@ours.network/fleet 2.3.3 → 2.3.4

package/dist/rooms-tasks/task-state.d.ts

@@ -1,5 +1,5 @@
 import type { ArchivedMemberAbsence } from './types.js';
-import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent, TaskDeletionActor, TaskDeletionMemberPhase, TaskNotificationEvent } from './types.js';
+import type { TaskRecord, TaskState, TaskOrigin, TaskTemplateRef, TaskOutcome, TaskMemberRole, TaskTerminalIntent, TaskDeletionActor, TaskDeletionMemberPhase, TaskNotificationEvent, TaskWorkspaceRemoval } from './types.js';
 import { type LabelCandidate } from './member-naming.js';
 import { type TaskNotificationManifest } from './notification-manifest.js';
 export declare const tasksDir: () => string;
@@ -295,4 +295,9 @@ export declare function updateTaskContribution<T>(id: string, change: (task: Tas
     changed: boolean;
 }): T;
 export declare function updateTaskBrief(id: string, brief: string, expectedBrief: string): TaskRecord;
+/**
+ * Record a step of an explicit working-folder removal. Callers hold the task
+ * operation lock; lifecycle state is untouched.
+ */
+export declare function updateTaskWorkspaceRemoval(id: string, change: (removal: TaskWorkspaceRemoval | undefined) => TaskWorkspaceRemoval | undefined): TaskRecord;
 export {};

package/dist/rooms-tasks/task-state.js

@@ -518,7 +518,8 @@ export function createTask(input) {
         const fresh = readTask(outcome.taskId);
         if (outcome.kind === 'existing')
             assertNoPendingDeletion(fresh);
-        if (fresh.workspace)
+        // A replayed create never recreates a folder the Owner removed.
+        if (fresh.workspace && !fresh.workspace_removal)
             ensureWorkspace(fresh.workspace);
         return fresh;
     });
@@ -1502,3 +1503,21 @@ export function updateTaskBrief(id, brief, expectedBrief) {
         return task;
     });
 }
+/**
+ * Record a step of an explicit working-folder removal. Callers hold the task
+ * operation lock; lifecycle state is untouched.
+ */
+export function updateTaskWorkspaceRemoval(id, change) {
+    assertCanonicalTaskId(id);
+    return withTaskLock(id, () => {
+        const task = readTask(id);
+        assertNoPendingDeletion(task);
+        const next = change(task.workspace_removal);
+        if (next)
+            task.workspace_removal = next;
+        else
+            delete task.workspace_removal;
+        writeTask(task);
+        return task;
+    });
+}

package/dist/rooms-tasks/types.d.ts

@@ -99,6 +99,21 @@ export interface TaskDeletionIntent {
     first_failure?: string;
     first_recovery_hint?: string;
 }
+/**
+ * Explicit removal of a Done task's owned working folder. The task record,
+ * Progress, To review files and agent archives stay; only the folder goes.
+ * `started_at` without `completed_at` means removal began and has not been
+ * confirmed: it may still be running or have been interrupted.
+ */
+export interface TaskWorkspaceRemoval {
+    started_at: string;
+    actor: TaskDeletionActor;
+    completed_at?: string;
+    /** The recorded folder was already absent when removal first ran. */
+    already_missing?: true;
+    error?: string;
+    error_at?: string;
+}
 export interface TaskLayoutLink {
     name: string;
     /** Deterministic `task-<task_id>` Room Layout run ID. */
@@ -173,6 +188,8 @@ export interface TaskRecord {
     /** Rooms whose notifications belong to this task; only grows. */
     notification_manifest?: import('./notification-manifest.js').TaskNotificationManifest;
     workspace?: import('./workspace.js').OwnedWorkspace;
+    /** Set once the Owner asked to remove the working folder; the record is never recreated from it. */
+    workspace_removal?: TaskWorkspaceRemoval;
     task_id: string;
     /**
      * Immutable human mission key (`MSN-1`), issued once from a durable

