@ours.network/fleet 1.2.0-nightly.54 → 1.2.0-nightly.56

package/dist/rooms-tasks/member-ownership.js

@@ -0,0 +1,40 @@
+import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { agentDir, agentsRoot } from '../paths.js';
+/** A room seat is never authority to retire a standalone persistent agent.
+ * Check both role-name collisions and a permanent role using the seat's
+ * identity name. Missing legacy task state must not bypass this fence.
+ */
+export function assertMemberNotPermanent(name) {
+    if (!/^[a-zA-Z0-9_-]{1,120}$/.test(name))
+        throw new Error('Invalid retirement member name');
+    if (existsSync(agentDir(name)))
+        throw new Error(`room member '${name}' conflicts with permanent agent state; refusing retirement`);
+    let entries;
+    try {
+        entries = readdirSync(agentsRoot(), { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory() || entry.isSymbolicLink())
+            continue;
+        const path = join(agentsRoot(), entry.name, '.identity');
+        let stat;
+        try {
+            stat = lstatSync(path);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                continue;
+            throw error;
+        }
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024)
+            throw new Error('Permanent identity ownership proof is unsafe; refusing member retirement');
+        if (readFileSync(path, 'utf8').trim() === name)
+            throw new Error(`room member '${name}' identity belongs to permanent agent '${entry.name}'; refusing retirement`);
+    }
+}

package/dist/rooms-tasks/provision.js

@@ -7,7 +7,8 @@ import { parse } from 'yaml';
 import { advanceSaga, setSagaError, updateMemberSeats, updateMemberStartup, activateRoom, getRoomRecord, } from './room-state.js';
 import { activateTask, updateTaskMembers, blockTask, unblockTask, getTask, } from './task-state.js';
 import { storedRoomLaunchPolicy } from './types.js';
-import { spawnTemp } from '../spawn.js';
+import { spawnTemp, resumeTaskSupervisor } from '../spawn.js';
+import { adoptLegacyTaskMember } from './legacy-task-member.js';
 import { effectivePermissionMode } from '../permissions.js';
 import { selectionOrigin, summarizeResolvedLaunch, } from '../lifecycle-summary.js';
 import { canonicalJson } from '../canonical-json.js';
@@ -207,6 +208,22 @@ async function retainRunningLaunch(input) {
                 } });
             return true;
         }
+        if (supervisor.taskOwner) {
+            await resumeTaskSupervisor(member.name, provision.binPath);
+            updateMemberStartup(provision.roomId, member.name, { launch: {
+                    ...retainedLaunch, state: 'launched', launch_id: supervisor.launchId,
+                    presentation: retainedLaunch.presentation ?? presentationFromStatePath(dir, settings, member.coworkRole),
+                    updated_at: new Date().toISOString(),
+                } });
+            return true;
+        }
+        if (provision.taskId) {
+            const adopted = await adoptLegacyTaskMember({ taskId: provision.taskId, roomId: provision.roomId,
+                roomIdentityCid, creationActionId: retainedLaunch.action_id }, member.name);
+            if (adopted !== 'running-legacy')
+                await resumeTaskSupervisor(member.name, provision.binPath);
+            return true;
+        }
         await secureStoppedTempArchive(member.name, supervisor.launchId);
         updateMemberStartup(provision.roomId, member.name, { launch: {
                 ...retainedLaunch, state: 'stopped', launch_id: supervisor.launchId,
@@ -215,6 +232,8 @@ async function retainRunningLaunch(input) {
         return false;
     }
     if (seat.launch?.state === 'launched' && !existsSync(dir)) {
+        if (provision.taskId)
+            throw Error(`retained task member ${member.name} is missing; explicit reconciliation required`);
         if (!seat.launch.launch_id || !seat.launch.action_id)
             throw new Error(`missing durable launch identity for disappeared ${member.name}`);
         const archive = await secureStoppedTempArchive(member.name, seat.launch.launch_id);
@@ -249,6 +268,7 @@ async function launchMember(input) {
     const actionId = randomUUID();
     let effectiveActionId = actionId;
     const attempt = (seat.launch?.attempt ?? 0) + 1;
+    const taskSupervised = Boolean(provision.taskId) && process.env.OURS_FLEET_SUPERVISOR !== 'none';
     const taskSha = sha256Text(startup.task);
     const effectiveAgentDefinition = structuredClone(settings.definition);
     const { projection: agentDefinition, fingerprint: agentFingerprint } = launchDefinition(effectiveAgentDefinition);
@@ -256,6 +276,7 @@ async function launchMember(input) {
         ? process.env[FLEET_PROXY_CALLER_ENV] : undefined;
     updateMemberStartup(provision.roomId, member.name, { launch: {
             state: 'intent', attempt, action_id: actionId, mission_sha256: taskSha,
+            ...(taskSupervised ? { task_supervised: true } : {}),
             agent_definition: agentDefinition, agent_fingerprint: agentFingerprint,
             agent_template: settings.template, agent_template_hash: settings.templateHash,
             ...(proxyCaller ? { caller_role: proxyCaller } : {}),
@@ -280,6 +301,7 @@ async function launchMember(input) {
         if (launched.creationActionId !== actionId) {
             updateMemberStartup(provision.roomId, member.name, { launch: {
                     state: 'intent', attempt, action_id: launched.creationActionId,
+                    ...(taskSupervised ? { task_supervised: true } : {}),
                     mission_sha256: taskSha, agent_definition: agentDefinition,
                     agent_fingerprint: agentFingerprint,
                     agent_template: settings.template, agent_template_hash: settings.templateHash,
@@ -297,6 +319,7 @@ async function launchMember(input) {
             : presentationFromStatePath(launchedDir, settings, member.coworkRole);
         updateMemberStartup(provision.roomId, member.name, { launch: {
                 state: 'launched', attempt, action_id: launched.creationActionId, mission_sha256: taskSha,
+                ...(taskSupervised ? { task_supervised: true } : {}),
                 agent_definition: agentDefinition, agent_fingerprint: agentFingerprint,
                 agent_template: settings.template, agent_template_hash: settings.templateHash,
                 presentation,
@@ -307,6 +330,7 @@ async function launchMember(input) {
     catch (error) {
         updateMemberStartup(provision.roomId, member.name, { launch: {
                 state: 'failed', attempt, action_id: effectiveActionId, mission_sha256: taskSha,
+                ...(taskSupervised ? { task_supervised: true } : {}),
                 agent_definition: agentDefinition, agent_fingerprint: agentFingerprint,
                 agent_template: settings.template, agent_template_hash: settings.templateHash,
                 ...(proxyCaller ? { caller_role: proxyCaller } : {}),
@@ -503,6 +527,7 @@ async function provisionMembersUnlocked(input) {
                     member,
                     settings: settings.get(member.name),
                     startup: {
+                        ...(taskId ? { task_id: taskId } : {}),
                         workspace: existing.workspace,
                         room_id: roomId,
                         room_identity_cid: roomIdentityCid,

