@ours.network/fleet 1.2.0-nightly.62 → 1.2.0-nightly.64

package/README.md

@@ -181,6 +181,9 @@ credentials and rotating refresh credentials; see
 owner-private Unix socket; local processes running as the same OS user are
 therefore inside the trust boundary.
 
+The read-only [conversation event stream](docs/conversation-stream.md) documents
+authentication deadlines, replay coverage, bounded framing and filesystem support.
+
 On first setup, the CLI requires an explicit access choice: `--password-file`
 or `--pairing` for protected access, or `--no-password` for intentional
 unprotected access. `--password-file` stores only a salted scrypt verifier in
@@ -1838,6 +1841,9 @@ See [Room layouts](docs/room-layouts.md) for YAML examples and CLI commands.
 
 Configure the web backend with `OURS_NOTIFICATIONS_ORIGIN` and a Fleet-scoped `OURS_NOTIFICATIONS_PRODUCER_TOKEN`. It reads each local supervisor ledger incrementally with persistent checkpoints under web state, correlating owner browser/channel prompts with terminal completion. Monitor/startup turns do not notify. First installation skips existing history; no agent restart or conversation controller is needed. Persist web state across deployment/restarts. Reads are bounded to 256 KiB per role per tick, and oversized model/media records are skipped across chunks. Expose `/notifications` through the generic authenticated prefix gateway with a server-side user token and `stripBrowserContext: true`; producer tokens stay server-side. All browser sessions of this single-owner console map to one stable notification account. See [ours-notifications](https://github.com/adapt-toolkit/ours-notifications) for configuration/API/release details.
 
+New agent notifications and confirmed role retirement use `/fleet/chats/agents/:roleId`, with each ID escaped once and matching message anchors retained. Deploy the app, notification service, and producers together: old query-based conversation links are intentionally unsupported. Existing pending payload URLs are replayed unchanged for idempotency; obsolete cleanup targets remain stored without being sent or treated as proof of absence. Task management notification paths are unchanged.
+
+
 Existing-host enrollment: `ours-fleet workspace-enroll --file <private-file> --preserve-profile` requires Messenger to advertise preservation support before any enrollment POST. It omits Name/Surname and leaves existing/absent profile untouched. Existing Fleet models and agents are retained; the installer must skip init when its configuration exists. Signed root proof, tunnel setup and device QR issuance remain the normal enrollment flow. Older Messenger fails closed and requires its preservation-capable release.
 
 ### Connect an installed host to the App

package/dist/application/conversation-history.js

@@ -68,6 +68,7 @@ export async function conversationTailPage(stateDir, request, snapshot, resumedS
     const events = [];
     let newest;
     let hasOlder = false;
+    const barrier = snapshot.ledgerBarrier;
     const pending = new Set(snapshot.pendingPermissionIds);
     let capabilities;
     const context = [];
@@ -94,6 +95,8 @@ export async function conversationTailPage(stateDir, request, snapshot, resumedS
             const seq = Number(event.seq);
             if (!Number.isSafeInteger(seq))
                 return true;
+            if (barrier !== undefined && seq > barrier)
+                return true;
             newest ??= seq;
             if (seq < before && conversationEventVisible(event, snapshot.sessionGeneration, resumedSessionId)) {
                 const inPage = !hasOlder && events.length < limit;
@@ -120,7 +123,7 @@ export async function conversationTailPage(stateDir, request, snapshot, resumedS
     context.reverse();
     return { events, snapshot, hasOlder, context, hasMore: false,
         ...(events.length ? { olderCursor: String(events[0].seq) } : {}),
-        ...(before === Infinity && newest !== undefined ? { nextCursor: String(newest) } : {}) };
+        ...(before === Infinity && (barrier !== undefined || newest !== undefined) ? { nextCursor: String(barrier ?? newest) } : {}) };
 }
 /** Read the existing ACP session ledger without opening its writer/recovery store. */
 export async function resumedConversationPage(stateDir, request, live, expectedSessionId) {

