@ours.network/fleet 1.1.5 → 1.2.0-nightly.10

package/dist/rooms-tasks/workspace-artifacts.js

@@ -0,0 +1,93 @@
+import { lstatSync, mkdirSync, readdirSync, readFileSync, renameSync } from 'node:fs';
+import { basename, join } from 'node:path';
+import { parse } from 'yaml';
+import { stateRoot } from '../paths.js';
+import { assertSafeAncestors, auditWorkspaceGit, validateWorkspace, ensureWorkspace, WorkspaceError } from './workspace.js';
+/** Runtime control state stays in Fleet's live roster and recovery store. Its
+ * durable launch descriptor, not a name prefix or caller-supplied path, proves
+ * artifact ownership. Audit receipts/journals intentionally outlive deletion.
+ */
+export function collectWorkspaceArchives(workspace) {
+    validateWorkspace(workspace);
+    const root = join(stateRoot(), 'recovery', 'temporary');
+    assertSafeAncestors(root);
+    let entries;
+    try {
+        entries = readdirSync(root, { withFileTypes: true });
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return;
+        throw e;
+    }
+    const owned = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory() || entry.isSymbolicLink())
+            continue;
+        const path = join(root, entry.name);
+        const roleFile = join(path, 'role.yaml');
+        let role;
+        try {
+            const s = lstatSync(roleFile);
+            if (!s.isFile() || s.isSymbolicLink())
+                continue;
+            role = parse(readFileSync(roleFile, 'utf8'));
+        }
+        catch {
+            continue;
+        } // no ownership proof: never adopt a foreign archive
+        const recorded = role?.roomMemberStartup?.workspace;
+        if (recorded?.owner !== workspace.owner || recorded.id !== workspace.id)
+            continue;
+        if (JSON.stringify(recorded) !== JSON.stringify(workspace))
+            throw new WorkspaceError('workspace archive ownership mismatch');
+        assertSafeAncestors(path);
+        const termination = join(path, 'termination.jsonl');
+        if (!lstatSync(termination).isFile() || lstatSync(termination).isSymbolicLink())
+            throw new WorkspaceError('unsafe workspace archive termination evidence');
+        const supervisorPath = join(path, '.temp-supervisor.json');
+        let supervisor;
+        try {
+            if (!lstatSync(supervisorPath).isFile() || lstatSync(supervisorPath).isSymbolicLink())
+                throw new WorkspaceError('unsafe workspace archive supervisor evidence');
+            supervisor = JSON.parse(readFileSync(supervisorPath, 'utf8'));
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+        }
+        if (supervisor && (supervisor.role !== role.name || !supervisor.launchId))
+            throw new WorkspaceError('workspace archive launch ownership mismatch');
+        const terminated = readFileSync(termination, 'utf8').trim().split('\n').some(line => {
+            const value = JSON.parse(line);
+            return value.version === 1 && value.role === role.name
+                && value.launchId === supervisor?.launchId
+                && ['retired', 'reclaimed', 'failed'].includes(value.outcome);
+        });
+        if (!terminated || entry.name.endsWith('.retiring'))
+            throw new WorkspaceError('workspace archive retirement is incomplete');
+        auditWorkspaceGit(path);
+        owned.push(path);
+    }
+    // Preflight the entire set before mutation; task/room record remains until all succeed.
+    if (!owned.length)
+        return;
+    ensureWorkspace(workspace);
+    const destination = join(workspace.path, '.fleet-retired-agents');
+    assertSafeAncestors(destination);
+    mkdirSync(destination, { recursive: true, mode: 0o700 });
+    for (const path of owned) {
+        const target = join(destination, basename(path));
+        try {
+            lstatSync(target);
+            throw new WorkspaceError('archive collection destination exists');
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+        }
+        // Atomic transfer before workspace deletion: a crash never loses ownership
+        // evidence halfway through recursively removing a global recovery archive.
+        renameSync(path, target);
+    }
+}

