agents-pod 0.1.0 → 0.3.0

package/src/listeners.ts

@@ -11,9 +11,10 @@ import { listenersFile } from "./paths.ts";
 export type ListenerMode = "template" | "pod";
 
 /**
- * A consumed item, by position (ADR 0013): the claim namespace is the inbox, so
- * `inbox` + `item` is the key across listeners. `spawnedPodId` is what the
- * template materialized; `blocked` is a reason materialization will not happen
+ * A consumed item, by position for an inbox or platform id for a Source
+ * (ADRs 0013, 0024): the claim namespace is the origin, so `inbox` + `item` is
+ * the key across listeners. `spawnedPodId` is what the template materialized;
+ * `blocked` is a reason materialization will not happen
  * (a configuration error, or an item that vanished). `appended` is ADR 0014's
  * one boolean for a bound standing pod: the block is in the pod's `## Inbox`.
  * Beyond that the document is the truth — there is no per-item lifecycle.
@@ -21,6 +22,8 @@ export type ListenerMode = "template" | "pod";
 export interface ClaimRecord {
   inbox: string;
   item: string;
+  /** Source claims retain the current and previous successful drain (ADR 0024). */
+  claimedAt?: number;
   spawnedPodId?: string;
   blocked?: string;
   appended?: boolean;
@@ -35,13 +38,16 @@ export interface SeenFact {
 
 export interface ListenerRecord {
   id: string;
-  /** Absolute path: a directory inbox or one append-only JSONL file. */
-  inbox: string;
+  /** Exactly one origin: an absolute inbox path or a Source name (ADR 0024). */
+  inbox?: string;
+  source?: string;
   /** P0's rule: a plain substring; absent means every item matches. */
   match?: string;
   mode: ListenerMode;
   /** Template mode: the goal template file. */
   template?: string;
+  /** Template mode: materialize under this project instead of the tick's cwd (ADR 0007). */
+  project?: string;
   /** Pod mode: the standing pod whose `## Inbox` the items join (ADR 0014). */
   podId?: string;
   maxConcurrent: number;

