@timqi/pier 0.0.20 → 0.0.22

package/dist/agent/config-sync.js

@@ -1,54 +1,98 @@
 // Credential-blind projection of the portable agent configuration.
-const MODEL_KEYS = ["id", "name", "reasoning", "input", "cost", "contextWindow", "maxTokens", "api"];
-const COST_KEYS = ["input", "output", "cacheRead", "cacheWrite"];
+/** Never leaves the instance, at any depth of a models.json provider: the
+ *  credentials, and the endpoint they authenticate against — a sharing link is
+ *  public. Every other field is metadata Pi's own schema already validates, so
+ *  it travels as-is instead of through a field list chasing Pi's versions. */
+const PRIVATE_KEYS = ["apiKey", "headers", "baseUrl"];
+/** The catalog is the part of a provider sync owns outright: absent on the
+ *  source means deleted here, while a field the source never states stays. */
+const CATALOG_KEYS = ["models", "modelOverrides"];
+/** Dropped strings shorter than this ("", "Bearer") collide with legitimate
+ *  metadata; a credential or an endpoint does not. */
+const SECRET_CHARS = 8;
+const asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
 function record(value, where) {
-    if (!value || typeof value !== "object" || Array.isArray(value) ||
-        ![Object.prototype, null].includes(Object.getPrototypeOf(value))) {
+    const plain = asRecord(value);
+    if (!plain || ![Object.prototype, null].includes(Object.getPrototypeOf(plain))) {
         throw new Error(`${where} must be an object`);
     }
-    return value;
+    return plain;
 }
 function only(value, keys, where) {
     if (Object.keys(value).some((key) => !keys.includes(key))) {
         throw new Error(`${where} contains unsupported fields`);
     }
 }
-function modelDefinition(value) {
-    const model = record(value, "model");
-    only(model, MODEL_KEYS, "model");
-    if (typeof model.id !== "string" || !model.id.trim() || model.id !== model.id.trim()) {
-        throw new Error("model id must be a non-empty trimmed string");
-    }
-    if (model.name !== undefined && (typeof model.name !== "string" || !model.name.length))
-        throw new Error("model name must be a non-empty string");
-    if (model.reasoning !== undefined && typeof model.reasoning !== "boolean") {
-        throw new Error("model reasoning must be a boolean");
-    }
-    if (model.api !== undefined && (typeof model.api !== "string" || !/^[a-z][a-z0-9-]*$/.test(model.api))) {
-        throw new Error("model api must be a protocol name");
+/** Every string in a JSON value, so one containment test covers the whole
+ *  projection however deeply Pi nests a future field. */
+function strings(value, found = []) {
+    const nested = asRecord(value);
+    if (typeof value === "string")
+        found.push(value);
+    else if (Array.isArray(value))
+        for (const entry of value)
+            strings(entry, found);
+    else if (nested)
+        for (const entry of Object.values(nested))
+            strings(entry, found);
+    return found;
+}
+/** Deep copy of JSON-only data; the private fields are dropped and handed to
+ *  `onPrivate` — collected on the way out, refused on the way in. */
+function project(value, where, onPrivate) {
+    if (value === null || ["string", "boolean", "number"].includes(typeof value))
+        return value;
+    if (Array.isArray(value))
+        return value.map((entry) => project(entry, where, onPrivate));
+    return Object.fromEntries(Object.entries(record(value, where)).flatMap(([key, entry]) => {
+        if (PRIVATE_KEYS.includes(key)) {
+            onPrivate(key, entry);
+            return [];
+        }
+        return [[key, project(entry, `${where} ${key}`, onPrivate)]];
+    }));
+}
+/** The shape both sides must agree on: a provider id that cannot address
+ *  anything but its own record, and a catalog addressable by model id. */
+function portable(id, value, onPrivate) {
+    if (id.length > 100 || !/^[a-z0-9][a-z0-9._-]*$/.test(id) || ["constructor", "prototype"].includes(id)) {
+        throw new Error("invalid snapshot provider id");
     }
-    if (model.input !== undefined && (!Array.isArray(model.input) || !model.input.length ||
-        model.input.some((input) => input !== "text" && input !== "image") ||
-        new Set(model.input).size !== model.input.length)) {
