@ours.network/fleet 1.2.0-nightly.3 → 1.2.0-nightly.5

package/dist/session/codex-app-server-transport.js

@@ -55,7 +55,7 @@ export class CodexAppServerTransport {
             throw new Error('Codex app-server command is empty');
         const child = spawn(options.argv[0], options.argv.slice(1), {
             cwd: options.cwd,
-            env: { ...process.env, ...options.env },
+            env: { ...(options.env?.FLEET_OURS_MANAGED === '1' ? {} : process.env), ...options.env },
             stdio: ['pipe', 'pipe', 'pipe'],
         });
         // `pid` is assigned synchronously on a successful local spawn. Checking it

package/dist/spawn.js

@@ -1,3 +1,5 @@
+import { randomUUID } from 'node:crypto';
+import { storeRoomSecret, storeTemporaryLaunch, preparePermanentAssignment } from './agent-ours/service.js';
 import { spawn as spawnChild } from 'node:child_process';
 import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -7,7 +9,7 @@ import { validateIsolationConfig } from './isolation/policy.js';
 import { loadConfig, findRole, splitRootFor, validateMonitorConfig, } from './config.js';
 import { applyRole, up } from './ops.js';
 import { START_STAGGER_FILE } from './runner.js';
-import { buildProvenance, daemonIdentityProvisioner, ensureIdentity, provenanceOf, withCreationTransaction, writeProvenance, writeRoleFile, } from './creation.js';
+import { buildProvenance, provenanceOf, withCreationTransaction, writeProvenance, writeRoleFile, } from './creation.js';
 import { VERSION } from './version.js';
 import { recordGeneratedAgentSource } from './generated-agent-source.js';
 import './harness/claude-code.js';
@@ -239,22 +241,12 @@ export async function spawnPermanent(o, deps, creation = {}) {
     return withCreationTransaction({ role: o.name, identity: effectiveIdentity(o) }, async (tx) => {
         assertNameFree(o);
         const cfg = loadConfig(o.configPath);
-        // Establish the identity BEFORE the service is enabled, and record
-        // what was actually guaranteed so the briefing can say something true.
+        // Pin an existing assignment without binding; the supervisor provisions
+        // a missing role identity before starting its harness.
         creation.onStage?.('checking_identity');
-        const guarantee = await ensureIdentity(effectiveIdentity(o), { bio: prepared.role.bio, persona: prepared.role.persona }, creation.identityProvisioner ?? deps.identityProvisioner ?? daemonIdentityProvisioner(), deps.log);
-        creation.onStage?.('checking_identity', {
-            result: guarantee.evidence, guarantee: guarantee.state,
-        });
-        if (guarantee.state === 'created')
-            // We minted it; a failed creation must not leave an orphan identity
-            // behind. Only ever removes an identity THIS transaction created.
-            tx.record({
-                stage: `ours identity ${effectiveIdentity(o)}`,
-                undo: async () => {
-                    await creation.identityProvisioner?.remove?.(effectiveIdentity(o));
-                },
-            });
+        const assignment = await preparePermanentAssignment(prepared.role);
+        const guarantee = { state: assignment, evidence: assignment === 'verified' ? 'verified' : 'missing' };
+        creation.onStage?.('checking_identity', { result: guarantee.evidence, guarantee: guarantee.state });
         const agentRoot = join(splitRootFor(o.configPath ?? defaultConfigPath()), 'agents');
         mkdirSync(agentRoot, { recursive: true });
         creation.onStage?.('writing_role');
@@ -354,6 +346,10 @@ async function spawnTempInner(o, preparedRole, binPath, launch, tx, onStage) {
         temporaryLoopSource: o.loopSource ?? (temporaryLoops?.length ? 'agent-template' : 'omitted'),
         roomMemberStartup: o.roomMemberStartup,
     };
+    storeTemporaryLaunch(role, o.creationActionId ?? randomUUID());
+    storeRoomSecret(role);
+    if (role.roomMemberStartup)
+        role.roomMemberStartup = { ...role.roomMemberStartup, invite: '' };
     onStage?.('writing_role');
     const dir = applyRole(role, { temp: true, identityGuarantee: 'unverified' });
     const provenance = buildProvenance({

