@ours.network/fleet 1.2.0-nightly.9 → 2.0.1

package/dist/rooms-tasks/recovery.js

@@ -0,0 +1,110 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse } from 'yaml';
+import { withFileLock } from '../atomic-file.js';
+import { agentDir, stateRoot } from '../paths.js';
+import { readProvenance } from '../creation.js';
+import { readTempSupervisor, tempSupervisorLiveness, requestedTempStopReason } from '../temp-lifecycle.js';
+import { taskSupervisorMayRun } from '../task-supervision.js';
+import { resumeTaskSupervisor } from '../spawn.js';
+import { resetRestartLedger, readRestartLedger } from '../runner.js';
+import { readRoomReadiness } from '../agent-ours/service.js';
+import { getTask } from './task-state.js';
+import { getRoomRecord } from './room-state.js';
+import { roomCloseLockPath, CLOSE_LOCK_STALE_MS } from './close.js';
+import { taskOperationLockPath, TASK_OPERATION_LOCK_STALE_MS } from './terminal.js';
+import { adoptLegacyTaskMember } from './legacy-task-member.js';
+/** Explicit supported recovery; never creates an identity, seat, invite, or session ID. */
+export async function recoverTaskMembers(input) {
+    const deps = input.deps ?? {};
+    return withFileLock(taskOperationLockPath(input.taskId), async () => {
+        const task = getTask(input.taskId);
+        if (!['provisioning', 'active', 'review'].includes(task.state) || task.deletion || task.terminal_intent)
+            throw Error('Task is not open for member recovery');
+        const recover = async (name, roomId) => {
+            const dir = agentDir(name, true), metadata = readTempSupervisor(dir);
+            if (!metadata || metadata.role !== name)
+                throw Error('Exact supervisor state missing; explicit reconciliation required');
+            if (requestedTempStopReason(dir))
+                throw Error('Task member has an explicit retirement request');
+            const live = await (deps.liveness ?? tempSupervisorLiveness)(dir);
+            if (live === 'unknown')
+                throw Error('Supervisor liveness unknown; refusing recovery');
+            if (!metadata.taskOwner) {
+                if (live === 'running')
+                    return { name, status: 'migration_pending' };
+                if (!roomId)
+                    throw Error('Legacy layout member requires explicit reconciliation');
+                if (deps.adopt)
+                    await deps.adopt(input.taskId, roomId, name);
+                else {
+                    const room = getRoomRecord(roomId);
+                    const seat = room.member_seats.find(member => member.role_name === name);
+                    const adopted = await adoptLegacyTaskMember({ taskId: input.taskId, roomId,
+                        roomIdentityCid: room.room_identity_cid, creationActionId: seat.launch.action_id }, name);
+                    if (adopted === 'running-legacy')
+                        return { name, status: 'migration_pending' };
+                }
+            }
+            if (!taskSupervisorMayRun(name))
+                throw Error('Task member is retired');
+            const reset = readRestartLedger(dir).circuit === 'open';
+            if (reset)
+                resetRestartLedger(dir);
+            if (live === 'running') {
+                return { name, status: reset ? 'recovery_reset' : 'running' };
+            }
+            await (deps.resume ?? resumeTaskSupervisor)(name, input.binPath);
+            return { name, status: 'resumed' };
+        };
+        if (task.layout) {
+            const path = join(stateRoot(), 'layouts', `${task.layout.run_id}.json`);
+            return withFileLock(path + '.lock', async () => {
+                const state = JSON.parse(readFileSync(path, 'utf8'));
+                if (state.closed || state.closing || state.uncertain)
+                    throw Error('Layout requires reconciliation before recovery');
+                const result = [];
+                for (const member of Object.values(state.participants)) {
+                    if (!member.owned || member.retired)
+                        continue;
+                    if (!member.instance?.agent || member.instance.remote)
+                        throw Error('Layout owned instance evidence missing');
+                    result.push(await recover(member.instance.agent));
+                }
+                return result;
+            });
+        }
+        if (!task.room_id || !input.cowork)
+            throw Error('Task room required for member recovery');
+        return withFileLock(roomCloseLockPath(task.room_id), async () => {
+            const room = getRoomRecord(task.room_id);
+            if (!room || room.task_id !== task.task_id || room.close || !['active', 'provisioning'].includes(room.state)
+                || !room.room_identity_cid || room.room_identity_cid !== task.room_identity_cid)
+                throw Error('Exact open task room required');
+            const remote = await input.cowork.getRoom(room.room_id);
+            if (!remote || remote.identity_cid !== room.room_identity_cid || remote.state !== 'active')
+                throw Error('Exact active Cowork room required');
+            // Validate the complete admitted roster before any member is resumed.
+            for (const seat of room.member_seats) {
+                const dir = agentDir(seat.role_name, true), metadata = readTempSupervisor(dir), provenance = readProvenance(dir);
+                const role = parse(readFileSync(join(dir, 'role.yaml'), 'utf8')), startup = role.roomMemberStartup;
+                const found = remote.seats.filter(item => item.display_name === seat.role_name && item.seat_state !== 'removed');
+                const ready = readRoomReadiness(room.room_identity_cid, seat.role_name);
+                if (seat.retirement || !seat.identity_cid || !seat.invite_id || !seat.launch?.action_id || !seat.launch.launch_id
+                    || metadata?.role !== seat.role_name || metadata.launchId !== seat.launch.launch_id
+                    || provenance?.role !== seat.role_name || provenance.creationActionId !== seat.launch.action_id
+                    || role.identity !== seat.role_name || startup?.identity_name !== seat.role_name
+                    || startup.room_id !== room.room_id || startup.room_identity_cid !== room.room_identity_cid
+                    || startup.invite_id !== seat.invite_id || startup.role !== seat.cowork_role
+                    || !ready || ready.cid !== seat.identity_cid || ready.room !== room.room_id || ready.invite !== seat.invite_id
+                    || found.length !== 1 || found[0].identity_cid !== seat.identity_cid || found[0].invite_id !== seat.invite_id
+                    || found[0].role !== seat.cowork_role || found[0].seat_state !== 'active')
+                    throw Error(`Exact admitted member proof missing: ${seat.role_name}`);
+            }
+            const result = [];
+            for (const seat of room.member_seats)
+                result.push(await recover(seat.role_name, room.room_id));
+            return result;
+        }, {}, CLOSE_LOCK_STALE_MS);
+    }, {}, TASK_OPERATION_LOCK_STALE_MS);
+}

