@ours.network/fleet 0.15.1 → 0.15.4

package/dist/fleet-proxy.js

@@ -0,0 +1,38 @@
+import { effectivePermissionMode } from './permissions.js';
+/** Present only inside a managed role process. The CLI treats it as a routing hint, not authority. */
+export const FLEET_PROXY_STATE_DIR_ENV = 'OURS_FLEET_PROXY_STATE_DIR';
+export const FLEET_PROXY_CALLER_ENV = 'OURS_FLEET_PROXY_CALLER';
+/**
+ * Fill only omitted spawn settings from the live caller. Explicit agent choices
+ * always win. This is convenience attribution, not an authorization boundary.
+ */
+export function inheritCallerSpawnDefaults(caller, requested, configPath) {
+    const options = { ...requested };
+    const inherited = [];
+    const take = (key, value) => {
+        if (options[key] !== undefined || value === undefined)
+            return;
+        options[key] = value;
+        inherited.push(String(key));
+    };
+    const sameHarness = requested.harness === undefined || requested.harness === caller.harness;
+    take('harness', caller.harness);
+    take('session', caller.session);
+    take('cwd', caller.cwd);
+    take('coordinator', caller.name);
+    if (options.approval === undefined)
+        take('approval', effectivePermissionMode(caller).fleetMode);
+    take('filesystem', caller.permissions.filesystem);
+    take('unattended', caller.permissions.unattended);
+    take('monitorConfig', structuredClone(caller.monitor));
+    // A model name and native harness options are not portable across harnesses.
+    // When the caller explicitly switches harness, let that harness/fleet defaults
+    // select its model instead of copying (for example) a Codex model into Claude.
+    if (sameHarness)
+        take('model', caller.model);
+    options.configPath = configPath;
+    options.surface = 'agent';
+    options.callerRole = caller.name;
+    options.inheritedFromCaller = [...inherited];
+    return { options, inherited };
+}

package/dist/harness/claude-code.js

@@ -6,7 +6,8 @@ import { registerAdapter } from './registry.js';
 import { replaceFileAtomically, withFileLock } from '../atomic-file.js';
 import { harnessRuntimeDir } from '../isolation/policy.js';
 import { bundledAcpAgent } from './acp-agent.js';
-const OPTION_KEYS = ['plugins', 'mem_palace', 'mem_palace_midsession_autosave', 'permission_mode'];
+const OPTION_KEYS = ['plugins', 'mem_palace', 'mem_palace_midsession_autosave', 'permission_mode', 'effort'];
+const EFFORT_LEVELS = ['low', 'medium', 'high', 'xhigh', 'max'];
 /** Claude Code's accepted --permission-mode values. */
 const PERMISSION_MODES = ['default', 'acceptEdits', 'plan', 'dontAsk', 'bypassPermissions'];
 /**
@@ -23,8 +24,9 @@ const PERMISSION_MODES = ['default', 'acceptEdits', 'plan', 'dontAsk', 'bypassPe
 export function nativePermissionMode(approval) {
     switch (approval) {
         case 'allow': return 'bypassPermissions';
+        case 'auto': return 'acceptEdits';
         case 'deny': return 'plan';
-        default: return undefined; // 'ask' → Claude's own default
+        default: return undefined; // ask uses Claude's native default
     }
 }
 /**
@@ -149,9 +151,13 @@ export function makeClaudeCodeAdapter(exec = realExec) {
                 return [];
             if (typeof opts !== 'object' || Array.isArray(opts))
                 return [{ path: 'harness_options', message: 'must be a map' }];
-            return Object.keys(opts)
+            const errors = Object.keys(opts)
                 .filter(k => !OPTION_KEYS.includes(k))
                 .map(k => ({ path: `harness_options.${k}`, message: `unknown option; allowed: ${OPTION_KEYS.join(', ')}` }));
+            const effort = opts.effort;
+            if (effort != null && !EFFORT_LEVELS.includes(effort))
+                errors.push({ path: 'harness_options.effort', message: `must be one of: ${EFFORT_LEVELS.join(', ')}` });
+            return errors;
         },
         async prepareSession(role, dirs) {
             // Pre-trust stays a HOST-side step: inside the sandbox ~/.claude.json is
@@ -189,7 +195,9 @@ export function makeClaudeCodeAdapter(exec = realExec) {
         buildLaunch(role, mode, s, prep) {
             const stateDir = roleStateDir(role);
             const pm = permissionMode(role);
+            const o = role.harness_options;
             const base = ['claude', ...(role.model ? ['--model', role.model] : []),
+                ...(o?.effort ? ['--effort', o.effort] : []),
                 ...(pm ? ['--permission-mode', pm] : []),
                 ...prep.argv, '--remote-control', role.name];
             const argv = mode === 'fresh'
@@ -256,6 +264,15 @@ export function makeClaudeCodeAdapter(exec = realExec) {
                 capabilities: claudeCapabilities(native, role.permissions.filesystem),
             };
         },
+        effectivePermissionMode(role) {
+            const nativeMode = permissionMode(role) ?? 'default';
+            const fleetMode = nativeMode === 'bypassPermissions' ? 'allow'
+                : nativeMode === 'acceptEdits' || nativeMode === 'dontAsk' ? 'auto'
+                    : nativeMode === 'default' || nativeMode === 'plan' ? 'ask' : undefined;
+            if (!fleetMode)
+                throw new Error(`unsupported Claude permission mode '${nativeMode}'`);
+            return { fleetMode, nativeMode };
+        },
         vocabulary: {
             bindTool: 'choose_identity',
             createTool: 'create_identity',

