@ours.network/fleet 1.2.0-nightly.6 → 1.2.0-nightly.60

package/dist/session/conversation-normalizer.d.ts

@@ -1,5 +1,5 @@
 import type * as acp from '@agentclientprotocol/sdk';
-import type { AdapterMeta, ConversationEventKind, ConversationPayload } from './conversation-types.js';
+import type { AdapterMeta, BoundedJson, ConversationEventKind, ConversationPayload } from './conversation-types.js';
 /**
  * Reduce one ACP v1 `session/update` into one conversation-domain event draft.
  *
@@ -43,4 +43,5 @@ export interface NormalizedUpdate {
     toolCallId?: string;
     adapterMeta?: AdapterMeta[];
 }
+export declare function boundedJson(value: unknown): BoundedJson;
 export declare function normalizeSessionUpdate(update: acp.SessionUpdate, options?: NormalizeOptions): NormalizedUpdate;

package/dist/session/conversation-normalizer.js

@@ -246,7 +246,7 @@ function redactSensitiveJson(value) {
     };
     return { value: visit(value, 0), redacted };
 }
-function boundedJson(value) {
+export function boundedJson(value) {
     let serialized;
     let safe;
     let redacted = false;

package/dist/session/conversation-store.d.ts

@@ -29,6 +29,7 @@ type EventDraft = Omit<ConversationEventV1, 'schemaVersion' | 'roleId' | 'eventI
 export declare class ConversationEventStore {
     private readonly dir;
     private nextSeq;
+    private firstAvailableSeq?;
     private segments;
     private tail;
     private readonly listeners;
@@ -81,7 +82,6 @@ export declare class ConversationEventStore {
     private trackPromptState;
     private segmentFd;
     private writeManifest;
-    private firstStoredSeq;
     private eventsAfter;
     private markDegraded;
 }

package/dist/session/conversation-store.js

@@ -24,6 +24,7 @@ export class IdempotencyConflictError extends Error {
 export class ConversationEventStore {
     dir;
     nextSeq = 1;
+    firstAvailableSeq;
     segments = [];
     tail = [];
     listeners = new Set();
@@ -72,6 +73,7 @@ export class ConversationEventStore {
         const fd = this.segmentFd(Buffer.byteLength(line));
         writeSync(fd, line);
         fsyncSync(fd);
+        this.firstAvailableSeq ??= event.seq;
         this.nextSeq++;
         this.activeBytes += Buffer.byteLength(line);
         this.tail.push(event);
@@ -101,7 +103,10 @@ export class ConversationEventStore {
         const events = this.eventsAfter(after, limit + 1);
         const hasMore = events.length > limit;
         const pageEvents = hasMore ? events.slice(0, limit) : events;
-        const firstStored = this.firstStoredSeq();
+        // This single-writer store never removes retained segments. Recovery and
+        // append already know the first readable sequence; paging the memory tail
+        // must not parse the first segment again, especially while skipping replay.
+        const firstStored = this.firstAvailableSeq;
         return {
             events: pageEvents,
             ...(firstStored !== undefined ? { firstAvailableCursor: String(firstStored) } : {}),
@@ -159,6 +164,7 @@ export class ConversationEventStore {
         let maxSeq = 0;
         for (const segment of this.segments) {
             for (const event of this.readSegment(segment)) {
+                this.firstAvailableSeq ??= event.seq;
                 maxSeq = Math.max(maxSeq, event.seq);
                 this.tail.push(event);
                 if (this.tail.length > TAIL_EVENTS)
@@ -308,16 +314,6 @@ export class ConversationEventStore {
         }
     }
     // ── reads ──────────────────────────────────────────────────────────────────
-    firstStoredSeq() {
-        if (this.tail.length && this.tail[0].seq === 1)
-            return 1;
-        for (const segment of this.segments) {
-            const events = this.readSegment(segment);
-            if (events.length)
-                return events[0].seq;
-        }
-        return this.tail[0]?.seq;
-    }
     eventsAfter(after, limit) {
         // Serve from the in-memory tail whenever the range allows it.
         if (this.tail.length && after >= this.tail[0].seq - 1)

