@ours.network/fleet 1.2.0-nightly.66 → 1.2.0-nightly.68

package/dist/supervisor/registration-refresh.js

@@ -0,0 +1,266 @@
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, sep } from 'node:path';
+import { replaceFileAtomically } from '../atomic-file.js';
+import { realExec } from '../exec.js';
+import { home } from '../paths.js';
+import { WATCHDOG_LAUNCHD_LABEL, WATCHDOG_SYSTEMD_UNIT } from '../watchdog/service.js';
+import { WEB_LAUNCHD_LABEL, WEB_SYSTEMD_UNIT } from '../web/service.js';
+import { labelFor } from './launchd.js';
+import { UNIT_TEMPLATE } from './systemd.js';
+/**
+ * Service definitions written by `init`, `web install` and the watchdog
+ * installer pin the realpath of the CLI that wrote them: an immutable,
+ * per-release package tree. An update installs a new tree and moves the
+ * `ours-fleet` command, but a definition is only rewritten when that command
+ * runs again, so after the next reboot the OS starts the previous release's
+ * supervisor while agents, web and CLI run the new one.
+ *
+ * Refresh re-points an existing Fleet-generated definition at the invoking
+ * release and changes nothing else: environment, profile, ports and drop-ins
+ * are kept byte for byte, and no unit is created, enabled, started, stopped
+ * or restarted. A running process keeps its old code until its operator
+ * restarts it, which the report states rather than doing.
+ */
+const PACKAGE_SCRIPT = ['node_modules', '@ours.network', 'fleet', 'dist', 'cli.js'].join(sep);
+/** The release tree that owns a Fleet CLI script, if it is a packaged one. */
+export function releaseRoot(script) {
+    const suffix = sep + PACKAGE_SCRIPT;
+    return script.endsWith(suffix) ? script.slice(0, -suffix.length) : undefined;
+}
+function definitions(platform, homeDir) {
+    if (platform === 'linux') {
+        const dir = join(homeDir, '.config', 'systemd', 'user');
+        return [
+            { service: 'supervisor', unit: UNIT_TEMPLATE, path: join(dir, UNIT_TEMPLATE), entry: '_run-fleet',
+                marker: 'ours-fleet process manager' },
+            { service: 'web', unit: WEB_SYSTEMD_UNIT, path: join(dir, WEB_SYSTEMD_UNIT), entry: 'web',
+                marker: 'ours-fleet localhost web console' },
+            { service: 'watchdogs', unit: WATCHDOG_SYSTEMD_UNIT, path: join(dir, WATCHDOG_SYSTEMD_UNIT), entry: '_run-watchdogs',
+                marker: 'ours-fleet watchdog scheduler' },
+        ];
+    }
+    if (platform === 'darwin') {
+        const dir = join(homeDir, 'Library', 'LaunchAgents');
+        return [
+            { service: 'supervisor', path: join(dir, `${labelFor('fleet')}.plist`), entry: '_run-fleet', marker: labelFor('fleet') },
+            { service: 'web', path: join(dir, `${WEB_LAUNCHD_LABEL}.plist`), entry: 'web', marker: WEB_LAUNCHD_LABEL },
+            { service: 'watchdogs', path: join(dir, `${WATCHDOG_LAUNCHD_LABEL}.plist`), entry: '_run-watchdogs',
+                marker: WATCHDOG_LAUNCHD_LABEL },
+        ];
+    }
+    return [];
+}
+const NODE_RUNTIME = /^node(js)?[0-9.]*$/;
+const systemdQuote = (value) => `"${value.replace(/[%\\"]/g, char => char === '%' ? '%%' : `\\${char}`)}"`;
+const xml = (value) => value.replace(/[&<>"']/g, char => ({
+    '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&apos;',
+}[char]));
+const unxml = (value) => value.replaceAll('&quot;', '"').replaceAll('&apos;', "'")
+    .replaceAll('&lt;', '<').replaceAll('&gt;', '>').replaceAll('&amp;', '&');
+function parseGenerated(text, platform, definition) {
+    if (platform === 'linux') {
+        const lines = text.split('\n');
+        const only = (pattern) => {
+            const found = lines.flatMap((line, index) => pattern.test(line) ? [index] : []);
+            return found.length === 1 ? found[0] : undefined;
+        };
+        if (lines[only(/^Description=/) ?? -1] !== `Description=${definition.marker}`)