-        throw new Error("model input must contain text or image without duplicates");
+    const provider = record(project(value, `provider ${id}`, onPrivate), `provider ${id}`);
+    const models = provider.models ?? [];
+    if (!Array.isArray(models))
+        throw new Error("models must be an array");
+    const ids = models.map((model) => record(model, "model").id);
+    if (ids.some((modelId) => typeof modelId !== "string" || !modelId.trim() || modelId !== modelId.trim())) {
+        throw new Error("model id must be a non-empty trimmed string");
     }
-    for (const key of ["contextWindow", "maxTokens"]) {
-        if (model[key] !== undefined && (typeof model[key] !== "number" || !Number.isSafeInteger(model[key]) || model[key] <= 0)) {
-            throw new Error(`model ${key} must be a positive integer`);
-        }
+    if (new Set(ids).size !== ids.length)
+        throw new Error("duplicate model ids");
+    const overrides = provider.modelOverrides ?? {};
+    for (const [overrideId, override] of Object.entries(record(overrides, "modelOverrides"))) {
+        record(override, `modelOverrides ${overrideId}`);
     }
-    if (model.cost !== undefined) {
-        const cost = record(model.cost, "model cost");
-        only(cost, COST_KEYS, "model cost");
-        for (const key of COST_KEYS) {
-            if (typeof cost[key] !== "number" || !Number.isFinite(cost[key]) || cost[key] < 0) {
-                throw new Error(`model cost ${key} must be a non-negative finite number`);
-            }
-        }
+    return provider;
+}
+/** Project disk metadata before validation, then fail closed if anything the
+ *  projection removed still appears in it: a deny list cannot foresee the field
+ *  Pi adds next, but it can refuse to publish a value it just dropped. */
+export function snapshotProviders(providers = {}) {
+    const dropped = [];
+    const shared = Object.fromEntries(Object.entries(providers).flatMap(([id, provider]) => {
+        const value = portable(id, provider, (_key, entry) => {
+            dropped.push(...strings(entry).filter((secret) => secret.length >= SECRET_CHARS));
+        });
+        return Object.keys(value).length ? [[id, value]] : [];
+    }));
+    const exported = strings(shared);
+    if (dropped.some((secret) => exported.some((value) => value.includes(secret)))) {
+        throw new Error("models.json repeats a credential or endpoint in a shared field; remove it before sharing");
     }
-    return structuredClone(model);
+    return shared;
 }
-/** Strict import boundary: unknown fields are rejected, never treated as masked secrets. */
+/** Strict import boundary: a source that states a private field is refused,
+ *  never trusted as a mask over the local one. */
 export function normalizeAgentSnapshot(raw) {
     const snapshot = record(raw, "agent snapshot");
     only(snapshot, ["files", "providers"], "agent snapshot");
@@ -59,65 +103,53 @@ export function normalizeAgentSnapshot(raw) {
             throw new Error(`${name} must be a string or null`);
         }
     }
-    const providers = Object.fromEntries(Object.entries(record(snapshot.providers, "snapshot providers")).map(([id, value]) => {
-        if (id.length > 100 || !/^[a-z0-9][a-z0-9._-]*$/.test(id) || ["constructor", "prototype"].includes(id)) {
-            throw new Error("invalid snapshot provider id");
-        }
-        const provider = record(value, "snapshot provider");
-        only(provider, ["models"], "snapshot provider");
-        if (!Array.isArray(provider.models))
-            throw new Error("snapshot provider models must be an array");
-        const models = provider.models.map(modelDefinition);
-        if (new Set(models.map((model) => model.id)).size !== models.length)
-            throw new Error("duplicate model ids");
-        return [id, { models }];
-    }));
-    return { files: { "SYSTEM.md": files["SYSTEM.md"], "AGENTS.md": files["AGENTS.md"] }, providers };
+    const providers = Object.fromEntries(Object.entries(record(snapshot.providers, "snapshot providers"))
+        .map(([id, provider]) => [id, portable(id, provider, (key) => {
+            throw new Error(`snapshot provider must not carry ${key}`);
+        })]));
+    return {
