@ours.network/fleet 0.13.2 → 0.14.0

package/dist/owner-channel/channel.js

@@ -1,18 +1,26 @@
 import { spawn } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
-import { mkdir, readdir, rm } from 'node:fs/promises';
+import { mkdir, readFile, readdir, rm } from 'node:fs/promises';
 import { createInterface } from 'node:readline';
 import { join } from 'node:path';
-import { DEFAULT_OWNER_ATTACHMENT_MIME, } from '../config.js';
+import { DEFAULT_OWNER_ATTACHMENT_MIME, canonicalCid, } from '../config.js';
+import { VERSION } from '../version.js';
+import { dispatchOwnerCommand, fleetCliOps, isOwnerCommandText, } from './commands.js';
 import { OursMcpClient } from './mcp.js';
 import { ownerNotices } from './notices.js';
-import { OwnerAuthorizationState, OwnerChannelState } from './state.js';
+import { DuplicateSendError, OwnerAuthorizationState, OwnerChannelState, OwnerConversationState, } from './state.js';
 import { OwnerTaskState, ownerTaskAuditId, ownerTaskDigest, } from './tasks.js';
 import { AttachmentRecoveryState, admitAttachments, cleanupAttachmentRoot, parseIncomingAttachments, parseRetrievedAttachments, prepareAttachmentDirectory, recoveredAttachment, removeRequestDirectory, safeField, validateAttachmentSelection, } from './attachments.js';
 const OWNER_UPDATE_MIN_INTERVAL_MS = 5_000;
 const OWNER_UPDATE_MAX_COUNT = 20;
 const OWNER_UPDATE_MAX_CHARS = 280;
 const OWNER_UPDATE_MAX_BYTES = 1_024;
+const PROACTIVE_MESSAGE_MAX_CHARS = 4_000;
+const PROACTIVE_MESSAGE_MAX_BYTES = 16_384;
+const RELAY_NACK_MEMORY = 512;
+/** A relay attempt that failed only because no owner route exists yet. */
+class RelayUnroutableError extends Error {
+}
 /**
  * Fleet-owned trusted ingress. The agent never binds this identity and never
  * chooses its reply recipient; both are fixed from authenticated message data.
@@ -22,6 +30,7 @@ export class OwnerChannel {
     client;
     state;
     authorizations;
+    conversations;
     tasks;
     attachmentRecovery;
     attachmentConfig;
@@ -31,6 +40,8 @@ export class OwnerChannel {
      * (a crash must replay them) but must not be queued twice while live.
      */
     inFlight = new Set();
+    /** Wires already NACKed to the managed agent, so a deferred replay stays quiet. */
+    relayNacks = new Set();
     stopping = false;
     watchProcess;
     watchTask;
@@ -40,11 +51,14 @@ export class OwnerChannel {
     activeRequests = new Map();
     managementTail = Promise.resolve();
     ready = false;
+    fleetOps;
     constructor(options) {
         this.options = options;
         this.client = options.client ?? new OursMcpClient(options.command, options.env, line => options.log(`[${options.role}] owner channel ${line}`));
+        this.fleetOps = options.fleet ?? fleetCliOps(options.role, options.configPath);
         this.state = new OwnerChannelState(join(options.stateDir, '.owner-channel-state.json'));
         this.authorizations = new OwnerAuthorizationState(join(options.stateDir, '.owner-channel-owners.json'), options.config.owners);
+        this.conversations = new OwnerConversationState(join(options.stateDir, '.owner-channel-conversations.json'));
         this.tasks = new OwnerTaskState(join(options.stateDir, '.owner-channel-tasks.json'));
         this.attachmentRecovery = new AttachmentRecoveryState(join(options.stateDir, '.owner-channel-attachment-recovery.json'));
         this.attachmentRoot = join(options.stateDir, '.owner-channel-inbox');
@@ -53,9 +67,11 @@ export class OwnerChannel {
             max_request_bytes: 20 * 1024 * 1024, retention_ms: 24 * 60 * 60 * 1_000,
             allowed_mime: [...DEFAULT_OWNER_ATTACHMENT_MIME],
         };
-        const integrity = this.authorizations.integrity();
+        const integrity = this.authorizationIntegrity();
         if (!integrity.ok)
             options.log(`[${options.role}] owner authorization state corrupt; all owner mail disabled`);
+        if (!this.conversations.integrity().ok)
+            options.log(`[${options.role}] owner conversation state corrupt; proactive messages disabled`);
         if (!this.tasks.integrity().ok)
             options.log(`[${options.role}] owner task state corrupt; proactive reports disabled`);
         if (!this.attachmentRecovery.integrity())
@@ -65,8 +81,8 @@ export class OwnerChannel {
         this.stopping = false;
         await this.client.start();
