@ours.network/fleet 1.1.0-nightly.6 → 1.1.0-nightly.8

package/dist/init-guidance.js

@@ -1,5 +1,6 @@
 export const INIT_COMPLETION_GUIDANCE = `
 Next:
-  cp "$(npm root -g)/@ours.network/fleet/examples/fleet.yaml" ~/fleet.yaml
-  cp -R "$(npm root -g)/@ours.network/fleet/examples/fleet" ~/fleet
-  edit ~/fleet.yaml and ~/fleet/{agents,roles,brains}/*.yaml, then: ours-fleet up`;
+  ours-fleet config
+  ours-fleet template list
+  edit the seeded manifest and fleet/{agents,roles,brains,room_templates}/*.yaml
+  configure rooms.owner, then create a task with --template single, pair, or team`;

package/dist/owner-channel/channel.d.ts

@@ -1,6 +1,7 @@
 import { type OwnerChannelConfig } from '../config.js';
 import { type AgentSession } from '../session/types.js';
 import { type OwnerFleetOps } from './commands.js';
+import type { ManagedFleetSpawnResult } from '../fleet-proxy.js';
 import { type FleetAuditAttempt, type FleetAuditPresentation, type FleetCommandOutcomeClass } from '../fleet-command-audit.js';
 import { type OursOps } from './ours-client.js';
 import { type OwnerUpdatePhase } from './notices.js';
@@ -27,12 +28,24 @@ export interface OwnerChannelOptions {
     binderDeps?: OwnerBinderDeps;
     /** Pre-acquired by the runner so the predecessor control socket remains reachable while waiting. */
     binderLease?: OwnerBinderLease;
+    recoveryDeps?: {
+        now(): number;
+        setTimer(fn: () => void, ms: number): ReturnType<typeof setTimeout>;
+        clearTimer(timer: ReturnType<typeof setTimeout>): void;
+        deadlineMs?: number;
+    };
 }
 export interface OwnerChannelHandle {
     start(): Promise<void>;
     drain(): Promise<void>;
     close(): Promise<void>;
+    /** Reattach this same supervisor-owned channel after a daemon generation change. */
+    recover?(epoch: string): Promise<void>;
+    /** False when shutdown skipped client disposal because quiescence was unproven. */
+    binderReleaseSafe?(): boolean;
     manage(request: OwnerChannelManagementRequest): Promise<OwnerChannelManagementResult>;
+    /** Fleet-owned deterministic lifecycle notice; absent on legacy test doubles. */
+    notifyFleetSpawn?(event: ManagedFleetSpawnResult): Promise<void>;
     beginFleetCommandAudit?(requestId: string, argv: string[]): Promise<FleetAuditAttempt>;
     finishFleetCommandAudit?(input: {
         correlationId: string;
@@ -43,6 +56,17 @@ export interface OwnerChannelHandle {
         presentation?: FleetAuditPresentation;
     }): Promise<FleetAuditAttempt>;
 }
+export declare const OWNER_RECOVERY_QUEUE_CAPACITY = 32;
+export declare const OWNER_RECOVERY_DEGRADED = "OWNER_RECOVERY_DEGRADED";
+export declare class OwnerRecoveryDegradedError extends Error {
+    readonly code = "OWNER_RECOVERY_DEGRADED";
+    constructor();
+}
+export declare class OwnerRecoveryTimeoutError extends Error {
+    readonly stage: string;
+    readonly code = "OWNER_RECOVERY_DEGRADED";
+    constructor(stage: string);
+}
 export type OwnerChannelManagementRequest = {
     action: 'contact_list';
 } | {
@@ -169,7 +193,17 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private readonly completionTasks;
     private readonly activeRequests;
     private managementTail;
+    private recoveryEpoch?;
+    private recoveryTask?;
+    private recoveryToken;
+    private recoveryQueued;
+    private watchGeneration;
+    /** A timed-out client operation that must settle before replacement is safe. */
+    private recoveryQuiescence?;
+    private releaseSafe;
     private ready;
+    private startedOnce;
+    private shutdownDegraded;
     private binder?;
     private binderOwnedInternally;
     private readonly fleetOps;
@@ -179,7 +213,9 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     start(): Promise<void>;
     drain(): Promise<void>;
     close(): Promise<void>;
+    binderReleaseSafe(): boolean;
     manage(request: OwnerChannelManagementRequest): Promise<OwnerChannelManagementResult>;
+    notifyFleetSpawn(event: ManagedFleetSpawnResult): Promise<void>;
     beginFleetCommandAudit(requestId: string, argv: string[]): Promise<FleetAuditAttempt>;
     finishFleetCommandAudit(input: {
         correlationId: string;
@@ -189,6 +225,10 @@ export declare class OwnerChannel implements OwnerChannelHandle {
         resourceIds?: Record<string, string>;
         presentation?: FleetAuditPresentation;
     }): Promise<FleetAuditAttempt>;
+    recover(epoch: string): Promise<void>;
+    private recoveryStage;
+    private writeShutdownState;
+    private queueManagement;
     private manageNow;
     /**
      * The daemon reports established contacts and pending introductions as two

