@ours.network/fleet 0.11.0 → 0.12.0

package/dist/owner-channel/channel.d.ts

@@ -0,0 +1,55 @@
+import { type ChildProcessWithoutNullStreams } from 'node:child_process';
+import type { OwnerChannelConfig } from '../config.js';
+import type { SessionHandle } from '../session/types.js';
+import { type OursToolClient } from './mcp.js';
+export interface OwnerChannelOptions {
+    role: string;
+    config: OwnerChannelConfig;
+    session: SessionHandle;
+    stateDir: string;
+    env?: Record<string, string>;
+    command?: string;
+    log(line: string): void;
+    client?: OursToolClient;
+    /** Test seam; production uses `ours-mcp watch <identity>`. */
+    watch?: (identity: string) => ChildProcessWithoutNullStreams;
+}
+export interface OwnerChannelHandle {
+    start(): Promise<void>;
+    drain(): Promise<void>;
+    close(): Promise<void>;
+}
+/**
+ * Fleet-owned trusted ingress. The agent never binds this identity and never
+ * chooses its reply recipient; both are fixed from authenticated message data.
+ */
+export declare class OwnerChannel implements OwnerChannelHandle {
+    private readonly options;
+    private readonly client;
+    private readonly state;
+    private stopping;
+    private watchProcess?;
+    private watchTask?;
+    private drainTask?;
+    private drainRequested;
+    private readonly inFlight;
+    private readonly completionTasks;
+    constructor(options: OwnerChannelOptions);
+    start(): Promise<void>;
+    drain(): Promise<void>;
+    close(): Promise<void>;
+    private drainAll;
+    private handle;
+    private complete;
+    private ownerPrompt;
+    private outboxDir;
+    private send;
+    private sendAttachments;
+    /** Bound message size without splitting Unicode code points. */
+    private sendFinal;
+    private wireId;
+    private sender;
+    private watchLoop;
+    private errorText;
+    private logError;
+}

