@ours.network/fleet 2.3.1 → 2.4.0-nightly.1

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "2.3.1",
-  "buildId": "2fbb7f11f70a",
-  "commit": "f7b1dda8a2cb911367ce11617ef38759ba78c5e6",
-  "dirty": false,
-  "builtAt": "2026-10-30T19:03:10.573Z",
+  "version": "2.4.0-nightly.1",
+  "buildId": "232666d8f084",
+  "commit": "c2a3010a2fd1eef69057a1c262a9bbb1c425be9f",
+  "dirty": true,
+  "builtAt": "2026-11-03T10:02:13.389Z",
   "capabilities": [
     "service.refresh-v1",
     "managed-cli.codex-reasoning-effort-v1",

package/dist/channels/identity-reads.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Minimal HTTP adapter for the daemon's lease-free identity reads
+ * (`GET /identities/<name>/contacts-activity|history`, ours-sdk
+ * docs/identity-reads.md). Kept local so Fleet does not need a newer SDK client;
+ * the shapes are the daemon contract verbatim. The ordinary workspace client
+ * credential is reread on every request. No identity is ever bound.
+ */
+export interface IdentityRef {
+    identity: string;
+    expectedCid: string;
+    expectedProducerGeneration?: string;
+}
+export interface SourcePosition {
+    protocolVersion: 1;
+    producerGeneration: string;
+    position: number;
+}
+export interface ContactRootClaim {
+    root_cid: string;
+    root_name: string;
+    role_id: string;
+}
+export interface ContactsActivity {
+    identity: {
+        name: string;
+        cid: string;
+    };
+    source: SourcePosition;
+    contacts: Array<{
+        name: string;
+        container_id: string;
+    }>;
+    roots: Record<string, ContactRootClaim>;
+    activity: Record<string, {
+        at: string;
+    } | {
+        unavailable: true;
+    }>;
+}
+export interface IdentityHistoryPage {
+    identity: {
+        name: string;
+        cid: string;
+    };
+    source: SourcePosition;
+    items: Array<Record<string, unknown> & {
+        seq: number;
+        wire_id: string;
+    }>;
+    next_cursor: number | null;
+}
+export declare class IdentityReadError extends Error {
+    readonly status: number;
+    readonly code: string | undefined;
+    constructor(status: number, code: string | undefined, message: string);
+}
+export interface IdentityReader {
+    contactsActivity(ref: IdentityRef, signal?: AbortSignal): Promise<ContactsActivity>;
+    history(ref: IdentityRef & {
+        peer_cid: string;
+        before_seq?: number;
+        limit?: number;
+    }, signal?: AbortSignal): Promise<IdentityHistoryPage>;
+}
+export declare function createIdentityReader(options: {
+    endpoint: string;
+    credentialPath: string;
+    fetchImpl?: typeof fetch;
+}): IdentityReader;

package/dist/channels/identity-reads.js

@@ -0,0 +1,47 @@
+import { readPrivateFile } from '@ours.network/sdk/connector';
+export class IdentityReadError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+export function createIdentityReader(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const base = options.endpoint.replace(/\/+$/, '');
+    async function get(name, kind, query, signal) {
+        const params = new URLSearchParams();
+        for (const [key, value] of Object.entries(query))
+            if (value !== undefined)
+                params.set(key, String(value));
+        const response = await fetchImpl(`${base}/identities/${encodeURIComponent(name)}/${kind}?${params}`, {
+            redirect: 'error',
+            signal: signal ?? AbortSignal.timeout(15_000),
+            headers: { 'x-ours-api-token': readPrivateFile(options.credentialPath, 4096).toString('utf8').trim() },
+        });
+        let json;
+        try {
+            json = await response.json();
+        }
+        catch {
+            throw new IdentityReadError(response.status, undefined, `${kind}: non-JSON response (HTTP ${response.status})`);
+        }
+        if (response.ok)
+            return json;
+        const error = json?.error;
+        if (error && typeof error === 'object') {
+            const { code, message } = error;
+            throw new IdentityReadError(response.status, typeof code === 'string' ? code : undefined, `${kind}: ${String(message ?? code)}`);
+        }
+        throw new IdentityReadError(response.status, undefined, `${kind}: ${String(error ?? `HTTP ${response.status}`)}`);
+    }
+    return {
+        contactsActivity: (ref, signal) => get(ref.identity, 'contacts-activity', { expectedCid: ref.expectedCid, expectedProducerGeneration: ref.expectedProducerGeneration }, signal),
+        history: (ref, signal) => get(ref.identity, 'history', {
+            peer_cid: ref.peer_cid, before_seq: ref.before_seq, limit: ref.limit,
+            expectedCid: ref.expectedCid, expectedProducerGeneration: ref.expectedProducerGeneration,
+        }, signal),
+    };
+}