package/dist/harness/codex.js

@@ -63,8 +63,10 @@ function approvalPolicy(role) {
         const approval = role.permissions?.approval;
         if (approval === 'allow')
             return 'never';
-        if (approval === 'ask' || approval === 'deny')
+        if (approval === 'auto' || approval === 'deny')
             return 'on-request';
+        if (approval === 'ask')
+            return 'untrusted';
         return undefined;
     }
     if (!APPROVAL_POLICIES.includes(a))
@@ -259,7 +261,8 @@ export function makeCodexAdapter(exec = realExec) {
             };
         },
         translatePermissions(permissions) {
-            const approval = permissions.approval === 'allow' ? 'never' : 'on-request';
+            const approval = permissions.approval === 'allow' ? 'never'
+                : permissions.approval === 'ask' ? 'untrusted' : 'on-request';
             const sandbox = permissions.filesystem === 'read-only'
                 ? 'read-only'
                 : permissions.filesystem === 'unrestricted'
@@ -285,6 +288,15 @@ export function makeCodexAdapter(exec = realExec) {
                 capabilities: codexCapabilities(approval, sandbox),
             };
         },
+        effectivePermissionMode(role) {
+            const nativeMode = approvalPolicy(role) ?? 'untrusted';
+            const fleetMode = nativeMode === 'never' ? 'allow'
+                : nativeMode === 'on-request' ? 'auto'
+                    : nativeMode === 'untrusted' ? 'ask' : undefined;
+            if (!fleetMode)
+                throw new Error(`unsupported Codex approval policy '${nativeMode}'`);
+            return { fleetMode, nativeMode };
+        },
         vocabulary: {
             bindTool: 'choose_identity',
             createTool: 'create_identity',

package/dist/harness/types.d.ts

@@ -1,4 +1,4 @@
-import type { CommonPermissions, ResolvedRole } from '../config.js';
+import type { CommonPermissions, FleetPermissionMode, ResolvedRole } from '../config.js';
 export interface PrereqCheck {
     name: string;
     ok: boolean;
@@ -106,6 +106,11 @@ export interface HarnessAdapter {
      * agent's default. Omit for a harness whose ACP agent has no modes.
      */
     acpPermissionModeId?(role: ResolvedRole): string | undefined;
+    /** Effective portable policy and harness-native approval mode after native overrides win. */
+    effectivePermissionMode?(role: ResolvedRole): {
+        fleetMode: FleetPermissionMode;
+        nativeMode: string;
+    };
     /**
      * REQUIRED. Every adapter must either translate neutral permissions or
      * explicitly declare that it cannot. Enforced at registration.