package/dist/owner-channel/channel.js

@@ -0,0 +1,295 @@
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { mkdir, readdir, rm } from 'node:fs/promises';
+import { createInterface } from 'node:readline';
+import { join } from 'node:path';
+import { OursMcpClient } from './mcp.js';
+import { OwnerChannelState } from './state.js';
+/**
+ * Fleet-owned trusted ingress. The agent never binds this identity and never
+ * chooses its reply recipient; both are fixed from authenticated message data.
+ */
+export class OwnerChannel {
+    options;
+    client;
+    state;
+    stopping = false;
+    watchProcess;
+    watchTask;
+    drainTask;
+    drainRequested = false;
+    inFlight = new Set();
+    completionTasks = new Set();
+    constructor(options) {
+        this.options = options;
+        this.client = options.client ?? new OursMcpClient(options.command, options.env, line => options.log(`[${options.role}] owner channel ${line}`));
+        this.state = new OwnerChannelState(join(options.stateDir, '.owner-channel-state.json'));
+    }
+    async start() {
+        this.stopping = false;
+        await this.client.start();
+        await this.client.callTool('choose_identity', { name: this.options.config.identity });
+        this.watchTask = this.watchLoop();
+        // Do not make role startup wait for an old owner request to finish a turn.
+        void this.drain().catch(error => this.logError('initial drain failed', error));
+    }
+    drain() {
+        this.drainRequested = true;
+        if (this.drainTask)
+            return this.drainTask;
+        this.drainTask = (async () => {
+            while (this.drainRequested && !this.stopping) {
+                this.drainRequested = false;
+                await this.drainAll();
+            }
+        })().finally(() => { this.drainTask = undefined; });
+        return this.drainTask;
+    }
+    async close() {
+        this.stopping = true;
+        const watch = this.watchProcess;
+        this.watchProcess = undefined;
+        if (watch && watch.exitCode === null)
+            watch.kill('SIGTERM');
+        await this.client.close();
+    }
+    async drainAll() {
+        // A finite cap protects the supervisor if a broken daemon repeats unread
+        // messages forever. A watch notification will resume draining later.
+        for (let pass = 0; pass < 100 && !this.stopping; pass++) {
+            const raw = await this.client.callTool('get_messages');
+            const messages = Array.isArray(raw?.messages)
+                ? raw.messages.filter(message => message && typeof message === 'object')
+                : [];
+            if (!messages.length)
+                return;
+            // get_messages marks the batch processed. Requeue allowed, unhandled
+            // inputs before executing them so a mid-turn process crash can replay.
+            const deferred = messages.filter(message => {
+                const wireId = this.wireId(message);
+                return wireId && !this.state.has(wireId)
+                    && this.options.config.owners.includes(this.sender(message).id)
+                    && Number.isInteger(message.msg_id);
+            }).map(message => message.msg_id);
+            if (deferred.length)
+                await this.client.callTool('defer_messages', { msg_ids: deferred });
+            let advanced = false;
+            for (const message of messages)
+                advanced = await this.handle(message) || advanced;
+            // Deferred in-flight messages are intentionally visible again until
+            // their correlated response is delivered. Do not spin on those replay
+            // copies; a new watch event or completion-triggered drain will resume.
+            if (!advanced)
+                return;
+        }
+        this.options.log(`[${this.options.role}] owner channel drain capped at 100 batches`);
+    }
+    async handle(message) {
+        const wireId = this.wireId(message);
+        if (!wireId || this.state.has(wireId) || this.inFlight.has(wireId))
+            return false;
+        const sender = this.sender(message);
+        if (!this.options.config.owners.includes(sender.id)) {
+            // Do not answer an unauthorized sender and thereby disclose that this is
+            // a privileged control address. Authenticated CID, never display name or
+            // message wording, is the authority boundary.
+            this.options.log(`[${this.options.role}] owner channel ignored unauthorized sender ${sender.id || '<unknown>'}`);
+            this.state.remember(wireId);
+            return true;
+        }
+        const text = String(message.text ?? '').trim();
+        if (text.toLowerCase() === '/status') {
+            const snapshot = this.options.session.snapshot();
+            await this.send(sender.id, `[fleet] ${this.options.role}: ${snapshot.readiness}; `
+                + `${snapshot.alive ? 'session alive' : 'session offline'}.`, wireId);
+            this.state.remember(wireId);
+            return true;
+        }
+        if (text.toLowerCase() === '/interrupt') {
+            await this.options.session.interrupt();
+            await this.send(sender.id, `[fleet] Interrupted ${this.options.role}'s active turn.`, wireId);
+            this.state.remember(wireId);
+            return true;
+        }
+        const outbox = this.outboxDir(wireId);
+        await mkdir(outbox, { recursive: true, mode: 0o700 });
+        let queued;
+        try {
+            queued = await this.options.session.queuePrompt(this.ownerPrompt(sender, text, wireId, outbox), {
+                interrupt: this.options.config.interrupt,
+            });
+        }
+        catch (error) {
+            await rm(outbox, { recursive: true, force: true });
+            await this.send(sender.id, `[fleet] Could not deliver this request: ${this.errorText(error)}.`, wireId);
+            this.state.remember(wireId);
+            return true;
+        }
+        const accepted = this.options.config.interrupt
+            ? "ℹ️ Message received. The agent's previous task was interrupted to prioritize "
+                + 'this request, and it is now working on a response. '
+                + 'The response will arrive in this channel when ready.'
+            : queued.queuedBehind > 0
+                ? `ℹ️ Message received. The agent is finishing ${queued.queuedBehind} earlier `
+                    + 'request(s) first; this request will start as soon as they complete. '
+                    + 'The response will arrive in this channel when ready.'
+                : 'ℹ️ Message received. The agent has started working on this request now. '
+                    + 'The response will arrive in this channel when ready.';
+        this.inFlight.add(wireId);
+        const task = this.complete(sender.id, wireId, outbox, accepted, queued.completion)
+            .catch(error => this.logError(`request ${wireId} completion failed`, error))
+            .finally(() => {