package/dist/rooms-tasks/workspace-removal.d.ts

@@ -0,0 +1,85 @@
+import type { TaskDeletionActor, TaskRecord } from './types.js';
+/**
+ * Explicit Owner removal of a Done task's working folder. Only the exact
+ * recorded task-owned folder is removed, through the guarded workspace
+ * deletion (marker, Git registration, symlink and mount fences). The task
+ * record, Progress, To review files (a separate store), agent archives and
+ * rooms' history are never touched. Every precondition is re-read under the
+ * task-operation lock that serializes terminal settlement, deletion and
+ * recovery; anything that cannot be proven idle is refused, never stopped.
+ */
+export type WorkspaceRemovalResult = 'removed' | 'already_removed' | 'already_missing';
+export interface WorkspaceRemovalOutcome {
+    task: TaskRecord;
+    result: WorkspaceRemovalResult;
+    /** Retained text fields that mention the removed folder; those paths no longer resolve. */
+    mentions: string[];
+}
+export interface WorkspaceRemovalDeps {
+    /** Working directories of configured permanent agents; undefined when the configuration is unreadable. */
+    permanentCwds?: readonly (string | undefined)[];
+    /** Test seam: processes whose cwd, root or open files are inside `path`, or cannot be read. */
+    processesUsing?(path: string, context: ProcessCheckContext): ProcessUse;
+}
+/**
+ * Every process whose cwd, root or open file descriptor is inside `path`, or
+ * whose use cannot be excluded. Only Linux exposes this without extra tools;
+ * elsewhere removal is refused. When a process's entries are unreadable (for
+ * example non-dumpable, or in a container), it is excluded only by evidence:
+ * it is a zombie, its mount table cannot reach the folder's filesystem
+ * location, it is the user's service manager (attested by the system manager)
+ * whose own records name nothing in the folder, or it is that manager's PAM
+ * helper started before the folder existed; otherwise it is reported.
+ * Other users' unreadable processes are skipped when a private ancestor
+ * closes the folder to them; a superuser process is outside this check.
+ */
+/** A same-user process whose cwd and descriptors cannot be read. */
+export interface UnverifiedProcess {
+    token: string;
+    description: string;
+}
+export interface ProcessUse {
+    /** Processes proven to use the folder. */
+    users: string[];
+    /** Processes whose use can be neither proven nor excluded. */
+    unverified: UnverifiedProcess[];
+}
+export interface ProcessCheckContext {
+    /** The folder's recorded path; configuration names it, not its tombstone. */
+    original: string;
+    /** When the folder came into existence (ms since the epoch). */
+    createdAt: number;
+}
+export declare function processesUsing(path: string, context: ProcessCheckContext): ProcessUse;
+declare const run: (command: string, args: string[]) => string;
+/**
+ * Whether the user service manager may use the folder, from its own read-only
+ * records: its attested working directory, socket units' paths and every
+ * file descriptor store (systemd 254+). Undefined when none names the folder;
+ * otherwise the reason, including any record that cannot be read.
+ */
+export declare function userManagerUse(uid: number, roots: string[], exec?: typeof run): string | undefined;
+/** True when some mount in the table exposes the filesystem location, or anything under it. */
+export declare function reaches(mountinfo: string, target: {
+    device: string;
+    inside: string;
+}): boolean;
+export declare function assertTaskWorkspaceRemovable(task: TaskRecord, deps: WorkspaceRemovalDeps): void;
+export declare function removeTaskWorkspace(taskId: string, actor: TaskDeletionActor, deps?: WorkspaceRemovalDeps): Promise<WorkspaceRemovalOutcome>;
+export interface WorkingFilesSummary {
+    /** `removing`: removal began and is not confirmed — still running or interrupted; retry resumes it. */
+    state: 'none' | 'present' | 'removing' | 'failed' | 'removed';
+    started_at?: string;
+    removed_at?: string;
+    error?: string;
+}
+/** Record-only readback for task payloads; never touches the filesystem. */
+export declare function workingFilesSummary(task: TaskRecord): WorkingFilesSummary;
+export declare function assertCwdNotInRemovedTaskFolder(cwd: string | undefined): void;
+/**
+ * Launch fence: an agent never starts in, and so never recreates, the folder
+ * of a task whose working files were removed. Creating its state under the
+ * folder's use lock makes it visible to a concurrent removal's scan.
+ */
+export declare function withTaskFolderUseFence<T>(cwd: string | undefined, work: () => T): T;
+export {};