@ours.network/fleet 1.2.0-nightly.44 → 1.2.0-nightly.46

package/dist/notifications/fleet-producer.d.ts

@@ -10,6 +10,7 @@ export declare class FleetNotificationProducer {
     private readonly queues;
     private readonly timer;
     private readonly existing;
+    private cleanup?;
     constructor(roots: string[], stateDir: string, config: ProducerConfig, warn?: (line: string) => void);
     private names;
     poll(): void;

package/dist/notifications/fleet-producer.js

@@ -1,7 +1,42 @@
-import { closeSync, existsSync, lstatSync, openSync, readSync, readdirSync, statSync } from 'node:fs';
+import { roomsDir } from '../rooms-tasks/room-state.js';
+import { drainNotificationTargetCleanup } from './target-cleanup.js';
+import { closeSync, existsSync, lstatSync, openSync, readSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { createHash } from 'node:crypto';
 import { NotificationOutbox } from './outbox.js';
+/** Unlike a UI inventory, unread classification must not treat unreadable records as absence. */
+function taskRoleAssociations() {
+    const dir = roomsDir(), result = new Map();
+    let files;
+    try {
+        files = readdirSync(dir);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return result;
+        throw error;
+    }
+    for (const name of files.filter(name => name.endsWith('.json'))) {
+        const file = join(dir, name), stat = lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024)
+            throw Error('Unreadable room association');
+        const room = JSON.parse(readFileSync(file, 'utf8'));
+        if (!room || typeof room.room_id !== 'string' || !Array.isArray(room.member_seats))
+            throw Error('Invalid room association');
+        if (room.task_id === undefined)
+            continue;
+        if (typeof room.task_id !== 'string' || !/^[A-Za-z0-9_-]{1,120}$/.test(room.task_id))
+            throw Error('Invalid task association');
+        for (const seat of room.member_seats) {
+            if (typeof seat.role_name !== 'string')
+                throw Error('Invalid member association');
+            if (result.has(seat.role_name) && result.get(seat.role_name) !== room.task_id)
+                throw Error('Ambiguous task association');
+            result.set(seat.role_name, room.task_id);
+        }
+    }
+    return result;
+}
 /** Read durable supervisor ledgers without restarting agents or attaching a
  * conversation controller. Each tick reads at most 256 KiB per role, from its
  * checkpoint; it never loads a complete transcript or requests model history. */
@@ -13,6 +48,7 @@ export class FleetNotificationProducer {
     queues = new Map();
     timer;
     existing = new Set();
+    cleanup;
     constructor(roots, stateDir, config, warn = () => { }) {
         this.roots = roots;
         this.stateDir = stateDir;
@@ -34,6 +70,49 @@ export class FleetNotificationProducer {
         }
     }
     poll() {
+        this.cleanup ??= drainNotificationTargetCleanup(this.config, undefined, undefined, { beforeDelete: async (url) => {
+                const name = new URL(url, 'https://ours.invalid').searchParams.get('chat');
+                if (!name || !/^[A-Za-z0-9_-]+$/.test(name))
+                    return false;
+                // A recreated or retained role still has a valid target. Filesystem errors cannot prove removal.
+                for (const root of this.roots) {
+                    try {
+                        lstatSync(join(root, name));
+                        return false;
+                    }
+                    catch (error) {
+                        if (error.code !== 'ENOENT')
+                            throw error;
+                    }
+                }
+                for (const root of this.roots) {
+                    const roleDir = join(root, name), queue = this.queues.get(roleDir);
+                    if (queue) {
+                        await queue.retire();
+                        this.queues.delete(roleDir);
+                    }
+                    else {
+                        const file = join(this.stateDir, createHash('sha256').update(roleDir).digest('hex') + '.json');
+                        if (existsSync(file)) {
+                            const queue = new NotificationOutbox(file, this.config, async () => { throw Error('retired target'); });
+                            try {
+                                await queue.retire();
+                            }
+                            finally {
+                                await queue.close();
+                            }
+                        }
+                    }
+                }
+                return true;
+            } }).catch(() => { }).finally(() => { this.cleanup = undefined; });
+        let taskRoles;
+        try {
+            taskRoles = taskRoleAssociations();
+        }
+        catch {
+            this.warn('Notification task association unavailable; delivering unclassified events');
+        }
         for (const root of this.roots)
             for (const roleId of this.names(root)) {
                 const roleDir = join(root, roleId), dir = join(roleDir, '.conversation');
@@ -108,7 +187,7 @@ export class FleetNotificationProducer {
                         if (['message.chunk', 'message.replace'].includes(event.kind) && event.promptId && event.messageId && current.prompts.includes(prompt))
                             current.messages[prompt] = event.messageId;
                         if (event.kind === 'turn.completed' && event.promptId && current.prompts.includes(prompt)) {
-                            if (!outbox.enqueue(`${roleId}:${event.sessionGeneration}:${event.seq}`, { url: `/fleet/chats?chat=${encodeURIComponent(roleId)}&detail=1#fleet-message-${encodeURIComponent(current.messages[prompt] ?? event.promptId)}` }))
+                            if (!outbox.enqueue(`${roleId}:${event.sessionGeneration}:${event.seq}`, { ...(taskRoles ? { taskId: taskRoles.get(roleId) ?? null } : {}), url: `/fleet/chats?chat=${encodeURIComponent(roleId)}&detail=1#fleet-message-${encodeURIComponent(current.messages[prompt] ?? event.promptId)}` }))
                                 break;
                             current.prompts = current.prompts.filter(p => p !== prompt);
                             delete current.messages[prompt];
@@ -125,5 +204,5 @@ export class FleetNotificationProducer {
             }
     }
     async drain() { await Promise.all([...this.queues.values()].map(q => q.drain())); }
-    async close() { clearInterval(this.timer); await Promise.all([...this.queues.values()].map(q => q.close())); }
+    async close() { clearInterval(this.timer); await this.cleanup; await Promise.all([...this.queues.values()].map(q => q.close())); }
 }

