@ours.network/fleet 0.18.0-nightly.5 → 0.18.0

package/dist/owner-channel/channel.js

@@ -1,17 +1,20 @@
-import { createHash } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { mkdir, readFile, readdir, rm } from 'node:fs/promises';
+import { createInterface } from 'node:readline';
 import { join } from 'node:path';
 import { DEFAULT_OWNER_ATTACHMENT_MIME, canonicalCid, } from '../config.js';
 import { replaceFileAtomically } from '../atomic-file.js';
+import { resolveEndpoint } from '../monitor.js';
 import { ACP_CANCEL_DEADLINE_EXCEEDED, SessionControlError, interruptOutcome, } from '../session/types.js';
 import { VERSION } from '../version.js';
 import { dispatchOwnerCommand, fleetCliOps, isOwnerCommandText, } from './commands.js';
-import { OURS_BOUND_ELSEWHERE, OursSdkClient, oursErrorCode, } from './ours-client.js';
+import { OursMcpClient } from './mcp.js';
 import { ownerNotices, } from './notices.js';
 import { DuplicateSendError, OwnerAuthorizationState, OwnerChannelState, OwnerConversationState, } from './state.js';
 import { OwnerTaskState, ownerTaskAuditId, ownerTaskDigest, } from './tasks.js';
-import { AttachmentRecoveryState, admitAttachments, cleanupAttachmentRoot, parseIncomingAttachments, parseRetrievedAttachments, prepareAttachmentDirectory, recoveredAttachment, removeRequestDirectory, safeField, validateAttachmentSelection, validateAttachmentRelaySelection, writeRecoveredAttachment, } from './attachments.js';
+import { AttachmentRecoveryState, admitAttachments, cleanupAttachmentRoot, parseIncomingAttachments, parseRetrievedAttachments, prepareAttachmentDirectory, recoveredAttachment, removeRequestDirectory, safeField, validateAttachmentSelection, validateAttachmentRelaySelection, } from './attachments.js';
 import { acquireOwnerBinderLease, OWNER_BIND_HANDOFF_TIMEOUT_MS, } from './binder.js';
 const OWNER_UPDATE_MIN_INTERVAL_MS = 5_000;
 const OWNER_UPDATE_MAX_COUNT = 20;
@@ -25,7 +28,15 @@ const COMMENTARY_MAX_CHARS = 1_600;
 const COMMENTARY_MAX_BYTES = 6_400;
 const COMMENTARY_MAX_UPDATES = 32;
 const COMMENTARY_DEDUPE_LIMIT = 512;
+const OWNER_WATCH_STALL_MS = 120_000;
 const OWNER_WATCH_BACKOFF_MAX_MS = 30_000;
+/**
+ * Credentials that are wrong now are wrong on the next attempt too. Retrying a
+ * permanent 401 forever burns the daemon and hides the real fault behind an
+ * endless reconnect log, so the watch stops after this many consecutive auth
+ * rejections and records a terminal reason instead.
+ */
+const OWNER_WATCH_AUTH_FATAL_ATTEMPTS = 5;
 /** A relay attempt that failed only because no owner route exists yet. */
 class RelayUnroutableError extends Error {
 }
@@ -59,6 +70,7 @@ export class OwnerChannel {
     commentsBaseline;
     commentsEnabled;
     stopping = false;
+    watchProcess;
     watchTask;
     watchAbort;
     drainTask;
@@ -72,7 +84,7 @@ export class OwnerChannel {
     fleetOps;
     constructor(options) {
         this.options = options;
-        this.client = options.client ?? new OursSdkClient(options.env, line => options.log(`[${options.role}] owner channel ${line}`));
+        this.client = options.client ?? new OursMcpClient(options.command, options.env, line => options.log(`[${options.role}] owner channel ${line}`));
         this.fleetOps = options.fleet ?? fleetCliOps(options.role, options.configPath);
         this.state = new OwnerChannelState(join(options.stateDir, '.owner-channel-state.json'));
         this.authorizations = new OwnerAuthorizationState(join(options.stateDir, '.owner-channel-owners.json'), options.config.owners);
@@ -111,16 +123,12 @@ export class OwnerChannel {
             const bindStartedAt = now();
             for (;;) {
                 try {
-                    await this.client.bindIdentity(this.options.config.identity);
+                    await this.client.callTool('choose_identity', { name: this.options.config.identity });
                     break;
                 }
                 catch (error) {
-                    // The predecessor's lease may still be in flight. Only the daemon's
-                    // own typed verdict may extend the handoff window: matching the
-                    // wording of an error message would let any other failure whose text
-                    // happens to say "bound to another live session" — including one
-                    // relayed from a peer — spin here for the whole timeout.
