@ours.network/fleet 0.13.0 → 0.13.2

package/dist/harness/claude-code.js

@@ -207,6 +207,11 @@ export function makeClaudeCodeAdapter(exec = realExec) {
                     : bundledAcpAgent('@agentclientprotocol/claude-agent-acp', 'claude-agent-acp', 'claude-agent-acp');
             return { argv, env: prep.env };
         },
+        // Same source as buildLaunch's --permission-mode flag, so the tmux and ACP
+        // backends cannot disagree about what a role's permissions translate to.
+        acpPermissionModeId(role) {
+            return permissionMode(role);
+        },
         isolationPaths(_role, _dirs) {
             const claudeHome = join(home(), '.claude');
             return {

package/dist/harness/types.d.ts

@@ -98,6 +98,12 @@ export interface HarnessAdapter {
     prepareSession(role: ResolvedRole, dirs: RoleDirs): Promise<SessionPrep>;
     buildLaunch(role: ResolvedRole, mode: 'fresh' | 'resume', s: SessionState, prep: SessionPrep): Launch;
     buildAcpLaunch?(role: ResolvedRole, prep: SessionPrep): AcpLaunch;
+    /**
+     * The native permission-mode id an ACP session should run at, from the same
+     * translation `buildLaunch` uses for its CLI flag. `undefined` keeps the
+     * agent's default. Omit for a harness whose ACP agent has no modes.
+     */
+    acpPermissionModeId?(role: ResolvedRole): string | undefined;
     /**
      * REQUIRED. Every adapter must either translate neutral permissions or
      * explicitly declare that it cannot. Enforced at registration.

package/dist/owner-channel/attachments.js

@@ -88,6 +88,16 @@ function parseTranscription(value, wireId) {
             fileWireId: wireId,
         } };
 }
+// Voice notes ride "<base>; x-ours-kind=voice-message" verbatim end to end
+// (the recorder's real container varies: audio/webm Chrome/Android, audio/mp4
+// iOS Safari, audio/ogg fallback), so policy for voice messages applies to the
+// base container type. Ordinary files keep exact allowlist matching.
+function baseMime(mime) {
+    return mime.split(';')[0].trim();
+}
+function policyMime(file) {
+    return file.kind === 'voice_message' ? baseMime(file.mime) : file.mime;
+}
 export function validateAttachmentSelection(files, config) {
     if (!config.enabled)
         return 'attachments are disabled for this owner channel';
@@ -95,7 +105,10 @@ export function validateAttachmentSelection(files, config) {
         return `the request exceeds the ${config.max_files_per_request}-file limit`;
     let total = 0;
     for (const file of files) {
-        if (!config.allowed_mime.includes(file.mime))
+        const mime = policyMime(file);
+        if (file.kind === 'voice_message' && !mime.startsWith('audio/'))
+            return `voice-message MIME type ${file.mime || '(missing)'} is not an audio container`;
+        if (!config.allowed_mime.includes(mime))
             return `MIME type ${file.mime || '(missing)'} is not allowed`;
         if (file.size > config.max_file_bytes)
             return `a file exceeds the ${config.max_file_bytes}-byte limit`;
@@ -148,9 +161,10 @@ export async function admitAttachments(files, dir, config) {
         total += bytes.length;
         if (total > config.max_request_bytes)
             throw new Error('retrieved attachments exceed the request size limit');
-        const detectedMime = detectMime(bytes, file.mime);
-        if (!mimeCompatible(file.mime, detectedMime))
-            throw new Error(`retrieved attachment content does not match declared MIME ${file.mime}`);
+        const declaredMime = policyMime(file);
+        const detectedMime = detectMime(bytes, declaredMime);
+        if (!mimeCompatible(declaredMime, detectedMime))
+            throw new Error(`retrieved attachment content does not match declared MIME ${declaredMime}`);
         const filename = sanitizeFilename(file.filename);
         const finalPath = join(dir, `${index + 1}-${file.wireId.slice(0, 12)}-${filename}`);
         const tmp = join(dir, `.${basename(finalPath)}.${randomUUID()}.tmp`);
@@ -175,7 +189,7 @@ export async function admitAttachments(files, dir, config) {
         await rm(tmp, { force: true });
         await chmod(finalPath, 0o600);
         admitted.push({
-            wireId: file.wireId, filename, path: finalPath, declaredMime: file.mime,
+            wireId: file.wireId, filename, path: finalPath, declaredMime,
             detectedMime, size: bytes.length, sha256: digest, kind: file.kind,
             ...(file.transcription ? { transcription: {
                     configured: file.transcription.configured, attempted: file.transcription.attempted,

package/dist/runner.js

@@ -442,6 +442,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             stateDir: dir,
             mode,
             permissions: perms,
+            modeId: adapter.acpPermissionModeId?.(role),
             log: deps.log,
         });
         pid = acpSession.pid;

package/dist/session/acp.d.ts

@@ -8,6 +8,8 @@ export interface AcpSessionOptions {
     stateDir: string;
     mode: 'fresh' | 'resume';
     permissions: CommonPermissions;
+    /** Native permission-mode id to request via session/set_mode; undefined keeps the agent default. */
+    modeId?: string;
     log(line: string): void;
 }
 /**

package/dist/session/acp.js

@@ -251,6 +251,22 @@ export class AcpSession {
             this.sessionId = created.sessionId;
         }
         writeFileSync(this.sessionFile, this.sessionId + '\n', { mode: 0o600 });
+        // Deliver the configured permission mode whichever way the session came up
+        // (new, resume or load) — the launch flag never reaches an ACP agent. A
+        // refusal is loud but never fatal: the session then simply runs at the
+        // agent's own default.
+        if (this.options.modeId) {
+            try {
+                await this.connection.agent.request(acp.methods.agent.session.setMode, {
+                    sessionId: this.sessionId,
+                    modeId: this.options.modeId,
+                });
+            }
+            catch (e) {
+                this.options.log(`[${this.options.name}] acp: session/set_mode "${this.options.modeId}" failed ` +
+                    `(${e instanceof Error ? e.message : String(e)}) — session runs at the agent default permission mode`);
+            }
+        }
         this.readiness = 'idle';
         this.events.emit('state', { status: 'idle', text: `ACP session ${this.sessionId}` });
     }

package/dist/spawn.js

@@ -253,6 +253,7 @@ function provenanceSettings(o, defaults) {
                 ? { value: explicitModel, source: 'cli' }
                 : { value: inheritedModel, source: inheritedModel ? 'fleet-default' : 'built-in' },
         coordinator: provenanceOf(o.coordinator, undefined, undefined),
+        permission_mode: provenanceOf(o.permissionMode, undefined, undefined),
         approval: provenanceOf(o.approval, perms.approval, 'ask'),
         filesystem: provenanceOf(o.filesystem, perms.filesystem, 'workspace'),
         unattended: provenanceOf(o.unattended, perms.unattended, 'deny'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux or ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",