@ours.network/fleet 1.2.0-nightly.12 → 1.2.0-nightly.14

package/README.md

@@ -1767,3 +1767,5 @@ A `task_not_ready` result distinguishes confirmed degradation from unknown healt
 and member status and choose supported recovery. These checks do not restart agents,
 recreate identities, redeem invites, or rewrite lifecycle state. Temporary room agents
 remain transient across host reboot; retained launch records do not restore them.
+
+See [predefined Brain models and runtime requirements](presets/README.md) for the verified model/effort matrix and regeneration instructions.

package/dist/application/model-catalog.d.ts

@@ -14,7 +14,7 @@ export interface HarnessModelCatalog {
 export declare function codexModelCatalog(path?: string): HarnessModelCatalog;
 /**
  * Claude Code 2.1 has no typed model-list endpoint. These exact IDs are the
- * versioned adapter contract shipped by the installed 2.1 CLI, not aliases and
+ * versioned adapter contract verified with CLI 2.1.281, not aliases and
  * not a claim about account entitlement (which Claude validates at launch).
  */
 export declare function claudeModelCatalog(): HarnessModelCatalog;

package/dist/application/model-catalog.js

@@ -41,17 +41,20 @@ export function codexModelCatalog(path = join(homedir(), '.codex', 'models_cache
 }
 /**
  * Claude Code 2.1 has no typed model-list endpoint. These exact IDs are the
- * versioned adapter contract shipped by the installed 2.1 CLI, not aliases and
+ * versioned adapter contract verified with CLI 2.1.281, not aliases and
  * not a claim about account entitlement (which Claude validates at launch).
  */
 export function claudeModelCatalog() {
     const reasoningEfforts = ['low', 'medium', 'high', 'xhigh', 'max'];
     return {
         models: [
+            { id: 'claude-fable-5-1', label: 'Claude Fable 5.1', reasoningEfforts, source: 'claude-adapter-2.1' },
+            { id: 'claude-opus-5-5', label: 'Claude Opus 5.5', reasoningEfforts, source: 'claude-adapter-2.1' },
+            { id: 'claude-haiku-4-5-20251001', label: 'Claude Haiku 4.5', reasoningEfforts: [], source: 'claude-adapter-2.1' },
             { id: 'claude-fable-5', label: 'Claude Fable 5', reasoningEfforts, source: 'claude-adapter-2.1' },
             { id: 'claude-opus-5', label: 'Claude Opus 5', reasoningEfforts, source: 'claude-adapter-2.1' },
             { id: 'claude-sonnet-5', label: 'Claude Sonnet 5', reasoningEfforts, source: 'claude-adapter-2.1' },
         ],
-        warnings: ['Claude Code exposes no typed model-list endpoint; choices are exact 2.1 adapter IDs and entitlement is validated at launch.'],
+        warnings: ['Claude Code exposes no typed model-list endpoint; choices require a current Claude runtime (verified with 2.1.281); older bundled SDKs need CLAUDE_CODE_EXECUTABLE. Entitlement is validated at launch.'],
     };
 }

package/dist/application/task-room-service.d.ts

@@ -282,6 +282,9 @@ export declare class TaskRoomApplicationService {
         actor: TaskRoomActor;
         roomId: string;
     }): Promise<{
+        room: undefined;
+        settlementRequired: true;
+    } | {
         room: RoomOrchestrationRecord;
         settlementRequired: true;
     }>;

package/dist/application/task-room-service.js

@@ -638,7 +638,7 @@ export class TaskRoomApplicationService {
             createCoworkAdapter({ configPath: cfg.rooms.cowork?.config });
         const room = getRoomRecord(input.roomId);
         if (!room) {
-            throw new TaskRoomApplicationError('room_record_not_found', 'room record not found', { room: input.roomId });
+            return { room: undefined, settlementRequired: true };
         }
         return { room: await acceptManagedRoomClose(input.roomId), settlementRequired: true };
     }

package/dist/atomic-file.d.ts

@@ -36,3 +36,8 @@ export declare function withFileLock<T>(lockPath: string, fn: () => T | Promise<
  * intact.
  */
 export declare function replaceFileAtomically(path: string, contents: string, mode?: number, deps?: WriteDeps): void;
+/** Synchronous Lamport bakery lock: unique claims are never reused, so stale
+ * reclamation cannot remove a successor's lock. Atomic claim replacement keeps
+ * choosing/ticket reads complete. Dead claims can be removed by any contender.
+ */
+export declare function withSynchronousFileLock<T>(path: string, work: () => T): T;

