@ours.network/fleet 1.2.0-nightly.70 → 1.2.0-nightly.72

package/dist/account-origin.d.ts

@@ -1,2 +1,5 @@
-export declare const accountOrigins: readonly ["https://app.ours.network", "https://app.ours-tunnel.com"];
+/** Syntax validation for an authority already selected by trusted private state/configuration. */
 export declare function validateAccountOrigin(value: unknown): string;
+/** Incoming grants/payloads must match explicit operator configuration before any network action. */
+export declare function validateConfiguredAccountOrigin(value: unknown): string;
+export declare function validateConfiguredWorkspaceHost(value: unknown): boolean;

package/dist/account-origin.js

@@ -1,6 +1,31 @@
-export const accountOrigins = ['https://app.ours.network', 'https://app.ours-tunnel.com'];
+/** Syntax validation for an authority already selected by trusted private state/configuration. */
 export function validateAccountOrigin(value) {
-    if (typeof value !== 'string' || !accountOrigins.some(origin => origin === value))
+    let url;
+    try {
+        if (typeof value !== 'string')
+            throw Error();
+        url = new URL(value);
+    }
+    catch {
+        throw Error('Unsupported account origin');
+    }
+    if (url.protocol !== 'https:' || url.origin !== value || url.username || url.password)
         throw Error('Unsupported account origin');
     return value;
 }
+/** Incoming grants/payloads must match explicit operator configuration before any network action. */
+export function validateConfiguredAccountOrigin(value) {
+    const configured = validateAccountOrigin(process.env.OURS_ACCOUNT_ORIGIN);
+    if (value !== configured)
+        throw Error('Unsupported account origin');
+    return configured;
+}
+const dnsName = (value) => typeof value === 'string' && value.length <= 253 && value.includes('.') && value.split('.').every(label => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label));
+export function validateConfiguredWorkspaceHost(value) {
+    if (!dnsName(value))
+        return false;
+    if (process.env.OURS_WORKSPACE_HOST !== undefined)
+        return dnsName(process.env.OURS_WORKSPACE_HOST) && value === process.env.OURS_WORKSPACE_HOST;
+    const domain = process.env.OURS_WORKSPACE_DOMAIN;
+    return dnsName(domain) && value.endsWith('.' + domain) && !value.slice(0, -domain.length - 1).includes('.');
+}

package/dist/application/conversation-history.d.ts

@@ -25,3 +25,10 @@ export declare function resumedConversationPage(stateDir: string, request: {
 }, live: ConversationPageView, expectedSessionId: string): Promise<ConversationPageView>;
 /** Download authorization requires an actual published attachment, never an orphan copy. */
 export declare function conversationHasAttachment(stateDir: string, attachment: import('../file-delivery/types.js').DeliveredFile): Promise<boolean>;
+/** Passive, bounded last assistant text for directory previews. Never opens the
+ * ledger writer/recovery path or acquires a session/controller. An incomplete
+ * newest append is not committed yet; completed malformed records still fail. */
+export declare function conversationPreview(stateDir: string, signal: AbortSignal): Promise<{
+    text: string;
+    at: string;
+}>;

