@ours.network/fleet 1.2.0-nightly.5 → 1.2.0-nightly.51

package/dist/subscriptions/service.js

@@ -0,0 +1,364 @@
+import { existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { FleetError } from '../application/errors.js';
+import { replaceFileAtomically } from '../atomic-file.js';
+import { claudeAuthStatus, claudeLoginExpiry, codexUsageWindows, defaultBinaries, profileEnv, withCodex, } from './cli.js';
+import { HOME_ENV } from './launch.js';
+import { ClaudeLogin, CodexDeviceLogin } from './login.js';
+import { recordClaudeRateLimit } from './observed.js';
+import { probeClaudeRateLimit } from './probe.js';
+import { DEFAULT_PROFILE_ID, OBSERVED_USAGE_FILE, SUBSCRIPTION_PROVIDERS, createProfileHome, profileHome, readPin, readSubscriptionState, removeProfileHome, subscriptionsRoot, updateSubscriptionState, } from './store.js';
+const EXPIRING_MS = 3 * 24 * 3600_000;
+const STALE_CHECK_MS = 10 * 60_000;
+export class SubscriptionService {
+    options;
+    bins;
+    now;
+    checks = new Map();
+    running = new Map();
+    logins = new Map();
+    probes = new Map();
+    constructor(options) {
+        this.options = options;
+        this.bins = options.binaries ?? defaultBinaries();
+        this.now = options.now ?? Date.now;
+    }
+    async list() {
+        const state = readSubscriptionState();
+        const pins = await this.pins();
+        return SUBSCRIPTION_PROVIDERS.map(provider => {
+            const p = state.providers[provider];
+            const profiles = p.profiles.map(profile => {
+                const key = `${provider}/${profile.id}`;
+                const cached = this.checks.get(key);
+                if (!cached || this.now() - Date.parse(cached.health.checkedAt ?? '0') > STALE_CHECK_MS)
+                    void this.check(provider, profile.id).catch(() => { });
+                const observed = provider === 'claude' ? this.observedUsage(pins, profile.id) : undefined;
+                const probed = provider === 'claude' ? this.probedUsage(profile.id) : undefined;
+                const usage = observed && probed
+                    ? (observed.observedAt ?? '') >= (probed.observedAt ?? '') ? observed : probed
+                    : observed ?? probed;
+                return {
+                    id: profile.id, label: profile.label, active: profile.id === p.activeProfileId,
+                    account: cached?.account,
+                    health: cached?.health ?? { state: 'unknown' },
+                    usage: usage ?? cached?.usage ?? { windows: [], source: 'none' },
+                    agents: pins.filter(x => x.running && x.provider === provider && x.profileId === profile.id).map(x => x.roleId),
+                };
+            });
+            return {
+                provider, activeProfileId: p.activeProfileId, profiles,
+                staleAgents: pins.filter(x => x.running && x.provider === provider && x.profileId !== p.activeProfileId)
+                    .map(x => ({ roleId: x.roleId, profileId: x.profileId })),
+                unmanagedAgents: pins.filter(x => x.running && x.provider === provider && x.unmanaged?.length)
+                    .map(x => ({ roleId: x.roleId, via: x.unmanaged })),
+            };
+        });
+    }
+    /** Health + account + (Codex) usage for one profile. Concurrent calls share one run. */
+    check(provider, profileId) {
+        this.profile(provider, profileId);
+        const key = `${provider}/${profileId}`;
+        const inflight = this.running.get(key);
+        if (inflight)
+            return inflight;
+        const run = (provider === 'claude' ? this.checkClaude(profileId) : this.checkCodex(profileId))
+            .catch((error) => ({
+            health: { state: 'error', checkedAt: new Date(this.now()).toISOString(), detail: error?.message?.includes('prerequisite') ? 'subscription state unreadable' : 'health check failed' },
+        }))
+            .then(result => { this.checks.set(key, result); this.options.onChange?.(); return result; })
+            .finally(() => this.running.delete(key));
+        this.running.set(key, run);
+        return run;
+    }
+    async checkClaude(profileId) {
+        const home = profileHome('claude', profileId);
+        const status = await claudeAuthStatus(this.bins.claude, profileEnv(HOME_ENV.claude, profileId, home));
+        const checkedAt = new Date(this.now()).toISOString();
+        const { refreshExpiresAt } = claudeLoginExpiry(home);
+        const loginExpiresAt = refreshExpiresAt ? new Date(refreshExpiresAt).toISOString() : undefined;
+        let state = status.loggedIn ? 'ok' : 'signed_out';
+        // The CLI reports the credential it would actually use (env, settings, helper…).
