@ours.network/fleet 2.1.1 → 2.2.0

package/dist/setup-tunnel-preflight.js

@@ -1,3 +1,4 @@
+import { cloudflaredUnavailableError, cloudflaredVersionError, CLOUDFLARED_VERSION_TIMEOUT_MS, isSecureCloudflaredVersion, isSecureNodeVersion, nodeVersionError } from './security-versions.js';
 import { existsSync, lstatSync, readFileSync, rmSync } from 'node:fs';
 import { userInfo } from 'node:os';
 import { join } from 'node:path';
@@ -10,9 +11,8 @@ const UNCHANGED = 'Nothing was changed and this host was not bound.';
  * proof is sent: a failure afterwards cannot be retried with a fresh command.
  */
 export async function setupTunnelPreflight({ exec = realExec, platform = process.platform, node = process.versions.node } = {}) {
-    const [major, minor] = node.split('.').map(Number);
-    if (major < 22 || (major === 22 && minor < 13))
-        throw Error(`Tunnel setup requires Node.js 22.13 or newer; this is ${node}. Update Node.js, then run a fresh tunnel setup command. ${UNCHANGED}`);
+    if (!isSecureNodeVersion(node))
+        throw Error(`${nodeVersionError(node)} ${UNCHANGED}`);
     if (platform === 'linux') {
         const manager = await exec('systemctl', ['--user', 'show-environment'], { timeout: 10_000 });
         if (manager.code !== 0)
@@ -20,6 +20,13 @@ export async function setupTunnelPreflight({ exec = realExec, platform = process
                 + `Log in directly as ${userInfo().username} (not through su or sudo), or run: sudo loginctl enable-linger ${userInfo().username} && export XDG_RUNTIME_DIR=/run/user/${process.getuid?.()} `
                 + `Then run a fresh tunnel setup command. ${UNCHANGED}`);
     }
+    // Refuse an unsafe connector before anything is redeemed; the service checks its own
+    // PATH-selected cloudflared again before every tunnel start.
+    const version = await exec('cloudflared', ['--version'], { timeout: CLOUDFLARED_VERSION_TIMEOUT_MS });
+    if (version.code !== 0)
+        throw Error(`${cloudflaredUnavailableError(version.code === 127 ? 'not found' : 'version check failed')} ${UNCHANGED}`);
+    if (!isSecureCloudflaredVersion(version.stdout))
+        throw Error(`${cloudflaredVersionError(version.stdout)} ${UNCHANGED}`);
     const help = await exec('cloudflared', ['tunnel', 'run', '--help'], { timeout: 10_000 });
     if (help.code === 127)
         throw Error(`cloudflared is not installed or not on PATH. Install it, then run a fresh tunnel setup command. ${UNCHANGED}`);

package/dist/supervisor/manager.js

@@ -160,8 +160,15 @@ export async function runFleetManager(entrypoint, deps = {}) {
     try {
         try {
             const config = producerConfig(process.env, undefined, log);
-            if (config)
-                notifications = new TaskNotificationProducer(config, log);
+            if (config) {
+                const [{ listTasks }, { TaskLayouts }] = await Promise.all([import('../rooms-tasks/task-state.js'), import('../application/task-layouts.js')]);
+                const layouts = new TaskLayouts();
+                notifications = new TaskNotificationProducer(config, log, fetch, {
+                    // Unreadable task or layout evidence is not an empty inventory: it throws and the bootstrap run stays incomplete.
+                    tasks: () => listTasks({ strict: true }),
+                    layoutRooms: task => (layouts.view(task)?.rooms ?? []).flatMap(room => room.identity_cid ? [room.identity_cid] : []),
+                });
+            }
         }
         catch {
             log('[fleet] task notifications unavailable; committed events retained');

package/dist/web/resource-views.d.ts

@@ -91,6 +91,8 @@ export interface ResourceDescriptor {
     list?: string;
     groupByList?: boolean;
     includeDeleting?: boolean;
+    /** Previews: each agent's newest assistant message time only, without its text. */
+    activityOnly?: boolean;
 }
 export declare function canonicalResourceDescriptor(input: unknown): ResourceDescriptor;
 interface BoundProjection {

