@ours.network/fleet 1.2.0-nightly.7 → 1.2.0-nightly.70

package/dist/owner-channel/channel.js

@@ -883,8 +883,15 @@ export class OwnerChannel {
         const recovered = [];
         for (const claim of this.messageRecovery.list()) {
             const item = await this.client.getHistoryItem(claim.wireId);
-            if (!item)
-                throw new Error(`journaled owner message ${claim.wireId} is missing from persistent history`);
+            if (!item) {
+                // The daemon has definitively lost this body. Retrying the claim would
+                // block every later owner message, including after a supervisor restart.
+                // Keep transient lookup errors retryable; only an explicit absence skips.
+                this.messageRecovery.pruneHandled(wireId => wireId === claim.wireId);
+                this.options.log(`[${this.options.role}] skipped journaled owner message ${claim.wireId} `
+                    + `(seq=${claim.seq}): missing from persistent history`);
+                continue;
+            }
             recovered.push(this.historyMessage(item, claim));
         }
         const listed = await this.client.listIncomingMessages();
@@ -1391,6 +1398,7 @@ export class OwnerChannel {
                     await this.fleetOps.provisionTask(task.task_id);
                 return outcome;
             }),
+            observeTaskReadiness: taskId => new TaskRoomApplicationService(this.options.configPath).observeTaskReadiness(taskId),
             taskProvisioningOutcome: taskId => new TaskRoomApplicationService(this.options.configPath).taskProvisioningOutcome(taskId),
             listTasks: filter => new TaskRoomApplicationService(this.options.configPath).listTasks(filter),
             groupedTasks: filter => new TaskRoomApplicationService(this.options.configPath).groupedTasks(filter),
@@ -1977,6 +1985,9 @@ export class OwnerChannel {
         const progressMs = this.options.config.progress_interval_ms;
         let lastSeq = activityCursor;
         let startedAt;
+        // When one turn delivers several waiting prompts, its events carry the turn's
+        // id, not this request's: follow the turn that actually carries this request.
+        const inTurn = (turnId) => turnId === (this.options.session.sharedTurnId?.(queued.promptId) ?? queued.promptId);
         let phase = 'starting request';
         let timer;
         const flushCommentary = () => {
@@ -2033,7 +2044,7 @@ export class OwnerChannel {
         };
         const acceptCommentary = (event) => {
             if (!this.commentsEnabled
-                || active.commentaryDisabled || active.finalizing || event.turnId !== queued.promptId
+                || active.commentaryDisabled || active.finalizing || !inTurn(event.turnId)
                 || event.kind !== 'agent_text' || event.messagePhase !== 'commentary'
                 || event.replayed || event.origin?.kind !== 'owner'
                 || event.origin.requestId !== active.requestId
@@ -2074,7 +2085,7 @@ export class OwnerChannel {
         const reportProgress = () => {
             const events = this.options.session.eventsSince(lastSeq);
             lastSeq = Math.max(lastSeq, this.latestEventSeq(events));
-            const activity = events.filter(event => event.turnId === queued.promptId);
+            const activity = events.filter(event => inTurn(event.turnId));
             if (!activity.length)
                 return;
             startedAt ??= Date.parse(activity[0].at) || Date.now();
@@ -2099,10 +2110,10 @@ export class OwnerChannel {
         const startProgress = (event) => {
             if (timer || progressMs <= 0)
                 return;
-            if (event && event.turnId !== queued.promptId)
+            if (event && !inTurn(event.turnId))
                 return;
             const observed = event ? [event] : this.options.session.eventsSince(activityCursor)
-                .filter(item => item.turnId === queued.promptId);
+                .filter(item => inTurn(item.turnId));
             if (!observed.length)
                 return;
             startedAt = Date.parse(observed[0].at) || Date.now();

package/dist/owner-channel/commands.d.ts

@@ -1,3 +1,4 @@
+import type { TaskReadinessIssue } from '../rooms-tasks/live-readiness.js';
 import type { InterruptOutcome, SessionEvent, SessionSnapshot } from '../session/types.js';
 import type { RoomOrchestrationRecord, TaskOutcome, TaskRecord, TaskTerminalIntent, TaskListRecord } from '../rooms-tasks/types.js';
 import { type OwnerCommentsState } from './notices.js';
@@ -58,6 +59,9 @@ export interface OwnerCommandContext {
     terminalTask(taskId: string, kind: TaskTerminalIntent['kind'], outcome?: TaskOutcome): Promise<void>;
     createTask(input: Omit<CreateTaskRequest, 'actor'>): Promise<TaskRecord>;
     startTask(taskId: string): Promise<TaskProvisioningOutcome | TaskRecord>;
+    observeTaskReadiness?(taskId: string): Promise<{
+        state: 'ready';
+    } | TaskReadinessIssue>;
     taskProvisioningOutcome?(taskId: string): TaskProvisioningOutcome;
     listTasks(filter?: {
         state?: TaskState | TaskState[];