package/dist/application/conversation-history.js

@@ -213,3 +213,68 @@ export async function conversationHasAttachment(stateDir, attachment) {
     }
     return found;
 }
+/** Passive, bounded last assistant text for directory previews. Never opens the
+ * ledger writer/recovery path or acquires a session/controller. An incomplete
+ * newest append is not committed yet; completed malformed records still fail. */
+export async function conversationPreview(stateDir, signal) {
+    signal.throwIfAborted();
+    const dir = join(stateDir, '.conversation');
+    let files;
+    try {
+        files = (await readdir(dir)).filter(name => /^events-\d{6}\.jsonl$/.test(name)).sort().reverse();
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { text: 'No recent agent output', at: '' };
+        throw error;
+    }
+    const events = [];
+    for (const name of files) {
+        signal.throwIfAborted();
+        const file = await open(join(dir, name), 'r');
+        try {
+            const size = (await file.stat()).size, length = Math.min(size, 2 * 1024 * 1024), buffer = Buffer.alloc(length);
+            await file.read(buffer, 0, length, size - length);
+            const completeEnd = buffer.lastIndexOf(10) + 1;
+            // Only the newest segment can have an in-flight append. If its tail
+            // fills the bounded window, we cannot establish the previous preview.
+            if (completeEnd < length && (name !== files[0] || (size > length && completeEnd === 0)))
+                throw Error('preview ledger has partial record');
+            const lines = buffer.toString('utf8', 0, completeEnd).split('\n');
+            lines.pop();
+            if (size > length)
+                lines.shift();
+            for (let i = lines.length - 1; i >= 0 && events.length < 200; i--) {
+                const event = JSON.parse(lines[i]);
+                if (event.schemaVersion !== 1 || !Number.isSafeInteger(event.seq))
+                    throw Error('preview ledger invalid');
+                events.push(event);
+            }
+        }
+        finally {
+            await file.close();
+        }
+        if (events.length >= 200)
+            break;
+    }
+    signal.throwIfAborted();
+    const assistant = (event) => ['message.chunk', 'message.replace'].includes(event.kind) && event.payload?.role === 'assistant' && typeof event.payload?.content?.type === 'string';
+    const end = events.findIndex(assistant);
+    if (end < 0)
+        return { text: 'No recent agent output', at: '' };
+    const last = events[end], parts = [];
+    for (let i = end; i < events.length; i++) {
+        const event = events[i];
+        if (last.messageId !== undefined) {
+            if (!assistant(event) || event.messageId !== last.messageId)
+                continue;
+        }
+        else if (!assistant(event) || event.messageId !== undefined)
+            break;
+        const content = event.payload.content;
+        parts.unshift(content.type === 'text' ? content.text : `[${content.type}]`);
+        if (event.kind === 'message.replace')
+            break;
+    }
+    return { text: parts.join('').replace(/\s+/g, ' ').trim().slice(0, 300) || 'No recent agent output', at: last.at ?? '' };
+}

package/dist/application/fleet-query-service.d.ts

@@ -24,7 +24,7 @@ export declare class FleetQueryService {
     private readonly options;
     private readonly control;
     constructor(options: FleetQueryOptions);
-    list(includeTemporary?: boolean): Promise<Array<{
+    list(includeTemporary?: boolean, strict?: boolean): Promise<Array<{
         role: RoleRecord;
         status: RoleStatus;
         capabilities: RoleCapabilities;

package/dist/application/fleet-query-service.js

@@ -75,8 +75,8 @@ export class FleetQueryService {
         this.options = options;
         this.control = options.control ?? controlRequest;
     }
-    async list(includeTemporary = false) {
-        const roles = (await this.options.repository.list())
+    async list(includeTemporary = false, strict = false) {
+        const roles = (await this.options.repository.list(strict))
             .filter(role => (role.configured && role.lifetime === 'permanent') || (includeTemporary && role.lifetime === 'temporary'));
         return Promise.all(roles.map(async (role) => {
             const status = await this.status(role);

package/dist/application/resource-observer.d.ts

@@ -0,0 +1,40 @@
+import { type FSWatcher } from 'node:fs';
+export interface FleetResourceState {
+    protocolVersion: 1;
+    producerGeneration: string;
+    position: number;
+    health: 'healthy' | 'failed' | 'unsupported';
+}
+export interface FleetResourceScope {
+    configPath?: string;
+    subscribeMutations?: (listener: () => void) => () => void;
+    /** Durable notification owners may reinstall degraded watches without idle content polling. */
+    retryWatchFailures?: boolean;
+    roots?: string[];
+    /** Overrides full Fleet discovery for narrow owners such as task delivery. */
+    paths?: string[];
+    watch?: (path: string, listener: (event: string, filename: string | null) => void) => Pick<FSWatcher, 'on' | 'close'>;
+}
+/** Only call after durable persistence succeeds. Observers cannot fail a commit. */
+export declare function publishFleetResourceCommit(path: string): void;
+/** Native notifications cover supported local mounts. No idle content scan or
+ * silent claim of coverage after watch failure. Parents survive atomic rename.
+ * Discovery reads directory metadata only, never opens a controller or transcript. */
+export declare function observeFleetResources(scope: FleetResourceScope, onCommitted: (state: FleetResourceState) => void, signal: AbortSignal): {
+    snapshot: () => {
+        health: "healthy" | "failed" | "unsupported";
+        protocolVersion: 1;
+        producerGeneration: string;
+        position: number;
+    };
+    cursor: (accepts: (path: string) => boolean, lifetime: AbortSignal) => {
+        snapshot: () => {
+            position: number;
+            health: "healthy" | "failed" | "unsupported";
+            protocolVersion: 1;
+            producerGeneration: string;
+        };
+        dispose: () => void;
+    };
+    dispose: () => void;
+};