package/dist/notifications/outbox.d.ts

@@ -3,6 +3,7 @@ export interface NotificationInput {
     title: string;
     body: string;
     url: string;
+    taskId?: string | null;
 }
 export interface ProducerConfig {
     /** Service base URL. With a gateway credential it is the server gateway's notifications route. */
@@ -29,6 +30,7 @@ export declare class NotificationOutbox {
     cursor?: number;
     checkpoint?: unknown;
     private running?;
+    private retired;
     private timer;
     constructor(file: string, config: ProducerConfig, project: (value: unknown, id: string) => Promise<NotificationInput>, warn?: (message: string) => void);
     private persist;
@@ -37,6 +39,8 @@ export declare class NotificationOutbox {
     enqueue(id: string, value: unknown, cursor?: number | undefined): boolean;
     drain(): Promise<void>;
     private drainOnce;
+    /** Wait for the current send before clearing queued sends and retiring its target. */
+    retire(): Promise<void>;
     close(): Promise<void>;
 }
 export {};

package/dist/notifications/outbox.js

@@ -66,6 +66,7 @@ export class NotificationOutbox {
     cursor;
     checkpoint;
     running;
+    retired = false;
     timer;
     constructor(file, config, project, warn = () => { }) {
         this.file = file;
@@ -106,6 +107,8 @@ export class NotificationOutbox {
     advance(cursor) { this.persist(this.entries, cursor); }
     saveCheckpoint(checkpoint) { this.persist(this.entries, this.cursor, checkpoint); }
     enqueue(id, value, cursor = this.cursor) {
+        if (this.retired)
+            return false;
         if (this.entries.some(e => e.id === id)) {
             if (cursor !== this.cursor)
                 this.advance(cursor);
@@ -117,10 +120,14 @@ export class NotificationOutbox {
         return true;
     }
     drain() {
+        if (this.retired)
+            return Promise.resolve();
         return this.running ??= this.drainOnce().finally(() => { this.running = undefined; });
     }
     async drainOnce() {
         for (const entry of [...this.entries].slice(0, 32)) {
+            if (this.retired)
+                break;
             try {
                 const value = entry.payload ?? await this.project(entry.value, entry.id);
                 // Freeze the canonical projection before any network attempt. A crash
@@ -145,5 +152,7 @@ export class NotificationOutbox {
             }
         }
     }
+    /** Wait for the current send before clearing queued sends and retiring its target. */
+    async retire() { this.retired = true; clearInterval(this.timer); await this.running; this.persist([]); }
     async close() { clearInterval(this.timer); await this.running; }
 }

