@ours.network/fleet 0.17.0 → 0.17.1

package/dist/fleet-proxy.js

@@ -1,4 +1,4 @@
-import { effectivePermissionMode } from './permissions.js';
+import { inheritedPermissionMode } from './permissions.js';
 /** Present only inside a managed role process. The CLI treats it as a routing hint, not authority. */
 export const FLEET_PROXY_STATE_DIR_ENV = 'OURS_FLEET_PROXY_STATE_DIR';
 export const FLEET_PROXY_CALLER_ENV = 'OURS_FLEET_PROXY_CALLER';
@@ -21,7 +21,7 @@ export function inheritCallerSpawnDefaults(caller, requested, configPath) {
     take('cwd', caller.cwd);
     take('coordinator', caller.name);
     if (options.approval === undefined)
-        take('approval', effectivePermissionMode(caller).fleetMode);
+        take('approval', inheritedPermissionMode(caller));
     take('filesystem', caller.permissions.filesystem);
     take('unattended', caller.permissions.unattended);
     take('monitorConfig', structuredClone(caller.monitor));

package/dist/harness/codex.js

@@ -14,6 +14,7 @@ const LAUNCHERS = ['auto', 'ours-codex', 'codex'];
 const SANDBOX_MODES = ['read-only', 'workspace-write', 'danger-full-access'];
 /** Codex CLI's accepted `--ask-for-approval` values. */
 const APPROVAL_POLICIES = ['untrusted', 'on-request', 'never'];
+const BUNDLED_CODEX_ACP_VERSION = '1.1.7';
 /**
  * What an unattended role can actually do under Codex's native settings.
  * `on-request` and `untrusted` stop to ask, and with no console attached that
@@ -55,6 +56,22 @@ function acpAgentMode(role) {
         return 'agent-full-access';
     return undefined;
 }
+function acpModePermissions(mode) {
+    if (mode === 'read-only')
+        return { approval: 'on-request', sandbox: 'read-only' };
+    if (mode === 'agent-full-access')
+        return { approval: 'never', sandbox: 'danger-full-access' };
+    return { approval: 'on-request', sandbox: 'workspace-write' };
+}
+function fleetModeForApproval(nativeMode) {
+    if (nativeMode === 'never')
+        return 'allow';
+    if (nativeMode === 'on-request')
+        return 'auto';
+    if (nativeMode === 'untrusted')
+        return 'ask';
+    throw new Error(`unsupported Codex approval policy '${nativeMode}'`);
+}
 /** Resolve & validate the per-role approval policy, throwing on an unknown value. */
 function approvalPolicy(role) {
     const o = role.harness_options;
@@ -282,6 +299,22 @@ export function makeCodexAdapter(exec = realExec) {
                 return translated;
             const approval = approvalPolicy(role) ?? 'on-request';
             const sandbox = sandboxMode(role) ?? 'workspace-write';
+            if (role.session === 'acp') {
+                const mode = acpAgentMode(role) ?? 'agent';
+                const actual = acpModePermissions(mode);
+                const exact = actual.approval === approval && actual.sandbox === sandbox;
+                return {
+                    ...translated,
+                    native: { mode, ...actual },
+                    exact,
+                    warnings: exact ? [] : [
+                        `bundled codex-acp ${BUNDLED_CODEX_ACP_VERSION} mode '${mode}' actually uses `
+                            + `approval=${actual.approval} sandbox=${actual.sandbox}; this does not exactly `
+                            + `represent approval=${approval} sandbox=${sandbox}`,
+                    ],
+                    capabilities: codexCapabilities(actual.approval, actual.sandbox),
+                };
+            }
             return {
                 ...translated,
                 native: { approval, sandbox },
@@ -289,13 +322,17 @@ export function makeCodexAdapter(exec = realExec) {
             };
         },
         effectivePermissionMode(role) {
+            if (role.session === 'acp') {
+                const nativeMode = acpAgentMode(role) ?? 'agent';
+                return {
+                    fleetMode: fleetModeForApproval(acpModePermissions(nativeMode).approval), nativeMode,
+                };
+            }
             const nativeMode = approvalPolicy(role) ?? 'untrusted';
-            const fleetMode = nativeMode === 'never' ? 'allow'
-                : nativeMode === 'on-request' ? 'auto'
-                    : nativeMode === 'untrusted' ? 'ask' : undefined;
-            if (!fleetMode)
-                throw new Error(`unsupported Codex approval policy '${nativeMode}'`);
-            return { fleetMode, nativeMode };
+            return { fleetMode: fleetModeForApproval(nativeMode), nativeMode };
+        },
+        inheritedPermissionMode(role) {
+            return fleetModeForApproval(approvalPolicy(role) ?? 'untrusted');
         },
         vocabulary: {
             bindTool: 'choose_identity',

