@ours.network/fleet 1.2.0-nightly.66 → 1.2.0-nightly.68

package/README.md

@@ -299,6 +299,7 @@ ours-fleet loops reload <Role>
 ours-fleet loops run-now|disable|enable <Role> <Loop>
 ours-fleet rm <Name>
 ours-fleet doctor [--harness H]
+ours-fleet service check|refresh [--json]   service definitions vs this release (refresh never starts or restarts)
 ours-fleet managed-cli setup [--enable <Agent>]... | status [--json]   native harness policy for the task workflow
 ours-fleet version [--json]         build identity, capabilities, installs on PATH
 ours-fleet init
@@ -326,6 +327,28 @@ is prepared the same way but not yet qualified. Scope, boundaries, unsupported
 combinations and the evidence are in
 [docs/validation/managed-cli-permissions.md](docs/validation/managed-cli-permissions.md).
 
+### Service definitions after an update
+
+`ours-fleet init`, `web install` and the watchdog installer write user service
+definitions (systemd units on Linux, LaunchAgents on macOS) that start the exact
+release tree they were written from. An update installs a new tree, but a running
+service keeps its code, and an unrefreshed definition starts the previous release
+again after the next reboot while agents and the CLI use the new one.
+
+```sh
+ours-fleet service check     # read-only; exit 1 when a definition or running service uses another release
+ours-fleet service refresh   # re-point existing definitions at this release
+```
+
+`refresh` changes only the release paths in definitions Fleet generated. It keeps
+environment, profile, ports and drop-ins, runs `daemon-reload`, and never creates,
+enables, starts, stops or restarts a service. Definitions that Fleet did not
+generate, or whose `ExecStart` a drop-in overrides, are reported and left alone.
+A running supervisor still uses its old code until you restart it
+(`systemctl --user restart ours-fleet.service`); its agents resume through it.
+`ours-install` runs `refresh` after updating Fleet, and `doctor` shows the same
+rows as `check`.
+
 ### Which build am I running?
 
 `--version` prints a semver, and a semver does not identify an artifact: version

package/dist/atomic-file.d.ts

@@ -1,3 +1,4 @@
+import { type IncarnationProbe } from './process-incarnation.js';
 /**
  * Cross-process file protection: a lock, and a replace that cannot leave a
  * partial file behind.
@@ -12,6 +13,22 @@ export interface LockDeps {
     sleep?(ms: number): Promise<void>;
     /** Test hook after a complete private claim is prepared, before atomic publication. */
     beforePublish?(): void | Promise<void>;
+    /** Test seam for PID liveness; defaults to signal 0. */
+    alive?(pid: number): boolean;
+    /** Test seam for boot id and process start markers. */
+    incarnation?: IncarnationProbe;
+    /** Test hook inside the reclaim section, before the dead holder is re-read. */
+    beforeReclaim?(): void;
+}
+/**
+ * A live holder recorded without process-incarnation markers by a release that
+ * predates them. Its PID may be reused, so the lock can be neither trusted nor
+ * removed; the caller fails with the path instead of waiting forever.
+ */
+export declare class FileLockOwnerUnverifiableError extends Error {
+    readonly lockPath: string;
+    readonly pid: number;
+    constructor(lockPath: string, pid: number);
 }
 /** The syscalls a replace depends on, injectable so faults can be forced deterministically. */
 export interface WriteDeps {