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { loadConfig, findRole, resolvePermissions, ConfigError } from './config.js';
-export type { FleetConfig, ResolvedRole, RoleConfig, OverseeEntry, SessionBackendId, CommonPermissions, SessionOptions, OwnerChannelConfig, } from './config.js';
+export type { FleetConfig, ResolvedRole, RoleConfig, OverseeEntry, SessionBackendId, CommonPermissions, FleetPermissionMode, ApprovalMode, SessionOptions, OwnerChannelConfig, } from './config.js';
 export type { HarnessAdapter, BriefingVocab, ExitPolicy, PrereqReport, PrereqCheck, SessionPrep, SessionState, Launch, AcpLaunch, PermissionTranslation, RoleDirs, ValidationError, } from './harness/types.js';
 export type { SessionHandle, SessionSnapshot, SessionEvent, TurnResult, } from './session/types.js';
 export { AcpSession } from './session/acp.js';
@@ -9,6 +9,7 @@ export { registerAdapter, getAdapter, knownAdapters } from './harness/registry.j
 export { claudeCodeAdapter, makeClaudeCodeAdapter } from './harness/claude-code.js';
 export { codexAdapter, makeCodexAdapter } from './harness/codex.js';
 export { generateBriefing } from './briefing.js';
+export { effectivePermissionMode } from './permissions.js';
 export { pickBackend } from './supervisor/index.js';
 export type { SupervisorBackend } from './supervisor/types.js';
 export { up, down, restartRoles, rmRole, applyRole } from './ops.js';

package/dist/index.js

@@ -6,6 +6,7 @@ export { registerAdapter, getAdapter, knownAdapters } from './harness/registry.j
 export { claudeCodeAdapter, makeClaudeCodeAdapter } from './harness/claude-code.js';
 export { codexAdapter, makeCodexAdapter } from './harness/codex.js';
 export { generateBriefing } from './briefing.js';
+export { effectivePermissionMode } from './permissions.js';
 export { pickBackend } from './supervisor/index.js';
 export { up, down, restartRoles, rmRole, applyRole } from './ops.js';
 export { spawnPermanent, spawnTemp, buildRoleConfig, profileValues, validateSpawnOpts, } from './spawn.js';

package/dist/owner-channel/channel.d.ts

@@ -2,6 +2,7 @@ import { type ChildProcessWithoutNullStreams } from 'node:child_process';
 import { type OwnerChannelConfig } from '../config.js';
 import type { SessionHandle } from '../session/types.js';
 import { type OwnerFleetOps } from './commands.js';
+import type { ManagedFleetSpawnResult } from '../fleet-proxy.js';
 import { type OursToolClient } from './mcp.js';
 import { type OwnerUpdatePhase } from './notices.js';
 import { type OwnerEntry } from './state.js';
@@ -34,6 +35,8 @@ export interface OwnerChannelHandle {
     drain(): Promise<void>;
     close(): Promise<void>;
     manage(request: OwnerChannelManagementRequest): Promise<OwnerChannelManagementResult>;
+    /** Fleet-owned deterministic lifecycle notice; absent on legacy test doubles. */
+    notifyFleetSpawn?(event: ManagedFleetSpawnResult): Promise<void>;
 }
 export type OwnerChannelManagementRequest = {
     action: 'contact_list';
@@ -155,6 +158,7 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     drain(): Promise<void>;
     close(): Promise<void>;
     manage(request: OwnerChannelManagementRequest): Promise<OwnerChannelManagementResult>;
+    notifyFleetSpawn(event: ManagedFleetSpawnResult): Promise<void>;
     private manageNow;
     private contacts;
     private contact;
@@ -195,6 +199,15 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private isAgentSender;
     private isEffectiveOwner;
     private relayManagedAgentMessage;
+    /**
+     * Caption and files are admitted as one relay transaction. The authenticated
+     * route and optional source wire are fixed before bytes are retrieved, and no
+     * outbound part is emitted until every file passes admission. A transport
+     * failure after emission starts is durably uncertain and never blind-retried;
+     * the managed agent receives one bounded NACK for the whole transaction.
+     */
+    private handleManagedAgentAttachmentGroup;
+    private managedAttachmentReplyWire;
     /**
      * One bounded NACK per wire: an unroutable or refused relay must be visible
      * to the authenticated agent, while its deferred replays stay quiet. NACK

