@ours.network/fleet 1.2.0-nightly.8 → 1.2.0-nightly.80

package/dist/application/session-control.js

@@ -1,20 +1,42 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { conversationTailPage, resumedConversationPage } from './conversation-history.js';
 import { controlRequest, followConversation } from '../session/control.js';
 import { FleetError, normalizeError } from './errors.js';
 const visibleEvents = (events) => events.filter(event => event.kind !== 'thought');
 export class RoleSessionControlAdapter {
     stateDir;
     request;
-    constructor(stateDir, request = controlRequest) {
+    openFollow;
+    observeRole;
+    controlHealthy = true;
+    constructor(stateDir, request = controlRequest, openFollow = followConversation, observeRole) {
         this.stateDir = stateDir;
         this.request = request;
+        this.openFollow = openFollow;
+        this.observeRole = observeRole;
     }
-    async describe() {
-        const response = await this.call('snapshot');
-        const result = response;
-        return {
-            backend: result.backend, protocolVersion: result.protocolVersion ?? 1,
-            features: result.features ?? [], snapshot: result,
-        };
+    async agentContacts() { await this.requireCorrespondence(); return this.call('agent_contacts'); }
+    async agentHistory(request) { await this.requireCorrespondence(); return this.call('agent_history', { agentHistory: request }); }
+    async requireCorrespondence() { if (!(await this.describe()).features.includes('agent_correspondence'))
+        throw new FleetError('capability_unavailable', 'This session needs an updated supervisor to show contacts and history.'); }
+    async describe(roleObservation) {
+        // A describe probe owns and always disposes its temporary watcher. Follow uses
+        // a separate connection-owned observer and publishes updates via onRole.
+        const role = roleObservation ?? this.observeRole?.(() => { });
+        try {
+            const response = await this.call('snapshot');
+            const result = response;
+            const features = (result.features ?? []).filter(feature => feature !== 'conversation_live_complete');
+            if (this.controlHealthy && role?.snapshot().health === 'healthy' && role.snapshot().availability === 'available'
+                && features.includes('conversation_observation') && features.includes('control_heartbeat'))
+                features.push('conversation_live_complete');
+            return { backend: result.backend, protocolVersion: result.protocolVersion ?? 1, features, snapshot: result };
+        }
+        finally {
+            if (!roleObservation)
+                role?.dispose();
+        }
     }
     async snapshot() {
         return await this.call('snapshot');
@@ -58,28 +80,103 @@ export class RoleSessionControlAdapter {
         };
     }
     async conversationPage(request = {}) {
-        return await this.call('conversation_page', {
+        const live = await this.call('conversation_page', {
             after: request.after, limit: request.limit,
         });
+        const snapshot = await this.snapshot();
+        if (snapshot.backend !== 'acp' || !snapshot.sessionId)
+            return live;
+        try {
+            const history = await resumedConversationPage(this.stateDir, request, live, snapshot.sessionId);
+            const check = await this.call('conversation_page', { limit: 1 });
+            return check.snapshot.sessionGeneration === live.snapshot.sessionGeneration ? history : await this.call('conversation_page', request);
+        }
+        catch {
+            return live;
+        }
+    }
+    async conversationTail(request = {}) {
+        // A replacement while reading disk invalidates both the tail and its snapshot.