package/dist/harness/types.d.ts

@@ -111,6 +111,8 @@ export interface HarnessAdapter {
         fleetMode: FleetPermissionMode;
         nativeMode: string;
     };
+    /** Configured portable intent to inherit when a live runtime preset is narrower. */
+    inheritedPermissionMode?(role: ResolvedRole): FleetPermissionMode;
     /**
      * REQUIRED. Every adapter must either translate neutral permissions or
      * explicitly declare that it cannot. Enforced at registration.

package/dist/permissions.d.ts

@@ -67,6 +67,8 @@ export declare function effectivePermissionMode(role: ResolvedRole): {
     fleetMode: import('./config.js').FleetPermissionMode;
     nativeMode: string;
 };
+/** Preserve configured intent when a managed child inherits from its caller. */
+export declare function inheritedPermissionMode(role: ResolvedRole): import('./config.js').FleetPermissionMode;
 /** Resolve one role's permissions through its adapter. Never throws. */
 export declare function analyzeRolePermissions(role: ResolvedRole): RolePermissionAnalysis;
 /** Every line a command should show for a role: translation, conflicts, floor. */

package/dist/permissions.js

@@ -30,6 +30,11 @@ export function effectivePermissionMode(role) {
         throw new Error(`harness '${role.harness}' cannot report an effective ask|auto|allow permission mode`);
     return adapter.effectivePermissionMode(role);
 }
+/** Preserve configured intent when a managed child inherits from its caller. */
+export function inheritedPermissionMode(role) {
+    const adapter = getAdapter(role.harness);
+    return adapter.inheritedPermissionMode?.(role) ?? effectivePermissionMode(role).fleetMode;
+}
 /**
  * Find native settings that contradict the neutral block. Only fires when the
  * operator wrote BOTH — a role that states its intent once, neutrally or