package/dist/application/conversation-role-observer.d.ts

@@ -0,0 +1,62 @@
+import { type FSWatcher } from 'node:fs';
+import { type SessionBackendId } from '../config.js';
+export interface ConversationRoleState {
+    roleId: string;
+    /** Connection-owned ordering; never a session stateRevision. */
+    roleRevision: number;
+    roleLifetime: string;
+    availability: 'available' | 'unavailable' | 'missing';
+    fallbackHarness?: string;
+    backend?: SessionBackendId;
+    stateDir?: string;
+    health: 'healthy' | 'unsupported' | 'failed';
+    failure?: 'watch-unsupported' | 'watch-error' | 'watch-closed' | 'role-read-failed' | 'observer-disposed';
+}
+export interface ConversationRoleObservation {
+    snapshot(): ConversationRoleState;
+    subscribe(listener: (state: ConversationRoleState) => void): {
+        snapshot: ConversationRoleState;
+        unsubscribe(): void;
+    };
+    dispose(): void;
+}
+export type ObserveConversationRole = (listener: (state: ConversationRoleState) => void) => ConversationRoleObservation;
+export interface ConversationRoleObserverOptions {
+    roleId: string;
+    configPath?: string;
+    permanentRoot?: string;
+    temporaryRoot?: string;
+    watch?: (path: string, listener: (event: string, filename: string | null) => void) => Pick<FSWatcher, 'on' | 'close'>;
+    subscribeMutations?: (listener: () => void) => () => void;
+}
+/** Native directory notifications are assumed reliable on qualified host/mount setups.
+ * No periodic reads or claim of detecting every silently dropped filesystem event.
+ */
+export declare class ConversationRoleObserver implements ConversationRoleObservation {
+    private readonly options;
+    private readonly listener;
+    private state;
+    private watchers;
+    private detach?;
+    private disposed;
+    private readonly listeners;
+    private queued;
+    private fingerprint?;
+    private readonly configPath;
+    private readonly permanent;
+    private readonly temporary;
+    constructor(options: ConversationRoleObserverOptions, listener: (state: ConversationRoleState) => void);
+    snapshot(): ConversationRoleState;
+    subscribe(listener: (state: ConversationRoleState) => void): {
+        snapshot: ConversationRoleState;
+        unsubscribe: () => void;
+    };
+    private publish;
+    dispose(): void;
+    private release;
+    private fail;
+    private schedule;
+    private refresh;
+    private install;
+    private watchFailure;
+}