package/dist/atomic-file.js

@@ -1,4 +1,4 @@
-import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, writeSync, } from 'node:fs';
+import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, writeSync, } from 'node:fs';
 import { basename, dirname, join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 const DEFAULT_STALE_MS = 10_000;
@@ -136,3 +136,64 @@ export function replaceFileAtomically(path, contents, mode = 0o600, deps = {}) {
     }
     catch { /* platform does not allow fsync on a directory */ }
 }
+/** Synchronous Lamport bakery lock: unique claims are never reused, so stale
+ * reclamation cannot remove a successor's lock. Atomic claim replacement keeps
+ * choosing/ticket reads complete. Dead claims can be removed by any contender.
+ */
+export function withSynchronousFileLock(path, work) {
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    const token = `${process.pid}-${randomUUID()}.json`;
+    const own = join(path, token);
+    const deadline = Date.now() + 10_000;
+    const claims = () => {
+        const result = [];
+        for (const name of readdirSync(path).filter(name => /^[0-9]+-[a-f0-9-]{36}\.json$/.test(name))) {
+            const file = join(path, name);
+            let value;
+            try {
+                value = JSON.parse(readFileSync(file, 'utf8'));
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    continue;
+                throw error;
+            }
+            if (!Number.isSafeInteger(value.pid) || value.pid <= 0 || !Number.isSafeInteger(value.ticket) || value.ticket < 0)
+                throw new Error('Invalid synchronous lock claim');
+            if (name !== token) {
+                try {
+                    process.kill(value.pid, 0);
+                }
+                catch (error) {
+                    if (error.code === 'ESRCH') {
+                        // This dead contender alone owned this UUID path. Never remove
+                        // the namespace or a successor's differently named claim.
+                        rmSync(file, { force: true });
+                        continue;
+                    }
+                }
+            }
+            result.push({ name, value });
+        }
+        return result;
+    };
+    replaceFileAtomically(own, JSON.stringify({ pid: process.pid, choosing: true, ticket: 0 }));
+    try {
+        const ticket = Math.max(0, ...claims().map(claim => claim.value.ticket)) + 1;
+        if (!Number.isSafeInteger(ticket))
+            throw new Error('Synchronous lock ticket overflow');
+        replaceFileAtomically(own, JSON.stringify({ pid: process.pid, choosing: false, ticket }));
+        for (;;) {
+            const preceding = claims().some(claim => claim.name !== token && (claim.value.choosing
+                || claim.value.ticket < ticket || (claim.value.ticket === ticket && claim.name < token)));
+            if (!preceding)
+                return work();
+            if (Date.now() >= deadline)
+                throw new Error('Timed out acquiring synchronous journal lock');
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+        }
+    }
+    finally {
+        rmSync(own, { force: true });
+    }
+}

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.12",
-  "buildId": "6f07096c9a0c",
-  "commit": "7e323845714c5b638db197673b84f28fe00a2f75",
+  "version": "1.2.0-nightly.14",
+  "buildId": "b88d0d158cc7",
+  "commit": "717f6d8a09e6173b9b8a017fc5efb08d71927524",
   "dirty": true,
-  "builtAt": "2026-09-24T13:14:00.219Z",
+  "builtAt": "2026-09-24T14:15:57.206Z",
   "capabilities": [
     "cowork.http-management-v1",
     "monitor.interrupt.after_tool"

package/dist/erased-resources.d.ts

@@ -0,0 +1,9 @@
+export declare const erasedArg: (value: string) => string;
+export declare function redactErasedContent<T>(value: T): T;
+/** Every cooperative writer filters stale in-memory snapshots under the same lock as erasure. */
+export declare function writePrivacyFilteredLedger(path: string, value: unknown): void;
+/** Content-free resource IDs persist to prevent active writers resurrecting erased labels. */
+export declare function eraseResourcePresentations(resources: ReadonlyArray<{
+    kind: 'task' | 'room' | 'agent';
+    id: string;
+}>): void;