package/dist/rooms-tasks/workspace.d.ts

@@ -0,0 +1,26 @@
+/** Persisted before allocation. Never infer ownership from an Agent's cwd. */
+export interface OwnedWorkspace {
+    version: 1;
+    owner: 'task' | 'room';
+    id: string;
+    path: string;
+    token: string;
+}
+export declare class WorkspaceError extends Error {
+}
+export declare function assertSafeAncestors(path: string): void;
+export declare function planWorkspace(owner: OwnedWorkspace['owner'], id: string): OwnedWorkspace;
+export declare function validateWorkspace(w: OwnedWorkspace, owner?: "task" | "room", id?: string): void;
+/** Atomic directory publication; retry uses the durable token, never adopts another folder. */
+export declare function ensureWorkspace(w: OwnedWorkspace): string;
+/** Audit both directions of Git worktree registration, without executing repository config/hooks.
+ * All registrations and common dirs must be inside this workspace. Removing the complete
+ * workspace then removes their registries atomically with the owned repositories; never prune.
+ */
+export declare function auditWorkspaceGit(path: string): void;
+/** Called only after all managed writers retire, under the owner's lifecycle lock.
+ * The tombstone is derived from the durable unguessable token. A crash during rm
+ * resumes that exact tombstone even if rm already removed its marker.
+ */
+export declare function assertWorkspaceDeletable(w: OwnedWorkspace, owner: OwnedWorkspace['owner'], id: string): void;
+export declare function deleteWorkspace(w: OwnedWorkspace, owner: OwnedWorkspace['owner'], id: string): void;