package/dist/application/conversation-role-observer.js

@@ -0,0 +1,206 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { lstatSync, readFileSync, realpathSync, watch } from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
+import { parse } from 'yaml';
+import { loadConfig, ROLE_NAME_RE, splitRootFor } from '../config.js';
+import { agentsRoot, defaultConfigPath, tmpRoot } from '../paths.js';
+import { controlSocketPath } from '../session/control.js';
+function identity(path) {
+    try {
+        const s = lstatSync(path);
+        return `${s.dev}:${s.ino}:${s.birthtimeMs}`;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+}
+/** Native directory notifications are assumed reliable on qualified host/mount setups.
+ * No periodic reads or claim of detecting every silently dropped filesystem event.
+ */
+export class ConversationRoleObserver {
+    options;
+    listener;
+    state;
+    watchers = new Map();
+    detach;
+    disposed = false;
+    listeners = new Set();
+    queued = false;
+    fingerprint;
+    configPath;
+    permanent;
+    temporary;
+    constructor(options, listener) {
+        this.options = options;
+        this.listener = listener;
+        if (!ROLE_NAME_RE.test(options.roleId))
+            throw new Error('invalid role id');
+        this.configPath = resolve(options.configPath ?? defaultConfigPath());
+        this.permanent = resolve(options.permanentRoot ?? agentsRoot(), options.roleId);
+        this.temporary = resolve(options.temporaryRoot ?? tmpRoot(), options.roleId);
+        this.state = { roleId: options.roleId, roleRevision: 0, roleLifetime: randomUUID(), availability: 'missing', health: 'healthy' };
+        this.refresh();
+        if (this.state.health === 'healthy')
+            this.detach = options.subscribeMutations?.(() => this.schedule());
+    }
+    snapshot() {
+        return this.disposed ? { ...this.state, health: 'failed', failure: 'observer-disposed' } : { ...this.state };
+    }
+    subscribe(listener) {
+        if (!this.disposed)
+            this.listeners.add(listener);
+        return { snapshot: this.snapshot(), unsubscribe: () => { this.listeners.delete(listener); } };
+    }
+    publish() {
+        this.listener(this.snapshot());
+        for (const listener of this.listeners)
+            listener(this.snapshot());
+    }
+    dispose() {
+        if (this.disposed)
+            return;
+        this.disposed = true;
+        this.release();
+        this.listeners.clear();
+    }
+    release() {
+        const retired = [...this.watchers.values()];
+        // Retire before close: native close events may arrive synchronously or later.
+        this.watchers.clear();
+        for (const watcher of retired)
+            watcher.handle.close();
+        this.detach?.();
+        this.detach = undefined;
+    }
+    fail(failure) {
+        if (this.disposed || this.state.health !== 'healthy')
+            return;
+        this.state = { ...this.state, roleRevision: this.state.roleRevision + 1, health: failure === 'watch-unsupported' ? 'unsupported' : 'failed', failure };
+        this.release();
+        this.publish();
+    }
+    schedule() {
+        if (this.queued || this.disposed || this.state.health !== 'healthy')
+            return;
+        this.queued = true;
+        queueMicrotask(() => { this.queued = false; if (!this.disposed && this.state.health === 'healthy')
+            this.refresh(); });
+    }
+    refresh() {
+        try {
+            // Install parents before reading, including absent children, so atomic rename
+            // and recreation cannot strand us watching an unlinked inode.
+            this.install();
+            if (this.state.health !== 'healthy')
+                return;
+            let configured;
+            const split = splitRootFor(this.configPath);
+            if (identity(this.configPath) && identity(split) && identity(join(split, 'agents')))
+                configured = loadConfig(this.configPath).roles.find(role => role.name === this.options.roleId);
+            const permanentId = identity(this.permanent), temporaryId = identity(this.temporary);
+            const stateDir = temporaryId ? realpathSync(this.temporary) : permanentId ? realpathSync(this.permanent) : undefined;
+            let temporary;
+            if (!configured && temporaryId && identity(join(this.temporary, 'role.yaml'))) {
+                const raw = parse(readFileSync(join(this.temporary, 'role.yaml'), 'utf8'));
+                if (!raw || typeof raw !== 'object' || Array.isArray(raw)
+                    || (raw.session !== undefined && raw.session !== 'acp' && raw.session !== 'codex-app-server'))
+                    throw new Error('invalid temporary role snapshot');