package/dist/session/conversation-types.d.ts

@@ -1,3 +1,4 @@
+import type { TaskCreatedNotice } from './task-notice.js';
 import type { PromptOrigin, TurnCancellationSource, TurnOutcome } from './types.js';
 /**
  * Durable conversation domain schema for managed-session consoles.
@@ -7,11 +8,11 @@ import type { PromptOrigin, TurnCancellationSource, TurnOutcome } from './types.
  * file touches the wire: transport updates are reduced into these shapes by a
  * session adapter, and the store assigns `seq`/`eventId`/timestamps.
  */
-export type ConversationEventKind = 'prompt.admitted' | 'prompt.started' | 'prompt.interrupt_requested' | 'message.chunk' | 'message.replace' | 'thought.chunk' | 'thought.replace' | 'plan.replace' | 'tool.upsert' | 'tool.content_chunk' | 'permission.requested' | 'permission.resolved' | 'monitor.delivery' | 'usage.updated' | 'turn.state' | 'turn.completed' | 'session.state' | 'session.info' | 'capabilities.updated' | 'error'
+export type ConversationEventKind = 'prompt.admitted' | 'prompt.started' | 'prompt.interrupt_requested' | 'message.chunk' | 'message.replace' | 'thought.chunk' | 'thought.replace' | 'plan.replace' | 'tool.upsert' | 'tool.content_chunk' | 'permission.requested' | 'permission.resolved' | 'file.attached' | 'fleet.task_created' | 'monitor.delivery' | 'usage.updated' | 'turn.state' | 'turn.completed' | 'session.state' | 'session.info' | 'capabilities.updated' | 'error'
 /** A well-formed transport update this version cannot represent. Bounded, never a crash. */
  | 'unsupported';
 /** Where a conversation record came from. Typed provenance, never prompt text. */
-export type ConversationSource = 'owner_admin_console' | 'owner_channel' | 'fleet_monitor' | 'scheduled_loop' | 'startup' | 'local_console' | 'agent' | 'agent_replay';
+export type ConversationSource = 'owner_admin_console' | 'owner_channel' | 'fleet_monitor' | 'scheduled_loop' | 'startup' | 'local_console' | 'agent' | 'agent_replay' | 'fleet_lifecycle';
 export interface NormalizedText {
     type: 'text';
     text: string;
@@ -175,6 +176,12 @@ export interface PromptAdmittedPayload {
 }
 export interface PromptStartedPayload {
     queuedBehind?: number;
+    /** Present when one adapter turn carries several admitted prompts; `turnId` is the shared turn. */
+    batch?: {
+        turnId: string;
+        index: number;
+        size: number;
+    };
 }
 export interface PromptInterruptRequestedPayload {
     commandId?: string;
@@ -227,7 +234,9 @@ export interface BoundedJson {
     digest?: string;
     redacted?: true;
 }
-export type ConversationPayload = MessageChunkPayload | ThoughtChunkPayload | PlanReplacePayload | ToolUpsertPayload | UsageUpdatedPayload | SessionStatePayload | SessionInfoPayload | CapabilitiesUpdatedPayload | UnsupportedPayload | PromptAdmittedPayload | PromptStartedPayload | PromptInterruptRequestedPayload | PermissionRequestedPayload | PermissionResolvedPayload | TurnStatePayload | TurnCompletedPayload | MonitorDeliveryPayload | SessionLifecyclePayload | ErrorPayload;
+export type ConversationPayload = {
+    attachment: import('../file-delivery/types.js').DeliveredFile;
+} | MessageChunkPayload | ThoughtChunkPayload | PlanReplacePayload | ToolUpsertPayload | UsageUpdatedPayload | SessionStatePayload | SessionInfoPayload | CapabilitiesUpdatedPayload | UnsupportedPayload | PromptAdmittedPayload | PromptStartedPayload | PromptInterruptRequestedPayload | PermissionRequestedPayload | PermissionResolvedPayload | TurnStatePayload | TurnCompletedPayload | MonitorDeliveryPayload | SessionLifecyclePayload | ErrorPayload | TaskCreatedNotice;
 export interface ConversationEventV1 {
     schemaVersion: 1;
     roleId: string;
@@ -262,6 +271,9 @@ export interface ConversationEventV1 {
     adapterMeta?: AdapterMeta[];
 }
 export interface SubmitPromptCommand {
+    expectedSessionGeneration?: string;
+    /** Live speech must not silently queue behind an unrelated turn. */
+    requireIdle?: boolean;
     /** Idempotency-Key / clientRequestId. Reuse with a different body is a conflict. */
     commandId: string;
     text: string;
@@ -283,12 +295,25 @@ export interface PermissionDecisionCommand {
     sessionGeneration: string;
     optionId: string;
 }
+/** One admitted prompt not yet handed to the agent, as reported by the queue that owns it. */
+export interface PendingPromptSummary {
+    promptId: string;
+    source: ConversationSource;
+    admittedAt: string;
+    bytes: number;
+    /** A bounded preview, present only for a body the ledger already holds. */
+    text?: string;
+    textTruncated?: boolean;
+}
 export interface ConversationSnapshot {
     sessionGeneration: string;
     readiness: 'starting' | 'idle' | 'running' | 'awaiting_permission' | 'failed' | 'offline';
     queueDepth: number;
     pendingPermissionIds: string[];
     historyDegraded?: boolean;
+    /** Every waiting prompt, in delivery order; `pendingPromptCount` equals its length. */
+    pendingPrompts?: PendingPromptSummary[];
+    pendingPromptCount?: number;
 }
 export interface ConversationPage {
     events: ConversationEventV1[];