package/dist/owner-channel/commands.js

@@ -47,6 +47,11 @@ function isKnownOwnerRoomState(message) {
     ].some(pattern => pattern.test(message));
 }
 function ownerTaskFailure(error) {
+    if (error instanceof TaskRoomApplicationError && error.code === 'task_not_ready')
+        return {
+            kind: 'state', detail: error.message,
+            action: 'Ask Fleet Coordinator to inspect room and member status and choose supported recovery.',
+        };
     if (error instanceof TaskListError)
         return {
             kind: error.code === 'list_not_found' ? 'not_found'
@@ -301,6 +306,7 @@ export const ownerCommands = [
             const trailingLines = argLines.slice(1).join('\n').trim() || undefined;
             const showTask = async (id) => {
                 const { task: t } = ctx.getTask(id);
+                const readiness = t.state === 'active' ? await ctx.observeTaskReadiness?.(id) : undefined;
                 await ctx.reply(renderMarkdownResult({
                     icon: '📋', title: 'Task details',
                     fields: [
@@ -308,6 +314,8 @@ export const ownerCommands = [
                         { label: 'Title', value: t.title },
                         { label: 'Status', value: taskStatus(t.state), kind: 'markdown' },
                         { label: 'List', value: t.list_name ?? 'default', kind: 'code' },
+                        ...(readiness ? [{ label: 'Readiness', value: readiness.state },
+                            ...('reason' in readiness ? [{ label: 'Reason', value: readiness.reason }] : [])] : []),
                         ...(t.blocked ? [{ label: 'Blocked', value: t.blocked.reason }] : []),
                         ...(t.template ? [{ label: 'Template', value: `${t.template.name}@${t.template.version}`, kind: 'code' }] : []),
                         ...(t.room_id ? [{ label: 'Room', value: t.room_id, kind: 'code' }] : []),

package/dist/owner-channel/lifecycle-outbox.js

@@ -1,6 +1,6 @@
+import { redactErasedContent, writePrivacyFilteredLedger } from '../erased-resources.js';
 import { createHash } from 'node:crypto';
 import { chmodSync, existsSync, readFileSync } from 'node:fs';
-import { replaceFileAtomically } from '../atomic-file.js';
 import { lifecycleEventDigestBasis, validateFleetAuditPresentations, } from '../fleet-command-audit.js';
 const DIGEST = /^[a-f0-9]{64}$/u;
 const LIMIT = 5_000;
@@ -63,7 +63,7 @@ export class FleetLifecycleOutbox {
     }
     pending() {
         this.assertHealthy();
-        return this.entries.filter(entry => entry.delivery === 'pending').map(entry => structuredClone(entry));
+        return redactErasedContent(this.entries).filter(entry => entry.delivery === 'pending').map(entry => structuredClone(entry));
     }
     finish(digest, delivery) {
         this.assertHealthy();
@@ -82,6 +82,7 @@ export class FleetLifecycleOutbox {
             throw new Error(this.corruptReason);
     }
     persist() {
-        replaceFileAtomically(this.path, `${JSON.stringify({ version: 1, entries: this.entries })}\n`, 0o600);
+        this.entries = redactErasedContent(this.entries);
+        writePrivacyFilteredLedger(this.path, { version: 1, entries: this.entries });
     }
 }

package/dist/owner-channel/ours-client.js

@@ -1,7 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
-import { extname, join } from 'node:path';
-import { readDaemonConfig, resolveEndpoint } from '../monitor.js';
+import { extname } from 'node:path';
 import { readClientProfile } from '../client-profile.js';
 import { OursError, attachOursClient, } from '@ours.network/sdk/client';
 /** Any failure of a daemon operation. Never carries a message body or a token. */
@@ -131,24 +130,10 @@ export class OursSdkClient {
             return;
         const environment = { ...process.env, ...this.env };
         const profile = readClientProfile(environment);
-        // Reuse existing connection configuration. Identity selection checks the
-        // daemon capability before reading the client's protected token delivery file.
-        const endpoint = !profile && environment.OURS_DAEMON_ID
-            ? resolveEndpoint(environment, false) : undefined;
-        const token = endpoint ? environment.OURS_API_TOKEN?.trim() || readDaemonConfig(environment).apiToken : undefined;
-        const options = profile ? {
+        const options = {
             endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
             credentialPath: profile.credentialPath,
             sessionMode: 'external', leaseToken: this.leaseToken, env: {},
-        } : endpoint ? {
-            endpoint: endpoint.origin, expectedInstanceId: environment.OURS_DAEMON_ID,
-            sessionMode: 'external', leaseToken: this.leaseToken,
-            ...(token ? { token } : { credentialPath: join(endpoint.stateDir, 'daemon-token') }),
-        } : {
-            env: environment,
-            leaseToken: this.leaseToken,
-            clientPid: process.pid,
-            fetch: notificationDeadlineFetch(this.deps.fetch ?? globalThis.fetch, this.deps.notificationRequestDeadlineMs ?? NOTIFICATION_REQUEST_DEADLINE_MS),
         };
         this.client = await (this.deps.attachClient?.(options) ?? attachOursClient(options));
         this.terminalReleasePending = true;