+            this.inFlight.delete(wireId);
+            this.completionTasks.delete(task);
+            if (!this.stopping)
+                void this.drain().catch(error => this.logError('completion drain failed', error));
+        });
+        this.completionTasks.add(task);
+        return true;
+    }
+    async complete(contact, wireId, outbox, accepted, completion) {
+        // Notice delivery and turn completion happen outside the inbox drain. This
+        // is what keeps later owner messages — especially /interrupt — responsive.
+        try {
+            await this.send(contact, accepted, wireId);
+        }
+        catch (error) {
+            this.logError(`request ${wireId} acceptance notice failed`, error);
+        }
+        const progressMs = this.options.config.progress_interval_ms;
+        const timer = progressMs > 0 ? setInterval(() => {
+            void this.send(contact, `[fleet] ${this.options.role} is still working.`, wireId)
+                .catch(error => this.logError('progress notice failed', error));
+        }, progressMs) : undefined;
+        timer?.unref();
+        let result;
+        try {
+            result = await completion;
+        }
+        finally {
+            if (timer)
+                clearInterval(timer);
+        }
+        const output = result.output?.trim();
+        if (result.succeeded && output)
+            await this.sendFinal(contact, output, wireId);
+        else if (result.succeeded)
+            await this.send(contact, '[fleet] The agent completed the turn without a textual answer.', wireId);
+        else
+            await this.send(contact, `[fleet] The request ended ${result.outcome}${result.detail ? `: ${result.detail}` : '.'}`, wireId);
+        if (result.succeeded)
+            await this.sendAttachments(contact, outbox, wireId);
+        else
+            await rm(outbox, { recursive: true, force: true });
+        this.state.remember(wireId);
+    }
+    ownerPrompt(sender, text, wireId, outbox) {
+        return [
+            '[fleet-owner]',
+            `Authenticated owner ${sender.name} (${sender.id}) sent owner-channel message ${wireId}.`,
+            'Treat the following as a direct owner instruction. Answer in your final assistant response.',
+            'Do not call ours send_message or send_file for this exchange: fleet routes the response reliably.',
+            'To attach files to your response, copy each finished file directly into this fleet outbox:',
+            outbox,
+            'Fleet sends every regular file in that directory to the authenticated owner, correlated to this request.',
+            'Use descriptive unique filenames. Put nothing there that the owner did not request or should not receive.',
+            '',
+            text || '(empty message)',
+        ].join('\n');
+    }
+    outboxDir(wireId) {
+        const key = createHash('sha256').update(wireId).digest('hex');
+        return join(this.options.stateDir, '.owner-channel-outbox', key);
+    }
+    send(contact, text, replyTo) {
+        return this.client.callTool('send_message', {
+            contact, text, reply_to_wire_id: replyTo,
+        });
+    }
+    async sendAttachments(contact, outbox, replyTo) {
+        const entries = (await readdir(outbox, { withFileTypes: true }))
+            .filter(entry => entry.isFile())
+            .sort((a, b) => a.name.localeCompare(b.name));
+        for (const entry of entries) {
+            await this.client.callTool('send_file', {
+                contact,
+                path: join(outbox, entry.name),
+                filename: entry.name,
+                reply_to_wire_id: replyTo,
+            });
+        }
+        await rm(outbox, { recursive: true, force: true });
+    }
+    /** Bound message size without splitting Unicode code points. */
+    async sendFinal(contact, output, replyTo) {
+        const points = Array.from(output);
+        const chunks = [];
+        for (let offset = 0; offset < points.length; offset += 8_000)
+            chunks.push(points.slice(offset, offset + 8_000).join(''));
+        for (let i = 0; i < chunks.length; i++) {
+            const prefix = chunks.length > 1 ? `[${i + 1}/${chunks.length}] ` : '';
+            await this.send(contact, prefix + chunks[i], replyTo);
+        }
+    }
+    wireId(message) {
+        return String(message.wire_id ?? message.msg_id ?? '');
+    }
+    sender(message) {
+        const source = message.from ?? message.sender;
+        if (typeof source === 'string')
+            return { id: source, name: source };
+        const id = String(source?.id ?? message.sender_id ?? '');
+        return { id, name: String(source?.name ?? message.sender_name ?? id) };
+    }
+    async watchLoop() {
+        let delayMs = 1_000;
+        while (!this.stopping) {
+            try {
+                const child = this.options.watch?.(this.options.config.identity) ?? spawn(this.options.command ?? 'ours-mcp', ['watch', this.options.config.identity], {
+                    env: { ...process.env, ...(this.options.env ?? {}) }, stdio: ['pipe', 'pipe', 'pipe'],
+                });
+                this.watchProcess = child;
+                await new Promise((resolve, reject) => {
+                    if (child.pid) {
+                        resolve();
+                        return;
+                    }
+                    child.once('spawn', resolve);
+                    child.once('error', reject);
+                });
+                createInterface({ input: child.stderr }).on('line', line => this.options.log(`[${this.options.role}] owner watch: ${line}`));
+                delayMs = 1_000;
+                // Drain at every (re)attachment, not only after a future notification:
+                // a failed send/turn leaves the input deferred and may not emit another
+                // watch line by itself.
+                await this.drain();
+                for await (const _line of createInterface({ input: child.stdout })) {
+                    if (this.stopping)
+                        break;
+                    await this.drain();
+                }
+                if (!this.stopping)
+                    throw new Error('watch exited');
+            }
+            catch (error) {
+                if (!this.stopping) {
+                    this.logError('watch failed; retrying', error);
+                    await new Promise(resolve => setTimeout(resolve, delayMs));
+                    delayMs = Math.min(delayMs * 2, 30_000);
+                }
+            }
+            finally {
+                const child = this.watchProcess;
+                this.watchProcess = undefined;
+                if (child && child.exitCode === null)
+                    child.kill('SIGTERM');
+            }
+        }
+    }
+    errorText(error) {
+        return error?.message ?? String(error);
+    }
+    logError(context, error) {
+        this.options.log(`[${this.options.role}] owner channel ${context}: ${this.errorText(error)}`);
+    }
+}