package/dist/owner-channel/channel.js

@@ -3,6 +3,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { mkdir, readFile, readdir, rm } from 'node:fs/promises';
 import { join } from 'node:path';
 import { canonicalCid } from '../config.js';
+import { DAEMON_RECOVERY_DEADLINE_MS } from '../daemon-recovery.js';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { TaskRoomApplicationService } from '../application/task-room-service.js';
 import { RoleLifecycleService } from '../application/role-command-service.js';
@@ -22,6 +23,24 @@ import { OwnerTaskState, ownerTaskAuditId, ownerTaskDigest, } from './tasks.js';
 import { AttachmentRecoveryState, admitAttachments, cleanupAttachmentRoot, parseIncomingAttachments, parseRetrievedAttachments, prepareAttachmentDirectory, recoveredAttachment, removeRequestDirectory, safeField, validateAttachmentSelection, validateAttachmentRelaySelection, writeRecoveredAttachment, } from './attachments.js';
 import { acquireOwnerBinderLease, OWNER_BIND_HANDOFF_TIMEOUT_MS, } from './binder.js';
 import { MessageRecoveryState } from './message-recovery.js';
+export const OWNER_RECOVERY_QUEUE_CAPACITY = 32;
+export const OWNER_RECOVERY_DEGRADED = 'OWNER_RECOVERY_DEGRADED';
+export class OwnerRecoveryDegradedError extends Error {
+    code = OWNER_RECOVERY_DEGRADED;
+    constructor() {
+        super('owner channel recovery is degraded');
+        this.name = 'OwnerRecoveryDegradedError';
+    }
+}
+export class OwnerRecoveryTimeoutError extends Error {
+    stage;
+    code = OWNER_RECOVERY_DEGRADED;
+    constructor(stage) {
+        super(`owner channel recovery timed out at ${stage}`);
+        this.stage = stage;
+        this.name = 'OwnerRecoveryTimeoutError';
+    }
+}
 const OWNER_UPDATE_MIN_INTERVAL_MS = 5_000;
 const OWNER_UPDATE_MAX_COUNT = 20;
 const OWNER_UPDATE_MAX_CHARS = 280;
@@ -77,7 +96,17 @@ export class OwnerChannel {
     completionTasks = new Set();
     activeRequests = new Map();
     managementTail = Promise.resolve();
+    recoveryEpoch;
+    recoveryTask;
+    recoveryToken = 0;
+    recoveryQueued = 0;
+    watchGeneration = 0;
+    /** A timed-out client operation that must settle before replacement is safe. */
+    recoveryQuiescence;
+    releaseSafe = true;
     ready = false;
+    startedOnce = false;
+    shutdownDegraded = false;
     binder;
     binderOwnedInternally = false;
     fleetOps;
@@ -127,6 +156,7 @@ export class OwnerChannel {
     }
     async start() {
         this.stopping = false;
+        this.shutdownDegraded = false;
         this.binderOwnedInternally = !this.options.binderLease;
         this.binder = this.options.binderLease ?? await acquireOwnerBinderLease(this.options.stateDir, this.options.role, this.options.config.identity, this.options.binderDeps);
         try {
@@ -167,11 +197,12 @@ export class OwnerChannel {
             this.attachmentRecovery.cleanup(Date.now(), this.attachmentConfig.retention_ms);
             void cleanupAttachmentRoot(this.attachmentRoot, Date.now(), this.attachmentConfig.retention_ms).catch(error => this.logError('attachment crash cleanup failed', error));
         }
+        this.startedOnce = true;
         this.ready = true;
         // Do not make role startup wait for an old owner request to finish a turn.
         // watchLoop itself drains before every establishment, including this first
         // one, so there is no drain-to-tip race.
-        this.watchTask = this.watchLoop();
+        this.watchTask = this.watchLoop(++this.watchGeneration);
     }
     drain() {
         this.drainRequested = true;
@@ -186,25 +217,65 @@ export class OwnerChannel {
         return this.drainTask;
     }
     async close() {
+        if (this.recoveryTask)
+            this.shutdownDegraded = true;
         this.stopping = true;
         this.ready = false;
-        this.watchAbort?.abort();
-        await this.watchTask?.catch(error => this.logError('watch shutdown failed', error));
+        this.recoveryToken++;
+        this.watchGeneration++;
+        const staleWatch = this.watchTask;
         this.watchTask = undefined;
-        await this.managementTail;