package/dist/paths.d.ts

@@ -11,6 +11,8 @@ export declare const home: () => string;
  */
 export declare function deriveXdgRuntimeDir(env?: NodeJS.ProcessEnv, uid?: number | undefined, exists?: (p: string) => boolean): string | undefined;
 export declare const stateRoot: () => string;
+/** The Owner invitation file that tunnel setup writes itself after enrollment. */
+export declare const workspaceOwnerInvite: () => string;
 export declare const agentsRoot: () => string;
 export declare const tmpRoot: () => string;
 export declare const logsRoot: () => string;

package/dist/paths.js

@@ -21,6 +21,8 @@ export function deriveXdgRuntimeDir(env = process.env, uid = process.getuid?.(),
     return env.XDG_RUNTIME_DIR;
 }
 export const stateRoot = () => join(home(), '.ours-fleet');
+/** The Owner invitation file that tunnel setup writes itself after enrollment. */
+export const workspaceOwnerInvite = () => join(stateRoot(), 'workspace', 'owner.invite');
 export const agentsRoot = () => join(stateRoot(), 'agents');
 export const tmpRoot = () => join(stateRoot(), 'tmp');
 export const logsRoot = () => join(stateRoot(), 'logs');

package/dist/preset-migration.js

@@ -67,10 +67,35 @@ const V5_GENERATED_ROLE_DEFAULT_FINGERPRINTS = Object.freeze({
     'agent_templates/Developer.yaml': 'fdd953aab72d042e62780dd273598745aae59521b39edf4876d7676bb7189c83',
     'agent_templates/Critic.yaml': '3e98a28f17876061cfadf984351aa59fdbe19629e514eff52c74546545c64a91',
 });
+// The packaged Coordinator role of revisions 8 and 9 addressed a named owner channel that a
+// fresh installation does not have. Untouched copies adopt the current role; edited ones stay.
+const OWNER_CHANNEL_COORDINATOR_FINGERPRINTS = Object.freeze({
+    'roles/Coordinator.yaml': [
+        '8c8ad28d9bb9ddf9dba8c5c9c7859f25edd8fa10ebf833e2340124a6e49583ec',
+        'f0d8b169ad0a18051b57e5280b93cf01e05faa5c12f4e12bdf89973edf2ef58a',
+    ],
+});
+// The packaged revision-10 LocalCoordinator continuity loop reread ROUTINES.md and the WORKLOG
+// checkpoint on every 15-minute pass. Untouched copies adopt the current template; edited ones stay.
+const REREADING_CONTINUITY_LOOP_FINGERPRINTS = Object.freeze({
+    'agent_templates/LocalCoordinator.yaml': [
+        '53889cd3987e25ca42be64ddcfa1cf46a73ab769070db144f5b7d86085734178',
+    ],
+});
+// The packaged Developer, Critic and Engineer charters before they described one bounded
+// self-reminder per peer wait. Untouched copies adopt the current text; edited ones stay.
+const PEER_WAIT_REMINDER_FINGERPRINTS = Object.freeze({
+    'roles/Developer.yaml': ['2884366ce02760d66d3edbaed2adc83f2959fd7906a7cd3b5a8b90cf601bc3e6'],
+    'roles/Critic.yaml': ['998abdbc5159e8e1c26eb1ca09f9707b005ba1930bd5b7a4989c4d6893804c4a'],
+    'roles/Engineer.yaml': ['a361453ad32cde08797cf90fff17a35bde1871ccea17389448b44398b45ccfa5'],
+});
 const CURRENT_ROLE_DEFAULTS = new Set([
     'roles/Coordinator.yaml', 'roles/LocalCoordinator.yaml', 'roles/Developer.yaml', 'roles/Critic.yaml',
+    'roles/Engineer.yaml',
     'agent_templates/LocalCoordinator.yaml', 'agent_templates/Developer.yaml', 'agent_templates/Critic.yaml',
+    'agent_templates/Engineer.yaml',
     'room_templates/single.yaml', 'room_templates/pair.yaml', 'room_templates/team.yaml',
+    'room_templates/engineering.yaml',
     'agents/FleetCoordinator.yaml',
 ]);
 export const legacyStarterMigrationManifest = Object.freeze({
@@ -193,6 +218,9 @@ export function migratePackagedRoleDefaults(configuration, options = {}, hooks =
             ...Object.keys(V3_ROLE_DEFAULT_FINGERPRINTS),
             ...Object.keys(V4_ROLE_DEFAULT_FINGERPRINTS),