         await this.client.callTool('choose_identity', { name: this.options.config.identity });
-        if (this.authorizations.integrity().ok && this.tasks.integrity().ok)
-            this.tasks.cleanup(Date.now(), this.authorizations.effective());
+        if (this.authorizationIntegrity().ok && this.tasks.integrity().ok)
+            this.tasks.cleanup(Date.now(), this.effectiveOwners());
         if (this.attachmentRecovery.integrity()) {
             this.attachmentRecovery.cleanup(Date.now(), this.attachmentConfig.retention_ms);
             void cleanupAttachmentRoot(this.attachmentRoot, Date.now(), this.attachmentConfig.retention_ms).catch(error => this.logError('attachment crash cleanup failed', error));
@@ -138,23 +154,37 @@ export class OwnerChannel {
             }
             case 'owner_list':
                 return {
-                    action: request.action, integrity: this.authorizations.integrity(),
-                    owners: this.authorizations.entries(),
+                    action: request.action, integrity: this.authorizationIntegrity(),
+                    owners: this.options.config.agent
+                        ? this.options.config.owners.map(cid => ({ cid, source: 'baseline', effective: true }))
+                        : this.authorizations.entries(),
                 };
             case 'owner_authorize': {
+                if (this.options.config.agent)
+                    throw new Error('live owner authorization is disabled when managed-agent CID gating is configured; edit fleet configuration instead');
                 this.assertCid(request.cid);
+                if (request.cid === this.options.config.agent)
+                    throw new Error('managed agent CID cannot also be authorized as an owner');
                 if (this.authorizations.effective().has(request.cid))
                     throw new Error(`owner '${request.cid}' is already authorized`);
                 const contacts = await this.contacts();
-                if (!contacts.some(contact => contact.cid === request.cid
+                if (!contacts.some(contact => canonicalCid(contact.cid) === canonicalCid(request.cid)
                     && ['established', 'active', 'connected'].includes(contact.status.toLowerCase())))
                     throw new Error(`cannot authorize unknown or pending contact CID '${request.cid}'`);
                 return { action: request.action, owner: this.authorizations.authorize(request.cid) };
             }
             case 'owner_revoke':
+                if (this.options.config.agent)
+                    throw new Error('live owner revocation is disabled when managed-agent CID gating is configured; edit fleet configuration instead');
                 this.assertCid(request.cid);
                 {
                     const owner = this.authorizations.revoke(request.cid);
+                    try {
+                        this.conversations.remove(request.cid);
+                    }
+                    catch (error) {
+                        this.logError('owner conversation revocation cleanup failed', error);
+                    }
                     let revokedTasks = 0;
                     try {
                         revokedTasks = this.tasks.revoke(request.cid);
@@ -167,10 +197,16 @@ export class OwnerChannel {
                     return { action: request.action, owner };
                 }
             case 'request_update':
+                if (this.options.config.agent)
+                    throw new Error('direct owner updates are disabled; the managed agent must message its owner-channel identity');
                 return this.sendOwnerUpdate(request);
             case 'task_open':
+                if (this.options.config.agent)
+                    throw new Error('owner task routes are disabled; the managed agent must message its owner-channel identity');
                 return this.openOwnerTask(request.requestId);
             case 'task_report':
+                if (this.options.config.agent)
+                    throw new Error('direct task reports are disabled; the managed agent must message its owner-channel identity');
                 return this.sendOwnerTaskReport(request);
             default:
                 throw new Error('unknown owner-channel management action');
@@ -251,13 +287,39 @@ export class OwnerChannel {