package/dist/rooms-tasks/workspace.js

@@ -0,0 +1,195 @@
+import { randomUUID } from 'node:crypto';
+import { lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { stateRoot } from '../paths.js';
+const MARKER = '.fleet-workspace.json';
+export class WorkspaceError extends Error {
+}
+function fail(message) { throw new WorkspaceError(`workspace: ${message}`); }
+function stat(path) {
+    try {
+        return lstatSync(path);
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return undefined;
+        throw e;
+    }
+}
+export function assertSafeAncestors(path) {
+    const absolute = resolve(path);
+    let part = absolute;
+    for (;;) {
+        const s = stat(part);
+        if (s && (s.isSymbolicLink() || !s.isDirectory()))
+            fail(`unsafe directory ${part}`);
+        const parent = dirname(part);
+        if (parent === part)
+            break;
+        part = parent;
+    }
+}
+function root(owner) {
+    return resolve(stateRoot(), 'workspaces', owner === 'task' ? 'tasks' : 'rooms');
+}
+export function planWorkspace(owner, id) {
+    if (!/^[a-zA-Z0-9_-]{1,80}$/.test(id))
+        fail('invalid owner ID');
+    return { version: 1, owner, id, path: join(root(owner), id), token: randomUUID() };
+}
+export function validateWorkspace(w, owner = w.owner, id = w.id) {
+    if (w.version !== 1 || !['task', 'room'].includes(w.owner) || w.owner !== owner || w.id !== id
+        || !/^[a-zA-Z0-9_-]{1,80}$/.test(w.id)
+        || !/^[a-f0-9-]{36}$/.test(w.token) || !isAbsolute(w.path)
+        || w.path !== join(root(w.owner), w.id))
+        fail('invalid recorded ownership/path');
+    assertSafeAncestors(dirname(w.path));
+}
+function marked(path, w) {
+    assertSafeAncestors(path);
+    const marker = join(path, MARKER);
+    if (!stat(marker)?.isFile() || stat(marker)?.isSymbolicLink())
+        fail('missing/unsafe ownership marker');
+    const actual = JSON.parse(readFileSync(marker, 'utf8'));
+    if (JSON.stringify(actual) !== JSON.stringify(w))
+        fail('ownership marker mismatch');
+}
+function staging(w, phase) {
+    return join(dirname(w.path), `.${w.id}.${w.token}.${phase}`);
+}
+/** Atomic directory publication; retry uses the durable token, never adopts another folder. */
+export function ensureWorkspace(w) {
+    validateWorkspace(w);
+    if (stat(staging(w, 'deleting')))
+        fail('deletion already started');
+    if (stat(w.path)) {
+        marked(w.path, w);
+        return w.path;
+    }
+    mkdirSync(dirname(w.path), { recursive: true, mode: 0o700 });
+    assertSafeAncestors(dirname(w.path));
+    const stage = staging(w, 'provisioning');
+    if (!stat(stage))
+        mkdirSync(stage, { mode: 0o700 });
+    assertSafeAncestors(stage);
+    if (readdirSync(stage).length === 0)
+        writeFileSync(join(stage, MARKER), JSON.stringify(w), { flag: 'wx', mode: 0o600 });
+    marked(stage, w);
+    try {
+        renameSync(stage, w.path);
+    }
+    catch (error) {
+        // Another allocator may have published this exact durable intent.
+        if (!stat(w.path))
+            throw error;
+        marked(w.path, w);
+    }
+    return w.path;
+}
+function inside(base, path) {
+    const rel = relative(base, path);
+    return rel !== '' && rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+function ownedPointer(base, from, value) {
+    if (!value.trim() || /[\r\n]/.test(value.trim()))
+        fail('malformed git pointer');
+    const target = resolve(from, value.trim());
+    if (!inside(base, target))
+        fail(`foreign git metadata ${target}`);
+    assertSafeAncestors(dirname(target));
+    if (stat(target)?.isSymbolicLink())
+        fail(`symlink git metadata ${target}`);
+    return target;
+}
+/** Audit both directions of Git worktree registration, without executing repository config/hooks.
+ * All registrations and common dirs must be inside this workspace. Removing the complete
+ * workspace then removes their registries atomically with the owned repositories; never prune.
+ */
+export function auditWorkspaceGit(path) {
+    const device = lstatSync(path).dev;
+    const visit = (dir, admin = false) => {
+        admin ||= Boolean(stat(join(dir, 'HEAD')) && (stat(join(dir, 'objects')) || stat(join(dir, 'commondir'))));
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            const p = join(dir, entry.name);
+            if (entry.isSymbolicLink()) {
+                if (admin || entry.name === '.git' || entry.name === 'commondir' || entry.name === 'gitdir')
+                    fail(`symlink git metadata ${p}`);
+                continue; // rm unlinks ordinary artifact symlinks, never follows them.
+            }
+            if (entry.isDirectory()) {
+                if (lstatSync(p).dev !== device)
+                    fail(`foreign mounted directory ${p}`);
+                visit(p, admin || entry.name === '.git');
+                continue;
+            }
+            if (!entry.isFile())
+                continue; // sockets/FIFOs in retired runtime state are unlinked, never opened
+            if (entry.name === '.git') {
+                const value = readFileSync(p, 'utf8').trim();
+                if (!value.startsWith('gitdir: '))
+                    fail(`invalid git file ${p}`);
+                const gitdir = ownedPointer(path, dir, value.slice(8));
+                if (!stat(gitdir)?.isDirectory())
+                    fail(`missing git directory ${gitdir}`);
+            }
+            // Git admin files, including bare repositories and submodules.
+            if (entry.name === 'commondir' && (admin || stat(join(dir, 'HEAD')))) {
+                const common = ownedPointer(path, dir, readFileSync(p, 'utf8'));
+                if (!stat(common)?.isDirectory())
+                    fail(`invalid git common directory ${common}`);
+            }
+            if (entry.name === 'gitdir' && (admin || stat(join(dir, 'commondir')))) {
+                const target = ownedPointer(path, dir, readFileSync(p, 'utf8'));
+                if (stat(target) && !stat(target)?.isFile())
+                    fail(`invalid worktree backlink ${target}`);
+            }
+        }
+    };
+    visit(path);
+}
+/** Called only after all managed writers retire, under the owner's lifecycle lock.
+ * The tombstone is derived from the durable unguessable token. A crash during rm
+ * resumes that exact tombstone even if rm already removed its marker.
+ */
+export function assertWorkspaceDeletable(w, owner, id) {
+    validateWorkspace(w, owner, id);
+    if (stat(w.path)) {
+        if (stat(staging(w, 'deleting')))
+            fail('both live and deleting workspace exist');
+        marked(w.path, w);
+        auditWorkspaceGit(w.path);
+    }
+    const pending = staging(w, 'provisioning');
+    if (stat(pending)) {
+        assertSafeAncestors(pending);
+        if (readdirSync(pending).length)
+            marked(pending, w);
+        if (readdirSync(pending).some(name => name !== MARKER))
+            fail('unexpected provisioning artifacts');
+    }
+    if (stat(staging(w, 'deleting')))
+        assertSafeAncestors(staging(w, 'deleting'));
+}
+export function deleteWorkspace(w, owner, id) {
+    assertWorkspaceDeletable(w, owner, id);
+    const tomb = staging(w, 'deleting');
+    const pending = staging(w, 'provisioning');
+    if (stat(w.path)) {
+        if (stat(tomb))
+            fail('both live and deleting workspace exist');
+        marked(w.path, w);
+        auditWorkspaceGit(w.path);
+        renameSync(w.path, tomb);
+    }
+    if (stat(pending)) {
+        if (readdirSync(pending).length)
+            marked(pending, w);
+        if (readdirSync(pending).some(name => name !== MARKER))
+            fail('unexpected provisioning artifacts');
+        rmSync(pending, { recursive: true });
+    }
+    if (stat(tomb)) {
+        assertSafeAncestors(tomb);
+        rmSync(tomb, { recursive: true });
+    }
+}