+                temporary = { session: raw.session ?? 'acp', harness: typeof raw.harness === 'string' ? raw.harness : 'claude-code' };
+            }
+            const backend = configured?.session ?? temporary?.session;
+            const fallbackHarness = configured?.harness ?? temporary?.harness;
+            const socket = stateDir ? identity(controlSocketPath(stateDir)) : undefined;
+            const tokenPath = stateDir && join(stateDir, '.control-token');
+            const token = tokenPath && identity(tokenPath) ? createHash('sha256').update(readFileSync(tokenPath)).digest('hex') : undefined;
+            const exists = Boolean(configured || permanentId || temporaryId);
+            const availability = !exists ? 'missing' : stateDir && socket && token && backend ? 'available' : 'unavailable';
+            const fingerprint = JSON.stringify([Boolean(configured), permanentId, temporaryId, backend, socket, token]);
+            const lifetime = this.fingerprint === fingerprint ? this.state.roleLifetime : randomUUID();
+            this.fingerprint = fingerprint;
+            const next = { roleId: this.options.roleId, roleRevision: this.state.roleRevision, roleLifetime: lifetime,
+                availability, fallbackHarness, backend, stateDir, health: 'healthy' };
+            if (JSON.stringify(next) !== JSON.stringify(this.state)) {
+                this.state = { ...next, roleRevision: this.state.roleRevision + 1 };
+                this.publish();
+            }
+        }
+        catch {
+            this.fail('role-read-failed');
+        }
+    }
+    install() {
+        const wanted = new Map();
+        const add = (dir, child) => {
+            if (child === undefined)
+                wanted.set(dir, null);
+            else if (wanted.get(dir) !== null) {
+                const names = wanted.get(dir) ?? new Set();
+                names.add(child);
+                wanted.set(dir, names);
+            }
+        };
+        const parents = (path, boundary) => {
+            while (path !== boundary && dirname(path) !== path) {
+                add(dirname(path), basename(path));
+                path = dirname(path);
+            }
+        };
+        const configRoot = splitRootFor(this.configPath);
+        const configBoundary = dirname(dirname(this.configPath));
+        parents(this.configPath, configBoundary);
+        for (const dir of [configRoot, ...['agents', 'brains', 'roles', 'agent_templates'].map(kind => join(configRoot, kind))]) {
+            parents(dir, configBoundary);
+            add(dir);
+        }
+        for (const dir of [this.permanent, this.temporary]) {
+            parents(dir, dirname(dirname(dirname(dir))));
+            for (const name of ['role.yaml', '.control-token', '.control.sock'])
+                add(dir, name);
+            const socket = controlSocketPath(dir);
+            parents(socket, dirname(dirname(socket)));
+        }
+        for (const [dir, current] of this.watchers) {
+            if (!wanted.has(dir) || identity(dir) !== current.identity) {
+                this.watchers.delete(dir);
+                current.handle.close();
+            }
+        }
+        for (const [dir, names] of wanted) {
+            const id = identity(dir);
+            if (!id)
+                continue;
+            const existing = this.watchers.get(dir);
+            if (existing) {
+                existing.names = names;
+                continue;
+            }
+            try {
+                const handle = (this.options.watch ?? ((path, listener) => watch(path, { persistent: false }, listener)))(dir, (_event, filename) => {
+                    const entry = this.watchers.get(dir);
+                    if (filename === null || !entry?.names || entry.names.has(String(filename)) || String(filename) === basename(dir))
+                        this.schedule();
+                });
+                this.watchers.set(dir, { identity: id, names, handle });
+                handle.on('error', (error) => {
+                    if (this.watchers.get(dir)?.handle === handle)
+                        this.watchFailure(error);
+                });
+                handle.on('close', () => {
+                    if (this.watchers.get(dir)?.handle !== handle)
+                        return;
+                    this.watchers.delete(dir);
+                    this.fail('watch-closed');
+                });
+            }
+            catch (error) {
+                this.watchFailure(error);
+                return;
+            }
+        }
+    }
+    watchFailure(error) {
+        this.fail(['ENOSYS', 'ENOTSUP', 'ERR_FEATURE_UNAVAILABLE_ON_PLATFORM'].includes(error.code ?? '') ? 'watch-unsupported' : 'watch-error');
+    }
+}

