@ours.network/fleet 1.2.0-nightly.6 → 1.2.0-nightly.61

package/dist/rooms-tasks/recovery.js

@@ -0,0 +1,110 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse } from 'yaml';
+import { withFileLock } from '../atomic-file.js';
+import { agentDir, stateRoot } from '../paths.js';
+import { readProvenance } from '../creation.js';
+import { readTempSupervisor, tempSupervisorLiveness, requestedTempStopReason } from '../temp-lifecycle.js';
+import { taskSupervisorMayRun } from '../task-supervision.js';
+import { resumeTaskSupervisor } from '../spawn.js';
+import { resetRestartLedger, readRestartLedger } from '../runner.js';
+import { readRoomReadiness } from '../agent-ours/service.js';
+import { getTask } from './task-state.js';
+import { getRoomRecord } from './room-state.js';
+import { roomCloseLockPath, CLOSE_LOCK_STALE_MS } from './close.js';
+import { taskOperationLockPath, TASK_OPERATION_LOCK_STALE_MS } from './terminal.js';
+import { adoptLegacyTaskMember } from './legacy-task-member.js';
+/** Explicit supported recovery; never creates an identity, seat, invite, or session ID. */
+export async function recoverTaskMembers(input) {
+    const deps = input.deps ?? {};
+    return withFileLock(taskOperationLockPath(input.taskId), async () => {
+        const task = getTask(input.taskId);
+        if (!['provisioning', 'active', 'review'].includes(task.state) || task.deletion || task.terminal_intent)
+            throw Error('Task is not open for member recovery');
+        const recover = async (name, roomId) => {
+            const dir = agentDir(name, true), metadata = readTempSupervisor(dir);
+            if (!metadata || metadata.role !== name)
+                throw Error('Exact supervisor state missing; explicit reconciliation required');
+            if (requestedTempStopReason(dir))
+                throw Error('Task member has an explicit retirement request');
+            const live = await (deps.liveness ?? tempSupervisorLiveness)(dir);
+            if (live === 'unknown')
+                throw Error('Supervisor liveness unknown; refusing recovery');
+            if (!metadata.taskOwner) {
+                if (live === 'running')
+                    return { name, status: 'migration_pending' };
+                if (!roomId)
+                    throw Error('Legacy layout member requires explicit reconciliation');
+                if (deps.adopt)
+                    await deps.adopt(input.taskId, roomId, name);
+                else {
+                    const room = getRoomRecord(roomId);
+                    const seat = room.member_seats.find(member => member.role_name === name);
+                    const adopted = await adoptLegacyTaskMember({ taskId: input.taskId, roomId,
+                        roomIdentityCid: room.room_identity_cid, creationActionId: seat.launch.action_id }, name);
+                    if (adopted === 'running-legacy')
+                        return { name, status: 'migration_pending' };
+                }
+            }
+            if (!taskSupervisorMayRun(name))
+                throw Error('Task member is retired');
+            const reset = readRestartLedger(dir).circuit === 'open';
+            if (reset)
+                resetRestartLedger(dir);
+            if (live === 'running') {
+                return { name, status: reset ? 'recovery_reset' : 'running' };
+            }
+            await (deps.resume ?? resumeTaskSupervisor)(name, input.binPath);
+            return { name, status: 'resumed' };
+        };
+        if (task.layout) {
+            const path = join(stateRoot(), 'layouts', `${task.layout.run_id}.json`);
+            return withFileLock(path + '.lock', async () => {
+                const state = JSON.parse(readFileSync(path, 'utf8'));
+                if (state.closed || state.closing || state.uncertain)
+                    throw Error('Layout requires reconciliation before recovery');
+                const result = [];
+                for (const member of Object.values(state.participants)) {
+                    if (!member.owned || member.retired)
+                        continue;
+                    if (!member.instance?.agent || member.instance.remote)
+                        throw Error('Layout owned instance evidence missing');
+                    result.push(await recover(member.instance.agent));
+                }
+                return result;
+            });
+        }
+        if (!task.room_id || !input.cowork)
+            throw Error('Task room required for member recovery');
+        return withFileLock(roomCloseLockPath(task.room_id), async () => {
+            const room = getRoomRecord(task.room_id);
+            if (!room || room.task_id !== task.task_id || room.close || !['active', 'provisioning'].includes(room.state)
+                || !room.room_identity_cid || room.room_identity_cid !== task.room_identity_cid)
+                throw Error('Exact open task room required');
+            const remote = await input.cowork.getRoom(room.room_id);
+            if (!remote || remote.identity_cid !== room.room_identity_cid || remote.state !== 'active')
+                throw Error('Exact active Cowork room required');
+            // Validate the complete admitted roster before any member is resumed.
+            for (const seat of room.member_seats) {
+                const dir = agentDir(seat.role_name, true), metadata = readTempSupervisor(dir), provenance = readProvenance(dir);
+                const role = parse(readFileSync(join(dir, 'role.yaml'), 'utf8')), startup = role.roomMemberStartup;
+                const found = remote.seats.filter(item => item.display_name === seat.role_name && item.seat_state !== 'removed');
+                const ready = readRoomReadiness(room.room_identity_cid, seat.role_name);
+                if (seat.retirement || !seat.identity_cid || !seat.invite_id || !seat.launch?.action_id || !seat.launch.launch_id
+                    || metadata?.role !== seat.role_name || metadata.launchId !== seat.launch.launch_id
+                    || provenance?.role !== seat.role_name || provenance.creationActionId !== seat.launch.action_id
+                    || role.identity !== seat.role_name || startup?.identity_name !== seat.role_name
+                    || startup.room_id !== room.room_id || startup.room_identity_cid !== room.room_identity_cid
+                    || startup.invite_id !== seat.invite_id || startup.role !== seat.cowork_role
+                    || !ready || ready.cid !== seat.identity_cid || ready.room !== room.room_id || ready.invite !== seat.invite_id
+                    || found.length !== 1 || found[0].identity_cid !== seat.identity_cid || found[0].invite_id !== seat.invite_id
+                    || found[0].role !== seat.cowork_role || found[0].seat_state !== 'active')
+                    throw Error(`Exact admitted member proof missing: ${seat.role_name}`);
+            }
+            const result = [];
+            for (const seat of room.member_seats)
+                result.push(await recover(seat.role_name, room.room_id));
+            return result;
+        }, {}, CLOSE_LOCK_STALE_MS);
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+}

