@ours.network/fleet 0.15.3 → 0.15.5

package/README.md

@@ -300,7 +300,7 @@ defaults:
   harness: claude-code                  # for roles that don't set one
   session: tmux                         # tmux (default) | acp
   permissions:                         # common intent, translated by each harness/backend
-    approval: ask                       # ask | allow | deny
+    approval: ask                       # ask | auto | allow (`deny` is a deprecated alias)
     filesystem: workspace               # read-only | workspace | unrestricted
     unattended: deny                    # deny | wait
   model: claude-fable-5                 # default model for roles that don't set one (per-role model / --model wins)
@@ -328,7 +328,7 @@ roles:
     owner_channel:                      # optional trusted owner ingress; requires session: acp
       identity: "Name Owner Channel"     # existing, dedicated ours identity bound only by fleet
       owners: [owner-contact-cid]        # authenticated ours contact IDs, never display names
-      agent: managed-agent-cid           # exact role identity CID allowed to relay messages outward
+      agent: managed-agent-cid           # exact role CID allowed to relay messages/files outward
       interrupt: false                  # false queues; true cancels current work first
       progress_interval_ms: 30000        # fleet-generated progress notices; 0 disables
       attachments:                      # secure inbound documents, images, and voice
@@ -467,15 +467,22 @@ native settings actually grant, against a fixed floor:
 those requests with nobody to see it. With `unattended: wait` it **warns**,
 since a human can still attach a console and answer.
 
-**Security meaning.** `approval: allow` maps to Claude's `bypassPermissions`,
-the mode that actually permits the actions the role was authorized to take.
+**Security meaning.** `ask` maps to Codex `untrusted` / Claude `default`,
+`auto` to Codex `on-request` / Claude `acceptEdits`, and `allow` to Codex
+`never` / Claude `bypassPermissions`, the non-interactive modes that actually
+permit the actions the role was authorized to take.
 `dontAsk` suppresses only the *prompt*, not the denial, which is why an
-`allow` role previously ran unable to do its job. Nothing but an explicit
-`allow` is elevated: `ask` keeps Claude's default mode and `deny` maps to
-`plan`. `allow` is a real grant — give it deliberately, and keep per-role
+`allow` role previously ran unable to do its job. Legacy `deny` is accepted
+only for compatibility and retains its conservative Codex `on-request` /
+Claude `plan` translation. `allow` is a real grant — give it deliberately, and keep per-role
 [`isolation:`](#agent-isolation) as the outer boundary, which no permission
 mode can cross.
 
+ACP exposes agent-specific session mode IDs and `session/set_mode`, but no
+portable permission-policy capability. Fleet uses that primitive where an
+adapter has a corresponding mode and otherwise translates at the adapter;
+live session metadata reports both normalized and harness-native modes.
+
 ### Isolation at creation time
 
 ```sh
@@ -644,15 +651,16 @@ These commands require a running ACP role with `owner_channel` enabled. Missing,
 stopped, tmux, disabled, draining, and unavailable-MCP targets fail without
 starting a second client, binding an identity, or opening a network listener.
 
-The managed agent has one outbound rule: use its ordinary ours `send_message`
-tool to message the channel identity. Fleet checks that the authenticated sender
-CID exactly equals `agent`, then forwards the body as a new message to the owner
-CID that most recently sent inbound channel mail. This applies equally to progress,
-blockers, suggestions, and proactive notes: there is no task/request/update type.
-The agent never chooses an owner recipient. A single configured owner is the safe
-fallback; multiple owners without route history fail closed instead of guessing or
-broadcasting. Different devices sharing one ours identity share one CID, while
-separate authorized identities naturally hand off the route when either sends.
+The managed agent can use its ordinary ours `send_message` or `send_file` tool to
+message the channel identity. Fleet checks that the authenticated sender CID
+exactly equals `agent`, then forwards the body/file to a resolved authenticated
+owner route. This applies equally to blockers, suggestions, proactive notes, and
+ordinary files: there is no model-selected owner recipient. An explicit reply wire
+pins a file to that wire's owner; otherwise the latest authenticated owner is used.