package/dist/channels/indexer.d.ts

@@ -0,0 +1,55 @@
+import { type ContactsActivity, type IdentityReader } from './identity-reads.js';
+import { type ChannelSources } from './sources.js';
+import type { ChannelEdge, ChannelsStore } from './store.js';
+export interface ResourceFrame {
+    kind: string;
+    producerGeneration: string;
+    position: number;
+}
+export interface ResourceEventSource {
+    resourceEvents(identity: string, options: {
+        signal: AbortSignal;
+        expectedGeneration?: string;
+        after?: number;
+    }): AsyncIterable<ResourceFrame>;
+}
+export interface ChannelsIndexerDeps {
+    store: ChannelsStore;
+    reader: IdentityReader;
+    events: ResourceEventSource;
+    discover(): Promise<ChannelSources>;
+    onChange(): void;
+    log(message: string): void;
+    debounceMs?: number;
+}
+/**
+ * Event-driven Channels projection. One passive resource-event stream per live
+ * perspective source; idle coverage frames are ignored and a committed frame
+ * only schedules work when the source position advanced. Work is debounced,
+ * at most one observation runs per source, and each observation reads only
+ * that source's contacts and activity (one lease-free daemon read), never other sources.
+ */
+export declare class ChannelsIndexer {
+    private readonly deps;
+    private readonly watches;
+    private internal;
+    private syncing?;
+    private resync;
+    private stopped;
+    private readonly debounceMs;
+    constructor(deps: ChannelsIndexerDeps);
+    /** Re-derive sources and the exclusion set; start/stop streams accordingly. */
+    sync(): Promise<void>;
+    stop(): void;
+    private syncOnce;
+    /** The daemon source of `sourceCid` changed under a caller: drop its pin and observe again. */
+    invalidate(sourceCid: string): void;
+    private retire;
+    private follow;
+    private retired;
+    private schedule;
+    private run;
+    private observe;
+}
+/** Contacts of one observation, minus internal identities, as metadata-only edges. */
+export declare function edgesFrom(observation: ContactsActivity, internal: Set<string>): ChannelEdge[];