package/dist/owner-channel/channel.js

@@ -157,6 +157,20 @@ export class OwnerChannel {
         this.managementTail = run.then(() => undefined, () => undefined);
         return run;
     }
+    notifyFleetSpawn(event) {
+        const run = this.managementTail.then(async () => {
+            if (!this.ready || this.stopping)
+                throw new Error('owner-channel MCP client is unavailable');
+            const model = event.model ? `, model ${event.model}` : '';
+            const monitor = `${event.monitor.mode} monitor${event.monitor.interrupt ? ' with interruption' : ''}`;
+            const inherited = event.inherited.length
+                ? ` Supervisor inherited omitted defaults: ${event.inherited.join(', ')}.` : '';
+            await this.sendProactiveMessage(`🧑‍💻 ${event.caller} spawned ${event.lifetime} agent ${event.role} `
+                + `(${event.harness}/${event.session}${model}; ${monitor}).${inherited}`, `fleet-spawn\0${event.creationActionId}`, 0);
+        });
+        this.managementTail = run.then(() => undefined, () => undefined);
+        return run;
+    }
     async manageNow(request) {
         if (!this.ready || this.stopping)
             throw new Error('owner-channel MCP client is unavailable');
@@ -337,13 +351,15 @@ export class OwnerChannel {
         await send;
         return { action: request.action, requestId: request.requestId, sequence };
     }
-    async sendProactiveMessage(messageValue) {
+    async sendProactiveMessage(messageValue, digestValue = messageValue, minIntervalMs) {
         if (!this.authorizationIntegrity().ok)
             throw new Error('owner authorization state is corrupt; proactive messages are disabled');
         const message = this.safeProactiveMessage(messageValue);
         const route = this.conversations.route(this.effectiveOwners());
-        const digest = createHash('sha256').update(message).digest('hex');
-        const sending = this.conversations.beginSend(route.contact, digest);
+        const digest = createHash('sha256').update(digestValue).digest('hex');
+        const sending = minIntervalMs === undefined
+            ? this.conversations.beginSend(route.contact, digest)
+            : this.conversations.beginSend(route.contact, digest, Date.now(), minIntervalMs);
         try {
             if (!this.isEffectiveOwner(route.contact))
                 throw new Error('selected proactive owner is no longer authorized');
@@ -542,7 +558,18 @@ export class OwnerChannel {
             if (exact.some(file => file.senderId !== recovery.contact))
                 continue;
             exact.forEach(file => used.add(file.wireId));
-            groups.push({ files: exact, recovery });
+            const caption = recovery.originWireId === recovery.fileWireIds[0]
+                ? undefined : messageByWire.get(recovery.originWireId);
+            if (caption && this.sender(caption).id !== recovery.contact)
+                continue;
+            // A managed-agent caption is deferred before retrieval. If recovery sees
+            // the processed file before that body is replayed, keep the file reserved
+            // by the journal until both halves are present again.
+            if (!caption && !recovery.fileWireIds.includes(recovery.originWireId))
+                continue;
+            if (caption)
+                consumed.add(caption);
+            groups.push({ files: exact, recovery, ...(caption ? { caption } : {}) });
         }
         for (const file of files) {
             if (used.has(file.wireId))
@@ -578,6 +605,9 @@ export class OwnerChannel {
         if (handledWireIds.some(wire => this.inFlight.has(wire)))
             return false;
         const sender = { id: group.files[0].senderId, name: group.files[0].senderName };
+        if (group.files.every(file => this.isAgentSender(file.senderId))
+            && (!group.caption || this.isAgentSender(this.sender(group.caption).id)))
+            return this.handleManagedAgentAttachmentGroup(group, handledWireIds, sender.id);
         if (group.files.some(file => file.senderId !== sender.id)
             || !this.isEffectiveOwner(sender.id)) {
             this.options.log(`[${this.options.role}] owner channel ignored unauthorized attachment sender ${sender.id}`);
@@ -590,6 +620,14 @@ export class OwnerChannel {
                 catch { }
             return true;
         }
+        // Owner files are requests too: retain their authenticated source wire so
+        // a later managed-agent attachment reply cannot drift to a newer owner.
+        try {
+            this.conversations.recordInbound(sender.id, originWireId);
+        }
+        catch (error) {
+            this.logError('owner attachment route update failed', error);
+        }
         const rejection = !this.attachmentRecovery.integrity()
             ? 'attachment recovery state is unavailable'
             : validateAttachmentSelection(group.files, this.attachmentConfig);