package/dist/notifications/target-cleanup.d.ts

@@ -0,0 +1,8 @@
+import { type ProducerConfig } from './outbox.js';
+/** Queue only after the owning lifecycle has established deletion, never on a failed inventory read. */
+export declare function retireNotificationTarget(url: string, config?: ProducerConfig | undefined, dir?: string, request?: typeof fetch): Promise<void>;
+/** Persisted retries also run from the ordinary web notification producer after restart. */
+export declare function drainNotificationTargetCleanup(config: ProducerConfig, dir?: string, request?: typeof fetch, options?: {
+    retain?: boolean;
+    beforeDelete?: (url: string) => Promise<boolean>;
+}): Promise<void>;

package/dist/notifications/target-cleanup.js

@@ -0,0 +1,41 @@
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically } from '../atomic-file.js';
+import { stateRoot } from '../paths.js';
+import { producerConfig } from './outbox.js';
+const cleanupDir = () => join(stateRoot(), 'notifications', 'removed-targets');
+/** Queue only after the owning lifecycle has established deletion, never on a failed inventory read. */
+export async function retireNotificationTarget(url, config = producerConfig(), dir = cleanupDir(), request = fetch) {
+    if (!config)
+        return;
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    replaceFileAtomically(join(dir, createHash('sha256').update(url).digest('hex') + '.json'), JSON.stringify({ url }) + '\n', 0o600);
+    await drainNotificationTargetCleanup(config, dir, request, { retain: true });
+}
+/** Persisted retries also run from the ordinary web notification producer after restart. */
+export async function drainNotificationTargetCleanup(config, dir = cleanupDir(), request = fetch, options = {}) {
+    if (!existsSync(dir))
+        return;
+    for (const file of readdirSync(dir).filter(file => /^[a-f0-9]{64}\.json$/.test(file)).slice(0, 32)) {
+        try {
+            const path = join(dir, file), value = JSON.parse(readFileSync(path, 'utf8'));
+            if (typeof value.url !== 'string' || !value.url.startsWith('/fleet/chats?'))
+                continue;
+            if (options.beforeDelete && !(await options.beforeDelete(value.url))) {
+                rmSync(path, { force: true });
+                continue;
+            }
+            const response = await request(config.origin + '/api/v1/delete-target', { method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10000),
+                headers: { ...(config.gatewayCredential ? { 'X-Ours-Api-Token': config.gatewayCredential, 'X-Ours-Notifications-Producer': config.token } : { Authorization: `Bearer ${config.token}` }), 'Content-Type': 'application/json' }, body: JSON.stringify(value) });
+            await response.body?.cancel();
+            if (!response.ok)
+                break;
+            if (!options.retain)
+                rmSync(path, { force: true });
+        }
+        catch {
+            break; /* No credentials or response bodies are included in logs. */
+        }
+    }
+}