+A single configured owner is the safe fallback; multiple owners without route
+history fail closed instead of guessing or broadcasting. Different devices sharing
+one ours identity share one CID, while separate authorized identities naturally
+hand off the unscoped route when either sends.
 
 Messages from CIDs which are neither an owner nor the configured agent are never
 injected or relayed. Fleet consumes the attempt, does not answer its sender, and
@@ -664,18 +672,32 @@ An owner request follows one ordered lifecycle on its authenticated source wire:
 
 1. Fleet sends an immediate receipt describing started, queued, or interrupting state.
 2. Periodic fleet-generated summaries may report allowlisted ACP activity shapes.
-3. The agent may send any non-final message to the channel identity through its
+3. On maintained Codex ACP adapters, assistant chunks carrying the exact
+   `_meta.codex.phase = "commentary"` marker are automatically batched and forwarded
+   on this request's fixed owner CID/source wire. Unknown or absent phases are never
+   inferred as commentary; thoughts, tools, permissions, prompts, and raw events are
+   excluded by event kind. Older adapters therefore retain final-only behavior.
+4. The agent may also send any non-final or out-of-turn message through its
    ordinary ours MCP tool. CID authentication is the message gate; no task ID,
    request ID, phase, reply reference, or routing command is used.
-4. The agent may send a caption and one or more files to the channel identity.
+ 4. The agent may send a caption and one or more files to the channel identity.
    A reply reference selects the authenticated owner of that exact source wire;
    an uncorrelated group uses the latest authenticated owner (or the sole-owner
    fallback). Fleet resolves that route once, admits every file before emitting
    any part, then sends the caption and files to the same owner on the same route.
-5. Fleet independently emits exactly one final ACP response (or a sanitized
+ 5. Fleet independently emits exactly one final ACP response (or a sanitized
    terminal outcome). Successful owner-request turns send regular files from the
    request outbox afterward, correlated to the same source wire.
 
+Commentary uses a 750 ms latency flush plus paragraph and 1,600-character/6,400-byte
+boundaries, with at most 32 updates and 512 in-memory fragment dedupe keys per turn.
+The terminal boundary flushes commentary before the final. Replay-marked fragments,
+wrong turns, wrong typed origins, missing message IDs, and unsafe/ambiguous content
+fail closed. Commentary plaintext buffers and fragment keys are memory-only; bounded
+wire-and-batch digests plus sending/delivered/uncertain status are persisted before
+transport. Thus reconnect replay and crash recovery never blindly resend the same
+batch, while an uncertain in-flight update may be omitted rather than duplicated.
+
 Fleet chooses the stored latest authenticated owner for every managed-agent
 message; the model supplies only text and the channel contact. Relay audit logs
 contain hashed wire prefixes and sizes, never bodies. A durable pre-send marker
@@ -806,6 +828,19 @@ admission. The host must run an ours-mcp version whose
 these guarantees; `ours-mcp voice-status --json` reports whether transcription
 is currently configured.
 
+Managed-agent file egress is a separate trust direction. It retains the same
+metadata provenance checks, count/per-file/request byte caps, regular-file and
+no-symlink reads, actual byte-count/SHA-256 verification, filename sanitization,
+private staging, fixed owner routing, and bounded body-free recovery metadata.
+It deliberately does not consult `attachments.enabled` or `allowed_mime`; MIME is
+still detected during byte validation, but a declared-versus-detected mismatch is
+not an egress deny gate. Markdown, HTML, octet-stream, unknown extensions, and normal
+binaries are therefore routable only from the exact configured `agent` CID.
+Owner-to-agent admission above remains byte-for-byte strict. Each outbound file
+gets a durable pre-send marker: a failed/ambiguous send becomes `uncertain` and is
+not blindly retried, while files not yet attempted remain recoverable after restart.
