@ours.network/fleet 2.1.2 → 2.2.0

package/dist/rooms-tasks/types.d.ts

@@ -115,6 +115,13 @@ export interface TaskNotificationEvent {
         taskId: string;
     };
     taskId: string;
+    /** Born read in the notification service: pushed, never an unread item. Absent on events queued before it. */
+    delivery?: 'push-only';
+}
+/** Persisted reads of Progress entries and To review revisions; absent until the first post-upgrade change. */
+export interface TaskContributionReads {
+    progress_read: string[];
+    review_revision: number;
 }
 /** Who wrote a progress entry or review change, as established by the Fleet surface. */
 export type TaskContributionAuthor = {
@@ -162,6 +169,9 @@ export interface TaskRecord {
     review?: TaskReview;
     /** Pending lifecycle events, committed atomically with their task change. */
     notification_events?: TaskNotificationEvent[];
+    contribution_reads?: TaskContributionReads;
+    /** Rooms whose notifications belong to this task; only grows. */
+    notification_manifest?: import('./notification-manifest.js').TaskNotificationManifest;
     workspace?: import('./workspace.js').OwnedWorkspace;
     task_id: string;
     /** Stable organizational list identifier. Missing legacy values mean `default`. */

package/dist/session/acp.d.ts

@@ -208,6 +208,9 @@ export declare class AcpSession implements AgentSession {
     private activeTurn?;
     private constructor();
     static start(options: AcpSessionOptions): Promise<AcpSession>;
+    /** Construction failed after the child and connection exist: close the connection, stop the child (bounded TERM, then
+     * KILL), and check liveness at the end. Every cleanup failure is kept; a child not proven exited is named by pid. */
+    private static releaseFailedStart;
     /**
      * Honest restart recovery: a prompt that was admitted but never
      * started is safe to dispatch again; a turn that had already started may

package/dist/session/acp.js

@@ -1,4 +1,5 @@
 import { ConversationObservation } from './conversation-observation.js';
+import { recordSessionOwnership } from './session-ownership.js';
 import { appendTaskCreated } from './task-notice.js';
 import { spawn } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
@@ -336,7 +337,17 @@ export class AcpSession {
         this.conversation = new ConversationEventStore(join(options.stateDir, '.conversation'), {
             roleId: options.name, log: line => options.log(`[${options.name}] ${line}`),
         });
+        // Only earlier generations are below the page floor. The current ownership
+        // binding must be visible through both canonical pages and passive replay.
         this.conversationStartCursor = this.conversation.lastCursor();
+        // Unavailable ownership refuses the start; release the ledger descriptor this constructor opened.
+        try {
+            recordSessionOwnership(this.conversation, this.sessionGeneration, options.stateDir);
+        }
+        catch (error) {
+            this.conversation.close();
+            throw error;
+        }
         // A durable append can precede its inventory mutation. Capture only after
         // the synchronous owner checkpoint, never the state at append notification.
         this.conversation.subscribe(() => this.observation.scheduleCapture());
@@ -417,7 +428,14 @@ export class AcpSession {
         });
         const stream = acp.ndJsonStream(Writable.toWeb(child.stdin), Readable.toWeb(child.stdout));
         const connection = app.connect(stream);
-        instance = new AcpSession(options, child, connection);
+        try {
+            instance = new AcpSession(options, child, connection);
+        }
+        catch (error) {
+            // A cleanup exception never replaces the ownership failure: both are kept.
+            throw await AcpSession.releaseFailedStart(child, connection, error)
+                .catch(cleanupError => new AggregateError([error, cleanupError], 'ACP start failed and its cleanup failed', { cause: error }));
+        }
         try {
             await instance.initialize();
             instance.startStallWatchdog();
@@ -430,6 +448,45 @@ export class AcpSession {
             throw error;
         }
     }
+    /** Construction failed after the child and connection exist: close the connection, stop the child (bounded TERM, then
+     * KILL), and check liveness at the end. Every cleanup failure is kept; a child not proven exited is named by pid. */
+    static async releaseFailedStart(child, connection, error) {
+        const failures = [];
+        try {
+            connection.close();
+        }
+        catch (closeError) {
+            failures.push(closeError);
+        }
+        const exited = () => child.exitCode !== null || child.signalCode !== null;
+        const wait = (ms) => new Promise(resolve => {
+            if (exited())
+                return resolve();
+            const settle = () => { clearTimeout(timer); child.off('exit', settle); resolve(); };
+            const timer = setTimeout(settle, ms);
+            timer.unref();
+            child.on('exit', settle);
+        });
+        let killFailed = false;
+        const signal = (name) => { try {
+            child.kill(name);
+        }
+        catch (killError) {
+            killFailed = true;
+            failures.push(killError);
+        } };
+        if (!exited()) {
+            signal('SIGTERM');
+            await wait(2_500);
+        }
+        if (!exited()) {
+            signal('SIGKILL');
+            await wait(2_500);
+        }
+        if (!exited())
+            failures.push(new Error(`ACP child (pid ${child.pid}) ${killFailed ? 'exit unproven: a stop signal failed' : 'is still running'}`));
+        return failures.length ? new AggregateError([error, ...failures], 'ACP start failed and its release is unproven', { cause: error }) : error;
+    }
     /**
      * Honest restart recovery: a prompt that was admitted but never
      * started is safe to dispatch again; a turn that had already started may