package/dist/owner-channel/mcp.d.ts

@@ -0,0 +1,24 @@
+export declare class OursMcpError extends Error {
+}
+export interface OursToolClient {
+    start(): Promise<void>;
+    callTool(name: string, args?: Record<string, unknown>): Promise<unknown>;
+    close(): Promise<void>;
+}
+/** Minimal MCP stdio client. One instance owns exactly one ours identity binding. */
+export declare class OursMcpClient implements OursToolClient {
+    private readonly command;
+    private readonly env;
+    private readonly log;
+    private child?;
+    private nextId;
+    private tail;
+    constructor(command?: string, env?: Record<string, string>, log?: (line: string) => void);
+    start(): Promise<void>;
+    callTool(name: string, args?: Record<string, unknown>): Promise<unknown>;
+    close(): Promise<void>;
+    private request;
+    private requestNow;
+    private notify;
+    private write;
+}

package/dist/owner-channel/mcp.js

@@ -0,0 +1,123 @@
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { createInterface } from 'node:readline';
+export class OursMcpError extends Error {
+}
+/** Minimal MCP stdio client. One instance owns exactly one ours identity binding. */
+export class OursMcpClient {
+    command;
+    env;
+    log;
+    child;
+    nextId = 0;
+    tail = Promise.resolve();
+    constructor(command = 'ours-mcp', env = {}, log = () => undefined) {
+        this.command = command;
+        this.env = env;
+        this.log = log;
+    }
+    async start() {
+        if (this.child && this.child.exitCode === null)
+            return;
+        const child = spawn(this.command, ['proxy'], {
+            env: {
+                ...process.env,
+                ...this.env,
+                // Bindings are keyed by this value. Sharing it would silently rebind a
+                // role's normal mailbox or another owner channel.
+                CLAUDE_CODE_SESSION_ID: `ours-fleet-owner-${process.pid}-${randomUUID()}`,
+            },
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        await new Promise((resolve, reject) => {
+            child.once('spawn', resolve);
+            child.once('error', reject);
+        });
+        this.child = child;
+        child.stdin.on('error', error => this.log(`ours-mcp stdin: ${error.message}`));
+        createInterface({ input: child.stderr }).on('line', line => this.log(`ours-mcp: ${line}`));
+        try {
+            await this.request('initialize', {
+                protocolVersion: '2025-03-26', capabilities: {},
+                clientInfo: { name: 'ours-fleet-owner-channel', version: '1' },
+            });
+            await this.notify('notifications/initialized', {});
+        }
+        catch (error) {
+            await this.close();
+            throw error;
+        }
+    }
+    async callTool(name, args = {}) {
+        const result = await this.request('tools/call', { name, arguments: args });
+        const text = (result.content ?? [])
+            .filter(item => item.type === 'text').map(item => item.text ?? '').join('\n').trim();
+        if (result.isError)
+            throw new OursMcpError(text || `ours tool ${name} failed`);
+        if (result.structuredContent !== undefined)
+            return result.structuredContent;
+        if (!text)
+            return {};
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return text;
+        }
+    }
+    async close() {
+        const child = this.child;
+        this.child = undefined;
+        if (!child || child.exitCode !== null)
+            return;
+        child.kill('SIGTERM');
+        await new Promise(resolve => {
+            const timer = setTimeout(() => { child.kill('SIGKILL'); resolve(); }, 5_000);
+            child.once('exit', () => { clearTimeout(timer); resolve(); });
+        });
+    }
+    request(method, params) {
+        const run = this.tail.then(() => this.requestNow(method, params));
+        this.tail = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    async requestNow(method, params) {
+        const child = this.child;
+        if (!child || child.exitCode !== null)
+            throw new OursMcpError('ours-mcp proxy is not running');
+        const id = ++this.nextId;
+        await this.write(child, { jsonrpc: '2.0', id, method, params });
+        const lines = createInterface({ input: child.stdout, crlfDelay: Infinity });
+        try {
+            for await (const line of lines) {
+                let response;
+                try {
+                    response = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                if (response.id !== id)
+                    continue;
+                if (response.error !== undefined)
+                    throw new OursMcpError(JSON.stringify(response.error));
+                return response.result ?? {};
+            }
+            throw new OursMcpError('ours-mcp proxy closed its output');
+        }
+        finally {
+            lines.close();
+        }
+    }
+    async notify(method, params) {
+        const child = this.child;
+        if (!child || child.exitCode !== null)
+            throw new OursMcpError('ours-mcp proxy is not running');
+        await this.write(child, { jsonrpc: '2.0', method, params });
+    }
+    write(child, value) {
+        return new Promise((resolve, reject) => {
+            child.stdin.write(JSON.stringify(value) + '\n', error => error ? reject(error) : resolve());
+        });
+    }
+}