package/dist/rooms-tasks/recovery.d.ts

@@ -0,0 +1,19 @@
+import { tempSupervisorLiveness } from '../temp-lifecycle.js';
+import { resumeTaskSupervisor } from '../spawn.js';
+import type { CoworkAdapter } from './cowork-adapter.js';
+export type MemberRecovery = {
+    name: string;
+    status: 'running' | 'resumed' | 'migration_pending' | 'recovery_reset';
+};
+export interface TaskMemberRecoveryDeps {
+    liveness?: typeof tempSupervisorLiveness;
+    resume?: typeof resumeTaskSupervisor;
+    adopt?(taskId: string, roomId: string, name: string): Promise<void>;
+}
+/** Explicit supported recovery; never creates an identity, seat, invite, or session ID. */
+export declare function recoverTaskMembers(input: {
+    taskId: string;
+    binPath: string;
+    cowork?: Pick<CoworkAdapter, 'getRoom'>;
+    deps?: TaskMemberRecoveryDeps;
+}): Promise<MemberRecovery[]>;

package/dist/rooms-tasks/recovery.js

@@ -0,0 +1,110 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse } from 'yaml';
+import { withFileLock } from '../atomic-file.js';
+import { agentDir, stateRoot } from '../paths.js';
+import { readProvenance } from '../creation.js';
+import { readTempSupervisor, tempSupervisorLiveness, requestedTempStopReason } from '../temp-lifecycle.js';
+import { taskSupervisorMayRun } from '../task-supervision.js';
+import { resumeTaskSupervisor } from '../spawn.js';
+import { resetRestartLedger, readRestartLedger } from '../runner.js';
+import { readRoomReadiness } from '../agent-ours/service.js';
+import { getTask } from './task-state.js';
+import { getRoomRecord } from './room-state.js';
+import { roomCloseLockPath, CLOSE_LOCK_STALE_MS } from './close.js';
+import { taskOperationLockPath, TASK_OPERATION_LOCK_STALE_MS } from './terminal.js';
+import { adoptLegacyTaskMember } from './legacy-task-member.js';
+/** Explicit supported recovery; never creates an identity, seat, invite, or session ID. */
+export async function recoverTaskMembers(input) {
+    const deps = input.deps ?? {};
+    return withFileLock(taskOperationLockPath(input.taskId), async () => {
+        const task = getTask(input.taskId);
+        if (!['provisioning', 'active', 'review'].includes(task.state) || task.deletion || task.terminal_intent)
+            throw Error('Task is not open for member recovery');
+        const recover = async (name, roomId) => {
+            const dir = agentDir(name, true), metadata = readTempSupervisor(dir);
+            if (!metadata || metadata.role !== name)
+                throw Error('Exact supervisor state missing; explicit reconciliation required');
+            if (requestedTempStopReason(dir))
+                throw Error('Task member has an explicit retirement request');
+            const live = await (deps.liveness ?? tempSupervisorLiveness)(dir);
+            if (live === 'unknown')
+                throw Error('Supervisor liveness unknown; refusing recovery');
+            if (!metadata.taskOwner) {
+                if (live === 'running')
+                    return { name, status: 'migration_pending' };
+                if (!roomId)
+                    throw Error('Legacy layout member requires explicit reconciliation');
+                if (deps.adopt)
+                    await deps.adopt(input.taskId, roomId, name);
+                else {
+                    const room = getRoomRecord(roomId);
+                    const seat = room.member_seats.find(member => member.role_name === name);
+                    const adopted = await adoptLegacyTaskMember({ taskId: input.taskId, roomId,
+                        roomIdentityCid: room.room_identity_cid, creationActionId: seat.launch.action_id }, name);
+                    if (adopted === 'running-legacy')
+                        return { name, status: 'migration_pending' };
+                }
+            }
+            if (!taskSupervisorMayRun(name))
+                throw Error('Task member is retired');
+            const reset = readRestartLedger(dir).circuit === 'open';
+            if (reset)
