@ours.network/fleet 1.2.0-nightly.12 → 1.2.0-nightly.14

package/dist/rooms-tasks/close.js

@@ -1,3 +1,6 @@
+import { detachDeletedRoom } from './task-state.js';
+import { binderKey } from '../agent-ours/state.js';
+import { eraseMemberArtifacts } from './erasure.js';
 import { deleteWorkspace, assertWorkspaceDeletable } from './workspace.js';
 import { collectWorkspaceArchives } from './workspace-artifacts.js';
 import { existsSync, readFileSync } from 'node:fs';
@@ -9,7 +12,7 @@ import { agentDir, stateRoot } from '../paths.js';
 import { readClientProfile } from '../client-profile.js';
 import { readTempSupervisor, secureStoppedTempArchive, stopTempSupervisor, tempSupervisorLiveness, tempArchiveForLaunch, tempArchiveForCreationAction, } from '../temp-lifecycle.js';
 import { CoworkProtocolError } from './cowork-adapter.js';
-import { advanceMemberRetirement, advanceRoomClose, beginRoomClose, closeRoom, deleteRoomRecord, getRoomRecord, listRoomRecords, setRoomCloseError, } from './room-state.js';
+import { advanceMemberRetirement, advanceRoomClose, beginRoomClose, closeRoom, deleteRoomRecord, getRoomRecord, listRoomRecords, setRoomCloseError, recordRetirementMemberCids, } from './room-state.js';
 export const CLOSE_LOCK_STALE_MS = 5 * 60_000;
 const STOP_POLLS = 50;
 const STOP_POLL_MS = 100;
@@ -22,6 +25,20 @@ function errorText(error) {
 function exactMemberIdentity(seat) {
     const dir = agentDir(seat.role_name, true);
     const identityPath = join(dir, '.identity');
+    if (existsSync(dir) && !existsSync(identityPath) && seat.launch?.action_id && seat.launch.launch_id) {
+        const supervisor = readTempSupervisor(dir);
+        let creation;
+        try {
+            creation = JSON.parse(readFileSync(join(dir, 'creation.json'), 'utf8'));
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (supervisor?.role === seat.role_name && supervisor.launchId === seat.launch.launch_id
+            && creation?.role === seat.role_name && creation.creationActionId === seat.launch.action_id)
+            return;
+    }
     if (!existsSync(dir) || !existsSync(identityPath)) {
         throw new Error(`room member '${seat.role_name}' has no live Fleet temp-state identity proof; refusing retirement`);
     }
@@ -33,7 +50,8 @@ function exactMemberIdentity(seat) {
 export async function inspectMember(seat) {
     exactMemberIdentity(seat);
     const supervisor = readTempSupervisor(agentDir(seat.role_name, true));
-    if (!supervisor || supervisor.role !== seat.role_name) {
+    if (!supervisor || supervisor.role !== seat.role_name
+        || (seat.launch?.launch_id && supervisor.launchId !== seat.launch.launch_id)) {
         throw new Error(`room member '${seat.role_name}' has no exact Fleet supervisor ownership proof`);
     }
     return { launchId: supervisor.launchId };
@@ -93,14 +111,19 @@ export async function identityCidPresent(cid) {
 }
 export async function removeExactMemberIdentity(seat) {
     await withIdentityClient(async (client) => {
-        const before = listedIdentity(await client.listIdentities(), seat.role_name);
-        if (!before)
+        const rows = await client.listIdentities();
+        const before = listedIdentity(rows, seat.role_name);
+        if (!before) {
+            if (rows.some(row => row.name === seat.role_name || (seat.identity_cid && 'cid' in row
+                && row.cid.toLowerCase() === seat.identity_cid.toLowerCase())))
+                throw new Error(`room member '${seat.role_name}' identity absence is not proven`);
             return;
+        }
         if (!seat.identity_cid) {
-            throw new Error(`room member '${seat.role_name}' exists without a recorded authenticated CID; refusing removal`);
+            throw new Error(`room member '${seat.role_name}' exists without a recorded authenticated CID; identity absence is not proven; refusing removal`);
         }