+Logs contain counts and byte totals, never filenames or raw bytes.
+
 Owner channels currently require `session: acp`. Fleet needs structured,
 turn-correlated assistant output for automatic replies; scraping a tmux pane
 cannot reliably distinguish the final answer from thoughts, tool output, or

package/dist/application/fleet-query-service.js

@@ -150,6 +150,9 @@ export class FleetQueryService {
                     readiness: snapshot.readiness, evidence: 'authoritative',
                     sessionId: snapshot.sessionId, lastError: snapshot.lastError,
                     pendingPermissionId: snapshot.pendingPermissionId,
+                    protocolVersion: snapshot.protocolVersion, features: snapshot.features,
+                    runtimeModel: snapshot.runtimeModel, reasoningEffort: snapshot.reasoningEffort,
+                    permissionMode: snapshot.permissionMode,
                 };
             }
             catch (error) {

package/dist/application/model-catalog.d.ts

@@ -0,0 +1,20 @@
+export type ModelCatalogSource = 'codex-runtime-catalog' | 'claude-adapter-2.1' | 'fleet-config';
+export interface HarnessModelOption {
+    id: string;
+    label: string;
+    reasoningEfforts: string[];
+    defaultReasoningEffort?: string;
+    source: ModelCatalogSource;
+}
+export interface HarnessModelCatalog {
+    models: HarnessModelOption[];
+    warnings: string[];
+}
+/** Read Codex's locally materialized `model/list` result; never invent fallback aliases. */
+export declare function codexModelCatalog(path?: string): HarnessModelCatalog;
+/**
+ * Claude Code 2.1 has no typed model-list endpoint. These exact IDs are the
+ * versioned adapter contract shipped by the installed 2.1 CLI, not aliases and
+ * not a claim about account entitlement (which Claude validates at launch).
+ */
+export declare function claudeModelCatalog(): HarnessModelCatalog;

package/dist/application/model-catalog.js

@@ -0,0 +1,57 @@
+import { readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+const validId = (value) => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9._[\]-]{0,127}$/.test(value);
+/** Read Codex's locally materialized `model/list` result; never invent fallback aliases. */
+export function codexModelCatalog(path = join(homedir(), '.codex', 'models_cache.json')) {
+    try {
+        if (statSync(path).size > 2_000_000)
+            throw new Error('catalog exceeds the 2 MB safety limit');
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        const models = (parsed.models ?? []).flatMap(raw => {
+            if (!raw || typeof raw !== 'object')
+                return [];
+            const model = raw;
+            if (model.visibility !== 'list' || !validId(model.slug))
+                return [];
+            const levels = Array.isArray(model.supported_reasoning_levels)
+                ? model.supported_reasoning_levels.flatMap(level => {
+                    const effort = level?.effort;
+                    return validId(effort) ? [effort] : [];
+                }) : [];
+            return [{
+                    id: model.slug,
+                    label: typeof model.display_name === 'string' ? model.display_name : model.slug,
+                    reasoningEfforts: [...new Set(levels)],
+                    ...(validId(model.default_reasoning_level)
+                        ? { defaultReasoningEffort: model.default_reasoning_level } : {}),
+                    source: 'codex-runtime-catalog',
+                }];
+        });
+        if (!models.length)
+            throw new Error('catalog has no picker-visible models');
+        return { models, warnings: [] };
+    }
+    catch (error) {
+        return {
+            models: [],
+            warnings: [`Codex runtime model catalog unavailable: ${error.message}. Use Advanced to enter an exact ID.`],
+        };
+    }
+}
+/**
+ * Claude Code 2.1 has no typed model-list endpoint. These exact IDs are the
+ * versioned adapter contract shipped by the installed 2.1 CLI, not aliases and
+ * not a claim about account entitlement (which Claude validates at launch).