+            return undefined;
+        if (lines[only(/^Type=/) ?? -1] !== 'Type=simple')
+            return undefined;
+        const exec = only(/^\s*ExecStart\s*=/);
+        if (exec === undefined || !lines[exec].startsWith('ExecStart="'))
+            return undefined;
+        const args = [...lines[exec].slice('ExecStart='.length).matchAll(/"((?:[^"\\]|\\.)*)"|(\S+)/g)]
+            .map(match => match[1] !== undefined ? match[1].replace(/\\(.)/g, '$1').replaceAll('%%', '%') : match[2]);
+        const [runtime, script, entry] = args;
+        if (!runtime?.startsWith('/') || !NODE_RUNTIME.test(runtime.split('/').at(-1)) || entry !== definition.entry || !script)
+            return undefined;
+        const quoted = `${systemdQuote(runtime)} ${systemdQuote(script)} `;
+        if (!lines[exec].startsWith(`ExecStart=${quoted}`))
+            return undefined;
+        const pathLine = only(/^Environment="PATH=/);
+        return {
+            script,
+            rewrite(next, path) {
+                const out = [...lines];
+                out[exec] = `ExecStart=${systemdQuote(runtime)} ${systemdQuote(next)} ${lines[exec].slice(`ExecStart=${quoted}`.length)}`;
+                if (pathLine !== undefined) {
+                    const value = /^Environment="PATH=((?:[^"\\]|\\.)*)"$/.exec(lines[pathLine])?.[1];
+                    if (value !== undefined && !/[\\%]/.test(value))
+                        out[pathLine] = `Environment="PATH=${value.split(':').map(path).join(':')}"`;
+                }
+                return out.join('\n');
+            },
+        };
+    }
+    if (!new RegExp(`<key>Label</key>\\s*<string>${definition.marker.replaceAll('.', '\\.')}</string>`).test(text))
+        return undefined;
+    const program = /<key>ProgramArguments<\/key>\s*<array>\s*<string>([^<]*)<\/string>\s*<string>([^<]*)<\/string>\s*<string>([^<]*)<\/string>/.exec(text);
+    if (!program)
+        return undefined;
+    const [, runtime, script, entry] = program.map(unxml);
+    if (!runtime.startsWith('/') || !NODE_RUNTIME.test(runtime.split('/').at(-1)) || entry !== definition.entry)
+        return undefined;
+    return {
+        script,
+        rewrite(next, path) {
+            const head = program[0];
+            const moved = head.replace(`<string>${program[2]}</string>`, `<string>${xml(next)}</string>`);
+            let out = text.replace(head, moved);
+            out = out.replace(/(<key>PATH<\/key>\s*<string>)([^<]*)(<\/string>)/, (_all, open, value, close) => `${open}${xml(unxml(value).split(':').map(path).join(':'))}${close}`);
+            return out;
+        },
+    };
+}
+/** A systemd drop-in that sets ExecStart owns the command line; Fleet must not fight it. */
+function overriddenByDropIn(path) {
+    const dir = `${path}.d`;
+    try {
+        return readdirSync(dir).some(name => name.endsWith('.conf')
+            && /^\s*ExecStart\s*=/m.test(readFileSync(join(dir, name), 'utf8')));
+    }
+    catch {
+        return false;
+    }
+}
+const procArgv = (pid) => {
+    try {
+        return readFileSync(`/proc/${pid}/cmdline`, 'utf8').split('\0').filter(Boolean);
+    }
+    catch {
+        return undefined;
+    }
+};
+async function runningState(definition, options, platform) {
+    if (platform !== 'linux' || !definition.unit)
+        return 'unknown';
+    const exec = options.exec ?? realExec;
+    const shown = await exec('systemctl', ['--user', 'show', '-p', 'MainPID', '--value', definition.unit]);
+    if (shown.code !== 0)
+        return 'unknown';
+    const pid = Number(shown.stdout.trim());
+    if (!Number.isSafeInteger(pid) || pid < 0)
+        return 'unknown';
+    if (pid === 0)
+        return 'stopped';
+    const argv = (options.processArgv ?? procArgv)(pid);
+    const script = argv?.[1];
+    if (!script)
+        return 'unknown';
+    // A stable launcher resolves to whichever release it pointed at when started.
