@ours.network/fleet 2.2.1 → 2.2.2

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "2.2.1",
-  "buildId": "31d6e72bc212",
-  "commit": "14d8f16953e773c6806d9df5661b8a4fe08af2b4",
+  "version": "2.2.2",
+  "buildId": "b0c5de2e0887",
+  "commit": "ebe447505d63119b299e3619d12a6399f1e2e49f",
   "dirty": false,
-  "builtAt": "2026-10-29T07:06:09.148Z",
+  "builtAt": "2026-10-29T07:51:29.222Z",
   "capabilities": [
     "service.refresh-v1",
     "managed-cli.codex-reasoning-effort-v1",

package/dist/rooms-tasks/task-review.d.ts

@@ -11,6 +11,10 @@ export declare class TaskReviewError extends Error {
 export declare function reviewArtifactMime(name: string): string;
 export declare function checkArtifactName(name: string): string;
 export declare function listTaskProgress(taskId: string): TaskProgressEntry[];
+/** Browser snapshot: entry bodies and their saved read state come from one task record. */
+export declare function taskProgressSnapshot(taskId: string): Array<Omit<TaskProgressEntry, 'request_key'> & {
+    unread: boolean;
+}>;
 /**
  * Append one milestone. Text is kept exactly as written; whitespace-only text is
  * rejected. A retry with the same author-scoped request_key returns the original

package/dist/rooms-tasks/task-review.js

@@ -73,6 +73,16 @@ export function listTaskProgress(taskId) {
     assertTaskId(taskId);
     return getTask(taskId).progress ?? [];
 }
+/** Browser snapshot: entry bodies and their saved read state come from one task record. */
+export function taskProgressSnapshot(taskId) {
+    assertTaskId(taskId);
+    const task = getTask(taskId);
+    const reads = task.contribution_reads;
+    const seen = new Set(reads?.progress_read);
+    return (task.progress ?? []).map(entry => ({
+        ...publicProgressEntry(entry), unread: !!reads && !seen.has(entry.id),
+    }));
+}
 /**
  * Append one milestone. Text is kept exactly as written; whitespace-only text is
  * rejected. A retry with the same author-scoped request_key returns the original

package/dist/web/resource-views.js

@@ -384,13 +384,15 @@ export class FleetResourceViews {
         // otherwise reserved for an independent task receipt.
         if (this.scope.configPath && resolve(path) === resolve(this.scope.configPath))
             return true;
-        // Adopted Codex history, telemetry and cache commits are not canonical
-        // Fleet preview inputs. Keep credentials, unknown paths and directory-level
-        // events conservative, and never override explicit config or role roots.
+        // These projections read role config/private status and conversation ledgers,
+        // not adopted Codex telemetry or this gateway's auth/audit bookkeeping. Those
+        // writes otherwise invalidate every in-flight directory capture on a busy host.
+        // Keep explicit config, declared role roots and unknown/ancestor wakes fenced.
         const roots = this.scope.roots ?? [agentsRoot(), tmpRoot()];
-        if (descriptor.resource === 'previews'
-            && /^(?:history\.jsonl|models_cache\.json|(?:thread_history|state|logs|queue|goals)_\d+\.sqlite(?:-wal|-shm|-journal)?)$/.test(relative(resolve(homedir(), '.codex'), path))
-            && !roots.some(root => { const local = relative(resolve(root), path); return local === '' || (local !== '..' && !local.startsWith('..' + sep)); }))
+        const roleProjection = ['directory', 'roles', 'previews'].includes(descriptor.resource);
+        const inRoleRoot = roots.some(root => { const local = relative(resolve(root), path); return local === '' || (local !== '..' && !local.startsWith('..' + sep)); });
+        if (roleProjection && !inRoleRoot && (/^(?:history\.jsonl|models_cache\.json|(?:thread_history|state|logs|queue|goals)_\d+\.sqlite(?:-wal|-shm|-journal)?)$/.test(relative(resolve(homedir(), '.codex'), path))
+            || /^(?:workspace-devices\.db(?:-wal|-shm|-journal)?|audit[/\\]audit\.jsonl)$/.test(relative(resolve(stateRoot(), 'web'), path))))
             return false;
         // Preview selection reads role config/state and conversation ledgers, never
         // task layout run/operation/brief receipts. A worker may commit several of

