@ours.network/fleet 0.15.3 → 0.15.5

package/dist/owner-channel/channel.js

@@ -10,7 +10,7 @@ import { OursMcpClient } from './mcp.js';
 import { ownerNotices } from './notices.js';
 import { DuplicateSendError, OwnerAuthorizationState, OwnerChannelState, OwnerConversationState, } from './state.js';
 import { OwnerTaskState, ownerTaskAuditId, ownerTaskDigest, } from './tasks.js';
-import { AttachmentRecoveryState, admitAttachments, cleanupAttachmentRoot, parseIncomingAttachments, parseRetrievedAttachments, prepareAttachmentDirectory, recoveredAttachment, removeRequestDirectory, safeField, validateAttachmentSelection, } from './attachments.js';
+import { AttachmentRecoveryState, admitAttachments, cleanupAttachmentRoot, parseIncomingAttachments, parseRetrievedAttachments, prepareAttachmentDirectory, recoveredAttachment, removeRequestDirectory, safeField, validateAttachmentSelection, validateAttachmentRelaySelection, } from './attachments.js';
 import { acquireOwnerBinderLease, OWNER_BIND_HANDOFF_TIMEOUT_MS, } from './binder.js';
 const OWNER_UPDATE_MIN_INTERVAL_MS = 5_000;
 const OWNER_UPDATE_MAX_COUNT = 20;
@@ -19,6 +19,11 @@ const OWNER_UPDATE_MAX_BYTES = 1_024;
 const PROACTIVE_MESSAGE_MAX_CHARS = 4_000;
 const PROACTIVE_MESSAGE_MAX_BYTES = 16_384;
 const RELAY_NACK_MEMORY = 512;
+const COMMENTARY_FLUSH_MS = 750;
+const COMMENTARY_MAX_CHARS = 1_600;
+const COMMENTARY_MAX_BYTES = 6_400;
+const COMMENTARY_MAX_UPDATES = 32;
+const COMMENTARY_DEDUPE_LIMIT = 512;
 /** A relay attempt that failed only because no owner route exists yet. */
 class RelayUnroutableError extends Error {
 }
@@ -671,7 +676,8 @@ export class OwnerChannel {
             const queued = await this.options.session.queuePrompt(this.ownerAttachmentPrompt(sender, originWireId, requestId, outbox, admitted, group.caption), {
                 interrupt: this.options.config.interrupt,
                 ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
-                origin: { kind: 'owner', requestId },
+                origin: { kind: 'owner', requestId,
+                    ...(group.caption ? { displayText: String(group.caption.text ?? '') } : {}) },
             });
             const accepted = this.options.config.interrupt
                 ? ownerNotices.receivedInterrupting()
@@ -685,6 +691,8 @@ export class OwnerChannel {
             const active = {
                 contact: sender.id, wireId: originWireId, requestId, outboundTail: receipt,
                 finalizing: false, updateCount: 0, updateDigests: new Set(), handledWireIds,
+                commentaryBuffer: '', commentaryCount: 0, commentaryKeys: new Set(),
+                commentaryDisabled: false,
             };
             this.activeRequests.set(requestId, active);
             const cleanupDir = requestDir;
@@ -783,9 +791,9 @@ export class OwnerChannel {
             // never prevent an authenticated owner from using the ordinary channel.
             this.logError('owner conversation route update failed', error);
         }
-        const text = String(message.text ?? '').trim();
-        if (isOwnerCommandText(text)) {
-            await this.handleCommand(sender, text, wireId);
+        const text = String(message.text ?? '');
+        if (isOwnerCommandText(text.trim())) {
+            await this.handleCommand(sender, text.trim(), wireId);
             return true;
         }
         const requestId = this.requestId(wireId);
@@ -797,7 +805,7 @@ export class OwnerChannel {
             queued = await this.options.session.queuePrompt(this.ownerPrompt(sender, text, wireId, outbox), {
                 interrupt: this.options.config.interrupt,
                 ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
-                origin: { kind: 'owner', requestId },
+                origin: { kind: 'owner', requestId, displayText: text },
             });
         }
         catch (error) {
@@ -822,6 +830,8 @@ export class OwnerChannel {
         const active = {
             contact: sender.id, wireId, requestId, outboundTail: receipt, finalizing: false,
             updateCount: 0, updateDigests: new Set(), handledWireIds: [wireId],
+            commentaryBuffer: '', commentaryCount: 0, commentaryKeys: new Set(),
+            commentaryDisabled: false,
         };
         this.activeRequests.set(requestId, active);
         const task = this.complete(active, outbox, queued, activityCursor)
@@ -1006,7 +1016,7 @@ export class OwnerChannel {
             const contact = await this.routableContact(route);
             const rejection = !this.attachmentRecovery.integrity()
                 ? 'attachment recovery state is unavailable'
-                : validateAttachmentSelection(group.files, this.attachmentConfig);
+                : validateAttachmentRelaySelection(group.files, this.attachmentConfig);
             if (rejection)
                 throw new Error(rejection);
             const transactionId = this.requestId(`managed-agent-attachment:${handledWireIds.slice().sort().join(':')}`);
@@ -1033,7 +1043,7 @@ export class OwnerChannel {
             }
             const order = new Map(group.files.map((file, index) => [file.wireId, index]));
             retrieved.sort((a, b) => order.get(a.wireId) - order.get(b.wireId));
-            const admitted = await admitAttachments(retrieved, requestDir, this.attachmentConfig);
+            const admitted = await admitAttachments(retrieved, requestDir, this.attachmentConfig, { mimePolicy: 'report-only' });
             const digest = createHash('sha256').update(`managed-agent-attachment\0${handledWireIds.slice().sort().join('\0')}`).digest('hex');
             const sending = this.conversations.beginSend(route.contact, digest, Date.now(), 0, 'all');
             try {
@@ -1196,6 +1206,95 @@ export class OwnerChannel {
         let startedAt;
         let phase = 'starting request';
         let timer;
+        const flushCommentary = () => {
+            if (active.commentaryTimer)
+                clearTimeout(active.commentaryTimer);
+            active.commentaryTimer = undefined;
+            const text = active.commentaryBuffer.trim();
+            active.commentaryBuffer = '';
+            if (!text || active.commentaryDisabled || active.finalizing)
+                return;
+            if (active.commentaryCount >= COMMENTARY_MAX_UPDATES) {
+                active.commentaryDisabled = true;
+                return;
+            }