package/src/outbox.ts

@@ -0,0 +1,294 @@
+import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import {
+  appendFile,
+  mkdir,
+  readFile,
+  readdir,
+  rename,
+  rm,
+  stat,
+  writeFile,
+} from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { cronLogPath, delivererFile, podDir } from "./paths.ts";
+
+/** The single operator delivery command (ADR 0025). */
+export interface DelivererRecord {
+  name: string;
+  cmd: string;
+  timeoutMs: number;
+}
+
+export const OUTBOX_FLUSH_MAX_ENTRIES = 10;
+export const OUTBOX_FLUSH_BUDGET_MS = 10_000;
+export const OUTBOX_DEAD_AFTER_MS = 3_600_000;
+
+export async function readDeliverer(): Promise<DelivererRecord | undefined> {
+  try {
+    const parsed: unknown = JSON.parse(await readFile(delivererFile(), "utf8"));
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)
+      ? (parsed as DelivererRecord)
+      : undefined;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    throw error;
+  }
+}
+
+/** The single record has its own atomic write, beside sources.json (ADR 0025). */
+export async function writeDeliverer(deliverer: DelivererRecord): Promise<void> {
+  const file = delivererFile();
+  await mkdir(dirname(file), { recursive: true });
+  const tmp = `${file}.${randomBytes(4).toString("hex")}.tmp`;
+  await writeFile(tmp, `${JSON.stringify(deliverer, null, 2)}\n`);
+  await rename(tmp, file);
+}
+
+/**
+ * The filename is the uuid's third input, so a later pass can re-derive it
+ * without registry state (ADR 0025, amended by #14). Fifty hex chars fit the
+ * delivery platform's uuid limit.
+ */
+export function outboxUuid(podId: string, wakeup: number, filename: string): string {
+  return createHash("sha256")
+    .update(podId)
+    .update("\0")
+    .update(String(wakeup))
+    .update("\0")
+    .update(filename)
+    .digest("hex")
+    .slice(0, 50);
+}
+
+async function logOutbox(line: string): Promise<void> {
+  const file = cronLogPath();
+  await mkdir(dirname(file), { recursive: true });
+  await appendFile(file, `${line}\n`);
+}
+
+function validEntry(raw: string): boolean {
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return false;
+    const entry = parsed as { to?: unknown; text?: unknown };
+    // The shape is fixed by ADR 0025: two strings, the address and the words.
+    return typeof entry.to === "string" && entry.to !== "" && typeof entry.text === "string";
+  } catch {
+    return false;
+  }
+}
+
+/** Exit 0 is the only acknowledgement; every other outcome leaves the file. */
+async function deliverOne(
+  deliverer: DelivererRecord,
+  podId: string,
+  project: string,
+  wakeup: number,
+  filename: string,
+  raw: string,
+  timeoutMs: number,
+): Promise<string | undefined> {
+  return new Promise((resolve) => {
+    const child = spawn(deliverer.cmd, [], {
+      cwd: project,
+      env: {
+        ...process.env,
+        AGENTS_POD_POD_ID: podId,
+        AGENTS_POD_WAKEUP_N: String(wakeup),
+        AGENTS_POD_OUTBOX_ENTRY: filename,
+        AGENTS_POD_OUTBOX_UUID: outboxUuid(podId, wakeup, filename),
+      },
+      // A delivery command can leave a child behind; its own process group
+      // makes the invocation timeout a hard bound (ADR 0025).
+      detached: true,
+      stdio: ["pipe", "ignore", "ignore"],
+    });
+    const kill = (): void => {
+      if (child.pid === undefined) {
+        child.kill("SIGKILL");
+        return;
+      }
+      try {
+        process.kill(-child.pid, "SIGKILL");
+      } catch {
+        child.kill("SIGKILL");
+      }
+    };
+    let timedOut = false;
+    let spawnError: string | undefined;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      kill();
+    }, timeoutMs);
+    child.on("error", (error) => {
+      spawnError = error.message;
+    });
+    child.on("close", (code, signal) => {
+      clearTimeout(timer);
+      if (timedOut) return resolve(`timed out after ${timeoutMs / 1000}s`);
+      if (spawnError !== undefined) return resolve(spawnError);
+      if (code !== 0) {
+        return resolve(
+          signal === null ? `exit ${code ?? "unknown"}` : `terminated by ${signal}`,
+        );
+      }
+      resolve(undefined);
+    });
+    // A command may exit without reading stdin; that is its exit status, not a
+    // wrapper-level EPIPE failure.
+    child.stdin.on("error", () => undefined);
+    child.stdin.end(raw);
+  });
+}
+
+/** The leading filename field is the entry's immutable wake-up attribution. */
+function entryWakeup(filename: string): number | undefined {
+  const match = /^([1-9]\d*)-/.exec(filename);
+  if (match === null) return undefined;
+  const wakeup = Number(match[1]);
+  return Number.isSafeInteger(wakeup) ? wakeup : undefined;
+}
+
+/** Dead-lettering changes the name, never the contents, and keeps the evidence. */