package/dist/owner-channel/state.d.ts

@@ -0,0 +1,10 @@
+/** Durable bounded dedupe containing wire IDs only — never message or reply plaintext. */
+export declare class OwnerChannelState {
+    private readonly path;
+    private readonly limit;
+    private handled;
+    private readonly seen;
+    constructor(path: string, limit?: number);
+    has(wireId: string): boolean;
+    remember(wireId: string): void;
+}

package/dist/owner-channel/state.js

@@ -0,0 +1,37 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+/** Durable bounded dedupe containing wire IDs only — never message or reply plaintext. */
+export class OwnerChannelState {
+    path;
+    limit;
+    handled = [];
+    seen = new Set();
+    constructor(path, limit = 5_000) {
+        this.path = path;
+        this.limit = limit;
+        try {
+            if (!existsSync(path))
+                return;
+            const state = JSON.parse(readFileSync(path, 'utf8'));
+            if (state.version !== 1 || !Array.isArray(state.handled))
+                return;
+            this.handled = state.handled.filter(id => typeof id === 'string').slice(-limit);
+            for (const id of this.handled)
+                this.seen.add(id);
+        }
+        catch { /* a corrupt cache safely degrades to at-least-once delivery */ }
+    }
+    has(wireId) { return this.seen.has(wireId); }
+    remember(wireId) {
+        if (this.seen.has(wireId))
+            return;
+        this.handled.push(wireId);
+        this.seen.add(wireId);
+        while (this.handled.length > this.limit)
+            this.seen.delete(this.handled.shift());
+        mkdirSync(dirname(this.path), { recursive: true });
+        const tmp = `${this.path}.tmp-${process.pid}`;
+        writeFileSync(tmp, JSON.stringify({ version: 1, handled: this.handled }) + '\n', { mode: 0o600 });
+        renameSync(tmp, this.path);
+    }
+}

package/dist/resolved-plan.js

@@ -26,6 +26,7 @@ export function resolvedPlan(cfg) {
             harness: w.harness, session: w.session, model: w.model ?? null,
             identity: w.identity, timeoutMs: w.timeoutMs, keepReports: w.keepReports,
             alertCooldownMs: w.alertCooldownMs, promptFile: w.promptFile ?? null,
+            isolation: w.isolation ?? null,
         })),
     };
 }
@@ -59,6 +60,7 @@ export function resolvedRolePlan(role) {
             ],
         },
         monitor: role.monitor,
+        ownerChannel: role.owner_channel ?? null,
         isolation: role.isolation ?? null,
         worklog: role.worklog ?? null,
         authProxy: role.auth_proxy ?? null,

package/dist/runner.d.ts

@@ -4,6 +4,7 @@ import { Tmux } from './tmux.js';
 import { type MonitorHandle, type MonitorOpts, type FetchLike } from './monitor.js';
 import { type Exec } from './exec.js';
 import type { ExitRecord } from './session/types.js';
+import { type OwnerChannelHandle, type OwnerChannelOptions } from './owner-channel/channel.js';
 export interface RunnerDeps {
     tmux: Tmux;
     exec: Exec;
@@ -16,6 +17,8 @@ export interface RunnerDeps {
     fetch: FetchLike;
     /** Construct the supervisor mail monitor (injectable so tests stub it out). */
     createMonitor(opts: MonitorOpts): MonitorHandle;
+    /** Construct trusted owner ingress (injectable for lifecycle tests). */
+    createOwnerChannel(opts: OwnerChannelOptions): OwnerChannelHandle;
     /** Lets a test (or a shutdown path) end the supervised restart loop. */
     shouldStop?(): boolean;
 }