package/dist/web/resource-views.js

@@ -156,9 +156,11 @@ export function canonicalResourceDescriptor(input) {
         throw Error('invalid resource descriptor');
     const value = input;
     if (!/^[A-Za-z0-9_-]{1,128}$/.test(value.viewId) || !['directory', 'roles', 'tasks', 'task-lists', 'configuration', 'previews', 'task-layout', 'creation-action', 'action', 'member-addition', 'login', 'onboarding-health', 'subscriptions'].includes(value.resource)
-        || Object.keys(value).some(key => !['viewId', 'resource', 'includeTemporary', 'includeDefinitions', 'ids', 'state', 'list', 'groupByList', 'includeDeleting', 'entityId', 'receiptId', 'provider'].includes(key)))
+        || Object.keys(value).some(key => !['viewId', 'resource', 'includeTemporary', 'includeDefinitions', 'ids', 'state', 'list', 'groupByList', 'includeDeleting', 'entityId', 'receiptId', 'provider', 'activityOnly'].includes(key)))
         throw Error('invalid resource descriptor');
-    for (const key of ['includeTemporary', 'includeDefinitions', 'groupByList', 'includeDeleting'])
+    if (value.activityOnly !== undefined && value.resource !== 'previews')
+        throw Error('invalid resource descriptor');
+    for (const key of ['includeTemporary', 'includeDefinitions', 'groupByList', 'includeDeleting', 'activityOnly'])
         if (value[key] !== undefined && typeof value[key] !== 'boolean')
             throw Error('invalid resource descriptor');
     if (value.ids !== undefined && (!Array.isArray(value.ids) || value.ids.length > 500 || value.ids.some(id => typeof id !== 'string' || !/^[A-Za-z0-9_-]{1,120}$/.test(id))))

package/dist/web/runtime.js

@@ -310,7 +310,7 @@ export async function startWebConsole(options) {
     }
     let stopTunnel;
     try {
-        stopTunnel = startWorkspaceTunnel(browserOrigin);
+        stopTunnel = await startWorkspaceTunnel(browserOrigin);
     }
     catch (error) {
         try {