@@ -633,7 +671,8 @@ export class OwnerChannel {
             const queued = await this.options.session.queuePrompt(this.ownerAttachmentPrompt(sender, originWireId, requestId, outbox, admitted, group.caption), {
                 interrupt: this.options.config.interrupt,
                 ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
-                origin: { kind: 'owner', requestId },
+                origin: { kind: 'owner', requestId,
+                    ...(group.caption ? { displayText: String(group.caption.text ?? '') } : {}) },
             });
             const accepted = this.options.config.interrupt
                 ? ownerNotices.receivedInterrupting()
@@ -745,9 +784,9 @@ export class OwnerChannel {
             // never prevent an authenticated owner from using the ordinary channel.
             this.logError('owner conversation route update failed', error);
         }
-        const text = String(message.text ?? '').trim();
-        if (isOwnerCommandText(text)) {
-            await this.handleCommand(sender, text, wireId);
+        const text = String(message.text ?? '');
+        if (isOwnerCommandText(text.trim())) {
+            await this.handleCommand(sender, text.trim(), wireId);
             return true;
         }
         const requestId = this.requestId(wireId);
@@ -759,7 +798,7 @@ export class OwnerChannel {
             queued = await this.options.session.queuePrompt(this.ownerPrompt(sender, text, wireId, outbox), {
                 interrupt: this.options.config.interrupt,
                 ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
-                origin: { kind: 'owner', requestId },
+                origin: { kind: 'owner', requestId, displayText: text },
             });
         }
         catch (error) {
@@ -936,6 +975,149 @@ export class OwnerChannel {
             + `wire=${createHash('sha256').update(wireId).digest('hex').slice(0, 12)} `
             + `basis=${route.basis} chars=${Array.from(text).length} bytes=${Buffer.byteLength(text)}`);
     }
+    /**
+     * Caption and files are admitted as one relay transaction. The authenticated
+     * route and optional source wire are fixed before bytes are retrieved, and no
+     * outbound part is emitted until every file passes admission. A transport
+     * failure after emission starts is durably uncertain and never blind-retried;
+     * the managed agent receives one bounded NACK for the whole transaction.
+     */
+    async handleManagedAgentAttachmentGroup(group, handledWireIds, agent) {
+        const captionWire = group.caption ? this.wireId(group.caption) : undefined;
+        const nackWire = captionWire ?? group.files[0].wireId;
+        const nackMessage = group.caption ?? { wire_id: nackWire };
+        let requestDir;
+        let recovery;
+        try {
+            if (!this.authorizationIntegrity().ok)
+                throw new Error('owner authorization state is corrupt; managed-agent relay is disabled');
+            const caption = group.caption ? this.safeRelayMessage(group.caption.text) : undefined;
+            const replyTo = this.managedAttachmentReplyWire(group, captionWire);
+            let route;
+            try {
+                route = replyTo
+                    ? this.conversations.routeForWire(replyTo, this.effectiveOwners())
+                    : this.conversations.route(this.effectiveOwners());
+            }
+            catch (error) {
+                throw new RelayUnroutableError(this.errorText(error));
+            }
+            if (!this.isEffectiveOwner(route.contact))
+                throw new Error('selected attachment relay owner is no longer authorized');
+            const contact = await this.routableContact(route);
+            const rejection = !this.attachmentRecovery.integrity()
+                ? 'attachment recovery state is unavailable'
+                : validateAttachmentSelection(group.files, this.attachmentConfig);
+            if (rejection)
+                throw new Error(rejection);
+            const transactionId = this.requestId(`managed-agent-attachment:${handledWireIds.slice().sort().join(':')}`);
+            recovery = group.recovery ?? {
+                id: transactionId, contact: agent, originWireId: captionWire ?? group.files[0].wireId,
+                fileWireIds: group.files.map(file => file.wireId), createdAt: Date.now(),
+            };
+            if (!group.recovery)
+                this.attachmentRecovery.add(recovery);
+            requestDir = await prepareAttachmentDirectory(this.attachmentRoot, transactionId);
+            const unread = group.files.filter(file => file.status === 'unread');
+            const processed = group.files.filter(file => file.status !== 'unread');
+            const retrieved = unread.length
+                ? parseRetrievedAttachments(await this.client.callTool('get_files', {
+                    wire_ids: unread.map(file => file.wireId),
+                }), unread)
+                : [];
