@ours.network/fleet 0.17.3 → 0.18.0-nightly.1

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "0.17.3",
-  "buildId": "789acfed6bbd",
-  "commit": "47f1efd0f90321cf233edc694a9af5fb5ba05647",
-  "dirty": false,
-  "builtAt": "2026-08-14T20:15:30.780Z",
+  "version": "0.18.0-nightly.1",
+  "buildId": "880ef60a977f",
+  "commit": "ece91028c05a5669507c0cdcff3a6f365902fcab",
+  "dirty": true,
+  "builtAt": "2026-08-16T13:06:15.416Z",
   "capabilities": [
     "monitor.interrupt.after_tool"
   ]

package/dist/owner-channel/attachments.d.ts

@@ -1,4 +1,6 @@
+import { type FileHandle } from 'node:fs/promises';
 import type { OwnerAttachmentConfig } from '../config.js';
+import type { OursIncomingFile, OursRetrievedFiles } from './ours-client.js';
 export interface AttachmentReplyRef {
     wire_id: string;
     sentence?: number;
@@ -42,8 +44,14 @@ export interface AdmittedAttachment {
     kind: 'file' | 'voice_message';
     transcription?: Omit<VoiceTranscription, 'audioPath'>;
 }
-export declare function parseIncomingAttachments(raw: unknown): IncomingAttachment[];
-export declare function parseRetrievedAttachments(raw: unknown, expected: IncomingAttachment[], recovered?: boolean): RetrievedAttachment[];
+/**
+ * Admit the daemon's file listing. The rows are typed now, but every field is
+ * still re-validated here: sender CID, wire id, sizes and ids all cross the
+ * trust boundary and decide routing, so a daemon-side shape change must drop a
+ * row rather than produce a half-built attachment.
+ */
+export declare function parseIncomingAttachments(raw: OursIncomingFile[] | undefined): IncomingAttachment[];
+export declare function parseRetrievedAttachments(raw: OursRetrievedFiles | undefined, expected: IncomingAttachment[], recovered?: boolean): RetrievedAttachment[];
 export declare function validateAttachmentSelection(files: IncomingAttachment[], config: OwnerAttachmentConfig): string | undefined;
 /**
  * Managed-agent -> owner egress limits. This intentionally does not consult
@@ -54,6 +62,21 @@ export declare function prepareAttachmentDirectory(root: string, requestId: stri
 export declare function admitAttachments(files: RetrievedAttachment[], dir: string, config: OwnerAttachmentConfig, options?: {
     mimePolicy?: 'strict' | 'report-only';
 }): Promise<AdmittedAttachment[]>;
+/** Injectable short-write seam, so partial writes are provably handled. */
+export interface AttachmentWriteDeps {
+    write?(handle: FileHandle, bytes: Uint8Array, offset: number): Promise<number>;
+}
+/**
+ * Land crash-recovered file bytes inside an already-prepared request directory.
+ *
+ * The MCP path handed the daemon a `dest_path` and let its connector write the
+ * file. Nothing writes on our behalf any more, so this owns both halves of that
+ * contract: the destination is DERIVED from a validated wire id inside `dir`
+ * rather than accepted from a caller, and the file is published by link-after-
+ * fsync, so a crash or a short write can never leave a partial file where the
+ * admission step would read it as complete.
+ */
+export declare function writeRecoveredAttachment(dir: string, wireId: string, bytes: Uint8Array, deps?: AttachmentWriteDeps): Promise<string>;
 export declare function recoveredAttachment(file: IncomingAttachment, path: string): Promise<RetrievedAttachment>;
 export declare function removeRequestDirectory(path: string): Promise<void>;
 export declare function cleanupAttachmentRoot(root: string, now: number, retentionMs: number, limit?: number): Promise<number>;

package/dist/owner-channel/attachments.js

@@ -6,8 +6,14 @@ import { replaceFileAtomically } from '../atomic-file.js';
 const WIRE = /^[A-Fa-f0-9]{64}$/;
 const CID = /^[A-Fa-f0-9]{64}$/;
 const MAX_PENDING_REQUESTS = 32;
+/**
+ * Admit the daemon's file listing. The rows are typed now, but every field is
+ * still re-validated here: sender CID, wire id, sizes and ids all cross the
+ * trust boundary and decide routing, so a daemon-side shape change must drop a
+ * row rather than produce a half-built attachment.
+ */
 export function parseIncomingAttachments(raw) {
-    const values = raw?.files;
+    const values = raw;
     if (!Array.isArray(values))
         return [];
     const out = [];
@@ -40,12 +46,12 @@ export function parseIncomingAttachments(raw) {
 export function parseRetrievedAttachments(raw, expected, recovered = false) {
     const values = raw?.files;
     if (!Array.isArray(values) || values.length !== expected.length)
-        throw new Error('ours-mcp returned an incomplete selected attachment set');
+        throw new Error('the ours daemon returned an incomplete selected attachment set');
     const byWire = new Map(expected.map(file => [file.wireId, file]));
     const out = [];
     for (const value of values) {
         if (!value || typeof value !== 'object')
-            throw new Error('ours-mcp returned invalid attachment metadata');
+            throw new Error('the ours daemon returned invalid attachment metadata');
         const file = value;
         const wireId = String(file.wire_id ?? '');
         const listed = byWire.get(wireId);
@@ -58,7 +64,7 @@ export function parseRetrievedAttachments(raw, expected, recovered = false) {
             || !Number.isSafeInteger(size) || size !== listed.size || mime !== listed.mime
             || kind !== listed.kind || !/^[a-f0-9]{64}$/.test(sha256)
             || typeof file.path !== 'string' || !file.path)
-            throw new Error('ours-mcp selected attachment provenance or integrity metadata mismatched');
+            throw new Error('selected attachment provenance or integrity metadata mismatched');
         out.push({
             ...listed, filename: safeField(file.filename, 255), mime, size, path: file.path, sha256, kind,
             ...(recovered ? {} : parseTranscription(file.transcription, wireId)),
@@ -66,7 +72,7 @@ export function parseRetrievedAttachments(raw, expected, recovered = false) {
         byWire.delete(wireId);
     }
     if (byWire.size)
-        throw new Error('ours-mcp omitted a selected attachment');
+        throw new Error('the ours daemon omitted a selected attachment');
     return out;
 }
 function parseTranscription(value, wireId) {
@@ -219,6 +225,56 @@ export async function admitAttachments(files, dir, config, options = {}) {
     }
     return admitted;
 }
+/**
+ * Land crash-recovered file bytes inside an already-prepared request directory.
+ *
+ * The MCP path handed the daemon a `dest_path` and let its connector write the
+ * file. Nothing writes on our behalf any more, so this owns both halves of that
+ * contract: the destination is DERIVED from a validated wire id inside `dir`
+ * rather than accepted from a caller, and the file is published by link-after-
+ * fsync, so a crash or a short write can never leave a partial file where the
+ * admission step would read it as complete.
+ */
+export async function writeRecoveredAttachment(dir, wireId, bytes, deps = {}) {
+    if (!WIRE.test(wireId))
+        throw new Error('recovered attachment wire id is not a 64-hex value');
+    const dirStat = await lstat(dir);
+    if (!dirStat.isDirectory() || dirStat.isSymbolicLink())
+        throw new Error('recovered attachment directory is not a safe directory');
+    const write = deps.write
+        ?? ((handle, buffer, offset) => handle.write(buffer, offset, buffer.length - offset)
+            .then(result => result.bytesWritten));
+    const finalPath = join(dir, `.recovered-${wireId}-${randomUUID()}`);
+    const tmp = join(dir, `.${basename(finalPath)}.${randomUUID()}.tmp`);
+    const handle = await open(tmp, 'wx', 0o600);
+    try {
+        for (let written = 0; written < bytes.length;) {
+            const advanced = await write(handle, bytes, written);
+            if (advanced <= 0)
+                throw new Error(`recovered attachment write made no progress at byte ${written}`);
+            written += advanced;
+        }
+        await handle.sync();
+    }
+    catch (error) {
+        await handle.close().catch(() => undefined);
+        await rm(tmp, { force: true });
+        throw error;
+    }
+    await handle.close();
+    // link publishes the finished bytes under a name that never existed in a
+    // partial state; the temp is only ever removed after it succeeded.
+    try {
+        await link(tmp, finalPath);
+    }
+    catch (error) {
+        await rm(tmp, { force: true });
+        throw error;
+    }
+    await rm(tmp, { force: true });
+    await chmod(finalPath, 0o600);
+    return finalPath;
+}
 export async function recoveredAttachment(file, path) {
     const stat = await lstat(path);
     if (!stat.isFile() || stat.isSymbolicLink() || stat.size !== file.size)