+async function deadLetter(podId: string, file: string, name: string, reason: string): Promise<void> {
+  try {
+    await rename(file, `${file}.dead`);
+    await logOutbox(`outbox ${podId}: ${name} dead-lettered (${reason}); kept as ${name}.dead`);
+  } catch (error) {
+    await logOutbox(
+      `outbox ${podId}: ${name} dead-letter rename failed (${(error as Error).message}); file kept`,
+    );
+  }
+}
+
+/**
+ * The wrapper and reconcile share one bounded flush (ADR 0025). A wrapper
+ * touches only its own wake-up's entries: older ones belong to pass retries.
+ * A pass derives every uuid from the filename, so retries keep their original
+ * wake-up number. Failures are audit lines, never outcome, policy, or
+ * notification changes.
+ */
+async function flushEntries(
+  podId: string,
+  project: string,
+  currentWakeup?: number,
+): Promise<void> {
+  const dir = join(podDir(project, podId), "outbox");
+  let names: string[];
+  try {
+    names = (await readdir(dir)).filter((name) => name.endsWith(".json")).sort();
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return;
+    await logOutbox(`outbox ${podId}: unreadable (${(error as Error).message})`);
+    return;
+  }
+  if (names.length === 0) return;
+
+  let deliverer: DelivererRecord | undefined;
+  try {
+    deliverer = await readDeliverer();
+  } catch (error) {
+    await logOutbox(`outbox ${podId}: deliverer unreadable (${(error as Error).message})`);
+    return;
+  }
+  // The unconfigured wrapper flush stays a no-op; the pass owns waiting and
+  // aging so each pass can make the missing configuration audible once.
+  if (deliverer === undefined && currentWakeup !== undefined) return;
+
+  const startedAt = Date.now();
+  let invocations = 0;
+  let waiting = 0;
+  for (const name of names) {
+    const elapsed = Date.now() - startedAt;
+    if (
+      deliverer !== undefined &&
+      (invocations >= OUTBOX_FLUSH_MAX_ENTRIES || elapsed >= OUTBOX_FLUSH_BUDGET_MS)
+    ) {
+      return;
+    }
+    const file = join(dir, name);
+    const wakeup = entryWakeup(name);
+    if (wakeup === undefined) {
+      await deadLetter(podId, file, name, "unparseable wake-up");
+      continue;
+    }
+    if (currentWakeup !== undefined) {
+      // An earlier wake-up's failed entry must survive later wrapper flushes;
+      // the pass retries it with the same uuid until the one-hour boundary.
+      if (wakeup < currentWakeup) continue;
+      if (wakeup > currentWakeup) {
+        await deadLetter(podId, file, name, `wake-up ${wakeup} is after ${currentWakeup}`);
+        continue;
+      }
+    }
+
+    const info = await stat(file).catch(() => undefined);
+    if (info === undefined) {
+      await logOutbox(`outbox ${podId}: ${name} unreadable; skipped`);
+      continue;
+    }
+    if (Date.now() - info.mtimeMs > OUTBOX_DEAD_AFTER_MS) {
+      await deadLetter(podId, file, name, "older than one hour");
+      continue;
+    }
+
+    let raw: string;
+    try {
+      raw = await readFile(file, "utf8");
+    } catch (error) {
+      await logOutbox(`outbox ${podId}: ${name} unreadable (${(error as Error).message}); skipped`);
+      continue;
+    }
+    if (!validEntry(raw)) {
+      await deadLetter(podId, file, name, "invalid entry (expected JSON with to and text)");
+      continue;
+    }
+    if (deliverer === undefined) {
+      waiting += 1;
+      continue;
+    }
+
+    const remainingMs = OUTBOX_FLUSH_BUDGET_MS - (Date.now() - startedAt);
+    if (remainingMs <= 0) return;
+    invocations += 1;
+    const error = await deliverOne(
+      deliverer,
+      podId,
+      project,
+      wakeup,
+      name,
+      raw,
+      Math.min(deliverer.timeoutMs, remainingMs),
+    );
+    if (error === undefined) {
+      try {
+        // Deletion is the acknowledgement; no completion marker exists.
+        await rm(file, { force: true });
+      } catch (deleteError) {
+        await logOutbox(
+          `outbox ${podId}: ${name} delivered but delete failed (${(deleteError as Error).message})`,
+        );
+      }
+    } else {
+      await logOutbox(`outbox ${podId}: ${name} delivery failed (${error}); file kept`);
+    }
+  }
+  if (deliverer === undefined && waiting > 0) {
+    await logOutbox(`outbox ${podId}: no deliverer configured; ${waiting} entries waiting`);
+  }
+}
+
+/** Flush this wake-up's outbox after adjudication and before idle (ADR 0025). */
+export async function flushOutbox(
+  podId: string,
+  project: string,
+  wakeup: number,
+): Promise<void> {
+  await flushEntries(podId, project, wakeup);
+}
+
+/** Retry one non-active Pod's outbox during reconcile (ADR 0025). */
+export async function retryOutbox(podId: string, project: string): Promise<void> {
+  await flushEntries(podId, project);
+}