+        files: { "SYSTEM.md": files["SYSTEM.md"], "AGENTS.md": files["AGENTS.md"] },
+        providers,
+    };
 }
-/** Project disk metadata before validation, so no nested transport object can escape. */
-export function snapshotProviders(providers = {}) {
-    return Object.fromEntries(Object.entries(providers).flatMap(([id, provider]) => {
-        if (provider.models === undefined)
-            return [];
-        if (!Array.isArray(provider.models))
-            throw new Error("models.json models must be an array");
-        const models = provider.models.map((value) => {
-            const source = record(value, "models.json model");
-            const model = Object.fromEntries(MODEL_KEYS.flatMap((key) => source[key] === undefined ? [] : [[key, source[key]]]));
-            if (source.cost !== undefined) {
-                const cost = record(source.cost, "models.json model cost");
-                model.cost = Object.fromEntries(COST_KEYS.flatMap((key) => cost[key] === undefined ? [] : [[key, cost[key]]]));
-            }
-            return modelDefinition(model);
-        });
-        return [[id, { models }]];
-    }));
+/** A model or override arrives whole; only the local private fields survive it. */
+function withLocalPrivate(incoming, local) {
+    const merged = { ...incoming };
+    for (const key of PRIVATE_KEYS)
+        if (local && Object.hasOwn(local, key))
+            merged[key] = local[key];
+    return merged;
 }
-/** Replace only portable fields, retaining excluded fields for matching local model ids. */
+const modelsById = (models) => new Map((Array.isArray(models) ? models : []).flatMap((model) => {
+    const value = asRecord(model);
+    return value ? [[value.id, value]] : [];
+}));
+/** The source sets what it states and replaces the catalog; credentials and
+ *  endpoints stay local, matched by provider, model id and override id. */
 export function mergeSnapshotProviders(local = {}, incoming) {
-    const providers = structuredClone(local);
-    for (const [id, provider] of Object.entries(providers)) {
-        if (!Object.hasOwn(incoming, id)) {
-            delete provider.models;
-        }
-    }
-    for (const [id, { models }] of Object.entries(incoming)) {
-        if (!Object.hasOwn(local, id)) {
+    for (const id of Object.keys(incoming)) {
+        if (!Object.hasOwn(local, id))
             throw new Error(`provider ${id} must be configured locally before importing models`);
-        }
-        const provider = providers[id];
-        if (provider.models !== undefined && !Array.isArray(provider.models))
-            throw new Error("models.json models must be an array");
-        const existing = new Map((provider.models ?? []).map((value) => {
-            const model = record(value, "models.json model");
-            return [model.id, model];
-        }));
-        provider.models = models.map((model) => {
-            const retained = { ...existing.get(model.id) };
-            for (const key of MODEL_KEYS)
-                delete retained[key];
-            return { ...retained, ...model };
-        });
     }
-    return providers;
+    return Object.fromEntries(Object.entries(local).map(([id, provider]) => {
+        const current = record(provider, "models.json provider");
+        const source = incoming[id];
+        if (!source)
+            return [id, Object.fromEntries(Object.entries(current).filter(([key]) => !CATALOG_KEYS.includes(key)))];
+        // The catalog shapes are the ones normalizeAgentSnapshot already proved.
+        const merged = { ...current, ...structuredClone(source) };
+        for (const key of CATALOG_KEYS)
+            if (!Object.hasOwn(source, key))
+                delete merged[key];
+        if (merged.models !== undefined) {
+            const previous = modelsById(current.models);
+            merged.models = merged.models.map((model) => withLocalPrivate(model, previous.get(model.id)));
+        }
+        if (merged.modelOverrides !== undefined) {
+            const previous = asRecord(current.modelOverrides) ?? {};
+            merged.modelOverrides = Object.fromEntries(Object.entries(merged.modelOverrides)
+                .map(([key, override]) => [key, withLocalPrivate(override, asRecord(previous[key]))]));
+        }
+        return [id, merged];
+    }));
 }