package/dist/rooms-tasks/room-state.d.ts

@@ -22,7 +22,7 @@ export declare function advanceSaga(id: string, phase: SagaPhase, stepIndex?: nu
 export declare function setSagaError(id: string, error: string, hint?: string, detail?: ProvisioningDetail): RoomOrchestrationRecord;
 export declare function setRoomIdentity(id: string, roomIdentityCid: string): RoomOrchestrationRecord;
 export declare function setOwnerSeat(id: string, ownerSeatCid: string, inviteFingerprint: string): RoomOrchestrationRecord;
-export declare function updateMemberSeats(id: string, seats: RoomMemberSeat[]): RoomOrchestrationRecord;
+export declare function updateMemberSeats(id: string, seats: RoomMemberSeat[], additionalTemplate?: import('./types.js').TemplateSnapshot): RoomOrchestrationRecord;
 export declare function updateRoomRoleBriefing(id: string, role: string, definition: RoomRoleBriefingDefinition): RoomOrchestrationRecord;
 export declare function updateRoomHistoryCursor(id: string, cursor: number): RoomOrchestrationRecord;
 export declare function updateMemberStartup(id: string, roleName: string, update: {
@@ -31,6 +31,8 @@ export declare function updateMemberStartup(id: string, roleName: string, update
 export declare function activateRoom(id: string): RoomOrchestrationRecord;
 export declare function closeRoom(id: string): RoomOrchestrationRecord;
 export declare function beginRoomClose(id: string): RoomOrchestrationRecord;
-export declare function advanceMemberRetirement(id: string, roleName: string, phase: MemberRetirementPhase, launchId: string, archivePath?: string): RoomOrchestrationRecord;
+export declare function advanceMemberRetirement(id: string, roleName: string, phase: MemberRetirementPhase, launchId: string, archivePath?: string, absenceVerified?: boolean): RoomOrchestrationRecord;
 export declare function advanceRoomClose(id: string, phase: RoomClosePhase): RoomOrchestrationRecord;
 export declare function setRoomCloseError(id: string, error: string, recoveryHint: string): RoomOrchestrationRecord;
+/** Settlement-only binding recovery; never publishes a seat or changes a launch. */
+export declare function recordRetirementMemberCids(id: string, recovered: ReadonlyArray<RoomMemberSeat>): RoomOrchestrationRecord;