package/dist/owner-channel/channel.d.ts

@@ -4,7 +4,7 @@ import { type FetchLike } from '../monitor.js';
 import { type SessionHandle } from '../session/types.js';
 import { type OwnerFleetOps } from './commands.js';
 import type { ManagedFleetSpawnResult } from '../fleet-proxy.js';
-import { type OursToolClient } from './mcp.js';
+import { type OursOps } from './ours-client.js';
 import { type OwnerUpdatePhase } from './notices.js';
 import { type OwnerEntry } from './state.js';
 import { type OwnerTaskPhase } from './tasks.js';
@@ -17,9 +17,13 @@ export interface OwnerChannelOptions {
     session: SessionHandle;
     stateDir: string;
     env?: Record<string, string>;
+    /**
+     * `ours-mcp` binary for the legacy `watch` child process only. Daemon
+     * operations no longer go through it; they use the ours SDK client.
+     */
     command?: string;
     log(line: string): void;
-    client?: OursToolClient;
+    client?: OursOps;
     /** Legacy child-process test seam; production uses the direct notification API. */
     watch?: (identity: string) => ChildProcessWithoutNullStreams;
     /** Test seam for the production direct notification long-poll. */
@@ -118,7 +122,13 @@ export type { OwnerUpdatePhase } from './notices.js';
 export interface OwnerContact {
     cid: string;
     name: string;
+    /** Structural, from which daemon collection the row came: established or pending. */
     status: string;
+    /**
+     * Retained for the `ours-fleet owner contact list` column. The daemon's typed
+     * contact view has no such field, so it is always absent; it is not inferred
+     * from anything a contact controls.
+     */
     kind?: string;
     human?: {
         cid?: string;
@@ -174,6 +184,12 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     manage(request: OwnerChannelManagementRequest): Promise<OwnerChannelManagementResult>;
     notifyFleetSpawn(event: ManagedFleetSpawnResult): Promise<void>;
     private manageNow;
+    /**
+     * The daemon reports established contacts and pending introductions as two
+     * separate collections, so the status is structural rather than a word parsed
+     * out of a rendered line. Nothing here can be spoofed by a contact's own
+     * display name.
+     */
     private contacts;
     private contact;
     private assertCid;