package/dist/session/prompt-batch.d.ts

@@ -0,0 +1,63 @@
+import type { ConversationSource, PendingPromptSummary } from './conversation-types.js';
+import type { PromptOrigin, TurnResult } from './types.js';
+/**
+ * A prompt the session has admitted and not yet handed to the adapter.
+ *
+ * Every admitted prompt keeps its own id, ledger records and completion. What
+ * changes at a turn boundary is how many of them one adapter turn carries.
+ */
+export interface PendingPrompt {
+    promptId: string;
+    text: string;
+    origin?: PromptOrigin;
+    source: ConversationSource;
+    /** Whether the ledger already holds this body; an external body is never copied out of the queue. */
+    persistBody: boolean;
+    admittedAt: string;
+    /** Whether the session recognised the text, at admission, as one of its own control operations. */
+    command?: boolean;
+    /** Set when a release takes this prompt; every member of that turn shares it. */
+    released?: Promise<TurnResult>;
+}
+/**
+ * How a waiting prompt takes part in a release.
+ *
+ *  - `message`: something a person or a peer route submitted for the agent to
+ *    read — the paired console, the owner channel, the local console, a
+ *    monitor wake. Every waiting message is delivered at one boundary, in
+ *    admission order, whatever its route.
+ *  - `command`: a control operation the session itself supports — the native
+ *    `/compact`, a command the ACP adapter advertised. It must reach the
+ *    adapter as the entire prompt, so it is its own turn and a boundary
+ *    between the messages before and after it. The session decides this at
+ *    admission; text that merely starts with a slash is an ordinary message.
+ *  - `internal`: startup, scheduled-loop and stall-watchdog prompts. They own
+ *    their turn's lifecycle (and, for a loop, the redaction of its whole
+ *    transcript), run alone, and never split the messages around them.
+ */
+export type PromptClass = 'message' | 'command' | 'internal';
+export declare function promptClass(prompt: Pick<PendingPrompt, 'origin' | 'command'>): PromptClass;
+/** The command name a prompt invokes, when its whole text has the shape of one. */
+export declare function commandName(text: string): string | undefined;
+/**
+ * Detach, in admission order, every pending prompt that is delivered with
+ * `head`. Synchronous on purpose: this is the snapshot boundary, and a prompt
+ * admitted after it returns belongs to the next release.
+ */
+export declare function takeBatch(pending: PendingPrompt[], head: PendingPrompt): PendingPrompt[];
+/** Exact, server-computed identity of one member's body inside a shared turn. */
+export interface MemberBinding {
+    index: number;
+    of: number;
+    source: ConversationSource;
+    bytes: number;
+    sha256: string;
+}
+export declare function memberBindings(members: ReadonlyArray<Pick<PendingPrompt, 'text' | 'origin'>>, sourceOf: (origin: PromptOrigin | undefined) => ConversationSource): MemberBinding[];
+/** What the server asserts about a member's route; never derived from the member's text. */
+export declare function memberAuthority(source: ConversationSource): string;
+/** What a client may show for prompts still waiting: all of them, in order, and never an unpersisted body. */
+export declare function pendingInventory(pending: readonly PendingPrompt[]): {
+    pendingPrompts: PendingPromptSummary[];
+    pendingPromptCount: number;
+};