+            let safe;
+            try {
+                safe = this.safeCommentary(text);
+            }
+            catch (error) {
+                active.commentaryDisabled = true;
+                this.logError('ACP commentary forwarding disabled for unsafe content', error);
+                return;
+            }
+            const digest = createHash('sha256')
+                .update(`owner-commentary\0${active.wireId}\0${safe}`).digest('hex');
+            let sending;
+            try {
+                sending = this.conversations.beginSend(active.contact, digest, Date.now(), 0, 'all');
+            }
+            catch (error) {
+                if (error instanceof DuplicateSendError)
+                    return;
+                active.commentaryDisabled = true;
+                this.logError('ACP commentary forwarding disabled by dedupe state', error);
+                return;
+            }
+            active.commentaryCount++;
+            active.outboundTail = active.outboundTail
+                .then(async () => {
+                try {
+                    if (!this.isEffectiveOwner(active.contact))
+                        throw new Error('initiating owner is no longer authorized');
+                    await this.send(active.contact, safe, active.wireId);
+                }
+                catch {
+                    this.conversations.finishSend(sending.id, 'uncertain');
+                    throw new Error('ACP commentary delivery outcome is uncertain');
+                }
+                this.conversations.finishSend(sending.id, 'delivered');
+            })
+                .catch(error => this.logError('ACP commentary delivery failed', error));
+        };
+        const acceptCommentary = (event) => {
+            if (active.commentaryDisabled || active.finalizing || event.turnId !== queued.promptId
+                || event.kind !== 'agent_text' || event.messagePhase !== 'commentary'
+                || event.replayed || event.origin?.kind !== 'owner'
+                || event.origin.requestId !== active.requestId
+                || typeof event.messageId !== 'string' || !event.messageId
+                || typeof event.text !== 'string' || !event.text)
+                return;
+            const key = createHash('sha256')
+                .update(`${event.messageId}\0${event.text}`).digest('hex');
+            if (active.commentaryKeys.has(key))
+                return;
+            active.commentaryKeys.add(key);
+            if (active.commentaryKeys.size > COMMENTARY_DEDUPE_LIMIT)
+                active.commentaryKeys.delete(active.commentaryKeys.values().next().value);
+            let chars = Array.from(active.commentaryBuffer).length;
+            let bytes = Buffer.byteLength(active.commentaryBuffer);
+            for (const point of event.text) {
+                const pointBytes = Buffer.byteLength(point);
+                if (chars >= COMMENTARY_MAX_CHARS || bytes + pointBytes > COMMENTARY_MAX_BYTES) {
+                    flushCommentary();
+                    if (active.commentaryDisabled)
+                        return;
+                    chars = 0;
+                    bytes = 0;
+                }
+                active.commentaryBuffer += point;
+                chars++;
+                bytes += pointBytes;
+            }
+            if (/\n\s*\n$/u.test(active.commentaryBuffer)) {
+                flushCommentary();
+                return;
+            }
+            if (!active.commentaryTimer) {
+                active.commentaryTimer = setTimeout(flushCommentary, COMMENTARY_FLUSH_MS);
+                active.commentaryTimer.unref?.();
+            }
+        };
         const reportProgress = () => {
             const events = this.options.session.eventsSince(lastSeq);
             lastSeq = Math.max(lastSeq, this.latestEventSeq(events));
@@ -1234,19 +1333,28 @@ export class OwnerChannel {
             timer = setInterval(reportProgress, progressMs);
             timer.unref();
         };
-        const unsubscribe = progressMs > 0
-            ? this.options.session.subscribe(event => startProgress(event))
-            : undefined;
+        const unsubscribe = typeof this.options.session.subscribe === 'function'
+            ? this.options.session.subscribe(event => {
+                startProgress(event);
+                // Automatic commentary is an ACP phase extension. Other backends and
+                // older adapters retain their established final-only behavior.
+                if (this.options.session.backend === 'acp')
+                    acceptCommentary(event);
+            })
+            : () => undefined;
         startProgress();
         let result;
         try {
             result = await queued.completion;
         }
         finally {
-            unsubscribe?.();
+            unsubscribe();
             if (timer)
                 clearInterval(timer);
+            if (active.commentaryTimer)
+                clearTimeout(active.commentaryTimer);
         }
+        flushCommentary();
         active.finalizing = true;
         await active.outboundTail;
         const output = result.output?.trim();
@@ -1267,6 +1375,20 @@ export class OwnerChannel {
         for (const wire of active.handledWireIds)
             this.state.remember(wire);
     }
+    /** Model-authored commentary only; raw protocol/tool data never reaches here. */
+    safeCommentary(value) {
+        const message = value.trim().normalize('NFC');
+        if (!message)
+            throw new Error('commentary is empty');
+        if (Array.from(message).length > COMMENTARY_MAX_CHARS
+            || Buffer.byteLength(message) > COMMENTARY_MAX_BYTES)
+            throw new Error('commentary batch exceeds its bounded size');
+        if (/\u0000|[\u202a-\u202e\u2066-\u2069]/u.test(message))
+            throw new Error('commentary contains unsafe control characters');
+        if (/-----BEGIN [A-Z ]*PRIVATE KEY-----|(?:api[_ -]?key|access[_ -]?token|authorization|password|secret)\s*[:=]|(?:chain of thought|private reasoning|internal reasoning)|^(?:stdout|stderr|tool (?:output|result)|command):/imu.test(message))
+            throw new Error('commentary appears to contain secret, reasoning, or raw tool content');
+        return message;
+    }
     ownerAttachmentPrompt(sender, wireId, requestId, outbox, files, caption) {
         const lines = [
             '[fleet-owner]',