package/dist/rooms-tasks/room-state.d.ts

@@ -22,7 +22,7 @@ export declare function advanceSaga(id: string, phase: SagaPhase, stepIndex?: nu
 export declare function setSagaError(id: string, error: string, hint?: string, detail?: ProvisioningDetail): RoomOrchestrationRecord;
 export declare function setRoomIdentity(id: string, roomIdentityCid: string): RoomOrchestrationRecord;
 export declare function setOwnerSeat(id: string, ownerSeatCid: string, inviteFingerprint: string): RoomOrchestrationRecord;
-export declare function updateMemberSeats(id: string, seats: RoomMemberSeat[]): RoomOrchestrationRecord;
+export declare function updateMemberSeats(id: string, seats: RoomMemberSeat[], additionalTemplate?: import('./types.js').TemplateSnapshot): RoomOrchestrationRecord;
 export declare function updateRoomRoleBriefing(id: string, role: string, definition: RoomRoleBriefingDefinition): RoomOrchestrationRecord;
 export declare function updateRoomHistoryCursor(id: string, cursor: number): RoomOrchestrationRecord;
 export declare function updateMemberStartup(id: string, roleName: string, update: {
@@ -31,6 +31,8 @@ export declare function updateMemberStartup(id: string, roleName: string, update
 export declare function activateRoom(id: string): RoomOrchestrationRecord;
 export declare function closeRoom(id: string): RoomOrchestrationRecord;
 export declare function beginRoomClose(id: string): RoomOrchestrationRecord;
-export declare function advanceMemberRetirement(id: string, roleName: string, phase: MemberRetirementPhase, launchId: string, archivePath?: string): RoomOrchestrationRecord;
+export declare function advanceMemberRetirement(id: string, roleName: string, phase: MemberRetirementPhase, launchId: string, archivePath?: string, absenceVerified?: boolean): RoomOrchestrationRecord;
 export declare function advanceRoomClose(id: string, phase: RoomClosePhase): RoomOrchestrationRecord;
 export declare function setRoomCloseError(id: string, error: string, recoveryHint: string): RoomOrchestrationRecord;
+/** Settlement-only binding recovery; never publishes a seat or changes a launch. */
+export declare function recordRetirementMemberCids(id: string, recovered: ReadonlyArray<RoomMemberSeat>): RoomOrchestrationRecord;

