@ours.network/fleet 2.3.3 → 2.3.5

package/dist/spawn.js

@@ -2,6 +2,7 @@ import { taskSupervisorMayRun } from './task-supervision.js';
 import { randomUUID } from 'node:crypto';
 import { storeRoomSecret, storeTemporaryLaunch, preparePermanentAssignment } from './agent-ours/service.js';
 import { ensureWorkspace } from './rooms-tasks/workspace.js';
+import { assertCwdNotInRemovedTaskFolder } from './rooms-tasks/workspace-removal.js';
 import { spawn as spawnChild } from 'node:child_process';
 import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -324,6 +325,7 @@ export async function spawnTemp(o, binPath, launch = independentSupervisor, crea
     if (o.isolationFile)
         readIsolationFile(o.isolationFile); // fail before reserving
     const prepared = resolvedSpawn(o); // canonical validation before mutation
+    assertCwdNotInRemovedTaskFolder(prepared.role.cwd);
     if ((o.taskOwner || o.roomMemberStartup?.task_id) && !getAdapter(prepared.role.harness).supportsResume)
         throw Error('TASK_HARNESS_RESUME_UNSUPPORTED: task agents require a resumable harness');
     if (o.roomMemberStartup?.workspace) {

package/dist/web/server.js

@@ -23,6 +23,7 @@ import { AuditSink } from './audit.js';
 import { WebAuth } from './auth.js';
 import { FleetEventBus } from './events.js';
 import { ROLE_NAME_RE } from '../config.js';
+import { workingFilesSummary } from '../rooms-tasks/workspace-removal.js';
 import { TaskListError } from '../rooms-tasks/task-lists.js';
 import { acknowledgeTaskProgress, acknowledgeTaskReview, contributionUnread, resolveTaskRef, TaskStateError } from '../rooms-tasks/task-state.js';
 import { CONTRIBUTION_CUTOFF_MAX, CONTRIBUTION_PAGE_MAX, listTaskContributions, readTaskContributions } from '../rooms-tasks/task-contributions.js';
@@ -390,7 +391,7 @@ export async function buildWebServer(services, boundary, options = {}) {
     /** Browser task payloads carry Progress/To review counts; bodies have their own routes. */
     const wireTask = (task) => {
         const { progress: _progress, review: _review, member_naming: _naming, ...rest } = task;
-        return { ...rest, ...taskContributionSummary(task) };
+        return { ...rest, ...taskContributionSummary(task), working_files: workingFilesSummary(task) };
     };
     const wireTaskResult = (result) => {
         const value = result;
@@ -625,6 +626,14 @@ export async function buildWebServer(services, boundary, options = {}) {
             recovery: `Repeat DELETE /api/v1/tasks/${submitted}?confirm=${submitted}.`,
         };
     });
+    // Removes only the Done task's own working folder; the task, Progress, To review files and chat history stay.
+    app.post('/api/v1/tasks/:id/working-files/remove', async (request) => {
+        auth.authenticate(request, true);
+        const result = await taskApi(() => requireTaskRooms().removeTaskWorkingFiles({
+            actor: { kind: 'local_control', surface: 'web' }, taskId: taskRef(request),
+        }));
+        return { task: wireTask(result.task), result: result.result, mentions: result.mentions };
+    });
     app.post('/api/v1/tasks', async (request, reply) => {
         auth.authenticate(request, true);
         const body = request.body;