+ */
+export function claudeModelCatalog() {
+    const reasoningEfforts = ['low', 'medium', 'high', 'xhigh', 'max'];
+    return {
+        models: [
+            { id: 'claude-fable-5', label: 'Claude Fable 5', reasoningEfforts, source: 'claude-adapter-2.1' },
+            { id: 'claude-opus-5', label: 'Claude Opus 5', reasoningEfforts, source: 'claude-adapter-2.1' },
+            { id: 'claude-sonnet-5', label: 'Claude Sonnet 5', reasoningEfforts, source: 'claude-adapter-2.1' },
+        ],
+        warnings: ['Claude Code exposes no typed model-list endpoint; choices are exact 2.1 adapter IDs and entitlement is validated at launch.'],
+    };
+}

package/dist/application/role-creation-service.d.ts

@@ -3,11 +3,13 @@ import { type IdentityProvisioner } from '../creation.js';
 import { type SupervisorLauncher } from '../spawn.js';
 import type { OpsDeps } from '../ops.js';
 import { FleetError } from './errors.js';
+import { type HarnessModelCatalog, type HarnessModelOption } from './model-catalog.js';
 export interface CreateRoleSessionRequest {
     name: string;
     harness: 'codex' | 'claude-code';
     /** null means the selected harness's own default; web blank fields send null. */
     model?: string | null;
+    reasoningEffort?: string | null;
     session: 'acp' | 'tmux';
     cwd?: string;
     lifetime: 'permanent' | 'temporary';
@@ -40,6 +42,9 @@ export interface CreationCapabilities {
         sessions: Array<'acp' | 'tmux'>;
         defaultModel?: string;
         models: string[];
+        modelOptions: HarnessModelOption[];
+        catalogSource: string;
+        customModelAllowed: true;
         warnings: string[];
     }>;
     lifetimes: Array<'permanent' | 'temporary'>;
@@ -66,6 +71,7 @@ export interface CreationPreview {
         harness: string;
         session: 'acp' | 'tmux';
         model?: string;
+        reasoningEffort?: string;
         cwd?: string;
         lifetime: 'permanent' | 'temporary';
         permissions: CommonPermissions;
@@ -115,6 +121,7 @@ export interface RoleCreationServiceOptions {
     journalDir?: string;
     probeReady?: (name: string, session: 'acp' | 'tmux') => Promise<'ready' | 'attention' | 'unknown'>;
     onProgress?: (action: CreationAction) => void;
+    modelCatalogs?: Partial<Record<'codex' | 'claude-code', () => HarnessModelCatalog>>;
 }
 export declare class RoleCreationService {
     private readonly options;

package/dist/application/role-creation-service.js

@@ -7,6 +7,7 @@ import { replaceFileAtomically } from '../atomic-file.js';
 import { stateRoot } from '../paths.js';
 import { buildRoleConfig, spawnPermanent, spawnTemp, validateSpawnOpts, } from '../spawn.js';
 import { FleetError, normalizeError } from './errors.js';
+import { claudeModelCatalog, codexModelCatalog, } from './model-catalog.js';
 const canonical = (value) => {
     if (Array.isArray(value))
         return `[${value.map(canonical).join(',')}]`;
@@ -48,13 +49,21 @@ export class RoleCreationService {
         catch (error) {
             reasons.push(`configuration is invalid: ${error.message}`);
         }
-        const modelsFor = (harness, suggested) => {
+        const modelsFor = (harness, catalog) => {
             const configured = roles.filter(role => role.harness === harness)
                 .flatMap(role => [role.model, ...(role.model_chain ?? [])])
                 .filter((model) => Boolean(model));
             const inherited = resolveRoleModel(undefined, harness, defaults);
-            return [...new Set([...(inherited ? [inherited] : []), ...configured, ...suggested])];
+            const configuredOptions = [...new Set([...(inherited ? [inherited] : []), ...configured])]
+                .filter(id => !catalog.models.some(model => model.id === id))
+                .map(id => ({ id, label: `${id} (configured)`, reasoningEfforts: [], source: 'fleet-config' }));
+            const modelOptions = [...configuredOptions, ...catalog.models];