package/dist/session/codex-app-server.js

@@ -1,4 +1,5 @@
 import { ConversationObservation } from './conversation-observation.js';
+import { recordSessionOwnership } from './session-ownership.js';
 import { appendTaskCreated } from './task-notice.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
@@ -173,7 +174,17 @@ export class CodexAppServerSession {
         this.conversation = new ConversationEventStore(join(options.stateDir, '.conversation'), {
             roleId: options.name, log: line => options.log(`[${options.name}] ${line}`),
         });
+        // Only earlier generations are below the page floor. The current ownership
+        // binding must be visible through both canonical pages and passive replay.
         this.conversationStartCursor = this.conversation.lastCursor();
+        // Unavailable ownership refuses the start; release the ledger descriptor this constructor opened.
+        try {
+            recordSessionOwnership(this.conversation, this.sessionGeneration, options.stateDir);
+        }
+        catch (error) {
+            this.conversation.close();
+            throw error;
+        }
         // A durable append can precede its inventory mutation. Capture only after
         // the synchronous owner checkpoint, never the state at append notification.
         this.conversation.subscribe(() => this.observation.scheduleCapture());
@@ -191,7 +202,17 @@ export class CodexAppServerSession {
             onRequest: (method, id, params) => instance?.serverRequest(method, id, params),
             onExit: exit => instance?.transportExited(exit),
         });
-        instance = new CodexAppServerSession(options, transport);
+        try {
+            instance = new CodexAppServerSession(options, transport);
+        }
+        catch (error) {
+            // Existing bounded TERM→KILL; its waits are not proof, so liveness is checked after it returns.
+            const failures = [];
+            await transport.close().catch((closeError) => { failures.push(closeError); });
+            if (transport.isAlive())
+                failures.push(new Error(`Codex app-server transport (pid ${transport.pid}) is still running`));
+            throw failures.length ? new AggregateError([error, ...failures], 'Codex app-server start failed and its release is unproven', { cause: error }) : error;
+        }
         try {
             await instance.initialize();
             instance.recoverOpenPrompts();