package/dist/runner.js

@@ -11,12 +11,14 @@ import { realExec, shq } from './exec.js';
 import { resolveIsolation } from './isolation/policy.js';
 import { selectIsolationBackend } from './isolation/registry.js';
 import { resourceArgs, cpuControllerDelegated } from './isolation/resources.js';
+import { resolveLaunchRuntime } from './isolation/runtime.js';
 import { AcpSession } from './session/acp.js';
 import { RoleControlServer } from './session/control.js';
 import { TmuxSession } from './session/tmux.js';
 import { classifyShellStatus } from './session/types.js';
 import { effectiveModelForRole, modelRecoveryHeld, reconcileModelRecovery, recordModelFailure, classifyFailureText, } from './model-recovery.js';
 import { rotateWorklog } from './worklog.js';
+import { OwnerChannel } from './owner-channel/channel.js';
 const defaultDeps = () => ({
     tmux: new Tmux(),
     exec: realExec,
@@ -33,6 +35,7 @@ const defaultDeps = () => ({
     log: line => process.stderr.write(line + '\n'),
     fetch: (url, init) => globalThis.fetch(url, init),
     createMonitor: opts => createMonitor(opts),
+    createOwnerChannel: opts => new OwnerChannel(opts),
 });
 const MONITOR_OWNER_FILE = '.monitor-owner';
 /**
@@ -319,7 +322,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     const runCwd = role.cwd && existsSync(role.cwd) ? role.cwd : dir;
     const prep = await adapter.prepareSession(role, { stateDir: dir, runCwd });
     const sessionBackend = role.session ?? 'tmux';
-    const launch = sessionBackend === 'acp'
+    let launch = sessionBackend === 'acp'
         ? (() => {
             if (!adapter.buildAcpLaunch)
                 throw new Error(`harness '${role.harness}' does not support the ACP session backend`);
@@ -330,10 +333,15 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     // env prefix + exit capture in buildPaneCommand stay host-side (see §5.3).
     let wrappedArgv = launch.argv;
     if (role.isolation) {
-        // The SAME context config validation and doctor judged (5.2): a policy
-        // checked against a different mount set than the one that launches is not a
-        // check at all.
-        const ctx = { ...isolationContextFor(role), stateDir: dir, runCwd };
+        // Start with the SAME durable context config validation and doctor judged
+        // (5.2), then add the selected launch's exact runtime closure. Those paths
+        // still pass through resolveIsolation's canonical blocklist enforcement.
+        const runtime = resolveLaunchRuntime(launch.argv);
+        launch = { ...launch, argv: runtime.argv };
+        const ctx = {
+            ...isolationContextFor(role), stateDir: dir, runCwd,
+            runtimeReadPaths: runtime.readPaths,
+        };
         const policy = resolveIsolation(role.isolation, ctx);
         const sel = await selectIsolationBackend(policy, deps.exec); // throws on strict + unavailable
         const degradedMarker = join(dir, '.isolation-degraded');
@@ -409,6 +417,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     let unsubscribeRecovery;
     let monitorLoop;
     let acpStartupComplete = false;
+    let ownerChannel;
     if (sessionBackend === 'acp') {
         const perms = role.permissions ?? resolvePermissions(undefined, undefined);
         // Say once, at startup, that this role will decide permission requests by
@@ -494,6 +503,29 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                 `${started.detail ? `: ${started.detail}` : ''}`);
         }
         acpStartupComplete = true;
+        if (role.owner_channel) {
+            ownerChannel = deps.createOwnerChannel({
+                role: name,
+                config: role.owner_channel,
+                session: acpSession,
+                stateDir: dir,
+                env: role.env,
+                log: deps.log,
+            });
+            try {
+                await ownerChannel.start();
+            }
+            catch (error) {
+                monitor?.stop();
+                if (monitorLoop)
+                    await monitorLoop;
+                await control.close();
+                await acpSession.close();
+                unsubscribeRecovery?.();
+                throw new Error(`[${name}] owner channel failed to start: `
+                    + `${error?.message ?? String(error)}`);
+            }
+        }
     }
     else {
         await deps.tmux.kill(name);
@@ -516,6 +548,8 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     const start = deps.now();
     while (sessionHandle.isAlive())
         await deps.sleep(2000);
+    if (ownerChannel)
+        await ownerChannel.close();
     if (monitor) {
         monitor.stop();
         await monitorLoop;