         if (before.cid?.toLowerCase() !== seat.identity_cid.toLowerCase()) {
-            throw new Error(`room member '${seat.role_name}' identity CID mismatch: recorded ${seat.identity_cid}, found ${before.cid ?? 'none'}`);
+            throw new Error(`room member '${seat.role_name}' identity absence is not proven: CID mismatch: recorded ${seat.identity_cid}, found ${before.cid ?? 'none'}`);
         }
         try {
             await client.removeIdentity({ name: seat.role_name });
@@ -115,8 +138,9 @@ export async function removeExactMemberIdentity(seat) {
             if (after)
                 throw error;
         }
-        const after = listedIdentity(await client.listIdentities(), seat.role_name);
-        if (after) {
+        const after = await client.listIdentities();
+        if (after.some(row => row.name === seat.role_name || (seat.identity_cid && 'cid' in row
+            && row.cid.toLowerCase() === seat.identity_cid.toLowerCase()))) {
             throw new Error(`room member '${seat.role_name}' identity still exists after remove_identity`);
         }
     });
@@ -135,9 +159,9 @@ async function retireMember(roomId, seat, deps) {
     let current = room.member_seats.find(candidate => candidate.role_name === seat.role_name);
     let retirement = current.retirement;
     if (retirement?.phase === 'identity_absent') {
-        if (current.launch?.launch_id && current.launch.launch_id !== retirement.launch_id) {
+        if (!deps.inspectMember) {
             if (existsSync(agentDir(current.role_name, true)))
-                throw new Error(`room member '${current.role_name}' has a replacement launch after retirement; retire that exact temporary role before retrying`);
+                throw new Error('Retired member has replacement launch live state');
             await assertMemberIdentityAbsent(current);
         }
         return;
@@ -146,6 +170,8 @@ async function retireMember(roomId, seat, deps) {
         if (!existsSync(agentDir(current.role_name, true)) && current.launch?.launch_id && current.launch.action_id) {
             const archived = tempArchiveForLaunch(current.role_name, current.launch.launch_id);
             const created = tempArchiveForCreationAction(current.role_name, current.launch.action_id);
+            if (archived && (!created || created.path !== archived || created.launchId !== current.launch.launch_id))
+                throw new Error('Archived member creation ownership mismatch');
             if (archived && created?.path === archived && created.launchId === current.launch.launch_id) {
                 if (readFileSync(join(archived, '.identity'), 'utf8').trim() !== current.role_name)
                     throw new Error(`room member '${current.role_name}' archive identity mismatch`);
@@ -153,6 +179,7 @@ async function retireMember(roomId, seat, deps) {
                     throw new Error(`room member '${current.role_name}' archived supervisor is not proven stopped`);
                 // A terminated launch can archive itself before room retirement begins.
                 // Accept its exact durable provenance only when no identity needs removal.
+                await (deps.removeIdentity ?? removeExactMemberIdentity)(current);
                 await assertMemberIdentityAbsent(current);
                 const latest = getRoomRecord(roomId)?.member_seats.find(seat => seat.role_name === current.role_name);
                 if (existsSync(agentDir(current.role_name, true))
@@ -164,14 +191,6 @@ async function retireMember(roomId, seat, deps) {
                 return;
             }
         }
-        if (current.launch?.state === 'failed' && !existsSync(agentDir(current.role_name, true))) {
-            // A failure before applyRole (for example invite-secret validation) has
-            // no supervisor to stop or archive. Settle only proven absence; this
-            // path never removes an identity based on missing local evidence.