package/dist/session/conversation-types.d.ts

@@ -8,7 +8,7 @@ import type { PromptOrigin, SessionSnapshot, TurnCancellationSource, TurnOutcome
  * file touches the wire: transport updates are reduced into these shapes by a
  * session adapter, and the store assigns `seq`/`eventId`/timestamps.
  */
-export type ConversationEventKind = 'prompt.admitted' | 'prompt.started' | 'prompt.interrupt_requested' | 'message.chunk' | 'message.replace' | 'thought.chunk' | 'thought.replace' | 'plan.replace' | 'tool.upsert' | 'tool.content_chunk' | 'permission.requested' | 'permission.resolved' | 'file.attached' | 'fleet.task_created' | 'monitor.delivery' | 'usage.updated' | 'turn.state' | 'turn.completed' | 'session.state' | 'session.info' | 'capabilities.updated' | 'error'
+export type ConversationEventKind = 'prompt.admitted' | 'prompt.started' | 'prompt.interrupt_requested' | 'message.chunk' | 'message.replace' | 'thought.chunk' | 'thought.replace' | 'plan.replace' | 'tool.upsert' | 'tool.content_chunk' | 'permission.requested' | 'permission.resolved' | 'file.attached' | 'fleet.task_created' | 'monitor.delivery' | 'usage.updated' | 'turn.state' | 'turn.completed' | 'session.state' | 'session.info' | 'session.ownership' | 'capabilities.updated' | 'error'
 /** A well-formed transport update this version cannot represent. Bounded, never a crash. */
  | 'unsupported';
 /** Where a conversation record came from. Typed provenance, never prompt text. */
@@ -142,6 +142,12 @@ export interface UsageUpdatedPayload {
 export interface SessionStatePayload {
     currentModeId?: string;
 }
+/** First event of a generation: the launch it belongs to and that launch's task, or null for a non-task role. */
+export interface SessionOwnershipPayload {
+    /** Null for a role without temp-supervisor metadata (explicitly standalone). */
+    launchId: string | null;
+    taskId: string | null;
+}
 export interface SessionInfoPayload {
     title?: string | null;
     updatedAt?: string | null;
@@ -236,7 +242,7 @@ export interface BoundedJson {
 }
 export type ConversationPayload = {
     attachment: import('../file-delivery/types.js').DeliveredFile;
-} | MessageChunkPayload | ThoughtChunkPayload | PlanReplacePayload | ToolUpsertPayload | UsageUpdatedPayload | SessionStatePayload | SessionInfoPayload | CapabilitiesUpdatedPayload | UnsupportedPayload | PromptAdmittedPayload | PromptStartedPayload | PromptInterruptRequestedPayload | PermissionRequestedPayload | PermissionResolvedPayload | TurnStatePayload | TurnCompletedPayload | MonitorDeliveryPayload | SessionLifecyclePayload | ErrorPayload | TaskCreatedNotice;
+} | MessageChunkPayload | ThoughtChunkPayload | PlanReplacePayload | ToolUpsertPayload | UsageUpdatedPayload | SessionStatePayload | SessionInfoPayload | SessionOwnershipPayload | CapabilitiesUpdatedPayload | UnsupportedPayload | PromptAdmittedPayload | PromptStartedPayload | PromptInterruptRequestedPayload | PermissionRequestedPayload | PermissionResolvedPayload | TurnStatePayload | TurnCompletedPayload | MonitorDeliveryPayload | SessionLifecyclePayload | ErrorPayload | TaskCreatedNotice;
 export interface ConversationEventV1 {
     schemaVersion: 1;
     roleId: string;

package/dist/session/session-ownership.d.ts

@@ -0,0 +1,18 @@
+import type { ConversationEventStore } from './conversation-store.js';
+/** Durable generation → launch/task evidence, independent of the transcript tail. Bounded to recent generations. */
+export declare const SESSION_OWNERSHIP_FILE = ".session-ownership.json";
+export interface SessionOwnership {
+    launchId: string | null;
+    taskId: string | null;
+}
+/** Canonical Fleet task identity; a task owner always has a launch. */
+export declare const validOwnerTask: (taskId: unknown) => taskId is string;
+/** Absent evidence is `{}` (no file: ENOENT only). Unreadable or invalid evidence throws and is never treated as absent. */
+export declare function readSessionOwnership(stateDir: string): Record<string, SessionOwnership>;
+/**
+ * Bind this session generation to its launch before any prompt can be admitted. A task member's generation names
+ * its task; a role without temp-supervisor metadata is explicitly standalone. Existing but unreadable metadata is
+ * unavailable evidence: the session refuses to start rather than guess. For a task-owned generation both the
+ * sidecar and the ledger event must persist, or the session start fails (no prompt is admitted without its binding).
+ */
+export declare function recordSessionOwnership(conversation: ConversationEventStore, sessionGeneration: string, stateDir: string): void;