+        for (let attempt = 0; attempt < 3; attempt++) {
+            request.signal?.throwIfAborted();
+            const live = await this.call('conversation_page', { limit: 1 });
+            request.signal?.throwIfAborted();
+            const snapshot = await this.snapshot();
+            let resumed;
+            if (snapshot.backend === 'acp' && snapshot.sessionId) {
+                try {
+                    if ((await readFile(join(this.stateDir, '.acp-session-id'), 'utf8')).trim() === snapshot.sessionId)
+                        resumed = snapshot.sessionId;
+                }
+                catch { /* no resumed history: live generation only */ }
+            }
+            let page;
+            try {
+                page = await conversationTailPage(this.stateDir, request, live.snapshot, resumed, request.signal);
+            }
+            catch (error) {
+                request.signal?.throwIfAborted();
+                throw new FleetError('invalid_request', error.message);
+            }
+            request.signal?.throwIfAborted();
+            const check = await this.call('conversation_page', { limit: 1 });
+            request.signal?.throwIfAborted();
+            if (check.snapshot.sessionGeneration === live.snapshot.sessionGeneration)
+                return page;
+        }
+        throw new FleetError('stale_state', 'Session generation changed during conversation baseline; explicit recovery required.');
     }
     async submitPromptV2(request) {
         if (!request.text.trim())
             throw new FleetError('invalid_request', 'text is required');
         if (Buffer.byteLength(request.text) > 32 * 1024)
             throw new FleetError('invalid_request', 'text exceeds 32 KiB');
+        // A prompt bound to a session generation (voice or attachments) is checked atomically by supervisors that
+        // support it. Older supervisors do not know that command and never answer, so check the generation here
+        // and submit an ordinary prompt; its command id keeps retries idempotent either way.
+        const features = request.requireIdle ? (await this.describe()).features : undefined;
+        if (request.requireIdle && (!request.expectedSessionGeneration || !features?.includes('idle_bound_prompts')))
+            throw new FleetError('capability_unavailable', 'Live voice requires an updated supervisor.');
+        let command = 'submit_prompt_v2';
+        if (request.expectedSessionGeneration) {
+            if ((await this.describe()).features.includes('generation_bound_prompts'))
+                command = 'submit_voice_prompt';
+            else {
+                const live = await this.call('conversation_page', { limit: 1 });
+                if (live.snapshot?.sessionGeneration !== request.expectedSessionGeneration)
+                    throw new FleetError('stale_state', 'Agent session changed. Record a new voice message.');
+            }
+        }
         try {
-            return await this.call('submit_prompt_v2', {
+            return await this.call(command, {
                 commandId: request.commandId, text: request.text, actor: request.actorBrowserSession,
-                source: request.source,
+                source: request.source, expectedSessionGeneration: request.expectedSessionGeneration, requireIdle: request.requireIdle,
             });
         }
         catch (error) {
             const fleetError = normalizeError(error);
+            if (fleetError.message.includes('session_changed:'))
+                throw new FleetError('stale_state', 'Agent session changed. Record a new voice message.');
+            if (fleetError.message.includes('voice_busy:'))
+                throw new FleetError('conflict', 'Agent is already working. Wait for the current turn.');
             if (fleetError.message.includes('idempotency_conflict'))
                 throw new FleetError('idempotency_conflict', 'this command id was already used with a different prompt body');
             throw fleetError;
         }
     }
+    async interruptPromptV2(request) {
+        if (!(await this.describe()).features.includes('targeted_voice_interrupt'))
+            throw new FleetError('capability_unavailable', 'Live voice requires an updated supervisor.');
+        try {
+            return await this.call('interrupt_voice_v2', request);
+        }
+        catch (error) {
+            const failure = normalizeError(error);
+            if (failure.message.includes('session_changed:'))
+                throw new FleetError('stale_state', 'Agent session changed.');
+            throw failure;
+        }
+    }
     async interruptV2(commandId) {
         const receipt = await this.call('interrupt_v2', { commandId });
         return {
@@ -101,32 +198,133 @@ export class RoleSessionControlAdapter {
         }
     }
     async followConversation(request) {
+        const passive = 'controller' in request ? request : undefined;
         let sawPage = false;
         let closed = false;
+        let role;
+        let unsubscribeRole;
+        let lifetime;
+        let roleRevision = -1;
+        let silence;
+        let lastControlHeartbeat = Date.now();
+        const armSilence = () => {
+            if (silence)
+                clearTimeout(silence);
+            silence = setTimeout(() => {
+                // Liveness only: no role/session snapshots, regardless of web traffic.