-            await assertMemberIdentityAbsent(current);
-            advanceMemberRetirement(roomId, current.role_name, 'identity_absent', 'failed-launch-absent');
-            return;
-        }
         if (current.launch?.state === 'pending' && current.launch.attempt === 0) {
             if (existsSync(agentDir(current.role_name, true))) {
                 throw new Error(`never-launched room member '${current.role_name}' unexpectedly has Fleet temp state`);
@@ -180,12 +199,31 @@ async function retireMember(roomId, seat, deps) {
             advanceMemberRetirement(roomId, current.role_name, 'identity_absent', 'never-launched');
             return;
         }
+        if (!deps.inspectMember && !existsSync(agentDir(current.role_name, true))) {
+            await (deps.removeIdentity ?? removeExactMemberIdentity)(current);
+            if (existsSync(agentDir(current.role_name, true)))
+                throw new Error(`room member '${current.role_name}' acquired replacement state during retirement`);
+            advanceMemberRetirement(roomId, current.role_name, 'identity_absent', 'absent-verified');
+            return;
+        }
         const ownership = await (deps.inspectMember ?? inspectMember)(current);
         room = advanceMemberRetirement(roomId, current.role_name, 'stop_requested', ownership.launchId);
         current = room.member_seats.find(candidate => candidate.role_name === seat.role_name);
         retirement = current.retirement;
     }
+    if (['stop_requested', 'liveness_absent', 'archive_secured'].includes(retirement.phase) && !deps.requestStop
+        && !existsSync(agentDir(current.role_name, true))) {
+        const archive = tempArchiveForLaunch(current.role_name, retirement.launch_id);
+        if (archive && await tempSupervisorLiveness(archive) !== 'stopped')
+            throw new Error('Archived supervisor is not proven stopped');
+        await (deps.removeIdentity ?? removeExactMemberIdentity)(current);
+        await assertMemberIdentityAbsent(current);
+        advanceMemberRetirement(roomId, current.role_name, 'identity_absent', retirement.launch_id, archive, !archive);
+        return;
+    }
     if (retirement.phase === 'stop_requested') {
+        if (!deps.inspectMember && (await inspectMember(current)).launchId !== retirement.launch_id)
+            throw new Error('Member launch changed before stop');
         await (deps.requestStop ?? (async (role) => { await stopTempSupervisor(role); }))(current.role_name);
         await (deps.waitForLivenessAbsent ?? waitForLivenessAbsent)(current.role_name, retirement.launch_id);
         room = advanceMemberRetirement(roomId, current.role_name, 'liveness_absent', retirement.launch_id);
@@ -215,17 +253,31 @@ export async function closeManagedRoom(input) {
     const lock = deps.lock ?? withFileLock;
     return lock(roomCloseLockPath(input.roomId), async () => {
         let room = beginRoomClose(input.roomId);
-        if (room.state === 'closed')
+        if (room.state === 'closed') {
+            if (!deps.inspectMember)
+                for (const seat of room.member_seats) {
+                    if (existsSync(agentDir(seat.role_name, true)))
+                        throw new Error('Closed room has replacement live state');
+                    await assertMemberIdentityAbsent(seat);
+                }
             return room;
+        }
         try {
             if (room.close?.phase === 'retire_members') {
+                room = await recoverMemberCids(room, input.cowork);
                 for (const seat of room.member_seats) {
                     await retireMember(input.roomId, seat, deps);
                 }
                 room = advanceRoomClose(input.roomId, 'close_cowork');
             }
             if (room.close?.phase === 'close_cowork') {
-                await input.cowork.closeRoom(input.roomId);
+                try {
+                    await input.cowork.closeRoom(input.roomId);
+                }
+                catch (error) {
+                    if (!(error instanceof CoworkProtocolError && error.code === 'not_found'))
+                        throw error;
+                }
             }
             return closeRoom(input.roomId);
         }
@@ -258,7 +310,8 @@ export async function deleteLegacyClosedRooms(input) {
 }
 /** Retire live resources through the existing cursor, then delete retained state. */
 export async function deleteManagedRoom(input) {
-    await closeManagedRoom(input);
+    if (getRoomRecord(input.roomId))
+        await closeManagedRoom(input);
     return withFileLock(roomCloseLockPath(input.roomId), async () => {
         try {
             try {
@@ -276,12 +329,65 @@ export async function deleteManagedRoom(input) {
                 collectWorkspaceArchives(retained.workspace);
                 deleteWorkspace(retained.workspace, 'room', input.roomId);
             }
+            if (retained)
+                await eraseMemberArtifacts('room', input.roomId, retained.member_seats, [input.roomId]);
+            if (retained?.task_id)
+                detachDeletedRoom(retained.task_id, input.roomId);
             deleteRoomRecord(input.roomId);
             return { room_id: input.roomId, deleted: true };
         }
         catch (error) {
-            setRoomCloseError(input.roomId, errorText(error), `Fix the cleanup error and explicitly retry room delete ${input.roomId} ${input.roomId}.`);
+            if (getRoomRecord(input.roomId))
+                setRoomCloseError(input.roomId, errorText(error), `Fix the cleanup error and explicitly retry room delete ${input.roomId} ${input.roomId}.`);
             throw error;
         }
     }, {}, CLOSE_LOCK_STALE_MS);
 }
+/** Recover only an authenticated seat tied to this exact room and issued invite.
+ * Display names and the current daemon name inventory are never binding proof.