package/dist/channels/indexer.js

@@ -0,0 +1,214 @@
+import { IdentityReadError } from './identity-reads.js';
+import { norm } from './sources.js';
+/**
+ * Event-driven Channels projection. One passive resource-event stream per live
+ * perspective source; idle coverage frames are ignored and a committed frame
+ * only schedules work when the source position advanced. Work is debounced,
+ * at most one observation runs per source, and each observation reads only
+ * that source's contacts and activity (one lease-free daemon read), never other sources.
+ */
+export class ChannelsIndexer {
+    deps;
+    watches = new Map();
+    internal = new Set();
+    syncing;
+    resync = false;
+    stopped = false;
+    debounceMs;
+    constructor(deps) {
+        this.deps = deps;
+        this.debounceMs = deps.debounceMs ?? 250;
+    }
+    /** Re-derive sources and the exclusion set; start/stop streams accordingly. */
+    sync() {
+        if (this.syncing) {
+            this.resync = true;
+            return this.syncing;
+        }
+        this.syncing = (async () => {
+            try {
+                do {
+                    this.resync = false;
+                    await this.syncOnce();
+                } while (this.resync && !this.stopped);
+            }
+            finally {
+                this.syncing = undefined;
+            }
+        })();
+        return this.syncing;
+    }
+    stop() {
+        this.stopped = true;
+        for (const watch of this.watches.values())
+            this.retire(watch);
+        this.watches.clear();
+    }
+    async syncOnce() {
+        if (this.stopped)
+            return;
+        const found = await this.deps.discover();
+        if (this.stopped)
+            return;
+        const internalChanged = found.internal.size !== this.internal.size || [...found.internal].some(cid => !this.internal.has(cid));
+        this.internal = found.internal;
+        this.deps.store.setSources(found.sources);
+        // Cached edges of every source, ended ones included, lose newly internal identities.
+        if (internalChanged)
+            this.deps.store.excludeContacts(found.internal);
+        const live = new Map(found.sources.filter(s => !s.ended).map(s => [s.cid, s]));
+        for (const [cid, watch] of this.watches) {
+            const next = live.get(cid);
+            if (!next || next.name !== watch.source.name) {
+                this.retire(watch);
+                this.watches.delete(cid);
+            }
+            else
+                watch.source = next;
+        }
+        for (const source of live.values()) {
+            let watch = this.watches.get(source.cid);
+            if (!watch) {
+                watch = { source, abort: new AbortController(), inflight: false, dirty: false };
+                this.watches.set(source.cid, watch);
+                void this.follow(watch);
+                this.schedule(watch); // bounded bootstrap/backfill for a new source
+            }
+            else if (internalChanged)
+                this.schedule(watch);
+        }
+        this.deps.onChange();
+    }
+    /** The daemon source of `sourceCid` changed under a caller: drop its pin and observe again. */
+    invalidate(sourceCid) {
+        const watch = this.watches.get(sourceCid.toUpperCase());
+        if (!watch || watch.abort.signal.aborted)
+            return;
+        watch.generation = undefined;
+        watch.position = undefined;
+        this.schedule(watch);
+    }
+    retire(watch) {
+        watch.abort.abort();
+        if (watch.timer)
+            clearTimeout(watch.timer);
+        watch.timer = undefined;
+    }
+    async follow(watch) {
+        let backoff = 1_000;
+        while (!watch.abort.signal.aborted) {
+            try {
+                for await (const frame of this.deps.events.resourceEvents(watch.source.name, {
+                    signal: watch.abort.signal, ...(watch.generation ? { expectedGeneration: watch.generation } : {}),
+                })) {
+                    backoff = 1_000;
+                    if (frame.kind === 'coverage')
+                        continue;
+                    // ready/committed at the already-observed position change nothing; resync always reads.
+                    if (frame.kind !== 'resync' && frame.producerGeneration === watch.generation && frame.position === watch.position)
+                        continue;
+                    if (frame.producerGeneration !== watch.generation)
+                        watch.position = undefined;