package/dist/owner-channel/channel.js

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process';
-import { createHash, randomUUID } from 'node:crypto';
+import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { mkdir, readFile, readdir, rm } from 'node:fs/promises';
 import { createInterface } from 'node:readline';
@@ -10,11 +10,11 @@ import { resolveEndpoint } from '../monitor.js';
 import { ACP_CANCEL_DEADLINE_EXCEEDED, SessionControlError, interruptOutcome, } from '../session/types.js';
 import { VERSION } from '../version.js';
 import { dispatchOwnerCommand, fleetCliOps, isOwnerCommandText, } from './commands.js';
-import { OursMcpClient } from './mcp.js';
+import { OURS_BOUND_ELSEWHERE, OursSdkClient, oursErrorCode, } from './ours-client.js';
 import { ownerNotices, } from './notices.js';
 import { DuplicateSendError, OwnerAuthorizationState, OwnerChannelState, OwnerConversationState, } from './state.js';
 import { OwnerTaskState, ownerTaskAuditId, ownerTaskDigest, } from './tasks.js';
-import { AttachmentRecoveryState, admitAttachments, cleanupAttachmentRoot, parseIncomingAttachments, parseRetrievedAttachments, prepareAttachmentDirectory, recoveredAttachment, removeRequestDirectory, safeField, validateAttachmentSelection, validateAttachmentRelaySelection, } from './attachments.js';
+import { AttachmentRecoveryState, admitAttachments, cleanupAttachmentRoot, parseIncomingAttachments, parseRetrievedAttachments, prepareAttachmentDirectory, recoveredAttachment, removeRequestDirectory, safeField, validateAttachmentSelection, validateAttachmentRelaySelection, writeRecoveredAttachment, } from './attachments.js';
 import { acquireOwnerBinderLease, OWNER_BIND_HANDOFF_TIMEOUT_MS, } from './binder.js';
 const OWNER_UPDATE_MIN_INTERVAL_MS = 5_000;
 const OWNER_UPDATE_MAX_COUNT = 20;
@@ -84,7 +84,7 @@ export class OwnerChannel {
     fleetOps;
     constructor(options) {
         this.options = options;
-        this.client = options.client ?? new OursMcpClient(options.command, options.env, line => options.log(`[${options.role}] owner channel ${line}`));
+        this.client = options.client ?? new OursSdkClient(options.env, line => options.log(`[${options.role}] owner channel ${line}`));
         this.fleetOps = options.fleet ?? fleetCliOps(options.role, options.configPath);
         this.state = new OwnerChannelState(join(options.stateDir, '.owner-channel-state.json'));
         this.authorizations = new OwnerAuthorizationState(join(options.stateDir, '.owner-channel-owners.json'), options.config.owners);
@@ -123,12 +123,16 @@ export class OwnerChannel {
             const bindStartedAt = now();
             for (;;) {
                 try {
-                    await this.client.callTool('choose_identity', { name: this.options.config.identity });
+                    await this.client.bindIdentity(this.options.config.identity);
                     break;
                 }
                 catch (error) {
-                    const message = error?.message ?? String(error);
-                    const liveConflict = /currently bound to another live session/i.test(message);
+                    // The predecessor's lease may still be in flight. Only the daemon's
+                    // own typed verdict may extend the handoff window: matching the
+                    // wording of an error message would let any other failure whose text
+                    // happens to say "bound to another live session" — including one
+                    // relayed from a peer — spin here for the whole timeout.
+                    const liveConflict = oursErrorCode(error) === OURS_BOUND_ELSEWHERE;
                     if (!this.binder.inherited || !liveConflict
                         || now() - bindStartedAt >= OWNER_BIND_HANDOFF_TIMEOUT_MS)
                         throw error;
@@ -217,11 +221,14 @@ export class OwnerChannel {
                 return { action: request.action, contacts: await this.contacts() };
             case 'contact_invite': {
                 this.assertLabel(request.name);
-                const raw = await this.client.callTool('generate_invite', request.name ? { name: request.name } : {});
-                const invite = typeof raw === 'string' ? raw : String(raw?.invite ?? '');
-                if (!invite)
-                    throw new Error('ours-mcp returned no invite');
-                return { action: request.action, invite };
+                // The invite is the blob field, not a sentence containing it. The MCP
+                // surface answered with "One-time invite for X created (invite_id …).
+                // Share this blob out-of-band …:\n<blob>" and the whole sentence was
+                // handed out as the invite, so any rewording changed the payload.
+                const { blob } = await this.client.generateInvite(request.name);
+                if (typeof blob !== 'string' || !blob)
+                    throw new Error('the ours daemon returned no invite blob');
+                return { action: request.action, invite: blob };
             }
             case 'contact_add': {
                 if (typeof request.invite !== 'string' || !request.invite)
@@ -229,18 +236,19 @@ export class OwnerChannel {
                 if (Buffer.byteLength(request.invite) > 48 * 1024)
                     throw new Error('invite exceeds 49152 bytes');
                 this.assertLabel(request.name);
-                let raw;
+                let added;
                 try {
-                    raw = await this.client.callTool('add_contact', {
+                    added = await this.client.addContact({
                         invite: request.invite, ...(request.name ? { name: request.name } : {}),
                     });
                 }
                 catch {
                     // Daemon errors are not allowed to reflect invite material through
                     // the control response, CLI stderr, or supervisor logs.
-                    throw new Error('ours-mcp could not accept the contact invite');
+                    throw new Error('the ours daemon could not accept the contact invite');
                 }
-                return { action: request.action, status: 'pending', contact: this.contact(raw) };
+                const contact = this.contact(added.cid, added.display, 'pending');
+                return { action: request.action, status: 'pending', ...(contact ? { contact } : {}) };
             }
             case 'owner_list':
                 return {
@@ -314,33 +322,36 @@ export class OwnerChannel {
                 throw new Error('unknown owner-channel management action');
         }
     }
+    /**
+     * The daemon reports established contacts and pending introductions as two
+     * separate collections, so the status is structural rather than a word parsed
+     * out of a rendered line. Nothing here can be spoofed by a contact's own
+     * display name.
+     */
     async contacts() {
-        const raw = await this.client.callTool('list_contacts');
-        const values = Array.isArray(raw) ? raw : raw?.contacts;
-        if (!Array.isArray(values))
-            return [];
-        return values.map(value => this.contact(value)).filter((v) => Boolean(v))
+        const view = await this.client.listContacts();
+        const rows = [
+            ...(Array.isArray(view?.contacts) ? view.contacts : [])
+                .map(row => this.contact(row?.container_id, row?.name, 'established', view)),
+            ...(Array.isArray(view?.pending) ? view.pending : [])
+                .map(row => this.contact(row?.container_id, row?.name, 'pending', view)),
+        ];
+        return rows.filter((row) => Boolean(row))
             .sort((a, b) => a.cid.localeCompare(b.cid));
     }
-    contact(raw) {
-        if (!raw || typeof raw !== 'object')
-            return undefined;
-        const value = raw;
-        const cid = String(value.cid ?? value.id ?? value.container_id ?? value.containerId ?? '');
+    contact(cidValue, nameValue, status, view) {
+        const cid = String(cidValue ?? '');
         if (!/^[A-Fa-f0-9]{64}$/.test(cid))
             return undefined;
-        const humanRaw = value.human ?? value.root;
-        const human = humanRaw && typeof humanRaw === 'object' ? humanRaw : undefined;
+        const root = view?.roots?.[cid];
+        const rootCid = String(root?.root_cid ?? '');
         return {
             cid,
-            name: this.safeMetadata(value.name ?? value.display_name ?? cid),
-            status: this.safeMetadata(value.status ?? 'established'),
-            ...(typeof value.kind === 'string' ? { kind: this.safeMetadata(value.kind) } : {}),
-            ...(human ? { human: {
-                    ...(typeof (human.cid ?? human.id) === 'string'
-                        && /^[A-Fa-f0-9]{64}$/.test(String(human.cid ?? human.id))
-                        ? { cid: String(human.cid ?? human.id) } : {}),
-                    ...(human.name ? { name: this.safeMetadata(human.name) } : {}),
+            name: this.safeMetadata(nameValue ?? cid),
+            status,
+            ...(root ? { human: {
+                    ...(/^[A-Fa-f0-9]{64}$/.test(rootCid) ? { cid: rootCid } : {}),
+                    ...(root.root_name ? { name: this.safeMetadata(root.root_name) } : {}),
                 } } : {}),
         };
     }
@@ -525,16 +536,16 @@ export class OwnerChannel {
         // A finite cap protects the supervisor if a broken daemon repeats unread
         // messages forever. A watch notification will resume draining later.
         for (let pass = 0; pass < 100 && !this.stopping; pass++) {
-            const [raw, fileResult] = await Promise.all([
-                this.client.callTool('get_messages'),
-                this.client.callTool('list_incoming_files')
+            const [payload, fileResult] = await Promise.all([
+                this.client.getMessages(),