+            return { modelOptions, models: modelOptions.map(model => model.id) };
         };
+        const codexCatalog = this.options.modelCatalogs?.codex?.() ?? codexModelCatalog();
+        const claudeCatalog = this.options.modelCatalogs?.['claude-code']?.() ?? claudeModelCatalog();
+        const codexModels = modelsFor('codex', codexCatalog);
+        const claudeModels = modelsFor('claude-code', claudeCatalog);
         return {
             available: reasons.length === 0,
             reasons,
@@ -62,12 +71,14 @@ export class RoleCreationService {
                 {
                     id: 'codex', available: true, sessions: ['acp', 'tmux'],
                     defaultModel: resolveRoleModel(undefined, 'codex', defaults),
-                    models: modelsFor('codex', ['gpt-5.6', 'gpt-5.4']), warnings: [],
+                    ...codexModels, catalogSource: 'codex-runtime-catalog', customModelAllowed: true,
+                    warnings: codexCatalog.warnings,
                 },
                 {
                     id: 'claude-code', available: true, sessions: ['acp', 'tmux'],
                     defaultModel: resolveRoleModel(undefined, 'claude-code', defaults),
-                    models: modelsFor('claude-code', ['sonnet', 'opus', 'haiku']), warnings: [],
+                    ...claudeModels, catalogSource: 'claude-adapter-2.1', customModelAllowed: true,
+                    warnings: claudeCatalog.warnings,
                 },
             ],
             lifetimes: ['permanent', 'temporary'],
@@ -100,6 +111,7 @@ export class RoleCreationService {
             harness: request.harness ?? defaults.harness ?? 'claude-code',
             session: request.session ?? defaults.session ?? 'tmux',
             model: resolveRoleModel(request.model, request.harness, defaults),
+            reasoningEffort: request.reasoningEffort ?? undefined,
             cwd, lifetime: request.lifetime,
             permissions: resolvePermissions(defaults.permissions, request.permissions),
             monitor: resolveMonitorConfig(defaults.monitor, request.monitor),
@@ -252,6 +264,9 @@ export class RoleCreationService {
         if (!['permanent', 'temporary'].includes(input.lifetime))
             throw new FleetError('invalid_request', 'unsupported lifetime');
         bounded(input.model ?? undefined, 'model', 128);
+        bounded(input.reasoningEffort ?? undefined, 'reasoning effort', 16);
+        if (input.reasoningEffort != null && !['low', 'medium', 'high', 'xhigh', 'max', 'ultra'].includes(input.reasoningEffort))
+            throw new FleetError('invalid_request', 'unsupported reasoning effort');
         bounded(input.mission, 'mission', 4_096);
         bounded(input.coordinator, 'coordinator', 128);
         bounded(input.bio, 'bio', 8_192);
@@ -266,6 +281,7 @@ export class RoleCreationService {
         }
         return {
             ...input, model: input.model === null ? null : input.model?.trim() || undefined,
+            reasoningEffort: input.reasoningEffort === null ? null : input.reasoningEffort?.trim() || undefined,
             mission: input.mission?.trim() || undefined, coordinator: input.coordinator?.trim() || undefined,
             bio: input.bio?.trim() || undefined, persona: input.persona?.trim() || undefined,
             monitor: input.monitor ? structuredClone(input.monitor) : undefined,
@@ -295,6 +311,7 @@ export class RoleCreationService {
         return {
             name: request.name, identity: request.name, harness: request.harness,
             model: request.model, session: request.session, cwd: request.cwd,
+            reasoningEffort: request.reasoningEffort,
             mission: request.mission, coordinator: request.coordinator,
             approval: request.permissions.approval, filesystem: request.permissions.filesystem,
             unattended: request.permissions.unattended, bio: request.bio, persona: request.persona,

package/dist/application/role-removal-service.d.ts