package/dist/config-sync-fetch.js

@@ -1,26 +1,8 @@
-// Fetch one configuration document without turning an operator URL into an
-// arbitrary network proxy. DNS is checked once and the TLS request is pinned
-// to that address; redirects never inherit the token or bypass the check.
-import { lookup } from "node:dns/promises";
-import { request } from "node:https";
-import { BlockList, isIP } from "node:net";
-import { checkServerIdentity } from "node:tls";
+// Fetch one configuration document from the operator's source URL: HTTPS with
+// no credentials, redirects followed while they stay HTTPS, JSON capped at
+// 1 MiB so a hostile or broken source cannot exhaust memory.
 export const CONFIG_SYNC_BYTES = 1024 * 1024;
-const blockedV4 = new BlockList();
-const blockedV6 = new BlockList();
-for (const [address, prefix] of [
-    ["0.0.0.0", 8], ["10.0.0.0", 8], ["100.64.0.0", 10], ["127.0.0.0", 8],
-    ["169.254.0.0", 16], ["172.16.0.0", 12], ["192.0.0.0", 24], ["192.168.0.0", 16],
-    ["198.18.0.0", 15], ["224.0.0.0", 4], ["240.0.0.0", 4],
-])
-    blockedV4.addSubnet(address, prefix, "ipv4");
-for (const [address, prefix] of [
-    ["::", 96], ["::ffff:0:0", 96], ["64:ff9b::", 96], ["64:ff9b:1::", 48],
-    ["100::", 64], ["2001::", 32], ["2002::", 16], ["fc00::", 7], ["fe80::", 10], ["ff00::", 8],
-])
-    blockedV6.addSubnet(address, prefix, "ipv6");
-const globalV6 = new BlockList();
-globalV6.addSubnet("2000::", 3, "ipv6");
+const MAX_REDIRECTS = 5;
 export function configSourceUrl(raw) {
     let url;
     try {
@@ -34,64 +16,69 @@ export function configSourceUrl(raw) {
     }
     return url;
 }
-export function publicConfigAddress(address) {
-    const family = isIP(address);
-    return family !== 0 && (family !== 6 || globalV6.check(address, "ipv6")) &&
-        !(family === 4 ? blockedV4 : blockedV6).check(address, family === 4 ? "ipv4" : "ipv6");
-}
 export async function downloadConfig(raw, etag, signal) {
-    const url = configSourceUrl(raw);
-    const hostname = url.hostname.replace(/^\[|\]$/g, "");
-    const addresses = isIP(hostname)
-        ? [{ address: hostname, family: isIP(hostname) }]
-        : await Promise.race([
-            lookup(hostname, { all: true }),
-            new Promise((_, reject) => {
-                if (signal.aborted)
-                    reject(new Error("Configuration download aborted"));
-                else
-                    signal.addEventListener("abort", () => reject(new Error("Configuration download aborted")), { once: true });
-            }),
-        ]);
-    if (!addresses.length || addresses.some(({ address }) => !publicConfigAddress(address))) {
-        throw new Error("Source must resolve to a public address");
-    }
-    signal.throwIfAborted();
-    const address = addresses[0];
-    return new Promise((resolve, reject) => {
-        const req = request({
-            hostname: address.address, family: address.family, port: url.port || 443,
-            servername: isIP(hostname) ? undefined : hostname,
-            checkServerIdentity: (_host, cert) => checkServerIdentity(hostname, cert),
-            path: `${url.pathname}${url.search}`, method: "GET", signal,
-            headers: { host: url.host, accept: "application/json", ...(etag ? { "if-none-match": etag } : {}) },
-        }, (res) => {
-            const status = res.statusCode;
-            if (status !== 200 && status !== 304) {
-                res.destroy();
-                reject(new Error(status === 404 || status === 410
-                    ? "Source link was revoked or does not exist"
-                    : `Source returned HTTP ${String(status)}`));
-                return;
+    let url = configSourceUrl(raw);
+    for (let hop = 0;; hop++) {
+        signal.throwIfAborted();
+        let res;
+        try {
+            res = await fetch(url, {
+                method: "GET", redirect: "manual", signal,
+                headers: { accept: "application/json", ...(etag ? { "if-none-match": etag } : {}) },
+            });
+        }
+        catch {
+            throw new Error(signal.aborted ? "Configuration download timed out or was cancelled" : "Could not connect to source");
+        }
+        const location = res.status >= 300 && res.status < 400 ? res.headers.get("location") : null;
+        if (location) {
+            await res.body?.cancel().catch(() => { });
+            if (hop >= MAX_REDIRECTS)
+                throw new Error("Source redirected too many times");
+            try {
+                url = configSourceUrl(new URL(location, url).href);
             }
-            if (status === 200 && !/^application\/json(?:\s*;|$)/i.test(res.headers["content-type"] ?? "")) {
-                res.destroy();
-                reject(new Error("Source did not return JSON"));
-                return;
+            catch {
+                throw new Error("Source redirected to a location that is not HTTPS");
             }
-            const chunks = [];
-            let size = 0;
-            res.on("data", (chunk) => {
-                size += chunk.length;
-                if (size > CONFIG_SYNC_BYTES)
-                    res.destroy(new Error("Configuration exceeds 1 MiB"));
-                else
-                    chunks.push(chunk);
-            });
-            res.on("error", () => reject(new Error(size > CONFIG_SYNC_BYTES ? "Configuration exceeds 1 MiB" : "Configuration download failed")));
-            res.on("end", () => resolve({ status, etag: res.headers.etag ?? null, body: Buffer.concat(chunks).toString("utf8") }));
-        });
-        req.on("error", () => reject(new Error(signal.aborted ? "Configuration download timed out or was cancelled" : "Could not connect to source")));
-        req.end();
-    });
+            continue;
+        }
+        if (res.status !== 200 && res.status !== 304) {
+            await res.body?.cancel().catch(() => { });
+            throw new Error(res.status === 404 || res.status === 410
+                ? "Source link was revoked or does not exist"
+                : `Source returned HTTP ${String(res.status)}`);
+        }
+        const status = res.status === 304 ? 304 : 200;
+        if (status === 200 && !/^application\/json(?:\s*;|$)/i.test(res.headers.get("content-type") ?? "")) {
+            await res.body?.cancel().catch(() => { });
+            throw new Error("Source did not return JSON");
+        }
+        return { status, etag: res.headers.get("etag"), body: await read(res, signal) };
+    }
+}
+async function read(res, signal) {
+    const reader = res.body?.getReader();
+    if (!reader)
+        return "";
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.length;
+            if (size > CONFIG_SYNC_BYTES)
+                throw new Error("Configuration exceeds 1 MiB");
+            chunks.push(Buffer.from(value));
+        }
+    }
+    catch (err) {
+        await reader.cancel().catch(() => { });
+        if (err instanceof Error && err.message === "Configuration exceeds 1 MiB")
+            throw err;
+        throw new Error(signal.aborted ? "Configuration download timed out or was cancelled" : "Configuration download failed");
+    }
+    return Buffer.concat(chunks).toString("utf8");
 }