package/dist/temp-supervisor-recovery.d.ts

@@ -0,0 +1,3 @@
+export declare const TEMP_RECYCLE_EXIT = 75;
+/** Keep the service's main process alive while replacing a PID-scoped worker. */
+export declare function runTempSupervisor(name: string, entrypoint: string, initial?: () => Promise<void>): Promise<void>;

package/dist/temp-supervisor-recovery.js

@@ -0,0 +1,46 @@
+import { spawn } from 'node:child_process';
+import { runTemp, SupervisorRecycleRequiredError } from './runner.js';
+export const TEMP_RECYCLE_EXIT = 75;
+/** Keep the service's main process alive while replacing a PID-scoped worker. */
+export async function runTempSupervisor(name, entrypoint, initial = () => runTemp(name)) {
+    try {
+        await initial();
+        return;
+    }
+    catch (error) {
+        if (!(error instanceof SupervisorRecycleRequiredError))
+            throw error;
+    }
+    for (let attempt = 0; attempt < 3; attempt++) {
+        const child = spawn(process.execPath, [entrypoint, '_run-temp-worker', name], {
+            stdio: 'inherit',
+            env: process.env,
+        });
+        let stopping = false;
+        const term = () => {
+            stopping = true;
+            child.kill('SIGTERM');
+        }, interrupt = () => {
+            stopping = true;
+            child.kill('SIGINT');
+        };
+        process.on('SIGTERM', term);
+        process.on('SIGINT', interrupt);
+        let code;
+        try {
+            code = await new Promise((resolve, reject) => {
+                child.once('error', reject);
+                child.once('exit', resolve);
+            });
+        }
+        finally {
+            process.off('SIGTERM', term);
+            process.off('SIGINT', interrupt);
+        }
+        if (code === 0 || stopping)
+            return;
+        if (code !== TEMP_RECYCLE_EXIT)
+            throw Error(`Temporary supervisor replacement exited with ${code}`);
+    }
+    throw Error('Temporary supervisor recycle limit reached; identity retained for explicit recovery');
+}

package/dist/watchdog/briefing.js

@@ -5,22 +5,9 @@ import { formatDuration } from '../duration.js';
  * wasn't verified when configured, fall back to createTool on first run.
  */
 function bindSection(heading, wd, v, guarantee) {
-    const L = ['', heading];
-    L.push(`Call the **${v.bindTool}** tool with name "${wd.identity}" force=true (search the`);
-    L.push('deferred tool registry first if needed).');
-    if (guarantee === 'unverified') {
-        L.push(`- This identity was NOT verified when this watchdog was configured, so it may not`);
-        L.push(`  exist yet. If binding reports no such identity, call **${v.createTool}** name`);
-        L.push(`  "${wd.identity}" once to mint it on this first run, then you are bound. Re-binding`);
-        L.push('  your OWN identity is always allowed.');
-    }
-    else {
-        L.push(`- It was ${guarantee === 'created' ? 'created' : 'verified to exist'} when this`);
-        L.push('  watchdog was configured, so binding should succeed. If it unexpectedly reports no');
-        L.push(`  such identity, call **${v.createTool}** name "${wd.identity}" once and report the`);
-        L.push('  discrepancy — something removed it since.');
-    }
-    return L;
+    return ['', '## Assigned identity',
+        `Your supervisor has bound your identity **${wd.identity}**. The ours tools are ready.`,
+        'No identity setup or skill reading is required.'];
 }
 /**
  * Render a watchdog run's fixed contract (briefing.md-equivalent for a one-shot clean-context