+                resetRestartLedger(dir);
+            if (live === 'running') {
+                return { name, status: reset ? 'recovery_reset' : 'running' };
+            }
+            await (deps.resume ?? resumeTaskSupervisor)(name, input.binPath);
+            return { name, status: 'resumed' };
+        };
+        if (task.layout) {
+            const path = join(stateRoot(), 'layouts', `${task.layout.run_id}.json`);
+            return withFileLock(path + '.lock', async () => {
+                const state = JSON.parse(readFileSync(path, 'utf8'));
+                if (state.closed || state.closing || state.uncertain)
+                    throw Error('Layout requires reconciliation before recovery');
+                const result = [];
+                for (const member of Object.values(state.participants)) {
+                    if (!member.owned || member.retired)
+                        continue;
+                    if (!member.instance?.agent || member.instance.remote)
+                        throw Error('Layout owned instance evidence missing');
+                    result.push(await recover(member.instance.agent));
+                }
+                return result;
+            });
+        }
+        if (!task.room_id || !input.cowork)
+            throw Error('Task room required for member recovery');
+        return withFileLock(roomCloseLockPath(task.room_id), async () => {
+            const room = getRoomRecord(task.room_id);
+            if (!room || room.task_id !== task.task_id || room.close || !['active', 'provisioning'].includes(room.state)
+                || !room.room_identity_cid || room.room_identity_cid !== task.room_identity_cid)
+                throw Error('Exact open task room required');
+            const remote = await input.cowork.getRoom(room.room_id);
+            if (!remote || remote.identity_cid !== room.room_identity_cid || remote.state !== 'active')
+                throw Error('Exact active Cowork room required');
+            // Validate the complete admitted roster before any member is resumed.
+            for (const seat of room.member_seats) {
+                const dir = agentDir(seat.role_name, true), metadata = readTempSupervisor(dir), provenance = readProvenance(dir);
+                const role = parse(readFileSync(join(dir, 'role.yaml'), 'utf8')), startup = role.roomMemberStartup;
+                const found = remote.seats.filter(item => item.display_name === seat.role_name && item.seat_state !== 'removed');
+                const ready = readRoomReadiness(room.room_identity_cid, seat.role_name);
+                if (seat.retirement || !seat.identity_cid || !seat.invite_id || !seat.launch?.action_id || !seat.launch.launch_id
+                    || metadata?.role !== seat.role_name || metadata.launchId !== seat.launch.launch_id
+                    || provenance?.role !== seat.role_name || provenance.creationActionId !== seat.launch.action_id
+                    || role.identity !== seat.role_name || startup?.identity_name !== seat.role_name
+                    || startup.room_id !== room.room_id || startup.room_identity_cid !== room.room_identity_cid
+                    || startup.invite_id !== seat.invite_id || startup.role !== seat.cowork_role
+                    || !ready || ready.cid !== seat.identity_cid || ready.room !== room.room_id || ready.invite !== seat.invite_id
+                    || found.length !== 1 || found[0].identity_cid !== seat.identity_cid || found[0].invite_id !== seat.invite_id
+                    || found[0].role !== seat.cowork_role || found[0].seat_state !== 'active')
+                    throw Error(`Exact admitted member proof missing: ${seat.role_name}`);
+            }
+            const result = [];
+            for (const seat of room.member_seats)
+                result.push(await recover(seat.role_name, room.room_id));
+            return result;
+        }, {}, CLOSE_LOCK_STALE_MS);
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+}

