@ours.network/fleet 1.2.0-nightly.8 → 1.2.0-nightly.81

package/dist/supervisor/systemd.js

@@ -1,9 +1,11 @@
+import { assertNativeFleetScope } from './scope.js';
+import { clientConfigPath } from '../client-profile.js';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { delimiter, dirname, join } from 'node:path';
 import { userInfo } from 'node:os';
 import { home } from '../paths.js';
 import { realExec } from '../exec.js';
-export const UNIT_TEMPLATE = 'ours-fleet-agent@.service';
+export const UNIT_TEMPLATE = 'ours-fleet.service';
 /**
  * Actionable hint when systemctl cannot reach the user bus. After the cli.ts
  * XDG_RUNTIME_DIR fallback this branch stays reachable only when
@@ -14,7 +16,7 @@ export const busHint = (stderr) => /user scope bus|XDG_RUNTIME_DIR/.test(stderr)
     ? `\nhint: no user runtime dir — enable linger: sudo loginctl enable-linger ${userInfo().username}` +
         `\n      (if linger is already on: export XDG_RUNTIME_DIR=/run/user/$(id -u))`
     : '';
-export const unitFor = (name) => `ours-fleet-agent@${name}.service`;
+export const unitFor = (_name) => UNIT_TEMPLATE;
 /** Quote a systemd unit argument and escape its specifier marker. */
 const unitArg = (value) => `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/%/g, '%%')}"`;
 /**
@@ -56,10 +58,11 @@ async function probeLiveness(ctl, name) {
     };
 }
 export function makeSystemdBackend(exec = realExec) {
-    const ctl = (...args) => exec('systemctl', ['--user', ...args]);
+    const ctl = (...args) => { assertNativeFleetScope(exec); return exec('systemctl', ['--user', ...args]); };
     return {
         id: 'systemd',
         async init(binPath) {
+            assertNativeFleetScope(exec);
             const msgs = [];
             const unitDir = join(home(), '.config', 'systemd', 'user');
             // Lingering user units often start before a login shell imports its PATH.
@@ -69,49 +72,32 @@ export function makeSystemdBackend(exec = realExec) {
                     dirname(process.execPath),
                     ...(process.env.PATH ?? '').split(delimiter),
                 ].filter(Boolean))].join(delimiter);
-            // Same reason as PATH, for the other thing a lingering unit cannot inherit:
-            // WHICH ours daemon this fleet was set up against.
-            //
-            // ours-fleet resolves its daemon from OURS_CONFIG / OURS_PORT / OURS_STATE_DIR
-            // and otherwise falls back to ~/.ours and port 3050 (src/monitor.ts). A host
-            // set up against a non-default daemon — the installer's multi-daemon profiles
-            // do exactly this — passes that selection to `ours-fleet init` in the
-            // environment, and it died there: nothing persisted it, so every runner
-            // systemd started at boot resolved the default daemon again, and on a host
-            // where only the non-default daemon exists that is a daemon that is not there.
-            //
-            // ONLY OURS_CONFIG is baked, deliberately. It names which daemon, and leaves
-            // that daemon's own config file authoritative for port and state directory, so
-            // a later edit to it still wins. Baking OURS_PORT/OURS_STATE_DIR would freeze
-            // those into a unit file that outranks the config for ever after — the failure
-            // mode @ours.network/cli avoids for the same reason (packages/cli/src/
-            // service.ts: "The port is deliberately NOT baked").
-            //
-            // Absent from init's environment ⇒ no line, and the unit is byte-for-byte what
-            // it has always been. This teaches fleet nothing about installer profiles; it
-            // persists the selection fleet was initialised with.
+            // Persist one profile path, never a URL or service port. Profile updates
+            // are picked up by every fresh process, including lingering user services.
             const unitEnv = ['PATH=' + servicePath];
-            if (process.env.OURS_CONFIG)
-                unitEnv.push('OURS_CONFIG=' + process.env.OURS_CONFIG);
+            unitEnv.push('OURS_CONFIG=' + clientConfigPath(process.env));
+            for (const key of ['OURS_FLEET_HOME', 'OURS_FLEET_SOCKET_ROOT', 'CODEX_HOME', 'CODEX_PATH']) {
+                if (process.env[key] !== undefined)
+                    unitEnv.push(key + '=' + process.env[key]);
+            }
             const environmentLines = unitEnv
                 .map(value => `Environment="${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/%/g, '%%')}"`)
                 .join('\n');
             mkdirSync(unitDir, { recursive: true });
             writeFileSync(join(unitDir, UNIT_TEMPLATE), `[Unit]
-Description=ours-fleet agent %i
+Description=ours-fleet process manager
 After=default.target
+StartLimitIntervalSec=0
 