+ */
+async function recoverMemberCids(room, cowork) {
+    if (!room.member_seats.some(seat => !seat.identity_cid))
+        return room;
+    const profile = room.member_seats.some(seat => seat.launch?.action_id) ? readClientProfile(process.env) : undefined;
+    let remote;
+    if (cowork.getRoom && room.room_identity_cid) {
+        try {
+            remote = await cowork.getRoom(room.room_id);
+        }
+        catch (error) {
+            if (!(error instanceof CoworkProtocolError && error.code === 'not_found'))
+                throw error;
+        }
+        if (remote && (remote.room_id !== room.room_id || remote.identity_cid.toLowerCase() !== room.room_identity_cid.toLowerCase()))
+            throw new Error('Room identity mismatch during deletion recovery');
+    }
+    const seats = room.member_seats.map(seat => {
+        let runtimeCid;
+        if (profile && seat.launch?.action_id) {
+            const dir = join(stateRoot(), 'private-ours', binderKey(profile.expectedInstanceId, seat.role_name));
+            try {
+                const state = JSON.parse(readFileSync(join(dir, 'state.json'), 'utf8'));
+                const instance = JSON.parse(readFileSync(join(dir, 'instance.json'), 'utf8'));
+                if (state.name === seat.role_name && state.daemon === profile.expectedInstanceId
+                    && state.lifetime === 'temporary' && state.action === seat.launch.action_id
+                    && instance.role === seat.role_name && instance.temporary === true && instance.instance === state.instance)
+                    runtimeCid = state.cid;
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+        const matches = seat.invite_id ? remote?.seats.filter(value => value.invite_id === seat.invite_id && value.role === seat.cowork_role) ?? [] : [];
+        if (matches.length > 1)
+            throw new Error('Ambiguous authenticated member identity during deletion recovery');
+        const candidates = [seat.identity_cid, runtimeCid, matches[0]?.identity_cid].filter((v) => !!v);
+        if (candidates.some(cid => !/^[a-f0-9]{64}$/i.test(cid)))
+            throw new Error('Invalid authenticated member CID');
+        if (new Set(candidates.map(cid => cid.toLowerCase())).size > 1)
+            throw new Error('Contradictory authenticated member CID evidence');
+        return candidates.length ? { ...seat, identity_cid: candidates[0] } : seat;
+    });
+    return recordRetirementMemberCids(room.room_id, seats);
+}

package/dist/rooms-tasks/deletion.d.ts

@@ -3,7 +3,7 @@ import { type CoworkAdapter } from './cowork-adapter.js';
 import { type TaskDeletionAcceptance } from './task-state.js';
 import type { TaskDeletionActor, TaskRecord } from './types.js';
 export { DELETION_MEMBER_ABSENT_VERIFIED } from './task-state.js';
-type DeletionCowork = Pick<CoworkAdapter, 'closeRoom' | 'deleteRoom'>;
+type DeletionCowork = Pick<CoworkAdapter, 'closeRoom' | 'deleteRoom'> & Partial<Pick<CoworkAdapter, 'getRoom'>>;
 export interface TaskDeletionSettleDeps {
     roomClose?: RoomCloseDeps;
     /** Test seam for the temp-state existence proof. */

package/dist/rooms-tasks/deletion.js

@@ -1,3 +1,4 @@
+import { eraseMemberArtifacts } from './erasure.js';
 import { proveArchivedAbsence, verifyArchivedAbsence, verifyArchivedMemberStillAbsent } from './archived-absence.js';
 import { existsSync } from 'node:fs';
 import { withFileLock } from '../atomic-file.js';
@@ -5,12 +6,12 @@ import { agentDir } from '../paths.js';
 import { deleteWorkspace, assertWorkspaceDeletable } from './workspace.js';
 import { collectWorkspaceArchives } from './workspace-artifacts.js';
 import { secureStoppedTempArchive, stopTempSupervisor } from '../temp-lifecycle.js';
-import { closeManagedRoom, identityCidPresent, inspectMember, removeExactMemberIdentity, waitForLivenessAbsent, } from './close.js';