package/dist/runner.d.ts

@@ -1,3 +1,4 @@
+import { prepareManagedAgent, releaseManagedAgent } from './agent-ours/service.js';
 import { type ResolvedRole } from './config.js';
 import { type MonitorHandle, type MonitorOpts, type FetchLike } from './monitor.js';
 import { type DaemonGenerationProbe } from './daemon-recovery.js';
@@ -9,6 +10,8 @@ import { type OwnerChannelHandle, type OwnerChannelOptions } from './owner-chann
 import { type OwnerBinderLease } from './owner-channel/binder.js';
 import { ScheduledLoopManager, type ScheduledLoopManagerHandle } from './loops/manager.js';
 export interface RunnerDeps {
+    prepareAgentOurs: typeof prepareManagedAgent;
+    releaseAgentOurs: typeof releaseManagedAgent;
     exec: Exec;
     cpuDelegated(): boolean;
     isAlive(pid: number): boolean;
@@ -146,6 +149,16 @@ export declare const START_STAGGER_FILE = ".start-stagger-ms";
 export declare function reserveLaunchSlot(root: string, staggerMs: number, deps: Pick<RunnerDeps, 'now' | 'sleep' | 'log'>): Promise<number>;
 /** Read a temp role's config snapshot written by spawnTemp. */
 export declare function loadTempRole(name: string): ResolvedRole;
+/**
+ * Fall back to the config path applyRole() recorded at the last up/restart/spawn
+ * for this role. systemd's shared unit template (`ours-fleet-agent@.service`)
+ * execs `_run <name>` with no -c on every restart, so a role brought up from a
+ * non-default config (`ours-fleet up -c custom.yaml`) would otherwise silently
+ * resolve against the default ~/fleet.yaml on its very first restart and fail
+ * with "no such role". An empty/missing marker means "use the default", same as
+ * no -c was ever given.
+ */
+export declare function resolveConfigPath(dir: string, explicit?: string): string | undefined;
 /** What one child session did, so the supervising loop can decide what follows. */
 export interface AttemptResult {
     elapsedSecs: number;
@@ -168,6 +181,7 @@ export declare function runOnce(name: string, opts?: {
     temp?: boolean;
     configPath?: string;
     allowResumeRotation?: boolean;
+    identityLifetime?: 'permanent' | 'temporary';
 }, partialDeps?: Partial<RunnerDeps>): Promise<AttemptResult>;
 /**
  * The persistent supervisor for one permanent role: run child sessions in a