+        if (status.loggedIn && status.authMethod && status.authMethod !== 'claude.ai') {
+            return {
+                health: { state: 'error', checkedAt, detail: `not using a Claude subscription login (${status.authMethod.slice(0, 40)})` },
+                account: { email: status.email, plan: status.authMethod, org: status.org },
+            };
+        }
+        if (status.loggedIn && refreshExpiresAt !== undefined) {
+            if (refreshExpiresAt <= this.now())
+                state = 'expired';
+            else if (refreshExpiresAt - this.now() < EXPIRING_MS)
+                state = 'expiring';
+        }
+        return {
+            health: { state, checkedAt, loginExpiresAt },
+            account: status.loggedIn ? { email: status.email, plan: status.plan, org: status.org } : undefined,
+        };
+    }
+    async checkCodex(profileId) {
+        const home = profileHome('codex', profileId);
+        return withCodex(this.bins.codex, profileEnv(HOME_ENV.codex, profileId, home), async (server) => {
+            const checkedAt = new Date(this.now()).toISOString();
+            // refreshToken:false — a health check must not rotate a token agents use.
+            const read = await server.call('account/read', { refreshToken: false });
+            if (!read.account)
+                return { health: { state: 'signed_out', checkedAt } };
+            if (read.account.type !== 'chatgpt') {
+                return {
+                    health: { state: 'error', checkedAt, detail: 'not a ChatGPT subscription login' },
+                    account: { plan: read.account.type === 'apiKey' ? 'API key' : read.account.type },
+                };
+            }
+            const account = { email: read.account.email ?? undefined, plan: read.account.planType ?? 'chatgpt' };
+            try {
+                const limits = await server.call('account/rateLimits/read', {});
+                return {
+                    health: { state: 'ok', checkedAt }, account,
+                    usage: { windows: codexUsageWindows(limits), observedAt: checkedAt, source: 'pull' },
+                };
+            }
+            catch (error) {
+                const expired = /401|unauthori[sz]ed|expired|sign in again|log in again/i.test(String(error.message));
+                return { health: { state: expired ? 'expired' : 'error', checkedAt, detail: expired ? 'login expired: sign in again' : 'usage limits unavailable' }, account };
+            }
+        });
+    }
+    async startLogin(provider, owner) {
+        for (const [id, login] of this.logins) {
+            const view = login.view();
+            if (view.provider !== provider)
+                continue;
+            if (view.state === 'starting' || view.state === 'awaiting_user' || view.state === 'verifying')
+                login.cancel();
+            this.logins.delete(id);
+        }
+        const { id: profileId, home } = createProfileHome(provider);
+        const login = provider === 'claude'
+            ? new ClaudeLogin(owner, this.bins, home, profileId)
+            : new CodexDeviceLogin(owner, this.bins, home, profileId);
+        const loginId = login.view().loginId;
+        this.logins.set(loginId, login);
+        void this.completeLogin(provider, profileId, login);
+        // Give the CLI a moment to print its URL so the first response is useful.