package/dist/rooms-tasks/task-service-retirement.d.ts

@@ -0,0 +1,11 @@
+import type { Exec } from '../exec.js';
+/** Registration retirement precedes every identity-absence shortcut. A proven
+ * legacy transient/detached launch never owned a retained registration.
+ * Missing state still requires exact catalog ownership before unregistering.
+ */
+export declare function retireTaskMemberService(name: string, expected: {
+    taskId: string;
+    creationActionId?: string;
+    launchId?: string;
+    taskSupervised?: boolean;
+}, exec?: Exec): Promise<void>;

package/dist/rooms-tasks/task-service-retirement.js

@@ -0,0 +1,21 @@
+import { existsSync } from 'node:fs';
+import { agentDir } from '../paths.js';
+import { readTempSupervisor, tempArchiveForCreationAction, tempArchiveForLaunch } from '../temp-lifecycle.js';
+import { unregisterTaskMember, hasTaskMemberRegistration } from '../supervisor/catalog.js';
+import { assertMemberNotPermanent } from './member-ownership.js';
+/** Registration retirement precedes every identity-absence shortcut. A proven
+ * legacy transient/detached launch never owned a retained registration.
+ * Missing state still requires exact catalog ownership before unregistering.
+ */
+export async function retireTaskMemberService(name, expected, exec) {
+    assertMemberNotPermanent(name);
+    const archive = expected.creationActionId ? tempArchiveForCreationAction(name, expected.creationActionId)
+        : expected.launchId ? { path: tempArchiveForLaunch(name, expected.launchId) } : undefined;
+    const source = existsSync(agentDir(name, true)) ? agentDir(name, true) : archive?.path;
+    const metadata = source ? readTempSupervisor(source) : undefined;
+    const hasServiceEvidence = hasTaskMemberRegistration(name);
+    const durableMetadata = metadata?.taskOwner && metadata.kind === 'fleet-managed';
+    if (!hasServiceEvidence && !expected.taskSupervised && !durableMetadata)
+        return;
+    await unregisterTaskMember(name, expected, { exec });
+}

package/dist/rooms-tasks/task-state.d.ts

@@ -130,6 +130,7 @@ interface SeatEvidence {
     launch?: {
         launch_id?: string;
         action_id?: string;
+        task_supervised?: boolean;
     };
     retirement?: {
         absence_verified?: boolean;

package/dist/rooms-tasks/task-state.js

@@ -664,6 +664,8 @@ function findCursorForSeat(id, stored, seat) {
     if (cursor && seat.identity_cid
         && cursor.identity_cid.toLowerCase() !== seat.identity_cid.toLowerCase())
         throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' identity CID mismatch between cursor and room seat`);
+    if (cursor?.action_id && seat.launch?.action_id && cursor.action_id !== seat.launch.action_id)
+        throw new TaskStateError(`task ${id} deletion member '${seat.role_name}' creation ownership proof changed`);
     return cursor;
 }
 /**
@@ -684,11 +686,20 @@ export function upsertTaskDeletionMembersFromSeats(id, seats) {
         for (const seat of seats) {
             if (!seat.identity_cid)
                 continue;
-            if (!findCursorForSeat(id, stored, seat)) {
+            const cursor = findCursorForSeat(id, stored, seat);
+            if (!cursor) {
                 stored.deletion.members.push({
                     name: seat.role_name, identity_cid: seat.identity_cid, phase: 'pending', updated_at: now,
+                    ...(seat.launch?.action_id ? { action_id: seat.launch.action_id } : {}),
+                    ...(seat.launch?.task_supervised ? { task_supervised: true } : {}),
                 });
             }
+            else {
+                if (seat.launch?.action_id)
+                    cursor.action_id ??= seat.launch.action_id;
+                if (seat.launch?.task_supervised)
+                    cursor.task_supervised = true;
+            }
         }
         writeTask(stored);
         return presentTaskLenient(stored);
@@ -747,6 +758,10 @@ export function importTaskDeletionRetirementEvidence(id, seats, proofs = []) {
                 cursor = { name: seat.role_name, identity_cid: seat.identity_cid, phase: 'pending', updated_at: now };
                 stored.deletion.members.push(cursor);
             }
+            if (seat.launch?.action_id)
+                cursor.action_id ??= seat.launch.action_id;
+            if (seat.launch?.task_supervised)
+                cursor.task_supervised = true;
             if (DELETION_MEMBER_PHASE_ORDER[evidence.phase] < DELETION_MEMBER_PHASE_ORDER[cursor.phase])
                 continue;
             if (cursor.launch_id !== undefined && cursor.launch_id !== evidence.launch_id)