@@ -0,0 +1,32 @@
+import { type OpsDeps } from '../ops.js';
+export interface RoleRemovalPreview {
+    role: string;
+    configured: boolean;
+    lifetime: 'permanent' | 'temporary' | 'orphan';
+    effects: string[];
+    confirmation: 'typed-role-name' | 'confirm';
+    coordinatorProtection: boolean;
+    selfProtected: boolean;
+    recovery: {
+        available: boolean;
+        detail: string;
+    };
+}
+export declare class RoleRemovalService {
+    private readonly options;
+    constructor(options: {
+        configPath?: string;
+        ops: OpsDeps;
+        currentControlRole?: string;
+    });
+    preview(requested: string): RoleRemovalPreview;
+    remove(input: {
+        role: string;
+        confirmation?: string;
+        confirmed?: boolean;
+        coordinatorAcknowledged?: boolean;
+    }): Promise<RoleRemovalPreview & {
+        removed: true;
+        recoveryPath: string;
+    }>;
+}

package/dist/application/role-removal-service.js

@@ -0,0 +1,87 @@
+import { cpSync, existsSync, mkdirSync, readdirSync, renameSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { loadConfig, ROLE_NAME_RE } from '../config.js';
+import { agentDir, stateRoot } from '../paths.js';
+import { rmRole } from '../ops.js';
+import { FleetError } from './errors.js';
+export class RoleRemovalService {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    preview(requested) {
+        if (!ROLE_NAME_RE.test(requested))
+            throw new FleetError('invalid_request', 'invalid role name');
+        const cfg = loadConfig(this.options.configPath);
+        const names = new Set(cfg.roles.map(role => role.name));
+        for (const root of [dirname(agentDir('_')), dirname(agentDir('_', true))]) {
+            try {
+                for (const entry of readdirSync(root, { withFileTypes: true }))
+                    if (entry.isDirectory())
+                        names.add(entry.name);
+            }
+            catch { /* missing state root */ }
+        }
+        const folded = [...names].filter(name => name.toLocaleLowerCase('en-US') === requested.toLocaleLowerCase('en-US'));
+        if (folded.length > 1)
+            throw new FleetError('conflict', `case-fold collision: ${folded.sort().join(', ')}; use the exact role name`);
+        if (!names.has(requested)) {
+            if (folded.length)
+                throw new FleetError('conflict', `role names are case-sensitive; use '${folded[0]}' exactly`);
+            throw new FleetError('role_not_found', `no such configured or state-backed role '${requested}'`);
+        }
+        const role = cfg.roles.find(item => item.name === requested);
+        const permanentState = agentDir(requested);
+        const temporaryState = agentDir(requested, true);
+        const lifetime = existsSync(temporaryState) && !existsSync(permanentState)
+            ? 'temporary' : role ? 'permanent' : 'orphan';
+        const coordinatorProtection = cfg.roles.some(item => item.name !== requested && item.coordinator === requested);
+        const selfProtected = this.options.currentControlRole === requested;
+        const effects = [
+            `Stop and uninstall the exact backend registration for '${requested}'.`,
+            `Archive then remove ${lifetime === 'temporary' ? temporaryState : permanentState}.`,
+        ];
+        if (role?.sourceFile.includes('/fleet.d/'))
+            effects.push(`Remove spawned configuration ${role.sourceFile}.`);
+        else if (role)
+            effects.push(`Keep hand-written configuration ${role.sourceFile}; the role can be recreated from it.`);
+        else
+            effects.push('Clean dangling unit/state left before configuration registration completed.');
+        return {
+            role: requested, configured: Boolean(role), lifetime, effects,
+            confirmation: lifetime === 'temporary' ? 'confirm' : 'typed-role-name',
+            coordinatorProtection, selfProtected,