package/dist/application/role-removal-service.js

@@ -94,7 +94,7 @@ export class RoleRemovalService {
             await this.options.ops.backend.uninstall(preview.role);
             if (existsSync(sourceState))
                 renameSync(sourceState, join(recoveryPath, 'orphan-state'));
-            await retireNotificationTarget(`/fleet/chats?chat=${encodeURIComponent(preview.role)}`).catch(() => { });
+            await retireNotificationTarget(`/fleet/chats/agents/${encodeURIComponent(preview.role)}`).catch(() => { });
             this.options.ops.log(`removed orphaned backend/state '${preview.role}'`);
         }
         return { ...preview, removed: true, recoveryPath };

package/dist/application/session-control.d.ts

@@ -1,8 +1,10 @@
+import type { ConversationRoleObservation, ConversationRoleState, ObserveConversationRole } from './conversation-role-observer.js';
 import { type ConversationTailPage } from './conversation-history.js';
 import type { AgentHistoryQuery } from '../agent-ours/correspondence.js';
-import { controlRequest } from '../session/control.js';
-import type { ConversationEventV1, ConversationSnapshot, PromptReceipt } from '../session/conversation-types.js';
+import { controlRequest, followConversation } from '../session/control.js';
+import type { ConversationEventV1, ConversationSnapshot, ConversationObservationState, PromptReceipt } from '../session/conversation-types.js';
 import type { SessionSnapshot } from '../session/types.js';
+import type { PassiveConversationFollowRequest, ConversationReplayPage, ConversationReplayReady } from '../session/conversation-replay.js';
 import type { OutputPage, SendReceipt, SessionDescriptor } from './types.js';
 export interface ConversationPageView {
     events: ConversationEventV1[];
@@ -14,6 +16,23 @@ export interface ConversationPageView {
 export interface ConversationFollowHandle {
     close(): void;
 }
+export interface LegacyConversationFollowRequest {
+    after?: string;
+    onPage(page: ConversationPageView): void;
+    onEvent(event: ConversationEventV1): void;
+    onClose(reason?: string): void;
+}
+export interface PassiveConversationFollow extends PassiveConversationFollowRequest {
+    /** Reports role updates from the owned or borrowed observer; never attaches a controller. */
+    onRole?(state: ConversationRoleState): void;
+    /** Application-only borrowed owner; never sent over the private wire. */
+    roleObservation?: ConversationRoleObservation;
+    onReplay(page: ConversationReplayPage): void;
+    onReady(ready: ConversationReplayReady): void;
+    onEvent(event: ConversationEventV1): void;
+    onState(state: ConversationObservationState): void;
+    onClose(reason?: string): void;
+}
 /**
  * An interrupt that reached the session. `state` says whether the turn stopped
  * cooperatively or through bounded forced recovery — both are accepted, so no
@@ -25,9 +44,11 @@ export interface InterruptReceipt {
     reasonCode?: string;
 }
 export interface RoleSessionControl {
+    /** Standalone owner for role-only observation; dispose with that connection. */
+    observeRole?: ObserveConversationRole;
     agentContacts?(): Promise<unknown>;
     agentHistory?(request: AgentHistoryQuery): Promise<unknown>;
-    describe(): Promise<SessionDescriptor>;
+    describe(roleObservation?: ConversationRoleObservation): Promise<SessionDescriptor>;
     snapshot(): Promise<SessionSnapshot>;
     recentOutput(request?: {
         since?: number;
@@ -80,21 +101,19 @@ export interface RoleSessionControl {
      * replay page; `onEvent` every subsequent durable event; `onClose` fires
      * exactly once when the underlying control stream ends.
      */
-    followConversation?(request: {
-        after?: string;
-        onPage(page: ConversationPageView): void;
-        onEvent(event: ConversationEventV1): void;
-        onClose(reason?: string): void;
-    }): Promise<ConversationFollowHandle>;
+    followConversation?(request: LegacyConversationFollowRequest | PassiveConversationFollow): Promise<ConversationFollowHandle>;
 }
 export declare class RoleSessionControlAdapter implements RoleSessionControl {
     private readonly stateDir;
     private readonly request;
-    constructor(stateDir: string, request?: typeof controlRequest);
+    private readonly openFollow;
+    readonly observeRole?: ObserveConversationRole | undefined;
+    private controlHealthy;
+    constructor(stateDir: string, request?: typeof controlRequest, openFollow?: typeof followConversation, observeRole?: ObserveConversationRole | undefined);
     agentContacts(): Promise<unknown>;
     agentHistory(request: AgentHistoryQuery): Promise<unknown>;
     private requireCorrespondence;
-    describe(): Promise<SessionDescriptor>;
+    describe(roleObservation?: ConversationRoleObservation): Promise<SessionDescriptor>;
     snapshot(): Promise<SessionSnapshot>;
     recentOutput(request?: {
         since?: number;
@@ -135,12 +154,7 @@ export declare class RoleSessionControlAdapter implements RoleSessionControl {
         accepted: true;
         commandId: string;
     }>;
-    followConversation(request: {
-        after?: string;
-        onPage(page: ConversationPageView): void;
-        onEvent(event: ConversationEventV1): void;
-        onClose(reason?: string): void;
-    }): Promise<ConversationFollowHandle>;
+    followConversation(request: LegacyConversationFollowRequest | PassiveConversationFollow): Promise<ConversationFollowHandle>;
     respondPermission(request: {
         permissionId: string;
         optionId: string;