+            for (const file of processed) {
+                if (!group.recovery)
+                    throw new Error('unexpected processed attachment without recovery route');
+                const recoveryPath = join(requestDir, `.recovered-${file.wireId}-${randomUUID()}`);
+                await this.client.callTool('save_file', { wire_id: file.wireId, dest_path: recoveryPath });
+                retrieved.push(await recoveredAttachment(file, recoveryPath));
+            }
+            const order = new Map(group.files.map((file, index) => [file.wireId, index]));
+            retrieved.sort((a, b) => order.get(a.wireId) - order.get(b.wireId));
+            const admitted = await admitAttachments(retrieved, requestDir, this.attachmentConfig);
+            const digest = createHash('sha256').update(`managed-agent-attachment\0${handledWireIds.slice().sort().join('\0')}`).digest('hex');
+            const sending = this.conversations.beginSend(route.contact, digest, Date.now(), 0, 'all');
+            try {
+                if (caption)
+                    await this.send(contact, caption, replyTo);
+                for (const file of admitted) {
+                    await this.client.callTool('send_file', {
+                        contact, path: file.path, filename: file.filename,
+                        ...(replyTo ? { reply_to_wire_id: replyTo } : {}),
+                    });
+                }
+            }
+            catch {
+                try {
+                    this.conversations.finishSend(sending.id, 'uncertain');
+                }
+                catch (error) {
+                    this.logError('managed-agent attachment uncertainty persist failed', error);
+                }
+                throw new Error('caption/file relay delivery outcome is uncertain; it was not retried');
+            }
+            this.conversations.finishSend(sending.id, 'delivered');
+            for (const wire of handledWireIds)
+                this.state.remember(wire);
+            this.attachmentRecovery.remove(recovery.id);
+            this.options.log(`[${this.options.role}] managed-agent attachment transaction relayed `
+                + `wires=${handledWireIds.length} basis=${route.basis} files=${admitted.length} `
+                + `bytes=${admitted.reduce((total, file) => total + file.size, 0)}`);
+            return true;
+        }
+        catch (error) {
+            if (error instanceof DuplicateSendError) {
+                this.options.log(`[${this.options.role}] managed-agent attachment replay consumed`);
+                for (const wire of handledWireIds)
+                    this.state.remember(wire);
+                if (recovery)
+                    try {
+                        this.attachmentRecovery.remove(recovery.id);
+                    }
+                    catch { }
+                return true;
+            }
+            if (error instanceof RelayUnroutableError) {
+                this.options.log(`[${this.options.role}] managed-agent attachment has no owner route; `
+                    + `transaction stays queued: ${this.errorText(error)}`);
+                await this.nackManagedAgent(agent, nackMessage, nackWire, ownerNotices.relayQueued());
+                return false;
+            }
+            this.logError('managed-agent caption/file relay refused', error);
+            await this.nackManagedAgent(agent, nackMessage, nackWire, ownerNotices.relayRefused(this.errorText(error)));
+            // Rejection/admission failure and uncertain transport are terminal and
+            // visible. Consuming every correlated wire prevents a later partial replay.
+            for (const wire of handledWireIds)
+                this.state.remember(wire);
+            if (recovery)
+                try {
+                    this.attachmentRecovery.remove(recovery.id);
+                }
+                catch { }
+            return true;
+        }
+        finally {
+            if (requestDir)
+                await removeRequestDirectory(requestDir).catch(error => {
+                    this.logError('managed-agent attachment cleanup failed', error);
+                });
+        }
+    }
+    managedAttachmentReplyWire(group, captionWire) {
+        const captionReply = group.caption?.reply_to?.wire_id;
+        const candidates = new Set();
+        if (captionReply)
+            candidates.add(captionReply);
+        for (const file of group.files) {
+            const wire = file.replyTo?.wire_id;
+            if (!wire || wire === captionWire)
+                continue;
+            candidates.add(wire);
+        }
+        if (candidates.size > 1)
+            throw new Error('managed-agent caption/file group has conflicting owner reply wires');
+        return candidates.values().next().value;
+    }
     /**
      * One bounded NACK per wire: an unroutable or refused relay must be visible
      * to the authenticated agent, while its deferred replays stay quiet. NACK

