@ours.network/fleet 2.2.2 → 2.2.4

package/README.md

@@ -1863,6 +1863,8 @@ See [Room layouts](docs/room-layouts.md) for YAML examples and CLI commands.
 
 ### Dedicated notification service
 
+Task room notification registration is attempted before admitting the Owner. If registration fails, room admission and task work continue; unassociated room messages may arrive as ordinary notifications even when mission-room messages are off. Existing-room registration is attempted once per Fleet startup, without automatic registration retries. The installer configures the trusted Fleet producer's mission ownership permission automatically.
+
 Configure the web backend with `OURS_NOTIFICATIONS_ORIGIN` and a Fleet-scoped `OURS_NOTIFICATIONS_PRODUCER_TOKEN`. It reads each local supervisor ledger incrementally with persistent checkpoints under web state, correlating owner browser/channel prompts with terminal completion. Monitor/startup turns do not notify. First installation skips existing history; no agent restart or conversation controller is needed. Persist web state across deployment/restarts. Reads are bounded to 256 KiB per role per tick, and oversized model/media records are skipped across chunks. Expose `/notifications` through the generic authenticated prefix gateway with a server-side user token and `stripBrowserContext: true`; producer tokens stay server-side. All browser sessions of this single-owner console map to one stable notification account. See [ours-notifications](https://github.com/adapt-toolkit/ours-notifications) for configuration/API/release details.
 
 New agent notifications and confirmed role retirement use `/fleet/chats/agents/:roleId`, with each ID escaped once and matching message anchors retained. Deploy the app, notification service, and producers together: old query-based conversation links are intentionally unsupported. Existing pending payload URLs are replayed unchanged for idempotency; obsolete cleanup targets remain stored without being sent or treated as proof of absence. Task management notification paths are unchanged.

