@ours.network/fleet 1.1.0-nightly.9 → 1.1.1

package/dist/session/control.d.ts

@@ -9,7 +9,7 @@ export interface ControlRequest {
     version: 1 | 2 | 3;
     id: string;
     token: string;
-    command: 'status' | 'snapshot' | 'submit_prompt' | 'respond_permission' | 'interrupt' | 'follow' | 'events_since' | 'owner_channel_manage' | 'loop_status' | 'loop_run_now' | 'loop_disable' | 'loop_enable' | 'reload_config' | 'conversation_page' | 'conversation_follow' | 'submit_prompt_v2' | 'interrupt_v2' | 'respond_permission_v2' | 'fleet_spawn' | 'fleet_audit_begin' | 'fleet_audit_finish';
+    command: 'status' | 'snapshot' | 'submit_prompt' | 'respond_permission' | 'interrupt' | 'follow' | 'events_since' | 'owner_channel_manage' | 'loop_status' | 'loop_run_now' | 'loop_disable' | 'loop_enable' | 'reload_config' | 'conversation_page' | 'conversation_follow' | 'submit_prompt_v2' | 'interrupt_v2' | 'respond_permission_v2' | 'fleet_spawn' | 'fleet_audit_begin' | 'fleet_audit_present' | 'fleet_audit_finish';
     text?: string;
     permissionId?: string;
     optionId?: string;

package/dist/session/control.js

@@ -3,7 +3,7 @@ import { chmodSync, existsSync, readFileSync, rmSync, writeFileSync } from 'node
 import { createConnection, createServer } from 'node:net';
 import { join } from 'node:path';
 import { SessionControlError } from './types.js';
-import { validateFleetAuditBegin, validateFleetAuditFinish, } from '../fleet-command-audit.js';
+import { validateFleetAuditBegin, validateFleetAuditFinish, validateFleetAuditPresentations, } from '../fleet-command-audit.js';
 import { interruptSession, queueSessionPrompt, respondSessionPermission, respondSessionPermissionV2, } from '../application/session-mutations.js';
 const MAX_LINE_BYTES = 64 * 1024;
 /** Commands that require protocol version 3. */
@@ -236,6 +236,9 @@ export class RoleControlServer {
                             features: [
                                 'events_since', 'observer_follow', 'retained_range',
                                 ...(this.session.conversationPage ? ['conversation_v3'] : []),
+                                ...(this.session.capabilities?.steering ? ['steering'] : []),
+                                ...(this.session.capabilities?.permissions ? ['permissions'] : []),
+                                ...(this.session.capabilities?.messagePhases ? ['message_phases'] : []),
                             ],
                         },
                     });
@@ -346,6 +349,19 @@ export class RoleControlServer {
                     this.write(socket, { version: 1, id: request.id, ok: true, result });
                     return;
                 }
+                case 'fleet_audit_present': {
+                    if (!this.fleetAuditor)
+                        throw new SessionControlError('rejected', 'fleet auditing is unavailable');
+                    try {
+                        validateFleetAuditPresentations(request.audit?.presentations);
+                    }
+                    catch {
+                        throw new SessionControlError('rejected', 'valid Fleet lifecycle presentations are required');
+                    }
+                    await this.fleetAuditor.present(request.audit.presentations);
+                    this.write(socket, { version: 1, id: request.id, ok: true, result: { delivered: true } });
+                    return;
+                }
                 case 'owner_channel_manage': {
                     if (!request.ownerChannel || typeof request.ownerChannel.action !== 'string')
                         throw new SessionControlError('rejected', 'owner-channel management action is required');