package/dist/session/session-ownership.js

@@ -0,0 +1,74 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically } from '../atomic-file.js';
+import { readTempSupervisor, TEMP_SUPERVISOR_FILE } from '../temp-lifecycle.js';
+/** Durable generation → launch/task evidence, independent of the transcript tail. Bounded to recent generations. */
+export const SESSION_OWNERSHIP_FILE = '.session-ownership.json';
+const MAX_GENERATIONS = 16;
+/** Canonical Fleet task identity; a task owner always has a launch. */
+export const validOwnerTask = (taskId) => typeof taskId === 'string' && /^[0-9a-z]{9}[0-9a-f]{8}$/.test(taskId);
+/** Absent evidence is `{}` (no file: ENOENT only). Unreadable or invalid evidence throws and is never treated as absent. */
+export function readSessionOwnership(stateDir) {
+    let text;
+    try {
+        text = readFileSync(join(stateDir, SESSION_OWNERSHIP_FILE), 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return {};
+        throw error;
+    }
+    if (text.length > 64 * 1024)
+        throw new Error('session ownership evidence too large');
+    const value = JSON.parse(text);
+    if (value?.schema !== 1 || !value.generations || typeof value.generations !== 'object' || Array.isArray(value.generations))
+        throw new Error('invalid session ownership evidence');
+    const result = {};
+    for (const [generation, owner] of Object.entries(value.generations)) {
+        if (!owner || !(owner.launchId === null || typeof owner.launchId === 'string')
+            || !(owner.taskId === null || validOwnerTask(owner.taskId)) || (owner.taskId !== null && owner.launchId === null))
+            throw new Error('invalid session ownership evidence');
+        result[generation] = { launchId: owner.launchId, taskId: owner.taskId };
+    }
+    return result;
+}
+/**
+ * Bind this session generation to its launch before any prompt can be admitted. A task member's generation names
+ * its task; a role without temp-supervisor metadata is explicitly standalone. Existing but unreadable metadata is
+ * unavailable evidence: the session refuses to start rather than guess. For a task-owned generation both the
+ * sidecar and the ledger event must persist, or the session start fails (no prompt is admitted without its binding).
+ */
+export function recordSessionOwnership(conversation, sessionGeneration, stateDir) {
+    let owner;
+    if (!existsSync(join(stateDir, TEMP_SUPERVISOR_FILE)))
+        owner = { launchId: null, taskId: null };
+    else {
+        const metadata = readTempSupervisor(stateDir);
+        if (!metadata)
+            throw new Error('session ownership unavailable: temp supervisor metadata is unreadable');
+        const taskId = metadata.taskOwner?.taskId ?? null;
+        if (taskId !== null && !validOwnerTask(taskId))
+            throw new Error('session ownership unavailable: invalid task owner');
+        owner = { launchId: metadata.launchId, taskId };
+    }
+    const draft = { kind: 'session.ownership', sessionGeneration, payload: owner };
+    if (!owner.taskId) {
+        // A standalone role keeps the existing degrade-not-die behaviour. A sidecar that cannot be updated is left exactly as
+        // it was (never reset): the ledger event still binds this generation, and the observer refuses to guess from it.
+        try {
+            writeSidecar(stateDir, sessionGeneration, owner);
+        }
+        catch { /* evidence preserved; the ledger binding remains */ }
+        conversation.appendSafe(draft);
+        return;
+    }
+    writeSidecar(stateDir, sessionGeneration, owner);
+    conversation.append(draft);
+}
+/** Initializes only on proven absence. Corrupt or unreadable prior evidence throws and its bytes stay untouched. */
+function writeSidecar(stateDir, sessionGeneration, owner) {
+    const generations = readSessionOwnership(stateDir);
+    delete generations[sessionGeneration];
+    const kept = Object.entries(generations).slice(-(MAX_GENERATIONS - 1));
+    replaceFileAtomically(join(stateDir, SESSION_OWNERSHIP_FILE), JSON.stringify({ schema: 1, generations: Object.fromEntries([...kept, [sessionGeneration, owner]]) }) + '\n', 0o600);
+}