package/dist/application/conversation-history.js

@@ -7,39 +7,155 @@ const HISTORICAL_KINDS = ['file.attached', 'fleet.task_created', 'prompt.admitte
 export function conversationEventVisible(event, sessionGeneration, resumedSessionId) {
     return event.source !== 'agent_replay' && (event.sessionGeneration === sessionGeneration || (!!resumedSessionId && HISTORICAL_KINDS.includes(event.kind) && event.acpSessionId === resumedSessionId));
 }
-/** Newest-first lines of a file, read in chunks from its end; `visit` returns false to stop. */
-async function readLinesBackward(path, visit, signal) {
+// A seek attempt is transactional: its caller discards all collected rows and
+// performs one ordinary scan if a probe or the file identity is no longer safe.
+class SeekFallback extends Error {
+}
+const stamp = (info) => `${info.dev}:${info.ino}:${info.size}:${info.mtimeMs}:${info.ctimeMs}`;
+/** Strict lower bound in an admitted monotonic writer segment, on this FD only. */
+async function seekBefore(file, size, before, signal) {
+    const read = async (position, length) => {
+        signal?.throwIfAborted();
+        const bytes = Buffer.alloc(length);
+        const { bytesRead } = await file.read(bytes, 0, length, position);
+        signal?.throwIfAborted();
+        if (bytesRead !== length)
+            throw new SeekFallback('segment changed during seek');
+        return bytes;
+    };
+    if (!size)
+        return 0;
+    // An active partial append is not a safe boundary, even if the first event
+    // would let us skip this whole segment.
+    if ((await read(size - 1, 1))[0] !== 10)
+        throw new SeekFallback('partial segment');
+    const record = async (position) => {
+        let start = position, end = position;
+        const left = [], right = [];
+        while (start > 0) {
+            const length = Math.min(4096, start), chunk = await read(start - length, length);
+            const newline = chunk.lastIndexOf(10);
+            left.push(chunk.subarray(newline + 1));
+            start -= length;
+            if (newline >= 0) {
+                start += newline + 1;
+                break;
+            }
+        }
+        while (end < size) {
+            const chunk = await read(end, Math.min(4096, size - end)), newline = chunk.indexOf(10);
+            right.push(newline < 0 ? chunk : chunk.subarray(0, newline));
+            end += newline < 0 ? chunk.length : newline + 1;
+            if (newline >= 0)
+                break;
+        }
+        let event;
+        try {
+            event = JSON.parse(Buffer.concat([...left.reverse(), ...right]).toString('utf8'));
+        }
+        catch {
+            throw new SeekFallback('unreadable seek record');
+        }
+        if (!event || event.schemaVersion !== 1 || !Number.isSafeInteger(event.seq) || event.seq <= 0)
+            throw new SeekFallback('legacy seek record');
+        return { start, end, seq: event.seq };
+    };
+    const first = await record(0);
+    if (first.seq >= before)
+        return 0;
+    let low = first.end, high = size, lower = first.seq, upper = Infinity;
+    while (low < high) {
+        const found = await record(Math.floor((low + high) / 2));
+        if (found.start < low || found.end > high || found.seq <= lower || found.seq >= upper)
+            throw new SeekFallback('non-monotonic seek record');
+        if (found.seq < before) {
+            low = found.end;
+            lower = found.seq;
+        }
+        else {
+            high = found.start;
+            upper = found.seq;
+        }
+    }
+    return low;
+}
+/** Newest-first lines; optional finite-before seek is only for a healthy writer. */
+async function readLinesBackward(path, visit, signal, seek) {
     signal?.throwIfAborted();
-    const file = await open(path, 'r');
+    let file;
+    try {
+        file = await open(path, 'r');
+    }
+    catch (error) {
+        signal?.throwIfAborted();
+        if (seek)
+            throw new SeekFallback('segment disappeared');
+        throw error;
+    }
     try {
-        let position = (await file.stat()).size;
-        let carry = Buffer.alloc(0);
-        while (position > 0) {
+        const initial = await file.stat(), key = stamp(initial);
+        let position = seek ? await seekBefore(file, initial.size, seek.before, signal) : initial.size;
+        let carry = Buffer.alloc(0), more = true;
+        scan: while (position > 0) {
             signal?.throwIfAborted();
             const size = Math.min(256 * 1024, position);
             position -= size;
             const chunk = Buffer.alloc(size);
-            await file.read(chunk, 0, size, position);
+            const { bytesRead } = await file.read(chunk, 0, size, position);
             signal?.throwIfAborted();
-            let buffer = Buffer.concat([chunk, carry]);
+            if (seek && bytesRead !== size)
+                throw new SeekFallback('short segment read');
+            const buffer = Buffer.concat([chunk.subarray(0, bytesRead), carry]);
             let end = buffer.length;
             for (let i = buffer.length - 1; i >= 0; i--) {
                 if (buffer[i] !== 10)
                     continue;
-                if (end > i + 1 && !visit(buffer.toString('utf8', i + 1, end)))
-                    return false;
+                if (end > i + 1 && !visit(buffer.toString('utf8', i + 1, end))) {
+                    more = false;
+                    break scan;
+                }
                 end = i;
             }
             carry = buffer.subarray(0, end);
         }
-        if (carry.length && !visit(carry.toString('utf8')))
-            return false;
-        return true;
+        if (more && carry.length && !visit(carry.toString('utf8')))
+            more = false;
+        if (seek) {
+            signal?.throwIfAborted();
+            const current = await stat(path).catch(() => undefined);
+            if (stamp(await file.stat()) !== key || !current || stamp(current) !== key)
+                throw new SeekFallback('segment changed during read');
+            seek.checked.push({ path, key });
+        }
+        return more;
+    }
+    catch (error) {
+        signal?.throwIfAborted();
+        if (seek && !(error instanceof SeekFallback))
+            throw new SeekFallback('seek read unavailable');
+        throw error;
     }
     finally {
         await file.close();
     }
 }
+/** Existing writer provenance, never a substitute for the captured barrier. */
+async function seekManifest(dir, files, signal) {
+    try {
+        signal?.throwIfAborted();
+        const raw = await readFile(join(dir, 'manifest.json'), { encoding: 'utf8', signal }), value = JSON.parse(raw);
+        if (value.schemaVersion !== 1 || !Number.isSafeInteger(value.nextSeq) || value.nextSeq < 1
+            || !Array.isArray(value.segments) || value.segments.length !== files.length
+            || value.segments.some((name, i) => name !== files[files.length - 1 - i])
+            || (value.failedGenerations !== undefined && (!Array.isArray(value.failedGenerations) || value.failedGenerations.length > 0)))
+            return;
+        return raw;
+    }
+    catch {
+        signal?.throwIfAborted();
+        return;
+    }
+}
 // Rotated segments never change, so their last cursor is reused until the file itself changes.
 const lastSeqs = new Map();
 /** The last event cursor in a segment, read from its tail; undefined when none is readable. */
@@ -72,6 +188,17 @@ async function lastSeq(path) {
  * `nextCursor` is the newest ledger position seen, for forward `after` paging.
  */
 export async function conversationTailPage(stateDir, request, snapshot, resumedSessionId, signal) {
+    try {
+        return await tailPage(stateDir, request, snapshot, resumedSessionId, signal, true);
+    }
+    catch (error) {
+        signal?.throwIfAborted();
+        if (!(error instanceof SeekFallback))
+            throw error;
+        return tailPage(stateDir, request, snapshot, resumedSessionId, signal, false);
+    }
+}
+async function tailPage(stateDir, request, snapshot, resumedSessionId, signal, allowSeek) {
     signal?.throwIfAborted();
     const before = request.before === undefined ? Infinity : Number(request.before);
     if (before !== Infinity && (!Number.isSafeInteger(before) || before < 0))
@@ -93,6 +220,11 @@ export async function conversationTailPage(stateDir, request, snapshot, resumedS
     // generation on every open. Legacy/incomplete snapshots still need context.
     const complete = !snapshot.observationFailure && Number.isSafeInteger(barrier) && barrier >= 0
         && Number.isSafeInteger(observation.stateRevision) && observation.stateRevision >= 0;
+    const dir = join(stateDir, '.conversation');
+    const manifest = allowSeek && before !== Infinity && complete && !snapshot.historyDegraded
+        ? await seekManifest(dir, files, signal) : undefined;
+    const seek = manifest === undefined ? undefined : { before, checked: [] };
+    let previousSeq = Infinity;
     const needsCapabilities = !complete || !Array.isArray(observation.commands);
     const pending = new Set(complete && Array.isArray(observation.pendingPermissions)
         && snapshot.pendingPermissionIds.every(id => observation.pendingPermissions.some(permission => permission.permissionId === id))
@@ -117,9 +249,16 @@ export async function conversationTailPage(stateDir, request, snapshot, resumedS
                 event = JSON.parse(line);
             }
             catch {
+                if (seek)
+                    throw new SeekFallback('unreadable page record');
                 return true;
             }
             const seq = Number(event.seq);
+            if (seek) {
+                if (event.schemaVersion !== 1 || !Number.isSafeInteger(seq) || seq <= 0 || seq >= previousSeq)
+                    throw new SeekFallback('non-monotonic page record');
+                previousSeq = seq;
+            }
             if (!Number.isSafeInteger(seq))
                 return true;
             if (barrier !== undefined && seq > barrier)
@@ -142,10 +281,22 @@ export async function conversationTailPage(stateDir, request, snapshot, resumedS
                     hasOlder = true;
             }
             return !hasOlder || wantsContext();
-        }, signal);
+        }, signal, seek);
         if (!more)
             break;
     }
+    if (seek) {
+        signal?.throwIfAborted();
+        const currentFiles = (await readdir(dir).catch(() => { throw new SeekFallback('ledger disappeared'); })).filter(n => /^events-\d{6}\.jsonl$/.test(n)).sort().reverse();
+        if (await seekManifest(dir, currentFiles, signal) !== manifest || currentFiles.join() !== files.join())
+            throw new SeekFallback('segments rotated during page');
+        for (const checked of seek.checked) {
+            signal?.throwIfAborted();
+            const current = await stat(checked.path).catch(() => undefined);
+            if (!current || stamp(current) !== checked.key)
+                throw new SeekFallback('segment replaced during page');
+        }
+    }
     events.reverse();
     context.reverse();
     return { events, snapshot, hasOlder, context, hasMore: false,