package/dist/ops.js

@@ -1,3 +1,4 @@
+import { retireNotificationTarget } from './notifications/target-cleanup.js';
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, unlinkSync, } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID, createHash } from 'node:crypto';
@@ -5,6 +6,7 @@ import { agentDir, watchdogsRoot } from './paths.js';
 import { findRole } from './config.js';
 import { getAdapter } from './harness/registry.js';
 import { generateBriefing } from './briefing.js';
+import { managedCliBriefing } from './managed-cli.js';
 import { resetRestartLedger } from './runner.js';
 import { archiveTempState, stopTempSupervisor, tempSupervisorLiveness, } from './temp-lifecycle.js';
 import { realExec } from './exec.js';
@@ -28,7 +30,7 @@ export function applyRole(role, opts = {}) {
     // brought up from so the supervised process can reload the SAME file instead of
     // silently falling back to the default ~/fleet.yaml. Temp roles snapshot their
     // whole resolved role into role.yaml instead and don't need this.
-    if (!opts.temp)
+    if (!opts.temp || opts.configPath)
         writeFileSync(join(dir, '.config-path'), (opts.configPath ?? '') + '\n');
     writeFileSync(join(dir, '.identity'), role.identity + '\n');
     if (role.cwd)
@@ -43,6 +45,7 @@ export function applyRole(role, opts = {}) {
         routinesPath: join(dir, 'ROUTINES.md'), briefingBody,
         identityGuarantee: opts.identityGuarantee,
         temporaryIdentity: opts.temp === true,
+        managedCli: managedCliBriefing(role, opts.configPath, opts.temp === true),
     }));
     if (opts.fresh)
         for (const f of ['.booted', '.session-id', '.exit-status'])
@@ -255,6 +258,7 @@ export async function rmRole(cfg, name, deps) {
     rmSync(agentDir(name), { recursive: true, force: true });
     if (generatedSource && existsSync(role.sourceFile)) {
         unlinkSync(role.sourceFile);
+        await retireNotificationTarget(`/fleet/chats?chat=${encodeURIComponent(name)}`).catch(() => { });
         deps.log(`removed ${role.sourceFile}`);
     }
     deps.log(`removed '${name}' (its ours identity is left intact)`);

package/dist/resolved-plan.js

@@ -103,6 +103,7 @@ export function resolvedRolePlan(role, manifestDir = dirname(role.sourceFile)) {
         isolation: role.isolation ?? null,
         worklog: role.worklog ?? null,
         authProxy: role.auth_proxy ?? null,
+        managedCli: role.managed_cli ?? [],
         oversee: role.oversee ?? [],
         harnessOptions: redactSensitive(role.harness_options ?? null),
         env: {

package/dist/runner.js

@@ -2,6 +2,7 @@ import { createLayoutControl } from './rooms-tasks/layout-control.js';
 import { TemporaryChatIdle } from './temp-idle.js';
 import { prepareManagedAgent, releaseManagedAgent } from './agent-ours/service.js';
 import { prepareManagedHarness } from './agent-ours/harness.js';
+import { prepareManagedCliLaunch } from './managed-cli.js';
 import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, realpathSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -522,7 +523,14 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     writeFileSync(bootedFile, `${new Date(deps.now()).toISOString()} ${mode}\n`);
     const runCwd = role.cwd && existsSync(role.cwd) ? role.cwd : dir;
     role = { ...role, monitor: { ...role.monitor, mode: 'fleet' } };
-    const prep = await adapter.prepareSession(role, { stateDir: dir, runCwd });
+    // Native policy for Fleet commands run from the harness command sandbox. This
+    // is the same step for configured, spawned and task-room agents alike.
+    const prep = prepareManagedCliLaunch(role, {
+        // A temporary agent has no config path threaded through its detached
+        // supervisor; spawn records the one it was created from beside its snapshot.
+        stateDir: dir, runCwd, configPath: configPath ?? resolveConfigPath(dir), temp,
+        prep: await adapter.prepareSession(role, { stateDir: dir, runCwd }), log: deps.log,
+    });
     const sessionBackend = role.session ?? 'acp';
     const sessionLabel = sessionBackend === 'acp' ? 'ACP' : 'Codex app-server';
     let launch = adapter.agentSession.prepareLaunch(role, prep);

package/dist/spawn.js

@@ -358,7 +358,7 @@ async function spawnTempInner(o, preparedRole, binPath, launch, tx, onStage) {
     if (role.roomMemberStartup)
         role.roomMemberStartup = { ...role.roomMemberStartup, invite: '' };
     onStage?.('writing_role');
-    const dir = applyRole(role, { temp: true, identityGuarantee: 'unverified' });
+    const dir = applyRole(role, { temp: true, identityGuarantee: 'unverified', configPath: o.configPath });
     const provenance = buildProvenance({
         role: o.name, lifetime: 'temporary', fleetVersion: VERSION,
         settings: provenanceSettings(o, cfg.defaults, preparedRole.temporaryLoops),