+        this.watchAbort?.abort();
+        const now = this.options.recoveryDeps?.now ?? (() => Date.now());
+        const deadlineAt = now()
+            + (this.options.recoveryDeps?.deadlineMs ?? DAEMON_RECOVERY_DEADLINE_MS);
+        let disposed = false;
         try {
-            await this.client.close();
+            await this.recoveryStage('shutdown_quiescence', Promise.all([
+                staleWatch?.catch(error => this.logError('watch shutdown failed', error)),
+                this.drainTask?.catch(error => this.logError('drain shutdown failed', error)),
+                this.managementTail.then(() => undefined),
+                this.recoveryQuiescence,
+            ]), deadlineAt);
+            await this.recoveryStage('shutdown_close', this.client.close(), deadlineAt);
+            disposed = true;
+            this.writeShutdownState('closed', 'OWNER_SHUTDOWN_CLOSED', now());
+        }
+        catch (error) {
+            this.shutdownDegraded = true;
+            this.releaseSafe = false;
+            const stage = error instanceof OwnerRecoveryTimeoutError ? error.stage : 'shutdown_unknown';
+            this.writeShutdownState('degraded', `OWNER_${stage.toUpperCase()}_TIMEOUT`, now());
+            this.options.log(`[${this.options.role}] owner shutdown degraded stage=${stage}`);
         }
         finally {
-            if (this.binderOwnedInternally)
+            if (disposed && this.binderOwnedInternally)
                 this.binder?.release();
-            this.binder = undefined;
+            if (disposed)
+                this.binder = undefined;
         }
     }
+    binderReleaseSafe() { return this.releaseSafe; }
     manage(request) {
-        const run = this.managementTail.then(() => this.manageNow(request));
-        this.managementTail = run.then(() => undefined, () => undefined);
-        return run;
+        return this.queueManagement(() => this.manageNow(request));
+    }
+    notifyFleetSpawn(event) {
+        return this.queueManagement(async () => {
+            if (!this.ready || this.stopping)
+                throw new Error('owner-channel MCP client is unavailable');
+            const model = event.model ? `, model ${event.model}` : '';
+            const monitorPolicy = event.monitor.interrupt === true
+                ? ' with interruption'
+                : event.monitor.interrupt === 'after_tool' ? ' with after-tool steering' : '';
+            const monitor = `${event.monitor.mode} monitor${monitorPolicy}`;
+            const permission = event.permissionMode
+                ? `; permission ${event.permissionMode.fleetMode}, native ${event.permissionMode.nativeMode}`
+                : '';
+            const inherited = event.inherited.length
+                ? ` Supervisor inherited omitted defaults: ${event.inherited.join(', ')}.` : '';
+            await this.sendProactiveMessage(`🧑‍💻 ${event.caller} spawned ${event.lifetime} agent ${event.role} `
+                + `(${event.harness}/${event.session}${model}; ${monitor}${permission}).${inherited}`, `fleet-spawn\0${event.creationActionId}`, 0);
+        });
     }
     beginFleetCommandAudit(requestId, argv) {
         const run = this.managementTail.then(async () => {
@@ -263,6 +334,129 @@ export class OwnerChannel {
         this.managementTail = run.then(() => undefined, () => undefined);
         return run;
     }
+    recover(epoch) {
+        if (this.stopping)
+            return Promise.reject(new Error('owner channel is stopping'));
+        if (this.recoveryEpoch === epoch && this.recoveryTask)
+            return this.recoveryTask;
+        this.recoveryEpoch = epoch;
+        this.ready = false;
+        const token = ++this.recoveryToken;
+        const watchGeneration = ++this.watchGeneration;
+        const staleWatch = this.watchTask;
+        this.watchTask = undefined;
+        this.watchAbort?.abort();
+        const superseded = () => this.stopping || token !== this.recoveryToken;
+        const now = this.options.recoveryDeps?.now ?? (() => Date.now());
+        const deadlineAt = now()