package/dist/application/task-room-service.d.ts

@@ -328,8 +328,8 @@ export declare class TaskRoomApplicationService {
         taskId: string;
     }): Promise<TaskProvisioningContinuationResult>;
     /**
-     * Before the Owner can join, register the room as this task's with the notification service, so own-room message
-     * preferences apply to its first message. An unreachable service stops here and the saga retries from this step.
+     * Attempt registration before the Owner joins. A notification failure must not become a room saga error:
+     * admission continues and unassociated room messages may arrive as ordinary notifications.
      */
     private associateRoomNotifications;
     private setOwnerRoomCommands;

package/dist/application/task-room-service.js

@@ -707,8 +707,8 @@ export class TaskRoomApplicationService {
         }
     }
     /**
-     * Before the Owner can join, register the room as this task's with the notification service, so own-room message
-     * preferences apply to its first message. An unreachable service stops here and the saga retries from this step.
+     * Attempt registration before the Owner joins. A notification failure must not become a room saga error:
+     * admission continues and unassociated room messages may arrive as ordinary notifications.
      */
     async associateRoomNotifications(room) {
         if (!room.task_id || !room.room_identity_cid)
@@ -716,9 +716,8 @@ export class TaskRoomApplicationService {
         try {
             await (this.deps.associateRoomNotifications ?? associateRoomNotifications)(room.task_id, room.room_identity_cid);
         }
-        catch (error) {
-            setSagaError(room.room_id, error instanceof Error ? error.message : String(error), `Start or repair the notification service, then run ours-fleet task start ${room.task_id}.`, 'waiting_cowork');
-            throw error;
+        catch {
+            console.warn('Mission room notification registration failed; continuing room admission with ordinary notifications');
         }
     }
     async setOwnerRoomCommands(cowork, roomId, role) {