+    if (!releaseRoot(script))
+        return 'unknown';
+    return script === options.binPath ? 'current' : 'stale';
+}
+/**
+ * Whether systemd still runs an older load of this unit than the file on disk.
+ * A rewrite whose daemon-reload failed looks current on the next pass; this is
+ * what keeps that pending reload visible instead of losing it.
+ */
+async function reloadPending(definition, options, platform) {
+    if (platform !== 'linux' || !definition.unit)
+        return false;
+    const shown = await (options.exec ?? realExec)('systemctl', ['--user', 'show', '-p', 'NeedDaemonReload', '--value', definition.unit]);
+    return shown.code === 0 && shown.stdout.trim() === 'yes';
+}
+/** Report, and with `write` refresh, each installed Fleet service definition. */
+export async function refreshServiceRegistrations(options) {
+    const platform = options.platform ?? process.platform;
+    const homeDir = options.homeDir ?? home();
+    const exists = options.exists ?? existsSync;
+    const target = releaseRoot(options.binPath);
+    const reports = [];
+    let rewrote = false;
+    for (const definition of definitions(platform, homeDir)) {
+        const base = { service: definition.service, path: definition.path };
+        if (!exists(definition.path)) {
+            reports.push({ ...base, state: 'absent', running: 'stopped' });
+            continue;
+        }
+        const running = await runningState(definition, options, platform);
+        const text = readFileSync(definition.path, 'utf8');
+        const generated = parseGenerated(text, platform, definition);
+        if (!generated) {
+            reports.push({ ...base, state: 'unrecognized', running,
+                detail: 'not the definition Fleet generates for this service; left untouched' });
+            continue;
+        }
+        const from = releaseRoot(generated.script);
+        if (!from || generated.script === options.binPath) {
+            if (await reloadPending(definition, options, platform)) {
+                // Normally an earlier refresh whose daemon-reload failed: the file is
+                // right, the loaded unit is not. Reload now, or keep reporting drift.
+                if (options.write) {
+                    rewrote = true;
+                    reports.push({ ...base, state: 'refreshed', running, ...(from ? { from } : {}),
+                        detail: 'definition on disk was not loaded yet; reloaded' });
+                }
+                else
+                    reports.push({ ...base, state: 'reload-failed', running, ...(from ? { from } : {}),
+                        detail: 'systemd has not loaded the definition on disk; run systemctl --user daemon-reload' });
+                continue;
+            }
+            reports.push({ ...base, state: 'current', running, ...(from ? { from } : {}) });
+            continue;
+        }
+        if (!target) {
+            reports.push({ ...base, state: 'stale', running, from,
+                detail: 'the invoking CLI is not a packaged release; nothing to point the definition at' });
+            continue;
+        }
+        if (platform === 'linux' && overriddenByDropIn(definition.path)) {
+            reports.push({ ...base, state: 'unrecognized', running, from,
+                detail: `a drop-in in ${definition.path}.d sets ExecStart; left untouched` });
+            continue;
+        }
+        if (!options.write) {
+            reports.push({ ...base, state: 'stale', running, from, to: target });
+            continue;
+        }
+        // Only bundled tool directories on PATH follow the release; every other
+        // setting, including a profile or home stored under a release tree, stays.