package/dist/rooms-tasks/types.d.ts

@@ -62,6 +62,8 @@ export type TaskDeletionMemberPhase = 'pending' | 'stop_requested' | 'liveness_a
 export interface TaskDeletionMemberCursor {
     name: string;
     identity_cid: string;
+    action_id?: string;
+    task_supervised?: boolean;
     phase: TaskDeletionMemberPhase;
     launch_id?: string;
     archive_path?: string;
@@ -170,6 +172,7 @@ export interface RoomRoleBriefingDefinition {
     last_error?: string;
 }
 export interface RoomMemberLaunchState {
+    task_supervised?: boolean;
     state: 'pending' | 'intent' | 'launched' | 'stopped' | 'failed';
     attempt: number;
     action_id?: string;

package/dist/rooms-tasks/workspace.d.ts

@@ -11,6 +11,8 @@ export declare class WorkspaceError extends Error {
 export declare function assertSafeAncestors(path: string): void;
 export declare function planWorkspace(owner: OwnedWorkspace['owner'], id: string): OwnedWorkspace;
 export declare function validateWorkspace(w: OwnedWorkspace, owner?: "task" | "room", id?: string): void;
+/** Read-only recovery proof; never allocate a replacement for a missing workspace. */
+export declare function assertWorkspacePresent(w: OwnedWorkspace, owner: OwnedWorkspace['owner'], id: string): void;
 /** Caller must first prove the exact workspace marker or retired archive
  * provenance, and hold its lifecycle lock with all managed writers retired.
  * Directories need owner rwx for recursive removal; ordinary files do not.

package/dist/rooms-tasks/workspace.js

@@ -54,6 +54,11 @@ function marked(path, w) {
     if (JSON.stringify(actual) !== JSON.stringify(w))
         fail('ownership marker mismatch');
 }
+/** Read-only recovery proof; never allocate a replacement for a missing workspace. */
+export function assertWorkspacePresent(w, owner, id) {
+    validateWorkspace(w, owner, id);
+    marked(w.path, w);
+}
 function staging(w, phase) {
     return join(dirname(w.path), `.${w.id}.${w.token}.${phase}`);
 }

package/dist/runner.d.ts

@@ -39,6 +39,8 @@ export interface RunnerDeps {
     reportOwnerStartupFailure(stateDir: string): Promise<'delivered' | 'duplicate'>;
     /** Lets a test (or a shutdown path) end the supervised restart loop. */
     shouldStop?(): boolean;
+    /** Parent shutdown suspends a managed transient member; explicit stop still retires. */
+    suspendOnStop?: boolean;
 }
 export declare const SUPERVISOR_RECYCLE_REQUIRED = "OWNER_CHANNEL_SUPERVISOR_RECYCLE_REQUIRED";
 export declare class SupervisorRecycleRequiredError extends Error {
@@ -201,9 +203,13 @@ export declare function runOnce(name: string, opts?: {
  */
 export declare function runSupervised(name: string, opts?: {
     configPath?: string;
+    temp?: boolean;
 }, partialDeps?: Partial<RunnerDeps>, attempt?: (n: string, o: {
     configPath?: string;
     allowResumeRotation?: boolean;
+    temp?: boolean;
 }, d: Partial<RunnerDeps>) => Promise<AttemptResult>): Promise<RestartLedger>;
 /** Temp-agent entrypoint: run once, journal why it ended, then archive its evidence. */
+/** The parent uses the same adapter-relative sustained-uptime reset boundary. */
+export declare function stableSupervisorWindow(name: string, temp: boolean, configPath?: string): number;
 export declare function runTemp(name: string, deps?: Partial<RunnerDeps>, attempt?: typeof runOnce): Promise<void>;