+            recovery: { available: true, detail: 'State and spawned configuration are copied to the local removal archive before deletion.' },
+        };
+    }
+    async remove(input) {
+        const preview = this.preview(input.role);
+        if (preview.selfProtected)
+            throw new FleetError('forbidden', 'the current control role cannot remove itself from its own web session');
+        if (preview.coordinatorProtection && !input.coordinatorAcknowledged)
+            throw new FleetError('prerequisite_unavailable', 'this role coordinates other configured roles; acknowledge the impact explicitly');
+        if (preview.confirmation === 'typed-role-name' && input.confirmation !== preview.role)
+            throw new FleetError('invalid_request', `type '${preview.role}' exactly to confirm removal`);
+        if (preview.confirmation === 'confirm' && input.confirmed !== true)
+            throw new FleetError('invalid_request', 'explicit confirmation is required');
+        const cfg = loadConfig(this.options.configPath);
+        const role = cfg.roles.find(item => item.name === preview.role);
+        const sourceState = preview.lifetime === 'temporary' ? agentDir(preview.role, true) : agentDir(preview.role);
+        const stamp = new Date().toISOString().replaceAll(/[:.]/g, '-');
+        const recoveryPath = join(stateRoot(), 'recovery', 'removed', `${stamp}-${preview.role}`);
+        mkdirSync(recoveryPath, { recursive: true, mode: 0o700 });
+        if (existsSync(sourceState))
+            cpSync(sourceState, join(recoveryPath, 'state'), { recursive: true });
+        if (role?.sourceFile.includes('/fleet.d/') && existsSync(role.sourceFile))
+            cpSync(role.sourceFile, join(recoveryPath, basename(role.sourceFile)));
+        if (role)
+            await rmRole(cfg, preview.role, this.options.ops);
+        else {
+            await this.options.ops.backend.uninstall(preview.role);
+            if (existsSync(sourceState))
+                renameSync(sourceState, join(recoveryPath, 'orphan-state'));
+            this.options.ops.log(`removed orphaned backend/state '${preview.role}'`);
+        }
+        return { ...preview, removed: true, recoveryPath };
+    }
+}

package/dist/application/role-repository.js

@@ -3,6 +3,7 @@ import { join, relative } from 'node:path';
 import { parse } from 'yaml';
 import { loadConfig, resolveMonitorConfig, resolvePermissions, ROLE_NAME_RE, } from '../config.js';
 import { agentsRoot, tmpRoot } from '../paths.js';
+import { readSpawnLineage } from '../web/topology.js';
 const MAX_SNAPSHOT_BYTES = 256 * 1024;
 function safeDirs(root) {
     try {
@@ -15,11 +16,18 @@ function safeDirs(root) {
     }
 }
 function view(role) {
+    const options = role.harness_options;
     return {
         name: role.name, harness: role.harness, session: role.session, identity: role.identity,
         mission: role.mission, coordinator: role.coordinator, model: role.model,
         cwd: role.cwd ? redactHome(role.cwd) : undefined,
         permissions: role.permissions,
+        nativeRuntime: {
+            ...(typeof options?.approval === 'string' ? { approval: options.approval } : {}),
+            ...(typeof options?.permission_mode === 'string' ? { permissionMode: options.permission_mode } : {}),
+            ...(typeof options?.sandbox === 'string' ? { sandbox: options.sandbox } : {}),
+        },
+        oversee: role.oversee,
     };
 }
 function redactHome(path) {
@@ -112,17 +120,21 @@ export class RoleRepository {
                     code: 'backend_mismatch', severity: 'warning',
                     detail: `configured ${intended}, detected ${detected}`,
                 });
+            const stateRef = inTemporary ? { lifetime: 'temporary' }
+                : inPermanent ? { lifetime: 'permanent' } : undefined;
+            const tempStateDir = inTemporary ? join(temporaryRoot, name) : undefined;
             return {
                 id: name,
                 lifetime: config ? 'permanent' : inTemporary ? 'temporary' : 'orphan',