package/dist/application/resource-observer.js

@@ -0,0 +1,278 @@
+import { EventEmitter } from 'node:events';
+import { randomUUID } from 'node:crypto';
+import { lstatSync, statSync, readdirSync, watch } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve, sep } from 'node:path';
+import { splitRootFor } from '../config.js';
+import { agentsRoot, tmpRoot, stateRoot, defaultConfigPath } from '../paths.js';
+// Directory discovery is shared by payload and notification owners. Each owner
+// has its own lifetime/coverage; the underlying OS watch is reference counted.
+const sharedWatches = new Map();
+function sharedWatch(path, listener) {
+    const key = `${path}:${identity(path, true)}`;
+    let entry = sharedWatches.get(key);
+    if (!entry) {
+        const clients = new Set(), listeners = new Map();
+        const handle = watch(path, { persistent: false }, (event, name) => { for (const fn of [...listeners.values()])
+            fn(event, name); });
+        entry = { handle, clients, listeners };
+        sharedWatches.set(key, entry);
+        handle.on('error', error => { for (const client of [...clients])
+            client.emit('error', error); });
+        handle.on('close', () => { for (const client of [...clients])
+            client.emit('close'); });
+    }
+    const current = entry, client = new EventEmitter();
+    let closed = false;
+    current.clients.add(client);
+    current.listeners.set(client, listener);
+    return Object.assign(client, { close() {
+            if (closed)
+                return;
+            closed = true;
+            current.clients.delete(client);
+            current.listeners.delete(client);
+            if (!current.clients.size) {
+                sharedWatches.delete(key);
+                current.handle.close();
+            }
+        } });
+}
+const commits = new Set();
+/** Only call after durable persistence succeeds. Observers cannot fail a commit. */
+export function publishFleetResourceCommit(path) {
+    for (const listener of [...commits]) {
+        try {
+            listener(resolve(path));
+        }
+        catch { }
+    }
+}
+function directoryGone(error) {
+    return ['ENOENT', 'ENOTDIR'].includes(error.code ?? '');
+}
+function identity(path, followLink = false) {
+    try {
+        const value = followLink ? statSync(path) : lstatSync(path);
+        if (value.isSymbolicLink())
+            throw Error('symbolic resource directory');
+        return value.isDirectory() ? `${value.dev}:${value.ino}:${value.birthtimeMs}` : undefined;
+    }
+    catch (error) {
+        if (directoryGone(error))
+            return;
+        throw error;
+    }
+}
+function within(path, root) { return path === root || path.startsWith(root + sep); }
+/** Native notifications cover supported local mounts. No idle content scan or
+ * silent claim of coverage after watch failure. Parents survive atomic rename.
+ * Discovery reads directory metadata only, never opens a controller or transcript. */
+export function observeFleetResources(scope, onCommitted, signal) {
+    const config = resolve(scope.configPath ?? defaultConfigPath());
+    const roots = (scope.roots ?? [agentsRoot(), tmpRoot()]).map(p => resolve(p));
+    const paths = (scope.paths ?? (scope.roots && !scope.configPath ? roots : [...roots, splitRootFor(config), join(stateRoot(), 'tasks'), join(stateRoot(), 'rooms'), join(stateRoot(), 'watchdogs'), join(stateRoot(), 'layouts'), join(stateRoot(), 'member-additions'), join(stateRoot(), 'subscriptions')])).map(p => resolve(p));
+    // Explicit roots without config select discovery only (notification producers).
+    const configEnabled = scope.configPath !== undefined || (!scope.paths && !scope.roots);
+    const adoptedHomes = configEnabled ? [join(homedir(), '.claude'), join(homedir(), '.codex')] : [];
+    if (configEnabled)
+        paths.push(dirname(config), resolve(stateRoot()), ...adoptedHomes);
+    // Explicit resource locations and their ancestors already belong to the
+    // caller's read scope (e.g. /home -> /var/home or a linked state root).
+    // Discovered descendants keep lstat validation and never traverse child links.
+    const trustedPaths = new Set(paths);
+    for (const path of paths) {
+        let parent = path;