package/src/paths.ts

@@ -31,6 +31,16 @@ export function listenersFile(): string {
   return join(storeRoot(), "listeners.json");
 }
 
+/** Sources and their committed cursors, beside rather than inside the registry (ADR 0024). */
+export function sourcesFile(): string {
+  return join(storeRoot(), "sources.json");
+}
+
+/** The single outbound delivery command, beside the Source records (ADR 0025). */
+export function delivererFile(): string {
+  return join(storeRoot(), "deliverer.json");
+}
+
 /** The pass's single-flight advisory lock, one for the whole registry (ADR 0018). */
 export function reconcileLockPath(): string {
   return join(storeRoot(), "reconcile.lock");
@@ -46,6 +56,11 @@ export function notifyConfigFile(): string {
   return join(storeRoot(), "config.json");
 }
 
+/** When the last pass finished (ADR 0027): "no pass ever ran" is its own fact. */
+export function lastPassFile(): string {
+  return join(storeRoot(), "last-pass.json");
+}
+
 /** The short-lived registry mutex that makes state transitions CAS (ADR 0017, 0018). */
 export function registryLockPath(): string {
   return join(storeRoot(), "registry.lock");

package/src/sources.ts

@@ -0,0 +1,312 @@
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import type { BadInboxLine, InboxItem } from "./inbox.ts";
+import type { ListenerRecord } from "./listeners.ts";
+import { sourcesFile } from "./paths.ts";
+
+/** A Source outlives its Listeners; its opaque cursor lives beside them (ADR 0024). */
+export interface SourceRecord {
+  name: string;
+  cmd: string;
+  timeoutMs: number;
+  cursor?: string;
+  /** The previous successful drain is the claim-retention horizon (ADR 0024). */
+  lastDrainAt?: number;
+  /**
+   * That drain's yield (ADR 0027): zero is a fact, not a gap — a pull that runs
+   * and delivers nothing is the shape of a conversation that never reaches it.
+   */
+  lastDrainItems?: number;
+  /** A failed drain's fact (ADR 0027): a report cannot say `ok` while every pass fails. */
+  lastFailureAt?: number;
+  lastError?: string;
+}
+
+export interface SourceDrain {
+  name: string;
+  items: InboxItem[];
+  bad: BadInboxLine[];
+  cursor?: string;
+  /** Successful drains carry their generation and the preceding one's boundary. */
+  drainedAt?: number;
+  previousDrainAt?: number;
+  /** A failed drain contributes nothing and leaves the cursor untouched. */
+  error?: string;
+}
+
+/** One MiB is the whole successful stdout budget (ADR 0024). */
+export const DRAIN_STDOUT_CAP = 1024 * 1024;
+
+export async function readSources(): Promise<SourceRecord[]> {
+  try {
+    const parsed: unknown = JSON.parse(await readFile(sourcesFile(), "utf8"));
+    return Array.isArray(parsed) ? (parsed as SourceRecord[]) : [];
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return [];
+    throw error;
+  }
+}
+
+/** The cursor's own atomic write, separate from listeners.json (ADR 0024). */
+export async function writeSources(sources: SourceRecord[]): Promise<void> {
+  const file = sourcesFile();
+  await mkdir(dirname(file), { recursive: true });
+  const tmp = `${file}.${randomBytes(4).toString("hex")}.tmp`;
+  await writeFile(tmp, `${JSON.stringify(sources, null, 2)}\n`);
+  await rename(tmp, file);
+}
+
+function routingField(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  return trimmed === "" ? undefined : trimmed;
+}
+
+/** A stream item is complete when its line parses; no two-pass guard applies. */
+export function parseDrainOutput(name: string, text: string): SourceDrain {
+  const items: InboxItem[] = [];
+  const bad: BadInboxLine[] = [];
+  let cursor: string | undefined;
+  const lines = text.split("\n")
+    .map((raw, index) => ({ raw, line: index + 1 }))
+    .filter(({ raw }) => raw.trim() !== "");
+
+  for (let index = 0; index < lines.length; index += 1) {
+    const { raw, line } = lines[index]!;
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      bad.push({ line, reason: "invalid JSON" });
+      continue;