package/dist/db.js

@@ -361,9 +361,11 @@ let shared;
  * defaults to it; a test passes `openDb(":memory:")` instead.
  */
 export const pierDb = () => (shared ??= openDb(PIER_DB));
-/** A release-level restore point, taken while the service is stopped even when
- * the release has no schema migration. The previous complete copies stay put if
- * writing this one fails.
+/** A release-level restore point, taken for every release even when it has no
+ * schema migration. The previous complete copies stay put if writing this one
+ * fails, and the service may be running while it is written: `copyDatabase`
+ * reads through a read-only connection, so what it writes is one consistent
+ * snapshot of a live database rather than a torn `cp`.
  *
  * `version` is the Pier that produced this database, not the one being
  * installed: the updater runs this from the tree it is about to replace, and

package/dist/main.js

@@ -205,8 +205,9 @@ await configurationSync.reconcile();
 tasks.start();
 readyForConfigReload = true;
 void secrets.unlock().then(startChannels, (err) => log.error("secrets locked — channels not started; unlock from Console → Settings → Security, or repair master.key", err));
-// Replacing Pier is systemd's job, not this process's: the oneshot unit stops
-// the service, snapshots the database, installs and starts it again. Without
+// Replacing Pier is systemd's job, not this process's: the oneshot unit
+// snapshots the database, installs, then stops the service and starts it again
+// on the new version — in that order, so only the last two are downtime. Without
 // that unit there is nothing to hand the work to, and the Console says so
 // instead of offering a button that cannot work.
 const updates = new UpdateCheck();
@@ -247,8 +248,14 @@ const takeWorkAgain = (why) => {
 };
 /** How long the handover has to actually stop us. `systemctl start --no-block`
  *  returns when the job is *queued*, so "started" is not proof of anything;
- *  the real outcome is a SIGTERM a second or two later. */
-const HANDOVER_GRACE_MS = 60_000;
+ *  the real outcome is a SIGTERM — but only after the updater has snapshotted
+ *  the database and installed the new version, which is a registry download on
+ *  someone else's network — ten seconds on a good day, minutes on a bad one.
+ *  So this waits far longer than the stop itself needs, because reopening the
+ *  gate mid-install would take work we are about to be SIGTERM'd out of, and
+ *  still short enough that a handover which never happens does not refuse
+ *  messages all afternoon. */
+const HANDOVER_GRACE_MS = 5 * 60_000;
 const handOverToUpdater = async () => {
     // One handover at a time, and never on top of a restart: the Console button,
     // the auto-update tick and SIGUSR2 would otherwise drain the same Pier