+        const deadline = this.now() + 8_000;
+        while (login.view().state === 'starting' && this.now() < deadline)
+            await new Promise(resolve => setTimeout(resolve, 100));
+        return login.view();
+    }
+    async completeLogin(provider, profileId, login) {
+        let label;
+        let email;
+        let error = 'sign-in did not complete';
+        try {
+            if (login instanceof ClaudeLogin) {
+                const code = await login.exited;
+                if (code === 0 && login.view().state === 'verifying') {
+                    const status = await claudeAuthStatus(this.bins.claude, profileEnv(HOME_ENV.claude, profileId, profileHome('claude', profileId)));
+                    if (status.loggedIn) {
+                        email = status.email;
+                        label = status.email ?? 'Claude account';
+                    }
+                }
+                else if (login.view().state === 'verifying')
+                    error = 'the sign-in code was not accepted';
+            }
+            else if (await login.completed) {
+                const result = await this.checkCodex(profileId);
+                // Only a verified ChatGPT subscription login becomes a profile.
+                if (result.health.state === 'ok') {
+                    email = result.account?.email;
+                    label = email ?? 'Codex account';
+                    this.checks.set(`${provider}/${profileId}`, result);
+                }
+            }
+            if (label !== undefined) {
+                if (!email?.trim()) {
+                    label = undefined;
+                    error = 'the CLI did not provide an account email';
+                }
+                else if (await this.accountAlreadyAdded(provider, email)) {
+                    label = undefined;
+                    error = 'this account is already added';
+                }
+            }
+        }
+        catch {
+            label = undefined;
+            error = 'sign-in could not be verified';
+        }
+        let registered = false;
+        if (label !== undefined) {
+            try {
+                // Registration and the login's terminal state change together inside the
+                // lock callback (synchronous), so a cancel or timeout that ran during the
+                // verification awaits wins and nothing is registered.
+                await updateSubscriptionState(state => {
+                    if (login.view().state !== 'verifying' || !existsSync(profileHome(provider, profileId)))
+                        return;
+                    state.providers[provider].profiles.push({ id: profileId, label: label.slice(0, 80), createdAt: new Date(this.now()).toISOString() });
+                    login.complete(true);
+                    registered = true;
+                });
+            }
+            catch {
+                error = 'sign-in could not be saved';
+            }
+        }
+        if (!registered) {
+            login.complete(false, error);
+            removeProfileHome(provider, profileId);
+            this.checks.delete(`${provider}/${profileId}`);
+        }
+        this.options.onChange?.();
+    }
+    /** Query the official CLI for each existing profile, including the adopted default. */
+    async accountAlreadyAdded(provider, email) {
+        const wanted = email.trim().toLowerCase();
+        for (const profile of readSubscriptionState().providers[provider].profiles) {
+            const home = profileHome(provider, profile.id);
+            let existing;
+            if (provider === 'claude') {
+                const status = await claudeAuthStatus(this.bins.claude, profileEnv(HOME_ENV.claude, profile.id, home));
+                if (status.loggedIn)
+                    existing = status.email;
+            }
+            else {
+                existing = await withCodex(this.bins.codex, profileEnv(HOME_ENV.codex, profile.id, home), async (server) => {
+                    const read = await server.call('account/read', { refreshToken: false });
+                    return read.account?.type === 'chatgpt' ? read.account.email ?? undefined : undefined;
+                });
+            }
+            if (existing?.trim().toLowerCase() === wanted)
+                return true;
+        }
+        return false;
+    }
+    login(loginId, owner) {
+        const login = this.logins.get(loginId);
+        // Unknown and foreign logins look the same: no probing of other sessions' logins.