package/dist/session/conversation-types.d.ts

@@ -1,14 +1,14 @@
 import type { PromptOrigin, TurnCancellationSource, TurnOutcome } from './types.js';
 /**
- * Durable conversation domain schema for the ACP web console.
+ * Durable conversation domain schema for managed-session consoles.
  *
  * `SessionEvent` in ./types.js remains the compact diagnostic projection; the
  * types here describe the durable per-role conversation ledger. Nothing in this
- * file touches the wire: ACP updates are reduced into these shapes by the
- * normalizer, and the store assigns `seq`/`eventId`/timestamps.
+ * file touches the wire: transport updates are reduced into these shapes by a
+ * session adapter, and the store assigns `seq`/`eventId`/timestamps.
  */
 export type ConversationEventKind = 'prompt.admitted' | 'prompt.started' | 'prompt.interrupt_requested' | 'message.chunk' | 'message.replace' | 'thought.chunk' | 'thought.replace' | 'plan.replace' | 'tool.upsert' | 'tool.content_chunk' | 'permission.requested' | 'permission.resolved' | 'monitor.delivery' | 'usage.updated' | 'turn.state' | 'turn.completed' | 'session.state' | 'session.info' | 'capabilities.updated' | 'error'
-/** A well-formed ACP update this version cannot represent. Bounded, never a crash. */
+/** A well-formed transport update this version cannot represent. Bounded, never a crash. */
  | 'unsupported';
 /** Where a conversation record came from. Typed provenance, never prompt text. */
 export type ConversationSource = 'owner_admin_console' | 'owner_channel' | 'fleet_monitor' | 'scheduled_loop' | 'startup' | 'local_console' | 'agent' | 'agent_replay';

package/dist/session/stall-watchdog.d.ts

@@ -0,0 +1,60 @@
+export declare const DEFAULT_STALL_TIMEOUT_MS: number;
+export declare const STALL_RECOVERY_PROMPT: string;
+export type StallStatus = 'interrupt_requested' | 'recovery_started' | 'progress_resumed' | 'recovery_completed' | 'blocked_cancel' | 'blocked_recovery' | 'blocked_restall' | 'blocked_persistence' | 'blocked_previous_attempt' | 'blocked_evidence' | 'superseded';
+export interface StallDiagnostic {
+    version: 1;
+    kind: 'stall_recovery';
+    eventId: string;
+    session: string;
+    turn: string;
+    status: StallStatus;
+    evidence: 'adapter_transport' | 'no_progress';
+    idleMs: number;
+}
+export interface StallObservation {
+    sessionId: string;
+    generation: string;
+    turnId: string;
+    startedAt: number;
+    lastProgressAt: number;
+    progressCount: number;
+    transportFailures: number;
+    safe: boolean;
+    boundaryEvidenceAvailable?: boolean;
+}
+/** Presence, including an incomplete claim, restores conservative mail policy. */
+export declare function hasStallRecoveryClaim(stateDir: string, sessionId: string): boolean;
+/** ACP has no turn IDs on tool updates. Reuse across turns is ambiguous. */
+export declare class StallToolHistory {
+    private readonly turns;
+    private healthy;
+    private readonly directory;
+    private readonly path;
+    private readonly session;
+    constructor(stateDir: string, sessionId: string, resume: boolean);
+    available(): boolean;
+    /** Record before relying on a tool event. False means cancellation is unsafe. */
+    observe(toolId: string, turnId: string): boolean;
+    private persist;
+}
+/**
+ * One durable attempt per ACP session, deliberately stricter than one per turn.
+ * A restarted supervisor never guesses whether cancellation or recovery ran.
+ * Claim files are never reclaimed automatically, including malformed/empty ones.
+ */
+export declare class StallWatchdog {
+    private readonly options;
+    private checking;
+    private disabled;
+    private unavailableTurn?;
+    constructor(options: {
+        stateDir: string;
+        timeoutMs: number;
+        previouslyClaimed?: boolean;
+        now(): number;
+        observe(): StallObservation | undefined;
+        recover(observed: StallObservation, report: (status: StallStatus) => void): Promise<void>;
+        diagnostic(event: StallDiagnostic): void;
+    });
+    tick(): Promise<void>;
+}