+                if (Date.now() - lastControlHeartbeat >= 45_000) {
+                    this.controlHealthy = false;
+                    finish('control-silent');
+                }
+                else
+                    armSilence();
+            }, Math.max(1, 45_000 - (Date.now() - lastControlHeartbeat)));
+            silence.unref?.();
+        };
+        let follow;
         const finish = (reason) => {
             if (closed)
                 return;
             closed = true;
+            passive?.signal?.removeEventListener('abort', aborted);
+            if (silence)
+                clearTimeout(silence);
+            unsubscribeRole?.();
+            if (!passive?.roleObservation)
+                role?.dispose();
+            follow?.close();
             request.onClose(reason);
         };
-        const follow = await followConversation(this.stateDir, request.after, message => {
-            if (message.conversationEvent) {
-                request.onEvent(message.conversationEvent);
-                return;
+        const aborted = () => finish('conversation follow aborted');
+        passive?.signal?.addEventListener('abort', aborted, { once: true });
+        if (passive?.signal?.aborted)
+            aborted();
+        if (closed)
+            return { close: () => { } };
+        try {
+            if (passive) {
+                const changed = (state) => {
+                    if (closed || state.roleRevision <= roleRevision)
+                        return;
+                    roleRevision = state.roleRevision;
+                    passive.onRole?.(state);
+                    if (state.health !== 'healthy') {
+                        this.controlHealthy = false;
+                        finish(state.failure ?? 'role-observation-unavailable');
+                    }
+                    else if (lifetime !== undefined && (state.roleLifetime !== lifetime || state.availability !== 'available' || state.stateDir !== this.stateDir))
+                        finish('role-replaced');
+                    lifetime = state.roleLifetime;
+                };
+                role = passive.roleObservation ?? this.observeRole?.(() => { });
+                if (role) {
+                    const registration = role.subscribe(changed);
+                    unsubscribeRole = registration.unsubscribe;
+                    const initial = registration.snapshot;
+                    changed(initial);
+                    if (initial.availability !== 'available' || initial.stateDir !== this.stateDir)
+                        finish('role-unavailable');
+                    if (closed)
+                        return { close: () => { } };
+                }
+                armSilence();
             }
-            if (!sawPage) {
-                sawPage = true;
+            follow = await this.openFollow(this.stateDir, passive ? { controller: false, expectedGeneration: passive.expectedGeneration, after: passive.after, signal: passive.signal } : request.after, message => {
+                if (closed)
+                    return;
+                if (passive) {
+                    // A delayed callback must not revive an already elapsed source deadline.
+                    if (Date.now() - lastControlHeartbeat >= 45_000) {
+                        this.controlHealthy = false;
+                        finish('control-silent');
+                        return;
+                    }
+                    if (message.controlHeartbeat === true || message.conversationReplay || message.conversationReady || message.conversationEvent || message.conversationState) {
+                        lastControlHeartbeat = Date.now();
+                        this.controlHealthy = true;
+                        armSilence();
+                    }
+                    if (message.controlHeartbeat === true)
+                        return;
+                }
                 if (message.ok === false) {
                     finish(String(message.error ?? 'conversation follow refused'));
-                    follow.close();
                     return;
                 }
-                request.onPage(message.result);
+                if (message.conversationEvent) {
+                    request.onEvent(message.conversationEvent);
+                    return;
+                }
+                if (passive) {
+                    if (message.conversationReplay)
+                        passive.onReplay(message.conversationReplay);
+                    else if (message.conversationReady)
+                        passive.onReady(message.conversationReady);
+                    else if (message.conversationState)
+                        passive.onState(message.conversationState);
+                }
+                else if (!sawPage) {
+                    sawPage = true;
+                    request.onPage(message.result);
+                }
+            });
+            // Abort may win while the connector is still creating its handle.