+        const kept = [];
+        const next = generated.rewrite(options.binPath, entry => {
+            if (!entry.startsWith(from + '/'))
+                return entry;
+            const moved = target + entry.slice(from.length);
+            if (exists(moved))
+                return moved;
+            kept.push(entry);
+            return entry;
+        });
+        if (parseGenerated(next, platform, definition)?.script !== options.binPath) {
+            reports.push({ ...base, state: 'unrecognized', running, from,
+                detail: 'the rewritten definition would not launch the invoking release; left untouched' });
+            continue;
+        }
+        replaceFileAtomically(definition.path, next, statSync(definition.path).mode & 0o777);
+        rewrote = true;
+        reports.push({ ...base, state: 'refreshed', running, from, to: target,
+            ...(kept.length ? { detail: `kept PATH entries absent from the new release: ${kept.join(', ')}` } : {}) });
+    }
+    if (rewrote && platform === 'linux') {
+        const reload = await (options.exec ?? realExec)('systemctl', ['--user', 'daemon-reload']);
+        // The file is rewritten, but systemd keeps the loaded unit until a reload,
+        // so a failed reload is not a refresh.
+        if (reload.code !== 0)
+            for (const report of reports)
+                if (report.state === 'refreshed') {
+                    report.state = 'reload-failed';
+                    report.detail = [report.detail, `systemctl --user daemon-reload failed: ${reload.stderr.trim() || `exit ${reload.code}`}; `
+                            + 'run it, then restart the service when convenient'].filter(Boolean).join('; ');
+                }
+    }
+    return reports;
+}
+/** One operator line per definition, including the restart a refresh cannot do. */
+export function describeRegistration(report) {
+    const what = `${report.service.padEnd(10)} ${report.state}`;
+    const pins = report.from ? ` ${report.from}${report.to ? ` -> ${report.to}` : ''}` : '';
+    const restart = report.running === 'stale'
+        ? `; the running process still uses ${report.state === 'refreshed' ? 'the previous' : 'another'} release until restarted`
+        : '';
+    return `${what}${pins}${restart}${report.detail ? ` (${report.detail})` : ''}`;
+}
+export const registrationDrift = (reports) => reports.filter(report => report.state === 'stale' || report.state === 'reload-failed' || report.running === 'stale');

package/dist/workspace-enrollment.d.ts

@@ -4,8 +4,9 @@ export interface WorkspacePayload {
     appOrigin: string;
     hostname: string;
     rootName: string;
-    name: string;
-    surname: string;
+    fullName?: string | null;
+    name?: string | null;
+    surname?: string | null;
     connectorToken?: string;
     invitation: string;
     serverCid: string;

package/dist/workspace-enrollment.js

@@ -25,14 +25,24 @@ export function decodeWorkspacePayload(input, options = {}) {
     catch {
         throw Error('Invalid workspace payload');
     }
-    if (p.version !== 1 || !['https://app.ours.network', 'https://app.ours-tunnel.com'].includes(p.appOrigin) || !/^[a-z0-9][a-z0-9-]{2,60}\.ours-tunnel\.com$/.test(p.hostname) || !/^[a-z0-9-]{2,30}@[a-z0-9-]{2,30}$/.test(p.rootName) || !/^[a-f0-9]{64}$/i.test(p.serverCid) || !p.challenge || !['nonce', 'accountId', 'workspaceId'].every(k => /^[\w-]{43}$/.test(String(p.challenge[k]))) || (!options.allowExpired && p.challenge.expiresAt <= Date.now()) || !Number.isSafeInteger(p.challenge.expiresAt) || p.challenge.expiresAt > Date.now() + 16 * 60000)
+    if (!p || typeof p !== 'object' || Array.isArray(p) || p.version !== 1 || !['https://app.ours.network', 'https://app.ours-tunnel.com'].includes(p.appOrigin) || !/^[a-z0-9][a-z0-9-]{2,60}\.ours-tunnel\.com$/.test(p.hostname) || !/^[a-z0-9-]{2,30}@[a-z0-9-]{2,30}$/.test(p.rootName) || !/^[a-f0-9]{64}$/i.test(p.serverCid) || !p.challenge || !['nonce', 'accountId', 'workspaceId'].every(k => /^[\w-]{43}$/.test(String(p.challenge[k]))) || (!options.allowExpired && p.challenge.expiresAt <= Date.now()) || !Number.isSafeInteger(p.challenge.expiresAt) || p.challenge.expiresAt > Date.now() + 16 * 60000)
         throw Error('Workspace payload is invalid or expired');
-    for (const k of ['connectorToken', 'invitation', 'name', 'surname']) {