package/dist/application/session-control.js

@@ -7,21 +7,36 @@ const visibleEvents = (events) => events.filter(event => event.kind !== 'thought
 export class RoleSessionControlAdapter {
     stateDir;
     request;
-    constructor(stateDir, request = controlRequest) {
+    openFollow;
+    observeRole;
+    controlHealthy = true;
+    constructor(stateDir, request = controlRequest, openFollow = followConversation, observeRole) {
         this.stateDir = stateDir;
         this.request = request;
+        this.openFollow = openFollow;
+        this.observeRole = observeRole;
     }
     async agentContacts() { await this.requireCorrespondence(); return this.call('agent_contacts'); }
     async agentHistory(request) { await this.requireCorrespondence(); return this.call('agent_history', { agentHistory: request }); }
     async requireCorrespondence() { if (!(await this.describe()).features.includes('agent_correspondence'))
         throw new FleetError('capability_unavailable', 'This session needs an updated supervisor to show contacts and history.'); }
-    async describe() {
-        const response = await this.call('snapshot');
-        const result = response;
-        return {
-            backend: result.backend, protocolVersion: result.protocolVersion ?? 1,
-            features: result.features ?? [], snapshot: result,
-        };
+    async describe(roleObservation) {
+        // A describe probe owns and always disposes its temporary watcher. Follow uses
+        // a separate connection-owned observer and publishes updates via onRole.
+        const role = roleObservation ?? this.observeRole?.(() => { });
+        try {
+            const response = await this.call('snapshot');
+            const result = response;
+            const features = (result.features ?? []).filter(feature => feature !== 'conversation_live_complete');
+            if (this.controlHealthy && role?.snapshot().health === 'healthy' && role.snapshot().availability === 'available'
+                && features.includes('conversation_observation') && features.includes('control_heartbeat'))
+                features.push('conversation_live_complete');
+            return { backend: result.backend, protocolVersion: result.protocolVersion ?? 1, features, snapshot: result };
+        }
+        finally {
+            if (!roleObservation)
+                role?.dispose();
+        }
     }
     async snapshot() {
         return await this.call('snapshot');
@@ -81,22 +96,30 @@ export class RoleSessionControlAdapter {
         }
     }
     async conversationTail(request = {}) {
-        const live = await this.call('conversation_page', { limit: 1 });
-        const snapshot = await this.snapshot();
-        let resumed;
-        if (snapshot.backend === 'acp' && snapshot.sessionId) {
+        // A replacement while reading disk invalidates both the tail and its snapshot.
+        for (let attempt = 0; attempt < 3; attempt++) {
+            const live = await this.call('conversation_page', { limit: 1 });
+            const snapshot = await this.snapshot();
+            let resumed;
+            if (snapshot.backend === 'acp' && snapshot.sessionId) {
+                try {
+                    if ((await readFile(join(this.stateDir, '.acp-session-id'), 'utf8')).trim() === snapshot.sessionId)
+                        resumed = snapshot.sessionId;
+                }
+                catch { /* no resumed history: live generation only */ }
+            }
+            let page;
             try {
-                if ((await readFile(join(this.stateDir, '.acp-session-id'), 'utf8')).trim() === snapshot.sessionId)
-                    resumed = snapshot.sessionId;
+                page = await conversationTailPage(this.stateDir, request, live.snapshot, resumed);
             }
-            catch { /* no resumed history: live generation only */ }
-        }
-        try {
-            return await conversationTailPage(this.stateDir, request, live.snapshot, resumed);
-        }
-        catch (error) {
-            throw new FleetError('invalid_request', error.message);
+            catch (error) {
+                throw new FleetError('invalid_request', error.message);
+            }
+            const check = await this.call('conversation_page', { limit: 1 });
+            if (check.snapshot.sessionGeneration === live.snapshot.sessionGeneration)
+                return page;
         }
+        throw new FleetError('stale_state', 'Session generation changed during conversation baseline; explicit recovery required.');
     }
     async submitPromptV2(request) {
         if (!request.text.trim())
@@ -170,32 +193,124 @@ export class RoleSessionControlAdapter {
         }
     }
     async followConversation(request) {
+        const passive = 'controller' in request ? request : undefined;
         let sawPage = false;
         let closed = false;
+        let role;
+        let unsubscribeRole;
+        let lifetime;
+        let roleRevision = -1;
+        let silence;
+        let lastControlHeartbeat = Date.now();
+        const armSilence = () => {
+            if (silence)
+                clearTimeout(silence);
+            silence = setTimeout(() => {
+                // Liveness only: no role/session snapshots, regardless of web traffic.
+                if (Date.now() - lastControlHeartbeat >= 6_000) {
+                    this.controlHealthy = false;
+                    finish('control-silent');
+                }
+                else
+                    armSilence();