                 configured: Boolean(config),
                 config: config ? view(config) : tempRole ? view(tempRole) : undefined,
-                stateRef: inTemporary ? { lifetime: 'temporary' } : inPermanent ? { lifetime: 'permanent' } : undefined,
+                stateRef,
                 stateHealth,
                 configuredBackend: intended,
                 detectedBackend: detected,
                 compatibility: { compatible: true },
                 problems,
+                lineage: tempStateDir ? readSpawnLineage(tempStateDir) : undefined,
             };
         });
     }

package/dist/application/session-control.d.ts

@@ -1,7 +1,18 @@
 import { controlRequest } from '../session/control.js';
+import type { ConversationEventV1, ConversationSnapshot, PromptReceipt } from '../session/conversation-types.js';
 import type { SessionSnapshot } from '../session/types.js';
 import { Tmux } from '../tmux.js';
 import type { OutputPage, SendReceipt, SessionDescriptor } from './types.js';
+export interface ConversationPageView {
+    events: ConversationEventV1[];
+    firstAvailableCursor?: string;
+    nextCursor?: string;
+    hasMore: boolean;
+    snapshot: ConversationSnapshot;
+}
+export interface ConversationFollowHandle {
+    close(): void;
+}
 export interface RoleSessionControl {
     describe(): Promise<SessionDescriptor>;
     snapshot(): Promise<SessionSnapshot>;
@@ -19,6 +30,40 @@ export interface RoleSessionControl {
     }): Promise<{
         accepted: true;
     }>;
+    conversationPage?(request: {
+        after?: string;
+        limit?: number;
+    }): Promise<ConversationPageView>;
+    submitPromptV2?(request: {
+        commandId: string;
+        text: string;
+        actorBrowserSession: string;
+        source: 'owner_admin_console';
+    }): Promise<PromptReceipt>;
+    interruptV2?(commandId: string): Promise<{
+        accepted: true;
+        commandId: string;
+    }>;
+    respondPermissionV2?(request: {
+        commandId: string;
+        permissionId: string;
+        optionId: string;
+        sessionGeneration: string;
+    }): Promise<{
+        accepted: true;
+        commandId: string;
+    }>;
+    /**
+     * Open a live follow on the role's ledger. `onPage` receives the initial
+     * replay page; `onEvent` every subsequent durable event; `onClose` fires
+     * exactly once when the underlying control stream ends.
+     */
+    followConversation?(request: {
+        after?: string;
+        onPage(page: ConversationPageView): void;
+        onEvent(event: ConversationEventV1): void;
+        onClose(reason?: string): void;
+    }): Promise<ConversationFollowHandle>;
 }
 export declare class AcpRoleSessionAdapter implements RoleSessionControl {
     private readonly stateDir;
@@ -34,6 +79,35 @@ export declare class AcpRoleSessionAdapter implements RoleSessionControl {
     interrupt(): Promise<{
         accepted: true;
     }>;
+    conversationPage(request?: {
+        after?: string;
+        limit?: number;
+    }): Promise<ConversationPageView>;
+    submitPromptV2(request: {
+        commandId: string;
+        text: string;
+        actorBrowserSession: string;
+        source: 'owner_admin_console';
+    }): Promise<PromptReceipt>;
+    interruptV2(commandId: string): Promise<{
+        accepted: true;
+        commandId: string;
+    }>;
+    respondPermissionV2(request: {
+        commandId: string;
+        permissionId: string;
+        optionId: string;
+        sessionGeneration: string;
+    }): Promise<{
+        accepted: true;
+        commandId: string;
+    }>;
+    followConversation(request: {
+        after?: string;
+        onPage(page: ConversationPageView): void;
+        onEvent(event: ConversationEventV1): void;
+        onClose(reason?: string): void;
+    }): Promise<ConversationFollowHandle>;
     respondPermission(request: {
         permissionId: string;
         optionId: string;