package/dist/session/stall-watchdog.js

@@ -0,0 +1,210 @@
+import { createHash } from 'node:crypto';
+import { closeSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically } from '../atomic-file.js';
+export const DEFAULT_STALL_TIMEOUT_MS = 15 * 60_000;
+export const STALL_RECOVERY_PROMPT = 'This is a diagnostic interruption. The previous turn showed no progress. '
+    + 'Inspect recorded terminal events and re-check completed actions before continuing. '
+    + 'Never assume an issued side effect failed: do not replay ambiguous or already-completed mutations. '
+    + 'Continue the previous task if safe; otherwise report an actionable blocker.';
+const digest = (text) => createHash('sha256').update(text).digest('hex');
+/** Presence, including an incomplete claim, restores conservative mail policy. */
+export function hasStallRecoveryClaim(stateDir, sessionId) {
+    try {
+        lstatSync(join(stateDir, '.stall-recovery', `${digest(sessionId)}.claim`));
+        return true;
+    }
+    catch (error) {
+        return error.code !== 'ENOENT';
+    }
+}
+/** ACP has no turn IDs on tool updates. Reuse across turns is ambiguous. */
+export class StallToolHistory {
+    turns = new Map();
+    healthy = true;
+    directory;
+    path;
+    session;
+    constructor(stateDir, sessionId, resume) {
+        this.session = digest(sessionId);
+        this.directory = join(stateDir, '.stall-recovery');
+        this.path = join(this.directory, `${this.session}.tools.json`);
+        try {
+            const stored = JSON.parse(readFileSync(this.path, 'utf8'));
+            if (stored.version !== 1 || stored.session !== this.session || !Array.isArray(stored.tools)
+                || stored.tools.length > 4096 || !stored.tools.every((id) => typeof id === 'string' && /^[a-f0-9]{64}$/.test(id)))
+                throw new Error('invalid history');
+            for (const id of stored.tools)
+                this.turns.set(id, 'previous-generation');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT' || resume)
+                this.healthy = false;
+            else {
+                try {
+                    mkdirSync(this.directory, { recursive: true, mode: 0o700 });
+                    this.persist();
+                    const fd = openSync(stateDir, 'r');
+                    try {
+                        fsyncSync(fd);
+                    }
+                    finally {
+                        closeSync(fd);
+                    }
+                }
+                catch {
+                    this.healthy = false;
+                }
+            }
+        }
+    }
+    available() { return this.healthy; }
+    /** Record before relying on a tool event. False means cancellation is unsafe. */
+    observe(toolId, turnId) {
+        if (!this.healthy || !toolId)
+            return false;
+        const id = digest(toolId);
+        const previous = this.turns.get(id);
+        if (previous !== undefined)
+            return previous === turnId;
+        if (this.turns.size >= 4096) {
+            this.healthy = false;
+            return false;
+        }
+        this.turns.set(id, turnId);
+        try {
+            this.persist();
+        }
+        catch {
+            this.healthy = false;
+        }
+        return this.healthy;
+    }
+    persist() {
+        replaceFileAtomically(this.path, JSON.stringify({ version: 1, session: this.session,
+            tools: [...this.turns.keys()] }) + '\n');
+        const fd = openSync(this.directory, 'r');
+        try {
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+}
+/**
+ * One durable attempt per ACP session, deliberately stricter than one per turn.
+ * A restarted supervisor never guesses whether cancellation or recovery ran.
+ * Claim files are never reclaimed automatically, including malformed/empty ones.
+ */
+export class StallWatchdog {
+    options;
+    checking = false;
+    disabled = false;
+    unavailableTurn;
+    constructor(options) {
+        this.options = options;
+    }
+    async tick() {
+        if (this.checking || this.disabled)
+            return;
+        const observed = this.options.observe();