+            }, Math.max(1, 6_000 - (Date.now() - lastControlHeartbeat)));
+            silence.unref?.();
+        };
+        let follow;
         const finish = (reason) => {
             if (closed)
                 return;
             closed = true;
+            passive?.signal?.removeEventListener('abort', aborted);
+            if (silence)
+                clearTimeout(silence);
+            unsubscribeRole?.();
+            if (!passive?.roleObservation)
+                role?.dispose();
+            follow?.close();
             request.onClose(reason);
         };
-        const follow = await followConversation(this.stateDir, request.after, message => {
-            if (message.conversationEvent) {
-                request.onEvent(message.conversationEvent);
-                return;
+        const aborted = () => finish('conversation follow aborted');
+        passive?.signal?.addEventListener('abort', aborted, { once: true });
+        if (passive?.signal?.aborted)
+            aborted();
+        if (closed)
+            return { close: () => { } };
+        try {
+            if (passive) {
+                const changed = (state) => {
+                    if (closed || state.roleRevision <= roleRevision)
+                        return;
+                    roleRevision = state.roleRevision;
+                    passive.onRole?.(state);
+                    if (state.health !== 'healthy') {
+                        this.controlHealthy = false;
+                        finish(state.failure ?? 'role-observation-unavailable');
+                    }
+                    else if (lifetime !== undefined && (state.roleLifetime !== lifetime || state.availability !== 'available' || state.stateDir !== this.stateDir))
+                        finish('role-replaced');
+                    lifetime = state.roleLifetime;
+                };
+                role = passive.roleObservation ?? this.observeRole?.(() => { });
+                if (role) {
+                    const registration = role.subscribe(changed);
+                    unsubscribeRole = registration.unsubscribe;
+                    const initial = registration.snapshot;
+                    changed(initial);
+                    if (initial.availability !== 'available' || initial.stateDir !== this.stateDir)
+                        finish('role-unavailable');
+                    if (closed)
+                        return { close: () => { } };
+                }
+                armSilence();
             }
-            if (!sawPage) {
-                sawPage = true;
+            follow = await this.openFollow(this.stateDir, passive ? { controller: false, expectedGeneration: passive.expectedGeneration, after: passive.after, signal: passive.signal } : request.after, message => {
+                if (closed)
+                    return;
+                if (passive && message.controlHeartbeat === true) {
+                    lastControlHeartbeat = Date.now();
+                    this.controlHealthy = true;
+                    armSilence();
+                    return;
+                }
                 if (message.ok === false) {
                     finish(String(message.error ?? 'conversation follow refused'));
-                    follow.close();
                     return;
                 }
-                request.onPage(message.result);
+                if (message.conversationEvent) {
+                    request.onEvent(message.conversationEvent);
+                    return;
+                }
+                if (passive) {
+                    if (message.conversationReplay)
+                        passive.onReplay(message.conversationReplay);
+                    else if (message.conversationReady)
+                        passive.onReady(message.conversationReady);
+                    else if (message.conversationState)
+                        passive.onState(message.conversationState);
+                }
+                else if (!sawPage) {
+                    sawPage = true;
+                    request.onPage(message.result);
+                }
+            });
+            // Abort may win while the connector is still creating its handle.
+            if (closed || passive?.signal?.aborted) {
+                follow.close();
+                finish('conversation follow aborted');
             }
-        });
-        follow.socket.once('close', () => finish());
-        follow.socket.once('error', error => finish(error.message));
-        return { close: () => { follow.close(); finish(); } };
+            else {
+                follow.socket.once('close', () => finish());
+                follow.socket.once('error', error => finish(error.message));
+                if (follow.socket.destroyed)
+                    finish();
+            }
+            return { close: () => finish() };
+        }
+        catch (error) {
+            finish(error.message);
+            throw error;
+        }
     }
     async respondPermission(request) {
         await this.call('respond_permission', request);

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.62",
-  "buildId": "dbb6bd7e2ef8",
-  "commit": "9162af7adc2521d0e1d5cbd79757919dfff402e3",
+  "version": "1.2.0-nightly.64",
+  "buildId": "2c1e4fbdd573",
+  "commit": "b239e42b7564298704a0651d766667ac43adcc9a",
   "dirty": true,
-  "builtAt": "2026-10-13T21:20:26.416Z",
+  "builtAt": "2026-10-15T18:18:33.495Z",
   "capabilities": [
     "managed-cli.codex-reasoning-effort-v1",
     "managed-cli.setup-v1",