+            + (this.options.recoveryDeps?.deadlineMs ?? DAEMON_RECOVERY_DEADLINE_MS);
+        const run = this.managementTail.then(async () => {
+            if (superseded())
+                throw new Error('owner recovery epoch superseded');
+            if (this.recoveryQuiescence) {
+                const debt = this.recoveryQuiescence;
+                await this.recoveryStage('prior_quiescence', debt, deadlineAt);
+                if (this.recoveryQuiescence === debt)
+                    this.recoveryQuiescence = undefined;
+            }
+            // Quiesce every stale-client reader before replacing its transport. A
+            // watch can be inside the shared drain task when its abort lands.
+            await this.recoveryStage('stale_quiescence', Promise.all([
+                staleWatch?.catch(error => this.logError('stale watch shutdown failed', error)),
+                this.drainTask?.catch(error => this.logError('stale drain shutdown failed', error)),
+            ]), deadlineAt);
+            if (superseded())
+                throw new Error('owner recovery epoch superseded');
+            await this.recoveryStage('close', this.client.close(), deadlineAt);
+            if (superseded())
+                throw new Error('owner recovery epoch superseded');
+            try {
+                await this.recoveryStage('start', this.client.start(), deadlineAt);
+                if (superseded())
+                    throw new Error('owner recovery epoch superseded');
+                await this.recoveryStage('bind', this.client.bindIdentity(this.options.config.identity), deadlineAt);
+                if (superseded())
+                    throw new Error('owner recovery epoch superseded');
+                // Journal-aware drain is the only operation allowed to mark owner mail
+                // read. The final listing is a typed, read-only channel probe.
+                await this.recoveryStage('drain', this.drain(), deadlineAt);
+                await this.recoveryStage('list', this.client.listIncomingMessages(), deadlineAt);
+                if (superseded())
+                    throw new Error('owner recovery epoch superseded');
+                this.ready = true;
+                this.watchTask = this.watchLoop(watchGeneration);
+            }
+            catch (error) {
+                this.ready = false;
+                if (token === this.recoveryToken)
+                    this.recoveryToken++;
+                // A timed-out operation may still be using this client. Never overlap
+                // its disposal; the recorded quiescence debt gates the next retry.
+                if (!this.recoveryQuiescence) {
+                    try {
+                        await this.recoveryStage('close_after_failure', this.client.close(), deadlineAt);
+                    }
+                    catch (closeError) {
+                        this.logError('recovery client close failed', closeError);
+                    }
+                }
+                throw error;
+            }
+        });
+        this.managementTail = run.then(() => undefined, () => undefined);
+        const task = run.finally(() => {
+            if (this.recoveryTask === task)
+                this.recoveryTask = undefined;
+        });
+        this.recoveryTask = task;
+        return task;
+    }
+    recoveryStage(stage, operation, deadlineAt) {
+        const now = this.options.recoveryDeps?.now ?? (() => Date.now());
+        const remaining = Math.max(0, deadlineAt - now());
+        const setTimer = this.options.recoveryDeps?.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
+        const clearTimer = this.options.recoveryDeps?.clearTimer ?? (timer => clearTimeout(timer));
+        let timer;
+        const timeout = new Promise((_resolve, reject) => {
+            timer = setTimer(() => reject(new OwnerRecoveryTimeoutError(stage)), remaining);
+        });
+        return Promise.race([operation, timeout]).catch(error => {
+            if (error instanceof OwnerRecoveryTimeoutError) {
+                const debt = operation.then(() => undefined, () => undefined);