         await send;
         return { action: request.action, requestId: request.requestId, sequence };
     }
+    async sendProactiveMessage(messageValue) {
+        if (!this.authorizationIntegrity().ok)
+            throw new Error('owner authorization state is corrupt; proactive messages are disabled');
+        const message = this.safeProactiveMessage(messageValue);
+        const route = this.conversations.route(this.effectiveOwners());
+        const digest = createHash('sha256').update(message).digest('hex');
+        const sending = this.conversations.beginSend(route.contact, digest);
+        try {
+            if (!this.isEffectiveOwner(route.contact))
+                throw new Error('selected proactive owner is no longer authorized');
+            await this.send(await this.routableContact(route), message);
+        }
+        catch {
+            try {
+                this.conversations.finishSend(sending.id, 'uncertain');
+            }
+            catch (error) {
+                this.logError('proactive owner uncertainty persist failed', error);
+            }
+            throw new Error('proactive owner message delivery outcome is uncertain; it was not retried');
+        }
+        this.conversations.finishSend(sending.id, 'delivered');
+        this.options.log(`[${this.options.role}] proactive owner message `
+            + `${createHash('sha256').update(sending.id).digest('hex').slice(0, 12)} `
+            + `basis=${route.basis} chars=${Array.from(message).length} bytes=${Buffer.byteLength(message)} delivered`);
+    }
     openOwnerTask(requestId) {
         if (!/^[a-f0-9]{64}$/.test(requestId))
             throw new Error('owner task request ID must be exactly 64 lowercase hexadecimal characters');
         const active = this.activeRequests.get(requestId);
         if (!active || active.finalizing)
             throw new Error('owner task can be opened only for a currently active owner request');
-        if (!this.authorizations.effective().has(active.contact))
+        if (!this.isEffectiveOwner(active.contact))
             throw new Error('originating owner is no longer authorized');
         const task = this.tasks.open({
             requestId, contact: active.contact, wireId: active.wireId,
@@ -276,7 +338,7 @@ export class OwnerChannel {
             throw new Error('owner task reports are allowed only after the originating request has finalized');
         if (!this.authorizations.integrity().ok)
             throw new Error('owner authorization state is corrupt; proactive reports are disabled');
-        if (!this.authorizations.effective().has(task.contact)) {
+        if (!this.isEffectiveOwner(task.contact)) {
             this.tasks.revoke(task.contact, now);
             throw new Error('originating owner is no longer authorized; task revoked');
         }
@@ -339,6 +401,22 @@ export class OwnerChannel {
             throw new Error('owner task report must contain exactly one plain-text sentence');
         return message;
     }
+    safeProactiveMessage(value) {
+        if (typeof value !== 'string')
+            throw new Error('proactive owner message must be text');
+        const message = value.trim().normalize('NFC');
+        if (!message)
+            throw new Error('proactive owner message must not be empty');
+        if (Array.from(message).length > PROACTIVE_MESSAGE_MAX_CHARS
+            || Buffer.byteLength(message) > PROACTIVE_MESSAGE_MAX_BYTES)
+            throw new Error(`proactive owner message exceeds ${PROACTIVE_MESSAGE_MAX_CHARS} characters or `
+                + `${PROACTIVE_MESSAGE_MAX_BYTES} bytes`);
+        if (/\u0000|[\u202a-\u202e\u2066-\u2069]/u.test(message))
+            throw new Error('proactive owner message contains unsafe control characters');
+        if (/-----BEGIN [A-Z ]*PRIVATE KEY-----|(?:api[_ -]?key|access[_ -]?token|authorization|password|secret)\s*[:=]|(?:chain of thought|private reasoning|internal reasoning)|^(?:stdout|stderr|tool (?:output|result)|command):/imu.test(message))
+            throw new Error('proactive owner message appears to contain unsafe reasoning, secret, or raw tool content');
+        return message;
+    }
     async drainAll() {
         // A finite cap protects the supervisor if a broken daemon repeats unread
         // messages forever. A watch notification will resume draining later.