+import { closeManagedRoom, identityCidPresent, inspectMember, assertMemberIdentityAbsent, removeExactMemberIdentity, waitForLivenessAbsent, } from './close.js';
 import { CoworkProtocolError } from './cowork-adapter.js';
 import { deleteRoomRecord, getRoomRecord, listRoomRecords } from './room-state.js';
 import { acquireLaunchSnapshotLock, releaseLaunchSnapshotForDeletingTask } from './launch-snapshot.js';
 import { TASK_OPERATION_LOCK_STALE_MS, taskOperationLockPath } from './terminal.js';
-import { advanceTaskDeletionMember, beginTaskDeletionIntent, completeTaskDeletionReceipt, ensureTaskDeletionReceipt, getDeletingTask, importTaskDeletionRetirementEvidence, setTaskDeletionError, TaskStateError, beginTaskWorkspaceCleanup, unlinkDeletedTask, upsertTaskDeletionMembersFromSeats, } from './task-state.js';
+import { advanceTaskDeletionMember, settleAbsentTaskDeletionMember, beginTaskDeletionIntent, completeTaskDeletionReceipt, ensureTaskDeletionReceipt, getDeletingTask, importTaskDeletionRetirementEvidence, setTaskDeletionError, TaskStateError, beginTaskArchiveCleanup, unlinkDeletedTask, upsertTaskDeletionMembersFromSeats, } from './task-state.js';
 export { DELETION_MEMBER_ABSENT_VERIFIED } from './task-state.js';
 import { DELETION_MEMBER_ABSENT_VERIFIED } from './task-state.js';
 /**
@@ -43,6 +44,7 @@ function tolerantCowork(cowork) {
         }
     };
     return {
+        ...(cowork.getRoom ? { getRoom: cowork.getRoom.bind(cowork) } : {}),
         closeRoom: roomId => tolerate(() => cowork.closeRoom(roomId)),
         deleteRoom: roomId => tolerate(() => cowork.deleteRoom(roomId)),
     };
@@ -51,6 +53,7 @@ function cursorSeat(cursor) {
     return {
         role_name: cursor.name, identity_cid: cursor.identity_cid,
         slot: cursor.name, cowork_role: 'member', seat_state: 'active',
+        ...(cursor.launch_id ? { retirement: { phase: 'identity_absent', launch_id: cursor.launch_id, archive_path: cursor.archive_path, updated_at: cursor.updated_at } } : {}),
     };
 }
 /**
@@ -63,8 +66,15 @@ function cursorSeat(cursor) {
 async function retireCursorMember(taskId, cursor, deps) {
     let phase = cursor.phase;
     let launchId = cursor.launch_id;
-    if (phase === 'identity_absent')
+    if (phase === 'identity_absent') {
+        if (!deps.roomClose?.inspectMember) {
+            if ((deps.hasTempState ?? (name => existsSync(agentDir(name, true))))(cursor.name))
+                throw new Error('Retired deletion member has replacement live state');
+            if (await (deps.identityCidPresent ?? identityCidPresent)(cursor.identity_cid))
+                throw new Error('Retired deletion member identity reappeared');
+        }
         return;
+    }
     const seat = cursorSeat(cursor);
     const roomClose = deps.roomClose ?? {};
     if (phase === 'pending') {
@@ -88,7 +98,16 @@ async function retireCursorMember(taskId, cursor, deps) {
         phase = 'stop_requested';
         launchId = ownership.launchId;
     }
+    if (!roomClose.inspectMember && !existsSync(agentDir(cursor.name, true))) {
+        await (roomClose.removeIdentity ?? removeExactMemberIdentity)(seat);
+        if (existsSync(agentDir(cursor.name, true)))
+            throw new Error('Deletion member acquired replacement state');
+        settleAbsentTaskDeletionMember(taskId, cursor.name);
+        return;
+    }
     if (phase === 'stop_requested') {
+        if (!roomClose.inspectMember && (await inspectMember(seat)).launchId !== launchId)
+            throw new Error('Deletion member launch changed before stop');
         await (roomClose.requestStop
             ?? (async (role) => { await stopTempSupervisor(role); }))(cursor.name);
         await (roomClose.waitForLivenessAbsent ?? waitForLivenessAbsent)(cursor.name, launchId);
@@ -140,8 +159,6 @@ export async function settleTaskDeletion(input) {
             // aborts settlement (fail closed).