+                this.client.listIncomingFiles()
                     .catch(error => {
                     this.logError('attachment metadata inspection unavailable', error);
                     return undefined;
                 }),
             ]);
-            const messages = Array.isArray(raw?.messages)
-                ? raw.messages.filter(message => message && typeof message === 'object')
+            const messages = Array.isArray(payload?.messages)
+                ? payload.messages.filter(message => message && typeof message === 'object')
                 : [];
             let files = [];
             try {
@@ -558,7 +569,7 @@ export class OwnerChannel {
                     && Number.isInteger(message.msg_id);
             }).map(message => message.msg_id);
             if (deferred.length)
-                await this.client.callTool('defer_messages', { msg_ids: deferred });
+                await this.client.deferMessages(deferred);
             let advanced = false;
             const consumedMessages = new Set();
             const groups = this.attachmentGroups(files, messages, pending, consumedMessages);
@@ -689,15 +700,12 @@ export class OwnerChannel {
             const unread = group.files.filter(file => file.status === 'unread');
             const processed = group.files.filter(file => file.status !== 'unread');
             const retrieved = unread.length
-                ? parseRetrievedAttachments(await this.client.callTool('get_files', {
-                    wire_ids: unread.map(file => file.wireId),
-                }), unread)
+                ? parseRetrievedAttachments(await this.client.getFiles(unread.map(file => file.wireId)), unread)
                 : [];
             for (const file of processed) {
                 if (!group.recovery)
                     throw new Error('unexpected processed attachment without recovery route');
-                const recoveryPath = join(requestDir, `.recovered-${file.wireId}-${randomUUID()}`);
-                await this.client.callTool('save_file', { wire_id: file.wireId, dest_path: recoveryPath });
+                const recoveryPath = await writeRecoveredAttachment(requestDir, file.wireId, await this.client.fetchFile(file.wireId));
                 retrieved.push(await recoveredAttachment(file, recoveryPath));
             }
             const order = new Map(group.files.map((file, index) => [file.wireId, index]));
@@ -794,12 +802,12 @@ export class OwnerChannel {
                     // the authenticated agent once so the wait is never silent.
                     this.options.log(`[${this.options.role}] owner channel managed-agent relay has no owner `
                         + `route yet; message stays queued: ${this.errorText(error)}`);
-                    await this.nackManagedAgent(sender.id, message, wireId, ownerNotices.relayQueued());
+                    await this.nackManagedAgent(sender.id, message.wire_id ? wireId : undefined, wireId, ownerNotices.relayQueued());
                     return false;
                 }
                 else {
                     this.logError('managed-agent message relay refused', error);
-                    await this.nackManagedAgent(sender.id, message, wireId, ownerNotices.relayRefused(this.errorText(error)));
+                    await this.nackManagedAgent(sender.id, message.wire_id ? wireId : undefined, wireId, ownerNotices.relayRefused(this.errorText(error)));
                 }
             }
             this.state.remember(wireId);
@@ -1044,7 +1052,9 @@ export class OwnerChannel {
     async handleManagedAgentAttachmentGroup(group, handledWireIds, agent) {
         const captionWire = group.caption ? this.wireId(group.caption) : undefined;
         const nackWire = captionWire ?? group.files[0].wireId;
-        const nackMessage = group.caption ?? { wire_id: nackWire };
+        // A caption whose own wire id is synthetic (msg_id only) must not be echoed
+        // back as a reply reference; a file wire always is a real one.
+        const nackReplyTo = (group.caption ? group.caption.wire_id : nackWire) ? nackWire : undefined;
         let requestDir;
         let recovery;
         try {
@@ -1080,15 +1090,12 @@ export class OwnerChannel {
             const unread = group.files.filter(file => file.status === 'unread');
             const processed = group.files.filter(file => file.status !== 'unread');
             const retrieved = unread.length
-                ? parseRetrievedAttachments(await this.client.callTool('get_files', {
-                    wire_ids: unread.map(file => file.wireId),
-                }), unread)
+                ? parseRetrievedAttachments(await this.client.getFiles(unread.map(file => file.wireId)), unread)
                 : [];
             for (const file of processed) {
                 if (!group.recovery)
                     throw new Error('unexpected processed attachment without recovery route');
-                const recoveryPath = join(requestDir, `.recovered-${file.wireId}-${randomUUID()}`);
-                await this.client.callTool('save_file', { wire_id: file.wireId, dest_path: recoveryPath });
+                const recoveryPath = await writeRecoveredAttachment(requestDir, file.wireId, await this.client.fetchFile(file.wireId));
                 retrieved.push(await recoveredAttachment(file, recoveryPath));
             }
             const order = new Map(group.files.map((file, index) => [file.wireId, index]));
@@ -1100,9 +1107,9 @@ export class OwnerChannel {
                 if (caption)
                     await this.send(contact, caption, replyTo);
                 for (const file of admitted) {
-                    await this.client.callTool('send_file', {
+                    await this.client.sendFile({
                         contact, path: file.path, filename: file.filename,
-                        ...(replyTo ? { reply_to_wire_id: replyTo } : {}),
+                        ...(replyTo ? { replyToWireId: replyTo } : {}),
                     });
                 }
             }
@@ -1139,11 +1146,11 @@ export class OwnerChannel {
             if (error instanceof RelayUnroutableError) {
                 this.options.log(`[${this.options.role}] managed-agent attachment has no owner route; `
                     + `transaction stays queued: ${this.errorText(error)}`);
-                await this.nackManagedAgent(agent, nackMessage, nackWire, ownerNotices.relayQueued());
+                await this.nackManagedAgent(agent, nackReplyTo, nackWire, ownerNotices.relayQueued());
                 return false;
             }
             this.logError('managed-agent caption/file relay refused', error);
-            await this.nackManagedAgent(agent, nackMessage, nackWire, ownerNotices.relayRefused(this.errorText(error)));
+            await this.nackManagedAgent(agent, nackReplyTo, nackWire, ownerNotices.relayRefused(this.errorText(error)));
             // Rejection/admission failure and uncertain transport are terminal and
             // visible. Consuming every correlated wire prevents a later partial replay.
             for (const wire of handledWireIds)
@@ -1182,14 +1189,14 @@ export class OwnerChannel {
      * to the authenticated agent, while its deferred replays stay quiet. NACK
      * delivery is best-effort — it must never make the failure worse.
      */
-    async nackManagedAgent(contact, message, wireId, notice) {
+    async nackManagedAgent(contact, replyTo, wireId, notice) {
         if (this.relayNacks.has(wireId))
             return;
         this.relayNacks.add(wireId);
         if (this.relayNacks.size > RELAY_NACK_MEMORY)
             this.relayNacks.delete(this.relayNacks.values().next().value);
         try {
-            await this.send(contact, notice, message.wire_id ? wireId : undefined);
+            await this.send(contact, notice, replyTo);
         }
         catch (error) {
             this.logError('managed-agent relay NACK delivery failed', error);
@@ -1507,8 +1514,8 @@ export class OwnerChannel {
         return createHash('sha256').update(wireId).digest('hex');
     }
     send(contact, text, replyTo) {
-        return this.client.callTool('send_message', {
-            contact, text, ...(replyTo ? { reply_to_wire_id: replyTo } : {}),
+        return this.client.sendMessage({
+            contact, text, ...(replyTo ? { replyToWireId: replyTo } : {}),
         });
     }
     async sendAttachments(contact, outbox, replyTo) {
@@ -1516,11 +1523,11 @@ export class OwnerChannel {
             .filter(entry => entry.isFile())
             .sort((a, b) => a.name.localeCompare(b.name));
         for (const entry of entries) {
-            await this.client.callTool('send_file', {
+            await this.client.sendFile({
                 contact,
                 path: join(outbox, entry.name),
                 filename: entry.name,
-                reply_to_wire_id: replyTo,
+                replyToWireId: replyTo,
             });
         }
         await rm(outbox, { recursive: true, force: true });
@@ -1543,11 +1550,11 @@ export class OwnerChannel {
         return Number.isInteger(message.msg_id) ? `msg:${message.msg_id}` : '';
     }
     sender(message) {
-        const source = message.from ?? message.sender;
-        if (typeof source === 'string')
-            return { id: source, name: source };
-        const id = String(source?.id ?? message.sender_id ?? '');
-        return { id, name: String(source?.name ?? message.sender_name ?? id) };
+        // Authenticated routing data, straight from the daemon's typed envelope.
+        // The id still goes through the CID checks in acceptedSender/isEffectiveOwner.
+        const source = message.from;
+        const id = String(source?.id ?? '');
+        return { id, name: String(source?.name ?? id) };
     }
     latestEventSeq(events) {
         return events.reduce((latest, event) => Math.max(latest, event.seq), 0);