package/dist/erased-resources.js

@@ -0,0 +1,87 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically, withSynchronousFileLock } from './atomic-file.js';
+import { stateRoot } from './paths.js';
+const registryPath = () => join(stateRoot(), 'erased-resources.json');
+const lockPath = () => join(stateRoot(), 'locks', 'audit-erasure');
+const ledgerNames = ['.fleet-command-audit.json', '.owner-channel-command-audit.json', '.owner-channel-lifecycle-outbox.json'];
+export const erasedArg = (value) => `[erased:${createHash('sha256').update(value).digest('hex')}]`;
+function registry() {
+    if (!existsSync(registryPath()))
+        return new Set();
+    const value = JSON.parse(readFileSync(registryPath(), 'utf8'));
+    if (!Array.isArray(value) || value.some(v => typeof v !== 'string'))
+        throw new Error('Invalid erasure registry');
+    return new Set(value);
+}
+/** Preserve delivery/deduplication metadata while removing owned presentation content. */
+function redact(value, erased) {
+    if (Array.isArray(value))
+        return value.map(item => redact(item, erased));
+    if (!value || typeof value !== 'object')
+        return value;
+    const next = { ...value };
+    const kind = value.kind === 'lifecycle_failure' ? value.resource?.toLowerCase() : value.kind === 'agent_started' ? 'agent' : value.kind;
+    if (typeof value.id === 'string' && erased.has(`${kind}:${value.id}`)) {
+        for (const key of ['title', 'reason', 'roomName', 'label', 'template', 'configuration', 'model', 'permissions'])
+            delete next[key];
+        if (kind === 'task')
+            next.agents = [];
+        if (kind === 'room') {
+            delete next.name;
+            next.participants = [];
+        }
+        if (kind === 'agent') {
+            next.name = 'erased';
+            next.brain = '[erased]';
+            next.role = '[erased]';
+            next.inherited = [];
+        }
+    }
+    if (typeof value.roomId === 'string' && erased.has(`room:${value.roomId}`)) {
+        delete next.roomName;
+        if (kind === 'task')
+            next.agents = [];
+    }
+    const resources = value.outcome?.resourceIds;
+    const ownsAttempt = resources && Object.entries(resources).some(([key, id]) => erased.has(`${key}:${id}`));
+    const ownsPresentation = value.outcome?.presentations?.some((p) => erased.has(`${p.kind === 'agent_started' ? 'agent' : p.kind}:${p.id}`));
+    if ((ownsAttempt || ownsPresentation) && Array.isArray(value.argv) && !value.erased) {
+        next.argv = value.argv.map(erasedArg);
+        next.erased = true;
+    }
+    for (const key of Object.keys(next))
+        if (typeof next[key] === 'object')
+            next[key] = redact(next[key], erased);
+    return next;
+}
+export function redactErasedContent(value) { return redact(value, registry()); }
+/** Every cooperative writer filters stale in-memory snapshots under the same lock as erasure. */
+export function writePrivacyFilteredLedger(path, value) {
+    withSynchronousFileLock(lockPath(), () => replaceFileAtomically(path, JSON.stringify(redact(value, registry())) + '\n'));
+}
+/** Content-free resource IDs persist to prevent active writers resurrecting erased labels. */
+export function eraseResourcePresentations(resources) {
+    withSynchronousFileLock(lockPath(), () => {
+        const erased = registry();
+        for (const resource of resources)
+            erased.add(`${resource.kind}:${resource.id}`);
+        replaceFileAtomically(registryPath(), JSON.stringify([...erased]));
+        for (const root of [join(stateRoot(), 'agents'), join(stateRoot(), 'tmp'), join(stateRoot(), 'recovery', 'temporary')]) {
+            if (!existsSync(root))
+                continue;
+            for (const entry of readdirSync(root, { withFileTypes: true })) {
+                if (!entry.isDirectory() || entry.isSymbolicLink())
+                    continue;
+                for (const name of ledgerNames) {
+                    const path = join(root, entry.name, name);
+                    if (!existsSync(path) || !lstatSync(path).isFile() || lstatSync(path).isSymbolicLink())
+                        continue;
+                    const old = JSON.parse(readFileSync(path, 'utf8'));
+                    replaceFileAtomically(path, JSON.stringify(redact(old, erased)) + '\n');
+                }
+            }
+        }
+    });
+}