@@ -372,7 +450,7 @@ export class OwnerChannel {
             const deferred = messages.filter(message => {
                 const wireId = this.wireId(message);
                 return wireId && !this.state.has(wireId)
-                    && this.authorizations.effective().has(this.sender(message).id)
+                    && this.acceptedSender(this.sender(message).id)
                     && Number.isInteger(message.msg_id);
             }).map(message => message.msg_id);
             if (deferred.length)
@@ -451,7 +529,7 @@ export class OwnerChannel {
             return false;
         const sender = { id: group.files[0].senderId, name: group.files[0].senderName };
         if (group.files.some(file => file.senderId !== sender.id)
-            || !this.authorizations.effective().has(sender.id)) {
+            || !this.isEffectiveOwner(sender.id)) {
             this.options.log(`[${this.options.role}] owner channel ignored unauthorized attachment sender ${sender.id}`);
             for (const wire of handledWireIds)
                 this.state.remember(wire);
@@ -571,33 +649,55 @@ export class OwnerChannel {
         if (!wireId || this.state.has(wireId) || this.inFlight.has(wireId))
             return false;
         const sender = this.sender(message);
-        if (!this.authorizations.effective().has(sender.id)) {
-            // Do not answer an unauthorized sender and thereby disclose that this is
-            // a privileged control address. Authenticated CID, never display name or
-            // message wording, is the authority boundary.
-            this.options.log(`[${this.options.role}] owner channel ignored unauthorized sender ${sender.id || '<unknown>'}`);
+        if (this.isAgentSender(sender.id)) {
+            try {
+                await this.relayManagedAgentMessage(message, wireId);
+            }
+            catch (error) {
+                if (error instanceof DuplicateSendError) {
+                    // A crash replay of a wire that already reached an owner. Consuming
+                    // it silently IS the correct outcome; delivering again is the bug.
+                    this.options.log(`[${this.options.role}] managed-agent relay replay of a delivered wire consumed`);
+                }
+                else if (error instanceof RelayUnroutableError) {
+                    // No owner route exists yet. Leave the wire deferred and unconsumed
+                    // so the daemon replays it after the first owner contact, and tell
+                    // the authenticated agent once so the wait is never silent.
+                    this.options.log(`[${this.options.role}] owner channel managed-agent relay has no owner `
+                        + `route yet; message stays queued: ${this.errorText(error)}`);
+                    await this.nackManagedAgent(sender.id, message, wireId, ownerNotices.relayQueued());
+                    return false;
+                }
+                else {
+                    this.logError('managed-agent message relay refused', error);
+                    await this.nackManagedAgent(sender.id, message, wireId, ownerNotices.relayRefused(this.errorText(error)));
+                }
+            }
             this.state.remember(wireId);
             return true;
         }
-        const text = String(message.text ?? '').trim();
-        if (text.toLowerCase() === '/status') {
-            const snapshot = this.options.session.snapshot();
-            await this.send(sender.id, ownerNotices.status(this.options.role, snapshot), wireId);
+        if (!this.isEffectiveOwner(sender.id)) {
+            // Never answer the sender or reflect its body. Notify an owner through the
+            // bounded proactive route, then consume the attempt so it cannot replay.
+            this.options.log(`[${this.options.role}] owner channel ignored unauthorized sender ${sender.id || '<unknown>'}`);
+            await this.warnOwnerOfUnauthorizedSender(sender.id);
             this.state.remember(wireId);
             return true;
         }
-        if (text.toLowerCase() === '/interrupt') {
-            try {
-                await this.options.session.interrupt('owner');
-            }
-            catch (error) {
-                this.logError('interrupt failed', error);
-                await this.send(sender.id, ownerNotices.interruptFailed(this.options.role), wireId);
-                this.state.remember(wireId);
-                return true;
-            }
-            await this.send(sender.id, ownerNotices.interrupted(this.options.role), wireId);
-            this.state.remember(wireId);
+        // Accepted authenticated inbound traffic selects the destination for the
+        // next unscoped proactive message. Distinct devices/identities naturally
+        // hand off this route by being the most recent sender.
+        try {
+            this.conversations.recordInbound(sender.id, wireId);
+        }
+        catch (error) {
+            // Proactive routing state is auxiliary. A corrupt/unwritable route file must
+            // never prevent an authenticated owner from using the ordinary channel.
