@ours.network/fleet 2.2.1 → 2.2.3

package/dist/application/conversation-history.js

@@ -7,39 +7,155 @@ const HISTORICAL_KINDS = ['file.attached', 'fleet.task_created', 'prompt.admitte
 export function conversationEventVisible(event, sessionGeneration, resumedSessionId) {
     return event.source !== 'agent_replay' && (event.sessionGeneration === sessionGeneration || (!!resumedSessionId && HISTORICAL_KINDS.includes(event.kind) && event.acpSessionId === resumedSessionId));
 }
-/** Newest-first lines of a file, read in chunks from its end; `visit` returns false to stop. */
-async function readLinesBackward(path, visit, signal) {
+// A seek attempt is transactional: its caller discards all collected rows and
+// performs one ordinary scan if a probe or the file identity is no longer safe.
+class SeekFallback extends Error {
+}
+const stamp = (info) => `${info.dev}:${info.ino}:${info.size}:${info.mtimeMs}:${info.ctimeMs}`;
+/** Strict lower bound in an admitted monotonic writer segment, on this FD only. */
+async function seekBefore(file, size, before, signal) {
+    const read = async (position, length) => {
+        signal?.throwIfAborted();
+        const bytes = Buffer.alloc(length);
+        const { bytesRead } = await file.read(bytes, 0, length, position);
+        signal?.throwIfAborted();
+        if (bytesRead !== length)
+            throw new SeekFallback('segment changed during seek');
+        return bytes;
+    };
+    if (!size)
+        return 0;
+    // An active partial append is not a safe boundary, even if the first event
+    // would let us skip this whole segment.
+    if ((await read(size - 1, 1))[0] !== 10)
+        throw new SeekFallback('partial segment');
+    const record = async (position) => {
+        let start = position, end = position;
+        const left = [], right = [];
+        while (start > 0) {
+            const length = Math.min(4096, start), chunk = await read(start - length, length);
+            const newline = chunk.lastIndexOf(10);
+            left.push(chunk.subarray(newline + 1));
+            start -= length;
+            if (newline >= 0) {
+                start += newline + 1;
+                break;
+            }
+        }
+        while (end < size) {
+            const chunk = await read(end, Math.min(4096, size - end)), newline = chunk.indexOf(10);
+            right.push(newline < 0 ? chunk : chunk.subarray(0, newline));
+            end += newline < 0 ? chunk.length : newline + 1;
+            if (newline >= 0)
+                break;
+        }
+        let event;
+        try {
+            event = JSON.parse(Buffer.concat([...left.reverse(), ...right]).toString('utf8'));
+        }
+        catch {
+            throw new SeekFallback('unreadable seek record');
+        }
+        if (!event || event.schemaVersion !== 1 || !Number.isSafeInteger(event.seq) || event.seq <= 0)
+            throw new SeekFallback('legacy seek record');
+        return { start, end, seq: event.seq };
+    };
+    const first = await record(0);
+    if (first.seq >= before)
+        return 0;
+    let low = first.end, high = size, lower = first.seq, upper = Infinity;
+    while (low < high) {
+        const found = await record(Math.floor((low + high) / 2));
+        if (found.start < low || found.end > high || found.seq <= lower || found.seq >= upper)
+            throw new SeekFallback('non-monotonic seek record');
+        if (found.seq < before) {
+            low = found.end;
+            lower = found.seq;
+        }
+        else {
+            high = found.start;
+            upper = found.seq;
+        }
+    }
+    return low;
+}
+/** Newest-first lines; optional finite-before seek is only for a healthy writer. */
+async function readLinesBackward(path, visit, signal, seek) {
     signal?.throwIfAborted();
-    const file = await open(path, 'r');
+    let file;
+    try {
+        file = await open(path, 'r');
+    }
+    catch (error) {
+        signal?.throwIfAborted();
+        if (seek)
+            throw new SeekFallback('segment disappeared');
+        throw error;
+    }
     try {
-        let position = (await file.stat()).size;
-        let carry = Buffer.alloc(0);
-        while (position > 0) {
+        const initial = await file.stat(), key = stamp(initial);
+        let position = seek ? await seekBefore(file, initial.size, seek.before, signal) : initial.size;
+        let carry = Buffer.alloc(0), more = true;
+        scan: while (position > 0) {
             signal?.throwIfAborted();
             const size = Math.min(256 * 1024, position);
             position -= size;
             const chunk = Buffer.alloc(size);
-            await file.read(chunk, 0, size, position);
+            const { bytesRead } = await file.read(chunk, 0, size, position);
             signal?.throwIfAborted();
-            let buffer = Buffer.concat([chunk, carry]);
+            if (seek && bytesRead !== size)
+                throw new SeekFallback('short segment read');
+            const buffer = Buffer.concat([chunk.subarray(0, bytesRead), carry]);
             let end = buffer.length;
             for (let i = buffer.length - 1; i >= 0; i--) {
                 if (buffer[i] !== 10)
                     continue;
-                if (end > i + 1 && !visit(buffer.toString('utf8', i + 1, end)))
-                    return false;
+                if (end > i + 1 && !visit(buffer.toString('utf8', i + 1, end))) {
+                    more = false;
+                    break scan;
+                }
                 end = i;
             }
             carry = buffer.subarray(0, end);
         }