             ensureTaskDeletionReceipt(taskId);
             const records = listRoomRecords().filter(room => room.task_id === taskId);
-            if (task.deletion.workspace_cleanup_started_at && records.length)
-                throw new TaskStateError(`task ${taskId} room records reappeared after workspace cleanup began`);
             const recordIds = new Set(records.map(room => room.room_id));
             const recordedRoomId = task.deletion.room_id ?? task.room_id;
             const needsCowork = records.length > 0 || recordedRoomId !== undefined;
@@ -153,8 +170,15 @@ export async function settleTaskDeletion(input) {
                 const seats = closed?.member_seats ?? record.member_seats;
                 const proofs = [];
                 for (const seat of seats) {
-                    if (!seat.identity_cid && seat.retirement?.launch_id !== 'never-launched')
-                        proofs.push(await proveArchivedAbsence(seat));
+                    if (!seat.identity_cid && !seat.retirement?.absence_verified && !['never-launched', 'absent-verified'].includes(seat.retirement?.launch_id ?? '')) {
+                        const prior = task.deletion.archived_absences?.find(proof => proof.name === seat.role_name);
+                        if (task.deletion.workspace_cleanup_started_at && prior && !existsSync(prior.archive_path)) {
+                            await verifyArchivedMemberStillAbsent(prior);
+                            proofs.push(prior);
+                        }
+                        else
+                            proofs.push(await proveArchivedAbsence(seat));
+                    }
                 }
                 // No await between the last live-state fence and durable checkpoint.
                 for (const proof of proofs) {
@@ -166,7 +190,9 @@ export async function settleTaskDeletion(input) {
                 importTaskDeletionRetirementEvidence(taskId, seats, proofs);
                 await cowork.deleteRoom(record.room_id);
                 for (const proof of proofs)
-                    await verifyArchivedAbsence(proof);
+                    await (task.deletion.workspace_cleanup_started_at && !existsSync(proof.archive_path) ? verifyArchivedMemberStillAbsent : verifyArchivedAbsence)(proof);
+                beginTaskArchiveCleanup(taskId);
+                await eraseMemberArtifacts('room', record.room_id, seats, [record.room_id]);
                 for (const proof of proofs)
                     if (existsSync(agentDir(proof.name, true)))
                         throw new Error('Archived member replacement before room unlink');
@@ -216,11 +242,17 @@ export async function settleTaskDeletion(input) {
             for (const proof of task.deletion.archived_absences ?? [])
                 if (existsSync(agentDir(proof.name, true)))
                     throw new Error('Archived member replacement before task unlink');
+            for (const name of task.deletion.absent_members ?? []) {
+                if (existsSync(agentDir(name, true)))
+                    throw new Error('Absent member acquired replacement state');
+                await assertMemberIdentityAbsent({ role_name: name, slot: name, cowork_role: 'member', seat_state: 'removed' });
+            }
             if (cleanup.snapshotHash)
                 releaseLaunchSnapshotForDeletingTask(cleanup.snapshotHash, taskId);
+            await eraseMemberArtifacts('task', taskId, task.deletion.members.map(cursorSeat), task.deletion.room_id ? [task.deletion.room_id] : []);
             if (task.workspace) {
                 assertWorkspaceDeletable(task.workspace, 'task', taskId);
-                beginTaskWorkspaceCleanup(taskId);
+                beginTaskArchiveCleanup(taskId);
                 collectWorkspaceArchives(task.workspace);
                 deleteWorkspace(task.workspace, 'task', taskId);
             }

package/dist/rooms-tasks/erasure.d.ts

@@ -0,0 +1,6 @@
+import type { RoomMemberSeat } from './types.js';
+/** Erase only proven launch artifacts. Each atomic rename transfers ownership to
+ * a random, durable tombstone before recursive removal can destroy its proof.
+ * The caller holds the task/room lifecycle lock and has retired all writers.
+ */
+export declare function eraseMemberArtifacts(owner: 'room' | 'task', id: string, seats: readonly RoomMemberSeat[], roomIds: readonly string[]): Promise<void>;

package/dist/rooms-tasks/erasure.js

@@ -0,0 +1,169 @@
+import { eraseResourcePresentations } from '../erased-resources.js';
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import { dirname, join, relative } from 'node:path';
+import { parse } from 'yaml';
+import { replaceFileAtomically } from '../atomic-file.js';
+import { agentDir, stateRoot } from '../paths.js';
+import { readTempSupervisor, tempSupervisorLiveness, eraseTerminationEvents } from '../temp-lifecycle.js';
+import { assertSafeAncestors, auditWorkspaceGit } from './workspace.js';
+function entries(path) {
+    try {
+        return readdirSync(path);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+}
+function json(path) {
+    try {
+        if (!lstatSync(path).isFile() || lstatSync(path).isSymbolicLink())
+            return undefined;
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+}
+function fingerprint(path) {
+    const stat = lstatSync(path);
+    const files = stat.isDirectory() ? ['creation.json', '.temp-supervisor.json', '.identity', 'role.yaml', 'state.json', 'instance.json'] : [''];
+    const hash = createHash('sha256');
+    for (const file of files) {
+        const target = file ? join(path, file) : path;
+        if (existsSync(target)) {
+            if (!lstatSync(target).isFile() || lstatSync(target).isSymbolicLink())
+                throw new Error('Unsafe erasure proof');
+            hash.update(file).update(readFileSync(target));
+        }
+    }
+    return hash.digest('hex');
+}
+/** Erase only proven launch artifacts. Each atomic rename transfers ownership to
+ * a random, durable tombstone before recursive removal can destroy its proof.