             ...Object.keys(V5_ROLE_DEFAULT_FINGERPRINTS),
+            ...Object.keys(OWNER_CHANNEL_COORDINATOR_FINGERPRINTS),
+            ...Object.keys(REREADING_CONTINUITY_LOOP_FINGERPRINTS),
+            ...Object.keys(PEER_WAIT_REMINDER_FINGERPRINTS),
         ]);
         for (const relative of known) {
             const path = join(root, relative);
@@ -206,6 +234,9 @@ export function migratePackagedRoleDefaults(configuration, options = {}, hooks =
                 V4_GENERATED_ROLE_DEFAULT_FINGERPRINTS[relative],
                 V5_ROLE_DEFAULT_FINGERPRINTS[relative],
                 V5_GENERATED_ROLE_DEFAULT_FINGERPRINTS[relative],
+                ...(OWNER_CHANNEL_COORDINATOR_FINGERPRINTS[relative] ?? []),
+                ...(REREADING_CONTINUITY_LOOP_FINGERPRINTS[relative] ?? []),
+                ...(PEER_WAIT_REMINDER_FINGERPRINTS[relative] ?? []),
             ].some(expected => expected !== undefined && actual === expected);
             if (recognized)
                 (CURRENT_ROLE_DEFAULTS.has(relative) ? replacements : removals).push(path);
@@ -258,6 +289,18 @@ export function migratePackagedRoleDefaults(configuration, options = {}, hooks =
                 unlinkSync(target);
             copyFileSync(join(source, relative), target, constants.COPYFILE_EXCL);
             chmodSync(target, 0o600);
+            // New Engineer seats use the existing Developer's selected brain. This
+            // preserves wizard/custom provider choices without copying permissions.
+            if (relative === 'agent_templates/Engineer.yaml' && classified.additions.includes(path)) {
+                const developer = join(root, 'agent_templates/Developer.yaml');
+                if (existsSync(developer)) {
+                    const value = parseFleetDocument(developer, readFileSync(developer, 'utf8'), 'strict').value;
+                    if (value.brain !== undefined && JSON.stringify(value.brain) !== JSON.stringify({ ref: 'claude-default' })) {
+                        const bytes = readFileSync(target, 'utf8').replace('brain: { ref: claude-default }', () => `brain: ${JSON.stringify(value.brain)}`);
+                        writeFileSync(target, bytes, { mode: 0o600 });
+                    }
+                }
+            }
             fsyncPath(target);
         }
         for (const kind of ['roles', 'agent_templates', 'room_templates', 'agents'])

package/dist/process-incarnation.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Which run of a process a PID names. A PID alone is not an identity: after a
+ * reboot or wraparound the same number belongs to an unrelated process, and a
+ * lock or claim keyed on it would then look held forever. The kernel boot id
+ * and the process start time (in clock ticks since boot) pin one incarnation.
+ * Both are Linux-only; elsewhere they are absent and callers stay PID-only.
+ */
+export interface ProcessIncarnation {
+    boot?: string;
+    start?: string;
+}
+export interface IncarnationProbe {
+    bootId(): string | undefined;
+    startTime(pid: number): string | undefined;
+}
+export declare const procIncarnationProbe: IncarnationProbe;
+export declare function processIncarnation(pid: number, probe?: IncarnationProbe): ProcessIncarnation;
+/**
+ * True only when a recorded marker positively proves the live PID is a later
+ * process: a different boot, or a different start time. A marker that was not
+ * recorded, or cannot be read now, proves nothing and keeps the PID check.
+ */
+export declare function incarnationEnded(pid: number, recorded: ProcessIncarnation, probe?: IncarnationProbe): boolean;