-                    const liveConflict = oursErrorCode(error) === OURS_BOUND_ELSEWHERE;
+                    const message = error?.message ?? String(error);
+                    const liveConflict = /currently bound to another live session/i.test(message);
                     if (!this.binder.inherited || !liveConflict
                         || now() - bindStartedAt >= OWNER_BIND_HANDOFF_TIMEOUT_MS)
                         throw error;
@@ -142,10 +150,9 @@ export class OwnerChannel {
             void cleanupAttachmentRoot(this.attachmentRoot, Date.now(), this.attachmentConfig.retention_ms).catch(error => this.logError('attachment crash cleanup failed', error));
         }
         this.ready = true;
+        this.watchTask = this.options.watch ? this.legacyWatchLoop() : this.watchLoop();
         // Do not make role startup wait for an old owner request to finish a turn.
-        // watchLoop itself drains before every establishment, including this first
-        // one, so there is no drain-to-tip race.
-        this.watchTask = this.watchLoop();
+        void this.drain().catch(error => this.logError('initial drain failed', error));
     }
     drain() {
         this.drainRequested = true;
@@ -162,8 +169,13 @@ export class OwnerChannel {
     async close() {
         this.stopping = true;
         this.ready = false;
+        const watch = this.watchProcess;
+        this.watchProcess = undefined;
+        if (watch && watch.exitCode === null)
+            watch.kill('SIGTERM');
         this.watchAbort?.abort();
-        await this.watchTask?.catch(error => this.logError('watch shutdown failed', error));
+        if (!this.options.watch)
+            await this.watchTask?.catch(error => this.logError('watch shutdown failed', error));
         this.watchTask = undefined;
         await this.managementTail;
         try {
@@ -189,10 +201,13 @@ export class OwnerChannel {
                 ? ' with interruption'
                 : event.monitor.interrupt === 'after_tool' ? ' with after-tool steering' : '';
             const monitor = `${event.monitor.mode} monitor${monitorPolicy}`;
+            const permission = event.permissionMode
+                ? `; permission ${event.permissionMode.fleetMode}, native ${event.permissionMode.nativeMode}`
+                : '';
             const inherited = event.inherited.length
                 ? ` Supervisor inherited omitted defaults: ${event.inherited.join(', ')}.` : '';
             await this.sendProactiveMessage(`🧑‍💻 ${event.caller} spawned ${event.lifetime} agent ${event.role} `
-                + `(${event.harness}/${event.session}${model}; ${monitor}).${inherited}`, `fleet-spawn\0${event.creationActionId}`, 0);
+                + `(${event.harness}/${event.session}${model}; ${monitor}${permission}).${inherited}`, `fleet-spawn\0${event.creationActionId}`, 0);
         });
         this.managementTail = run.then(() => undefined, () => undefined);
         return run;
@@ -205,14 +220,11 @@ export class OwnerChannel {
                 return { action: request.action, contacts: await this.contacts() };
             case 'contact_invite': {
                 this.assertLabel(request.name);
-                // The invite is the blob field, not a sentence containing it. The MCP
-                // surface answered with "One-time invite for X created (invite_id …).
-                // Share this blob out-of-band …:\n<blob>" and the whole sentence was
-                // handed out as the invite, so any rewording changed the payload.
-                const { blob } = await this.client.generateInvite(request.name);
-                if (typeof blob !== 'string' || !blob)
-                    throw new Error('the ours daemon returned no invite blob');
-                return { action: request.action, invite: blob };
+                const raw = await this.client.callTool('generate_invite', request.name ? { name: request.name } : {});
+                const invite = typeof raw === 'string' ? raw : String(raw?.invite ?? '');
+                if (!invite)
+                    throw new Error('ours-mcp returned no invite');
+                return { action: request.action, invite };
             }
             case 'contact_add': {
                 if (typeof request.invite !== 'string' || !request.invite)
@@ -220,19 +232,18 @@ export class OwnerChannel {
                 if (Buffer.byteLength(request.invite) > 48 * 1024)
                     throw new Error('invite exceeds 49152 bytes');
                 this.assertLabel(request.name);
-                let added;
+                let raw;
                 try {
-                    added = await this.client.addContact({
+                    raw = await this.client.callTool('add_contact', {
                         invite: request.invite, ...(request.name ? { name: request.name } : {}),
                     });
                 }
                 catch {
                     // Daemon errors are not allowed to reflect invite material through
                     // the control response, CLI stderr, or supervisor logs.