+        if (!observed)
+            return;
+        const missingBoundary = observed.boundaryEvidenceAvailable === false;
+        if (!observed.safe && !missingBoundary && !this.options.previouslyClaimed)
+            return;
+        const missingEvidence = observed.progressCount === 0 || missingBoundary;
+        // Turn age can only produce an informational blocker, never cancellation.
+        const idleMs = this.options.now() - (observed.progressCount === 0 ? observed.startedAt : observed.lastProgressAt);
+        // Generic silence needs two full windows. Authenticated repeated transport
+        // failures strengthen evidence, but never bypass protected-operation checks.
+        const threshold = this.options.timeoutMs * (!missingEvidence && observed.transportFailures >= 2 ? 1 : 2);
+        if (!Number.isFinite(idleMs) || (idleMs < threshold && !this.options.previouslyClaimed))
+            return;
+        this.checking = true;
+        const session = digest(observed.sessionId);
+        const turn = digest(observed.generation + '\0' + observed.turnId);
+        const directory = join(this.options.stateDir, '.stall-recovery');
+        const report = (status) => {
+            const event = {
+                version: 1, kind: 'stall_recovery', eventId: `${turn}:${status}`,
+                session, turn, status, idleMs: Math.floor(idleMs),
+                evidence: observed.transportFailures >= 2 ? 'adapter_transport' : 'no_progress',
+            };
+            const fd = openSync(join(directory, 'audit.jsonl'), 'a', 0o600);
+            try {
+                writeFileSync(fd, JSON.stringify(event) + '\n');
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+            this.options.diagnostic(event);
+        };
+        try {
+            mkdirSync(directory, { recursive: true, mode: 0o700 });
+            const parentFd = openSync(this.options.stateDir, 'r');
+            try {
+                fsyncSync(parentFd);
+            }
+            finally {
+                closeSync(parentFd);
+            }
+            if (this.options.previouslyClaimed) {
+                this.disabled = true;
+                report('blocked_previous_attempt');
+                return;
+            }
+            if (missingEvidence) {
+                if (this.unavailableTurn !== turn) {
+                    this.unavailableTurn = turn;
+                    report('blocked_evidence');
+                }
+                return;
+            }
+            let fd;
+            try {
+                fd = openSync(join(directory, `${session}.claim`), 'wx', 0o600);
+            }
+            catch (error) {
+                this.disabled = true;
+                if (error.code === 'EEXIST') {
+                    report('blocked_previous_attempt');
+                    return;
+                }
+                throw error;
+            }
+            // Even a crash before this write leaves a permanent conservative fence.
+            try {
+                writeFileSync(fd, JSON.stringify({ version: 1, session, turn }) + '\n');
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+            const dirFd = openSync(directory, 'r');
+            try {
+                fsyncSync(dirFd);
+            }
+            finally {
+                closeSync(dirFd);
+            }
+            this.disabled = true;
+            report('interrupt_requested');
+            // No await between the durable claim and the adapter's final atomic
+            // observation check. Recovery itself must re-check before session/cancel.
+            await this.options.recover(observed, report);
+        }
+        catch {
+            this.disabled = true;
+            // Never include an exception string: it may contain paths or wire data.
+            this.options.diagnostic({ version: 1, kind: 'stall_recovery',
+                eventId: `${turn}:blocked_persistence`, session, turn,
+                status: 'blocked_persistence', evidence: 'no_progress', idleMs: Math.floor(idleMs) });
+        }
+        finally {
+            this.checking = false;
+        }
+    }
+}