package/dist/supervisor/manager.js

@@ -160,8 +160,15 @@ export async function runFleetManager(entrypoint, deps = {}) {
     try {
         try {
             const config = producerConfig(process.env, undefined, log);
-            if (config)
-                notifications = new TaskNotificationProducer(config, log);
+            if (config) {
+                const [{ listTasks }, { TaskLayouts }] = await Promise.all([import('../rooms-tasks/task-state.js'), import('../application/task-layouts.js')]);
+                const layouts = new TaskLayouts();
+                notifications = new TaskNotificationProducer(config, log, fetch, {
+                    // Unreadable task or layout evidence is not an empty inventory: it throws and the bootstrap run stays incomplete.
+                    tasks: () => listTasks({ strict: true }),
+                    layoutRooms: task => (layouts.view(task)?.rooms ?? []).flatMap(room => room.identity_cid ? [room.identity_cid] : []),
+                });
+            }
         }
         catch {
             log('[fleet] task notifications unavailable; committed events retained');

package/dist/web/resource-views.d.ts

@@ -91,6 +91,8 @@ export interface ResourceDescriptor {
     list?: string;
     groupByList?: boolean;
     includeDeleting?: boolean;
+    /** Previews: each agent's newest assistant message time only, without its text. */
+    activityOnly?: boolean;
 }
 export declare function canonicalResourceDescriptor(input: unknown): ResourceDescriptor;
 interface BoundProjection {

package/dist/web/resource-views.js

@@ -156,9 +156,11 @@ export function canonicalResourceDescriptor(input) {
         throw Error('invalid resource descriptor');
     const value = input;
     if (!/^[A-Za-z0-9_-]{1,128}$/.test(value.viewId) || !['directory', 'roles', 'tasks', 'task-lists', 'configuration', 'previews', 'task-layout', 'creation-action', 'action', 'member-addition', 'login', 'onboarding-health', 'subscriptions'].includes(value.resource)
-        || Object.keys(value).some(key => !['viewId', 'resource', 'includeTemporary', 'includeDefinitions', 'ids', 'state', 'list', 'groupByList', 'includeDeleting', 'entityId', 'receiptId', 'provider'].includes(key)))
+        || Object.keys(value).some(key => !['viewId', 'resource', 'includeTemporary', 'includeDefinitions', 'ids', 'state', 'list', 'groupByList', 'includeDeleting', 'entityId', 'receiptId', 'provider', 'activityOnly'].includes(key)))
         throw Error('invalid resource descriptor');
-    for (const key of ['includeTemporary', 'includeDefinitions', 'groupByList', 'includeDeleting'])
+    if (value.activityOnly !== undefined && value.resource !== 'previews')
+        throw Error('invalid resource descriptor');
+    for (const key of ['includeTemporary', 'includeDefinitions', 'groupByList', 'includeDeleting', 'activityOnly'])
         if (value[key] !== undefined && typeof value[key] !== 'boolean')
             throw Error('invalid resource descriptor');
     if (value.ids !== undefined && (!Array.isArray(value.ids) || value.ids.length > 500 || value.ids.some(id => typeof id !== 'string' || !/^[A-Za-z0-9_-]{1,120}$/.test(id))))