package/dist/tunnel-setup-input.d.ts

@@ -6,3 +6,14 @@ export declare function readTunnelSetupStdin(input?: AsyncIterable<Buffer | stri
 export declare function readTunnelSetupArgument(input: string): string;
 /** Redeem the grant by HTTPS POST; long-lived connector credentials remain off argv and URLs. */
 export declare function redeemTunnelSetup(input: string, request?: typeof fetch): Promise<WorkspacePayload>;
+/** Inspect only public destination metadata; this never consumes a one-use grant. */
+export declare function inspectTunnelSetup(input: string, request?: typeof fetch): Promise<{
+    workspaceId: string;
+    serverCid: string;
+    appOrigin: string;
+} | undefined>;
+export declare function verifyTunnelSetupTarget(target: {
+    workspaceId: string;
+    serverCid: string;
+    appOrigin: string;
+} | undefined, payload: WorkspacePayload): void;

package/dist/tunnel-setup-input.js

@@ -80,3 +80,45 @@ export async function redeemTunnelSetup(input, request = fetch) {
         throw Error('Tunnel setup response origin mismatch');
     return payload;
 }
+/** Inspect only public destination metadata; this never consumes a one-use grant. */
+export async function inspectTunnelSetup(input, request = fetch) {
+    let version;
+    try {
+        version = JSON.parse(Buffer.from(input.trim(), 'base64url').toString()).version;
+    }
+    catch { }
+    if (version === 1) {
+        const p = decodeWorkspacePayload(input);
+        return { workspaceId: p.challenge.workspaceId, serverCid: p.serverCid, appOrigin: p.appOrigin };
+    }
+    const grant = decodeTunnelSetupGrant(input);
+    let response;
+    try {
+        response = await request(grant.appOrigin + '/account-api/workspace-install-inspect', { method: 'POST', redirect: 'error', credentials: 'omit', signal: AbortSignal.timeout(15000), headers: { Origin: grant.appOrigin, 'Content-Type': 'application/json' }, body: JSON.stringify({ code: grant.code }) });
+    }
+    catch {
+        throw Error('Could not inspect the account setup command; existing setup and grant preserved');
+    }
+    if (response.status === 404 || response.status === 405) {
+        await response.body?.cancel();
+        return;
+    }
+    if (!response.ok) {
+        await response.body?.cancel();
+        throw Error('Setup command inspection failed; existing setup and grant preserved');
+    }
+    let target;
+    try {
+        target = await response.json();
+    }
+    catch {
+        throw Error('Invalid setup command inspection response');
+    }
+    if (!target || Object.keys(target).sort().join(',') !== 'serverCid,workspaceId' || typeof target.workspaceId !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(target.workspaceId) || typeof target.serverCid !== 'string' || !/^[a-f0-9]{64}$/i.test(target.serverCid))
+        throw Error('Invalid setup command inspection response');
+    return { ...target, appOrigin: grant.appOrigin };
+}
+export function verifyTunnelSetupTarget(target, payload) {
+    if (target && (target.workspaceId !== payload.challenge.workspaceId || target.serverCid.toUpperCase() !== payload.serverCid.toUpperCase() || target.appOrigin !== payload.appOrigin))
+        throw Error('Redeemed setup command differs from inspected destination; existing setup preserved');
+}

package/dist/web/workspace-devices.d.ts

@@ -25,5 +25,7 @@ export declare class WorkspaceDeviceStore {
     valid(id: string): boolean;
     list(): WorkspaceDevice[];
     revoke(id: string): void;
+    /** Retire account links without changing the installation's stable host ID or other data. */
+    revokeAll(): void;
     close(): void;
 }