+        for (let depth = 0; depth < 4 && dirname(parent) !== parent; depth++, parent = dirname(parent))
+            trustedPaths.add(parent);
+    }
+    const resourceIdentity = (path) => identity(path, trustedPaths.has(path));
+    let state = { protocolVersion: 1, producerGeneration: randomUUID(), position: 0, health: 'healthy' };
+    let disposed = signal.aborted, queued = false;
+    let recovery;
+    let installing = false, installFailure;
+    const cursors = new Set();
+    const watchers = new Map();
+    const release = () => { const old = [...watchers.values()]; watchers.clear(); for (const entry of old)
+        entry.handle.close(); };
+    const fail = (error) => {
+        if (installing) {
+            installFailure = error;
+            return;
+        }
+        if (disposed || state.health !== 'healthy')
+            return;
+        state = { ...state, position: state.position + 1, health: ['ENOSYS', 'ENOTSUP', 'ERR_FEATURE_UNAVAILABLE_ON_PLATFORM'].includes(error.code ?? '') ? 'unsupported' : 'failed' };
+        release();
+        onCommitted({ ...state });
+        recover();
+    };
+    const install = () => {
+        installing = true;
+        installFailure = undefined;
+        try {
+            const wanted = new Set();
+            const cover = (dir) => {
+                const id = resourceIdentity(dir);
+                if (!id)
+                    return;
+                wanted.add(dir);
+                const existing = watchers.get(dir);
+                if (existing && existing.identity === id)
+                    return;
+                if (existing) {
+                    watchers.delete(dir);
+                    existing.handle.close();
+                }
+                let handle;
+                try {
+                    handle = (scope.watch ?? sharedWatch)(dir, (_event, filename) => {
+                        if (watchers.get(dir)?.handle !== handle)
+                            return;
+                        // Ignore sibling noise from ancestor coverage, lock churn and delivery acknowledgements.
+                        const changed = filename === null ? dir : resolve(dir, String(filename));
+                        if (changed.split(sep).some(name => name === '.locks' || name.endsWith('.lock') || name.endsWith('.tmp')))
+                            return;
+                        if (paths.some(path => within(changed, path) || within(path, changed)) || (configEnabled && changed === config) || filename === null)
+                            wake(filename === null ? undefined : changed);
+                    });
+                }
+                catch (error) {
+                    // Parent coverage owns removal/recreation. Only verified disappearance
+                    // is benign; permissions, unsupported watches and other errors fail.
+                    if (directoryGone(error) && !resourceIdentity(dir))
+                        return;
+                    throw error;
+                }
+                watchers.set(dir, { identity: id, handle });
+                handle.on('error', (error) => { if (watchers.get(dir)?.handle === handle)
+                    fail(error); });
+                handle.on('close', () => { if (watchers.get(dir)?.handle === handle)
+                    fail(Error('resource watch closed')); });
+                if (installFailure)
+                    throw installFailure;
+            };
+            const visit = (dir, depth) => {
+                const id = resourceIdentity(dir);
+                if (!id)
+                    return;
+                // Watch before enumerating children: creation before watch is covered by
+                // this scan; creation after watch schedules another discovery pass.
+                cover(dir);
+                if (!depth)
+                    return;
+                let entries;
+                try {
+                    entries = readdirSync(dir, { withFileTypes: true });
+                }
+                catch (error) {
+                    if (directoryGone(error) && !resourceIdentity(dir))
+                        return;
+                    throw error;
+                }
+                for (const entry of entries) {