package/docs/task-workspaces.md

@@ -30,6 +30,7 @@ complete internal worktree registries, including dirty and stale owned entries.
 | Operation | Workspace and execution artifacts | Member runtime evidence |
 | --- | --- | --- |
 | Complete, fail, cancel | Retained while Task is recorded | Retained in Fleet recovery archives |
+| Explicit working-files removal (Done Task only) | Task workspace removed; Task, Progress and To review files retained | Retained in Fleet recovery archives |
 | Linked Room retirement or deletion | Task workspace retained | Retained |
 | Internal standalone Room retirement | Room workspace retained | Retained |
 | Explicit Task deletion | Removed after member retirement, with the task's retained To review files | All proven owned retired launches removed |
@@ -39,7 +40,8 @@ Internal room close means retirement, not destructive Task deletion.
 The existing CLI `room close ID ID` remains a deprecated alias for explicit
 `room delete ID ID`: it deletes standalone room-owned artifacts, but always
 retains a linked Task workspace. Its repeated-ID confirmation is unchanged. To remove a Task's
-artifacts, explicitly delete the Task. Cancellation is not deletion. Automatic
+artifacts, explicitly delete the Task, or, for a Done Task, remove only its working files
+(`task remove-files ID`, below). Cancellation is not deletion. Automatic
 compatibility cleanup of legacy closed Rooms skips records with owned workspaces.
 These choices reconcile close/remove wording with the requirement that completed,
 recorded Tasks retain all artifacts.
@@ -223,3 +225,51 @@ requires a supported Home Screen installation and granted device/browser permiss
 reopen the workspace to reconcile an expired subscription and explicitly re-enable
 permission if it was revoked. Every received push must display a notification to
 honor Safari's user-visible push requirement.
+
+## Removing a Done Task's working files
+
+`ours-fleet task remove-files ID` (API `POST /api/v1/tasks/ID/working-files/remove`)
+frees disk space without deleting the Task. It removes only the recorded owned
+workspace through the same guarded deletion as Task deletion (marker, Git
+registration, symlink and mount checks, token tombstone). It never collects or
+erases recovery archives, member artifacts or the To review store, and never
+closes rooms or stops agents. It runs under the task operation lock and refuses
+with the reason unless all of these hold:
+
+- the Task is Done with its completion settled, and is not being deleted;
+- no room record names the Task or its workspace, and every room record is readable;
+- a layout run exists, is closed, is not uncertain, and has retired every owned participant;
+- no supervisor registration belongs to the Task;
+- no unarchived temporary agent state belongs to the Task or works in the
+  folder (cwd or startup workspace, literally or through symlinks), and all
+  such state is readable;
+- no permanent agent's recorded `.cwd` or configured cwd is in the folder.
+
+The intent is recorded before a final in-use scan. Agent state that names a
+task folder is created under that folder's use lock and refuses a folder
+whose removal began, so a concurrent launch is either seen by the scan or
+refused. After the folder is renamed to its tombstone and before anything
+is removed, every process's cwd, root and open files are checked (Linux
+`/proc`). A process that entered the folder earlier restores the folder and
+refuses the removal. Platforms without this check refuse the removal.
+A same-user process whose cwd and descriptors are unreadable (for example
+non-dumpable, or in a container) refuses the removal unless it is a zombie.
+Nothing readable proves such a process holds nothing in the folder: a
+retained cwd or descriptor survives namespace and chroot changes, and a user
+service manager may keep descriptors in its store. The refusal names each
+such process by pid and kernel name (never its command line), with
+read-only context such as "own mount namespace without the folder".
+Another user's unreadable process is skipped when a private ancestor closes
+the folder to it. Superuser processes are outside the check. On hosts that
+run rootless containers or a user service manager, this strict check can
+make removal unavailable while those processes run. Only a folder
+that this run renamed intact is restored. A partly removed tombstone from an
+earlier run stays in place with the refusal recorded, so a later retry can
+finish it.
+
+The Task records `workspace_removal` (started, completed, error), shown as
+`working_files` in API payloads. A retry resumes an unfinished tombstone, and
+repeating a finished removal changes nothing. A folder already missing on the
+first run is recorded as such. A create replay never recreates the folder, and
+To review files can no longer be attached from it. Explicit Task deletion
+still works and first finishes an interrupted removal.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "2.3.3",
+  "version": "2.3.5",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -50,7 +50,7 @@
     "@agentclientprotocol/sdk": "^1.3.0",
     "@fastify/websocket": "^11.2.0",
     "@ours.network/cli": "4.2.0",
-    "@ours.network/mcp": "2.0.3",
+    "@ours.network/mcp": "2.0.4",
     "@ours.network/sdk": "5.2.0",
     "commander": "^12.1.0",
     "fastify": "^5.4.0",