@ours.network/fleet 1.2.0-nightly.1 → 1.2.0-nightly.10

package/dist/rooms-tasks/task-state.js

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { stateRoot } from '../paths.js';
+import { planWorkspace, ensureWorkspace } from './workspace.js';
 import { storedRoomLaunchPolicy, TASK_TERMINAL_STATES, TASK_CANCELLABLE_STATES } from './types.js';
 import { DEFAULT_TASK_LIST_ID, readTaskLists } from './task-lists.js';
 export const tasksDir = () => join(stateRoot(), 'tasks');
@@ -127,7 +128,7 @@ export function assertNoPendingDeletion(task) {
 }
 export function createTask(input) {
     const key = input.idempotency_key ?? randomUUID();
-    const existing = findByIdempotencyKey(key);
+    const existing = listTasks({ includeDeleting: true }).find(task => task.idempotency_key === key);
     if (existing) {
         const existingPlan = existing.execution_plan?.plan_hash;
         const requestedPlan = input.execution_plan?.plan_hash;
@@ -135,7 +136,13 @@ export function createTask(input) {
         const requestedPolicy = storedRoomLaunchPolicy(input.execution_plan?.room_policy);
         if (existingPlan !== requestedPlan || JSON.stringify(existingPolicy) !== JSON.stringify(requestedPolicy))
             throw new TaskStateError(`idempotency key '${key}' was already used with a different execution plan`);
-        return existing;
+        return withTaskLock(existing.task_id, () => {
+            const fresh = readTask(existing.task_id);
+            assertNoPendingDeletion(fresh);
+            if (fresh.workspace)
+                ensureWorkspace(fresh.workspace);
+            return fresh;
+        });
     }
     const state = input.start === false ? 'backlog' : 'provisioning';
     const record = {
@@ -155,7 +162,9 @@ export function createTask(input) {
         created_at: new Date().toISOString(),
         started_at: state === 'provisioning' ? new Date().toISOString() : undefined,
     };
+    record.workspace = planWorkspace('task', record.task_id);
     writeTask(record);
+    ensureWorkspace(record.workspace);
     return readTask(record.task_id);
 }
 export function getTask(id) { return withTaskLock(id, () => readTask(id)); }
@@ -505,7 +514,8 @@ function writeDeletionReceiptForIntent(stored) {
         actor: deletion.actor,
         original_state: stored.state,
         room_id: deletion.room_id,
-        member_count: deletion.members.length,
+        member_count: deletion.members.length + (deletion.archived_absences?.length ?? 0),
+        ...(deletion.archived_absences?.length ? { archived_absences: deletion.archived_absences } : {}),
     };
     replaceFileAtomically(deletionReceiptPath(stored.task_id), JSON.stringify(receipt, null, 2) + '\n');
 }
@@ -688,10 +698,10 @@ export function upsertTaskDeletionMembersFromSeats(id, seats) {
  *
  * The room saga is trusted for phase jumps, but partial or corrupt retained
  * records must not become false success: every seat must be identity_absent;
- * a real launch requires archive evidence; an identity-less seat is accepted
- * only via the never-launched proof.
+ * a real launch requires archive evidence; an identity-less seat requires
+ * never-launched proof or a freshly verified archived-absence checkpoint.
  */
-export function importTaskDeletionRetirementEvidence(id, seats) {
+export function importTaskDeletionRetirementEvidence(id, seats, proofs = []) {
     return withTaskLock(id, () => {
         assertCanonicalTaskId(id);
         const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
@@ -708,6 +718,18 @@ export function importTaskDeletionRetirementEvidence(id, seats) {
             if (!seat.identity_cid) {
                 if (neverLaunched)
                     continue; // provably never held a managed identity
+                const proof = proofs.find(value => value.name === seat.role_name);
+                if (proof && proof.launch_id === evidence.launch_id && proof.archive_path === evidence.archive_path
+                    && proof.launch_id === seat.launch?.launch_id && proof.action_id === seat.launch?.action_id) {
+                    const existing = stored.deletion.archived_absences?.find(value => value.name === proof.name);
+                    if (existing && (existing.launch_id !== proof.launch_id || existing.action_id !== proof.action_id
+                        || existing.archive_path !== proof.archive_path))
+                        throw new TaskStateError('Archived absence checkpoint ownership is immutable');
+                    stored.deletion.archived_absences ??= [];
+                    if (!existing)
+                        stored.deletion.archived_absences.push({ ...proof });
+                    continue;
+                }
                 throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' has retirement evidence but no identity CID`);
             }
             let cursor = findCursorForSeat(id, stored, seat);
@@ -729,9 +751,23 @@ export function importTaskDeletionRetirementEvidence(id, seats) {
             cursor.updated_at = now;
         }
         writeTask(stored);
+        writeDeletionReceiptForIntent(stored);
         return presentTaskLenient(stored);
     });
 }
+/** Settlement-only checkpoint, under the task-operation lock after fresh archive verification.
+ * From here retries still verify live absence, but owned archives may be consumed.
+ */
+export function beginTaskWorkspaceCleanup(id) {
+    withTaskLock(id, () => {
+        const stored = JSON.parse(readFileSync(taskPath(id), 'utf8'));
+        if (stored.deletion?.status !== 'pending' || !stored.workspace
+            || stored.deletion.members.some(member => member.phase !== 'identity_absent'))
+            throw new TaskStateError('Task is not ready for workspace cleanup');
+        stored.deletion.workspace_cleanup_started_at ??= new Date().toISOString();
+        writeTask(stored);
+    });
+}
 /**
  * Physically remove a deletion-pending task record. Settlement-only: callers
  * must have completed member retirement and room cleanup first. Missing