package/dist/session/acp.js

@@ -1,7 +1,7 @@
 import { spawn } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
-import { isAbsolute, join, relative, resolve } from 'node:path';
+import { existsSync, lstatSync, readFileSync, readlinkSync, realpathSync, writeFileSync, } from 'node:fs';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { Readable, Writable } from 'node:stream';
 import * as acp from '@agentclientprotocol/sdk';
 import { normalizeSessionUpdate } from './conversation-normalizer.js';
@@ -18,7 +18,119 @@ export const AFTER_TOOL_BOUNDARY_TIMEOUT_MS = 120_000;
 const TERMINAL_TOOL_STATUSES = new Set(['completed', 'failed']);
 const SCHEDULED_LOOP_REDACTION = '[scheduled-loop content redacted]';
 const OWNER_COMMENTARY_REDACTION = '[assistant commentary redacted]';
+const MAX_CANONICAL_SYMLINK_DEPTH = 40;
 const scheduledTurn = (turn) => turn?.origin?.kind === 'scheduled-loop';
+/**
+ * Two matching realpath observations narrow the opportunity for a concurrent
+ * retarget, but are only an advisory consistency check: they do not lock the
+ * path. A mutation after the completed check remains an unavoidable TOCTOU
+ * window until ACP offers handle-based access.
+ */
+function stableRealpath(path) {
+    const first = realpathSync.native(path);
+    const second = realpathSync.native(path);
+    return first === second ? first : undefined;
+}
+/** Distinguish an absent component from a dangling symlink at that component. */
+function inspectMissingPath(path) {
+    try {
+        const stat = lstatSync(path);
+        // realpath said ENOENT but lstat found a non-link: the path changed while
+        // inspected, so there is no coherent canonical answer to trust.
+        if (!stat.isSymbolicLink())
+            return { kind: 'unsafe' };
+        try {
+            return { kind: 'symlink', target: resolve(dirname(path), readlinkSync(path)) };
+        }
+        catch {
+            return { kind: 'unsafe' };
+        }
+    }
+    catch (error) {
+        return error.code === 'ENOENT'
+            ? { kind: 'absent' }
+            : { kind: 'unsafe' };
+    }
+}
+/**
+ * Canonicalize an existing path, or a not-yet-created target through its
+ * nearest existing ancestor. Dangling links are followed explicitly because
+ * realpath reports their absent target as ENOENT. Only genuine absence is
+ * recoverable; loops, permissions, races, and every other error fail closed.
+ */
+function canonicalTarget(path, symlinkDepth = 0) {
+    let probe = resolve(path);
+    const missing = [];
+    while (true) {
+        try {
+            let canonical = stableRealpath(probe);
+            if (!canonical)
+                return undefined;
+            // A component may have appeared while the ancestor search was in
+            // progress. Re-walk the suffix so a newly-created symlink is resolved,
+            // not treated as a lexical child of the old ancestor.
+            let logical = probe;
+            for (let i = 0; i < missing.length; i++) {
+                logical = resolve(logical, missing[i]);
+                try {
+                    const appeared = stableRealpath(logical);
+                    if (!appeared)
+                        return undefined;
+                    canonical = appeared;
+                }
+                catch (error) {
+                    if (error.code !== 'ENOENT')
+                        return undefined;
+                    const inspected = inspectMissingPath(logical);
+                    if (inspected.kind === 'unsafe')
+                        return undefined;
+                    if (inspected.kind === 'symlink') {
+                        if (symlinkDepth >= MAX_CANONICAL_SYMLINK_DEPTH)
+                            return undefined;
+                        return canonicalTarget(resolve(inspected.target, ...missing.slice(i + 1)), symlinkDepth + 1);
+                    }
+                    return resolve(canonical, ...missing.slice(i));
+                }
+            }
+            return canonical;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                return undefined;
+            const inspected = inspectMissingPath(probe);
+            if (inspected.kind === 'unsafe')
+                return undefined;
+            if (inspected.kind === 'symlink') {
+                if (symlinkDepth >= MAX_CANONICAL_SYMLINK_DEPTH)
+                    return undefined;
+                return canonicalTarget(resolve(inspected.target, ...missing), symlinkDepth + 1);
+            }
+            const parent = dirname(probe);
+            if (parent === probe)
+                return undefined;
+            missing.unshift(basename(probe));
+            probe = parent;
+        }
+    }
+}
+function canonicallyWithin(root, candidates) {
+    if (candidates.length === 0)
+        return false;
+    try {
+        const firstRoot = realpathSync.native(root);
+        const paths = candidates.map(canonicalTarget);
+        const secondRoot = realpathSync.native(root);
+        if (firstRoot !== secondRoot || paths.some(path => path === undefined))
+            return false;
+        return paths.every(candidate => {
+            const rel = relative(firstRoot, candidate);
+            return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
+        });
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Map typed prompt provenance to the conversation ledger's source vocabulary.
  * Only operator-authored local sources may persist prompt bodies; external
@@ -947,11 +1059,7 @@ export class AcpSession {
         if (locations.length === 0)
             return false;
         const cwd = resolve(this.options.cwd);
-        return locations.every(location => {
-            const path = resolve(location.path);
-            const rel = relative(cwd, path);
-            return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
-        });
+        return canonicallyWithin(cwd, locations.map(location => resolve(location.path)));
     }
     recordUpdate(update) {
         const scheduled = this.activeTurn?.origin?.kind === 'scheduled-loop';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux or ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",