package/dist/owner-channel/ours-client.d.ts

@@ -0,0 +1,126 @@
+import { OursClient, type OursClientOptions } from '@ours.network/sdk/client';
+/** Any failure of a daemon operation. Never carries a message body or a token. */
+export declare class OursDaemonError extends Error {
+}
+/**
+ * The daemon accepted the call and answered "not sent". The MCP surface reported
+ * exactly these verdicts as tool errors, so they must keep throwing here: the
+ * owner channel books a resolved send as delivered, and a silently-swallowed
+ * refusal would be recorded as a delivered message that never left the host.
+ */
+export declare class OursSendRefusedError extends OursDaemonError {
+}
+type Res<M extends keyof OursClient> = OursClient[M] extends (...args: never[]) => infer R ? Awaited<R> : never;
+export type OursContactsView = Res<'listContacts'>;
+export type OursInviteResult = Res<'generateInvite'>;
+export type OursAddContactResult = Res<'addContact'>;
+export type OursMessagesPayload = Res<'getMessages'>;
+export type OursInboundMessage = OursMessagesPayload['messages'][number];
+export type OursIncomingFile = Res<'listIncomingFiles'>[number];
+export type OursRetrievedFiles = Res<'getFiles'>;
+export type OursRetrievedFile = OursRetrievedFiles['files'][number];
+/**
+ * The daemon operations the owner channel needs, one typed method each.
+ *
+ * This interface deliberately has no generic `callTool(name, args): unknown`
+ * escape hatch. The MCP surface had one, and because ours-mcp answers every
+ * tool with `{content:[{type:'text',...}]}` and no `structuredContent`, the
+ * transport fell back to returning the daemon's English sentence — which the
+ * channel then pattern-matched (an invite blob sliced out of a prose sentence,
+ * a bind conflict detected with /currently bound to another live session/i).
+ * With no untyped result there is nothing left to pattern-match.
+ */
+export interface OursOps {
+    /** Prepare the transport. Must be called before any operation. */
+    start(): Promise<void>;
+    /** Bind this session's identity. Throws `BOUND_ELSEWHERE` when it is held live. */
+    bindIdentity(name: string): Promise<void>;
+    listContacts(): Promise<OursContactsView>;
+    generateInvite(name?: string): Promise<OursInviteResult>;
+    addContact(a: {
+        invite: string;
+        name?: string;
+    }): Promise<OursAddContactResult>;
+    getMessages(): Promise<OursMessagesPayload>;
+    deferMessages(msgIds: number[]): Promise<void>;
+    listIncomingFiles(): Promise<OursIncomingFile[]>;
+    getFiles(wireIds: string[]): Promise<OursRetrievedFiles>;
+    /**
+     * The bytes of an already-retrieved file. Transport only — the caller owns
+     * where they land, so path safety stays with the attachment code that already
+     * enforces it (`writeRecoveredAttachment`).
+     */
+    fetchFile(wireId: string): Promise<Uint8Array>;
+    sendMessage(a: {
+        contact: string;
+        text: string;
+        replyToWireId?: string;
+    }): Promise<void>;
+    sendFile(a: {
+        contact: string;
+        path: string;
+        filename: string;
+        replyToWireId?: string;
+    }): Promise<void>;
+    /** Release the daemon lease and stop. Never throws. */
+    close(): Promise<void>;
+}
+/**
+ * The typed error code of a daemon operation, or undefined when the failure was
+ * not one (transport, abort, programming error). `instanceof` is checked first;
+ * the structural fallback keeps a duplicated SDK copy in a consumer's tree from
+ * silently demoting a real daemon verdict to "unknown transport failure".
+ */
+export declare function oursErrorCode(error: unknown): string | undefined;
+/** The identity is bound by another live session; a predecessor may still be releasing it. */
+export declare const OURS_BOUND_ELSEWHERE = "BOUND_ELSEWHERE";
+export interface OursSdkClientDeps {
+    /** Test seam; production builds an `OursClient` from the resolved endpoint. */
+    createClient?(options: OursClientOptions): OursClient;
+}
+/**
+ * The owner-channel's daemon client: one `OursClient` over the local ours HTTP
+ * API, owning exactly one identity binding.
+ *
+ * Lease lifetime. The lease token IS the session, so each channel instance mints
+ * its own and hands it back in `close()`. That replaces the `ours-mcp proxy`
+ * shell-PID fence, which existed because a supervised attempt had to make its
+ * lease reclaimable while the supervisor itself stayed alive: an explicit
+ * release does that deterministically, and `clientPid` still covers the case
+ * where the whole supervisor dies without unwinding.
+ */
+export declare class OursSdkClient implements OursOps {
+    private readonly env;
+    private readonly log;
+    private readonly deps;
+    private client?;
+    private readonly leaseToken;
+    constructor(env?: Record<string, string>, log?: (line: string) => void, deps?: OursSdkClientDeps);
+    start(): Promise<void>;
+    bindIdentity(name: string): Promise<void>;
+    listContacts(): Promise<OursContactsView>;
+    generateInvite(name?: string): Promise<OursInviteResult>;
+    addContact(a: {
+        invite: string;
+        name?: string;
+    }): Promise<OursAddContactResult>;
+    getMessages(): Promise<OursMessagesPayload>;
+    deferMessages(msgIds: number[]): Promise<void>;
+    listIncomingFiles(): Promise<OursIncomingFile[]>;
+    getFiles(wireIds: string[]): Promise<OursRetrievedFiles>;
+    fetchFile(wireId: string): Promise<Uint8Array>;
+    sendMessage(a: {
+        contact: string;
+        text: string;
+        replyToWireId?: string;
+    }): Promise<void>;
+    sendFile(a: {
+        contact: string;
+        path: string;
+        filename: string;
+        replyToWireId?: string;
+    }): Promise<void>;
+    close(): Promise<void>;
+    private ops;
+}
+export {};