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      bad.push({ line, reason: "invalid JSON (not an object)" });
+      continue;
+    }
+    const record = parsed as {
+      id?: unknown;
+      body?: unknown;
+      title?: unknown;
+      cursor?: unknown;
+      chat_id?: unknown;
+      root_id?: unknown;
+      thread_id?: unknown;
+    };
+    if (
+      index === lines.length - 1 &&
+      "cursor" in record &&
+      record.id === undefined &&
+      record.body === undefined
+    ) {
+      if (typeof record.cursor !== "string") {
+        bad.push({ line, reason: "invalid cursor" });
+      } else {
+        cursor = record.cursor;
+      }
+      continue;
+    }
+    if (typeof record.id !== "string" || record.id.trim() === "") {
+      bad.push({ line, reason: "no id" });
+      continue;
+    }
+    if (typeof record.body !== "string") {
+      bad.push({ line, reason: "no body" });
+      continue;
+    }
+    const title =
+      typeof record.title === "string" && record.title.trim() !== ""
+        ? record.title
+        : record.body.split("\n", 1)[0]!.trim();
+    const chatId = routingField(record.chat_id);
+    const rootId = routingField(record.root_id);
+    const threadId = routingField(record.thread_id);
+    items.push({
+      id: record.id,
+      title,
+      body: record.body,
+      path: "",
+      mtimeMs: 0,
+      size: 0,
+      ...(chatId === undefined ? {} : { chatId }),
+      ...(rootId === undefined ? {} : { rootId }),
+      ...(threadId === undefined ? {} : { threadId }),
+    });
+  }
+  return { name, items, bad, ...(cursor === undefined ? {} : { cursor }) };
+}
+
+async function drainOne(source: SourceRecord, project: string): Promise<SourceDrain> {
+  const empty = { name: source.name, items: [], bad: [] };
+  const result = await new Promise<{ stdout?: string; error?: string }>((resolve) => {
+    const child = spawn(source.cmd, [], {
+      cwd: project,
+      env: {
+        ...process.env,
+        AGENTS_POD_SOURCE_ID: source.name,
+        AGENTS_POD_CURSOR: source.cursor ?? "",
+      },
+      // A shell drain can leave a child holding stdout after the shell dies.
+      // Its own process group makes the timeout and output cap real bounds.
+      detached: true,
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    const kill = (): void => {
+      if (child.pid === undefined) {
+        child.kill("SIGKILL");
+        return;
+      }
+      try {
+        process.kill(-child.pid, "SIGKILL");
+      } catch {
+        child.kill("SIGKILL");
+      }
+    };
+    const chunks: Buffer[] = [];
+    let bytes = 0;
+    let oversized = false;
+    let timedOut = false;
+    let spawnError: string | undefined;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      kill();
+    }, source.timeoutMs);
+
+    child.stdout.on("data", (chunk: Buffer) => {
+      bytes += chunk.length;
+      if (bytes > DRAIN_STDOUT_CAP) {
+        if (!oversized) {
+          oversized = true;
+          kill();
+        }
+        return;
+      }
+      chunks.push(chunk);
+    });
+    child.on("error", (error) => {
+      spawnError = error.message;
+    });
+    child.on("close", (code, signal) => {
+      clearTimeout(timer);
+      if (oversized) return resolve({ error: "stdout exceeded 1 MiB" });
+      if (timedOut) return resolve({ error: `timed out after ${source.timeoutMs / 1000}s` });
+      if (spawnError !== undefined) return resolve({ error: spawnError });
+      if (code !== 0) {
+        return resolve({
+          error: signal === null ? `exit ${code ?? "unknown"}` : `terminated by ${signal}`,
+        });
+      }
+      resolve({ stdout: Buffer.concat(chunks).toString("utf8") });
+    });
+  });
+  if (result.error !== undefined) return { ...empty, error: result.error };
+  // Distinct generations need distinct boundaries even when two local drains
+  // finish within one wall-clock millisecond.
+  const drainedAt = Math.max(Date.now(), (source.lastDrainAt ?? 0) + 1);
+  return {