package/dist/rooms-tasks/types.d.ts

@@ -73,6 +73,13 @@ export interface TaskDeletionMemberCursor {
  * evidence. While pending, the task is hidden from normal operation and every
  * lifecycle mutation or room publication is rejected.
  */
+export interface ArchivedMemberAbsence {
+    name: string;
+    launch_id: string;
+    action_id: string;
+    archive_path: string;
+    checked_at: string;
+}
 export interface TaskDeletionIntent {
     status: 'pending';
     accepted_at: string;
@@ -80,6 +87,9 @@ export interface TaskDeletionIntent {
     room_id?: string;
     /** Snapshot of managed members at acceptance; the missing-room retirement evidence. */
     members: TaskDeletionMemberCursor[];
+    archived_absences?: ArchivedMemberAbsence[];
+    /** Archive proofs were verified before owned workspace cleanup may consume them. */
+    workspace_cleanup_started_at?: string;
     error?: string;
     error_at?: string;
     recovery_hint?: string;
@@ -87,6 +97,7 @@ export interface TaskDeletionIntent {
     first_recovery_hint?: string;
 }
 export interface TaskRecord {
+    workspace?: import('./workspace.js').OwnedWorkspace;
     task_id: string;
     /** Stable organizational list identifier. Missing legacy values mean `default`. */
     list_id: string;
@@ -227,6 +238,7 @@ export interface RoomMemberSeat {
     retirement?: MemberRetirement;
 }
 export interface RoomOrchestrationRecord {
+    workspace?: import('./workspace.js').OwnedWorkspace;
     room_id: string;
     room_identity_cid?: string;
     room_name: string;

package/dist/rooms-tasks/workspace-artifacts.d.ts

@@ -0,0 +1,6 @@
+import { type OwnedWorkspace } from './workspace.js';
+/** Runtime control state stays in Fleet's live roster and recovery store. Its
+ * durable launch descriptor, not a name prefix or caller-supplied path, proves
+ * artifact ownership. Audit receipts/journals intentionally outlive deletion.
+ */
+export declare function collectWorkspaceArchives(workspace: OwnedWorkspace): void;

