@ours.network/fleet 1.2.0-nightly.73 → 1.2.0-nightly.75

package/dist/application/resource-observer.js

@@ -65,6 +65,14 @@ function identity(path, followLink = false) {
     }
 }
 function within(path, root) { return path === root || path.startsWith(root + sep); }
+/** Lock directories and the claim/reclaim entries derived from their names
+ * (`<lock>.claim.<pid>.<uuid>`, `<lock>.reclaim`) are never resources. */
+const lockClaim = /\.claim\.\d+\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$|\.reclaim$/;
+function lockName(name) { return name === '.locks' || name.endsWith('.lock'); }
+function lockArtifact(name) { return lockName(name) || (lockClaim.test(name) && lockName(name.replace(lockClaim, ''))); }
+/** Full discovery is synchronous and lstats every covered directory. Wakes are
+ * still delivered promptly, but discovery runs at most once per window. */
+const DISCOVERY_WINDOW_MS = 100;
 /** Native notifications cover supported local mounts. No idle content scan or
  * silent claim of coverage after watch failure. Parents survive atomic rename.
  * Discovery reads directory metadata only, never opens a controller or transcript. */
@@ -87,9 +95,11 @@ export function observeFleetResources(scope, onCommitted, signal) {
             trustedPaths.add(parent);
     }
     const resourceIdentity = (path) => identity(path, trustedPaths.has(path));
+    const locks = resolve(stateRoot(), 'locks');
+    const ignored = (path) => within(path, locks) || path.split(sep).some(name => lockArtifact(name) || name.endsWith('.tmp'));
     let state = { protocolVersion: 1, producerGeneration: randomUUID(), position: 0, health: 'healthy' };
-    let disposed = signal.aborted, queued = false;
-    let recovery;
+    let disposed = signal.aborted, queued = false, discoveredAt = -Infinity;
+    let recovery, discovery;
     let installing = false, installFailure;
     const cursors = new Set();
     const watchers = new Map();
@@ -110,6 +120,7 @@ export function observeFleetResources(scope, onCommitted, signal) {
     const install = () => {
         installing = true;
         installFailure = undefined;
+        let added = 0;
         try {
             const wanted = new Set();
             const cover = (dir) => {
@@ -131,7 +142,7 @@ export function observeFleetResources(scope, onCommitted, signal) {
                             return;
                         // Ignore sibling noise from ancestor coverage, lock churn and delivery acknowledgements.
                         const changed = filename === null ? dir : resolve(dir, String(filename));
-                        if (changed.split(sep).some(name => name === '.locks' || name.endsWith('.lock') || name.endsWith('.tmp')))
+                        if (ignored(changed))
                             return;
                         if (paths.some(path => within(changed, path) || within(path, changed)) || (configEnabled && changed === config) || filename === null)
                             wake(filename === null ? undefined : changed);
@@ -145,6 +156,7 @@ export function observeFleetResources(scope, onCommitted, signal) {
                     throw error;
                 }
                 watchers.set(dir, { identity: id, handle });
+                added++;
                 handle.on('error', (error) => { if (watchers.get(dir)?.handle === handle)
                     fail(error); });
                 handle.on('close', () => { if (watchers.get(dir)?.handle === handle)
@@ -153,6 +165,8 @@ export function observeFleetResources(scope, onCommitted, signal) {
                     throw installFailure;
             };
             const visit = (dir, depth) => {
+                if (within(dir, locks))
+                    return;
                 const id = resourceIdentity(dir);
                 if (!id)
                     return;
@@ -171,7 +185,7 @@ export function observeFleetResources(scope, onCommitted, signal) {
                     throw error;
                 }
                 for (const entry of entries) {
-                    if (!entry.isDirectory() || entry.isSymbolicLink() || entry.name === '.locks' || entry.name.endsWith('.lock'))
+                    if (!entry.isDirectory() || entry.isSymbolicLink() || lockArtifact(entry.name))
                         continue;
                     visit(join(dir, entry.name), depth - 1);
                 }
@@ -195,6 +209,7 @@ export function observeFleetResources(scope, onCommitted, signal) {
             }
             if (installFailure)
                 throw installFailure;
+            return added;
         }
         finally {
             installing = false;
@@ -236,21 +251,48 @@ export function observeFleetResources(scope, onCommitted, signal) {
             queued = false;
             if (disposed || state.health !== 'healthy')
                 return;
-            try {
-                install();
-            }
-            catch (error) {
-                fail(error);
-                return;
+            if (!discovery) {
+                const wait = discoveredAt + DISCOVERY_WINDOW_MS - performance.now();
+                if (wait <= 0) {
+                    discover(false);
+                    return;
+                }
+                discovery = setTimeout(() => { discovery = undefined; discover(true); }, wait);
+                discovery.unref();
             }
+            // Covered directories were watched before this wake; directories created
+            // since the last pass are covered by the pending one.
             onCommitted({ ...state });
         });
     };
+    const discover = (deferred) => {
+        if (disposed || state.health !== 'healthy')
+            return;
+        discoveredAt = performance.now();
+        let added;
+        try {
+            added = install();
+        }
+        catch (error) {
+            fail(error);
+            return;
+        }
+        // Every wake before a deferred pass was already delivered. Writes into
+        // directories it newly covers have no event of their own: treat as unknown.
+        if (deferred) {
+            if (!added)
+                return;
+            state = { ...state, position: state.position + 1 };
+            for (const cursor of cursors)
+                cursor.position = state.position;
+        }
+        onCommitted({ ...state });
+    };
     const direct = (path) => { if (paths.some(root => within(path, root)) || (configEnabled && path === config))
         wake(path); };
     let detach;
     const dispose = () => { if (disposed)
-        return; disposed = true; clearTimeout(recovery); recovery = undefined; detach?.(); for (const cursor of [...cursors])
+        return; disposed = true; clearTimeout(recovery); recovery = undefined; clearTimeout(discovery); discovery = undefined; detach?.(); for (const cursor of [...cursors])
         cursor.dispose(); commits.delete(direct); signal.removeEventListener('abort', dispose); release(); };
     if (!disposed) {
         commits.add(direct);