+            this.logError('owner conversation route update failed', error);
+        }
+        const text = String(message.text ?? '').trim();
+        if (isOwnerCommandText(text)) {
+            await this.handleCommand(sender, text, wireId);
             return true;
         }
         const requestId = this.requestId(wireId);
@@ -606,7 +706,7 @@ export class OwnerChannel {
         let queued;
         const activityCursor = this.latestEventSeq(this.options.session.eventsSince(0));
         try {
-            queued = await this.options.session.queuePrompt(this.ownerPrompt(sender, text, wireId, requestId, outbox), {
+            queued = await this.options.session.queuePrompt(this.ownerPrompt(sender, text, wireId, outbox), {
                 interrupt: this.options.config.interrupt,
                 ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
                 origin: { kind: 'owner', requestId },
@@ -619,10 +719,13 @@ export class OwnerChannel {
             this.state.remember(wireId);
             return true;
         }
-        const accepted = this.options.config.interrupt
-            ? ownerNotices.receivedInterrupting()
-            : queued.queuedBehind > 0
-                ? ownerNotices.receivedQueued(queued.queuedBehind)
+        // Interrupting the live turn does not remove prompts which were already
+        // accepted into the ACP queue. Never claim this request is running while
+        // the session itself says earlier work remains ahead of it.
+        const accepted = queued.queuedBehind > 0
+            ? ownerNotices.receivedQueued(queued.queuedBehind)
+            : this.options.config.interrupt
+                ? ownerNotices.receivedInterrupting()
                 : ownerNotices.receivedStarted();
         this.inFlight.add(wireId);
         const receipt = this.send(sender.id, accepted, wireId).then(() => undefined).catch(error => {
@@ -645,34 +748,271 @@ export class OwnerChannel {
         this.completionTasks.add(task);
         return true;
     }
+    /**
+     * Deterministic command path: the message never becomes an agent prompt.
+     * Authorization already happened — the managed-agent relay branch and the
+     * owner-CID check in handle() both run before dispatch, so only an
+     * authenticated owner reaches this: neither ordinary peers nor the managed
+     * agent itself can execute /force-restart, /model, or any other command.
+     */
+    async handleCommand(sender, text, wireId) {
+        const ctx = {
+            role: this.options.role,
+            harness: this.options.harness,
+            version: VERSION,
+            snapshot: () => this.options.session.snapshot(),
+            interrupt: () => this.options.session.interrupt('owner'),
+            runHarnessCommand: command => this.runHarnessCommand(sender, command, wireId),
+            restart: mode => this.restartSelf(sender, mode, wireId),
+            fleetList: () => this.fleetOps.list(),
+            recentEvents: limit => this.options.session.eventsSince(0).slice(-limit),
+            readWorklogTail: maxChars => this.readWorklogTail(maxChars),
+            reply: async (replyText) => { await this.send(sender.id, replyText, wireId); },
+        };
+        try {
+            await dispatchOwnerCommand(text, ctx);
+        }
+        catch (error) {
+            this.logError(`owner command failed (${text.split(/\s+/, 1)[0]})`, error);
+        }
+        // Harness commands own their wire until the queued turn settles; everything
+        // else is complete now and must never replay.
+        if (!this.inFlight.has(wireId))
+            this.state.remember(wireId);
+    }
+    /** Queue raw slash text to the harness and report the turn's outcome. */
+    async runHarnessCommand(sender, command, wireId) {
+        const requestId = this.requestId(wireId);
+        const queued = await this.options.session.queuePrompt(command, {
+            origin: { kind: 'owner', requestId },
+        });
+        this.inFlight.add(wireId);
+        const receipt = this.send(sender.id, ownerNotices.commandStarted(command), wireId)
+            .then(() => undefined)
+            .catch(error => this.logError(`command ${command} acceptance notice failed`, error));
+        const task = queued.completion.then(async (result) => {
+            await receipt;
+            const output = result.succeeded ? this.commandOutput(result.output) : undefined;
+            await this.send(sender.id, ownerNotices.commandOutcome(command, result.outcome, output), wireId);
+            this.state.remember(wireId);
+        }).catch(error => this.logError(`command ${command} completion failed`, error))
+            .finally(() => {
+            this.inFlight.delete(wireId);
+            this.completionTasks.delete(task);
+            if (!this.stopping)
+                void this.drain().catch(error => this.logError('completion drain failed', error));
+        });
+        this.completionTasks.add(task);
+    }
+    /**
+     * Confirmation and the durable wire record must both land BEFORE the fleet
+     * CLI is asked to bounce this very process; neither can happen afterwards.