+ * The caller holds the task/room lifecycle lock and has retired all writers.
+ */
+export async function eraseMemberArtifacts(owner, id, seats, roomIds) {
+    if (!/^[a-zA-Z0-9_-]{1,80}$/.test(id))
+        throw new Error('Invalid erasure owner');
+    const root = stateRoot();
+    const manifestPath = join(root, 'erasure', `${owner}-${id}.json`);
+    assertSafeAncestors(dirname(manifestPath));
+    let manifest = json(manifestPath);
+    const names = new Set(seats.map(s => s.role_name));
+    for (const name of names) {
+        if (!/^[a-zA-Z0-9_-]{1,120}$/.test(name))
+            throw new Error('Invalid erasure member');
+        if (existsSync(agentDir(name, true)))
+            throw new Error(`Member '${name}' still has live state during erasure`);
+    }
+    if (!manifest) {
+        const paths = [];
+        const launches = seats.flatMap(seat => {
+            const launchId = seat.launch?.launch_id ?? seat.retirement?.launch_id;
+            return launchId ? [{ role: seat.role_name, launchId }] : [];
+        });
+        const actions = new Map(seats.map(s => [s.role_name, new Set([s.launch?.action_id].filter((v) => !!v))]));
+        const recovery = join(root, 'recovery', 'temporary');
+        assertSafeAncestors(recovery);
+        for (const entry of entries(recovery)) {
+            const path = join(recovery, entry);
+            const stat = lstatSync(path);
+            if (!stat.isDirectory() || stat.isSymbolicLink())
+                continue;
+            const supervisor = readTempSupervisor(path);
+            if (!supervisor || !names.has(supervisor.role))
+                continue;
+            const seat = seats.find(s => s.role_name === supervisor.role);
+            const creation = json(join(path, 'creation.json'));
+            let room;
+            const roleFile = join(path, 'role.yaml');
+            if (existsSync(roleFile) && lstatSync(roleFile).isFile() && !lstatSync(roleFile).isSymbolicLink()) {
+                const role = parse(readFileSync(roleFile, 'utf8'));
+                if (role?.name === supervisor.role)
+                    room = role.roomMemberStartup?.room_id;
+            }
+            const exactLaunch = seat.launch?.launch_id === supervisor.launchId || seat.retirement?.launch_id === supervisor.launchId;
+            const exactAction = creation?.role === supervisor.role && creation.creationActionId === seat.launch?.action_id;
+            // Older attempts belong only when the launch descriptor pins the room.