+                    watch.generation = frame.producerGeneration;
+                    this.schedule(watch);
+                }
+            }
+            catch (error) {
+                if (watch.abort.signal.aborted)
+                    return;
+                this.deps.log(`channels: ${watch.source.name} event stream interrupted: ${error.message}`);
+            }
+            if (this.retired(watch))
+                return;
+            // The stream ended or failed: data may be behind until it is re-established.
+            watch.generation = undefined;
+            this.deps.store.markStale(watch.source.cid);
+            this.deps.onChange();
+            await new Promise(resolve => setTimeout(resolve, backoff));
+            backoff = Math.min(backoff * 2, 30_000);
+        }
+    }
+    retired(watch) {
+        return this.stopped || watch.abort.signal.aborted || this.watches.get(watch.source.cid) !== watch;
+    }
+    schedule(watch) {
+        watch.dirty = true;
+        if (watch.timer || watch.inflight || watch.abort.signal.aborted)
+            return;
+        watch.timer = setTimeout(() => { watch.timer = undefined; void this.run(watch); }, this.debounceMs);
+    }
+    async run(watch) {
+        if (watch.inflight || watch.abort.signal.aborted)
+            return;
+        watch.inflight = true;
+        watch.dirty = false;
+        try {
+            const observation = await this.observe(watch);
+            // Retired (stopped, removed or replaced) work never touches the store or a successor.
+            if (!observation || this.retired(watch))
+                return;
+            this.deps.store.replaceEdges(watch.source.cid, edgesFrom(observation, this.internal), observation.source);
+            watch.generation = observation.source.producerGeneration;
+            watch.position = observation.source.position;
+            this.deps.onChange();
+        }
+        catch (error) {
+            if (this.retired(watch))
+                return;
+            this.deps.store.markStale(watch.source.cid);
+            this.deps.onChange();
+            if (error instanceof IdentityReadError && (error.code === 'identity_not_found' || error.code === 'identity_mismatch'))
+                void this.sync();
+            else
+                this.deps.log(`channels: ${watch.source.name} observation failed: ${error.message}`);
+        }
+        finally {
+            watch.inflight = false;
+            if (watch.dirty && !this.retired(watch))
+                this.schedule(watch);
+        }
+    }
+    async observe(watch) {
+        for (let attempt = 0;; attempt++) {
+            try {
+                return await this.deps.reader.contactsActivity({
+                    identity: watch.source.name, expectedCid: watch.source.cid,
+                    ...(watch.generation ? { expectedProducerGeneration: watch.generation } : {}),
+                }, watch.abort.signal);
+            }
+            catch (error) {
+                if (!(error instanceof IdentityReadError) || attempt >= 2)
+                    throw error;
+                // A new daemon source generation (daemon restart): drop the stale pin and read again.
+                if (error.code === 'source_generation_changed') {
+                    watch.generation = undefined;
+                    watch.position = undefined;
+                    continue;
+                }
+                // The identity committed during the read: its own wake will follow; retry briefly.
+                if (error.code !== 'source_changed')
+                    throw error;
+                await new Promise(resolve => setTimeout(resolve, 100 * (attempt + 1)));
+                if (watch.abort.signal.aborted)
+                    return undefined;
+            }
+        }
+    }
+}
+/** Contacts of one observation, minus internal identities, as metadata-only edges. */
+export function edgesFrom(observation, internal) {
+    const edges = [];
+    for (const contact of observation.contacts) {
+        const cid = norm(contact.container_id);
+        if (internal.has(cid))
+            continue;
+        const activity = observation.activity[contact.container_id];
+        const root = observation.roots[contact.container_id];
+        edges.push({
+            contactCid: cid, contactName: contact.name,
+            lastActivity: activity && 'at' in activity ? activity.at : '',
+            ...(root?.root_cid ? { rootCid: norm(root.root_cid), rootName: root.root_name, roleId: root.role_id } : {}),
+        });
+    }
+    return edges;
+}