+     */
+    async restartSelf(sender, mode, wireId) {
+        const command = mode === 'fresh' ? '/force-restart' : '/restart';
+        await this.send(sender.id, ownerNotices.restarting(this.options.role, command, mode), wireId);
+        this.state.remember(wireId);
+        this.options.log(`[${this.options.role}] owner requested ${command}`);
+        await this.fleetOps.restart(mode);
+    }
+    /** Code-point-safe tail of the worklog, or undefined when there is none. */
+    async readWorklogTail(maxChars) {
+        try {
+            const content = (await readFile(join(this.options.stateDir, 'WORKLOG.md'), 'utf8')).trim();
+            if (!content)
+                return undefined;
+            const points = Array.from(content);
+            return points.length <= maxChars ? content : `…${points.slice(-maxChars).join('')}`;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** Bound harness-command output to a single outbound message. */
+    commandOutput(output) {
+        const trimmed = output?.trim();
+        if (!trimmed)
+            return undefined;
+        const points = Array.from(trimmed);
+        return points.length <= 7_000 ? trimmed : `${points.slice(0, 7_000).join('')}…`;
+    }
+    acceptedSender(cid) {
+        return this.isAgentSender(cid) || this.isEffectiveOwner(cid);
+    }
+    isAgentSender(cid) {
+        const agent = this.options.config.agent;
+        return agent !== undefined && cid !== '' && canonicalCid(cid) === canonicalCid(agent);
+    }
+    isEffectiveOwner(cid) {
+        const canonical = canonicalCid(cid);
+        for (const owner of this.effectiveOwners())
+            if (canonicalCid(owner) === canonical)
+                return true;
+        return false;
+    }
+    async relayManagedAgentMessage(message, wireId) {
+        if (!this.authorizationIntegrity().ok)
+            throw new Error('owner authorization state is corrupt; managed-agent relay is disabled');
+        const text = this.safeRelayMessage(message.text);
+        let route;
+        try {
+            route = this.conversations.route(this.effectiveOwners());
+        }
+        catch (error) {
+            throw new RelayUnroutableError(this.errorText(error));
+        }
+        // The inbound wire—not its body—is the idempotency key. Repeating the same
+        // wording in two deliberate messages remains valid, while crash replay of
+        // one message cannot produce two owner deliveries — to ANY owner, which is
+        // why the wire digest is checked across every recorded send.
+        const digest = createHash('sha256').update(`managed-agent-relay\0${wireId}`).digest('hex');
+        const sending = this.conversations.beginSend(route.contact, digest, Date.now(), 0, 'all');
+        try {
+            if (!this.isEffectiveOwner(route.contact))
+                throw new Error('selected relay owner is no longer authorized');
+            await this.send(await this.routableContact(route), text);
+        }
+        catch {
+            try {
+                this.conversations.finishSend(sending.id, 'uncertain');
+            }
+            catch (error) {
+                this.logError('managed-agent relay uncertainty persist failed', error);
+            }
+            throw new Error('managed-agent relay delivery outcome is uncertain; it was not retried');
+        }
+        this.conversations.finishSend(sending.id, 'delivered');
+        this.options.log(`[${this.options.role}] managed-agent message relayed `
+            + `wire=${createHash('sha256').update(wireId).digest('hex').slice(0, 12)} `
+            + `basis=${route.basis} chars=${Array.from(text).length} bytes=${Buffer.byteLength(text)}`);
+    }
+    /**
+     * One bounded NACK per wire: an unroutable or refused relay must be visible
+     * to the authenticated agent, while its deferred replays stay quiet. NACK
+     * delivery is best-effort — it must never make the failure worse.
+     */
+    async nackManagedAgent(contact, message, wireId, notice) {
+        if (this.relayNacks.has(wireId))
+            return;
+        this.relayNacks.add(wireId);
+        if (this.relayNacks.size > RELAY_NACK_MEMORY)
+            this.relayNacks.delete(this.relayNacks.values().next().value);
+        try {
+            await this.send(contact, notice, message.wire_id ? wireId : undefined);
+        }
+        catch (error) {
+            this.logError('managed-agent relay NACK delivery failed', error);
+        }
+    }
+    /**
+     * Daemon contact resolution is case-exact, so a canonical config CID picked
+     * by the sole-owner fallback is translated to the daemon-known contact form
+     * when one exists. Last-inbound routes already carry the daemon form.