+            if (closed || passive?.signal?.aborted) {
+                follow.close();
+                finish('conversation follow aborted');
             }
-        });
-        follow.socket.once('close', () => finish());
-        follow.socket.once('error', error => finish(error.message));
-        return { close: () => { follow.close(); finish(); } };
+            else {
+                follow.socket.once('close', () => finish());
+                follow.socket.once('error', error => finish(error.message));
+                if (follow.socket.destroyed)
+                    finish();
+            }
+            return { close: () => finish() };
+        }
+        catch (error) {
+            finish(error.message);
+            throw error;
+        }
     }
     async respondPermission(request) {
         await this.call('respond_permission', request);

package/dist/application/supervisor-ours-tools.js

@@ -1,3 +1,4 @@
+import { socketPath } from '../socket-path.js';
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -35,7 +36,8 @@ export class SupervisorOursTools {
         const identity = legacy
             ? legacySupervisorIdentity(role, identityName, selected.temporary, descriptor.generation)
             : { name: identityName, cid: descriptor.cid, generation: descriptor.generation };
-        if (legacy && descriptor.socket !== join(selected.dir, '.ours-bridge', `g${descriptor.generation}.sock`))
+        const legacySocket = join(selected.dir, '.ours-bridge', `g${descriptor.generation}.sock`);
+        if (legacy && descriptor.socket !== legacySocket && descriptor.socket !== socketPath(legacySocket))
             throw new FleetError('capability_unavailable', 'legacy supervisor socket does not match the selected agent');
         if ((!legacy && (descriptor.role !== role || descriptor.identity !== identityName))
             || !/^[a-f0-9]{64}$/i.test(identity.cid ?? '') || !Number.isSafeInteger(descriptor.generation) || descriptor.generation < 1)
@@ -71,16 +73,8 @@ export class SupervisorOursTools {
                     verifySelection();
                     return;
                 }
-                const actual = await client.callTool({ name: 'current_identity', arguments: {} });
-                const blocks = actual.content;
-                const lines = blocks?.length === 1 && blocks[0].type === 'text' ? blocks[0].text?.split('\n') : undefined;
-                const prefix = `Bound to "${identity.name}" (${identity.cid})`;
-                const suffix = lines?.[0].startsWith(prefix) ? lines[0].slice(prefix.length) : undefined;
-                const roleSuffix = typeof suffix === 'string' && /^ — role "[^"\r\n]+" under root "[^"\r\n]+"\.$/.test(suffix);
-                const temporaryLine = 'TEMPORARY identity owned by the Fleet supervisor for this logical agent instance. Bridge or harness disconnect retains it; terminal supervisor release deletes local state with best-effort peer notices.';
-                if (actual.isError || !(roleSuffix || (selected.temporary && suffix === '.'))
-                    || (selected.temporary ? lines?.[1] !== temporaryLine : lines?.[1]?.startsWith('TEMPORARY')))
-                    throw new FleetError('capability_unavailable', 'connected supervisor identity does not match legacy ownership proof');
+                // The supervisor owns the binding. The authenticated bridge and pinned local
+                // assignment are authoritative; current_identity is display text, not a protocol.