package/dist/rooms-tasks/room-state.js

@@ -2,17 +2,28 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from 'node:f
 import { join } from 'node:path';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { stateRoot } from '../paths.js';
+import { planWorkspace, ensureWorkspace } from './workspace.js';
+import { getTask } from './task-state.js';
 import { storedRoomLaunchPolicy } from './types.js';
 import { releaseLaunchSnapshot } from './launch-snapshot.js';
 export const roomsDir = () => join(stateRoot(), 'rooms');
-function roomPath(id) { return join(roomsDir(), `${id}.json`); }
+function roomPath(id) {
+    if (!/^[a-zA-Z0-9_-]{1,120}$/.test(id))
+        throw new RoomStateError('Invalid room ID');
+    return join(roomsDir(), `${id}.json`);
+}
 export class RoomStateError extends Error {
 }
 function readRoom(id) {
     const p = roomPath(id);
-    if (!existsSync(p))
-        throw new RoomStateError(`room not found: ${id}`);
-    return JSON.parse(readFileSync(p, 'utf8'));
+    try {
+        return JSON.parse(readFileSync(p, 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            throw new RoomStateError(`room not found: ${id}`);
+        throw error;
+    }
 }
 function writeRoom(record) {
     mkdirSync(roomsDir(), { recursive: true });
@@ -25,6 +36,8 @@ export function createRoomRecord(input) {
         const requested = storedRoomLaunchPolicy(input.room_policy);
         if (JSON.stringify(before) !== JSON.stringify(requested))
             throw new RoomStateError(`room ${input.room_id} launch policy mismatch`);
+        if (existing.workspace)
+            ensureWorkspace(existing.workspace);
         return existing;
     }
     const record = {
@@ -40,15 +53,20 @@ export function createRoomRecord(input) {
         state: 'provisioning',
         created_at: new Date().toISOString(),
     };
+    record.workspace = input.task_id ? getTask(input.task_id).workspace : planWorkspace('room', input.room_id);
     writeRoom(record);
+    if (record.workspace)
+        ensureWorkspace(record.workspace);
     return record;
 }
 export function getRoomRecord(id) {
     try {
         return readRoom(id);
     }
-    catch {
-        return undefined;
+    catch (error) {
+        if (error instanceof RoomStateError && error.message === `room not found: ${id}`)
+            return undefined;
+        throw error;
     }
 }
 /** Remove a terminal orchestration record from the live room inventory. */
@@ -110,11 +128,13 @@ export function setOwnerSeat(id, ownerSeatCid, inviteFingerprint) {
     writeRoom(r);
     return r;
 }
-export function updateMemberSeats(id, seats) {
+export function updateMemberSeats(id, seats, additionalTemplate) {
     const r = readRoom(id);
     if (r.state === 'closing' || r.state === 'closed')
         throw new RoomStateError(`room ${id} is ${r.state}; member provisioning is fenced`);
     r.member_seats = seats;
+    if (additionalTemplate)
+        r.additional_member_templates = [...(r.additional_member_templates ?? []), additionalTemplate];
     writeRoom(r);
     return r;
 }
@@ -204,7 +224,7 @@ export function beginRoomClose(id) {
 const RETIREMENT_ORDER = [
     'stop_requested', 'liveness_absent', 'archive_secured', 'identity_absent',
 ];
-export function advanceMemberRetirement(id, roleName, phase, launchId, archivePath) {
+export function advanceMemberRetirement(id, roleName, phase, launchId, archivePath, absenceVerified = false) {
     const r = readRoom(id);
     if (r.state !== 'closing')
         throw new RoomStateError(`room ${id} is not closing`);
@@ -221,6 +241,7 @@ export function advanceMemberRetirement(id, roleName, phase, launchId, archivePa
         throw new RoomStateError(`room ${id} member ${roleName} retirement cannot move backward to ${phase}`);
     }
     seat.retirement = {
+        ...(absenceVerified || previous?.absence_verified ? { absence_verified: true } : {}),
         phase,
         launch_id: launchId,
         updated_at: new Date().toISOString(),
@@ -273,3 +294,21 @@ export function setRoomCloseError(id, error, recoveryHint) {
     writeRoom(r);
     return r;
 }
+/** Settlement-only binding recovery; never publishes a seat or changes a launch. */
+export function recordRetirementMemberCids(id, recovered) {
+    const room = readRoom(id);
+    if (room.state !== 'closing')
+        throw new RoomStateError('Room is not closing');
+    for (const proof of recovered) {
+        const seat = room.member_seats.find(value => value.role_name === proof.role_name);
+        if (!seat || seat.launch?.action_id !== proof.launch?.action_id || seat.invite_id !== proof.invite_id)
+            throw new RoomStateError('Member changed during identity recovery');
+        if (!proof.identity_cid)
+            continue;
+        if (seat.identity_cid && seat.identity_cid.toLowerCase() !== proof.identity_cid.toLowerCase())
+            throw new RoomStateError('Member identity changed during recovery');
+        seat.identity_cid = proof.identity_cid;
+    }
+    writeRoom(room);
+    return room;
+}