+     */
+    async routableContact(route) {
+        if (route.basis !== 'sole-owner')
+            return route.contact;
+        try {
+            const canonical = canonicalCid(route.contact);
+            const match = (await this.contacts()).find(entry => canonicalCid(entry.cid) === canonical);
+            return match?.cid ?? route.contact;
+        }
+        catch {
+            return route.contact;
+        }
+    }
+    safeRelayMessage(value) {
+        if (typeof value !== 'string')
+            throw new Error('managed-agent relay must be text');
+        const message = value.normalize('NFC');
+        if (!message.trim())
+            throw new Error('managed-agent relay must not be empty');
+        if (Array.from(message).length > PROACTIVE_MESSAGE_MAX_CHARS
+            || Buffer.byteLength(message) > PROACTIVE_MESSAGE_MAX_BYTES)
+            throw new Error(`managed-agent relay exceeds ${PROACTIVE_MESSAGE_MAX_CHARS} characters or `
+                + `${PROACTIVE_MESSAGE_MAX_BYTES} bytes`);
+        if (/\u0000|[\u202a-\u202e\u2066-\u2069]/u.test(message))
+            throw new Error('managed-agent relay contains unsafe control characters');
+        return message;
+    }
+    async warnOwnerOfUnauthorizedSender(cid) {
+        const source = /^[A-Fa-f0-9]{64}$/.test(cid)
+            ? cid
+            : `invalid-${createHash('sha256').update(cid).digest('hex').slice(0, 12)}`;
+        try {
+            await this.sendProactiveMessage(`⚠️ Owner-channel security warning: rejected a message from unauthorized `
+                + `sender CID ${source}. Its body was not forwarded.`);
+        }
+        catch (error) {
+            // Warning delivery must not make hostile input replayable or disclose
+            // anything to its sender. Rate/dedupe/no-route failures remain local.
+            this.logError('unauthorized sender warning suppressed', error);
+        }
+    }
+    effectiveOwners() {
+        // In managed-agent mode the checked-in fleet configuration is the complete
+        // authority boundary. Ignore any legacy dynamic overlay left on disk.
+        return this.options.config.agent
+            ? new Set(this.options.config.owners)
+            : this.authorizations.effective();
+    }
+    authorizationIntegrity() {
+        return this.options.config.agent ? { ok: true } : this.authorizations.integrity();
+    }
     async complete(active, outbox, queued, activityCursor) {
         const progressMs = this.options.config.progress_interval_ms;
-        const startedAt = Date.now();
         let lastSeq = activityCursor;
-        let phase = queued.queuedBehind > 0
-            ? 'waiting behind earlier requests' : 'starting request';
-        const timer = progressMs > 0 ? setInterval(() => {
+        let startedAt;
+        let phase = 'starting request';
+        let timer;
+        const reportProgress = () => {
             const events = this.options.session.eventsSince(lastSeq);
             lastSeq = Math.max(lastSeq, this.latestEventSeq(events));
             const activity = events.filter(event => event.turnId === queued.promptId);
+            if (!activity.length)
+                return;
+            startedAt ??= Date.parse(activity[0].at) || Date.now();
             phase = this.progressPhase(activity) ?? phase;
             const started = activity.filter(event => event.kind === 'tool_call').length;
             const completed = activity.filter(event => event.kind === 'tool_update' && event.status === 'completed').length;
-            const activityUpdates = activity.filter(event => event.kind !== 'tool_call'
-                && !(event.kind === 'tool_update' && event.status === 'completed')
-                && event.kind !== 'turn_stop').length;
+            // Token/thought chunks are transport activity, not evidence of progress.
+            // Permission transitions and errors are material even without a tool.
+            const activityUpdates = activity.filter(event => event.kind === 'permission' || event.kind === 'error').length;
+            if (!started && !completed && !activityUpdates)
+                return;
             const notice = ownerNotices.progress(Date.now() - startedAt, phase, started, completed, activityUpdates);
             // Preserve wire ordering if a progress send overlaps turn completion.
             active.outboundTail = active.outboundTail
                 .then(async () => { await this.send(active.contact, notice, active.wireId); })
                 .catch(error => this.logError('progress notice failed', error));
-        }, progressMs) : undefined;
-        timer?.unref();
+        };
+        // A queued request used to create its 30-second interval immediately. A
+        // backlog of three requests therefore produced three permanent notice
+        // streams saying "waiting behind earlier requests" without any work. Arm
+        // the interval only after this exact prompt emits its first session event.