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.73",
-  "buildId": "b6b76cb3faf6",
-  "commit": "45058aae764ba12d712ea74da7bbdb840c497171",
+  "version": "1.2.0-nightly.75",
+  "buildId": "adbb39fb78cd",
+  "commit": "3a4e46ab47afdcfe370c827809357d8c67f69783",
   "dirty": true,
-  "builtAt": "2026-10-18T13:27:24.108Z",
+  "builtAt": "2026-10-18T20:22:00.847Z",
   "capabilities": [
     "service.refresh-v1",
     "managed-cli.codex-reasoning-effort-v1",

package/dist/web/server.js

@@ -56,8 +56,9 @@ export async function buildWebServer(services, boundary, options = {}) {
         if (auth.appOrigin && request.headers.origin === auth.appOrigin && request.url.startsWith('/api/')) {
             reply.header('Access-Control-Allow-Origin', auth.appOrigin).header('Vary', 'Origin');
             reply.header('Access-Control-Allow-Methods', 'GET,POST,PUT,PATCH,DELETE,OPTIONS');
-            reply.header('Access-Control-Expose-Headers', 'X-Ours-Workspace-Auth, X-Ours-Request-Id');
-            reply.header('Access-Control-Allow-Headers', 'Authorization,Content-Type,X-CSRF-Token,Idempotency-Key');
+            // The App binds resource reads by these headers; it must be able to send and read them cross-origin.
+            reply.header('Access-Control-Expose-Headers', 'X-Ours-Workspace-Auth, X-Ours-Request-Id, X-Resource-Producer, X-Resource-Revision, X-Resource-Source-Generation, X-Resource-Source-Position, X-Resource-Connection, X-Resource-View, X-Resource-Epoch, X-Resource-Baseline');
+            reply.header('Access-Control-Allow-Headers', 'Authorization,Content-Type,X-CSRF-Token,Idempotency-Key,X-Ours-Messenger-CSRF,X-Resource-Connection,X-Resource-View,X-Resource-Epoch,X-Resource-Baseline');
             if (request.method === 'OPTIONS') {
                 auth.validateBoundary(request, false);
                 return reply.code(204).send();
@@ -428,6 +429,10 @@ export async function buildWebServer(services, boundary, options = {}) {
     app.get('/api/v1/resource-events', async (request, reply) => {
         const browser = auth.authenticate(request);
         reply.hijack();
+        // A hijacked reply bypasses Fastify headers: keep the exact-origin CORS and security headers.
+        for (const [name, value] of Object.entries(reply.getHeaders()))
+            if (value !== undefined)
+                reply.raw.setHeader(name, Array.isArray(value) ? value : String(value));
         reply.raw.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache, no-transform', Connection: 'keep-alive', 'X-Accel-Buffering': 'no' });
         reply.raw.flushHeaders();
         const opened = resources.open(reply.raw, browser.id, () => auth.sessionValid(browser));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.73",
+  "version": "1.2.0-nightly.75",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",