@ours.network/fleet 2.3.1 → 2.3.2

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "2.3.1",
-  "buildId": "2fbb7f11f70a",
-  "commit": "f7b1dda8a2cb911367ce11617ef38759ba78c5e6",
+  "version": "2.3.2",
+  "buildId": "597fdbc5f69f",
+  "commit": "31b6aae8610ef1e4d74212cb06d9b03379a8eb40",
   "dirty": false,
-  "builtAt": "2026-10-30T19:03:10.573Z",
+  "builtAt": "2026-10-31T06:49:15.117Z",
   "capabilities": [
     "service.refresh-v1",
     "managed-cli.codex-reasoning-effort-v1",

package/dist/rooms-tasks/task-state.js

@@ -179,7 +179,7 @@ function writeTask(record, options = {}) {
             const next = status(record), before = previous ? status(previous) : undefined;
             pending.push({ eventId: `task:${record.task_id}:${randomUUID()}`, taskId: record.task_id,
                 title: `Task ${!previous ? 'created' : 'updated'}: ${taskLabel(record)}`.slice(0, 160),
-                body: `Task ${record.task_id}: ${before ? `${before} → ` : 'created in '}${next}.`,
+                body: taskSentence(record, `${before ? `${before} → ` : 'created in '}${next}.`),
                 target: { kind: 'task', taskId: record.task_id }, delivery: 'push-only' });
         }
         pending.push(...contributionEvents(previous, record));
@@ -196,6 +196,11 @@ function writeTask(record, options = {}) {
 }
 /** Human label for notification titles: the mission key, when issued, precedes the title. */
 const taskLabel = (record) => record.key ? `${record.key} · ${record.title}` : record.title;
+/**
+ * Notification body naming the task by its mission key. The opaque task ID stays in routing and
+ * event fields only; a task without a key relies on its title, which the notification title shows.
+ */
+const taskSentence = (record, text) => record.key ? `Task ${record.key}: ${text}` : text[0].toUpperCase() + text.slice(1);
 /** Packages written before revisions existed count as revision 1; their next change becomes 2. No package is 0. */
 export const reviewRevision = (review) => review ? review.revision ?? 1 : 0;
 const contributionsChanged = (previous, record) => (record.progress ?? []).some(entry => !(previous.progress ?? []).some(old => old.id === entry.id))
@@ -214,7 +219,7 @@ function contributionEvents(previous, record) {
     const revision = reviewRevision(record.review);
     if (revision > reviewRevision(previous.review))
         events.push({ eventId: `task:${id}:review:${revision}`, taskId: id, title: `To review updated: ${taskLabel(record)}`.slice(0, 160),
-            body: `Task ${id}: the review package changed.`, target: { kind: 'task', taskId: id }, delivery: 'push-only' });
+            body: taskSentence(record, 'the review package changed.'), target: { kind: 'task', taskId: id }, delivery: 'push-only' });
     return events;
 }
 /** Item-based Progress unread and revision-based To review unread. An absent read state means nothing is unread. */

package/dist/web/fleet-config-service.d.ts

@@ -50,6 +50,14 @@ export declare class FleetConfigService {
     private validationInputs;
     /** Cached during canonical reads; observer filtering must never parse YAML. */
     resourceValidationInputs(): readonly string[];
+    /**
+     * Record the manifest's external file references before a projection that loads
+     * the configuration, so a reference anywhere (including a task workspace) fences
+     * that capture even before the configuration itself has been read. A manifest that
+     * cannot be read keeps the last recorded inputs; the projection reports its error.
+     */
+    observeValidationInputs(): void;
+    private recordValidationInputs;
     constructor(options?: FleetConfigServiceOptions);
     read(includeDefinitions?: boolean): ConfigReadResult;
     preview(baseRevision: string, input: unknown): Promise<ConfigPreviewResult>;

package/dist/web/fleet-config-service.js

@@ -21,6 +21,28 @@ export class FleetConfigService {
     validationInputs = [];
     /** Cached during canonical reads; observer filtering must never parse YAML. */
     resourceValidationInputs() { return this.validationInputs; }
+    /**
+     * Record the manifest's external file references before a projection that loads
+     * the configuration, so a reference anywhere (including a task workspace) fences
+     * that capture even before the configuration itself has been read. A manifest that
+     * cannot be read keeps the last recorded inputs; the projection reports its error.
+     */
+    observeValidationInputs() {
+        try {
+            this.recordValidationInputs(parse(trustedFile(this.path), { prettyErrors: false }));
+        }
+        catch { /* unchanged */ }
+    }
+    recordValidationInputs(parsed) {
+        const record = (value) => value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+        const manifest = record(parsed);
+        const vars = record(manifest.vars);
+        const expand = (value) => value.replace(/\$\{(\w+)\}/g, (match, key) => key in vars ? String(vars[key]) : match);
+        const invite = record(record(manifest.rooms).owner).public_invite_file;
+        const prompts = Object.values(record(manifest.watchdogs)).map(value => record(value).prompt_file);
+        this.validationInputs = [...(typeof invite === 'string' ? [expand(expand(invite))] : []),
+            ...prompts.filter((value) => typeof value === 'string').map(expand)].map(value => resolve(value));
+    }
     constructor(options = {}) {
         this.path = options.configPath ?? defaultConfigPath();
         this.preflight = options.preflight ?? (async () => emptyReport());
@@ -30,16 +52,9 @@ export class FleetConfigService {
         const sources = readSources(this.path);
         let raw;
         try {
-            const manifest = parse(sources.documents.get(basename(sources.manifest)), { prettyErrors: false });
-            const record = (value) => value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-            const vars = record(manifest.vars);
-            const expand = (value) => value.replace(/\$\{(\w+)\}/g, (match, key) => key in vars ? String(vars[key]) : match);
-            const invite = record(record(manifest.rooms).owner).public_invite_file;
-            const prompts = Object.values(record(manifest.watchdogs)).map(value => record(value).prompt_file);
             // Record even invalid/missing references before validation, so repairing an
             // already observed dependency can never retain a certified stale capture.
-            this.validationInputs = [...(typeof invite === 'string' ? [expand(expand(invite))] : []),
-                ...prompts.filter((value) => typeof value === 'string').map(expand)].map(value => resolve(value));
+            this.recordValidationInputs(parse(sources.documents.get(basename(sources.manifest)), { prettyErrors: false }));
             loadConfig(this.path, { yamlMode: 'strict' });
             raw = modelFrom(sources, includeDefinitions);
         }