package/dist/rooms-tasks/workspace-artifacts.js

@@ -0,0 +1,93 @@
+import { lstatSync, mkdirSync, readdirSync, readFileSync, renameSync } from 'node:fs';
+import { basename, join } from 'node:path';
+import { parse } from 'yaml';
+import { stateRoot } from '../paths.js';
+import { assertSafeAncestors, auditWorkspaceGit, validateWorkspace, ensureWorkspace, WorkspaceError } from './workspace.js';
+/** Runtime control state stays in Fleet's live roster and recovery store. Its
+ * durable launch descriptor, not a name prefix or caller-supplied path, proves
+ * artifact ownership. Audit receipts/journals intentionally outlive deletion.
+ */
+export function collectWorkspaceArchives(workspace) {
+    validateWorkspace(workspace);
+    const root = join(stateRoot(), 'recovery', 'temporary');
+    assertSafeAncestors(root);
+    let entries;
+    try {
+        entries = readdirSync(root, { withFileTypes: true });
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return;
+        throw e;
+    }
+    const owned = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory() || entry.isSymbolicLink())
+            continue;
+        const path = join(root, entry.name);
+        const roleFile = join(path, 'role.yaml');
+        let role;
+        try {
+            const s = lstatSync(roleFile);
+            if (!s.isFile() || s.isSymbolicLink())
+                continue;
+            role = parse(readFileSync(roleFile, 'utf8'));
+        }
+        catch {
+            continue;
+        } // no ownership proof: never adopt a foreign archive
+        const recorded = role?.roomMemberStartup?.workspace;
+        if (recorded?.owner !== workspace.owner || recorded.id !== workspace.id)
+            continue;
+        if (JSON.stringify(recorded) !== JSON.stringify(workspace))
+            throw new WorkspaceError('workspace archive ownership mismatch');
+        assertSafeAncestors(path);
+        const termination = join(path, 'termination.jsonl');
+        if (!lstatSync(termination).isFile() || lstatSync(termination).isSymbolicLink())
+            throw new WorkspaceError('unsafe workspace archive termination evidence');
+        const supervisorPath = join(path, '.temp-supervisor.json');
+        let supervisor;
+        try {
+            if (!lstatSync(supervisorPath).isFile() || lstatSync(supervisorPath).isSymbolicLink())
+                throw new WorkspaceError('unsafe workspace archive supervisor evidence');
+            supervisor = JSON.parse(readFileSync(supervisorPath, 'utf8'));
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+        }
+        if (supervisor && (supervisor.role !== role.name || !supervisor.launchId))
+            throw new WorkspaceError('workspace archive launch ownership mismatch');
+        const terminated = readFileSync(termination, 'utf8').trim().split('\n').some(line => {
+            const value = JSON.parse(line);
+            return value.version === 1 && value.role === role.name
+                && value.launchId === supervisor?.launchId
+                && ['retired', 'reclaimed', 'failed'].includes(value.outcome);
+        });
+        if (!terminated || entry.name.endsWith('.retiring'))
+            throw new WorkspaceError('workspace archive retirement is incomplete');
+        auditWorkspaceGit(path);
+        owned.push(path);
+    }
+    // Preflight the entire set before mutation; task/room record remains until all succeed.
+    if (!owned.length)
+        return;
+    ensureWorkspace(workspace);
+    const destination = join(workspace.path, '.fleet-retired-agents');
+    assertSafeAncestors(destination);
+    mkdirSync(destination, { recursive: true, mode: 0o700 });
+    for (const path of owned) {
+        const target = join(destination, basename(path));
+        try {
+            lstatSync(target);
+            throw new WorkspaceError('archive collection destination exists');
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+        }
+        // Atomic transfer before workspace deletion: a crash never loses ownership
+        // evidence halfway through recursively removing a global recovery archive.
+        renameSync(path, target);
+    }
+}