package/dist/atomic-file.js

@@ -1,6 +1,24 @@
 import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, writeSync, } from 'node:fs';
 import { basename, dirname, join } from 'node:path';
 import { randomUUID } from 'node:crypto';
+import { incarnationEnded, procIncarnationProbe, processIncarnation, } from './process-incarnation.js';
+/**
+ * A live holder recorded without process-incarnation markers by a release that
+ * predates them. Its PID may be reused, so the lock can be neither trusted nor
+ * removed; the caller fails with the path instead of waiting forever.
+ */
+export class FileLockOwnerUnverifiableError extends Error {
+    lockPath;
+    pid;
+    constructor(lockPath, pid) {
+        super(`lock ${lockPath} is held by PID ${pid}, recorded without a boot or start marker by an older `
+            + 'release, so it can be neither trusted nor proved stale; it was left in place. Inspect PID '
+            + `${pid}: the lock may be removed only once that process is proved not to be the Fleet process `
+            + 'that wrote it.');
+        this.lockPath = lockPath;
+        this.pid = pid;
+    }
+}
 function fsyncDirectory(dir) {
     const dirFd = openSync(dir, 'r');
     try {
@@ -11,6 +29,7 @@ function fsyncDirectory(dir) {
     }
 }
 const DEFAULT_STALE_MS = 10_000;
+const SYNCHRONOUS_LOCK_TIMEOUT = 'Timed out acquiring synchronous journal lock';
 const POLL_MS = 25;
 /**
  * Run `fn` holding a cross-process lock. A fully populated private claim directory
@@ -23,16 +42,40 @@ const POLL_MS = 25;
 export async function withFileLock(lockPath, fn, deps = {}, staleMs = DEFAULT_STALE_MS) {
     const now = deps.now ?? (() => Date.now());
     const sleep = deps.sleep ?? ((ms) => new Promise(r => { setTimeout(r, ms); }));
+    const probe = deps.incarnation ?? procIncarnationProbe;
+    const alive = deps.alive ?? ((pid) => { try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    } });
     const stampPath = join(lockPath, 'ts');
     const ownerPath = join(lockPath, 'owner.json');
+    const reclaimPath = `${lockPath}.reclaim`;
     const token = randomUUID();
     mkdirSync(dirname(lockPath), { recursive: true });
+    /** The exact bytes that identify one holder, so a reclaim never removes its successor. */
+    const holder = () => {
+        let owner = '', stamp = '';
+        try {
+            owner = readFileSync(ownerPath, 'utf8');
+        }
+        catch { /* legacy or incomplete lock */ }
+        try {
+            stamp = readFileSync(stampPath, 'utf8');
+        }
+        catch { /* holder died between mkdir and stamp */ }
+        return owner || stamp ? `${stamp}\0${owner}` : null;
+    };
     for (let waited = 0;;) {
         const claimPath = `${lockPath}.claim.${process.pid}.${randomUUID()}`;
         try {
             mkdirSync(claimPath);
             writeFileSync(join(claimPath, 'ts'), String(now()));
-            writeFileSync(join(claimPath, 'owner.json'), JSON.stringify({ token, pid: process.pid }));
+            writeFileSync(join(claimPath, 'owner.json'), JSON.stringify({
+                token, pid: process.pid, ...processIncarnation(process.pid, probe),
+            }));
             await deps.beforePublish?.();
             renameSync(claimPath, lockPath);
             break;
@@ -41,6 +84,7 @@ export async function withFileLock(lockPath, fn, deps = {}, staleMs = DEFAULT_ST
             rmSync(claimPath, { recursive: true, force: true });
             if (!['EEXIST', 'ENOTEMPTY'].includes(e.code ?? ''))
                 throw e;
+            const observed = holder();
             let held = null;
             try {
                 const n = parseInt(readFileSync(stampPath, 'utf8').trim(), 10);
@@ -48,21 +92,23 @@ export async function withFileLock(lockPath, fn, deps = {}, staleMs = DEFAULT_ST
             }
             catch { /* holder died between mkdir and stamp */ }
             let ownerAlive = false;
+            let unverifiable;
             try {
                 const owner = JSON.parse(readFileSync(ownerPath, 'utf8'));
+                // A reused PID is not the holder: a lock written before a reboot, or by
+                // a process that has since exited, must not block every later caller.
                 if (typeof owner.pid === 'number') {
-                    try {
-                        process.kill(owner.pid, 0);
-                        ownerAlive = true;
-                    }
-                    catch { /* dead owner */ }
+                    ownerAlive = alive(owner.pid) && !incarnationEnded(owner.pid, owner, probe);
+                    if (ownerAlive && owner.boot === undefined && owner.start === undefined && probe.bootId())
+                        unverifiable = owner.pid;
                 }
             }
             catch { /* legacy or incomplete lock */ }
-            if (!ownerAlive && ((held !== null && now() - held > staleMs) || waited > staleMs * 2)) {