package/dist/watchdog/run.js

@@ -1,3 +1,4 @@
+import { preparePermanentAssignment, releaseManagedAgent } from '../agent-ours/service.js';
 import { closeSync, existsSync, openSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 import { spawn as spawnChild } from 'node:child_process';
 import { join } from 'node:path';
@@ -7,8 +8,7 @@ import { acquireRunLock, formatRunId, pruneReports, releaseRunLock, writeReport
 import { generateNotifierBriefing, generateWatchdogBriefing } from './briefing.js';
 import { computeDigest, reconcileLedger, readLedger, writeLedger } from './alerts.js';
 import { applyRole } from '../ops.js';
-import { daemonIdentityInventoryProvisioner, ensureIdentity, } from '../creation.js';
-import { runOnce, START_STAGGER_FILE } from '../runner.js';
+import { runOnce, loadTempRole, START_STAGGER_FILE } from '../runner.js';
 import { agentDir, tmpRoot } from '../paths.js';
 import { loadConfig, ROLE_NAME_RE, } from '../config.js';
 import { getAdapter } from '../harness/registry.js';
@@ -53,6 +53,7 @@ async function killIfNeeded(reason, child, roleName, sleep) {
         if (reason === 'stable')
             await sleep(HARVEST_GRACE_MS);
         child.kill();
+        await child.exited;
     }
 }
 function defaultLaunchChild(binPath, roleName, runDir) {
@@ -139,7 +140,7 @@ export async function executeWatchdogRun(wd, deps) {
         rmSync(runDir, { recursive: true, force: true });
     let report;
     try {
-        const guarantee = await ensureIdentity(wd.identity, {}, deps.identityProvisioner ?? daemonIdentityInventoryProvisioner(), deps.log);
+        const guarantee = { state: 'unverified' }; // The child supervisor provisions before its harness starts.
         const cfg = deps.cfg ?? loadConfig();
         const discovered = wd.watchExplicit
             ? []
@@ -272,7 +273,7 @@ export async function executeNotifierRun(wd, text, deps) {
         // A crashed previous run can leave the temp dir behind; start clean.
         if (existsSync(runDir))
             rmSync(runDir, { recursive: true, force: true });
-        const guarantee = await ensureIdentity(wd.identity, {}, deps.identityProvisioner ?? daemonIdentityInventoryProvisioner(), deps.log);
+        const guarantee = { state: 'unverified' }; // The child supervisor provisions before its harness starts.
         const cfg = deps.cfg ?? loadConfig();
         const role = buildWatchdogRole(wd, cfg);
         const dir = applyRole(role, { temp: true, identityGuarantee: guarantee.state });
@@ -317,5 +318,18 @@ export async function executeNotifierRun(wd, text, deps) {
 }
 /** What `_run-watchdog` calls: one supervised session, no cleanup — the parent harvests. */
 export async function runWatchdogAgent(name) {
-    await runOnce(name, { temp: true });
+    const role = loadTempRole(name);
+    await preparePermanentAssignment(role);
+    let stopping = false;
+    const stop = () => { stopping = true; };
+    process.on('SIGTERM', stop);
+    process.on('SIGINT', stop);
+    try {
+        await runOnce(name, { temp: true, identityLifetime: 'permanent' }, { shouldStop: () => stopping });
+    }
+    finally {
+        process.off('SIGTERM', stop);
+        process.off('SIGINT', stop);
+        await releaseManagedAgent(role);
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.3",
+  "version": "1.2.0-nightly.5",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -41,8 +41,9 @@
     "@agentclientprotocol/sdk": "^1.3.0",
     "@fastify/static": "^10.1.2",
     "@fastify/websocket": "^11.2.0",
-    "@ours.network/cli": "2.8.1-nightly.7",
-    "@ours.network/sdk": "3.8.1-nightly.9",
+    "@ours.network/cli": "2.8.1-nightly.8",
+    "@ours.network/mcp": "1.2.0-nightly.6",
+    "@ours.network/sdk": "3.8.1-nightly.10",
     "commander": "^12.1.0",
     "fastify": "^5.4.0",
     "react": "^19.1.1",
@@ -56,6 +57,7 @@
     "@agentclientprotocol/codex-acp": "1.10.0"
   },
   "devDependencies": {
+    "@ours.network/daemon": "3.8.1-nightly.2",
     "@playwright/test": "^1.54.1",
     "@types/node": "^20.14.0",
     "@types/react": "^19.1.9",
@@ -63,7 +65,6 @@
     "@types/ws": "^8.18.1",
     "typescript": "^5.5.0",
     "vite": "^7.0.6",
-    "vitest": "^2.0.0",
-    "@ours.network/daemon": "3.8.1-nightly.1"
+    "vitest": "^2.0.0"
   }
 }