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "2.2.2",
-  "buildId": "b0c5de2e0887",
-  "commit": "ebe447505d63119b299e3619d12a6399f1e2e49f",
+  "version": "2.2.4",
+  "buildId": "009d1f631eac",
+  "commit": "ed07f55a29a98edfbcadccb5ebc07fccaa24adae",
   "dirty": false,
-  "builtAt": "2026-10-29T07:51:29.222Z",
+  "builtAt": "2026-10-29T09:19:37.374Z",
   "capabilities": [
     "service.refresh-v1",
     "managed-cli.codex-reasoning-effort-v1",

package/dist/notifications/mission-ownership.d.ts

@@ -10,10 +10,9 @@ export declare function missionRequest(config: ProducerConfig, path: string, bod
     data: any;
 }>;
 /**
- * Register a room as this task's before the Owner can join it: with own-room messages off, the service must know
- * the room before the room can message the Owner. Unreachable service or unconfirmed coverage → throws, so room
- * activation waits and retries. No producer configured → nothing to gate. An older service without the route →
- * admitted with a warning (it cannot suppress own-room messages either).
+ * Attempt to register the task room before the Owner joins, so preferences apply from its first message when confirmed.
+ * Unreachable service or unconfirmed coverage throws to the caller, which continues admission with ordinary notifications.
+ * No producer configured → nothing to register. An older service without the route returns with a warning.
  */
 export declare function associateRoomNotifications(taskId: string, roomCid: string, options?: {
     config?: ProducerConfig | undefined;

package/dist/notifications/mission-ownership.js

@@ -47,10 +47,9 @@ async function registerMission(config, taskId, manifest, request) {
     throw new MissionOwnershipUnavailable(`notification service refused room registration (HTTP ${status})`);
 }
 /**
- * Register a room as this task's before the Owner can join it: with own-room messages off, the service must know
- * the room before the room can message the Owner. Unreachable service or unconfirmed coverage → throws, so room
- * activation waits and retries. No producer configured → nothing to gate. An older service without the route →
- * admitted with a warning (it cannot suppress own-room messages either).
+ * Attempt to register the task room before the Owner joins, so preferences apply from its first message when confirmed.
+ * Unreachable service or unconfirmed coverage throws to the caller, which continues admission with ordinary notifications.
+ * No producer configured → nothing to register. An older service without the route returns with a warning.
  */
 export async function associateRoomNotifications(taskId, roomCid, options = {}) {
     const manifest = recordNotificationRooms(taskId, [roomCid]);
@@ -66,7 +65,7 @@ export async function associateRoomNotifications(taskId, roomCid, options = {})
             return;
         }
         if (error instanceof MissionOwnershipUnavailable)
-            throw new Error('Waiting for notification service to register the mission room');
+            throw new Error('Notification service did not register the mission room');
         throw error;
     }
 }

package/dist/notifications/task-producer.d.ts

@@ -15,8 +15,7 @@ export declare class TaskNotificationProducer {
     private offset;
     private stopped;
     private readonly shutdown;
-    private bootstrapped;
-    private bootstrapAt;
+    private bootstrapAttempted;
     constructor(config: ProducerConfig, warn?: (line: string) => void, request?: typeof fetch, 
     /** Existing tasks and their layout room CIDs, registered once per start before own-room OFF can be chosen. */
     missions?: {

package/dist/notifications/task-producer.js

@@ -16,8 +16,7 @@ export class TaskNotificationProducer {
     offset = 0;
     stopped = false;
     shutdown = new AbortController();
-    bootstrapped = false;
-    bootstrapAt = 0;
+    bootstrapAttempted = false;
     constructor(config, warn = () => { }, request = fetch, 
     /** Existing tasks and their layout room CIDs, registered once per start before own-room OFF can be chosen. */
     missions) {
@@ -68,21 +67,14 @@ export class TaskNotificationProducer {
         // Deletion first: a retired task's notifications go before any other delivery work in this pass.
         if (convertRetiredTaskNotifications() || await drainMissionCleanup(this.config, this.warn, this.request))
             this.retry();
-        if (this.missions && !this.bootstrapped && !this.stopped) {
-            // A failed run waits 30s: unavailable inventory or a refused registration needs repair, not a tight loop.
-            const wait = this.bootstrapAt - Date.now();
-            if (wait > 0)
-                this.retry(wait);
-            else {
-                try {
-                    await bootstrapMissionRooms(this.config, this.missions.tasks, this.missions.layoutRooms, this.request);
-                    this.bootstrapped = true;
-                }
-                catch {
-                    this.warn('Mission room registration pending; own-room message preference stays unavailable');
-                    this.bootstrapAt = Date.now() + 30_000;
-                    this.retry(30_000);
-                }
+        if (this.missions && !this.bootstrapAttempted && !this.stopped) {
+            // One startup attempt. Association failure neither blocks task events nor schedules another registration.
+            this.bootstrapAttempted = true;
+            try {
+                await bootstrapMissionRooms(this.config, this.missions.tasks, this.missions.layoutRooms, this.request);
+            }
+            catch {
+                this.warn('Mission room registration failed; own-room message preference may be unavailable');
             }
         }
         const pending = pendingTaskNotifications(this.warn);