-                rmSync(lockPath, { recursive: true, force: true }); // break a dead holder's lock
+            const expired = (held !== null && now() - held > staleMs) || waited > staleMs * 2;
+            if (!ownerAlive && expired && reclaimDeadHolder(reclaimPath, lockPath, observed, holder, deps))
                 continue;
-            }
+            if (unverifiable !== undefined && expired && waited > staleMs * 2)
+                throw new FileLockOwnerUnverifiableError(lockPath, unverifiable);
             await sleep(POLL_MS);
             waited += POLL_MS;
         }
@@ -79,6 +125,30 @@ export async function withFileLock(lockPath, fn, deps = {}, staleMs = DEFAULT_ST
         catch { /* never remove a lock whose ownership cannot be proved */ }
     }
 }
+/**
+ * Remove a dead holder's lock only while it is still that holder's. Contenders
+ * that observed the same dead holder serialize through a bakery lock, whose
+ * claims are per-process files removed only when their process is provably
+ * gone, never by age. Inside it the holder is re-read, so a reclaimer that was
+ * descheduled after observing the dead holder cannot delete the lock a faster
+ * contender has since claimed.
+ */
+function reclaimDeadHolder(reclaimPath, lockPath, observed, holder, deps) {
+    try {
+        withSynchronousFileLock(reclaimPath, () => {
+            deps.beforeReclaim?.();
+            if (holder() === observed)
+                rmSync(lockPath, { recursive: true, force: true });
+        });
+        return true;
+    }
+    catch (error) {
+        // A live contender stalled inside the section: wait like any other poll.
+        if (!(error instanceof Error) || error.message !== SYNCHRONOUS_LOCK_TIMEOUT)
+            throw error;
+        return false;
+    }
+}
 /**
  * Replace a file's contents atomically: write a temp file in the SAME directory
  * (so the rename cannot cross a filesystem boundary), fsync it, then rename over
@@ -152,6 +222,7 @@ export function withSynchronousFileLock(path, work) {
     const token = `${process.pid}-${randomUUID()}.json`;
     const own = join(path, token);
     const deadline = Date.now() + 10_000;
+    const incarnation = processIncarnation(process.pid);
     const claims = () => {
         const result = [];
         for (const name of readdirSync(path).filter(name => /^[0-9]+-[a-f0-9-]{36}\.json$/.test(name))) {
@@ -168,35 +239,39 @@ export function withSynchronousFileLock(path, work) {
             if (!Number.isSafeInteger(value.pid) || value.pid <= 0 || !Number.isSafeInteger(value.ticket) || value.ticket < 0)
                 throw new Error('Invalid synchronous lock claim');
             if (name !== token) {
+                let dead = false;
                 try {
                     process.kill(value.pid, 0);
                 }
                 catch (error) {
-                    if (error.code === 'ESRCH') {
-                        // This dead contender alone owned this UUID path. Never remove
-                        // the namespace or a successor's differently named claim.
-                        rmSync(file, { force: true });
-                        continue;
-                    }
+                    dead = error.code === 'ESRCH';
+                }
+                // A claim from before a reboot, or whose PID now names a later process,
+                // is as dead as an exited one.
+                if (dead || incarnationEnded(value.pid, value)) {
+                    // This dead contender alone owned this UUID path. Never remove
+                    // the namespace or a successor's differently named claim.
+                    rmSync(file, { force: true });
+                    continue;
                 }
             }
             result.push({ name, value });
         }
         return result;
     };
-    replaceFileAtomically(own, JSON.stringify({ pid: process.pid, choosing: true, ticket: 0 }));
+    replaceFileAtomically(own, JSON.stringify({ pid: process.pid, choosing: true, ticket: 0, ...incarnation }));
     try {
         const ticket = Math.max(0, ...claims().map(claim => claim.value.ticket)) + 1;
         if (!Number.isSafeInteger(ticket))
             throw new Error('Synchronous lock ticket overflow');
-        replaceFileAtomically(own, JSON.stringify({ pid: process.pid, choosing: false, ticket }));
+        replaceFileAtomically(own, JSON.stringify({ pid: process.pid, choosing: false, ticket, ...incarnation }));
         for (;;) {
             const preceding = claims().some(claim => claim.name !== token && (claim.value.choosing
                 || claim.value.ticket < ticket || (claim.value.ticket === ticket && claim.name < token)));
             if (!preceding)
                 return work();
             if (Date.now() >= deadline)
-                throw new Error('Timed out acquiring synchronous journal lock');
+                throw new Error(SYNCHRONOUS_LOCK_TIMEOUT);
             Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
         }
     }