 [Service]
 Type=simple
 ${environmentLines}
-ExecStart=${unitArg(process.execPath)} ${unitArg(binPath)} _run %i
-# The RUNNER owns the child-session restart loop, with a counted, backed-off
-# circuit breaker. systemd must only recover the runner PROCESS crashing —
-# Restart=always here would resume the uncounted two-second relaunch loop, and
-# would also restart a runner that is deliberately holding a failing agent down.
+ExecStart=${unitArg(process.execPath)} ${unitArg(binPath)} _run-fleet
+# Fleet owns agent startup and restart; the OS recovers only the Fleet parent.
+KillMode=control-group
 Restart=on-failure
 RestartSec=5
-TimeoutStopSec=15
+TimeoutStopSec=25
 
 [Install]
 WantedBy=default.target

package/dist/task-supervision.d.ts

@@ -0,0 +1,9 @@
+/** Read-only ownership fence: absence/mismatch never permits a new identity or launch. */
+export declare function taskSupervisorMayRun(name: string): boolean;
+/** Resolve the externally recorded CID/action for explicit terminal retirement.
+ * Run only after the same launch passed taskSupervisorMayRun's ownership fence.
+ * An unpublished failed launch stays for its seat's retry/retirement saga. */
+export declare function taskMemberRetirementProof(name: string): {
+    cid: string;
+    action: string;
+};