package/dist/rooms-tasks/layout-service.d.ts

@@ -30,7 +30,7 @@ export declare class RoomLayoutService {
     supervisor(id?: string, templates?: Record<string, AgentTemplateDefinition>): NativeLayoutSupervisor;
     private owner;
     private engine;
-    /** A task's layout rooms are registered with the notification service before the Owner can join them. */
+    /** A task's layout rooms attempt notification registration before Owner admission. */
     private beforeOwner;
     open(id: string, cleanup?: boolean): RoomLayout;
     /** `scope` lets an owner (e.g. a Task) snapshot an adjusted definition and pin agent working directories. */

package/dist/rooms-tasks/layout-service.js

@@ -180,7 +180,7 @@ export class RoomLayoutService {
             assertLayoutFile(path);
         return new RoomLayout(path, () => createCoworkAdapter(), this.supervisor(id), cleanup ? undefined : this.owner(), this.beforeOwner(id));
     }
-    /** A task's layout rooms are registered with the notification service before the Owner can join them. */
+    /** A task's layout rooms attempt notification registration before Owner admission. */
     beforeOwner(id) {
         const taskId = /^task-([0-9a-z]{9}[0-9a-f]{8})$/.exec(id)?.[1];
         return taskId ? async (roomCid) => (await import('../notifications/mission-ownership.js')).associateRoomNotifications(taskId, roomCid) : undefined;

package/dist/rooms-tasks/layout.d.ts

@@ -104,12 +104,12 @@ export declare class RoomLayout {
     private file;
     private supervisor;
     private owner?;
-    /** Runs before the Owner may join each room; a failure stops here and the next pass retries it. */
+    /** Best-effort notification registration before the Owner joins each room. */
     private beforeOwner?;
     private coworkAdapter?;
     private readonly coworkFactory;
     constructor(file: string, cowork: CoworkAdapter | (() => CoworkAdapter), supervisor: LayoutSupervisor, owner?: LayoutOwner | undefined, 
-    /** Runs before the Owner may join each room; a failure stops here and the next pass retries it. */
+    /** Best-effort notification registration before the Owner joins each room. */
     beforeOwner?: ((roomCid: string) => Promise<void>) | undefined);
     private get cowork();
     snapshot(): RoomLayoutState;

package/dist/rooms-tasks/layout.js

@@ -43,7 +43,7 @@ export class RoomLayout {
     coworkAdapter;
     coworkFactory;
     constructor(file, cowork, supervisor, owner, 
-    /** Runs before the Owner may join each room; a failure stops here and the next pass retries it. */
+    /** Best-effort notification registration before the Owner joins each room. */
     beforeOwner) {
         this.file = file;
         this.supervisor = supervisor;
@@ -165,8 +165,14 @@ export class RoomLayout {
                 activation_requirements: !spec.members.length && s.owner ? [{ role: s.owner.role, count: 1 }]
                     : [...new Set(spec.members.map(roleFor))].map(role => ({ role, count: spec.members.filter(m => roleFor(m) === role).length })),
             }), native => { room.native = native; s.order.push(key); });
-        if (s.owner && !room.owner_ready && this.beforeOwner)
-            await this.beforeOwner(room.native.identity_cid);
+        if (s.owner && !room.owner_ready && this.beforeOwner) {
+            try {
+                await this.beforeOwner(room.native.identity_cid);
+            }
+            catch {
+                console.warn('Mission room notification registration failed; continuing room admission with ordinary notifications');
+            }
+        }
         if (s.owner && !room.owner_ready)
             await this.mutation(s, `owner:${key}`, async () => {
                 await this.cowork.acceptInvite(room.native.room_id, this.owner.invite, { role: s.owner.role, expected_cid: s.owner.cid });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "2.2.2",
+  "version": "2.2.4",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",