+        if (!login || login.owner !== owner)
+            throw new FleetError('resource_not_found', 'login not found');
+        return login;
+    }
+    async setActive(provider, profileId) {
+        this.profile(provider, profileId);
+        await updateSubscriptionState(state => {
+            if (!state.providers[provider].profiles.some(p => p.id === profileId))
+                throw new FleetError('resource_not_found', 'profile not found');
+            state.providers[provider].activeProfileId = profileId;
+        });
+        this.options.onChange?.();
+        return (await this.list()).find(p => p.provider === provider);
+    }
+    async rename(provider, profileId, label) {
+        const clean = label.replace(/[\u0000-\u001f\u007f]/g, '').trim().slice(0, 80);
+        if (!clean)
+            throw new FleetError('invalid_request', 'label is required');
+        await updateSubscriptionState(state => {
+            const profile = state.providers[provider].profiles.find(p => p.id === profileId);
+            if (!profile)
+                throw new FleetError('resource_not_found', 'profile not found');
+            profile.label = clean;
+        });
+        this.options.onChange?.();
+    }
+    /**
+     * Remove a profile and its login. Refused while it is active or while any
+     * running agent is still pinned to it; the adopted default is never removed.
+     */
+    async remove(provider, profileId) {
+        if (profileId === DEFAULT_PROFILE_ID)
+            throw new FleetError('conflict', 'the default profile is your existing CLI login and cannot be removed here');
+        const pinned = (await this.pins()).filter(x => x.running && x.provider === provider && x.profileId === profileId);
+        if (pinned.length)
+            throw new FleetError('conflict', `profile is in use by running agents: ${pinned.map(x => x.roleId).join(', ')}; restart or stop them first`);
+        await updateSubscriptionState(state => {
+            const p = state.providers[provider];
+            if (!p.profiles.some(x => x.id === profileId))
+                throw new FleetError('resource_not_found', 'profile not found');
+            if (p.activeProfileId === profileId)
+                throw new FleetError('conflict', 'switch to another profile before removing the active one');
+            p.profiles = p.profiles.filter(x => x.id !== profileId);
+        });
+        removeProfileHome(provider, profileId);
+        if (provider === 'claude')
+            rmSync(this.probeUsageDir(profileId), { recursive: true, force: true });
+        this.checks.delete(`${provider}/${profileId}`);
+        this.options.onChange?.();
+    }
+    profile(provider, profileId) {
+        if (!readSubscriptionState().providers[provider].profiles.some(p => p.id === profileId))
+            throw new FleetError('resource_not_found', 'profile not found');
+    }
+    /** An explicit, bounded Haiku request can refresh Claude usage for an idle profile. */
+    probeClaudeUsage(profileId) {
+        this.profile('claude', profileId);
+        const inFlight = this.probes.get(profileId);
+        if (inFlight)
+            return inFlight;
+        const run = (async () => {
+            const dir = this.probeUsageDir(profileId);
+            const result = await probeClaudeRateLimit(this.bins.claude, profileId);
+            if (result) {
+                mkdirSync(dir, { recursive: true, mode: 0o700 });
+                const observedAt = new Date(this.now()).toISOString();
+                const windows = result.rateLimit && recordClaudeRateLimit(dir, result.rateLimit, new Date(this.now()))
+                    ? readObservedClaudeUsage(dir, this.now())?.windows ?? [] : [];
+                if (windows.length || result.exhausted) {
+                    const usage = { windows, observedAt, source: 'probe', ...(result.exhausted ? { exhausted: true } : {}) };
+                    replaceFileAtomically(join(dir, OBSERVED_USAGE_FILE), `${JSON.stringify(usage)}\n`, 0o600);
+                    this.options.onChange?.();
+                    return usage;
+                }
+            }
+            rmSync(join(dir, OBSERVED_USAGE_FILE), { force: true });