package/dist/fleet-command-audit.d.ts

@@ -113,6 +113,7 @@ export interface FleetCommandClassification {
     decision: FleetCommandDecision;
 }
 export interface FleetAuditAttempt {
+    erased?: boolean;
     version: 1;
     correlationId: string;
     requestId: string;

package/dist/fleet-command-audit.js

@@ -1,7 +1,7 @@
+import { erasedArg, redactErasedContent, writePrivacyFilteredLedger } from './erased-resources.js';
 import { existsSync, readFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { Buffer } from 'node:buffer';
-import { replaceFileAtomically } from './atomic-file.js';
 import { isSensitiveConfigKey } from './sensitive-config.js';
 import { mandatoryConfigurationFits } from './lifecycle-summary.js';
 import { MARKDOWN_MAX_BYTES, MARKDOWN_MAX_CODE_POINTS, markdownCode, markdownProse, } from './rooms-tasks/markdown.js';
@@ -91,7 +91,7 @@ export function recordFleetAuditPresentation(value) {
                 : value.kind === 'lifecycle_failure'
                     ? { label: fleetPresentationLabel(value.label) }
                     : {};
-        const presentation = structuredClone({ ...value, ...labels, eventId: basis });
+        const presentation = redactErasedContent(structuredClone({ ...value, ...labels, eventId: basis }));
         const digest = lifecycleEventDigestBasis(presentation);
         if (!collection.presentations.some(existing => lifecycleEventDigestBasis(existing) === digest))
             collection.presentations.push(presentation);
@@ -305,11 +305,12 @@ export class FleetCommandAuditStore {
         if (recovered)
             this.persist();
     }
-    list() { return this.attempts.map(item => structuredClone(item)); }
+    list() { return redactErasedContent(this.attempts).map(item => structuredClone(item)); }
     begin(requestId, caller, argv) {
+        this.attempts = redactErasedContent(this.attempts);
         const existing = this.attempts.find(item => item.caller === caller && item.requestId === requestId);
         if (existing) {
-            if (JSON.stringify(existing.argv) !== JSON.stringify(redactFleetArgv(argv)))
+            if (JSON.stringify(existing.argv) !== JSON.stringify(existing.erased ? redactFleetArgv(argv).map(erasedArg) : redactFleetArgv(argv)))
                 throw new Error('fleet command request ID was reused with different argv');
             return structuredClone(existing);
         }
@@ -329,6 +330,8 @@ export class FleetCommandAuditStore {
         return structuredClone(attempt);
     }
     finish(correlationId, caller, outcome) {
+        this.attempts = redactErasedContent(this.attempts);
+        outcome = redactErasedContent({ outcome }).outcome;
         const attempt = this.owned(correlationId, caller);
         if (!attempt.outcome)
             attempt.outcome = { ...outcome, completedAt: this.deps.now().toISOString(), delivery: 'sending' };
@@ -360,7 +363,8 @@ export class FleetCommandAuditStore {
         return attempt;
     }
     persist() {
-        replaceFileAtomically(this.path, `${JSON.stringify({ version: 1, attempts: this.attempts })}\n`, 0o600);
+        this.attempts = redactErasedContent(this.attempts);
+        writePrivacyFilteredLedger(this.path, { version: 1, attempts: this.attempts });
     }
 }
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;