+                    if (!entry.isDirectory() || entry.isSymbolicLink() || entry.name === '.locks' || entry.name.endsWith('.lock'))
+                        continue;
+                    visit(join(dir, entry.name), depth - 1);
+                }
+            };
+            for (const path of paths) {
+                // Enough ancestors to retain the subscription when its state root is replaced.
+                let parent = path;
+                for (let depth = 0; depth < 4 && dirname(parent) !== parent; depth++, parent = dirname(parent)) {
+                    if (resourceIdentity(parent)) {
+                        wanted.add(parent);
+                        cover(parent);
+                    }
+                }
+                visit(path, configEnabled && (path === dirname(config) || adoptedHomes.includes(path)) ? 0 : 3);
+            }
+            for (const [dir, entry] of watchers) {
+                if (!wanted.has(dir) || resourceIdentity(dir) !== entry.identity) {
+                    watchers.delete(dir);
+                    entry.handle.close();
+                }
+            }
+            if (installFailure)
+                throw installFailure;
+        }
+        finally {
+            installing = false;
+        }
+    };
+    const recover = () => {
+        if (disposed || state.health === 'healthy' || !scope.retryWatchFailures || recovery)
+            return;
+        recovery = setTimeout(() => {
+            recovery = undefined;
+            if (disposed)
+                return;
+            try {
+                install();
+            }
+            catch {
+                release();
+                recover();
+                return;
+            }
+            state = { ...state, position: state.position + 1, health: 'healthy' };
+            // Reinstallation precedes one checkpoint recovery pass; later work is
+            // event driven again. Degraded retries inspect directory metadata only.
+            onCommitted({ ...state });
+        }, 3000);
+        recovery.unref();
+    };
+    const wake = (path) => {
+        if (disposed || state.health !== 'healthy')
+            return;
+        state = { ...state, position: state.position + 1 };
+        for (const cursor of cursors)
+            if (path === undefined || cursor.accepts(path))
+                cursor.position = state.position;
+        if (queued)
+            return;
+        queued = true;
+        queueMicrotask(() => {
+            queued = false;
+            if (disposed || state.health !== 'healthy')
+                return;
+            try {
+                install();
+            }
+            catch (error) {
+                fail(error);
+                return;
+            }
+            onCommitted({ ...state });
+        });
+    };
+    const direct = (path) => { if (paths.some(root => within(path, root)) || (configEnabled && path === config))
+        wake(path); };
+    let detach;
+    const dispose = () => { if (disposed)
+        return; disposed = true; clearTimeout(recovery); recovery = undefined; detach?.(); for (const cursor of [...cursors])
+        cursor.dispose(); commits.delete(direct); signal.removeEventListener('abort', dispose); release(); };
+    if (!disposed) {
+        commits.add(direct);
+        detach = scope.subscribeMutations?.(wake);
+        signal.addEventListener('abort', dispose, { once: true });
+        try {
+            install();
+        }
+        catch (error) {
+            fail(error);
+        }
+    }
+    const snapshot = () => ({ ...state, ...(disposed ? { health: 'failed' } : {}) });
+    // View-local cursors share coverage and health, but unrelated file commits
+    // cannot invalidate a capture. Unknown wakes remain conservative.
+    const cursor = (accepts, lifetime) => {
+        const entry = { accepts, position: state.position, dispose() { cursors.delete(entry); lifetime.removeEventListener('abort', entry.dispose); } };
+        if (!disposed && !lifetime.aborted) {
+            cursors.add(entry);
+            lifetime.addEventListener('abort', entry.dispose, { once: true });
+        }
+        return { snapshot: () => ({ ...snapshot(), position: entry.position }), dispose: entry.dispose };
+    };
+    return { snapshot, cursor, dispose };
+}