package/dist/web/server.js

@@ -2,7 +2,7 @@ import { FleetResourceViews, ResourceBindingError, canonicalResourceDescriptor }
 import { publishFleetResourceCommit } from '../application/resource-observer.js';
 import { stateRoot, defaultConfigPath } from '../paths.js';
 import { EMPTY_TASK_LAYOUT } from '../rooms-tasks/empty-layout.js';
-import { conversationPreview } from '../application/conversation-history.js';
+import { conversationActivity, conversationPreview } from '../application/conversation-history.js';
 import { registerConversationStream } from './conversation-stream.js';
 import { conversationHasAttachment } from '../application/conversation-history.js';
 import { readDeliveredFile } from '../file-delivery/store.js';
@@ -26,7 +26,7 @@ import { WebAuth } from './auth.js';
 import { FleetEventBus } from './events.js';
 import { ROLE_NAME_RE } from '../config.js';
 import { TaskListError } from '../rooms-tasks/task-lists.js';
-import { TaskStateError } from '../rooms-tasks/task-state.js';
+import { acknowledgeTaskProgress, acknowledgeTaskReview, contributionUnread, TaskStateError } from '../rooms-tasks/task-state.js';
 import { appendTaskProgress, getTaskReview, listTaskProgress, publicProgressEntry, publicReview, readTaskReviewArtifact, setTaskReviewMarkdown, taskContributionSummary, TaskReviewError, } from '../rooms-tasks/task-review.js';
 import { isProvider } from '../subscriptions/store.js';
 const ONBOARDING_WORK = ['coordination', 'development', 'review'];
@@ -371,9 +371,12 @@ export async function buildWebServer(services, boundary, options = {}) {
         const filter = { strict, ...(state ? { state } : {}), ...(query.list ? { list: query.list } : {}),
             ...(query.includeDeleting === 'true' ? { includeDeleting: true } : {}) };
         const api = requireTaskRooms();
+        // Navigation totals cover every task in scope, not only the filtered or visible cards.
+        const unreadTotal = () => api.listTasks({ strict, ...(query.includeDeleting === 'true' ? { includeDeleting: true } : {}) })
+            .reduce((sum, task) => { const unread = contributionUnread(task); return sum + unread.progress + (unread.review ? 1 : 0); }, 0);
         return taskApi(() => query.groupByList === 'true'
-            ? { groups: api.groupedTasks(filter).map(group => ({ ...group, tasks: group.tasks.map(task => wireTask(api.withLayoutRooms(task))) })) }
-            : { tasks: api.listTasks(filter).map(task => wireTask(api.withLayoutRooms(task))) });
+            ? { groups: api.groupedTasks(filter).map(group => ({ ...group, tasks: group.tasks.map(task => wireTask(api.withLayoutRooms(task))) })), contribution_unread_total: unreadTotal() }
+            : { tasks: api.listTasks(filter).map(task => wireTask(api.withLayoutRooms(task))), contribution_unread_total: unreadTotal() });
     };
     const project = async (descriptor, signal, owner = '') => {
         signal.throwIfAborted();
@@ -426,7 +429,8 @@ export async function buildWebServer(services, boundary, options = {}) {
                 return { ...services.configuration.read(descriptor.includeDefinitions ?? false), provenance: services.presetProvenance?.read() ?? null };
             case 'directory': {
                 const [roles, tasks] = await Promise.all([services.query.list(true, true), projectTasks({})]);
-                return { roles, tasks: tasks.tasks, lists: requireTaskRooms().listTaskLists() };
+                const { tasks: rows, contribution_unread_total } = tasks;
+                return { roles, tasks: rows, contribution_unread_total, lists: requireTaskRooms().listTaskLists() };
             }
             case 'previews': {
                 const roles = await services.repository.list(true), selected = new Map(roles.map(role => [role.id, role]));
@@ -437,14 +441,15 @@ export async function buildWebServer(services, boundary, options = {}) {
                     if (!role)
                         continue;
                     try {
-                        previews[id] = dir ? await conversationPreview(dir, signal) : { text: 'No recent agent output', at: '' };
+                        previews[id] = descriptor.activityOnly ? (dir ? await conversationActivity(dir, signal) : { at: '' })
+                            : dir ? await conversationPreview(dir, signal) : { text: 'No recent agent output', at: '' };
                     }
                     catch {
                         signal.throwIfAborted();
                         // A damaged/unreadable ledger is unavailable, not empty or removed.
                         // Keep this selected row observable so a repair can refresh it,
                         // without retiring previews for the other selected roles.
-                        previews[id] = { text: 'Preview unavailable', at: '', unavailable: true };
+                        previews[id] = descriptor.activityOnly ? { at: '', unavailable: true } : { text: 'Preview unavailable', at: '', unavailable: true };
                     }
                 }
                 return { previews };
@@ -505,7 +510,7 @@ export async function buildWebServer(services, boundary, options = {}) {
     for (const resource of ['task-layout', 'creation-action', 'action', 'member-addition', 'login', 'onboarding-health'])
         app.get('/api/v1/' + resource, async () => { throw new ResourceBindingError(409, 'resource binding required'); });
     app.get('/api/v1/directory', async (request) => { auth.authenticate(request); return project({ viewId: 'read', resource: 'directory' }, new AbortController().signal); });
-    app.get('/api/v1/previews', async (request) => { auth.authenticate(request); const ids = String(request.query.ids ?? '').split(',').filter(Boolean); return project(canonicalResourceDescriptor({ viewId: 'read', resource: 'previews', ids }), new AbortController().signal); });
+    app.get('/api/v1/previews', async (request) => { auth.authenticate(request); const query = request.query, ids = String(query.ids ?? '').split(',').filter(Boolean); return project(canonicalResourceDescriptor({ viewId: 'read', resource: 'previews', ids, ...(query.activityOnly === 'true' ? { activityOnly: true } : {}) }), new AbortController().signal); });
     app.get('/api/v1/task-lists', async (request) => {
         auth.authenticate(request);
         return project({ viewId: 'read', resource: 'task-lists' }, new AbortController().signal);
@@ -619,6 +624,22 @@ export async function buildWebServer(services, boundary, options = {}) {
             reply.code(201);
         return { entry: publicProgressEntry(result.entry), replayed: result.replayed };
     });
+    /** Acknowledge Progress entries the browser actually showed; returns the task's remaining unread. */
+    app.post('/api/v1/tasks/:id/progress/read', async (request) => {
+        auth.authenticate(request, true);
+        const ids = request.body?.ids;
+        if (!Array.isArray(ids) || ids.length > 200 || ids.some(id => typeof id !== 'string' || id.length > 64))
+            throw new FleetError('invalid_request', 'ids must be at most 200 progress entry IDs');
+        return { unread: await reviewApi(() => acknowledgeTaskProgress(request.params.id, ids)) };
+    });
+    /** Acknowledge the To review revision the browser fetched and rendered. */
+    app.post('/api/v1/tasks/:id/review/read', async (request) => {
+        auth.authenticate(request, true);
+        const revision = request.body?.revision;
+        if (!Number.isSafeInteger(revision) || revision < 0)
+            throw new FleetError('invalid_request', 'revision must be a non-negative integer');
+        return { unread: await reviewApi(() => acknowledgeTaskReview(request.params.id, revision)) };
+    });
     app.get('/api/v1/tasks/:id/review', async (request) => {
         auth.authenticate(request);
         const review = await reviewApi(() => getTaskReview(request.params.id));