package/dist/owner-channel/state.d.ts

@@ -41,6 +41,7 @@ export declare class OwnerConversationState {
     route(effective: Set<string>): {
         contact: string;
         basis: OwnerConversationRouteBasis;
+        replyToWireId?: string;
     };
     routeForWire(wireId: string, effective: Set<string>): {
         contact: string;

package/dist/owner-channel/state.js

@@ -43,7 +43,7 @@ export class OwnerChannelState {
 }
 const CONVERSATION_LIMIT = 64;
 const WIRE_ROUTE_LIMIT = 512;
-const PROACTIVE_SEND_LIMIT = 256;
+const PROACTIVE_SEND_LIMIT = 2_048;
 const PROACTIVE_MIN_INTERVAL_MS = 30_000;
 const HEX_64_LOWER = /^[a-f0-9]{64}$/;
 const CID = /^[A-Fa-f0-9]{64}$/;
@@ -158,7 +158,10 @@ export class OwnerConversationState {
         if (candidates.length) {
             if (candidates[1]?.lastInboundAt === candidates[0].lastInboundAt)
                 throw new Error('proactive owner route is ambiguous');
-            return { contact: candidates[0].contact, basis: 'last-inbound' };
+            return {
+                contact: candidates[0].contact, basis: 'last-inbound',
+                replyToWireId: candidates[0].lastInboundWireId,
+            };
         }
         if (canonical.size === 1)
             return { contact: [...effective][0], basis: 'sole-owner' };
@@ -180,7 +183,7 @@ export class OwnerConversationState {
         const recent = this.sends.filter(send => canonicalCid(send.contact) === canonical).slice(-128);
         // 'all' scope serves wire-keyed idempotency: a crash replay must not
         // deliver the same wire to a second owner after the route moved.
-        const scope = dedupe === 'all' ? this.sends.slice(-128) : recent;
+        const scope = dedupe === 'all' ? this.sends : recent;
         if (scope.some(send => send.digest === digest))
             throw new DuplicateSendError('duplicate proactive owner message refused');
         const last = recent.at(-1);