package/dist/service.js

@@ -104,8 +104,14 @@ function legacyOptions(home) {
         ...(pierHome ? { pierHome } : {}),
     };
 }
-/** A separate cgroup stops Pier, takes a consistent backup, updates the exact
- * npm installation recorded at install time, and always starts Pier again. */
+/** A separate cgroup snapshots the database, updates the exact npm
+ * installation recorded at install time, and only then restarts Pier.
+ *
+ * Both slow steps run while the service is still up, so the downtime is one
+ * stop and one start rather than the ~10s an install takes. The snapshot is
+ * consistent on a live database — `VACUUM INTO` off a read-only connection
+ * (db.ts) — and it still runs from the tree npm is about to replace, so the
+ * copy carries the version whose schema it pairs with. */
 export function renderUpdateUnit(options) {
     const { execPath, npmPath, entry, pierHome, shellPath } = options;
     const cli = join(dirname(entry), "cli.js");
@@ -120,12 +126,16 @@ Type=oneshot
 # resolves node from PATH, and systemd's minimal PATH has no fnm/nvm node —
 # the install then dies with "node: not found" with the tree half written.
 ${environment("PATH", pathEnv(execPath, shellPath))}
-${pierHome ? `${environment("PIER_HOME", pierHome)}\n` : ""}ExecStart=systemctl --user stop ${UNIT_NAME}
-ExecStart=${quote(execPath, true)} ${quote(cli, true)} backup
+${pierHome ? `${environment("PIER_HOME", pierHome)}\n` : ""}ExecStart=${quote(execPath, true)} ${quote(cli, true)} backup
 # npm runs under the recorded node: its shebang needs a node on PATH too.
 ExecStart=${quote(execPath, true)} ${quote(npmPath, true)} install -g @timqi/pier@latest
-# ExecStopPost runs on success and failure, so a failed backup or npm install
-# does not leave the previously working service stopped.
+# Last, because everything above it is downtime the running Pier does not owe
+# anyone. A failed backup or install never gets here: the service stays up on
+# the code it already loaded.
+ExecStart=systemctl --user stop ${UNIT_NAME}
+# ExecStopPost runs on success and failure. After a failed step above, Pier was
+# never stopped and this is a no-op; it is here for the window that is still
+# fatal — the unit dying between that stop and the start of the new version.
 ExecStopPost=systemctl --user start ${UNIT_NAME}
 `;
 }
@@ -300,7 +310,7 @@ export function startUpdate(options) {
     if (!run(["systemctl", "--user", "start", "--no-block", UPDATE_UNIT_NAME]))
         return "failed";
     say(`updating in the background — follow it with: journalctl --user -u ${UPDATE_UNIT_NAME} -f`);
-    say(`Pier stops, snapshots the database into db/backups/, installs, then starts again.`);
+    say(`Pier snapshots the database into db/backups/ and installs while still up, then stops and starts on the new version.`);
     return "started";
 }
 export function uninstall(home = homedir(), say = console.log, exec) {

package/dist/tasks/definitions.js

@@ -247,6 +247,10 @@ export class TaskDefinitions {
         return this.router.stateOf(sessionId) !== undefined ||
             (await this.factory.find(sessionId)) !== undefined;
     }
+    /** A caller's own directory — what a relative or omitted cwd resolves against. */
+    async sessionCwd(sessionId) {
+        return (await this.factory.find(sessionId))?.cwd;
+    }
     /** The guard `ownerOf` exists for, on the three ways a definition changes. */
     assertOwner(task, by, what) {
         const owner = ownerOf(task);