package/dist/init-wizard.js

@@ -14,6 +14,11 @@ const REASONING_EFFORT = {
     quick: 'low', balanced: 'medium', thorough: 'high',
 };
 const MODEL_LABELS = {
+    'gpt-6-sol': 'GPT-6 Sol',
+    'gpt-6-luna': 'GPT-6 Luna',
+    'claude-fable-5-1': 'Claude Fable 5.1',
+    'claude-opus-5-5': 'Claude Opus 5.5',
+    'claude-haiku-4-5-20251001': 'Claude Haiku 4.5',
     'gpt-6-astra': 'GPT-6 Astra',
     'gpt-5.6-sol': 'GPT-5.6 Sol',
     'gpt-5.6-terra': 'GPT-5.6 Terra',
@@ -33,10 +38,10 @@ export function validateCatalog(value, path = 'supported model catalog') {
     for (const model of value.models) {
         if (!['codex', 'claude-code'].includes(model.harness) || model.session !== 'acp'
             || typeof model.model !== 'string' || !MODEL_LABELS[model.model]
-            || !Array.isArray(model.efforts) || model.efforts.length === 0
+            || !Array.isArray(model.efforts)
             || new Set(model.efforts).size !== model.efforts.length
             || model.efforts.some(effort => !['low', 'medium', 'high', 'xhigh', 'max', 'ultra'].includes(effort))
-            || !['low', 'medium', 'high'].every(effort => model.efforts.includes(effort)))
+            || (model.efforts.length > 0 && !['low', 'medium', 'high'].every(effort => model.efforts.includes(effort))))
             throw new Error(`unsupported model state in ${path}`);
         const tuple = `${model.harness}\0${model.session}\0${model.model}`;
         if (tuples.has(tuple))
@@ -90,7 +95,9 @@ export async function askInitQuestions(prompter, configuration) {
         return undefined;
     if (subscriptions.length === 0)
         throw new Error('Select at least one subscription.');
-    const available = catalog().models.filter(model => subscriptions.includes(subscriptionFor(model)));
+    // The wizard assigns low/medium/high; no-effort models remain available as named presets.
+    const available = catalog().models.filter(model => subscriptions.includes(subscriptionFor(model))
+        && model.efforts.length > 0);
     if (!available.length)
         throw new Error('None of the selected subscriptions has a supported model.');
     prompter.note([

package/dist/owner-channel/lifecycle-outbox.js

@@ -1,6 +1,6 @@
+import { redactErasedContent, writePrivacyFilteredLedger } from '../erased-resources.js';
 import { createHash } from 'node:crypto';
 import { chmodSync, existsSync, readFileSync } from 'node:fs';
-import { replaceFileAtomically } from '../atomic-file.js';
 import { lifecycleEventDigestBasis, validateFleetAuditPresentations, } from '../fleet-command-audit.js';
 const DIGEST = /^[a-f0-9]{64}$/u;
 const LIMIT = 5_000;
@@ -63,7 +63,7 @@ export class FleetLifecycleOutbox {
     }
     pending() {
         this.assertHealthy();
-        return this.entries.filter(entry => entry.delivery === 'pending').map(entry => structuredClone(entry));
+        return redactErasedContent(this.entries).filter(entry => entry.delivery === 'pending').map(entry => structuredClone(entry));
     }
     finish(digest, delivery) {
         this.assertHealthy();
@@ -82,6 +82,7 @@ export class FleetLifecycleOutbox {
             throw new Error(this.corruptReason);
     }
     persist() {
-        replaceFileAtomically(this.path, `${JSON.stringify({ version: 1, entries: this.entries })}\n`, 0o600);
+        this.entries = redactErasedContent(this.entries);
+        writePrivacyFilteredLedger(this.path, { version: 1, entries: this.entries });
     }
 }

package/dist/rooms-tasks/close.d.ts

@@ -27,7 +27,7 @@ export declare function acceptManagedRoomClose(roomId: string): Promise<RoomOrch
 export declare function recordManagedRoomCloseError(roomId: string, error: string, recoveryHint: string): Promise<RoomOrchestrationRecord>;
 export declare function closeManagedRoom(input: {
     roomId: string;
-    cowork: Pick<CoworkAdapter, 'closeRoom'>;
+    cowork: Pick<CoworkAdapter, 'closeRoom'> & Partial<Pick<CoworkAdapter, 'getRoom'>>;
     deps?: RoomCloseDeps;
 }): Promise<RoomOrchestrationRecord>;
 export interface ManagedRoomDeleteResult {
@@ -41,6 +41,6 @@ export declare function deleteLegacyClosedRooms(input: {
 /** Retire live resources through the existing cursor, then delete retained state. */
 export declare function deleteManagedRoom(input: {
     roomId: string;
-    cowork: Pick<CoworkAdapter, 'closeRoom' | 'deleteRoom'>;
+    cowork: Pick<CoworkAdapter, 'closeRoom' | 'deleteRoom'> & Partial<Pick<CoworkAdapter, 'getRoom'>>;
     deps?: RoomCloseDeps;
 }): Promise<ManagedRoomDeleteResult>;