                 const fresh = legacySupervisorIdentity(role, identityName, selected.temporary, descriptor.generation);
                 if (!('proof' in identity) || fresh.proof !== identity.proof)
                     throw new FleetError('capability_unavailable', 'legacy supervisor identity changed');

package/dist/application/task-layouts.d.ts

@@ -0,0 +1,91 @@
+import { type RoomLayoutDefinition } from '../rooms-tasks/layout-config.js';
+import { RoomLayoutService } from '../rooms-tasks/layout-service.js';
+import type { TaskLayoutLink, TaskRecord } from '../rooms-tasks/types.js';
+export type TaskLayoutOperation = 'open' | 'close-room' | 'close';
+export interface TaskLayoutOperationRecord {
+    /** Only the worker holding the current ID may update the record. */
+    id: string;
+    operation: TaskLayoutOperation;
+    room?: string;
+    status: 'launching' | 'running' | 'succeeded' | 'failed';
+    error?: string;
+    updated_at: string;
+}
+export interface TaskLayoutRoomView {
+    key: string;
+    goal: string;
+    members: string[];
+    roles?: Record<string, string>;
+    state: 'declared' | 'provisioning' | 'active' | 'closed';
+    room_id?: string;
+    identity_cid?: string;
+    ready: string[];
+}
+export interface TaskLayoutView {
+    name: string;
+    run_id: string;
+    created: boolean;
+    closed: boolean;
+    closing: boolean;
+    uncertain?: string;
+    rooms: TaskLayoutRoomView[];
+    participants: Array<{
+        key: string;
+        participant?: string;
+        room?: string;
+        agent_template?: string;
+        owned: boolean;
+        retired: boolean;
+        agent?: string;
+        cid?: string;
+    }>;
+    operation?: TaskLayoutOperationRecord;
+}
+/** Hash of the authorable definition only (never the source file path). */
+export declare function layoutDefinitionHash(definition: RoomLayoutDefinition): string;
+/** Always-current brief for layout participants; rooms may open long after the run snapshot.
+ * It lives in Fleet's private layout state, never in the agent-writable task workspace. */
+export declare function taskBriefPath(task: Pick<TaskRecord, 'task_id'>): string;
+export declare function writeTaskBrief(task: Pick<TaskRecord, 'task_id' | 'title' | 'brief'>): void;
+/** Task context reaches every participant through the room contract (briefing text).
+ * The contract references the brief file instead of copying the brief, so later edits reach later rooms. */
+export declare function taskScopedDefinition(definition: RoomLayoutDefinition, task: Pick<TaskRecord, 'task_id' | 'title' | 'brief' | 'workspace'>): RoomLayoutDefinition;
+/** Opening rooms requires a started, live task; checked again by the worker before any side effect. */
+export declare function assertLayoutOpenable(task: TaskRecord): void;
+export declare class TaskLayouts {
+    private configPath?;
+    private deps;
+    constructor(configPath?: string | undefined, deps?: {
+        service?: RoomLayoutService;
+        launch?: (args: string[], operation: string) => Promise<void>;
+        binPath?: () => string | undefined;
+    });
+    private service;
+    private operationPath;
+    private provenancePath;
+    /** Serializes run creation, worker preconditions and deletion's removal of the run. */
+    private withTaskLock;
+    /** Resolve a layout for task creation: it must exist, parse and reference known Agent Templates. */
+    resolve(name: string): {
+        name: string;
+        definition_hash: string;
+    };
+    runExists(link: TaskLayoutLink): boolean;
+    /** Idempotent: reuse a run whose provenance matches this task, or snapshot one from the pinned source. */
+    ensureRun(task: TaskRecord, precondition?: (current: TaskRecord) => void): Promise<void>;
+    private verifyProvenance;
+    readOperation(runId: string): TaskLayoutOperationRecord | undefined;
+    /** Update only the still-current operation; a superseded or forgotten one is never resurrected. */
+    private updateOperation;
+    private writeOperation;
+    /** Sanitized read model: no Agent Template snapshots, owner fingerprints or session internals. */
+    view(task: TaskRecord): TaskLayoutView | undefined;
+    /** Accept an operation and run it in a detached worker; the outcome is recorded for polling. */
+    launch(task: TaskRecord, operation: TaskLayoutOperation, room?: string): Promise<TaskLayoutOperationRecord>;
+    /** Worker body. Errors are recorded and rethrown; unknown engine outcomes stay in run state for inspection. */
+    /** Without an ID (direct CLI use) the worker claims a new current operation. */
+    run(task: TaskRecord, operation: TaskLayoutOperation, room?: string, operationId?: string): Promise<void>;
+    private perform;
+    /** Deletion: close every layout resource, then remove the run and its operation record. */
+    closeAndForget(task: Pick<TaskRecord, 'task_id' | 'layout'>): Promise<void>;
+}