package/dist/owner-channel/ours-client.js

@@ -0,0 +1,148 @@
+import { randomUUID } from 'node:crypto';
+import { OursClient, OursError } from '@ours.network/sdk/client';
+import { resolveApiToken, resolveEndpoint } from '../monitor.js';
+/** Any failure of a daemon operation. Never carries a message body or a token. */
+export class OursDaemonError extends Error {
+}
+/**
+ * The daemon accepted the call and answered "not sent". The MCP surface reported
+ * exactly these verdicts as tool errors, so they must keep throwing here: the
+ * owner channel books a resolved send as delivered, and a silently-swallowed
+ * refusal would be recorded as a delivered message that never left the host.
+ */
+export class OursSendRefusedError extends OursDaemonError {
+}
+/**
+ * The typed error code of a daemon operation, or undefined when the failure was
+ * not one (transport, abort, programming error). `instanceof` is checked first;
+ * the structural fallback keeps a duplicated SDK copy in a consumer's tree from
+ * silently demoting a real daemon verdict to "unknown transport failure".
+ */
+export function oursErrorCode(error) {
+    if (error instanceof OursError)
+        return error.code;
+    if (error instanceof Error && error.name === 'OursError') {
+        const code = error.code;
+        if (typeof code === 'string')
+            return code;
+    }
+    return undefined;
+}
+/** The identity is bound by another live session; a predecessor may still be releasing it. */
+export const OURS_BOUND_ELSEWHERE = 'BOUND_ELSEWHERE';
+/**
+ * The owner-channel's daemon client: one `OursClient` over the local ours HTTP
+ * API, owning exactly one identity binding.
+ *
+ * Lease lifetime. The lease token IS the session, so each channel instance mints
+ * its own and hands it back in `close()`. That replaces the `ours-mcp proxy`
+ * shell-PID fence, which existed because a supervised attempt had to make its
+ * lease reclaimable while the supervisor itself stayed alive: an explicit
+ * release does that deterministically, and `clientPid` still covers the case
+ * where the whole supervisor dies without unwinding.
+ */
+export class OursSdkClient {
+    env;
+    log;
+    deps;
+    client;
+    leaseToken = `ours-fleet-owner-${process.pid}-${randomUUID()}`;
+    constructor(env = {}, log = () => undefined, deps = {}) {
+        this.env = env;
+        this.log = log;
+        this.deps = deps;
+    }
+    async start() {
+        if (this.client)
+            return;
+        const environment = { ...process.env, ...this.env };
+        // Reuse fleet's own daemon resolution so this client and the notification
+        // watch loop can never disagree about which daemon they are talking to.
+        const endpoint = resolveEndpoint(environment);
+        const apiToken = resolveApiToken(environment);
+        const options = {
+            url: endpoint.origin,
+            leaseToken: this.leaseToken,
+            clientPid: process.pid,
+            ...(apiToken ? { apiToken } : {}),
+        };
+        this.client = this.deps.createClient?.(options) ?? new OursClient(options);
+    }
+    async bindIdentity(name) {
+        // force is pinned off: the owner channel never evicts another live session
+        // from an identity, it waits for the bounded handoff window and then fails.
+        await this.ops().chooseIdentity({ name, force: false });
+    }
+    async listContacts() {
+        return this.ops().listContacts();
+    }
+    async generateInvite(name) {
+        return this.ops().generateInvite(name ? { name } : {});
+    }
+    async addContact(a) {
+        return this.ops().addContact({ invite: a.invite, ...(a.name ? { name: a.name } : {}) });
+    }
+    async getMessages() {
+        return this.ops().getMessages();
+    }
+    async deferMessages(msgIds) {
+        await this.ops().deferMessages({ msg_ids: msgIds });
+    }
+    async listIncomingFiles() {
+        return this.ops().listIncomingFiles();
+    }
+    async getFiles(wireIds) {
+        return this.ops().getFiles({ wire_ids: wireIds });
+    }
+    async fetchFile(wireId) {
+        // save_file has no SDK operation on purpose: that daemon route only reports
+        // that a too-old connector reached it. The bytes of a retrieved file are
+        // already on disk, so read them back and let the caller write them as this
+        // process's own OS user.
+        return this.ops().fetchFile(wireId);
+    }
+    async sendMessage(a) {
+        const verdict = await this.ops().sendMessage({
+            contact: a.contact, text: a.text,
+            ...(a.replyToWireId ? { reply_to_wire_id: a.replyToWireId } : {}),
+        });
+        // Parity with ours-mcp 0.16.0: only `refused` was a tool error. `migrating`,
+        // `deferred` and `e2e` are accepted-and-queued outcomes that it reported as
+        // success, so they must not become failures here.
+        if (verdict.kind === 'refused')
+            throw new OursSendRefusedError('the daemon refused the message: the contact\'s end-to-end session must be '
+                + 're-established after an upgrade; it was not sent and not downgraded');
+    }
+    async sendFile(a) {
+        const verdict = await this.ops().sendFile({
+            contact: a.contact, path: a.path, filename: a.filename,
+            ...(a.replyToWireId ? { reply_to_wire_id: a.replyToWireId } : {}),
+        });
+        // Parity with ours-mcp 0.16.0, which treated `migrating` as an error for
+        // files and as success for messages: files are not auto-queued behind a
+        // migration, so "queued" would be a false delivery claim.
+        if (verdict.kind === 'refused' || verdict.kind === 'migrating')
+            throw new OursSendRefusedError(`the daemon did not send the file (${verdict.kind}): the contact's end-to-end `
+                + 'session must be re-established after an upgrade; files are not queued');
+    }
+    async close() {
+        const client = this.client;
+        this.client = undefined;
+        if (!client)
+            return;
+        // Handing the lease back is what lets a successor bind this identity without
+        // waiting for the supervisor to exit. A failure here is not fatal — the
+        // daemon still reclaims the lease when this process dies.
+        try {
+            await client.releaseLease();
+        }
+        catch (error) {
+            this.log(`lease release failed: ${error?.message ?? String(error)}`);
+        }
+    }
+    ops() {
+        if (!this.client)
+            throw new OursDaemonError('ours daemon client is not started');
+        return this.client;
+    }
+}