package/dist/channels/runtime.d.ts

@@ -0,0 +1,30 @@
+import type { RoleRepository } from '../application/role-repository.js';
+import { ChannelsService } from './service.js';
+export declare const channelsPrivateDir: () => string;
+/**
+ * Build the Fleet-side Channels service over the workspace's ordinary daemon
+ * client profile: identity discovery, passive resource events and lease-free
+ * identity reads. No identity is ever bound. Returns undefined when this host
+ * has no daemon profile.
+ */
+export declare function createChannels(options: {
+    configPath: string;
+    repository: RoleRepository;
+    log?: (message: string) => void;
+}): {
+    service: ChannelsService;
+    close(): void;
+} | undefined;
+/**
+ * The files Channels source discovery reads: the manifest (Owner CID, roles), split role
+ * definitions, permanent and temporary role definitions, agent journals and room records.
+ * Conversation ledgers and other state under the role roots are not inputs.
+ */
+export declare function channelSourceInputs(configPath: string): {
+    journals: string;
+    rooms: string;
+    splitRoot: string;
+    permanentRoles: string;
+    temporaryRoles: string;
+    affects: (changed: string) => boolean;
+};

package/dist/channels/runtime.js

@@ -0,0 +1,125 @@
+import { join, relative, resolve, sep } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { attachOursClient } from '@ours.network/sdk/client';
+import { readClientProfile } from '../client-profile.js';
+import { loadConfig, splitRootFor } from '../config.js';
+import { agentsRoot, stateRoot, tmpRoot } from '../paths.js';
+import { observeFleetResources, publishFleetResourceCommit } from '../application/resource-observer.js';
+import { listRoomRecords } from '../rooms-tasks/room-state.js';
+import { privateRuntimeRoot } from '../agent-ours/service.js';
+import { createIdentityReader } from './identity-reads.js';
+import { ChannelsIndexer } from './indexer.js';
+import { ChannelsService } from './service.js';
+import { readAgentRecords, resolveSources } from './sources.js';
+import { ChannelsStore } from './store.js';
+export const channelsPrivateDir = () => join(stateRoot(), 'private-channels');
+/**
+ * Build the Fleet-side Channels service over the workspace's ordinary daemon
+ * client profile: identity discovery, passive resource events and lease-free
+ * identity reads. No identity is ever bound. Returns undefined when this host
+ * has no daemon profile.
+ */
+export function createChannels(options) {
+    let profile;
+    try {
+        profile = readClientProfile();
+    }
+    catch {
+        return undefined;
+    }
+    const log = options.log ?? (message => console.warn(message));
+    const store = new ChannelsStore(channelsPrivateDir());
+    const reader = createIdentityReader({ endpoint: profile.endpoint, credentialPath: profile.credentialPath });
+    const attach = () => attachOursClient({
+        endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId, credentialPath: profile.credentialPath,
+        sessionMode: 'external', leaseToken: `ours-fleet-channels-${process.pid}-${randomUUID()}`, env: {},
+    });
+    let eventsClient;
+    const events = {
+        async *resourceEvents(identity, opts) {
+            eventsClient ??= await attach();
+            yield* eventsClient.resourceEvents(identity, opts);
+        },
+    };
+    let last;
+    const discover = async () => {
+        const ownerCid = loadConfig(options.configPath).rooms?.owner.expected_cid;
+        const roleByIdentity = new Map();
+        for (const role of await options.repository.list(true))
+            if (role.config?.identity)
+                roleByIdentity.set(role.config.identity, role.id);
+        const client = await attach();
+        let identities;
+        try {
+            identities = (await client.listIdentities());
+        }
+        finally {
+            await client.close().catch(() => { });
+        }
+        const found = resolveSources({
+            ownerCid: ownerCid ?? '',
+            identities,
+            agents: readAgentRecords(privateRuntimeRoot()),
+            roleByIdentity,
+            roomCids: listRoomRecords().map(room => room.room_identity_cid).filter((cid) => typeof cid === 'string'),
+        });
+        if (!ownerCid)
+            found.internal.delete('');
+        last = found;
+        return found;
+    };
+    const indexer = new ChannelsIndexer({ store, reader, events, discover, log, onChange: () => publishFleetResourceCommit(store.path) });
+    const sync = () => { void indexer.sync().catch(error => log(`channels: sync failed: ${error.message}`)); };
+    const service = new ChannelsService({ store, reader, indexer, ownerRoot: () => last?.rootCid, ready: () => last !== undefined });
+    sync();
+    // Re-derive sources when one of their inputs commits, so new or stopped agents change
+    // perspectives without polling. Bursts coalesce. The configuration scope also tracks the
+    // manifest file itself; every wake is filtered to the actual inputs (never this index).
+    const lifetime = new AbortController();
+    const inputs = channelSourceInputs(options.configPath);
+    let pending, relevant = false;
+    observeFleetResources({
+        configPath: options.configPath, retryWatchFailures: true,
+        paths: [inputs.journals, inputs.rooms, inputs.splitRoot, inputs.permanentRoles, inputs.temporaryRoles],
+        onInvalidated: path => { if (path === undefined || inputs.affects(path))
+            relevant = true; },
+    }, () => {
+        if (!relevant || pending || lifetime.signal.aborted)
+            return;
+        relevant = false;
+        pending = setTimeout(() => { pending = undefined; sync(); }, 1_000);
+        pending.unref?.();
+    }, lifetime.signal);
+    return {
+        service,
+        close() { lifetime.abort(); if (pending)
+            clearTimeout(pending); indexer.stop(); void eventsClient?.close().catch(() => { }); store.close(); },
+    };
+}
+/**
+ * The files Channels source discovery reads: the manifest (Owner CID, roles), split role
+ * definitions, permanent and temporary role definitions, agent journals and room records.
+ * Conversation ledgers and other state under the role roots are not inputs.
+ */
+export function channelSourceInputs(configPath) {
+    const config = resolve(configPath);
+    const journals = resolve(privateRuntimeRoot()), rooms = resolve(stateRoot(), 'rooms'), splitRoot = resolve(splitRootFor(config));
+    const permanentRoles = resolve(agentsRoot()), temporaryRoles = resolve(tmpRoot());
+    const under = (path, root) => { const local = relative(root, path); return local !== '..' && !local.startsWith('..' + sep) && !local.startsWith(sep) ? local : undefined; };
+    const affects = (changed) => {
+        const path = resolve(changed);
+        if (path === config || under(path, journals) !== undefined || under(path, rooms) !== undefined || under(path, splitRoot) !== undefined)
+            return true;
+        for (const root of [permanentRoles, temporaryRoles]) {
+            const local = under(path, root);
+            if (local === undefined)
+                continue;
+            const parts = local.split(sep).filter(Boolean);
+            // The roles directory, a role directory appearing/disappearing, or its definition.
+            return parts.length <= 1 || (parts.length === 2 && parts[1] === 'role.yaml');
+        }
+        // Ancestor replacement of any input root.
+        return [config, journals, rooms, splitRoot, permanentRoles, temporaryRoles].some(root => under(root, path) !== undefined);
+    };
+    return { journals, rooms, splitRoot, permanentRoles, temporaryRoles, affects };
+}