package/dist/web/workspace-devices.js

@@ -80,5 +80,18 @@ export class WorkspaceDeviceStore {
     valid(id) { return Boolean(this.db.prepare('SELECT id FROM devices WHERE id=? AND revokedAt IS NULL AND expiresAt>?').get(id, this.now())); }
     list() { return this.db.prepare('SELECT id,label,createdAt,lastUsedAt,expiresAt,revokedAt FROM devices ORDER BY createdAt DESC LIMIT 256').all().map(row => ({ id: String(row.id), label: String(row.label), createdAt: Number(row.createdAt), lastUsedAt: Number(row.lastUsedAt), expiresAt: Number(row.expiresAt), revokedAt: row.revokedAt === null ? null : Number(row.revokedAt) })); }
     revoke(id) { this.db.prepare('UPDATE devices SET revokedAt=? WHERE id=? AND revokedAt IS NULL').run(this.now(), id); this.db.prepare('DELETE FROM enrollments WHERE issuer=?').run(id); }
+    /** Retire account links without changing the installation's stable host ID or other data. */
+    revokeAll() {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            this.db.prepare('UPDATE devices SET revokedAt=? WHERE revokedAt IS NULL').run(this.now());
+            this.db.exec('DELETE FROM enrollments');
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
     close() { this.db.close(); }
 }

package/dist/workspace-enrollment.d.ts

@@ -6,7 +6,7 @@ export interface WorkspacePayload {
     rootName: string;
     name: string;
     surname: string;
-    connectorToken: string;
+    connectorToken?: string;
     invitation: string;
     serverCid: string;
     challenge: {
@@ -17,7 +17,11 @@ export interface WorkspacePayload {
     };
 }
 export declare function readWorkspacePayload(file: string): WorkspacePayload;
-export declare function decodeWorkspacePayload(input: string): WorkspacePayload;
+export declare function decodeWorkspacePayload(input: string, options?: {
+    allowExpired?: boolean;
+}): WorkspacePayload;
+/** Credential-free renewal is allowed only on the host already holding this private connector. */
+export declare function checkWorkspaceConnector(payload: WorkspacePayload): void;
 type DaemonClient = Pick<OursClient, 'listIdentities' | 'chooseIdentity' | 'addContact' | 'listContacts' | 'sendCommand' | 'removeContact' | 'releaseLease' | 'close'>;
 /** How tunnel setup reaches this host's daemon; replaced only by tests. */
 export type AttachDaemonClient = (options: AttachOursClientOptions) => Promise<DaemonClient>;
@@ -29,6 +33,7 @@ export declare function checkWorkspaceConfiguration(configuration?: string, atta
 export declare function enrollWorkspace(payload: WorkspacePayload, configuration?: string, options?: {
     migrateAppOrigin?: boolean;
     preserveProfile?: boolean;
+    replacingWorkspace?: string;
     attach?: AttachDaemonClient;
     contactWaitMs?: number;
     afterInvitation?: () => void;
@@ -51,4 +56,27 @@ export declare function configureWorkspacePort(payload: Pick<WorkspacePayload, '
  * so the setup can be finished later. A removal that fails is reported and does not undo the setup.
  */
 export declare function confirmWorkspaceTarget(payload: Pick<WorkspacePayload, 'appOrigin' | 'challenge'>, hostWorkspaceId: string, rootCid: string, port: number, cleanupFailed?: (error: unknown) => void): Promise<void>;
+/** Retire exactly the original registration using the same signed Human root that bound it. */
+export declare function unregisterWorkspace(previous: {
+    workspaceId: string;
+    hostWorkspaceId: string;
+    appOrigin: string;
+    serverCid: string;
+    proofRootCid?: string;
+}, payload: WorkspacePayload, operationNonce: string, attach?: AttachDaemonClient, options?: {
+    request?: typeof fetch;
+    waitMs?: number;
+    checkOnly?: boolean;
+    beforeSend?: () => void;
+    operationExpiresAt?: number;
+    onReceipt?: (status: {
+        deleted?: boolean;
+        retired?: boolean;
+        absent?: boolean;
+        rejected?: boolean;
+        expired?: boolean;
+        deadlineEnforced?: boolean;
+        oldBindingPresent?: boolean;
+    }) => void;
+}): Promise<string>;
 export {};