package/dist/session/prompt-batch.js

@@ -0,0 +1,86 @@
+import { createHash } from 'node:crypto';
+/**
+ * The inventory names every waiting prompt — a client must be able to show the
+ * whole queue, not a count of what it could not see. What keeps a snapshot
+ * small is the body: each entry carries a short preview, not the prompt.
+ */
+const INVENTORY_TEXT_CHARS = 200;
+const INTERNAL = new Set(['startup', 'scheduled-loop', 'stall-watchdog']);
+export function promptClass(prompt) {
+    if (INTERNAL.has(prompt.origin?.kind ?? 'local-console'))
+        return 'internal';
+    return prompt.command ? 'command' : 'message';
+}
+/** The command name a prompt invokes, when its whole text has the shape of one. */
+export function commandName(text) {
+    return /^\/([a-z][a-z0-9_-]*)(?:\s|$)/i.exec(text.trim())?.[1];
+}
+/**
+ * Detach, in admission order, every pending prompt that is delivered with
+ * `head`. Synchronous on purpose: this is the snapshot boundary, and a prompt
+ * admitted after it returns belongs to the next release.
+ */
+export function takeBatch(pending, head) {
+    const members = [];
+    if (promptClass(head) !== 'message')
+        members.push(head);
+    else {
+        for (const prompt of pending) {
+            const kind = promptClass(prompt);
+            if (kind === 'command')
+                break;
+            if (kind === 'message')
+                members.push(prompt);
+        }
+        if (!members.includes(head))
+            members.unshift(head);
+    }
+    for (const member of members) {
+        const at = pending.indexOf(member);
+        if (at >= 0)
+            pending.splice(at, 1);
+    }
+    return members;
+}
+export function memberBindings(members, sourceOf) {
+    return members.map((member, at) => ({
+        index: at + 1,
+        of: members.length,
+        source: sourceOf(member.origin),
+        bytes: Buffer.byteLength(member.text),
+        sha256: createHash('sha256').update(member.text).digest('hex'),
+    }));
+}
+/** What the server asserts about a member's route; never derived from the member's text. */
+export function memberAuthority(source) {
+    switch (source) {
+        case 'owner_admin_console':
+            return 'direct owner input from the server-authenticated paired console';
+        case 'owner_channel':
+            return 'admitted through the authenticated Fleet owner channel';
+        case 'fleet_monitor':
+            return 'a Fleet monitor notification, not owner input';
+        default:
+            return 'local console input, not authenticated owner-console or owner-channel input';
+    }
+}
+/** What a client may show for prompts still waiting: all of them, in order, and never an unpersisted body. */
+export function pendingInventory(pending) {
+    return {
+        pendingPromptCount: pending.length,
+        pendingPrompts: pending.map(prompt => {
+            const display = prompt.origin?.kind === 'owner' ? prompt.origin.displayText
+                : prompt.persistBody ? prompt.text : undefined;
+            return {
+                promptId: prompt.promptId,
+                source: prompt.source,
+                admittedAt: prompt.admittedAt,
+                bytes: Buffer.byteLength(prompt.text),
+                ...(display === undefined ? {} : {
+                    text: display.slice(0, INVENTORY_TEXT_CHARS),
+                    ...(display.length > INVENTORY_TEXT_CHARS ? { textTruncated: true } : {}),
+                }),
+            };
+        }),
+    };
+}

package/dist/session/task-notice.d.ts

@@ -0,0 +1,14 @@
+import type { ConversationEventStore } from './conversation-store.js';
+export interface TaskNoticeBinding {
+    sessionGeneration: string;
+    acpSessionId: string;
+    promptId: string;
+}
+export interface TaskCreatedNotice {
+    operationId: string;
+    taskId: string;
+    title: string;
+    state: string;
+}
+/** Only the trusted Fleet audit completion calls this, never model output. */
+export declare function appendTaskCreated(store: ConversationEventStore, binding: TaskNoticeBinding, notice: TaskCreatedNotice): void;

package/dist/session/task-notice.js

@@ -0,0 +1,13 @@
+/** Only the trusted Fleet audit completion calls this, never model output. */
+export function appendTaskCreated(store, binding, notice) {
+    let after;
+    do {
+        const page = store.page({ after, limit: 1000 });
+        if (page.events.some(e => e.kind === 'fleet.task_created' && e.payload.operationId === notice.operationId))
+            return;
+        if (!page.hasMore)
+            break;
+        after = page.nextCursor;
+    } while (after);
+    store.append({ kind: 'fleet.task_created', source: 'fleet_lifecycle', ...binding, turnId: binding.promptId, payload: notice });
+}