package/dist/web/server.js

@@ -2,7 +2,7 @@ import { FleetResourceViews, ResourceBindingError, canonicalResourceDescriptor }
 import { publishFleetResourceCommit } from '../application/resource-observer.js';
 import { stateRoot, defaultConfigPath } from '../paths.js';
 import { EMPTY_TASK_LAYOUT } from '../rooms-tasks/empty-layout.js';
-import { conversationPreview } from '../application/conversation-history.js';
+import { conversationActivity, conversationPreview } from '../application/conversation-history.js';
 import { registerConversationStream } from './conversation-stream.js';
 import { conversationHasAttachment } from '../application/conversation-history.js';
 import { readDeliveredFile } from '../file-delivery/store.js';
@@ -26,7 +26,7 @@ import { WebAuth } from './auth.js';
 import { FleetEventBus } from './events.js';
 import { ROLE_NAME_RE } from '../config.js';
 import { TaskListError } from '../rooms-tasks/task-lists.js';
-import { TaskStateError } from '../rooms-tasks/task-state.js';
+import { acknowledgeTaskProgress, acknowledgeTaskReview, contributionUnread, TaskStateError } from '../rooms-tasks/task-state.js';
 import { appendTaskProgress, getTaskReview, listTaskProgress, publicProgressEntry, publicReview, readTaskReviewArtifact, setTaskReviewMarkdown, taskContributionSummary, TaskReviewError, } from '../rooms-tasks/task-review.js';
 import { isProvider } from '../subscriptions/store.js';
 const ONBOARDING_WORK = ['coordination', 'development', 'review'];
@@ -371,9 +371,12 @@ export async function buildWebServer(services, boundary, options = {}) {
         const filter = { strict, ...(state ? { state } : {}), ...(query.list ? { list: query.list } : {}),
             ...(query.includeDeleting === 'true' ? { includeDeleting: true } : {}) };
         const api = requireTaskRooms();
+        // Navigation totals cover every task in scope, not only the filtered or visible cards.
+        const unreadTotal = () => api.listTasks({ strict, ...(query.includeDeleting === 'true' ? { includeDeleting: true } : {}) })
+            .reduce((sum, task) => { const unread = contributionUnread(task); return sum + unread.progress + (unread.review ? 1 : 0); }, 0);
         return taskApi(() => query.groupByList === 'true'
-            ? { groups: api.groupedTasks(filter).map(group => ({ ...group, tasks: group.tasks.map(task => wireTask(api.withLayoutRooms(task))) })) }
-            : { tasks: api.listTasks(filter).map(task => wireTask(api.withLayoutRooms(task))) });
+            ? { groups: api.groupedTasks(filter).map(group => ({ ...group, tasks: group.tasks.map(task => wireTask(api.withLayoutRooms(task))) })), contribution_unread_total: unreadTotal() }
+            : { tasks: api.listTasks(filter).map(task => wireTask(api.withLayoutRooms(task))), contribution_unread_total: unreadTotal() });
     };
     const project = async (descriptor, signal, owner = '') => {
         signal.throwIfAborted();
@@ -426,7 +429,8 @@ export async function buildWebServer(services, boundary, options = {}) {
                 return { ...services.configuration.read(descriptor.includeDefinitions ?? false), provenance: services.presetProvenance?.read() ?? null };
             case 'directory': {
                 const [roles, tasks] = await Promise.all([services.query.list(true, true), projectTasks({})]);
-                return { roles, tasks: tasks.tasks, lists: requireTaskRooms().listTaskLists() };
+                const { tasks: rows, contribution_unread_total } = tasks;
+                return { roles, tasks: rows, contribution_unread_total, lists: requireTaskRooms().listTaskLists() };
             }
             case 'previews': {
                 const roles = await services.repository.list(true), selected = new Map(roles.map(role => [role.id, role]));
@@ -437,14 +441,15 @@ export async function buildWebServer(services, boundary, options = {}) {
                     if (!role)
                         continue;
                     try {
-                        previews[id] = dir ? await conversationPreview(dir, signal) : { text: 'No recent agent output', at: '' };
+                        previews[id] = descriptor.activityOnly ? (dir ? await conversationActivity(dir, signal) : { at: '' })
+                            : dir ? await conversationPreview(dir, signal) : { text: 'No recent agent output', at: '' };