package/dist/runner.d.ts

@@ -3,7 +3,9 @@ import type { Launch } from './harness/types.js';
 import { Tmux } from './tmux.js';
 import { type MonitorHandle, type MonitorOpts, type FetchLike } from './monitor.js';
 import { type Exec } from './exec.js';
-import type { ExitRecord } from './session/types.js';
+import { type AcpSessionOptions } from './session/acp.js';
+import { RoleControlServer } from './session/control.js';
+import type { ExitRecord, SessionHandle, TurnResult } from './session/types.js';
 import { type OwnerChannelHandle, type OwnerChannelOptions } from './owner-channel/channel.js';
 import { type OwnerBinderLease } from './owner-channel/binder.js';
 export interface RunnerDeps {
@@ -20,6 +22,10 @@ export interface RunnerDeps {
     createMonitor(opts: MonitorOpts): MonitorHandle;
     /** Construct trusted owner ingress (injectable for lifecycle tests). */
     createOwnerChannel(opts: OwnerChannelOptions): OwnerChannelHandle;
+    /** Start the ACP transport (injectable for deterministic runner lifecycle tests). */
+    startAcpSession(opts: AcpSessionOptions): Promise<SessionHandle>;
+    /** Construct the authenticated role control route (injectable where sockets are unavailable). */
+    createControlServer(stateDir: string, session: SessionHandle, log: (line: string) => void): Pick<RoleControlServer, 'start' | 'close' | 'setFleetSpawner' | 'setOwnerChannel' | 'setConfigReloader' | 'setLoopManager'>;
     /** Acquire the cross-process owner-channel binder lease before replacing the control socket. */
     acquireOwnerBinder(stateDir: string, role: string, identity: string): Promise<OwnerBinderLease>;
     /** Ask the still-authenticated predecessor to emit the fixed recovery notice. */
@@ -107,6 +113,8 @@ export interface AttemptResult {
 export declare const TEMP_IDENTITY_CLOSE_DEBOUNCE_MS = 5000;
 /** Lifecycle polling is deliberately slower than the 500ms stop-signal loop. */
 export declare const TEMP_IDENTITY_POLL_MS = 2000;
+/** Only authenticated wake interrupts may turn a temp startup cancellation into readiness. */
+export declare function isRecoverableTempStartupCancellation(temp: boolean, result: TurnResult): boolean;
 /** One session lifecycle. `runSupervised` (or a one-shot caller) drives it. */
 export declare function runOnce(name: string, opts?: {
     temp?: boolean;

package/dist/runner.js

@@ -42,6 +42,8 @@ const defaultDeps = () => ({
     fetch: (url, init) => globalThis.fetch(url, init),
     createMonitor: opts => createMonitor(opts),
     createOwnerChannel: opts => new OwnerChannel(opts),
+    startAcpSession: opts => AcpSession.start(opts),
+    createControlServer: (stateDir, session, log) => new RoleControlServer(stateDir, session, log),
     acquireOwnerBinder: (stateDir, role, identity) => acquireOwnerBinderLease(stateDir, role, identity),
     reportOwnerStartupFailure: async (stateDir) => {
         const response = await controlRequest(stateDir, {
@@ -352,6 +354,12 @@ function resolveConfigPath(dir, explicit) {
 export const TEMP_IDENTITY_CLOSE_DEBOUNCE_MS = 5_000;
 /** Lifecycle polling is deliberately slower than the 500ms stop-signal loop. */
 export const TEMP_IDENTITY_POLL_MS = 2_000;
+/** Only authenticated wake interrupts may turn a temp startup cancellation into readiness. */
+export function isRecoverableTempStartupCancellation(temp, result) {
+    return temp && result.accepted && result.outcome === 'cancelled'
+        && (result.cancellationSource === 'local-console'
+            || result.cancellationSource === 'fleet-monitor');
+}
 /** One session lifecycle. `runSupervised` (or a one-shot caller) drives it. */
 export async function runOnce(name, opts = {}, partialDeps = {}) {
     const deps = { ...defaultDeps(), ...partialDeps };
@@ -512,7 +520,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         if (perms.unattended === 'deny')
             deps.log(`[${name}] permission policy: unattended=deny — with no console attached, ` +
                 `permission requests are automatically denied once each (reject_once) and the turn continues`);
-        acpSession = await AcpSession.start({
+        acpSession = await deps.startAcpSession({
             name,
             argv: wrappedArgv,
             cwd: runCwd,
@@ -555,7 +563,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                     + `${error?.message ?? String(error)}`);
             }
         }
-        control = new RoleControlServer(dir, arbiter, deps.log);
+        control = deps.createControlServer(dir, arbiter, deps.log);
         try {
             await control.start();
         }
@@ -640,7 +648,14 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         // success, so there is neither a deaf gap nor a boot-cancellation loop.
         monitorLoop = monitor?.run(pid);
         const started = await starting;
-        if (!started.succeeded) {
+        // A temporary role's first turn can be the active turn when an ours wake
+        // needs immediate attention. A typed console/monitor cancellation ends
+        // only that turn: the already-live ACP session and any queued wake remain
+        // valid. Keep every unproven cancellation, refusal, shutdown, and genuine
+        // failure terminal so a role that never accepted its briefing is not
+        // silently reported as healthy.
+        const interruptedForWake = isRecoverableTempStartupCancellation(temp, started);
+        if (!started.succeeded && !interruptedForWake) {
             monitor?.stop();
             await control.close();
             ownerBinder?.release();
@@ -664,6 +679,9 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             throw new Error(`[${name}] ACP startup prompt ${started.outcome}` +
                 `${started.detail ? `: ${started.detail}` : ''}`);
         }
+        if (interruptedForWake)
+            deps.log(`[${name}] ACP startup prompt cancelled by ${started.cancellationSource}; `
+                + 'keeping temporary supervisor alive');
         acpStartupComplete = true;
         if (role.owner_channel) {
             ownerChannel = deps.createOwnerChannel({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.17.3",
+  "version": "0.18.0-nightly.1",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux or ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -38,6 +38,7 @@
     "@agentclientprotocol/sdk": "^1.3.0",
     "@fastify/static": "^10.1.2",
     "@fastify/websocket": "^11.2.0",
+    "@ours.network/sdk": "1.3.1",
     "@xterm/addon-fit": "0.10.0",
     "@xterm/addon-serialize": "0.13.0",
     "@xterm/headless": "5.5.0",