package/dist/rooms-tasks/workspace.d.ts

@@ -0,0 +1,26 @@
+/** Persisted before allocation. Never infer ownership from an Agent's cwd. */
+export interface OwnedWorkspace {
+    version: 1;
+    owner: 'task' | 'room';
+    id: string;
+    path: string;
+    token: string;
+}
+export declare class WorkspaceError extends Error {
+}
+export declare function assertSafeAncestors(path: string): void;
+export declare function planWorkspace(owner: OwnedWorkspace['owner'], id: string): OwnedWorkspace;
+export declare function validateWorkspace(w: OwnedWorkspace, owner?: "task" | "room", id?: string): void;
+/** Atomic directory publication; retry uses the durable token, never adopts another folder. */
+export declare function ensureWorkspace(w: OwnedWorkspace): string;
+/** Audit both directions of Git worktree registration, without executing repository config/hooks.
+ * All registrations and common dirs must be inside this workspace. Removing the complete
+ * workspace then removes their registries atomically with the owned repositories; never prune.
+ */
+export declare function auditWorkspaceGit(path: string): void;
+/** Called only after all managed writers retire, under the owner's lifecycle lock.
+ * The tombstone is derived from the durable unguessable token. A crash during rm
+ * resumes that exact tombstone even if rm already removed its marker.
+ */
+export declare function assertWorkspaceDeletable(w: OwnedWorkspace, owner: OwnedWorkspace['owner'], id: string): void;
+export declare function deleteWorkspace(w: OwnedWorkspace, owner: OwnedWorkspace['owner'], id: string): void;