-                    throw new Error('the ours daemon could not accept the contact invite');
+                    throw new Error('ours-mcp could not accept the contact invite');
                 }
-                const contact = this.contact(added.cid, added.display, 'pending');
-                return { action: request.action, status: 'pending', ...(contact ? { contact } : {}) };
+                return { action: request.action, status: 'pending', contact: this.contact(raw) };
             }
             case 'owner_list':
                 return {
@@ -306,36 +317,33 @@ export class OwnerChannel {
                 throw new Error('unknown owner-channel management action');
         }
     }
-    /**
-     * The daemon reports established contacts and pending introductions as two
-     * separate collections, so the status is structural rather than a word parsed
-     * out of a rendered line. Nothing here can be spoofed by a contact's own
-     * display name.
-     */
     async contacts() {
-        const view = await this.client.listContacts();
-        const rows = [
-            ...(Array.isArray(view?.contacts) ? view.contacts : [])
-                .map(row => this.contact(row?.container_id, row?.name, 'established', view)),
-            ...(Array.isArray(view?.pending) ? view.pending : [])
-                .map(row => this.contact(row?.container_id, row?.name, 'pending', view)),
-        ];
-        return rows.filter((row) => Boolean(row))
+        const raw = await this.client.callTool('list_contacts');
+        const values = Array.isArray(raw) ? raw : raw?.contacts;
+        if (!Array.isArray(values))
+            return [];
+        return values.map(value => this.contact(value)).filter((v) => Boolean(v))
             .sort((a, b) => a.cid.localeCompare(b.cid));
     }
-    contact(cidValue, nameValue, status, view) {
-        const cid = String(cidValue ?? '');
+    contact(raw) {
+        if (!raw || typeof raw !== 'object')
+            return undefined;
+        const value = raw;
+        const cid = String(value.cid ?? value.id ?? value.container_id ?? value.containerId ?? '');
         if (!/^[A-Fa-f0-9]{64}$/.test(cid))
             return undefined;
-        const root = view?.roots?.[cid];
-        const rootCid = String(root?.root_cid ?? '');
+        const humanRaw = value.human ?? value.root;
+        const human = humanRaw && typeof humanRaw === 'object' ? humanRaw : undefined;
         return {
             cid,
-            name: this.safeMetadata(nameValue ?? cid),
-            status,
-            ...(root ? { human: {
-                    ...(/^[A-Fa-f0-9]{64}$/.test(rootCid) ? { cid: rootCid } : {}),
-                    ...(root.root_name ? { name: this.safeMetadata(root.root_name) } : {}),
+            name: this.safeMetadata(value.name ?? value.display_name ?? cid),
+            status: this.safeMetadata(value.status ?? 'established'),
+            ...(typeof value.kind === 'string' ? { kind: this.safeMetadata(value.kind) } : {}),
+            ...(human ? { human: {
+                    ...(typeof (human.cid ?? human.id) === 'string'
+                        && /^[A-Fa-f0-9]{64}$/.test(String(human.cid ?? human.id))
+                        ? { cid: String(human.cid ?? human.id) } : {}),
+                    ...(human.name ? { name: this.safeMetadata(human.name) } : {}),
                 } } : {}),
         };
     }
@@ -520,16 +528,16 @@ export class OwnerChannel {
         // A finite cap protects the supervisor if a broken daemon repeats unread
         // messages forever. A watch notification will resume draining later.