+            if (!(exactLaunch && (exactAction || !seat.launch?.action_id)) && !(room && roomIds.includes(room)))
+                continue;
+            if (existsSync(join(path, '.identity')) && readFileSync(join(path, '.identity'), 'utf8').trim() !== supervisor.role)
+                throw new Error('Archive identity mismatch during erasure');
+            if (await tempSupervisorLiveness(path) !== 'stopped')
+                throw new Error('Archive writer is not stopped');
+            if (creation?.role === supervisor.role && typeof creation.creationActionId === 'string')
+                actions.get(supervisor.role).add(creation.creationActionId);
+            auditWorkspaceGit(path);
+            launches.push({ role: supervisor.role, launchId: supervisor.launchId });
+            paths.push(path);
+        }
+        const privateRoot = join(root, 'private-ours');
+        assertSafeAncestors(privateRoot);
+        for (const entry of entries(privateRoot)) {
+            const path = join(privateRoot, entry);
+            if (!lstatSync(path).isDirectory() || lstatSync(path).isSymbolicLink())
+                continue;
+            if (entry === 'launches' || entry === 'room-inputs') {
+                for (const file of entries(path)) {
+                    const child = join(path, file), value = json(child);
+                    if (!value)
+                        continue;
+                    const launchOwned = entry === 'launches' && value.role === value.identity
+                        && actions.get(value.role)?.has(value.action);
+                    const roomOwned = entry === 'room-inputs' && roomIds.includes(value.room_id)
+                        && names.has(value.identity_name);
+                    const readyOwned = entry === 'room-inputs' && file.endsWith('.ready.json')
+                        && roomIds.includes(value.room) && seats.some(seat => seat.invite_id === value.invite && (!seat.identity_cid || seat.identity_cid === value.cid));
+                    if (launchOwned || roomOwned || readyOwned)
+                        paths.push(child);
+                }
+                continue;
+            }
+            const state = json(join(path, 'state.json')), instance = json(join(path, 'instance.json'));
+            if (state?.lifetime === 'temporary' && actions.get(state.name)?.has(state.action)
+                && instance?.role === state.name && instance?.temporary === true && instance?.instance === state.instance) {
+                auditWorkspaceGit(path);
+                paths.push(path);
+            }
+        }
+        manifest = { launches, version: 1, token: randomUUID(), paths, phases: {}, stamps: Object.fromEntries(paths.map(path => {
+                const stat = lstatSync(path);
+                return [path, { dev: stat.dev, ino: stat.ino, proof: fingerprint(path) }];
+            })) };
+        mkdirSync(dirname(manifestPath), { recursive: true, mode: 0o700 });
+        replaceFileAtomically(manifestPath, JSON.stringify(manifest));
+    }
+    if (manifest.version !== 1 || !/^[a-f0-9-]{36}$/.test(manifest.token) || !Array.isArray(manifest.paths))
+        throw new Error('Invalid erasure manifest');
+    for (const path of manifest.paths) {
+        const rel = relative(root, path);
+        if (!rel.startsWith('recovery/temporary/') && !rel.startsWith('private-ours/'))
+            throw new Error('Invalid erasure artifact path');
+        if (rel.split('/').includes('..'))
+            throw new Error('Invalid erasure artifact traversal');
+        assertSafeAncestors(dirname(path));
+        const tombstone = `${path}.erasing-${manifest.token}`;
+        if (manifest.phases[path] === 'removed')
+            continue;
+        if (existsSync(path) && !existsSync(tombstone) && manifest.phases[path] !== 'renamed') {
+            const stat = lstatSync(path), stamp = manifest.stamps[path];
+            if (stat.isSymbolicLink() || !stamp || stamp.dev !== stat.dev || stamp.ino !== stat.ino || stamp.proof !== fingerprint(path))
+                throw new Error('Erasure source ownership changed');
+            renameSync(path, tombstone);
+        }
+        manifest.phases[path] = 'renamed';
+        replaceFileAtomically(manifestPath, JSON.stringify(manifest));
+        rmSync(tombstone, { recursive: true, force: true });
+        manifest.phases[path] = 'removed';
+        replaceFileAtomically(manifestPath, JSON.stringify(manifest));
+    }
+    eraseResourcePresentations([{ kind: owner, id }, ...roomIds.map(id => ({ kind: 'room', id })),
+        ...seats.map(seat => ({ kind: 'agent', id: seat.role_name }))]);
+    eraseTerminationEvents(manifest.launches);
+    rmSync(manifestPath, { force: true });
+}

package/dist/rooms-tasks/room-state.d.ts

@@ -31,6 +31,8 @@ export declare function updateMemberStartup(id: string, roleName: string, update
 export declare function activateRoom(id: string): RoomOrchestrationRecord;
 export declare function closeRoom(id: string): RoomOrchestrationRecord;
 export declare function beginRoomClose(id: string): RoomOrchestrationRecord;
-export declare function advanceMemberRetirement(id: string, roleName: string, phase: MemberRetirementPhase, launchId: string, archivePath?: string): RoomOrchestrationRecord;
+export declare function advanceMemberRetirement(id: string, roleName: string, phase: MemberRetirementPhase, launchId: string, archivePath?: string, absenceVerified?: boolean): RoomOrchestrationRecord;
 export declare function advanceRoomClose(id: string, phase: RoomClosePhase): RoomOrchestrationRecord;
 export declare function setRoomCloseError(id: string, error: string, recoveryHint: string): RoomOrchestrationRecord;
+/** Settlement-only binding recovery; never publishes a seat or changes a launch. */
+export declare function recordRetirementMemberCids(id: string, recovered: ReadonlyArray<RoomMemberSeat>): RoomOrchestrationRecord;