package/dist/rooms-tasks/workspace.js

@@ -0,0 +1,195 @@
+import { randomUUID } from 'node:crypto';
+import { lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { stateRoot } from '../paths.js';
+const MARKER = '.fleet-workspace.json';
+export class WorkspaceError extends Error {
+}
+function fail(message) { throw new WorkspaceError(`workspace: ${message}`); }
+function stat(path) {
+    try {
+        return lstatSync(path);
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return undefined;
+        throw e;
+    }
+}
+export function assertSafeAncestors(path) {
+    const absolute = resolve(path);
+    let part = absolute;
+    for (;;) {
+        const s = stat(part);
+        if (s && (s.isSymbolicLink() || !s.isDirectory()))
+            fail(`unsafe directory ${part}`);
+        const parent = dirname(part);
+        if (parent === part)
+            break;
+        part = parent;
+    }
+}
+function root(owner) {
+    return resolve(stateRoot(), 'workspaces', owner === 'task' ? 'tasks' : 'rooms');
+}
+export function planWorkspace(owner, id) {
+    if (!/^[a-zA-Z0-9_-]{1,80}$/.test(id))
+        fail('invalid owner ID');
+    return { version: 1, owner, id, path: join(root(owner), id), token: randomUUID() };
+}
+export function validateWorkspace(w, owner = w.owner, id = w.id) {
+    if (w.version !== 1 || !['task', 'room'].includes(w.owner) || w.owner !== owner || w.id !== id
+        || !/^[a-zA-Z0-9_-]{1,80}$/.test(w.id)
+        || !/^[a-f0-9-]{36}$/.test(w.token) || !isAbsolute(w.path)
+        || w.path !== join(root(w.owner), w.id))
+        fail('invalid recorded ownership/path');
+    assertSafeAncestors(dirname(w.path));
+}
+function marked(path, w) {
+    assertSafeAncestors(path);
+    const marker = join(path, MARKER);
+    if (!stat(marker)?.isFile() || stat(marker)?.isSymbolicLink())
+        fail('missing/unsafe ownership marker');
+    const actual = JSON.parse(readFileSync(marker, 'utf8'));
+    if (JSON.stringify(actual) !== JSON.stringify(w))
+        fail('ownership marker mismatch');
+}
+function staging(w, phase) {
+    return join(dirname(w.path), `.${w.id}.${w.token}.${phase}`);
+}
+/** Atomic directory publication; retry uses the durable token, never adopts another folder. */
+export function ensureWorkspace(w) {
+    validateWorkspace(w);
+    if (stat(staging(w, 'deleting')))
+        fail('deletion already started');
+    if (stat(w.path)) {
+        marked(w.path, w);
+        return w.path;
+    }
+    mkdirSync(dirname(w.path), { recursive: true, mode: 0o700 });
+    assertSafeAncestors(dirname(w.path));
+    const stage = staging(w, 'provisioning');
+    if (!stat(stage))
+        mkdirSync(stage, { mode: 0o700 });
+    assertSafeAncestors(stage);
+    if (readdirSync(stage).length === 0)
+        writeFileSync(join(stage, MARKER), JSON.stringify(w), { flag: 'wx', mode: 0o600 });
+    marked(stage, w);
+    try {
+        renameSync(stage, w.path);
+    }
+    catch (error) {
+        // Another allocator may have published this exact durable intent.
+        if (!stat(w.path))
+            throw error;
+        marked(w.path, w);
+    }
+    return w.path;
+}
+function inside(base, path) {
+    const rel = relative(base, path);
+    return rel !== '' && rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+function ownedPointer(base, from, value) {
+    if (!value.trim() || /[\r\n]/.test(value.trim()))
+        fail('malformed git pointer');
+    const target = resolve(from, value.trim());
+    if (!inside(base, target))
+        fail(`foreign git metadata ${target}`);
+    assertSafeAncestors(dirname(target));
+    if (stat(target)?.isSymbolicLink())
+        fail(`symlink git metadata ${target}`);
+    return target;
+}
+/** Audit both directions of Git worktree registration, without executing repository config/hooks.
+ * All registrations and common dirs must be inside this workspace. Removing the complete
+ * workspace then removes their registries atomically with the owned repositories; never prune.
+ */
+export function auditWorkspaceGit(path) {
+    const device = lstatSync(path).dev;
+    const visit = (dir, admin = false) => {
+        admin ||= Boolean(stat(join(dir, 'HEAD')) && (stat(join(dir, 'objects')) || stat(join(dir, 'commondir'))));
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            const p = join(dir, entry.name);
+            if (entry.isSymbolicLink()) {
+                if (admin || entry.name === '.git' || entry.name === 'commondir' || entry.name === 'gitdir')
+                    fail(`symlink git metadata ${p}`);
+                continue; // rm unlinks ordinary artifact symlinks, never follows them.
+            }
+            if (entry.isDirectory()) {
+                if (lstatSync(p).dev !== device)
+                    fail(`foreign mounted directory ${p}`);
+                visit(p, admin || entry.name === '.git');
+                continue;
+            }
+            if (!entry.isFile())
+                continue; // sockets/FIFOs in retired runtime state are unlinked, never opened
+            if (entry.name === '.git') {
+                const value = readFileSync(p, 'utf8').trim();
+                if (!value.startsWith('gitdir: '))
+                    fail(`invalid git file ${p}`);
+                const gitdir = ownedPointer(path, dir, value.slice(8));
+                if (!stat(gitdir)?.isDirectory())
+                    fail(`missing git directory ${gitdir}`);
+            }
+            // Git admin files, including bare repositories and submodules.
+            if (entry.name === 'commondir' && (admin || stat(join(dir, 'HEAD')))) {
+                const common = ownedPointer(path, dir, readFileSync(p, 'utf8'));
+                if (!stat(common)?.isDirectory())
+                    fail(`invalid git common directory ${common}`);
+            }
+            if (entry.name === 'gitdir' && (admin || stat(join(dir, 'commondir')))) {
+                const target = ownedPointer(path, dir, readFileSync(p, 'utf8'));
+                if (stat(target) && !stat(target)?.isFile())
+                    fail(`invalid worktree backlink ${target}`);
+            }
+        }
+    };
+    visit(path);
+}
+/** Called only after all managed writers retire, under the owner's lifecycle lock.
+ * The tombstone is derived from the durable unguessable token. A crash during rm
+ * resumes that exact tombstone even if rm already removed its marker.
+ */
+export function assertWorkspaceDeletable(w, owner, id) {
+    validateWorkspace(w, owner, id);
+    if (stat(w.path)) {
+        if (stat(staging(w, 'deleting')))
+            fail('both live and deleting workspace exist');
+        marked(w.path, w);
+        auditWorkspaceGit(w.path);
+    }
+    const pending = staging(w, 'provisioning');
+    if (stat(pending)) {
+        assertSafeAncestors(pending);
+        if (readdirSync(pending).length)
+            marked(pending, w);
+        if (readdirSync(pending).some(name => name !== MARKER))
+            fail('unexpected provisioning artifacts');
+    }
+    if (stat(staging(w, 'deleting')))
+        assertSafeAncestors(staging(w, 'deleting'));
+}
+export function deleteWorkspace(w, owner, id) {
+    assertWorkspaceDeletable(w, owner, id);
+    const tomb = staging(w, 'deleting');
+    const pending = staging(w, 'provisioning');
+    if (stat(w.path)) {
+        if (stat(tomb))
+            fail('both live and deleting workspace exist');
+        marked(w.path, w);
+        auditWorkspaceGit(w.path);
+        renameSync(w.path, tomb);
+    }
+    if (stat(pending)) {
+        if (readdirSync(pending).length)
+            marked(pending, w);
+        if (readdirSync(pending).some(name => name !== MARKER))
+            fail('unexpected provisioning artifacts');
+        rmSync(pending, { recursive: true });
+    }
+    if (stat(tomb)) {
+        assertSafeAncestors(tomb);
+        rmSync(tomb, { recursive: true });
+    }
+}