package/dist/session/types.d.ts

@@ -1,3 +1,4 @@
+import type { TaskCreatedNotice, TaskNoticeBinding } from './task-notice.js';
 import type { SessionBackendId } from '../config.js';
 import type { ConversationEventV1, ConversationSnapshot, PromptReceipt, SubmitPromptCommand } from './conversation-types.js';
 /**
@@ -185,6 +186,8 @@ export interface SessionSnapshot {
     backend: SessionBackendId;
     alive: boolean;
     readiness: SessionReadiness;
+    /** Typed source of the active prompt; excludes prompt bodies and command IDs. */
+    activePromptSource?: PromptOrigin['kind'];
     sessionId?: string;
     lastError?: string;
     pendingPermissionId?: string;
@@ -283,12 +286,15 @@ export interface ConversationHandlePage {
  * on any concrete transport which implements it.
  */
 export interface AgentSession {
+    sendFileToChat?: (input: import('../file-delivery/types.js').FileDeliveryInput, signal: AbortSignal, copy: import('../file-delivery/types.js').CopyChatFile, policy: import('../config.js').CommonPermissions) => Promise<import('../file-delivery/types.js').DeliveredFile>;
     readonly backend: SessionBackendId;
     readonly pid: number;
     /** Live capabilities; optional only for source compatibility with external adapters. */
     readonly capabilities?: AgentSessionCapabilities;
     isAlive(): boolean;
     snapshot(): SessionSnapshot;
+    taskNoticeBinding?(): TaskNoticeBinding | undefined;
+    recordTaskCreated?(binding: TaskNoticeBinding, notice: TaskCreatedNotice): void;
     conversationPage?(request: {
         after?: string;
         limit?: number;
@@ -301,6 +307,11 @@ export interface AgentSession {
      * Hand the session a prompt and return as soon as it has accepted
      * responsibility for it. Throws `SessionControlError` if it cannot.
      */
+    /**
+     * The turn that carries an admitted prompt when one adapter turn delivered
+     * several; absent means the prompt's own id is its turn id.
+     */
+    sharedTurnId?(promptId: string): string | undefined;
     queuePrompt(text: string, options?: SubmitPromptOptions): Promise<QueuedPrompt>;
     /** Queue a prompt and wait for its terminal result. */
     submitPrompt(text: string, options?: SubmitPromptOptions): Promise<TurnResult>;
@@ -316,6 +327,9 @@ export interface AgentSession {
      * keep compiling. Read it through `interruptOutcome`, never directly.
      */
     interrupt(source?: TurnCancellationSource): Promise<InterruptResult>;
+    /** Atomically bind cancellation to one voice-owned turn. */
+    readonly liveVoiceSupported?: boolean;
+    interruptPrompt?(generation: string, promptId: string): Promise<InterruptResult>;
     respondPermission(permissionId: string, optionId: string): boolean;
     /** Generation-bound browser decision; stale/settled/invalid all fail closed. */
     respondPermissionV2?(permissionId: string, optionId: string, sessionGeneration: string): 'accepted' | 'stale';

package/dist/setup-tunnel-preflight.d.ts

@@ -0,0 +1,34 @@
+import { type Exec } from './exec.js';
+import type { WorkspacePayload } from './workspace-enrollment.js';
+/**
+ * Check what the steps after the one-time root proof depend on, before that
+ * proof is sent: a failure afterwards cannot be retried with a fresh command.
+ */
+export declare function setupTunnelPreflight({ exec, platform, node }?: {
+    exec?: Exec;
+    platform?: NodeJS.Platform;
+    node?: string;
+}): Promise<void>;
+/** What the steps after the proof need, kept so they can be finished without a new command. */
+export interface PendingTunnelSetup {
+    appOrigin: string;
+    origin: string;
+    hostWorkspaceId: string;
+    rootCid: string;
+    challenge: WorkspacePayload['challenge'];
+    /** Fleet configuration the setup started with; a resume must use the same one. */
+    configuration: string;
+    /** Every port sent to the account as the tunnel target. Without confirmedPort, the remote target may be any of these or the default. */
+    requestedPorts?: number[];
+    /** Last positively confirmed target; cleared before any new retarget request. */
+    confirmedPort?: number;
+}
+export declare function savePendingTunnelSetup(pending: PendingTunnelSetup): void;
+export declare function clearPendingTunnelSetup(): void;
+export declare function readPendingTunnelSetup(): PendingTunnelSetup;
+export declare const DEFAULT_TUNNEL_PORT = 49271;
+/**
+ * The port the web service must bind when the account can no longer retarget
+ * the tunnel. Unknown when a different port was requested and never confirmed.
+ */
+export declare function requiredPortAfterExpiry(pending: PendingTunnelSetup): number;