package/dist/task-supervision.js

@@ -0,0 +1,145 @@
+import { readFileSync, lstatSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse } from 'yaml';
+import { agentDir, stateRoot } from './paths.js';
+import { readTempSupervisor } from './temp-lifecycle.js';
+import { createHash } from 'node:crypto';
+import { readProvenance } from './creation.js';
+import { getTask } from './rooms-tasks/task-state.js';
+import { getRoomRecord } from './rooms-tasks/room-state.js';
+import { assertWorkspacePresent } from './rooms-tasks/workspace.js';
+import { privateRuntimeRoot } from './agent-ours/service.js';
+import { binderKey, RuntimeJournal } from './agent-ours/state.js';
+import { assertMemberNotPermanent } from './rooms-tasks/member-ownership.js';
+import { readClientProfile } from './client-profile.js';
+import { firstManagedSessionMayStart } from './managed-recovery.js';
+function readProof(path) {
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 256 * 1024)
+        throw Error('TASK_SUPERVISOR_UNSAFE_PROOF');
+    return readFileSync(path, 'utf8');
+}
+/** An admitted task member must resume its retained instance, never allocate a successor. */
+function assertRetainedRuntime(role, action, cid, launch, session) {
+    const profile = readClientProfile({ ...process.env, ...role.env });
+    if (!profile)
+        throw Error('TASK_RUNTIME_PROFILE_MISSING');
+    const dir = join(privateRuntimeRoot(), binderKey(profile.expectedInstanceId, role.identity));
+    const instance = JSON.parse(readProof(join(dir, 'instance.json')));
+    const owner = JSON.parse(readProof(join(dir, 'owner.json')));
+    const pin = JSON.parse(readProof(join(dir, 'identity-pin.json')));
+    readProof(join(dir, 'state.json'));
+    const state = new RuntimeJournal(dir).read();
+    const creation = JSON.parse(readProof(join(privateRuntimeRoot(), 'launches', binderKey('temporary', role.name) + '.json')));
+    const sessionDir = agentDir(role.name, true);
+    let retainedSession = '';
+    try {
+        retainedSession = readProof(join(sessionDir, role.session === 'codex-app-server' ? '.session-id' : '.acp-session-id')).trim();
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT' || session || !firstManagedSessionMayStart(sessionDir))
+            throw error;
+    }
+    readProof(join(sessionDir, '.booted')); // presence is the runner's resume marker, including legacy empty files
+    if (creation.role !== role.name || creation.identity !== role.identity || creation.action !== action
+        || !state || instance.role !== role.name || instance.temporary !== true || !instance.instance
+        || owner.instance !== instance.instance || typeof owner.token !== 'string' || !owner.token
+        || pin.daemon !== profile.expectedInstanceId || pin.name !== role.identity || pin.cid !== cid
+        || state.daemon !== profile.expectedInstanceId || state.name !== role.identity || state.cid !== cid
+        || state.instance !== instance.instance || state.lifetime !== 'temporary' || state.action !== action
+        || ['QUIESCING', 'TERMINAL_INTENT', 'RELEASED', 'CLEANUP_PENDING', 'FAILED'].includes(state.phase)
+        || (!retainedSession && !firstManagedSessionMayStart(sessionDir)) || (launch && launch !== instance.instance) || (session && session !== retainedSession))
+        throw Error('TASK_RETAINED_RUNTIME_MISMATCH');
+}
+/** Read-only ownership fence: absence/mismatch never permits a new identity or launch. */
+export function taskSupervisorMayRun(name) {
+    assertMemberNotPermanent(name);
+    const dir = agentDir(name, true);
+    readProof(join(dir, '.temp-supervisor.json'));
+    readProof(join(dir, 'creation.json'));
+    const supervisor = readTempSupervisor(dir), owner = supervisor?.taskOwner;
+    if (!owner || supervisor.role !== name || !owner.taskId || !owner.creationActionId)
+        throw Error('TASK_SUPERVISOR_OWNER_MISSING');
+    const role = parse(readProof(join(dir, 'role.yaml')));
+    const startup = role.roomMemberStartup, provenance = readProvenance(dir);
+    const task = getTask(owner.taskId);
+    if (role.name !== name || role.identity !== name || provenance?.role !== name
+        || provenance.creationActionId !== owner.creationActionId)
+        throw Error('TASK_SUPERVISOR_OWNERSHIP_MISMATCH');
+    if (!task.deletion && !task.terminal_intent && ['provisioning', 'active', 'review'].includes(task.state) && task.workspace) {
+        if (role.cwd !== task.workspace.path)
+            throw Error('TASK_WORKSPACE_MISMATCH');
+        assertWorkspacePresent(task.workspace, 'task', task.task_id);
+    }
+    if (owner.layout) {
+        const { runId, participant } = owner.layout;
+        const expectedName = `layout-${createHash('sha256').update(runId + ':' + participant).digest('hex').slice(0, 16)}`;
+        if (!task.layout || task.layout.run_id !== runId || runId !== `task-${owner.taskId}`
+            || !/^[A-Za-z0-9_-]+$/.test(runId) || expectedName !== name
+            || owner.creationActionId !== `${runId}:${participant}`)
+            throw Error('TASK_LAYOUT_OWNER_MISMATCH');
+        const state = JSON.parse(readProof(join(stateRoot(), 'layouts', `${runId}.json`)));
+        const member = state.participants[participant];
+        if (!member?.owned || member.instance?.remote || (member.instance?.agent && member.instance.agent !== name)
+            || (member.instance && member.instance.temporary !== true))
+            throw Error('TASK_LAYOUT_PARTICIPANT_MISMATCH');
+        if (task.deletion || task.terminal_intent || state.closed || state.closing || member.retired
+            || !['provisioning', 'active', 'review'].includes(task.state))
+            return false;
+        if (member.instance)
+            assertRetainedRuntime(role, owner.creationActionId, member.instance.cid, member.instance.launch, member.instance.session);
+        return true;
+    }
+    if (!owner.roomId || !owner.roomIdentityCid)
+        throw Error('TASK_SUPERVISOR_OWNER_MISSING');
+    const room = getRoomRecord(owner.roomId);
+    const seat = room?.member_seats.find(member => member.role_name === name);
+    if (!task || !room || room.task_id !== task.task_id || room.room_identity_cid !== owner.roomIdentityCid
+        || (task.room_id !== undefined && task.room_id !== owner.roomId)
+        || (task.room_identity_cid !== undefined && task.room_identity_cid !== owner.roomIdentityCid)
+        || role.name !== name || role.identity !== name || startup?.task_id !== owner.taskId
+        || startup.room_id !== owner.roomId || startup.room_identity_cid !== owner.roomIdentityCid
+        || startup.identity_name !== name || !seat || seat.invite_id !== startup.invite_id
+        || seat.cowork_role !== startup.role || provenance?.role !== name
+        || provenance.creationActionId !== owner.creationActionId
+        || seat.launch?.action_id !== owner.creationActionId
+        || (seat.launch.launch_id !== undefined && seat.launch.launch_id !== supervisor.launchId))
+        throw Error('TASK_SUPERVISOR_OWNERSHIP_MISMATCH');
+    if (task.deletion || task.terminal_intent || room.close || seat.retirement
+        || !['provisioning', 'active', 'review'].includes(task.state)
+        || !['provisioning', 'active'].includes(room.state))
+        return false;
+    if (task.workspace && (role.cwd !== task.workspace.path
+        || JSON.stringify(startup.workspace) !== JSON.stringify(task.workspace)
+        || JSON.stringify(room.workspace) !== JSON.stringify(task.workspace)))
+        throw Error('TASK_WORKSPACE_MISMATCH');
+    if (seat.identity_cid)
+        assertRetainedRuntime(role, owner.creationActionId, seat.identity_cid);
+    return true;
+}
+/** Resolve the externally recorded CID/action for explicit terminal retirement.
+ * Run only after the same launch passed taskSupervisorMayRun's ownership fence.
+ * An unpublished failed launch stays for its seat's retry/retirement saga. */
+export function taskMemberRetirementProof(name) {
+    const dir = agentDir(name, true), metadata = readTempSupervisor(dir), owner = metadata?.taskOwner;
+    if (!owner || metadata.role !== name)
+        throw Error('TASK_SUPERVISOR_OWNER_MISSING');
+    let cid;
+    if (owner.layout) {
+        const state = JSON.parse(readProof(join(stateRoot(), 'layouts', `${owner.layout.runId}.json`)));
+        const participant = state.participants[owner.layout.participant];
+        if (!participant?.owned || participant.instance?.agent !== name || participant.instance?.remote
+            || participant.instance?.temporary !== true)
+            throw Error('TASK_LAYOUT_PARTICIPANT_MISMATCH');
+        cid = participant.instance.cid;
+    }
+    else {
+        const seat = owner.roomId && getRoomRecord(owner.roomId)?.member_seats.find(member => member.role_name === name);
+        if (!seat || seat.launch?.action_id !== owner.creationActionId || seat.launch.launch_id !== metadata.launchId)
+            throw Error('TASK_SUPERVISOR_OWNERSHIP_MISMATCH');
+        cid = seat.identity_cid;
+    }
+    if (!cid)
+        throw Error('TASK_MEMBER_RETIREMENT_CID_MISSING');
+    return { cid, action: owner.creationActionId };
+}