package/dist/runner.d.ts

@@ -1,3 +1,4 @@
+import { prepareManagedAgent, releaseManagedAgent } from './agent-ours/service.js';
 import { type ResolvedRole } from './config.js';
 import { type MonitorHandle, type MonitorOpts, type FetchLike } from './monitor.js';
 import { type DaemonGenerationProbe } from './daemon-recovery.js';
@@ -9,6 +10,8 @@ import { type OwnerChannelHandle, type OwnerChannelOptions } from './owner-chann
 import { type OwnerBinderLease } from './owner-channel/binder.js';
 import { ScheduledLoopManager, type ScheduledLoopManagerHandle } from './loops/manager.js';
 export interface RunnerDeps {
+    prepareAgentOurs: typeof prepareManagedAgent;
+    releaseAgentOurs: typeof releaseManagedAgent;
     exec: Exec;
     cpuDelegated(): boolean;
     isAlive(pid: number): boolean;
@@ -146,6 +149,16 @@ export declare const START_STAGGER_FILE = ".start-stagger-ms";
 export declare function reserveLaunchSlot(root: string, staggerMs: number, deps: Pick<RunnerDeps, 'now' | 'sleep' | 'log'>): Promise<number>;
 /** Read a temp role's config snapshot written by spawnTemp. */
 export declare function loadTempRole(name: string): ResolvedRole;
+/**
+ * Fall back to the config path applyRole() recorded at the last up/restart/spawn
+ * for this role. systemd's shared unit template (`ours-fleet-agent@.service`)
+ * execs `_run <name>` with no -c on every restart, so a role brought up from a
+ * non-default config (`ours-fleet up -c custom.yaml`) would otherwise silently
+ * resolve against the default ~/fleet.yaml on its very first restart and fail
+ * with "no such role". An empty/missing marker means "use the default", same as
+ * no -c was ever given.
+ */
+export declare function resolveConfigPath(dir: string, explicit?: string): string | undefined;
 /** What one child session did, so the supervising loop can decide what follows. */
 export interface AttemptResult {
     elapsedSecs: number;
@@ -168,6 +181,7 @@ export declare function runOnce(name: string, opts?: {
     temp?: boolean;
     configPath?: string;
     allowResumeRotation?: boolean;
+    identityLifetime?: 'permanent' | 'temporary';
 }, partialDeps?: Partial<RunnerDeps>): Promise<AttemptResult>;
 /**
  * The persistent supervisor for one permanent role: run child sessions in a