package/dist/setup-tunnel-preflight.js

@@ -0,0 +1,62 @@
+import { existsSync, lstatSync, readFileSync, rmSync } from 'node:fs';
+import { userInfo } from 'node:os';
+import { join } from 'node:path';
+import { replaceFileAtomically } from './atomic-file.js';
+import { realExec } from './exec.js';
+import { stateRoot } from './paths.js';
+const UNCHANGED = 'Nothing was changed and this host was not bound.';
+/**
+ * Check what the steps after the one-time root proof depend on, before that
+ * proof is sent: a failure afterwards cannot be retried with a fresh command.
+ */
+export async function setupTunnelPreflight({ exec = realExec, platform = process.platform, node = process.versions.node } = {}) {
+    const [major, minor] = node.split('.').map(Number);
+    if (major < 22 || (major === 22 && minor < 13))
+        throw Error(`Tunnel setup requires Node.js 22.13 or newer; this is ${node}. Update Node.js, then run a fresh tunnel setup command. ${UNCHANGED}`);
+    if (platform === 'linux') {
+        const manager = await exec('systemctl', ['--user', 'show-environment'], { timeout: 10_000 });
+        if (manager.code !== 0)
+            throw Error(`The user service manager is not reachable from this shell (${manager.stderr.trim().split('\n')[0] || `systemctl --user exited ${manager.code}`}). `
+                + `Log in directly as ${userInfo().username} (not through su or sudo), or run: sudo loginctl enable-linger ${userInfo().username} && export XDG_RUNTIME_DIR=/run/user/${process.getuid?.()} `
+                + `Then run a fresh tunnel setup command. ${UNCHANGED}`);
+    }
+    const help = await exec('cloudflared', ['tunnel', 'run', '--help'], { timeout: 10_000 });
+    if (help.code === 127)
+        throw Error(`cloudflared is not installed or not on PATH. Install it, then run a fresh tunnel setup command. ${UNCHANGED}`);
+    if (help.code !== 0 || !`${help.stdout}\n${help.stderr}`.includes('--token-file'))
+        throw Error(`This cloudflared is too old for tunnel setup (no --token-file support). Update cloudflared, then run a fresh tunnel setup command. ${UNCHANGED}`);
+}
+const pendingPath = () => join(stateRoot(), 'workspace', 'pending-setup.json');
+export function savePendingTunnelSetup(pending) {
+    replaceFileAtomically(pendingPath(), JSON.stringify(pending) + '\n', 0o600);
+}
+export function clearPendingTunnelSetup() { rmSync(pendingPath(), { force: true }); }
+export function readPendingTunnelSetup() {
+    const path = pendingPath();
+    if (!existsSync(path))
+        throw Error('No unfinished tunnel setup on this host. Run the tunnel setup command from the App.');
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0)
+        throw Error('Unfinished tunnel setup record must be an owned private file');
+    const pending = JSON.parse(readFileSync(path, 'utf8'));
+    if (typeof pending?.appOrigin !== 'string' || typeof pending.origin !== 'string' || typeof pending.hostWorkspaceId !== 'string'
+        || typeof pending.rootCid !== 'string' || !pending.challenge || !Number.isSafeInteger(pending.challenge.expiresAt) || typeof pending.configuration !== 'string'
+        || (pending.requestedPorts !== undefined && (!Array.isArray(pending.requestedPorts) || !pending.requestedPorts.every(Number.isInteger))))
+        throw Error('Unfinished tunnel setup record is invalid');
+    if (pending.confirmedPort !== undefined && (!Number.isInteger(pending.confirmedPort) || pending.confirmedPort < 1024 || pending.confirmedPort > 65535))
+        throw Error('Unfinished tunnel setup record is invalid');
+    return pending;
+}
+export const DEFAULT_TUNNEL_PORT = 49_271;
+/**
+ * The port the web service must bind when the account can no longer retarget
+ * the tunnel. Unknown when a different port was requested and never confirmed.
+ */
+export function requiredPortAfterExpiry(pending) {
+    if (pending.confirmedPort !== undefined)
+        return pending.confirmedPort;
+    const other = [...new Set(pending.requestedPorts ?? [])].filter(port => port !== DEFAULT_TUNNEL_PORT);
+    if (!other.length)
+        return DEFAULT_TUNNEL_PORT;
+    throw Error(`The setup window has expired and it is unknown whether the tunnel points at port ${[...other, DEFAULT_TUNNEL_PORT].join(' or ')}: the account's answer to a port request was not received. This setup cannot be finished automatically`);
+}

package/dist/socket-path.d.ts

@@ -0,0 +1,2 @@
+/** Optional private socket directory for deeply nested, isolated Fleet homes. */
+export declare function socketPath(logicalPath: string): string;