package/dist/temp-idle.d.ts

@@ -0,0 +1,17 @@
+import type { SessionSnapshot } from './session/types.js';
+export declare const TEMP_CHAT_IDLE_MS: number;
+export type ChatIdlePolicy = {
+    version: 1;
+    timeoutMs: number;
+    lastActivityAt: number;
+};
+export declare function readChatIdle(dir: string): ChatIdlePolicy | undefined;
+/** Only a standalone temporary supervisor owns this clock; browser reads never touch it. */
+export declare class TemporaryChatIdle {
+    private dir;
+    private value;
+    private busy;
+    constructor(dir: string, now: number);
+    private save;
+    observe(snapshot: SessionSnapshot, queueDepth: number, now: number): boolean;
+}

package/dist/temp-idle.js

@@ -0,0 +1,42 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically } from './atomic-file.js';
+export const TEMP_CHAT_IDLE_MS = 24 * 60 * 60_000;
+const FILE = 'chat-idle.json';
+export function readChatIdle(dir) {
+    if (!existsSync(join(dir, FILE)))
+        return undefined;
+    const value = JSON.parse(readFileSync(join(dir, FILE), 'utf8'));
+    if (value.version !== 1 || !Number.isSafeInteger(value.lastActivityAt) || value.timeoutMs !== TEMP_CHAT_IDLE_MS)
+        throw new Error('Invalid persisted chat idle policy');
+    return value;
+}
+/** Only a standalone temporary supervisor owns this clock; browser reads never touch it. */
+export class TemporaryChatIdle {
+    dir;
+    value;
+    busy = false;
+    constructor(dir, now) {
+        this.dir = dir;
+        this.value = readChatIdle(dir) ?? { version: 1, timeoutMs: TEMP_CHAT_IDLE_MS, lastActivityAt: now };
+        this.save();
+    }
+    save() { replaceFileAtomically(join(this.dir, FILE), JSON.stringify(this.value) + '\n', 0o600); }
+    observe(snapshot, queueDepth, now) {
+        // Unknown activity evidence never grants permission to retire a session.
+        const idle = snapshot.alive && snapshot.readiness === 'idle' && !snapshot.pendingPermissionId && queueDepth === 0 && snapshot.activity?.activeToolCalls === 0;
+        const update = Date.parse(snapshot.activity?.lastUpdateAt ?? '');
+        let next = this.value.lastActivityAt;
+        if (Number.isFinite(update) && update <= now)
+            next = Math.max(next, update);
+        if (!idle || this.busy)
+            next = Math.max(next, now);
+        this.busy = !idle;
+        // Active work checkpoints at most once a minute, with an immediate idle boundary write.
+        if (next > this.value.lastActivityAt && (idle || next - this.value.lastActivityAt >= 60_000)) {
+            this.value.lastActivityAt = next;
+            this.save();
+        }
+        return idle && now >= this.value.lastActivityAt && now - this.value.lastActivityAt >= this.value.timeoutMs;
+    }
+}