package/dist/owner-channel/mcp.d.ts

@@ -1,24 +0,0 @@
-export declare class OursMcpError extends Error {
-}
-export interface OursToolClient {
-    start(): Promise<void>;
-    callTool(name: string, args?: Record<string, unknown>): Promise<unknown>;
-    close(): Promise<void>;
-}
-/** Minimal MCP stdio client. One instance owns exactly one ours identity binding. */
-export declare class OursMcpClient implements OursToolClient {
-    private readonly command;
-    private readonly env;
-    private readonly log;
-    private child?;
-    private nextId;
-    private tail;
-    constructor(command?: string, env?: Record<string, string>, log?: (line: string) => void);
-    start(): Promise<void>;
-    callTool(name: string, args?: Record<string, unknown>): Promise<unknown>;
-    close(): Promise<void>;
-    private request;
-    private requestNow;
-    private notify;
-    private write;
-}

package/dist/owner-channel/mcp.js

@@ -1,145 +0,0 @@
-import { spawn } from 'node:child_process';
-import { randomUUID } from 'node:crypto';
-import { createInterface } from 'node:readline';
-export class OursMcpError extends Error {
-}
-/** Minimal MCP stdio client. One instance owns exactly one ours identity binding. */
-export class OursMcpClient {
-    command;
-    env;
-    log;
-    child;
-    nextId = 0;
-    tail = Promise.resolve();
-    constructor(command = 'ours-mcp', env = {}, log = () => undefined) {
-        this.command = command;
-        this.env = env;
-        this.log = log;
-    }
-    async start() {
-        if (this.child && this.child.exitCode === null)
-            return;
-        // ours-mcp normally records the long-lived client PID so an identity lease
-        // survives connector churn. An owner-channel connector has the opposite
-        // lifecycle: each supervised attempt owns a fresh connector and must make
-        // its lease reclaimable when that connector exits, even though the fleet
-        // supervisor itself remains alive. POSIX exec preserves the shell PID as
-        // the proxy PID, giving the daemon an exact process-lifetime fence without
-        // interpolating the command path into shell text.
-        const child = spawn('/bin/sh', [
-            '-c', 'OURS_CLIENT_PID=$$; export OURS_CLIENT_PID; exec "$1" "$2"',
-            'ours-fleet-owner-proxy', this.command, 'proxy',
-        ], {
-            env: {
-                ...process.env,
-                ...this.env,
-                // Bindings are keyed by this value. Sharing it would silently rebind a
-                // role's normal mailbox or another owner channel.
-                CLAUDE_CODE_SESSION_ID: `ours-fleet-owner-${process.pid}-${randomUUID()}`,
-            },
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
-        await new Promise((resolve, reject) => {
-            child.once('spawn', resolve);
-            child.once('error', reject);
-        });
-        this.child = child;
-        child.once('exit', (code, signal) => {
-            this.log(`ours-mcp proxy launcher exited (${code ?? signal ?? 'unknown'})`);
-        });
-        child.stdin.on('error', error => this.log(`ours-mcp stdin: ${error.message}`));
-        createInterface({ input: child.stderr }).on('line', line => this.log(`ours-mcp: ${line}`));
-        try {
-            await this.request('initialize', {
-                protocolVersion: '2025-03-26', capabilities: {},
-                clientInfo: { name: 'ours-fleet-owner-channel', version: '1' },
-            });
-            await this.notify('notifications/initialized', {});
-        }
-        catch (error) {
-            await this.close();
-            throw error;
-        }
-    }
-    async callTool(name, args = {}) {
-        const result = await this.request('tools/call', { name, arguments: args });
-        const text = (result.content ?? [])
-            .filter(item => item.type === 'text').map(item => item.text ?? '').join('\n').trim();
-        if (result.isError)
-            throw new OursMcpError(text || `ours tool ${name} failed`);
-        if (result.structuredContent !== undefined)
-            return result.structuredContent;
-        if (!text)
-            return {};
-        try {
-            return JSON.parse(text);
-        }
-        catch {
-            return text;
-        }
-    }
-    async close() {
-        const child = this.child;
-        this.child = undefined;
-        if (!child || child.exitCode !== null)
-            return;
-        // EOF asks the proxy to close normally. Once this exact process exits, the
-        // daemon can reclaim its lease even while the supervisor stays alive.
-        child.stdin.end();
-        const exited = await new Promise(resolve => {
-            const timer = setTimeout(() => resolve(false), 1_000);
-            child.once('exit', () => { clearTimeout(timer); resolve(true); });
-        });
-        if (exited || child.exitCode !== null)
-            return;
-        child.kill('SIGTERM');
-        await new Promise(resolve => {
-            const timer = setTimeout(() => { child.kill('SIGKILL'); resolve(); }, 5_000);
-            child.once('exit', () => { clearTimeout(timer); resolve(); });
-        });
-    }
-    request(method, params) {
-        const run = this.tail.then(() => this.requestNow(method, params));
-        this.tail = run.then(() => undefined, () => undefined);
-        return run;
-    }
-    async requestNow(method, params) {
-        const child = this.child;
-        if (!child || child.exitCode !== null)
-            throw new OursMcpError('ours-mcp proxy is not running');
-        const id = ++this.nextId;
-        await this.write(child, { jsonrpc: '2.0', id, method, params });
-        const lines = createInterface({ input: child.stdout, crlfDelay: Infinity });
-        try {
-            for await (const line of lines) {
-                let response;
-                try {
-                    response = JSON.parse(line);
-                }
-                catch {
-                    continue;
-                }
-                if (response.id !== id)
-                    continue;
-                if (response.error !== undefined)
-                    throw new OursMcpError(JSON.stringify(response.error));
-                return response.result ?? {};
-            }
-            throw new OursMcpError('ours-mcp proxy closed its output');
-        }
-        finally {
-            lines.close();
-        }
-    }
-    async notify(method, params) {
-        const child = this.child;
-        if (!child || child.exitCode !== null)
-            throw new OursMcpError('ours-mcp proxy is not running');
-        await this.write(child, { jsonrpc: '2.0', method, params });
-    }
-    write(child, value) {
-        return new Promise((resolve, reject) => {
-            child.stdin.write(JSON.stringify(value) + '\n', error => error ? reject(error) : resolve());
-        });
-    }
-}