+            this.options.onChange?.();
+            return { windows: [], source: 'none' };
+        })().catch(() => ({ windows: [], source: 'none' }))
+            .finally(() => this.probes.delete(profileId));
+        this.probes.set(profileId, run);
+        return run;
+    }
+    probeUsageDir(profileId) {
+        return join(subscriptionsRoot(), 'observed', 'claude', profileId);
+    }
+    probedUsage(profileId) {
+        const usage = readObservedClaudeUsage(this.probeUsageDir(profileId), this.now());
+        return usage && (usage.windows.length || usage.exhausted) ? { ...usage, source: 'probe' } : undefined;
+    }
+    async pins() {
+        const result = [];
+        for (const agent of await this.options.agents()) {
+            if (!agent.stateDir)
+                continue;
+            const pin = readPin(agent.stateDir);
+            if (pin)
+                result.push({ roleId: agent.roleId, stateDir: agent.stateDir, running: agent.running, provider: pin.provider, profileId: pin.profileId, unmanaged: pin.unmanaged });
+        }
+        return result;
+    }
+    /** Latest Claude rate-limit snapshot any agent on this profile reported. */
+    observedUsage(pins, profileId) {
+        let best;
+        for (const pin of pins) {
+            if (pin.provider !== 'claude' || pin.profileId !== profileId)
+                continue;
+            const observed = readObservedClaudeUsage(pin.stateDir);
+            if (observed && (!best || (observed.observedAt ?? '') > (best.observedAt ?? '')))
+                best = observed;
+        }
+        return best;
+    }
+}
+/** Read what `recordClaudeRateLimit` stored, dropping windows that already reset. */
+export function readObservedClaudeUsage(stateDir, now = Date.now()) {
+    try {
+        const raw = JSON.parse(readFileSync(join(stateDir, OBSERVED_USAGE_FILE), 'utf8'));
+        const windows = (raw.windows ?? []).filter(w => !w.resetsAt || Date.parse(w.resetsAt) > now);
+        return { windows, observedAt: raw.observedAt, source: 'agent', ...(raw.exhausted === true ? { exhausted: true } : {}) };
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/subscriptions/store.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Fleet-wide Claude Code / Codex subscription profiles.
+ *
+ * A profile is one CLI home directory holding one account's login. Fleet never
+ * reads or returns token values; the official CLIs own the credential files.
+ * The `default` profile adopts the operator's existing `~/.claude` / `~/.codex`
+ * in place, so a fleet that never adds a profile launches exactly as before.
+ * Exactly one profile per provider is active; switching only affects agents
+ * launched afterwards (running sessions stay pinned until restarted).
+ */
+export type SubscriptionProvider = 'claude' | 'codex';
+export declare const SUBSCRIPTION_PROVIDERS: SubscriptionProvider[];
+export declare const DEFAULT_PROFILE_ID = "default";
+export interface SubscriptionProfile {
+    id: string;
+    label: string;
+    createdAt: string;
+}
+export interface ProviderState {
+    activeProfileId: string;
+    profiles: SubscriptionProfile[];
+}
+export interface SubscriptionState {
+    version: 1;
+    providers: Record<SubscriptionProvider, ProviderState>;
+}
+/** Recorded in an agent's state dir at launch: which profile the session uses. */
+export interface SubscriptionPin {
+    provider: SubscriptionProvider;
+    profileId: string;
+    /** Explicit CLI home, absent for the adopted default (the CLI's own default). */
+    home?: string;
+    /**
+     * Default profile only: credential env (role or supervisor) that makes this
+     * session authenticate outside Fleet's profiles. Reported, not managed.
+     */
+    unmanaged?: string[];
+    pinnedAt: string;
+}
+export declare const PIN_FILE = ".subscription-pin.json";
+export declare const OBSERVED_USAGE_FILE = ".subscription-usage.json";
+export declare const PROFILE_ID_RE: RegExp;
+export declare const subscriptionsRoot: () => string;
+/**
+ * The CLI's own default home, adopted as the `default` profile. This follows
+ * `$HOME` like the CLIs do, not OURS_FLEET_HOME (which may relocate Fleet state).