package/dist/rooms-tasks/room-state.js

@@ -2,17 +2,28 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from 'node:f
 import { join } from 'node:path';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { stateRoot } from '../paths.js';
+import { planWorkspace, ensureWorkspace } from './workspace.js';
+import { getTask } from './task-state.js';
 import { storedRoomLaunchPolicy } from './types.js';
 import { releaseLaunchSnapshot } from './launch-snapshot.js';
 export const roomsDir = () => join(stateRoot(), 'rooms');
-function roomPath(id) { return join(roomsDir(), `${id}.json`); }
+function roomPath(id) {
+    if (!/^[a-zA-Z0-9_-]{1,120}$/.test(id))
+        throw new RoomStateError('Invalid room ID');
+    return join(roomsDir(), `${id}.json`);
+}
 export class RoomStateError extends Error {
 }
 function readRoom(id) {
     const p = roomPath(id);
-    if (!existsSync(p))
-        throw new RoomStateError(`room not found: ${id}`);
-    return JSON.parse(readFileSync(p, 'utf8'));
+    try {
+        return JSON.parse(readFileSync(p, 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            throw new RoomStateError(`room not found: ${id}`);
+        throw error;
+    }
 }
 function writeRoom(record) {
     mkdirSync(roomsDir(), { recursive: true });
@@ -25,6 +36,8 @@ export function createRoomRecord(input) {
         const requested = storedRoomLaunchPolicy(input.room_policy);
         if (JSON.stringify(before) !== JSON.stringify(requested))
             throw new RoomStateError(`room ${input.room_id} launch policy mismatch`);
+        if (existing.workspace)
+            ensureWorkspace(existing.workspace);
         return existing;
     }
     const record = {
@@ -40,15 +53,20 @@ export function createRoomRecord(input) {
         state: 'provisioning',
         created_at: new Date().toISOString(),
     };
+    record.workspace = input.task_id ? getTask(input.task_id).workspace : planWorkspace('room', input.room_id);
     writeRoom(record);
+    if (record.workspace)
+        ensureWorkspace(record.workspace);
     return record;
 }
 export function getRoomRecord(id) {
     try {
         return readRoom(id);
     }
-    catch {
-        return undefined;
+    catch (error) {
+        if (error instanceof RoomStateError && error.message === `room not found: ${id}`)
+            return undefined;
+        throw error;
     }
 }
 /** Remove a terminal orchestration record from the live room inventory. */
@@ -110,11 +128,13 @@ export function setOwnerSeat(id, ownerSeatCid, inviteFingerprint) {
     writeRoom(r);
     return r;
 }
-export function updateMemberSeats(id, seats) {
+export function updateMemberSeats(id, seats, additionalTemplate) {
     const r = readRoom(id);
     if (r.state === 'closing' || r.state === 'closed')
         throw new RoomStateError(`room ${id} is ${r.state}; member provisioning is fenced`);
     r.member_seats = seats;
+    if (additionalTemplate)
+        r.additional_member_templates = [...(r.additional_member_templates ?? []), additionalTemplate];
     writeRoom(r);
     return r;
 }
@@ -204,7 +224,7 @@ export function beginRoomClose(id) {
 const RETIREMENT_ORDER = [
     'stop_requested', 'liveness_absent', 'archive_secured', 'identity_absent',
 ];
-export function advanceMemberRetirement(id, roleName, phase, launchId, archivePath) {
+export function advanceMemberRetirement(id, roleName, phase, launchId, archivePath, absenceVerified = false) {
     const r = readRoom(id);
     if (r.state !== 'closing')
         throw new RoomStateError(`room ${id} is not closing`);
@@ -221,6 +241,7 @@ export function advanceMemberRetirement(id, roleName, phase, launchId, archivePa
         throw new RoomStateError(`room ${id} member ${roleName} retirement cannot move backward to ${phase}`);
     }
     seat.retirement = {
+        ...(absenceVerified || previous?.absence_verified ? { absence_verified: true } : {}),
         phase,
         launch_id: launchId,
         updated_at: new Date().toISOString(),
@@ -273,3 +294,21 @@ export function setRoomCloseError(id, error, recoveryHint) {
     writeRoom(r);
     return r;
 }
+/** Settlement-only binding recovery; never publishes a seat or changes a launch. */
+export function recordRetirementMemberCids(id, recovered) {
+    const room = readRoom(id);
+    if (room.state !== 'closing')
+        throw new RoomStateError('Room is not closing');
+    for (const proof of recovered) {
+        const seat = room.member_seats.find(value => value.role_name === proof.role_name);
+        if (!seat || seat.launch?.action_id !== proof.launch?.action_id || seat.invite_id !== proof.invite_id)
+            throw new RoomStateError('Member changed during identity recovery');
+        if (!proof.identity_cid)
+            continue;
+        if (seat.identity_cid && seat.identity_cid.toLowerCase() !== proof.identity_cid.toLowerCase())
+            throw new RoomStateError('Member identity changed during recovery');
+        seat.identity_cid = proof.identity_cid;
+    }
+    writeRoom(room);
+    return room;
+}