                     }
                     catch {
                         signal.throwIfAborted();
                         // A damaged/unreadable ledger is unavailable, not empty or removed.
                         // Keep this selected row observable so a repair can refresh it,
                         // without retiring previews for the other selected roles.
-                        previews[id] = { text: 'Preview unavailable', at: '', unavailable: true };
+                        previews[id] = descriptor.activityOnly ? { at: '', unavailable: true } : { text: 'Preview unavailable', at: '', unavailable: true };
                     }
                 }
                 return { previews };
@@ -505,7 +510,7 @@ export async function buildWebServer(services, boundary, options = {}) {
     for (const resource of ['task-layout', 'creation-action', 'action', 'member-addition', 'login', 'onboarding-health'])
         app.get('/api/v1/' + resource, async () => { throw new ResourceBindingError(409, 'resource binding required'); });
     app.get('/api/v1/directory', async (request) => { auth.authenticate(request); return project({ viewId: 'read', resource: 'directory' }, new AbortController().signal); });
-    app.get('/api/v1/previews', async (request) => { auth.authenticate(request); const ids = String(request.query.ids ?? '').split(',').filter(Boolean); return project(canonicalResourceDescriptor({ viewId: 'read', resource: 'previews', ids }), new AbortController().signal); });
+    app.get('/api/v1/previews', async (request) => { auth.authenticate(request); const query = request.query, ids = String(query.ids ?? '').split(',').filter(Boolean); return project(canonicalResourceDescriptor({ viewId: 'read', resource: 'previews', ids, ...(query.activityOnly === 'true' ? { activityOnly: true } : {}) }), new AbortController().signal); });
     app.get('/api/v1/task-lists', async (request) => {
         auth.authenticate(request);
         return project({ viewId: 'read', resource: 'task-lists' }, new AbortController().signal);
@@ -619,6 +624,22 @@ export async function buildWebServer(services, boundary, options = {}) {
             reply.code(201);
         return { entry: publicProgressEntry(result.entry), replayed: result.replayed };
     });
+    /** Acknowledge Progress entries the browser actually showed; returns the task's remaining unread. */
+    app.post('/api/v1/tasks/:id/progress/read', async (request) => {
+        auth.authenticate(request, true);
+        const ids = request.body?.ids;
+        if (!Array.isArray(ids) || ids.length > 200 || ids.some(id => typeof id !== 'string' || id.length > 64))
+            throw new FleetError('invalid_request', 'ids must be at most 200 progress entry IDs');
+        return { unread: await reviewApi(() => acknowledgeTaskProgress(request.params.id, ids)) };
+    });
+    /** Acknowledge the To review revision the browser fetched and rendered. */
+    app.post('/api/v1/tasks/:id/review/read', async (request) => {
+        auth.authenticate(request, true);
+        const revision = request.body?.revision;
+        if (!Number.isSafeInteger(revision) || revision < 0)
+            throw new FleetError('invalid_request', 'revision must be a non-negative integer');
+        return { unread: await reviewApi(() => acknowledgeTaskReview(request.params.id, revision)) };
+    });
     app.get('/api/v1/tasks/:id/review', async (request) => {
         auth.authenticate(request);
         const review = await reviewApi(() => getTaskReview(request.params.id));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "2.1.2",
+  "version": "2.2.0",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -49,9 +49,9 @@
   "dependencies": {
     "@agentclientprotocol/sdk": "^1.3.0",
     "@fastify/websocket": "^11.2.0",
-    "@ours.network/cli": "4.0.0",
-    "@ours.network/mcp": "2.0.0",
-    "@ours.network/sdk": "5.0.0",
+    "@ours.network/cli": "4.0.1",
+    "@ours.network/mcp": "2.0.1",
+    "@ours.network/sdk": "5.0.1",
     "commander": "^12.1.0",
     "fastify": "^5.4.0",
     "qrcode": "1.5.4",
@@ -65,7 +65,7 @@
     "@agentclientprotocol/codex-acp": "1.10.0"
   },
   "devDependencies": {
-    "@ours.network/daemon": "5.0.0",
+    "@ours.network/daemon": "5.0.1",
     "@types/node": "^22.20.4",
     "@types/qrcode": "^1.5.6",
     "@types/ws": "^8.18.1",