package/dist/application/role-removal-service.js

@@ -100,7 +100,7 @@ export class RoleRemovalService {
                 renameSync(sourceState, join(recoveryPath, 'orphan-state'));
                 removeReminderState(join(recoveryPath, 'orphan-state'));
             }
-            await retireNotificationTarget(`/fleet/chats/agents/${encodeURIComponent(preview.role)}`).catch(() => { });
+            await retireNotificationTarget({ kind: 'agent', agentId: preview.role }).catch(() => { });
             this.options.ops.log(`removed orphaned backend/state '${preview.role}'`);
         }
         return { ...preview, removed: true, recoveryPath };

package/dist/application/role-repository.d.ts

@@ -14,7 +14,7 @@ export interface RoleRepositoryOptions {
 export declare class RoleRepository {
     private readonly options;
     constructor(options?: RoleRepositoryOptions);
-    list(): Promise<RoleRecord[]>;
+    list(strict?: boolean): Promise<RoleRecord[]>;
     get(id: string): Promise<RoleRecord | undefined>;
     stateDir(record: RoleRecord): string | undefined;
     private detect;

package/dist/application/role-repository.js

@@ -20,13 +20,15 @@ function retainedTaskId(dir, name) {
         return undefined;
     }
 }
-function safeDirs(root) {
+function safeDirs(root, strict = false) {
     try {
         return readdirSync(root, { withFileTypes: true })
             .filter(entry => entry.isDirectory() && !entry.isSymbolicLink() && ROLE_NAME_RE.test(entry.name))
             .map(entry => entry.name);
     }
-    catch {
+    catch (error) {
+        if (strict && error.code !== 'ENOENT')
+            throw error;
         return [];
     }
 }
@@ -101,7 +103,7 @@ export class RoleRepository {
     constructor(options = {}) {
         this.options = options;
     }
-    async list() {
+    async list(strict = false) {
         const permanentRoot = this.options.permanentRoot ?? agentsRoot();
         const temporaryRoot = this.options.temporaryRoot ?? tmpRoot();
         let configured = [];
@@ -110,10 +112,12 @@ export class RoleRepository {
             configured = loadConfig(this.options.configPath).roles;
         }
         catch (error) {
+            if (strict)
+                throw error;
             configProblem = { code: 'config_invalid', severity: 'error', source: 'config', detail: error.message };
         }
-        const permanent = new Set(safeDirs(permanentRoot));
-        const temporary = new Set(safeDirs(temporaryRoot));
+        const permanent = new Set(safeDirs(permanentRoot, strict));
+        const temporary = new Set(safeDirs(temporaryRoot, strict));
         const configuredByName = new Map(configured.map(role => [role.name, role]));
         const names = [...new Set([...configuredByName.keys(), ...permanent, ...temporary])].sort();
         return boundedMap(names, this.options.concurrency ?? 8, async (name) => {
@@ -126,6 +130,8 @@ export class RoleRepository {
             if (inTemporary) {
                 const read = snapshot(join(temporaryRoot, name, 'role.yaml'), name);
                 tempRole = read.role;
+                if (strict && read.problem)
+                    throw new Error('temporary role snapshot unavailable');
                 if (read.problem) {
                     problems.push(read.problem);
                     stateHealth = 'corrupt';

package/dist/application/task-layouts.js

@@ -1,3 +1,4 @@
+import { publishFleetResourceCommit } from './resource-observer.js';
 /** Task ↔ Room Layout bridge.
  * A layout task owns exactly one Room Layout run, `task-<task_id>`, snapshotted
  * from the named source layout with task context added to every room contract.
@@ -134,6 +135,7 @@ export class TaskLayouts {
     writeOperation(runId, record) {
         layoutRunPath(runId); // validates the ID and creates the private layouts directory
         replaceFileAtomically(this.operationPath(runId), JSON.stringify({ ...record, updated_at: new Date().toISOString() }), 0o600);
+        publishFleetResourceCommit(this.operationPath(runId));
     }
     /** Sanitized read model: no Agent Template snapshots, owner fingerprints or session internals. */
     view(task) {