-        if (carry.length && !visit(carry.toString('utf8')))
-            return false;
-        return true;
+        if (more && carry.length && !visit(carry.toString('utf8')))
+            more = false;
+        if (seek) {
+            signal?.throwIfAborted();
+            const current = await stat(path).catch(() => undefined);
+            if (stamp(await file.stat()) !== key || !current || stamp(current) !== key)
+                throw new SeekFallback('segment changed during read');
+            seek.checked.push({ path, key });
+        }
+        return more;
+    }
+    catch (error) {
+        signal?.throwIfAborted();
+        if (seek && !(error instanceof SeekFallback))
+            throw new SeekFallback('seek read unavailable');
+        throw error;
     }
     finally {
         await file.close();
     }
 }
+/** Existing writer provenance, never a substitute for the captured barrier. */
+async function seekManifest(dir, files, signal) {
+    try {
+        signal?.throwIfAborted();
+        const raw = await readFile(join(dir, 'manifest.json'), { encoding: 'utf8', signal }), value = JSON.parse(raw);
+        if (value.schemaVersion !== 1 || !Number.isSafeInteger(value.nextSeq) || value.nextSeq < 1
+            || !Array.isArray(value.segments) || value.segments.length !== files.length
+            || value.segments.some((name, i) => name !== files[files.length - 1 - i])
+            || (value.failedGenerations !== undefined && (!Array.isArray(value.failedGenerations) || value.failedGenerations.length > 0)))
+            return;
+        return raw;
+    }
+    catch {
+        signal?.throwIfAborted();
+        return;
+    }
+}
 // Rotated segments never change, so their last cursor is reused until the file itself changes.
 const lastSeqs = new Map();
 /** The last event cursor in a segment, read from its tail; undefined when none is readable. */
@@ -72,6 +188,17 @@ async function lastSeq(path) {
  * `nextCursor` is the newest ledger position seen, for forward `after` paging.
  */
 export async function conversationTailPage(stateDir, request, snapshot, resumedSessionId, signal) {
+    try {
+        return await tailPage(stateDir, request, snapshot, resumedSessionId, signal, true);
+    }
+    catch (error) {
+        signal?.throwIfAborted();
+        if (!(error instanceof SeekFallback))
+            throw error;
+        return tailPage(stateDir, request, snapshot, resumedSessionId, signal, false);
+    }
+}
+async function tailPage(stateDir, request, snapshot, resumedSessionId, signal, allowSeek) {
     signal?.throwIfAborted();
     const before = request.before === undefined ? Infinity : Number(request.before);
     if (before !== Infinity && (!Number.isSafeInteger(before) || before < 0))
@@ -93,6 +220,11 @@ export async function conversationTailPage(stateDir, request, snapshot, resumedS
     // generation on every open. Legacy/incomplete snapshots still need context.
     const complete = !snapshot.observationFailure && Number.isSafeInteger(barrier) && barrier >= 0
         && Number.isSafeInteger(observation.stateRevision) && observation.stateRevision >= 0;
+    const dir = join(stateDir, '.conversation');
+    const manifest = allowSeek && before !== Infinity && complete && !snapshot.historyDegraded
+        ? await seekManifest(dir, files, signal) : undefined;
+    const seek = manifest === undefined ? undefined : { before, checked: [] };
+    let previousSeq = Infinity;
     const needsCapabilities = !complete || !Array.isArray(observation.commands);
     const pending = new Set(complete && Array.isArray(observation.pendingPermissions)
         && snapshot.pendingPermissionIds.every(id => observation.pendingPermissions.some(permission => permission.permissionId === id))
@@ -117,9 +249,16 @@ export async function conversationTailPage(stateDir, request, snapshot, resumedS
                 event = JSON.parse(line);
             }
             catch {
+                if (seek)
+                    throw new SeekFallback('unreadable page record');
                 return true;
             }
             const seq = Number(event.seq);
+            if (seek) {
+                if (event.schemaVersion !== 1 || !Number.isSafeInteger(seq) || seq <= 0 || seq >= previousSeq)
+                    throw new SeekFallback('non-monotonic page record');
+                previousSeq = seq;
+            }
             if (!Number.isSafeInteger(seq))
                 return true;
             if (barrier !== undefined && seq > barrier)
@@ -142,10 +281,22 @@ export async function conversationTailPage(stateDir, request, snapshot, resumedS
                     hasOlder = true;
             }
             return !hasOlder || wantsContext();
-        }, signal);
+        }, signal, seek);
         if (!more)
             break;
     }
+    if (seek) {
+        signal?.throwIfAborted();
+        const currentFiles = (await readdir(dir).catch(() => { throw new SeekFallback('ledger disappeared'); })).filter(n => /^events-\d{6}\.jsonl$/.test(n)).sort().reverse();
+        if (await seekManifest(dir, currentFiles, signal) !== manifest || currentFiles.join() !== files.join())
+            throw new SeekFallback('segments rotated during page');
+        for (const checked of seek.checked) {
+            signal?.throwIfAborted();
+            const current = await stat(checked.path).catch(() => undefined);
+            if (!current || stamp(current) !== checked.key)
+                throw new SeekFallback('segment replaced during page');
+        }
+    }
     events.reverse();
     context.reverse();
     return { events, snapshot, hasOlder, context, hasMore: false,