+    for (const k of ['connectorToken', 'invitation']) {
         if (k === 'connectorToken' && p[k] === undefined)
             continue;
         if (typeof p[k] !== 'string' || !p[k] || p[k].length > 8192 || /[\x00-\x1f\x7f]/.test(p[k]))
             throw Error('Invalid workspace payload');
     }
+    for (const k of ['fullName', 'name', 'surname']) {
+        const value = p[k];
+        if (value == null || value === '') {
+            p[k] = null;
+            continue;
+        }
+        if (typeof value !== 'string' || value.length > 8192 || /[\x00-\x1f\x7f]/.test(value))
+            throw Error('Invalid workspace profile');
+        p[k] = value.trim() || null;
+    }
     return p;
 }
 /** Credential-free renewal is allowed only on the host already holding this private connector. */
@@ -120,11 +130,11 @@ const CID = /^[a-f0-9]{64}$/i, same = (a, b) => a.toLowerCase() === b.toLowerCas
 async function messengerIdentity(request, attach) {
     const bound = await request('workspace/enrollment-identity');
     if (bound.rootCid === undefined)
-        return { cid: bound.cid, preserveProfile: bound.preserveProfile === true };
+        return { cid: bound.cid, preserveProfile: bound.preserveProfile === true, optionalWorkspaceProfileV1: bound.optionalWorkspaceProfileV1 === true };
     if (typeof bound.cid !== 'string' || !CID.test(bound.cid) || typeof bound.rootCid !== 'string' || !CID.test(bound.rootCid) || same(bound.cid, bound.rootCid))
         throw Error('Bound Messenger identity unavailable');
     const root = await humanRoot(attach, bound.rootCid, bound.cid);
-    return { cid: bound.cid, preserveProfile: bound.preserveProfile === true, root };
+    return { cid: bound.cid, preserveProfile: bound.preserveProfile === true, optionalWorkspaceProfileV1: bound.optionalWorkspaceProfileV1 === true, root };
 }
 /** This host's only Human root, as its daemon lists it; optionally with a permanent identity that must be listed under it. */
 async function humanRoot(attach, rootCid, under) {
@@ -280,6 +290,8 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
         && (options.replacingWorkspace !== undefined || JSON.parse(readFileSync(previousFile, 'utf8')).serverCid?.toUpperCase() === payload.serverCid.toUpperCase());
     if (options.preserveProfile && identity.preserveProfile !== true)
         throw Error('Existing-host setup requires Messenger profile-preservation support; update the host Messenger before retrying');
+    if (!options.preserveProfile && (payload.fullName?.trim() || !payload.name?.trim() || !payload.surname?.trim()) && !identity.optionalWorkspaceProfileV1)
+        throw Error('Optional workspace profile requires updated Messenger; update the host Messenger before retrying (the host is not enrolled)');
     if (loaded.rooms && !lost && !moved && loaded.rooms.owner.expected_cid.toLowerCase() !== identity.cid.toLowerCase())
         throw Error('Retained room owner CID conflicts with the Human root');
     const inviteFile = loaded.rooms?.owner.public_invite_file || join(dir, 'owner.invite');
@@ -291,7 +303,7 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
     const devices = new WorkspaceDeviceStore();
     const hostWorkspaceId = devices.workspaceId;
     devices.close();
-    const { name, surname, ...proofPayload } = payload;
+    const { fullName, name, surname, ...proofPayload } = payload;
     let result, ownerCid;
     // A replacement can stop after its one-time proof but before local files commit. Read the
     // account's existing signed receipt first; a verified proof must not be sent a second time.
@@ -316,6 +328,8 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
         }
     }
     if (identity.root) {
+        if (!options.preserveProfile)
+            await request('identity/profile', { fullName: fullName ?? null, name: name ?? null, surname: surname ?? null });
         // The Human root signs the binding; the person's own Messenger identity is the room Owner and issues the Owner invitation.
         if (!proofAlreadyConfirmed)
             await proveWithHumanRoot(attach, identity.root, payload, hostWorkspaceId, options.contactWaitMs ?? 10000, options.replacingWorkspace !== undefined);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.66",
+  "version": "1.2.0-nightly.68",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",