package/dist/owner-channel/state.d.ts

@@ -11,7 +11,7 @@ export declare class OwnerChannelState {
     has(wireId: string): boolean;
     remember(wireId: string): void;
 }
-export type OwnerConversationRouteBasis = 'last-inbound' | 'sole-owner';
+export type OwnerConversationRouteBasis = 'last-inbound' | 'sole-owner' | 'source-wire';
 interface OwnerProactiveSend {
     id: string;
     contact: string;
@@ -28,6 +28,7 @@ interface OwnerProactiveSend {
 export declare class OwnerConversationState {
     private readonly path;
     private conversations;
+    private routes;
     private sends;
     private corruptReason?;
     constructor(path: string);
@@ -41,12 +42,17 @@ export declare class OwnerConversationState {
         contact: string;
         basis: OwnerConversationRouteBasis;
     };
+    routeForWire(wireId: string, effective: Set<string>): {
+        contact: string;
+        basis: OwnerConversationRouteBasis;
+    };
     beginSend(contact: string, digest: string, now?: number, minIntervalMs?: number, dedupe?: 'contact' | 'all'): OwnerProactiveSend;
     finishSend(id: string, status: 'delivered' | 'uncertain'): void;
     private mutate;
     private persist;
     private assertHealthy;
     private validConversation;
+    private validRoute;
     private validSend;
 }
 export type OwnerSource = 'baseline' | 'dynamic';