+ */
+export declare const baseHome: (provider: SubscriptionProvider) => string;
+export declare function isProvider(value: unknown): value is SubscriptionProvider;
+export declare function profileHome(provider: SubscriptionProvider, profileId: string): string;
+/**
+ * Read the state. The file is only ever replaced by an atomic rename, so a
+ * reader (including a launching agent) sees either the old or the new active
+ * profile, never a torn write.
+ */
+export declare function readSubscriptionState(): SubscriptionState;
+/** Serialised read-modify-write of the state under a cross-process lock. */
+export declare function updateSubscriptionState<T>(fn: (state: SubscriptionState) => T): Promise<T>;
+/**
+ * Create an empty profile home (not yet registered). Shared, non-history
+ * configuration is symlinked from the base home; credentials and session
+ * history stay per profile.
+ */
+export declare function createProfileHome(provider: SubscriptionProvider): {
+    id: string;
+    home: string;
+};
+/** Remove a non-default profile home. Never touches the adopted default. */
+export declare function removeProfileHome(provider: SubscriptionProvider, profileId: string): void;
+export declare function readPin(stateDir: string, provider?: SubscriptionProvider): SubscriptionPin | undefined;
+export declare function writePin(stateDir: string, pin: SubscriptionPin): void;

package/dist/subscriptions/store.js

@@ -0,0 +1,140 @@
+import { existsSync, mkdirSync, readFileSync, rmSync, symlinkSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { join } from 'node:path';
+import { replaceFileAtomically, withFileLock } from '../atomic-file.js';
+import { FleetError } from '../application/errors.js';
+import { homedir } from 'node:os';
+import { stateRoot } from '../paths.js';
+export const SUBSCRIPTION_PROVIDERS = ['claude', 'codex'];
+export const DEFAULT_PROFILE_ID = 'default';
+export const PIN_FILE = '.subscription-pin.json';
+export const OBSERVED_USAGE_FILE = '.subscription-usage.json';
+/** Non-history configuration shared from the base home into each new profile. */
+const SHARED_CONFIG = {
+    claude: ['settings.json', 'CLAUDE.md', 'plugins', 'skills', 'agents', 'commands'],
+    codex: ['config.toml', 'AGENTS.md', 'plugins', 'skills', 'rules'],
+};
+export const PROFILE_ID_RE = /^[a-z0-9][a-z0-9-]{0,40}$/;
+export const subscriptionsRoot = () => join(stateRoot(), 'subscriptions');
+const stateFile = () => join(subscriptionsRoot(), 'state.json');
+const lockPath = () => join(subscriptionsRoot(), '.lock');
+/**
+ * The CLI's own default home, adopted as the `default` profile. This follows
+ * `$HOME` like the CLIs do, not OURS_FLEET_HOME (which may relocate Fleet state).
+ */
+export const baseHome = (provider) => join(homedir(), provider === 'claude' ? '.claude' : '.codex');
+export function isProvider(value) {
+    return value === 'claude' || value === 'codex';
+}
+export function profileHome(provider, profileId) {
+    if (profileId === DEFAULT_PROFILE_ID)
+        return baseHome(provider);
+    if (!PROFILE_ID_RE.test(profileId))
+        throw new FleetError('invalid_request', 'invalid profile id');
+    return join(subscriptionsRoot(), provider, profileId);
+}
+function initialState() {
+    const provider = () => ({
+        activeProfileId: DEFAULT_PROFILE_ID,
+        profiles: [{ id: DEFAULT_PROFILE_ID, label: 'Default (existing login)', createdAt: new Date(0).toISOString() }],
+    });
+    return { version: 1, providers: { claude: provider(), codex: provider() } };
+}
+/**
+ * Read the state. The file is only ever replaced by an atomic rename, so a
+ * reader (including a launching agent) sees either the old or the new active
+ * profile, never a torn write.
+ */
+export function readSubscriptionState() {
+    let text;
+    try {
+        text = readFileSync(stateFile(), 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return initialState();
+        throw unreadable();
+    }
+    // Fail closed: a damaged state file must not silently move launches to another account.