package/dist/build-info.json

@@ -1,13 +1,15 @@
 {
-  "version": "1.2.0-nightly.66",
-  "buildId": "b8fdde9dbcd0",
-  "commit": "268a18be4c8f3921b8e432b0025ffe3052903fda",
+  "version": "1.2.0-nightly.68",
+  "buildId": "ec9481a2cd81",
+  "commit": "7c3095b817127cff76cac375f21e8124558e8f38",
   "dirty": true,
-  "builtAt": "2026-10-16T07:07:30.528Z",
+  "builtAt": "2026-10-16T12:16:06.490Z",
   "capabilities": [
+    "service.refresh-v1",
     "managed-cli.codex-reasoning-effort-v1",
     "managed-cli.setup-v1",
     "workspace.enroll.preserve-profile-v1",
+    "workspace.enroll.optional-profile-v1",
     "cowork.http-management-v1",
     "monitor.interrupt.after_tool"
   ]

package/dist/capabilities.d.ts

@@ -15,12 +15,15 @@
 /** `monitor.interrupt: after_tool` — cancel at the next tool boundary (#67). */
 export declare const CAP_MONITOR_INTERRUPT_AFTER_TOOL = "monitor.interrupt.after_tool";
 export declare const CAP_HTTP_COWORK = "cowork.http-management-v1";
+export declare const CAP_WORKSPACE_OPTIONAL_PROFILE = "workspace.enroll.optional-profile-v1";
 export declare const CAP_WORKSPACE_PRESERVE_PROFILE = "workspace.enroll.preserve-profile-v1";
 /** `ours-fleet managed-cli setup|status` and the `managed_cli` Agent key (#233). */
 export declare const CAP_MANAGED_CLI_SETUP = "managed-cli.setup-v1";
 /** Managed CLI accepts validated Codex Brain reasoning effort without dropping it (#235). */
 export declare const CAP_MANAGED_CLI_CODEX_EFFORT = "managed-cli.codex-reasoning-effort-v1";
-export declare const CAPABILITIES: readonly ["managed-cli.codex-reasoning-effort-v1", "managed-cli.setup-v1", "workspace.enroll.preserve-profile-v1", "cowork.http-management-v1", "monitor.interrupt.after_tool"];
+/** `ours-fleet service check|refresh`: re-point service definitions after an update. */
+export declare const CAP_SERVICE_REFRESH = "service.refresh-v1";
+export declare const CAPABILITIES: readonly ["service.refresh-v1", "managed-cli.codex-reasoning-effort-v1", "managed-cli.setup-v1", "workspace.enroll.preserve-profile-v1", "workspace.enroll.optional-profile-v1", "cowork.http-management-v1", "monitor.interrupt.after_tool"];
 export type Capability = (typeof CAPABILITIES)[number];
 /** Does this build declare `token`? */
 export declare const hasCapability: (token: string) => boolean;