package/dist/permissions.d.ts

@@ -62,6 +62,11 @@ export interface PermissionConflict {
     /** The role-named line commands print. */
     warning: string;
 }
+/** Resolve the effective portable policy after harness-native overrides win. */
+export declare function effectivePermissionMode(role: ResolvedRole): {
+    fleetMode: import('./config.js').FleetPermissionMode;
+    nativeMode: string;
+};
 /** Resolve one role's permissions through its adapter. Never throws. */
 export declare function analyzeRolePermissions(role: ResolvedRole): RolePermissionAnalysis;
 /** Every line a command should show for a role: translation, conflicts, floor. */

package/dist/permissions.js

@@ -23,6 +23,13 @@ export function checkUnattendedFloor(granted, required = UNATTENDED_FLOOR) {
     const missing = required.filter(c => !granted.includes(c));
     return { meets: missing.length === 0, missing };
 }
+/** Resolve the effective portable policy after harness-native overrides win. */
+export function effectivePermissionMode(role) {
+    const adapter = getAdapter(role.harness);
+    if (!adapter.effectivePermissionMode)
+        throw new Error(`harness '${role.harness}' cannot report an effective ask|auto|allow permission mode`);
+    return adapter.effectivePermissionMode(role);
+}
 /**
  * Find native settings that contradict the neutral block. Only fires when the
  * operator wrote BOTH — a role that states its intent once, neutrally or

package/dist/runner.js

@@ -23,6 +23,7 @@ import { acquireOwnerBinderLease, OwnerBinderHandoffTimeoutError, } from './owne
 import { RoleTurnArbiter } from './session/arbiter.js';
 import { ScheduledLoopManager, } from './loops/manager.js';
 import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, inheritCallerSpawnDefaults, } from './fleet-proxy.js';
+import { effectivePermissionMode } from './permissions.js';
 const defaultDeps = () => ({
     tmux: new Tmux(),
     exec: realExec,
@@ -514,6 +515,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             mode,
             permissions: perms,
             modeId: adapter.acpPermissionModeId?.(role),
+            permissionMode: effectivePermissionMode(role),
             log: deps.log,
         });
         pid = acpSession.pid;