package/dist/rooms-tasks/task-service-retirement.d.ts

@@ -0,0 +1,11 @@
+import type { Exec } from '../exec.js';
+/** Registration retirement precedes every identity-absence shortcut. A proven
+ * legacy transient/detached launch never owned a retained registration.
+ * Missing state still requires exact catalog ownership before unregistering.
+ */
+export declare function retireTaskMemberService(name: string, expected: {
+    taskId: string;
+    creationActionId?: string;
+    launchId?: string;
+    taskSupervised?: boolean;
+}, exec?: Exec): Promise<void>;

package/dist/rooms-tasks/task-service-retirement.js

@@ -0,0 +1,21 @@
+import { existsSync } from 'node:fs';
+import { agentDir } from '../paths.js';
+import { readTempSupervisor, tempArchiveForCreationAction, tempArchiveForLaunch } from '../temp-lifecycle.js';
+import { unregisterTaskMember, hasTaskMemberRegistration } from '../supervisor/catalog.js';
+import { assertMemberNotPermanent } from './member-ownership.js';
+/** Registration retirement precedes every identity-absence shortcut. A proven
+ * legacy transient/detached launch never owned a retained registration.
+ * Missing state still requires exact catalog ownership before unregistering.
+ */
+export async function retireTaskMemberService(name, expected, exec) {
+    assertMemberNotPermanent(name);
+    const archive = expected.creationActionId ? tempArchiveForCreationAction(name, expected.creationActionId)
+        : expected.launchId ? { path: tempArchiveForLaunch(name, expected.launchId) } : undefined;
+    const source = existsSync(agentDir(name, true)) ? agentDir(name, true) : archive?.path;
+    const metadata = source ? readTempSupervisor(source) : undefined;
+    const hasServiceEvidence = hasTaskMemberRegistration(name);
+    const durableMetadata = metadata?.taskOwner && metadata.kind === 'fleet-managed';
+    if (!hasServiceEvidence && !expected.taskSupervised && !durableMetadata)
+        return;
+    await unregisterTaskMember(name, expected, { exec });
+}