package/dist/process-incarnation.js

@@ -0,0 +1,42 @@
+import { readFileSync } from 'node:fs';
+export const procIncarnationProbe = {
+    bootId() {
+        try {
+            return readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim() || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    },
+    startTime(pid) {
+        try {
+            const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
+            return stat.slice(stat.lastIndexOf(')') + 2).split(/\s+/)[19] || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    },
+};
+export function processIncarnation(pid, probe = procIncarnationProbe) {
+    const boot = probe.bootId(), start = probe.startTime(pid);
+    return { ...(boot ? { boot } : {}), ...(start ? { start } : {}) };
+}
+/**
+ * True only when a recorded marker positively proves the live PID is a later
+ * process: a different boot, or a different start time. A marker that was not
+ * recorded, or cannot be read now, proves nothing and keeps the PID check.
+ */
+export function incarnationEnded(pid, recorded, probe = procIncarnationProbe) {
+    if (typeof recorded.boot === 'string') {
+        const boot = probe.bootId();
+        if (boot && boot !== recorded.boot)
+            return true;
+    }
+    if (typeof recorded.start === 'string') {
+        const start = probe.startTime(pid);
+        if (start && start !== recorded.start)
+            return true;
+    }
+    return false;
+}

package/dist/reminders/manager.d.ts

@@ -0,0 +1,75 @@
+import type { ReminderAttempt, UrgentReminderHooks } from '../session/arbiter.js';
+import type { PromptOrigin } from '../session/types.js';
+import type { ReminderEvent, ReminderRecord, ReminderStore } from './store.js';
+/** The admission seam: the role's RoleTurnArbiter in production. */
+export interface ReminderAdmitter {
+    tryReminder(text: string, origin: Extract<PromptOrigin, {
+        kind: 'self-reminder';
+    }>, beforeQueue: () => boolean, releaseGuard: () => boolean): Promise<ReminderAttempt>;
+    /** Urgent admission (see `RoleTurnArbiter.tryUrgentReminder`). Absent: urgent reminders are idle-only. */
+    tryUrgentReminder?(origin: Extract<PromptOrigin, {
+        kind: 'self-reminder';
+    }>, hooks: UrgentReminderHooks): Promise<ReminderAttempt>;
+}
+export interface ReminderManagerDeps {
+    now(): number;
+    setTimer(callback: () => void, ms: number): unknown;
+    clearTimer(timer: unknown): void;
+    log(line: string): void;
+}
+/**
+ * The dispatcher never sleeps longer than this while reminders are open, so a
+ * wall-clock jump (host suspend, NTP step) is noticed within a minute. With
+ * nothing open it arms no timer at all: an idle agent costs nothing.
+ */
+export declare const REMINDER_POLL_CEILING_MS = 60000;
+export interface ReminderManagerHandle {
+    start(): void;
+    stop(): void;
+    /** Called after an agent tool changed the schedule so the timer reflects it. */
+    changed(): void;
+}
+/**
+ * Turns due self-reminders into wakes for the agent that owns them.
+ *
+ * Runs inside that agent's runner, beside the role's turn arbiter. It starts
+ * only after the role's startup turn has succeeded and stops before the runner
+ * releases its runtime binding. Admission is idle-only by default: a wake
+ * never interrupts or queues behind work, and the session's release guard
+ * makes the durable `dispatched` claim at the moment the prompt reaches the
+ * model. A reminder created with `interrupt: true` is considered first and may
+ * ask an interruptible busy turn to stop once (`tryUrgentReminder`); the
+ * release guard is still the only path to the model.
+ */
+export declare class ReminderManager implements ReminderManagerHandle {
+    private readonly role;
+    private readonly store;
+    private readonly admitter;
+    private readonly deps;
+    private timer?;
+    private started;
+    private stopping;
+    private polling;
+    private busyStreak;
+    /** Consecutive re-arms with work already overdue; drives the spin backoff. */
+    private overdueStreak;
+    private readonly inFlight;
+    constructor(role: string, store: ReminderStore, admitter: ReminderAdmitter, deps: ReminderManagerDeps);
+    start(): void;
+    /** Synchronous: after this returns no timer is armed and every release guard refuses. */
+    stop(): void;
+    get isStopping(): boolean;
+    changed(): void;
+    /** Public fake-clock seam; the timer calls the same transition. */
+    poll(): Promise<void>;
+    private admit;
+    private guard;
+    private retryAt;
+    private schedule;
+}
+/**
+ * The wake text. It carries the agent's own title so the wake is legible, but
+ * the note is only returned by `fleet_reminder_inspect`, which also re-checks
+ * eligibility at the moment the agent acts.
+ */
+export declare function wakePrompt(event: ReminderEvent, reminder: ReminderRecord, now: number, retry: boolean): string;