package/dist/owner-channel/state.js

@@ -42,6 +42,7 @@ export class OwnerChannelState {
     }
 }
 const CONVERSATION_LIMIT = 64;
+const WIRE_ROUTE_LIMIT = 512;
 const PROACTIVE_SEND_LIMIT = 256;
 const PROACTIVE_MIN_INTERVAL_MS = 30_000;
 const HEX_64_LOWER = /^[a-f0-9]{64}$/;
@@ -55,6 +56,7 @@ const CID = /^[A-Fa-f0-9]{64}$/;
 export class OwnerConversationState {
     path;
     conversations = [];
+    routes = [];
     sends = [];
     corruptReason;
     constructor(path) {
@@ -63,18 +65,29 @@ export class OwnerConversationState {
             return;
         try {
             const raw = JSON.parse(readFileSync(path, 'utf8'));
-            if (raw.version !== 1 || !Array.isArray(raw.conversations) || !Array.isArray(raw.sends)
+            const legacy = raw.version === 1;
+            const routes = legacy
+                ? (raw.conversations ?? []).map(record => ({
+                    contact: record.contact, wireId: record.lastInboundWireId, at: record.lastInboundAt,
+                }))
+                : raw.routes;
+            if (![1, 2].includes(raw.version ?? 0)
+                || !Array.isArray(raw.conversations) || !Array.isArray(routes) || !Array.isArray(raw.sends)
                 || raw.conversations.length > CONVERSATION_LIMIT
+                || routes.length > WIRE_ROUTE_LIMIT
                 || raw.sends.length > PROACTIVE_SEND_LIMIT
                 || !raw.conversations.every(record => this.validConversation(record))
+                || !routes.every(route => this.validRoute(route))
                 || !raw.sends.every(send => this.validSend(send)))
                 throw new Error('invalid or unbounded conversation state');
             if (new Set(raw.conversations.map(record => record.contact)).size !== raw.conversations.length
+                || new Set(routes.map(route => route.wireId)).size !== routes.length
                 || new Set(raw.sends.map(send => send.id)).size !== raw.sends.length)
                 throw new Error('duplicate conversation state entry');
             this.conversations = raw.conversations.map(record => ({ ...record }));
+            this.routes = routes.map(route => ({ ...route }));
             this.sends = raw.sends.map(send => ({ ...send }));
-            let recovered = false;
+            let recovered = legacy;
             for (const send of this.sends) {
                 if (send.status === 'sending') {
                     send.status = 'uncertain';
@@ -88,6 +101,7 @@ export class OwnerConversationState {
         catch {
             this.corruptReason = 'invalid persisted owner conversation state';
             this.conversations = [];
+            this.routes = [];
             this.sends = [];
             try {
                 chmodSync(path, 0o600);
@@ -118,6 +132,9 @@ export class OwnerConversationState {
                     throw new Error(`owner conversations are limited to ${CONVERSATION_LIMIT}`);
                 this.conversations.push({ contact, lastInboundAt: acceptedAt, lastInboundWireId: wireId });
             }
+            this.routes = this.routes.filter(route => route.wireId !== wireId);
+            this.routes.push({ contact, wireId, at: acceptedAt });
+            this.routes = this.routes.slice(-WIRE_ROUTE_LIMIT);
         });
     }
     remove(contact) {
@@ -127,6 +144,7 @@ export class OwnerConversationState {
             return;
         this.mutate(() => {
             this.conversations = this.conversations.filter(record => canonicalCid(record.contact) !== canonical);
+            this.routes = this.routes.filter(route => canonicalCid(route.contact) !== canonical);
         });
     }
     route(effective) {
@@ -146,6 +164,14 @@ export class OwnerConversationState {
             return { contact: [...effective][0], basis: 'sole-owner' };
         throw new Error('no authenticated owner conversation route is available yet');
     }
+    routeForWire(wireId, effective) {
+        this.assertHealthy();
+        const route = [...this.routes].reverse().find(item => item.wireId === wireId);
+        const allowed = new Set([...effective].map(canonicalCid));
+        if (!route || !allowed.has(canonicalCid(route.contact)))
+            throw new Error('no authenticated owner route matches the source wire');
+        return { contact: route.contact, basis: 'source-wire' };
+    }
     beginSend(contact, digest, now = Date.now(), minIntervalMs = PROACTIVE_MIN_INTERVAL_MS, dedupe = 'contact') {
         this.assertHealthy();
         if (!CID.test(contact) || !HEX_64_LOWER.test(digest))
@@ -177,7 +203,9 @@ export class OwnerConversationState {
         this.mutate(() => { send.status = status; });
     }
     mutate(change) {
-        const snapshot = JSON.stringify({ conversations: this.conversations, sends: this.sends });
+        const snapshot = JSON.stringify({
+            conversations: this.conversations, routes: this.routes, sends: this.sends,
+        });
         change();
         try {
             this.persist();
@@ -185,13 +213,14 @@ export class OwnerConversationState {
         catch (error) {
             const old = JSON.parse(snapshot);
             this.conversations = old.conversations;
+            this.routes = old.routes;
             this.sends = old.sends;
             throw error;
         }
     }
     persist() {
         replaceFileAtomically(this.path, JSON.stringify({
-            version: 1, conversations: this.conversations, sends: this.sends,
+            version: 2, conversations: this.conversations, routes: this.routes, sends: this.sends,
         }) + '\n', 0o600);
         chmodSync(this.path, 0o600);
     }
@@ -207,6 +236,14 @@ export class OwnerConversationState {
             && record.lastInboundAt >= 0 && typeof record.lastInboundWireId === 'string'
             && record.lastInboundWireId.length > 0 && record.lastInboundWireId.length <= 1_024;
     }
+    validRoute(value) {
+        if (!value || typeof value !== 'object')
+            return false;
+        const route = value;
+        return CID.test(route.contact) && typeof route.wireId === 'string'
+            && route.wireId.length > 0 && route.wireId.length <= 1_024
+            && Number.isSafeInteger(route.at) && route.at >= 0;
+    }
     validSend(value) {
         if (!value || typeof value !== 'object')
             return false;