package/dist/capabilities.js

@@ -15,15 +15,20 @@
 /** `monitor.interrupt: after_tool` — cancel at the next tool boundary (#67). */
 export const CAP_MONITOR_INTERRUPT_AFTER_TOOL = 'monitor.interrupt.after_tool';
 export const CAP_HTTP_COWORK = 'cowork.http-management-v1';
+export const CAP_WORKSPACE_OPTIONAL_PROFILE = 'workspace.enroll.optional-profile-v1';
 export const CAP_WORKSPACE_PRESERVE_PROFILE = 'workspace.enroll.preserve-profile-v1';
 /** `ours-fleet managed-cli setup|status` and the `managed_cli` Agent key (#233). */
 export const CAP_MANAGED_CLI_SETUP = 'managed-cli.setup-v1';
 /** Managed CLI accepts validated Codex Brain reasoning effort without dropping it (#235). */
 export const CAP_MANAGED_CLI_CODEX_EFFORT = 'managed-cli.codex-reasoning-effort-v1';
+/** `ours-fleet service check|refresh`: re-point service definitions after an update. */
+export const CAP_SERVICE_REFRESH = 'service.refresh-v1';
 export const CAPABILITIES = [
+    CAP_SERVICE_REFRESH,
     CAP_MANAGED_CLI_CODEX_EFFORT,
     CAP_MANAGED_CLI_SETUP,
     CAP_WORKSPACE_PRESERVE_PROFILE,
+    CAP_WORKSPACE_OPTIONAL_PROFILE,
     CAP_HTTP_COWORK,
     CAP_MONITOR_INTERRUPT_AFTER_TOOL,
 ];

package/dist/cli.js

@@ -15,6 +15,7 @@ import { spawn as spawnChild } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, rmSync } from 'node:fs';
 import { realpathSync } from 'node:fs';
+import { describeRegistration, refreshServiceRegistrations, registrationDrift, } from './supervisor/registration-refresh.js';
 import { join as joinPath, resolve as resolvePath } from 'node:path';
 import { createInterface } from 'node:readline';
 import { Command } from 'commander';
@@ -1400,12 +1401,41 @@ cOpt(program.command('doctor').description('prerequisite report'))
         harness: opts.harness,
         configPath: opts.configuration,
         yamlMode: opts.yamlMode,
+        serviceRegistration: { binPath },
     });
     for (const c of rep.checks)
         console.log(`${c.ok ? 'ok  ' : 'MISS'} ${c.name.padEnd(22)} ${c.detail}`);
     if (!rep.ok)
         throw new FleetCliExit(1);
 });
+const serviceCommand = program.command('service')
+    .description('installed Fleet service definitions (supervisor, web, watchdogs)');
+const printRegistrations = (reports, json) => {
+    if (json)
+        console.log(JSON.stringify({ binPath, services: reports }, null, 2));
+    else
+        for (const report of reports)
+            console.log(describeRegistration(report));
+};
+serviceCommand.command('check')
+    .description('report whether installed definitions and running services use this release; changes nothing')
+    .option('--json', 'machine-readable report')
+    .action(async (opts) => {
+    const reports = await refreshServiceRegistrations({ binPath, write: false });
+    printRegistrations(reports, opts.json);
+    if (registrationDrift(reports).length)
+        throw new FleetCliExit(1);
+});
+serviceCommand.command('refresh')
+    .description('point installed definitions at this release; never creates, enables, starts, stops or restarts a service')
+    .option('--json', 'machine-readable report')
+    .action(async (opts) => {
+    const reports = await refreshServiceRegistrations({ binPath, write: true });
+    printRegistrations(reports, opts.json);
+    if (!opts.json && reports.some(report => report.running === 'stale'))
+        console.log('A running service still uses another release. Restart it when convenient, '
+            + 'e.g. systemctl --user restart ours-fleet.service; agents resume through their supervisor.');
+});
 cOpt(program.command('init').description('add missing Fleet defaults while preserving existing configuration')
     .option('--settings <file>', 'validated InitAnswers JSON; runs without interactive questions'))
     .action(async (opts) => {