+        const startProgress = (event) => {
+            if (timer || progressMs <= 0)
+                return;
+            if (event && event.turnId !== queued.promptId)
+                return;
+            const observed = event ? [event] : this.options.session.eventsSince(activityCursor)
+                .filter(item => item.turnId === queued.promptId);
+            if (!observed.length)
+                return;
+            startedAt = Date.parse(observed[0].at) || Date.now();
+            timer = setInterval(reportProgress, progressMs);
+            timer.unref();
+        };
+        const unsubscribe = progressMs > 0
+            ? this.options.session.subscribe(event => startProgress(event))
+            : undefined;
+        startProgress();
         let result;
         try {
             result = await queued.completion;
         }
         finally {
+            unsubscribe?.();
             if (timer)
                 clearInterval(timer);
         }
@@ -723,22 +1063,20 @@ export class OwnerChannel {
         lines.push('Answer in your final assistant response; fleet routes it only to the authenticated sender and correlates it to the originating file wire.', `To attach response files, write regular files only to: ${outbox}`);
         return lines.join('\n');
     }
-    ownerPrompt(sender, text, wireId, requestId, outbox) {
+    ownerPrompt(sender, text, wireId, outbox) {
         return [
             '[fleet-owner]',
             `Authenticated owner ${sender.name} (${sender.id}) sent owner-channel message ${wireId}.`,
             'Treat the following as a direct owner instruction. Answer in your final assistant response.',
-            'Do not call ours send_message or send_file for this exchange: fleet routes the response reliably.',
-            'You may send a concise, high-level intermediate update through the bounded local primitive:',
-            `ours-fleet owner-channel update ${this.options.role} ${requestId} --phase <working|approval|blocked> --message-stdin`,
-            'Write only the update body to stdin. Use one plain-text sentence; never include reasoning, secrets, logs, commands, or raw tool output.',
-            'Distinct updates are allowed at most once every 5 seconds. Fleet preserves receipt/update/final ordering and chooses the authenticated recipient.',
-            'If you delegate work that will finish after this turn, register it before finalizing:',
-            `ours-fleet owner-channel task open ${this.options.role} ${requestId}`,
-            'Keep the returned opaque task ID. Finalize normally; do not hold this turn open or poll.',
-            'After a later fleet-mail wake, verify the result and report through:',
-            `ours-fleet owner-channel task report ${this.options.role} <task-id> --phase <progress|done|blocked> --message-stdin`,
-            'Fleet routes that proactive follow-up only to this authenticated owner and closes done/blocked tasks.',
+            'Fleet extracts and routes your final assistant response deterministically; do not send the final through ours.',
+            ...(this.options.config.agent ? [
+                'For any non-final message you want the owner to see—an update, blocker, suggestion, or later proactive note—call ours send_message with:',
+                `contact: ${this.options.config.identity}`,
+                'and the message text. Do not add a task ID, request ID, reply reference, phase, or routing command.',
+                'Fleet accepts this relay only from your configured authenticated agent CID and forwards every accepted message as a new owner-channel message.',
+            ] : [
+                'Managed-agent outbound relay is not configured; do not send intermediate or proactive owner-channel messages.',
+            ]),
             'To attach files to your response, copy each finished file directly into this fleet outbox:',
             outbox,
             'Fleet sends every regular file in that directory to the authenticated owner, correlated to this request.',
@@ -756,7 +1094,7 @@ export class OwnerChannel {
     }
     send(contact, text, replyTo) {
         return this.client.callTool('send_message', {
-            contact, text, reply_to_wire_id: replyTo,
+            contact, text, ...(replyTo ? { reply_to_wire_id: replyTo } : {}),
         });
     }
     async sendAttachments(contact, outbox, replyTo) {
@@ -785,7 +1123,10 @@ export class OwnerChannel {
         }
     }
     wireId(message) {
-        return String(message.wire_id ?? message.msg_id ?? '');
+        const wire = String(message.wire_id ?? '').trim();
+        if (wire)
+            return wire;
+        return Number.isInteger(message.msg_id) ? `msg:${message.msg_id}` : '';
     }
     sender(message) {
         const source = message.from ?? message.sender;