package/dist/session/types.d.ts

@@ -13,9 +13,11 @@ import type { ConversationEventV1, ConversationSnapshot, PromptReceipt, SubmitPr
  */
 export type SessionReadiness = 'starting' | 'idle' | 'running' | 'awaiting_permission' | 'failed';
 export type TurnOutcome = 'completed' | 'refused' | 'cancelled' | 'failed' | 'inconclusive';
-export type TurnCancellationSource = 'owner' | 'local-console' | 'fleet-monitor' | 'scheduled-loop' | 'shutdown';
+export type TurnCancellationSource = 'owner' | 'local-console' | 'fleet-monitor' | 'scheduled-loop' | 'shutdown' | 'stall-watchdog';
 export type PromptOrigin = {
     kind: 'startup';
+} | {
+    kind: 'stall-watchdog';
 } | {
     kind: 'local-console';
 } | {
@@ -33,7 +35,7 @@ export type PromptOrigin = {
     commandId: string;
 };
 export interface RuntimeSelectorMetadata {
-    /** Exact provider/model identifier reported by the live ACP session. */
+    /** Exact provider/model identifier reported by the live managed session. */
     value: string;
     /** Complete provider-supplied label for that exact value, when available. */
     label?: string;
@@ -75,6 +77,8 @@ export interface TurnResult {
 export type ControlFailureKind = 'offline' | 'control-unavailable' | 'timeout' | 'rejected' | 'backend';
 /** Stable body-free reason shared by ACP recovery and durable ingress. */
 export declare const ACP_CANCEL_DEADLINE_EXCEEDED = "ACP_CANCEL_DEADLINE_EXCEEDED";
+/** Native Codex equivalent; kept distinct so diagnostics name the failing transport. */
+export declare const CODEX_APP_SERVER_CANCEL_DEADLINE_EXCEEDED = "CODEX_APP_SERVER_CANCEL_DEADLINE_EXCEEDED";
 export declare class SessionControlError extends Error {
     readonly kind: ControlFailureKind;
     /** Stable body-free machine reason for recovery/audit decisions. */
@@ -170,7 +174,7 @@ export interface SubmitPromptOptions {
     interruptSource?: TurnCancellationSource;
     /** Typed in-process provenance. Text markers never grant this origin. */
     origin?: PromptOrigin;
-    /** Use the ACP steering extension when available; ignored by other backends. */
+    /** Inject into active work when the selected backend supports steering. */
     steer?: boolean;
     /** Audit-grade actor detail persisted with the conversation admission record. */
     actor?: {
@@ -200,12 +204,26 @@ export interface SessionSnapshot {
     activity?: SessionActivity;
 }
 export interface SessionActivity {
-    /** ACP tool calls currently reserved (lifecycle open or permission pending). */
+    /** Tool calls currently reserved (lifecycle open or permission pending). */
     activeToolCalls: number;
     /** When the agent last sent ANY session update, replay excluded. */
     lastUpdateAt?: string;
 }
-export type SessionEventKind = 'state' | 'agent_text' | 'thought' | 'tool_call' | 'tool_update' | 'permission' | 'monitor_delivery' | 'turn_stop' | 'error';
+/** Provider-neutral behavior exposed by a session transport. */
+export interface AgentSessionCapabilities {
+    streaming: boolean;
+    durableConversation: boolean;
+    promptInput: boolean;
+    interrupt: boolean;
+    steering: boolean;
+    permissions: boolean;
+    toolBoundaryDelivery: boolean;
+    messagePhases: boolean;
+    resume: boolean;
+}
+/** Conservative static capabilities used before a live session is reachable. */
+export declare function sessionBackendCapabilities(backend: SessionBackendId, harness?: string): AgentSessionCapabilities;
+export type SessionEventKind = 'state' | 'agent_text' | 'thought' | 'tool_call' | 'tool_update' | 'permission' | 'stall_recovery' | 'monitor_delivery' | 'turn_stop' | 'error';
 /** What a settled permission request resolved to. */
 export type PermissionDecision = 'allowed' | 'denied' | 'cancelled';
 export interface SessionEvent {
@@ -219,7 +237,7 @@ export interface SessionEvent {
     text?: string;
     /**
      * Adapter-authenticated presentation phase for assistant text. Only the
-     * exact Codex ACP marker is promoted; absence/unknown values stay unset.
+     * exact Codex phase marker is promoted; absence/unknown values stay unset.
      */
     messagePhase?: 'commentary' | 'final_answer';
     /** Stable adapter message/item id when supplied. */
@@ -247,6 +265,7 @@ export interface SessionEvent {
     /** The option actually selected, when one was. */
     optionId?: string;
     /** Body-free evidence for monitor safe-boundary delivery. */
+    stallDiagnostic?: import('./stall-watchdog.js').StallDiagnostic;
     monitorPolicy?: 'after_tool';
     activeToolCount?: number;
     waitedMs?: number;
@@ -261,11 +280,13 @@ export interface ConversationHandlePage {
 /**
  * The live, harness-neutral contract between Fleet and one agent session.
  * Harness adapters construct this handle; orchestration code must not depend
- * on the ACP transport which currently implements it.
+ * on any concrete transport which implements it.
  */
 export interface AgentSession {
     readonly backend: SessionBackendId;
     readonly pid: number;
+    /** Live capabilities; optional only for source compatibility with external adapters. */
+    readonly capabilities?: AgentSessionCapabilities;
     isAlive(): boolean;
     snapshot(): SessionSnapshot;
     conversationPage?(request: {
@@ -283,7 +304,7 @@ export interface AgentSession {
     queuePrompt(text: string, options?: SubmitPromptOptions): Promise<QueuedPrompt>;
     /** Queue a prompt and wait for its terminal result. */
     submitPrompt(text: string, options?: SubmitPromptOptions): Promise<TurnResult>;
-    /** Monitor-only ACP safe-boundary delivery. Never implies human/control cancellation. */
+    /** Monitor-only safe-boundary delivery. Never implies human/control cancellation. */
     submitPromptAfterTool?(text: string, options?: SubmitPromptOptions): Promise<TurnResult>;
     /**
      * Cancel the active turn. Resolves when the cancellation has taken effect —