package/dist/web/workspace-tunnel.d.ts

@@ -1 +1,2 @@
-export declare function startWorkspaceTunnel(origin: string): () => Promise<void>;
+import { type Exec } from '../exec.js';
+export declare function startWorkspaceTunnel(origin: string, exec?: Exec): Promise<() => Promise<void>>;

package/dist/web/workspace-tunnel.js

@@ -1,8 +1,10 @@
 import { spawn } from 'node:child_process';
 import { existsSync, lstatSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { realExec } from '../exec.js';
+import { assertSecureCloudflaredVersion, cloudflaredUnavailableError, CLOUDFLARED_VERSION_TIMEOUT_MS } from '../security-versions.js';
 import { stateRoot } from '../paths.js';
-export function startWorkspaceTunnel(origin) {
+export async function startWorkspaceTunnel(origin, exec = realExec) {
     const dir = join(stateRoot(), 'workspace'), file = join(dir, 'tunnel.json');
     if (!existsSync(file))
         return async () => { };
@@ -15,7 +17,31 @@ export function startWorkspaceTunnel(origin) {
     const stat = lstatSync(tokenFile);
     if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 || stat.uid !== process.getuid?.())
         throw Error('Connector credential must be an owned private file');
-    let stopped = false, child, timer, backoff = 1000;
+    // The connector is the executable named cloudflared on this process's PATH, the
+    // same lookup spawn uses. Its version is verified before the first start and
+    // before every reconnect, so a downgrade is refused and an upgrade is picked up.
+    const verify = async () => {
+        const result = await exec('cloudflared', ['--version'], { timeout: CLOUDFLARED_VERSION_TIMEOUT_MS });
+        if (result.code !== 0)
+            throw Error(cloudflaredUnavailableError(result.code === 127 ? 'not found' : 'version check failed'));
+        assertSecureCloudflaredVersion(result.stdout);
+    };
+    await verify();
+    let stopped = false, child, timer, backoff = 1000, reported = '';
+    const schedule = () => { if (stopped)
+        return; timer = setTimeout(reconnect, backoff); backoff = Math.min(30000, backoff * 2); };
+    // A refused or unverifiable connector is never started; retry after the backoff.
+    const reconnect = () => {
+        timer = undefined;
+        void verify().then(() => { reported = ''; launch(); }, (error) => {
+            if (stopped)
+                return;
+            if (error.message !== reported)
+                console.error(`Workspace tunnel not restarted: ${error.message}`);
+            reported = error.message;
+            schedule();
+        });
+    };
     const launch = () => {
         if (stopped)
             return;
@@ -23,7 +49,7 @@ export function startWorkspaceTunnel(origin) {
         let scheduled = false;
         // Keep an error listener for the child's whole lifetime, including shutdown.
         const retry = () => { if (scheduled || stopped)
-            return; scheduled = true; timer = setTimeout(launch, backoff); backoff = Math.min(30000, backoff * 2); };
+            return; scheduled = true; schedule(); };
         child.on('error', retry);
         child.once('exit', retry);
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "2.1.1",
+  "version": "2.2.0",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -30,7 +30,7 @@
     "docs/task-progress-review.md"
   ],
   "engines": {
-    "node": ">=22.13.0"
+    "node": ">=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1 <27"
   },
   "scripts": {
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
@@ -49,9 +49,9 @@
   "dependencies": {
     "@agentclientprotocol/sdk": "^1.3.0",
     "@fastify/websocket": "^11.2.0",
-    "@ours.network/cli": "4.0.0",
-    "@ours.network/mcp": "2.0.0",
-    "@ours.network/sdk": "5.0.0",
+    "@ours.network/cli": "4.0.1",
+    "@ours.network/mcp": "2.0.1",
+    "@ours.network/sdk": "5.0.1",
     "commander": "^12.1.0",
     "fastify": "^5.4.0",
     "qrcode": "1.5.4",
@@ -65,7 +65,7 @@
     "@agentclientprotocol/codex-acp": "1.10.0"
   },
   "devDependencies": {
-    "@ours.network/daemon": "5.0.0",
+    "@ours.network/daemon": "5.0.1",
     "@types/node": "^22.20.4",
     "@types/qrcode": "^1.5.6",
     "@types/ws": "^8.18.1",