package/dist/web/resource-views.d.ts

@@ -135,6 +135,8 @@ export declare class FleetResourceViews {
     private coverage;
     /** Certify each view's last projected source; never a position its capture did not read. */
     private cover;
+    /** Whether `path` is, contains or lies within the manifest, its split definitions or another configuration input. */
+    private configurationDependency;
     private affects;
     private schedule;
     private refresh;

package/dist/web/resource-views.js

@@ -364,22 +364,25 @@ export class FleetResourceViews {
             view.qualifiedAt = now;
         } });
     }
+    /** Whether `path` is, contains or lies within the manifest, its split definitions or another configuration input. */
+    configurationDependency(path) {
+        const manifest = resolve(this.scope.configPath ?? defaultConfigPath());
+        const root = resolve(splitRootFor(manifest)), changed = resolve(path);
+        const within = (candidate, parent) => {
+            const local = relative(parent, candidate);
+            return local === '' || (local !== '..' && !local.startsWith('..' + sep));
+        };
+        // Configuration and provenance read the manifest and split definitions;
+        // loadConfig also rejects legacy YAML files in the global fleet.d root.
+        // Ancestor replacement/unknown directory wakes remain conservative.
+        const legacy = resolve(fleetDDir());
+        return within(changed, root) || within(root, changed) || within(manifest, changed)
+            || within(changed, legacy) || within(legacy, changed)
+            || this.configurationInputs().some(input => within(resolve(input), changed));
+    }
     affects(descriptor, path, structural = false) {
-        if (descriptor.resource === 'configuration') {
-            const manifest = resolve(this.scope.configPath ?? defaultConfigPath());
-            const root = resolve(splitRootFor(manifest)), changed = resolve(path);
-            const within = (candidate, parent) => {
-                const local = relative(parent, candidate);
-                return local === '' || (local !== '..' && !local.startsWith('..' + sep));
-            };
-            // Configuration and provenance read the manifest and split definitions;
-            // loadConfig also rejects legacy YAML files in the global fleet.d root.
-            // Ancestor replacement/unknown directory wakes remain conservative.
-            const legacy = resolve(fleetDDir());
-            return within(changed, root) || within(root, changed) || within(manifest, changed)
-                || within(changed, legacy) || within(legacy, changed)
-                || this.configurationInputs().some(input => within(resolve(input), changed));
-        }
+        if (descriptor.resource === 'configuration')
+            return this.configurationDependency(path);
         // An explicitly selected manifest may use any pathname, including one
         // otherwise reserved for an independent task receipt.
         if (this.scope.configPath && resolve(path) === resolve(this.scope.configPath))
@@ -394,6 +397,14 @@ export class FleetResourceViews {
         if (roleProjection && !inRoleRoot && (/^(?:history\.jsonl|models_cache\.json|(?:thread_history|state|logs|queue|goals)_\d+\.sqlite(?:-wal|-shm|-journal)?)$/.test(relative(resolve(homedir(), '.codex'), path))
             || /^(?:workspace-devices\.db(?:-wal|-shm|-journal)?|audit[/\\]audit\.jsonl)$/.test(relative(resolve(stateRoot(), 'web'), path))))
             return false;
+        // Task and room workspaces hold their agents' own execution artifacts (checkouts,
+        // builds, test logs); role projections read nothing there except declared role
+        // roots and configuration (manifest, split definitions), which stay fenced. Working
+        // agents write there continuously, which otherwise fences every directory capture
+        // until it resyncs. The workspace directories themselves and their ancestors remain full wakes.
+        if (roleProjection && !inRoleRoot && /^(?:tasks|rooms)[/\\][^/\\]+[/\\]/.test(relative(resolve(stateRoot(), 'workspaces'), path))
+            && !this.configurationDependency(path))
+            return false;
         // Preview selection reads role config/state and conversation ledgers, never
         // task layout run/operation/brief receipts. A worker may commit several of
         // these while that independent canonical preview read is in flight.

package/dist/web/server.js

@@ -424,6 +424,9 @@ export async function buildWebServer(services, boundary, options = {}) {
     const project = async (descriptor, signal, owner = '') => {
         signal.throwIfAborted();
         services.invalidateResourceCaches?.();
+        // Role projections load the configuration: fence this capture on its external inputs too.
+        if (['directory', 'roles', 'previews'].includes(descriptor.resource))
+            services.configuration?.observeValidationInputs();
         switch (descriptor.resource) {
             case 'task-layout':
                 try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",