package/dist/web/server.js

@@ -27,7 +27,7 @@ import { FleetEventBus } from './events.js';
 import { ROLE_NAME_RE } from '../config.js';
 import { TaskListError } from '../rooms-tasks/task-lists.js';
 import { acknowledgeTaskProgress, acknowledgeTaskReview, contributionUnread, TaskStateError } from '../rooms-tasks/task-state.js';
-import { appendTaskProgress, getTaskReview, listTaskProgress, publicProgressEntry, publicReview, readTaskReviewArtifact, setTaskReviewMarkdown, taskContributionSummary, TaskReviewError, } from '../rooms-tasks/task-review.js';
+import { appendTaskProgress, getTaskReview, taskProgressSnapshot, publicProgressEntry, publicReview, readTaskReviewArtifact, setTaskReviewMarkdown, taskContributionSummary, TaskReviewError, } from '../rooms-tasks/task-review.js';
 import { isProvider } from '../subscriptions/store.js';
 const ONBOARDING_WORK = ['coordination', 'development', 'review'];
 const statusFor = (code) => ({
@@ -608,7 +608,7 @@ export async function buildWebServer(services, boundary, options = {}) {
     });
     app.get('/api/v1/tasks/:id/progress', async (request) => {
         auth.authenticate(request);
-        return { progress: (await reviewApi(() => listTaskProgress(request.params.id))).map(publicProgressEntry) };
+        return { progress: await reviewApi(() => taskProgressSnapshot(request.params.id)) };
     });
     app.post('/api/v1/tasks/:id/progress', async (request, reply) => {
         auth.authenticate(request, true);

package/docs/task-progress-review.md

@@ -4,7 +4,10 @@ Every task can carry two optional sections next to its description. Tasks create
 before this feature, or that never use it, have neither and behave as before.
 
 - **Progress** is an append-only, chronological milestone log: free-form text
-  entries, each with a stable ID, the time it was recorded and its author. It is
+  entries, each with a stable ID, the time it was recorded and its author. The
+  browser response also includes `unread` per entry from the same task snapshot,
+  based on persisted entry-ID acknowledgments. Legacy records without read state
+  report all existing entries as read; retry keys remain private. It is
   for significant verified milestones (root cause found, PR opened with its link,
   a measured result with its honest scope, final deliverable ready), not for room
   chat, routine status, handoffs or ordinary review rounds. Entries cannot be
@@ -99,7 +102,7 @@ workspace-device bearer. `GET /api/v1/meta` reports API minor version 1.
 | Route | Result |
 | --- | --- |
 | `GET /tasks`, `GET /tasks/:id` and other task payloads | `progress_count` and `review: {has_markdown, artifact_count, revision, updated_at?}`; `revision` grows with every package change (0 without a package). Bodies are not inlined. |
-| `GET /tasks/:id/progress` | `{progress: [{id, at, author, text}]}`, oldest first. |
+| `GET /tasks/:id/progress` | `{progress: [{id, at, author, text, unread}]}`, oldest first. |
 | `POST /tasks/:id/progress` | `{text, requestKey?}` (or an `Idempotency-Key` header): 201 new, 200 replay, 409 conflicting replay. |
 | `GET /tasks/:id/review` | `{review: {markdown, updated_at, updated_by, artifacts: [{id, name, mime, size, sha256, added_at, added_by}]}}` or `{review: null}`. |
 | `PUT /tasks/:id/review` | `{markdown, expectedMarkdown}`; 409 when the Markdown changed meanwhile. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",