+    ...parseDrainOutput(source.name, result.stdout ?? ""),
+    drainedAt,
+    ...(source.lastDrainAt === undefined ? {} : { previousDrainAt: source.lastDrainAt }),
+  };
+}
+
+/** Drain each distinct Source once, before the registry lock or any Pod work (ADR 0024). */
+export async function drainSources(
+  project: string,
+  listeners: ListenerRecord[],
+): Promise<SourceDrain[]> {
+  const sources = await readSources();
+  const names = [...new Set(listeners.flatMap((listener) => listener.source ?? []))];
+  const drained: SourceDrain[] = [];
+  for (const name of names) {
+    const source = sources.find((candidate) => candidate.name === name);
+    drained.push(
+      source === undefined
+        ? { name, items: [], bad: [], error: "source record is missing" }
+        : await drainOne(source, project),
+    );
+  }
+  return drained;
+}
+
+/**
+ * Two generations are enough: after this drain, anything older than the prior
+ * successful one is behind the committed cursor and cannot arrive again. The
+ * store is transformed without I/O; the caller writes it inside the registry
+ * lock before advancing the Source records (ADR 0024). Legacy claims without a
+ * timestamp are retained because their generation cannot be proven.
+ */
+export function pruneSourceClaims(
+  listeners: ListenerRecord[],
+  drained: SourceDrain[],
+): { listeners: ListenerRecord[]; changed: boolean } {
+  const horizons = new Map<string, number>();
+  for (const drain of drained) {
+    if (drain.error === undefined && drain.previousDrainAt !== undefined) {
+      horizons.set(`source:${drain.name}`, drain.previousDrainAt);
+    }
+  }
+  if (horizons.size === 0) return { listeners, changed: false };
+
+  let changed = false;
+  const pruned = listeners.map((listener) => {
+    const claimed = listener.claimed.filter((claim) => {
+      const horizon = horizons.get(claim.inbox);
+      return (
+        horizon === undefined || claim.claimedAt === undefined || claim.claimedAt >= horizon
+      );
+    });
+    if (claimed.length === listener.claimed.length) return listener;
+    changed = true;
+    return { ...listener, claimed };
+  });
+  return { listeners: pruned, changed };
+}
+
+/** Claims and pruning land before this cursor/retention-horizon write (ADR 0024). */
+export async function commitSourceCursors(drained: SourceDrain[]): Promise<void> {
+  const sources = await readSources();
+  let changed = false;
+  for (const drain of drained) {
+    if (drain.error !== undefined || drain.drainedAt === undefined) continue;
+    const source = sources.find((candidate) => candidate.name === drain.name);
+    if (source === undefined) continue;
+    if (drain.cursor !== undefined && source.cursor !== drain.cursor) {
+      source.cursor = drain.cursor;
+      changed = true;
+    }
+    if (source.lastDrainAt !== drain.drainedAt) {
+      source.lastDrainAt = drain.drainedAt;
+      changed = true;
+    }
+    // The yield is recorded even when it is zero (ADR 0027): doctor reports a
+    // silent pull only because the count exists.
+    if (source.lastDrainItems !== drain.items.length) {
+      source.lastDrainItems = drain.items.length;
+      changed = true;
+    }
+    // A success clears the failure it disproved (ADR 0027).
+    if (source.lastError !== undefined) {
+      delete source.lastError;
+      delete source.lastFailureAt;
+      changed = true;
+    }
+  }
+  if (changed) await writeSources(sources);
+}
+
+/**
+ * A failed drain leaves the cursor and the yield alone, so its only trace is a
+ * `cron.log` line — invisible to anyone not tailing the log. The record keeps
+ * the fact for the report (ADR 0027), and a later success clears it.
+ */
+export async function recordSourceFailure(name: string, error: string): Promise<void> {
+  const sources = await readSources();
+  const source = sources.find((candidate) => candidate.name === name);
+  if (source === undefined) return;
+  source.lastFailureAt = Date.now();
+  source.lastError = error;
+  await writeSources(sources);
+}