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "2.2.1",
-  "buildId": "31d6e72bc212",
-  "commit": "14d8f16953e773c6806d9df5661b8a4fe08af2b4",
+  "version": "2.2.3",
+  "buildId": "3ac91b025945",
+  "commit": "576470bf1cd528fb2d517d081358b3e5c667eea3",
   "dirty": false,
-  "builtAt": "2026-10-29T07:06:09.148Z",
+  "builtAt": "2026-10-29T08:13:26.500Z",
   "capabilities": [
     "service.refresh-v1",
     "managed-cli.codex-reasoning-effort-v1",

package/dist/rooms-tasks/task-review.d.ts

@@ -11,6 +11,10 @@ export declare class TaskReviewError extends Error {
 export declare function reviewArtifactMime(name: string): string;
 export declare function checkArtifactName(name: string): string;
 export declare function listTaskProgress(taskId: string): TaskProgressEntry[];
+/** Browser snapshot: entry bodies and their saved read state come from one task record. */
+export declare function taskProgressSnapshot(taskId: string): Array<Omit<TaskProgressEntry, 'request_key'> & {
+    unread: boolean;
+}>;
 /**
  * Append one milestone. Text is kept exactly as written; whitespace-only text is
  * rejected. A retry with the same author-scoped request_key returns the original

package/dist/rooms-tasks/task-review.js

@@ -73,6 +73,16 @@ export function listTaskProgress(taskId) {
     assertTaskId(taskId);
     return getTask(taskId).progress ?? [];
 }
+/** Browser snapshot: entry bodies and their saved read state come from one task record. */
+export function taskProgressSnapshot(taskId) {
+    assertTaskId(taskId);
+    const task = getTask(taskId);
+    const reads = task.contribution_reads;
+    const seen = new Set(reads?.progress_read);
+    return (task.progress ?? []).map(entry => ({
+        ...publicProgressEntry(entry), unread: !!reads && !seen.has(entry.id),
+    }));
+}
 /**
  * Append one milestone. Text is kept exactly as written; whitespace-only text is
  * rejected. A retry with the same author-scoped request_key returns the original