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        throw unreadable();
+    }
+    const state = initialState();
+    const providers = raw?.providers;
+    if (!providers || typeof providers !== 'object')
+        throw unreadable();
+    for (const provider of SUBSCRIPTION_PROVIDERS) {
+        const p = providers[provider];
+        if (!p || !Array.isArray(p.profiles) || typeof p.activeProfileId !== 'string')
+            throw unreadable();
+        const profiles = p.profiles;
+        if (profiles.some(x => !x || typeof x.id !== 'string' || (x.id !== DEFAULT_PROFILE_ID && !PROFILE_ID_RE.test(x.id))))
+            throw unreadable();
+        if (!profiles.some(x => x.id === DEFAULT_PROFILE_ID))
+            profiles.unshift(state.providers[provider].profiles[0]);
+        if (!profiles.some(x => x.id === p.activeProfileId))
+            throw unreadable();
+        const active = p.activeProfileId;
+        state.providers[provider] = {
+            activeProfileId: active,
+            profiles: profiles.map(x => ({ id: x.id, label: String(x.label ?? x.id).slice(0, 80), createdAt: String(x.createdAt ?? '') })),
+        };
+    }
+    return state;
+}
+const unreadable = () => new FleetError('prerequisite_unavailable', `subscription state ${stateFile()} is unreadable or invalid; fix or remove it before starting agents`);
+/** Serialised read-modify-write of the state under a cross-process lock. */
+export async function updateSubscriptionState(fn) {
+    mkdirSync(subscriptionsRoot(), { recursive: true, mode: 0o700 });
+    return withFileLock(lockPath(), () => {
+        const state = readSubscriptionState();
+        const result = fn(state);
+        replaceFileAtomically(stateFile(), `${JSON.stringify(state, null, 2)}\n`, 0o600);
+        return result;
+    });
+}
+/**
+ * Create an empty profile home (not yet registered). Shared, non-history
+ * configuration is symlinked from the base home; credentials and session
+ * history stay per profile.
+ */
+export function createProfileHome(provider) {
+    const id = `p-${randomBytes(6).toString('hex')}`;
+    const dir = profileHome(provider, id);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const base = baseHome(provider);
+    for (const name of SHARED_CONFIG[provider]) {
+        const src = join(base, name);
+        if (existsSync(src)) {
+            try {
+                symlinkSync(src, join(dir, name));
+            }
+            catch { /* optional convenience */ }
+        }
+    }
+    return { id, home: dir };
+}
+/** Remove a non-default profile home. Never touches the adopted default. */
+export function removeProfileHome(provider, profileId) {
+    if (profileId === DEFAULT_PROFILE_ID)
+        return;
+    rmSync(profileHome(provider, profileId), { recursive: true, force: true });
+}
+export function readPin(stateDir, provider) {
+    try {
+        const pin = JSON.parse(readFileSync(join(stateDir, PIN_FILE), 'utf8'));
+        if (provider)
+            return pin[provider];
+        return Object.values(pin)[0];
+    }
+    catch {
+        return undefined;
+    }
+}
+export function writePin(stateDir, pin) {
+    replaceFileAtomically(join(stateDir, PIN_FILE), `${JSON.stringify({ [pin.provider]: pin })}\n`, 0o600);
+}

package/dist/supervisor/launchd.js

@@ -1,3 +1,4 @@
+import { clientConfigPath } from '../client-profile.js';
 import { existsSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { home, logsRoot } from '../paths.js';
@@ -22,7 +23,7 @@ const xml = (value) => value
     .replaceAll("'", ''');
 function plist(name, binPath) {
     const log = join(logsRoot(), `${name}.log`);
-    const config = process.env.OURS_CONFIG;
+    const config = clientConfigPath(process.env);
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">

package/dist/supervisor/systemd.js

@@ -1,3 +1,4 @@
+import { clientConfigPath } from '../client-profile.js';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { delimiter, dirname, join } from 'node:path';
 import { userInfo } from 'node:os';
@@ -69,30 +70,10 @@ export function makeSystemdBackend(exec = realExec) {
                     dirname(process.execPath),
                     ...(process.env.PATH ?? '').split(delimiter),
                 ].filter(Boolean))].join(delimiter);
-            // Same reason as PATH, for the other thing a lingering unit cannot inherit:
-            // WHICH ours daemon this fleet was set up against.