package/dist/channels/service.d.ts

@@ -0,0 +1,61 @@
+import { type IdentityHistoryPage, type IdentityReader } from './identity-reads.js';
+import type { ChannelsIndexer } from './indexer.js';
+import type { ChannelPage, ChannelPerspective, ChannelRow, ChannelsStore } from './store.js';
+export interface ChannelsServiceDeps {
+    store: ChannelsStore;
+    reader: IdentityReader;
+    indexer: ChannelsIndexer;
+    /** Actual root CID of this workspace's Owner, when known. */
+    ownerRoot(): string | undefined;
+    /** False until the first discovery completed. */
+    ready(): boolean;
+}
+export type ChannelRowView = ChannelRow & {
+    claimsOwnerRoot: boolean;
+};
+/**
+ * Owner-facing Channels queries over the durable projection. Served only
+ * behind the Fleet web Owner session; agents get no route to it.
+ */
+export declare class ChannelsService {
+    private readonly deps;
+    constructor(deps: ChannelsServiceDeps);
+    status(): {
+        ready: boolean;
+        sources: ReturnType<ChannelsStore['sourcesSummary']>;
+    };
+    private view;
+    list(options: {
+        cursor?: string;
+        limit?: number;
+        q?: string;
+        root?: string;
+    }): ChannelPage & {
+        channels: ChannelRowView[];
+    };
+    /** The SSE snapshot: the first Recent page. */
+    snapshot(): {
+        ready: boolean;
+        channels: ChannelRowView[];
+        nextCursor: string | null;
+    };
+    get(cid: string): {
+        channel: ChannelRowView;
+        perspectives: ChannelPerspective[];
+    };
+    /**
+     * One perspective's own history with this contact; never a merged view, never consuming.
+     * Pinned to the source's CID and last observed daemon source generation; a response is
+     * released only while that same perspective is still current.
+     */
+    history(contactCid: string, sourceCid: string, page: {
+        before_seq?: number;
+        limit?: number;
+    }): Promise<IdentityHistoryPage & {
+        perspective: {
+            sourceCid: string;
+            kind: string;
+            roleId?: string;
+        };
+    }>;
+}