+                this.recoveryQuiescence = debt;
+            }
+            throw error;
+        }).finally(() => clearTimer(timer));
+    }
+    writeShutdownState(state, reason, at) {
+        try {
+            replaceFileAtomically(join(this.options.stateDir, '.owner-channel-shutdown.json'), JSON.stringify({ version: 1, state, reason, at: new Date(at).toISOString() }, null, 2) + '\n');
+        }
+        catch (error) {
+            this.logError('shutdown status write failed', error);
+        }
+    }
+    queueManagement(operation) {
+        const deferred = this.recoveryTask !== undefined && !this.ready;
+        if (!this.ready && !deferred)
+            return Promise.reject(!this.startedOnce || (this.stopping && !this.shutdownDegraded)
+                ? new Error('owner-channel MCP client is unavailable')
+                : new OwnerRecoveryDegradedError());
+        if (deferred && this.recoveryQueued >= OWNER_RECOVERY_QUEUE_CAPACITY)
+            return Promise.reject(new Error('owner recovery queue is full'));
+        if (deferred)
+            this.recoveryQueued++;
+        const run = this.managementTail.then(() => {
+            if (!this.ready || this.stopping)
+                throw new OwnerRecoveryDegradedError();
+            return operation();
+        });
+        this.managementTail = run.then(() => undefined, () => undefined);
+        return run.finally(() => {
+            if (deferred)
+                this.recoveryQueued = Math.max(0, this.recoveryQueued - 1);
+        });
+    }
     async manageNow(request) {
         if (!this.ready || this.stopping)
             throw new Error('owner-channel MCP client is unavailable');
@@ -1916,7 +2110,7 @@ export class OwnerChannel {
         }
         return undefined;
     }
-    async watchLoop() {
+    async watchLoop(generation) {
         const sleep = this.options.binderDeps?.sleep
             ?? (ms => new Promise(resolve => setTimeout(resolve, ms)));
         const restored = this.readWatchState();
@@ -1925,7 +2119,7 @@ export class OwnerChannel {
             state = this.writeWatchState(state, 'OWNER_WATCH_STATE_RECOVERED');
         let delayMs = 1_000;
         let attempts = 0;
-        while (!this.stopping) {
+        while (!this.stopping && generation === this.watchGeneration) {
             const ctrl = new AbortController();
             this.watchAbort = ctrl;
             try {
@@ -1935,12 +2129,12 @@ export class OwnerChannel {
                 // fall into a gap. Persistent history plus fleet's body-free claim
                 // journal is authoritative; durable wire-ID dedupe makes hints harmless.
                 await this.drain();
-                if (this.stopping)
+                if (this.stopping || generation !== this.watchGeneration)
                     return;
                 state = this.writeWatchState(state, 'OWNER_WATCH_CONNECTING', { reconnected: attempts > 0 });
                 attempts++;
                 for await (const _event of this.client.watchNotifications(this.options.config.identity, { since: 0, signal: ctrl.signal })) {
-                    if (this.stopping)
+                    if (this.stopping || generation !== this.watchGeneration)
                         return;
                     state = this.writeWatchState(state, 'OWNER_WATCH_CONNECTED', { resetFailures: true });
                     delayMs = 1_000;
@@ -1949,11 +2143,11 @@ export class OwnerChannel {
                     // recorded before a managed request is dispatched.
                     await this.drain();
                 }
-                if (!this.stopping)
+                if (!this.stopping && generation === this.watchGeneration)
                     throw new Error('ours SDK notification stream ended');
             }
             catch (error) {
-                if (this.stopping)
+                if (this.stopping || generation !== this.watchGeneration)
                     return;
                 // SDK 2 deliberately hides transport status behind its typed stream.
                 // Do not parse error prose to rediscover it: every failure follows the