-            //
-            // ours-fleet resolves its daemon from OURS_CONFIG / OURS_PORT / OURS_STATE_DIR
-            // and otherwise falls back to ~/.ours and port 3050 (src/monitor.ts). A host
-            // set up against a non-default daemon — the installer's multi-daemon profiles
-            // do exactly this — passes that selection to `ours-fleet init` in the
-            // environment, and it died there: nothing persisted it, so every runner
-            // systemd started at boot resolved the default daemon again, and on a host
-            // where only the non-default daemon exists that is a daemon that is not there.
-            //
-            // ONLY OURS_CONFIG is baked, deliberately. It names which daemon, and leaves
-            // that daemon's own config file authoritative for port and state directory, so
-            // a later edit to it still wins. Baking OURS_PORT/OURS_STATE_DIR would freeze
-            // those into a unit file that outranks the config for ever after — the failure
-            // mode @ours.network/cli avoids for the same reason (packages/cli/src/
-            // service.ts: "The port is deliberately NOT baked").
-            //
-            // Absent from init's environment ⇒ no line, and the unit is byte-for-byte what
-            // it has always been. This teaches fleet nothing about installer profiles; it
-            // persists the selection fleet was initialised with.
+            // Persist one profile path, never a URL or service port. Profile updates
+            // are picked up by every fresh process, including lingering user services.
             const unitEnv = ['PATH=' + servicePath];
-            if (process.env.OURS_CONFIG)
-                unitEnv.push('OURS_CONFIG=' + process.env.OURS_CONFIG);
+            unitEnv.push('OURS_CONFIG=' + clientConfigPath(process.env));
             const environmentLines = unitEnv
                 .map(value => `Environment="${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/%/g, '%%')}"`)
                 .join('\n');
@@ -100,10 +81,15 @@ export function makeSystemdBackend(exec = realExec) {
             writeFileSync(join(unitDir, UNIT_TEMPLATE), `[Unit]
 Description=ours-fleet agent %i
 After=default.target
+StartLimitIntervalSec=0
 
 [Service]
 Type=simple
 ${environmentLines}
+# Wait outside the runner so boot-time daemon unavailability cannot consume
+# the agent crash budget. Selection comes from the same role and profile.
+ExecStartPre=${unitArg(process.execPath)} ${unitArg(binPath)} _wait-daemon %i
+TimeoutStartSec=270
 ExecStart=${unitArg(process.execPath)} ${unitArg(binPath)} _run %i
 # The RUNNER owns the child-session restart loop, with a counted, backed-off
 # circuit breaker. systemd must only recover the runner PROCESS crashing —

package/dist/temp-idle.d.ts

@@ -0,0 +1,17 @@
+import type { SessionSnapshot } from './session/types.js';
+export declare const TEMP_CHAT_IDLE_MS: number;
+export type ChatIdlePolicy = {
+    version: 1;
+    timeoutMs: number;
+    lastActivityAt: number;
+};
+export declare function readChatIdle(dir: string): ChatIdlePolicy | undefined;
+/** Only a standalone temporary supervisor owns this clock; browser reads never touch it. */
+export declare class TemporaryChatIdle {
+    private dir;
+    private value;
+    private busy;
+    constructor(dir: string, now: number);
+    private save;
+    observe(snapshot: SessionSnapshot, queueDepth: number, now: number): boolean;
+}