package/dist/temp-lifecycle.d.ts

@@ -4,8 +4,18 @@ export declare const TEMP_TERMINATION_FILE = "termination.jsonl";
 export declare const TEMP_STOP_REQUEST_FILE = ".temp-stop-request.json";
 export declare const TEMP_RECLAIM_BATCH = 32;
 export declare const TEMP_LAUNCH_GRACE_MS = 60000;
-export type TempSupervisorKind = 'systemd-transient' | 'launchd-transient' | 'detached';
-export type TempTerminationReason = 'identity-closed' | 'session-ended' | 'operator-stop' | 'supervisor-signal' | 'supervisor-recycle' | 'startup-failure' | 'stale-supervisor';
+export type TempSupervisorKind = 'fleet-managed' | 'systemd-transient' | 'launchd-transient' | 'detached';
+export type TempTerminationReason = 'idle-timeout' | 'identity-closed' | 'session-ended' | 'operator-stop' | 'supervisor-signal' | 'supervisor-recycle' | 'startup-failure' | 'stale-supervisor';
+export interface TaskSupervisorOwner {
+    taskId: string;
+    roomId?: string;
+    roomIdentityCid?: string;
+    layout?: {
+        runId: string;
+        participant: string;
+    };
+    creationActionId: string;
+}
 export interface TempSupervisorRecord {
     version: 1;
     role: string;
@@ -16,6 +26,7 @@ export interface TempSupervisorRecord {
     target?: string;
     pid?: number;
     binPath?: string;
+    taskOwner?: TaskSupervisorOwner;
 }
 export interface TempTerminationRecord {
     version: 1;
@@ -29,13 +40,12 @@ export interface TempTerminationRecord {
 export type SupervisorLauncher = (binPath: string, args: string[], dir: string) => void | Promise<void>;
 export declare const tempSystemdUnit: (name: string) => string;
 export declare const tempLaunchdLabel: (name: string) => string;
-export declare function prepareTempSupervisor(dir: string, role: string): TempSupervisorRecord;
+export declare function prepareTempSupervisor(dir: string, role: string, taskOwner?: TaskSupervisorOwner): TempSupervisorRecord;
 export declare function readTempSupervisor(dir: string): TempSupervisorRecord | undefined;
-/**
- * Launch a temp supervisor outside the caller's service-manager ownership
- * boundary. `detached: true` creates a new process group but does not escape a
- * systemd cgroup; a transient unit does, and is not enabled across reboot.
- */
+/** Broad scans retain unsupported entries instead of blocking other members. */
+export declare function readTempSupervisorForScan(dir: string): TempSupervisorRecord | undefined;
+export declare function updateTempSupervisor(dir: string, update: Partial<Omit<TempSupervisorRecord, 'version' | 'role' | 'launchId' | 'createdAt'>>): Promise<TempSupervisorRecord | undefined>;
+/** Register managed members under Fleet; explicit manual mode uses a detached child. */
 export declare function makeTempSupervisorLauncher(options?: {
     exec?: Exec;
     platform?: NodeJS.Platform;
@@ -44,6 +54,11 @@ export declare function makeTempSupervisorLauncher(options?: {
 }): SupervisorLauncher;
 export declare function markTempSupervisorActive(dir: string, pid?: number): Promise<void>;
 export declare function requestedTempStopReason(dir: string): 'operator-stop' | undefined;
+/** Explicit erasure removes only exact retired role/launch events. */
+export declare function eraseTerminationEvents(launches: ReadonlyArray<{
+    role: string;
+    launchId: string;
+}>): void;
 /** Move retired state out of the live roster without deleting any evidence. */
 export declare function archiveTempState(role: string, reason: TempTerminationReason, outcome: TempTerminationRecord['outcome'], detail: string, now?: Date): string | undefined;
 /** Resolve only an exact role+launch archive; names and timestamps are never proof. */