package/dist/owner-channel/commands.js

@@ -598,10 +598,7 @@ export const ownerCommands = [
             const templates = ctx.listTemplateQueries();
             if (!templates.length)
                 return ctx.reply('📐 No templates.');
-            const lines = templates.map(t => {
-                const tag = t.builtin ? ' (built-in)' : '';
-                return `${t.name}@${t.version}${tag}  ${t.description}`;
-            });
+            const lines = templates.map(t => `${t.name}@${t.version}  ${t.description}  [file: ${t.sourceFile ?? 'manifest'}]`);
             await ctx.reply(`📐 Templates:\n${lines.join('\n')}`);
         }),
     },
@@ -627,7 +624,7 @@ export const ownerCommands = [
                 const lines = [
                     `📐 Template: ${t.name}@${t.version}`,
                     `Description: ${t.description}`,
-                    ...(t.builtin ? ['Source: built-in'] : []),
+                    `Source: ${t.sourceFile ?? 'manifest'}`,
                     ...(t.contract ? [`Contract: ${t.contract}`] : []),
                     'Members:',
                     ...t.members.map(m => `  ${m.slot} (${m.role}) ×${m.count} → `
@@ -646,10 +643,7 @@ export const ownerCommands = [
                     const templates = ctx.listTemplateQueries();
                     if (!templates.length)
                         return ctx.reply('📐 No templates.');
-                    const lines = templates.map(t => {
-                        const tag = t.builtin ? ' (built-in)' : '';
-                        return `${t.name}@${t.version}${tag}  ${t.description}`;
-                    });
+                    const lines = templates.map(t => `${t.name}@${t.version}  ${t.description}  [file: ${t.sourceFile ?? 'manifest'}]`);
                     await ctx.reply(`📐 Templates:\n${lines.join('\n')}`);
                     break;
                 }

package/dist/preset-bootstrap.d.ts

@@ -0,0 +1,10 @@
+export interface BootstrapResult {
+    revision: number;
+    sourceRoot: string;
+    configPath: string;
+    created: string[];
+    preserved: string[];
+}
+export declare const packagedPresetRoot: () => string;
+/** Seed packaged defaults without replacing a single existing byte. */
+export declare function bootstrapPresets(configuration?: string): BootstrapResult;

package/dist/preset-bootstrap.js

@@ -0,0 +1,85 @@
+import { constants, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, chmodSync, } from 'node:fs';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { defaultConfigPath } from './paths.js';
+import { splitRootFor } from './config.js';
+export const packagedPresetRoot = () => fileURLToPath(new URL('../presets', import.meta.url));
+function assertSafeExisting(path, kind) {
+    const stat = lstatSync(path);
+    if (stat.isSymbolicLink())
+        throw new Error(`preset bootstrap refuses symlink target: ${path}`);
+    if (kind === 'file' ? !stat.isFile() : !stat.isDirectory())
+        throw new Error(`preset bootstrap expected ${kind}: ${path}`);
+    const uid = process.getuid?.();
+    if (uid !== undefined && stat.uid !== uid)
+        throw new Error(`preset bootstrap refuses target owned by uid ${stat.uid}: ${path}`);
+    if ((stat.mode & 0o022) !== 0)
+        throw new Error(`preset bootstrap refuses group/world-writable target: ${path}`);
+}
+function ensureDirectory(path) {
+    const parent = dirname(path);
+    if (parent !== path && !existsSync(parent))
+        ensureDirectory(parent);
+    if (existsSync(path)) {
+        assertSafeExisting(path, 'directory');
+        return;
+    }
+    mkdirSync(path, { mode: 0o700 });
+}
+function seedFile(source, target, result) {
+    ensureDirectory(dirname(target));
+    if (existsSync(target)) {
+        assertSafeExisting(target, 'file');
+        result.preserved.push(target);
+        return;
+    }
+    try {
+        copyFileSync(source, target, constants.COPYFILE_EXCL);
+        chmodSync(target, 0o600);
+        result.created.push(target);
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        assertSafeExisting(target, 'file');
+        result.preserved.push(target);
+    }
+}
+function presetFiles(root) {
+    const files = [];
+    const visit = (directory) => {
+        for (const entry of readdirSync(directory, { withFileTypes: true })) {
+            const path = join(directory, entry.name);
+            if (entry.isDirectory())
+                visit(path);
+            else if (entry.isFile())
+                files.push(path);
+        }
+    };
+    visit(root);
+    return files.sort();
+}
+/** Seed packaged defaults without replacing a single existing byte. */
+export function bootstrapPresets(configuration = defaultConfigPath()) {
+    const sourceRoot = packagedPresetRoot();
+    const manifest = JSON.parse(readFileSync(join(sourceRoot, 'manifest.json'), 'utf8'));
+    if (manifest.schema_version !== 1 || !Number.isInteger(manifest.preset_revision))
+        throw new Error(`invalid packaged preset manifest: ${join(sourceRoot, 'manifest.json')}`);
+    const configPath = resolve(configuration);
+    const result = {
+        revision: manifest.preset_revision, sourceRoot, configPath, created: [], preserved: [],
+    };
+    ensureDirectory(dirname(configPath));
+    seedFile(join(sourceRoot, 'fleet.yaml'), configPath, result);
+    const sourceSplit = join(sourceRoot, 'fleet');
+    const targetSplit = splitRootFor(configPath);
+    if (existsSync(targetSplit))
+        assertSafeExisting(targetSplit, 'directory');
+    for (const source of presetFiles(sourceSplit)) {
+        const rel = relative(sourceSplit, source);
+        if (rel.startsWith('..') || rel.includes(`..${sep}`))
+            throw new Error(`invalid packaged preset path: ${source}`);
+        seedFile(source, join(targetSplit, rel), result);
+    }
+    return result;
+}