package/dist/rooms-tasks/task-review.d.ts

@@ -0,0 +1,113 @@
+import type { TaskContributionAuthor, TaskProgressEntry, TaskRecord, TaskReview, TaskReviewArtifact } from './types.js';
+export declare const PROGRESS_TEXT_MAX = 4000;
+export declare const PROGRESS_MAX_ENTRIES = 200;
+export declare const REVIEW_MARKDOWN_MAX = 50000;
+export declare const REVIEW_MAX_ARTIFACTS = 20;
+export declare const REVIEW_ARTIFACT_MAX_BYTES: number;
+export declare class TaskReviewError extends Error {
+    readonly code: 'invalid_request' | 'idempotency_conflict' | 'limit_exceeded' | 'conflict' | 'not_found';
+    constructor(code: 'invalid_request' | 'idempotency_conflict' | 'limit_exceeded' | 'conflict' | 'not_found', message: string);
+}
+export declare function reviewArtifactMime(name: string): string;
+export declare function checkArtifactName(name: string): string;
+export declare function listTaskProgress(taskId: string): TaskProgressEntry[];
+/**
+ * Append one milestone. Text is kept exactly as written; whitespace-only text is
+ * rejected. A retry with the same author-scoped request_key returns the original
+ * entry; the same key with different text is a conflict.
+ */
+export declare function appendTaskProgress(taskId: string, input: {
+    text: string;
+    author: TaskContributionAuthor;
+    requestKey?: string;
+}): {
+    entry: TaskProgressEntry;
+    replayed: boolean;
+};
+export declare function getTaskReview(taskId: string): TaskReview | undefined;
+/**
+ * Replace the review Markdown. `expectedMarkdown` is what the writer last read
+ * ('' when none); a different current value is a stale edit. Re-sending the
+ * value already stored succeeds, so retries are safe.
+ */
+export declare function setTaskReviewMarkdown(taskId: string, input: {
+    markdown: string;
+    expectedMarkdown: string;
+    author: TaskContributionAuthor;
+}): TaskReview;
+export declare const reviewStoreRoot: () => string;
+export declare function reviewStoreDirectory(taskId: string): string;
+/** A file being read; `verify` fails when it changed since it was opened. */
+export type Source = {
+    size: number;
+    body: ReadableStream<Uint8Array>;
+    close(): Promise<void>;
+    verify?(): Promise<void>;
+};
+type Stored = {
+    id: string;
+    size: number;
+    sha256: string;
+};
+/**
+ * Attach one file to the review package: reserve under the task lock, copy
+ * into the private store, then commit metadata under the lock again; any
+ * failure removes the copy. A retry with the same author-scoped request_key
+ * is compared by content without storing another copy: identical content
+ * returns the original artifact, different content is a conflict. Without a
+ * key an interrupted call may or may not have attached: read the package
+ * before retrying.
+ */
+export declare function attachTaskReviewArtifact(taskId: string, input: {
+    name: string;
+    source: Source;
+    author: TaskContributionAuthor;
+    requestKey?: string;
+    signal?: AbortSignal;
+    /** Test seam: runs after the bytes are durable, before the record references them. */
+    beforeCommit?(stored: Stored): void;
+    /** Test seam: runs after a keyed retry was read, before it is confirmed under the lock. */
+    beforeReplay?(): void;
+}): Promise<{
+    artifact: TaskReviewArtifact;
+    replayed: boolean;
+}>;
+/** Remove a file from the package; repeating it after success reports not found. */
+export declare function detachTaskReviewArtifact(taskId: string, artifactId: string, input: {
+    author: TaskContributionAuthor;
+}): TaskReviewArtifact;
+/** Bytes of a referenced artifact, integrity-checked; only the owning task can name it. */
+export declare function readTaskReviewArtifact(taskId: string, artifactId: string): Promise<{
+    artifact: TaskReviewArtifact;
+    bytes: Buffer;
+}>;
+/** Task deletion: remove every retained review file of the task. */
+export declare function deleteTaskReviewStore(taskId: string): void;
+/** True when `path` names an entry strictly inside `root`, compared by path components. */
+export declare function insideDirectory(root: string, path: string): boolean;
+/** The task's owned workspace, validated against its ownership marker. */
+export declare function taskWorkspaceRoot(task: TaskRecord): string;
+/**
+ * Open a file inside the task workspace in this process's own OS context (the
+ * CLI). Every component below the pinned workspace is opened without
+ * following symlinks; the file must be one regular, singly-linked file.
+ */
+export declare function openTaskWorkspaceFile(task: TaskRecord, input: string, cwd?: string): Promise<Source & {
+    name: string;
+}>;
+/** Size of the store, for diagnostics and tests. */
+export declare function reviewStoreFiles(taskId: string): string[];
+/** Wire shapes: retry keys stay internal. */
+export declare function publicProgressEntry(entry: TaskProgressEntry): Omit<TaskProgressEntry, 'request_key'>;
+export declare function publicReview(review: TaskReview): TaskReview;
+/** Compact summary for list and detail payloads; bodies are fetched separately. */
+export declare function taskContributionSummary(task: TaskRecord): {
+    progress_count: number;
+    review: {
+        has_markdown: boolean;
+        artifact_count: number;
+        revision: number;
+        updated_at?: string;
+    };
+};
+export {};