonGenerationObserver {
+    private current?;
+    private unavailable;
+    observe(probe: DaemonGenerationProbe): DaemonGenerationObservation;
+}
+export declare function daemonRecoveryBackoff(attempt: number): number;
+export type RecoveryPath = 'agent' | 'owner';
+export type RecoveryPathResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+export interface RoleRecoveryControllerOptions {
+    role: string;
+    identity: string;
+    stateDir: string;
+    now(): number;
+    sleep(ms: number): Promise<void>;
+    recoverAgent(epoch: string): Promise<RecoveryPathResult>;
+    recoverOwner(epoch: string): Promise<RecoveryPathResult>;
+    log(line: string): void;
+}
+export interface RecoveryStatus {
+    version: 1;
+    identity: string;
+    epoch: string;
+    state: 'recovering' | 'recovered' | 'degraded' | 'cancelled';
+    paths: Record<RecoveryPath, {
+        state: 'pending' | 'recovered' | 'degraded';
+        attempts: number;
+        reason?: string;
+    }>;
+    updatedAt: string;
+}
+export declare function readDaemonRecoveryStatus(dir: string): RecoveryStatus | undefined;
+/** Per-role, per-generation bounded recovery with path-level fault isolation. */
+export declare class RoleRecoveryController {
+    private readonly options;
+    private token;
+    private activeEpoch?;
+    private active?;
+    private status?;
+    constructor(options: RoleRecoveryControllerOptions);
+    recover(generation: DaemonGeneration): Promise<RecoveryStatus>;
+    cancel(): void;
+    noteLoss(reason: string): void;
+    private write;
+}
+export {};