package/dist/rooms-tasks/cli.js

@@ -43,7 +43,7 @@ function taskRoomPublicFailure(error) {
         case 'template_not_found': return {
             legacy: `template not found: ${f.template ?? 'requested-template'}`, kind: 'not_found',
             detail: `The requested template ${f.template ?? ''}`.trim() + ' was not found.',
-            action: 'Run ours-fleet template list and retry with an available template.',
+            action: 'Run ours-fleet init to seed missing file-backed presets, then run ours-fleet template list.',
         };
         case 'template_mismatch': return {
             legacy: `template ${f.requested ?? 'requested-template'} does not match room ${f.room ?? 'requested-room'}'s provisioned template ${f.provisioned ?? 'recorded-template'}`,
@@ -446,12 +446,11 @@ export function registerTemplateCommands(parent, cOpt) {
                 return;
             }
             if (!templates.length) {
-                console.log('No templates configured.');
+                console.log('No templates configured. Run ours-fleet init to seed missing file-backed presets.');
                 return;
             }
             for (const t of templates) {
-                const tag = t.builtin ? ' (built-in)' : '';
-                console.log(`${t.name}@${t.version}${tag}  ${t.description}`);
+                console.log(`${t.name}@${t.version}  ${t.description}  [file: ${t.sourceFile ?? 'manifest'}]`);
             }
         }
         catch (e) {
@@ -469,6 +468,7 @@ export function registerTemplateCommands(parent, cOpt) {
                 return;
             }
             console.log(`${t.name}@${t.version}  ${t.description}`);
+            console.log(`Source: ${t.sourceFile ?? 'manifest'}`);
             if (t.contract)
                 console.log(`\nContract:\n${t.contract}`);
             console.log(`\nMembers:`);

package/dist/rooms-tasks/config.js

@@ -1,7 +1,6 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { ROOMS_KEYS as RK, ROOMS_OWNER_KEYS as ROK, ROOMS_COWORK_KEYS as RCK, ROOMS_DEFAULTS_KEYS as RDK, TASKS_KEYS as TK, TEMPLATE_KEYS as TPK, TEMPLATE_MEMBER_KEYS as TMK, } from './types.js';
-import { BUILTIN_TEMPLATES } from './templates.js';
 import { isSensitiveConfigKey } from '../sensitive-config.js';
 const isPlainObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
 const CID_RE = /^[0-9a-fA-F]{64}$/;
@@ -117,9 +116,6 @@ export function validateRoomTemplatesConfig(raw, path) {
         if (!isPlainObject(tplRaw))
             throw new RoomsTasksConfigError(path, `room_templates.${name}: must be a mapping`);
         rejectUnknown(tplRaw, [...TPK, 'name'], path, `room_templates.${name}`);
-        const isBuiltinOverride = BUILTIN_TEMPLATES.some(b => b.name === name);
-        if (isBuiltinOverride && !tplRaw.override_builtin)
-            throw new RoomsTasksConfigError(path, `room_templates.${name}: overrides built-in template; set override_builtin: true and bump version`);
         const version = tplRaw.version;
         if (version === undefined || !Number.isInteger(version) || version < 1)
             throw new RoomsTasksConfigError(path, `room_templates.${name}.version: required positive integer`);

package/dist/rooms-tasks/templates.d.ts

@@ -1,5 +1,4 @@
 import type { TemplateDefinition, TemplateSnapshot } from './types.js';
-export declare const BUILTIN_TEMPLATES: readonly TemplateDefinition[];
 export declare function hashTemplate(t: TemplateDefinition): string;
 export declare function snapshotTemplate(t: TemplateDefinition): TemplateSnapshot;
 export declare function resolveTemplate(name: string, customTemplates: Record<string, TemplateDefinition>): TemplateDefinition | undefined;