package/dist/session/types.js

@@ -1,5 +1,7 @@
 /** Stable body-free reason shared by ACP recovery and durable ingress. */
 export const ACP_CANCEL_DEADLINE_EXCEEDED = 'ACP_CANCEL_DEADLINE_EXCEEDED';
+/** Native Codex equivalent; kept distinct so diagnostics name the failing transport. */
+export const CODEX_APP_SERVER_CANCEL_DEADLINE_EXCEEDED = 'CODEX_APP_SERVER_CANCEL_DEADLINE_EXCEEDED';
 export class SessionControlError extends Error {
     kind;
     reasonCode;
@@ -53,3 +55,29 @@ export function turnResult(accepted, outcome, detail, output, cancellationSource
         ...(outcome === 'cancelled' && cancellationSource ? { cancellationSource } : {}),
     };
 }
+/** Conservative static capabilities used before a live session is reachable. */
+export function sessionBackendCapabilities(backend, harness) {
+    if (backend === 'codex-app-server')
+        return {
+            streaming: true,
+            durableConversation: true,
+            promptInput: true,
+            interrupt: true,
+            steering: true,
+            permissions: true,
+            toolBoundaryDelivery: false,
+            messagePhases: true,
+            resume: true,
+        };
+    return {
+        streaming: true,
+        durableConversation: true,
+        promptInput: true,
+        interrupt: true,
+        steering: false,
+        permissions: true,
+        toolBoundaryDelivery: true,
+        messagePhases: harness === 'codex',
+        resume: true,
+    };
+}

package/dist/spawn.d.ts

@@ -1,4 +1,5 @@
 import type { IsolationConfig } from './isolation/types.js';
+import type { AgentLoopsConfig } from './loops/config.js';
 import { type ApprovalMode, type FilesystemMode, type ResolvedRole, type MonitorConfig, type UnattendedMode, type RoomMemberStartup, type AgentDefinition, type AgentSelection } from './config.js';
 import { type OpsDeps } from './ops.js';
 import { type CreationDeps, type CreationProvenance } from './creation.js';
@@ -40,6 +41,12 @@ export interface SpawnOpts {
      * input in this release.
      */
     isolationFile?: string;
+    /** Trusted YAML containing exactly a top-level `loops:` map. Temporary launches only. */
+    loopsFile?: string;
+    /** Explicitly override any selected Agent Template loops with none. */
+    noLoops?: boolean;
+    /** Internal source label retained after room-member plan resolution. */
+    loopSource?: 'agent-template' | 'cli' | 'omitted';
     overseeInterval?: string;
     configPath?: string;
     dryRun?: boolean;
@@ -56,6 +63,8 @@ export declare function agentDefinitionFromSpawn(o: SpawnOpts): AgentDefinition;
  * must fail before any artifact exists.
  */
 export declare function readIsolationFile(path: string): IsolationConfig;
+/** Read a private canonical temporary-loop override before any creation side effect. */
+export declare function readLoopsFile(path: string): AgentLoopsConfig;
 export declare function validateSpawnOpts(o: SpawnOpts): void;
 /** The ours identity a spawn will bind: explicit, else the role name. */
 export declare const effectiveIdentity: (o: SpawnOpts) => string;