package/dist/web/resource-views.js

@@ -384,13 +384,15 @@ export class FleetResourceViews {
         // otherwise reserved for an independent task receipt.
         if (this.scope.configPath && resolve(path) === resolve(this.scope.configPath))
             return true;
-        // Adopted Codex history, telemetry and cache commits are not canonical
-        // Fleet preview inputs. Keep credentials, unknown paths and directory-level
-        // events conservative, and never override explicit config or role roots.
+        // These projections read role config/private status and conversation ledgers,
+        // not adopted Codex telemetry or this gateway's auth/audit bookkeeping. Those
+        // writes otherwise invalidate every in-flight directory capture on a busy host.
+        // Keep explicit config, declared role roots and unknown/ancestor wakes fenced.
         const roots = this.scope.roots ?? [agentsRoot(), tmpRoot()];
-        if (descriptor.resource === 'previews'
-            && /^(?:history\.jsonl|models_cache\.json|(?:thread_history|state|logs|queue|goals)_\d+\.sqlite(?:-wal|-shm|-journal)?)$/.test(relative(resolve(homedir(), '.codex'), path))
-            && !roots.some(root => { const local = relative(resolve(root), path); return local === '' || (local !== '..' && !local.startsWith('..' + sep)); }))
+        const roleProjection = ['directory', 'roles', 'previews'].includes(descriptor.resource);
+        const inRoleRoot = roots.some(root => { const local = relative(resolve(root), path); return local === '' || (local !== '..' && !local.startsWith('..' + sep)); });
+        if (roleProjection && !inRoleRoot && (/^(?:history\.jsonl|models_cache\.json|(?:thread_history|state|logs|queue|goals)_\d+\.sqlite(?:-wal|-shm|-journal)?)$/.test(relative(resolve(homedir(), '.codex'), path))
+            || /^(?:workspace-devices\.db(?:-wal|-shm|-journal)?|audit[/\\]audit\.jsonl)$/.test(relative(resolve(stateRoot(), 'web'), path))))
             return false;
         // Preview selection reads role config/state and conversation ledgers, never
         // task layout run/operation/brief receipts. A worker may commit several of

package/dist/web/server.js

@@ -27,7 +27,7 @@ import { FleetEventBus } from './events.js';
 import { ROLE_NAME_RE } from '../config.js';
 import { TaskListError } from '../rooms-tasks/task-lists.js';
 import { acknowledgeTaskProgress, acknowledgeTaskReview, contributionUnread, TaskStateError } from '../rooms-tasks/task-state.js';
-import { appendTaskProgress, getTaskReview, listTaskProgress, publicProgressEntry, publicReview, readTaskReviewArtifact, setTaskReviewMarkdown, taskContributionSummary, TaskReviewError, } from '../rooms-tasks/task-review.js';
+import { appendTaskProgress, getTaskReview, taskProgressSnapshot, publicProgressEntry, publicReview, readTaskReviewArtifact, setTaskReviewMarkdown, taskContributionSummary, TaskReviewError, } from '../rooms-tasks/task-review.js';
 import { isProvider } from '../subscriptions/store.js';
 const ONBOARDING_WORK = ['coordination', 'development', 'review'];
 const statusFor = (code) => ({
@@ -608,7 +608,7 @@ export async function buildWebServer(services, boundary, options = {}) {
     });
     app.get('/api/v1/tasks/:id/progress', async (request) => {
         auth.authenticate(request);
-        return { progress: (await reviewApi(() => listTaskProgress(request.params.id))).map(publicProgressEntry) };
+        return { progress: await reviewApi(() => taskProgressSnapshot(request.params.id)) };
     });
     app.post('/api/v1/tasks/:id/progress', async (request, reply) => {
         auth.authenticate(request, true);

package/docs/task-progress-review.md

@@ -4,7 +4,10 @@ Every task can carry two optional sections next to its description. Tasks create
 before this feature, or that never use it, have neither and behave as before.
 
 - **Progress** is an append-only, chronological milestone log: free-form text
-  entries, each with a stable ID, the time it was recorded and its author. It is
+  entries, each with a stable ID, the time it was recorded and its author. The
+  browser response also includes `unread` per entry from the same task snapshot,
+  based on persisted entry-ID acknowledgments. Legacy records without read state
+  report all existing entries as read; retry keys remain private. It is
   for significant verified milestones (root cause found, PR opened with its link,
   a measured result with its honest scope, final deliverable ready), not for room
   chat, routine status, handoffs or ordinary review rounds. Entries cannot be
@@ -99,7 +102,7 @@ workspace-device bearer. `GET /api/v1/meta` reports API minor version 1.
 | Route | Result |
 | --- | --- |
 | `GET /tasks`, `GET /tasks/:id` and other task payloads | `progress_count` and `review: {has_markdown, artifact_count, revision, updated_at?}`; `revision` grows with every package change (0 without a package). Bodies are not inlined. |
-| `GET /tasks/:id/progress` | `{progress: [{id, at, author, text}]}`, oldest first. |
+| `GET /tasks/:id/progress` | `{progress: [{id, at, author, text, unread}]}`, oldest first. |
 | `POST /tasks/:id/progress` | `{text, requestKey?}` (or an `Idempotency-Key` header): 201 new, 200 replay, 409 conflicting replay. |
 | `GET /tasks/:id/review` | `{review: {markdown, updated_at, updated_by, artifacts: [{id, name, mime, size, sha256, added_at, added_by}]}}` or `{review: null}`. |
 | `PUT /tasks/:id/review` | `{markdown, expectedMarkdown}`; 409 when the Markdown changed meanwhile. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "2.2.1",
+  "version": "2.2.3",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",