package/dist/socket-path.js

@@ -0,0 +1,22 @@
+import { createHash } from 'node:crypto';
+import { lstatSync, mkdirSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+/** Optional private socket directory for deeply nested, isolated Fleet homes. */
+export function socketPath(logicalPath) {
+    const root = process.env.OURS_FLEET_SOCKET_ROOT;
+    if (!root) {
+        if (Buffer.byteLength(logicalPath) > 103)
+            throw new Error('Unix socket path is too long; configure a short private OURS_FLEET_SOCKET_ROOT');
+        return logicalPath;
+    }
+    if (!isAbsolute(root) || resolve(root) !== root)
+        throw new Error('OURS_FLEET_SOCKET_ROOT must be an absolute normalized path');
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(root);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || (stat.mode & 0o777) !== 0o700)
+        throw new Error('OURS_FLEET_SOCKET_ROOT must be an owner-only 0700 directory');
+    const path = join(root, createHash('sha256').update(resolve(logicalPath)).digest('hex').slice(0, 24) + '.sock');
+    if (Buffer.byteLength(path) > 103)
+        throw new Error('OURS_FLEET_SOCKET_ROOT is too long');
+    return path;
+}

package/dist/spawn.d.ts

@@ -6,7 +6,7 @@ import { type CreationDeps, type CreationProvenance } from './creation.js';
 import './harness/claude-code.js';
 import './harness/codex.js';
 import './harness/hermes.js';
-import { type SupervisorLauncher } from './temp-lifecycle.js';
+import { type SupervisorLauncher, type TaskSupervisorOwner } from './temp-lifecycle.js';
 /**
  * The provenance record written by the most recent spawn in this process, so
  * the CLI can print the same summary it persisted rather than rebuilding it.
@@ -15,6 +15,8 @@ export declare let lastProvenance: CreationProvenance | undefined;
 export interface SpawnOpts {
     name: string;
     temp?: boolean;
+    /** Internal exact task-layout ownership, never a standalone manifest entry. */
+    taskOwner?: TaskSupervisorOwner;
     brain?: AgentSelection;
     role?: AgentSelection;
     /** Trusted canonical definition used by room provisioning; never a second schema. */
@@ -85,3 +87,5 @@ export declare function spawnPermanent(o: SpawnOpts, deps: OpsDeps, creation?: C
 export type { SupervisorLauncher } from './temp-lifecycle.js';
 /** Temp spawn: live state under ~/.ours-fleet/tmp, independent transient supervision. */
 export declare function spawnTemp(o: SpawnOpts, binPath: string, launch?: SupervisorLauncher, creation?: CreationDeps): Promise<string>;
+/** Resume the exact durable task launch; no creation, invite issuance or state rotation. */
+export declare function resumeTaskSupervisor(name: string, binPath: string): Promise<void>;