package/dist/application/task-room-service.d.ts

@@ -184,12 +184,14 @@ export declare class TaskRoomApplicationService {
         state?: TaskState | TaskState[];
         list?: string;
         includeDeleting?: boolean;
+        strict?: boolean;
     }): TaskRecord[];
     listTaskLists(): TaskListRecord[];
     groupedTasks(filter?: {
         state?: TaskState | TaskState[];
         list?: string;
         includeDeleting?: boolean;
+        strict?: boolean;
     }): Array<{
         list: TaskListRecord;
         tasks: TaskRecord[];

package/dist/application/task-room-service.js

@@ -136,7 +136,7 @@ export class TaskRoomApplicationService {
             return { ...task, layout_rooms: (view?.rooms ?? []).map(({ key, state, room_id, identity_cid }) => ({ key, state, ...(room_id ? { room_id } : {}), ...(identity_cid ? { identity_cid } : {}) })) };
         }
         catch {
-            return { ...task, layout_rooms: [] };
+            return task; /* An unreadable run cannot prove room absence. */
         }
     }
     /** Backlog only: choose, change or clear the task's Room Layout before it starts. */
@@ -302,7 +302,7 @@ export class TaskRoomApplicationService {
     }
     listTasks(filter) {
         const listId = filter?.list === undefined ? undefined : resolveTaskList(filter.list).list_id;
-        return readTasks({ state: filter?.state, listId, includeDeleting: filter?.includeDeleting });
+        return readTasks({ state: filter?.state, listId, includeDeleting: filter?.includeDeleting, strict: filter?.strict });
     }
     listTaskLists() { return readTaskLists(); }
     groupedTasks(filter) {

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.70",
-  "buildId": "ca16d5313844",
-  "commit": "16bdad930ad484741ec362a5b1f608d9c5e8706a",
+  "version": "1.2.0-nightly.72",
+  "buildId": "b6b76cb3faf6",
+  "commit": "912fae4f35543806656b5f0488fce830330681d5",
   "dirty": true,
-  "builtAt": "2026-10-16T20:49:37.491Z",
+  "builtAt": "2026-10-18T12:25:33.807Z",
   "capabilities": [
     "service.refresh-v1",
     "managed-cli.codex-reasoning-effort-v1",

package/dist/daemon-recovery.d.ts

@@ -1,5 +1,5 @@
 import { type AttachOursClientOptions, type OursClient } from '@ours.network/sdk/client';
-import { type FetchLike } from './monitor.js';
+import { type FetchLike, type IdentityPresence } from './monitor.js';
 export declare const DAEMON_RECOVERY_MAX_ATTEMPTS = 6;
 export declare const DAEMON_RECOVERY_INITIAL_BACKOFF_MS = 1000;
 export declare const DAEMON_RECOVERY_MAX_BACKOFF_MS = 5000;
@@ -30,12 +30,24 @@ export type DaemonGenerationObservation = {
     reason: string;
 };
 interface GenerationProbeDeps {
+    requestSignal?: AbortSignal;
     readText?(path: string): string;
     canonicalize?(path: string): string;
     attachClient?(options: AttachOursClientOptions): Pick<OursClient, 'version' | 'identities' | 'close'> | Promise<Pick<OursClient, 'version' | 'identities' | 'close'>>;
 }
 /** Read generation and readiness through the selected gateway. Server paths are opaque. */
 export declare function probeDaemonGeneration(fetch: FetchLike, env: NodeJS.ProcessEnv, deps?: GenerationProbeDeps): Promise<DaemonGenerationProbe>;
+export interface SelectedDaemonHealthSnapshot {
+    generation: DaemonGenerationProbe;
+    identities?: unknown[];
+}
+export interface SelectedDaemonHealthLease {
+    sample(): Promise<SelectedDaemonHealthSnapshot>;
+    presence(name: string, snapshot: SelectedDaemonHealthSnapshot): IdentityPresence;
+    release(): void;
+}
+/** Retained runtime health, independent of browser delivery and stream readiness. */
+export declare function acquireSelectedDaemonHealth(env: NodeJS.ProcessEnv, deps?: GenerationProbeDeps): SelectedDaemonHealthLease;
 export declare class DaemonGenerationObserver {
     private current?;
     private unavailable;