package/dist/rooms-tasks/task-state.d.ts

@@ -1,7 +1,15 @@
-import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent, TaskDeletionActor, TaskDeletionMemberPhase } from './types.js';
+import type { ArchivedMemberAbsence } from './types.js';
+import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent, TaskDeletionActor, TaskDeletionMemberPhase, TaskNotificationEvent } from './types.js';
 export declare const tasksDir: () => string;
 export declare class TaskStateError extends Error {
 }
+/** Atomic snapshots contain the events, including intermediate states between polls. */
+export declare function pendingTaskNotifications(warn?: (line: string) => void): Array<{
+    taskId: string;
+    events: TaskNotificationEvent[];
+}>;
+/** Service event-id dedupe covers acceptance followed by a crash before this acknowledgement. */
+export declare function acknowledgeTaskNotification(id: string, eventId: string): void;
 /**
  * Accepted deletion is the per-task epoch guard: once pending, every lifecycle
  * mutation, terminal settlement, and room publication must fail boundedly.
@@ -17,6 +25,10 @@ export interface CreateTaskInput {
     idempotency_key?: string;
     start?: boolean;
     no_room?: boolean;
+    layout?: {
+        name: string;
+        definition_hash: string;
+    };
     room_id?: string;
     listId?: string;
 }
@@ -61,9 +73,8 @@ export declare function getDeletingTask(id: string): TaskRecord;
 export declare function taskDeletionState(id: string): 'none' | 'pending' | 'absent';
 /**
  * Durable, surface-independent audit evidence for a permanent deletion. The
- * receipt outlives the task record: written with the acceptance intent, and
- * completed before settlement is reported. Metadata only — never brief or
- * room content.
+ * receipt supports in-flight recovery only: written with acceptance intent,
+ * then erased before settlement is reported. It may contain a bounded title.
  */
 export interface TaskDeletionReceipt {
     schema_version: 1;
@@ -74,6 +85,7 @@ export interface TaskDeletionReceipt {
     original_state: TaskState;
     room_id?: string;
     member_count: number;
+    archived_absences?: ArchivedMemberAbsence[];
     settled_at?: string;
     result?: 'deleted';
 }
@@ -86,7 +98,7 @@ export declare function readTaskDeletionReceipt(id: string): TaskDeletionReceipt
  * settlement rather than deleting resources without audit evidence.
  */
 export declare function ensureTaskDeletionReceipt(id: string): void;
-/** Record settlement on the receipt; idempotent, tolerant of legacy absence. */
+/** Erase the in-flight receipt; also heals a crash after task unlink. */
 export declare function completeTaskDeletionReceipt(id: string): void;
 export type TaskDeletionAcceptance = {
     status: 'accepted' | 'pending';
@@ -122,7 +134,13 @@ export declare function advanceTaskDeletionMember(id: string, name: string, phas
 interface SeatEvidence {
     role_name: string;
     identity_cid?: string;
+    launch?: {
+        launch_id?: string;
+        action_id?: string;
+        task_supervised?: boolean;
+    };
     retirement?: {
+        absence_verified?: boolean;
         phase: TaskDeletionMemberPhase;
         launch_id: string;
         archive_path?: string;
@@ -146,14 +164,39 @@ export declare function upsertTaskDeletionMembersFromSeats(id: string, seats: Re
  *
  * The room saga is trusted for phase jumps, but partial or corrupt retained
  * records must not become false success: every seat must be identity_absent;
- * a real launch requires archive evidence; an identity-less seat is accepted
- * only via the never-launched proof.
+ * a real launch requires archive evidence; an identity-less seat requires
+ * never-launched proof or a freshly verified archived-absence checkpoint.
  */
-export declare function importTaskDeletionRetirementEvidence(id: string, seats: ReadonlyArray<SeatEvidence>): TaskRecord;
+export declare function importTaskDeletionRetirementEvidence(id: string, seats: ReadonlyArray<SeatEvidence>, proofs?: ReadonlyArray<ArchivedMemberAbsence>): TaskRecord;
+/** Settlement-only checkpoint, under the task-operation lock after fresh archive verification.
+ * From here retries still verify live absence, but owned archives may be consumed.
+ */
+export declare function beginTaskWorkspaceCleanup(id: string): void;
 /**
  * Physically remove a deletion-pending task record. Settlement-only: callers
  * must have completed member retirement and room cleanup first. Missing
  * records are the idempotent already-settled outcome.
  */
 export declare function unlinkDeletedTask(id: string): boolean;
+/** Called only after current temp and exact identity absence have been checked. */
+export declare function settleAbsentTaskDeletionMember(id: string, name: string): void;
+/** Room-only erasure keeps the parent Task but removes its dead room/member links. */
+export declare function detachDeletedRoom(taskId: string, roomId: string): void;
+/** A completed room may consume its archives while other task members still retire. */
+export declare function beginTaskArchiveCleanup(id: string): void;
+/** Metadata-only edit; compare under the task lock to prevent lost updates. */
+/**
+ * Choose, change or clear a Backlog task's Room Layout before it starts.
+ * `expected` is the layout name the caller saw (null = none); a different
+ * current choice is a stale edit. Choosing a layout drops the sealed room
+ * template plan; the caller releases the returned launch snapshot hash.
+ */
+export declare function updateTaskLayout(id: string, expected: string | null, next: {
+    name: string;
+    definition_hash: string;
+} | null): {
+    task: TaskRecord;
+    releasedSnapshot?: string;
+};
+export declare function updateTaskBrief(id: string, brief: string, expectedBrief: string): TaskRecord;
 export {};