package/dist/spawn.js

@@ -1,5 +1,7 @@
+import { taskSupervisorMayRun } from './task-supervision.js';
 import { randomUUID } from 'node:crypto';
 import { storeRoomSecret, storeTemporaryLaunch, preparePermanentAssignment } from './agent-ours/service.js';
+import { ensureWorkspace } from './rooms-tasks/workspace.js';
 import { spawn as spawnChild } from 'node:child_process';
 import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -15,7 +17,8 @@ import { recordGeneratedAgentSource } from './generated-agent-source.js';
 import './harness/claude-code.js';
 import './harness/codex.js';
 import './harness/hermes.js';
-import { archiveTempState, makeTempSupervisorLauncher, prepareTempSupervisor, reclaimStaleTempState, } from './temp-lifecycle.js';
+import { getAdapter } from './harness/registry.js';
+import { archiveTempState, makeTempSupervisorLauncher, prepareTempSupervisor, reclaimStaleTempState, stopTempSupervisor, secureStoppedTempArchive, readTempSupervisor, requestedTempStopReason, } from './temp-lifecycle.js';
 /**
  * The provenance record written by the most recent spawn in this process, so
  * the CLI can print the same summary it persisted rather than rebuilding it.
@@ -321,6 +324,14 @@ export async function spawnTemp(o, binPath, launch = independentSupervisor, crea
     if (o.isolationFile)
         readIsolationFile(o.isolationFile); // fail before reserving
     const prepared = resolvedSpawn(o); // canonical validation before mutation
+    if ((o.taskOwner || o.roomMemberStartup?.task_id) && !getAdapter(prepared.role.harness).supportsResume)
+        throw Error('TASK_HARNESS_RESUME_UNSUPPORTED: task agents require a resumable harness');
+    if (o.roomMemberStartup?.workspace) {
+        const workspace = o.roomMemberStartup.workspace;
+        if (prepared.role.cwd !== workspace.path)
+            throw new Error('room member cwd must equal its recorded owned workspace');
+        ensureWorkspace(workspace);
+    }
     // Retire only supervisors whose recorded owner is definitively stopped. This
     // bounded pass keeps the active roster clean without deleting old evidence.
     await reclaimStaleTempState();
@@ -351,7 +362,7 @@ async function spawnTempInner(o, preparedRole, binPath, launch, tx, onStage) {
     if (role.roomMemberStartup)
         role.roomMemberStartup = { ...role.roomMemberStartup, invite: '' };
     onStage?.('writing_role');
-    const dir = applyRole(role, { temp: true, identityGuarantee: 'unverified' });
+    const dir = applyRole(role, { temp: true, identityGuarantee: 'unverified', configPath: o.configPath });
     const provenance = buildProvenance({
         role: o.name, lifetime: 'temporary', fleetVersion: VERSION,
         settings: provenanceSettings(o, cfg.defaults, preparedRole.temporaryLoops),
@@ -361,7 +372,14 @@ async function spawnTempInner(o, preparedRole, binPath, launch, tx, onStage) {
     lastProvenance = provenance;
     tx.record({
         stage: `temp state dir ${dir}`,
-        undo: () => {
+        undo: async () => {
+            if (o.taskOwner || role.roomMemberStartup?.task_id) {
+                await stopTempSupervisor(o.name);
+                const supervisor = readTempSupervisor(dir);
+                if (supervisor)
+                    await secureStoppedTempArchive(o.name, supervisor.launchId);
+                return;
+            }
             // A failed launch is still lifecycle evidence: briefing, provenance,
             // metadata and supervisor output explain what happened. Remove it from
             // the live roster by atomic archive, never recursive deletion.
@@ -374,7 +392,14 @@ async function spawnTempInner(o, preparedRole, binPath, launch, tx, onStage) {
     // out; a lone temp spawn still waits zero (time-based gate).
     if (cfg.startStaggerMs > 0)
         writeFileSync(join(dir, START_STAGGER_FILE), String(cfg.startStaggerMs));
-    prepareTempSupervisor(dir, o.name);
+    prepareTempSupervisor(dir, o.name, o.taskOwner ?? (o.roomMemberStartup?.task_id ? {
+        taskId: o.roomMemberStartup.task_id,
+        roomId: o.roomMemberStartup.room_id,
+        roomIdentityCid: o.roomMemberStartup.room_identity_cid,
+        creationActionId: o.creationActionId,
+    } : undefined));
+    if (o.taskOwner || o.roomMemberStartup?.task_id)
+        taskSupervisorMayRun(o.name);
     // Run the supervisor independently. On a service-managed host the temp
     // runner gets its own transient unit/job, so stopping the coordinator's unit
     // cannot kill a live worker in the coordinator's cgroup.
@@ -382,3 +407,14 @@ async function spawnTempInner(o, preparedRole, binPath, launch, tx, onStage) {
     await launch(binPath, ['_run-temp', o.name], dir);
     return dir;
 }
+/** Resume the exact durable task launch; no creation, invite issuance or state rotation. */
+export async function resumeTaskSupervisor(name, binPath) {
+    if (!taskSupervisorMayRun(name))
+        throw Error('TASK_SUPERVISOR_RETIRED');
+    const dir = agentDir(name, true);
+    if (requestedTempStopReason(dir))
+        throw Error('TASK_SUPERVISOR_STOP_REQUESTED');
+    const launcher = readTempSupervisor(dir)?.kind === 'detached'
+        ? makeTempSupervisorLauncher({ spawnDetached, supervisor: 'none' }) : independentSupervisor;
+    await launcher(binPath, ['_run-temp', name], dir);
+}

package/dist/startup-prompt.d.ts

@@ -0,0 +1,4 @@
+/** Readiness is a separate turn after identity/profile and room admission succeed. */
+export declare function managedStartupPrompt(stateDir: string, mode: 'fresh' | 'resume', hasPriorBoot?: boolean): string;
+/** Configured work/continuity runs after readiness, never inside the fast turn. */
+export declare function managedTaskPrompt(stateDir: string, mode: 'fresh' | 'resume', hasPriorBoot?: boolean): string;