package/dist/session/acp.d.ts

@@ -1,5 +1,11 @@
+import * as acp from '@agentclientprotocol/sdk';
 import type { CommonPermissions } from '../config.js';
-import type { ExitRecord, QueuedPrompt, SessionEvent, SessionHandle, SessionSnapshot, SubmitPromptOptions, TurnCancellationSource, TurnOutcome, TurnResult } from './types.js';
+import { ConversationEventStore } from './conversation-store.js';
+import type { ConversationSnapshot, PromptOrigin, PromptReceipt, SubmitPromptCommand } from './conversation-types.js';
+import type { ConversationHandlePage, ExitRecord, QueuedPrompt, SessionEvent, RuntimeSelectorMetadata, SessionHandle, SessionSnapshot, SubmitPromptOptions, TurnCancellationSource, TurnOutcome, TurnResult } from './types.js';
+/** Server-generated typed provenance followed by the exact human-authored body. */
+export declare function promptContentBlocks(text: string, origin?: PromptOrigin): acp.ContentBlock[];
+export declare function runtimeSelector(options: acp.SessionConfigOption[] | null | undefined, category: string): RuntimeSelectorMetadata | undefined;
 export interface AcpSessionOptions {
     name: string;
     argv: string[];
@@ -10,9 +16,15 @@ export interface AcpSessionOptions {
     permissions: CommonPermissions;
     /** Native permission-mode id to request via session/set_mode; undefined keeps the agent default. */
     modeId?: string;
+    /** Adapter-resolved live permission policy; separate from ACP agent-specific session modes. */
+    permissionMode?: NonNullable<SessionSnapshot['permissionMode']>;
     log(line: string): void;
     /** Test seam for the cancel-escalation grace period; production uses the default. */
     cancelGraceMs?: number;
+    /** How long a pending permission may wait for a human before it expires. */
+    permissionTimeoutMs?: number;
+    /** Grace after the last controller detaches before the unattended policy applies. */
+    controllerGraceMs?: number;
 }
 /**
  * Classify an ACP `stopReason` into a terminal outcome. A refusal and a
@@ -30,6 +42,11 @@ export declare class AcpSession implements SessionHandle {
     readonly pid: number;
     private readonly child;
     private readonly events;
+    private readonly conversation;
+    /** New on every runner start; permission/turn IDs from prior generations are stale. */
+    private readonly sessionGeneration;
+    /** True while `session/load` replays history as ordinary updates. */
+    private replaying;
     private readonly sessionFile;
     private readonly pendingPermissions;
     private connection;
@@ -41,11 +58,22 @@ export declare class AcpSession implements SessionHandle {
     private exit;
     private steeringSupported;
     private capabilities?;
+    private runtimeModel?;
+    private reasoningEffort?;
     private controllerCount;
+    /** Armed when the last controller detaches; unattended policy applies on fire. */
+    private controllerGrace?;
     private cancelEscalation?;
     private activeTurn?;
     private constructor();
     static start(options: AcpSessionOptions): Promise<AcpSession>;
+    /**
+     * Honest restart recovery (spec §5.3): a prompt that was admitted but never
+     * started is safe to dispatch again; a turn that had already started may
+     * have caused side effects, so it is closed as `unknown_after_restart` —
+     * never silently replayed.
+     */
+    private recoverOpenPrompts;
     isAlive(): boolean;
     snapshot(): SessionSnapshot;
     /**
@@ -54,16 +82,40 @@ export declare class AcpSession implements SessionHandle {
      * for it is what turned a busy agent into a timeout and then into "dead".
      */
     queuePrompt(text: string, options?: SubmitPromptOptions): Promise<QueuedPrompt>;
+    /**
+     * Durably record a prompt admission BEFORE acceptance is returned. Browser
+     * admissions are transactional — a prompt the ledger cannot hold is refused,
+     * because an acknowledged-then-lost prompt is worse than an error. Every
+     * other source degrades to best-effort so the agent keeps working (§5.3).
+     */
+    private admitToLedger;
+    /** Idempotent browser prompt admission (control v3 `submit_prompt_v2`). */
+    submitPromptBrowser(command: SubmitPromptCommand): Promise<PromptReceipt>;
     submitPrompt(text: string, options?: SubmitPromptOptions): Promise<TurnResult>;
     interrupt(source?: TurnCancellationSource): Promise<void>;
     private cancelActive;
     respondPermission(permissionId: string, optionId: string): boolean;
+    /**
+     * A v2 decision binds to the session generation it was shown under. A stale
+     * generation, an already-settled request, or an unknown option are all the
+     * same answer: someone else's decision (or a restart) got there first.
+     */
+    respondPermissionV2(permissionId: string, optionId: string, sessionGeneration: string): 'accepted' | 'stale';
     eventsSince(seq: number): SessionEvent[];
     subscribe(listener: (event: SessionEvent) => void): () => void;
     setControllerAttached(attached: boolean): void;
+    private armControllerGrace;
+    /**
+     * Settle one pending request without a human decision — unattended policy,
+     * expiry, or cancellation — and leave the same durable evidence a manual
+     * decision would. A denial selects the agent's own one-shot reject option;
+     * everything else resolves as cancelled toward the agent.
+     */
+    private settlePendingAutomatically;
     exitResult(): ExitRecord | null;
     close(): Promise<void>;
     private initialize;
+    private captureRuntimeMetadata;
     private runPrompt;
     private steerPrompt;
     private requestPermission;
@@ -75,5 +127,18 @@ export declare class AcpSession implements SessionHandle {
     private settleAutomatically;
     private withinAutomaticBoundary;
     private recordUpdate;
+    /**
+     * Codex ACP's phase extension is the only currently supported visibility
+     * signal. Never infer commentary from text, message order, or unknown meta.
+     */
+    private codexMessagePhase;
+    /** Normalize every ACP update losslessly into the durable ledger. */
+    private recordConversationUpdate;
+    conversationPage(request?: {
+        after?: string;
+        limit?: number;
+    }): ConversationHandlePage;
+    conversationSnapshot(): ConversationSnapshot;
+    subscribeConversation(listener: Parameters<ConversationEventStore['subscribe']>[0]): () => void;
     private fail;
 }