         for (let pass = 0; pass < 100 && !this.stopping; pass++) {
-            const [payload, fileResult] = await Promise.all([
-                this.client.getMessages(),
-                this.client.listIncomingFiles()
+            const [raw, fileResult] = await Promise.all([
+                this.client.callTool('get_messages'),
+                this.client.callTool('list_incoming_files')
                     .catch(error => {
                     this.logError('attachment metadata inspection unavailable', error);
                     return undefined;
                 }),
             ]);
-            const messages = Array.isArray(payload?.messages)
-                ? payload.messages.filter(message => message && typeof message === 'object')
+            const messages = Array.isArray(raw?.messages)
+                ? raw.messages.filter(message => message && typeof message === 'object')
                 : [];
             let files = [];
             try {
@@ -553,7 +561,7 @@ export class OwnerChannel {
                     && Number.isInteger(message.msg_id);
             }).map(message => message.msg_id);
             if (deferred.length)
-                await this.client.deferMessages(deferred);
+                await this.client.callTool('defer_messages', { msg_ids: deferred });
             let advanced = false;
             const consumedMessages = new Set();
             const groups = this.attachmentGroups(files, messages, pending, consumedMessages);
@@ -684,12 +692,15 @@ export class OwnerChannel {
             const unread = group.files.filter(file => file.status === 'unread');
             const processed = group.files.filter(file => file.status !== 'unread');
             const retrieved = unread.length
-                ? parseRetrievedAttachments(await this.client.getFiles(unread.map(file => file.wireId)), unread)
+                ? parseRetrievedAttachments(await this.client.callTool('get_files', {
+                    wire_ids: unread.map(file => file.wireId),
+                }), unread)
                 : [];
             for (const file of processed) {
                 if (!group.recovery)
                     throw new Error('unexpected processed attachment without recovery route');
-                const recoveryPath = await writeRecoveredAttachment(requestDir, file.wireId, await this.client.fetchFile(file.wireId));
+                const recoveryPath = join(requestDir, `.recovered-${file.wireId}-${randomUUID()}`);
+                await this.client.callTool('save_file', { wire_id: file.wireId, dest_path: recoveryPath });
                 retrieved.push(await recoveredAttachment(file, recoveryPath));
             }
             const order = new Map(group.files.map((file, index) => [file.wireId, index]));
@@ -698,17 +709,13 @@ export class OwnerChannel {
             outbox = this.outboxDir(originWireId);
             await mkdir(outbox, { recursive: true, mode: 0o700 });
             const activityCursor = this.latestEventSeq(this.options.session.eventsSince(0));
-            const queued = await this.options.session.queuePrompt(this.ownerAttachmentPrompt(sender, originWireId, requestId, outbox, admitted, group.caption), {
+            const queued = await this.options.session.queuePrompt(this.ownerAttachmentPrompt(sender, originWireId, requestId, admitted, group.caption), {
                 interrupt: this.options.config.interrupt,
                 ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
                 origin: { kind: 'owner', requestId,
                     ...(group.caption ? { displayText: String(group.caption.text ?? '') } : {}) },
             });
-            const accepted = this.options.config.interrupt
-                ? ownerNotices.receivedInterrupting()
-                : queued.queuedBehind > 0
-                    ? ownerNotices.receivedQueued(queued.queuedBehind)
-                    : ownerNotices.receivedStarted();
+            const accepted = this.acceptanceNotice(queued);
             handledWireIds.forEach(wire => this.inFlight.add(wire));
             const receipt = this.send(sender.id, accepted, originWireId).then(() => undefined).catch(error => {
                 this.logError(`attachment request ${requestId.slice(0, 12)} acceptance notice failed`, error);
@@ -786,12 +793,12 @@ export class OwnerChannel {
                     // the authenticated agent once so the wait is never silent.
                     this.options.log(`[${this.options.role}] owner channel managed-agent relay has no owner `
                         + `route yet; message stays queued: ${this.errorText(error)}`);
-                    await this.nackManagedAgent(sender.id, message.wire_id ? wireId : undefined, wireId, ownerNotices.relayQueued());
+                    await this.nackManagedAgent(sender.id, message, wireId, ownerNotices.relayQueued());
                     return false;
                 }
                 else {
                     this.logError('managed-agent message relay refused', error);
-                    await this.nackManagedAgent(sender.id, message.wire_id ? wireId : undefined, wireId, ownerNotices.relayRefused(this.errorText(error)));
+                    await this.nackManagedAgent(sender.id, message, wireId, ownerNotices.relayRefused(this.errorText(error)));
                 }
             }
             this.state.remember(wireId);
@@ -827,7 +834,7 @@ export class OwnerChannel {
         let queued;
         const activityCursor = this.latestEventSeq(this.options.session.eventsSince(0));
         try {
-            queued = await this.options.session.queuePrompt(this.ownerPrompt(sender, text, wireId, outbox), {
+            queued = await this.options.session.queuePrompt(this.ownerPrompt(sender, text, wireId), {
                 interrupt: this.options.config.interrupt,
                 ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
                 origin: { kind: 'owner', requestId, displayText: text },
@@ -849,14 +856,7 @@ export class OwnerChannel {
             this.state.remember(wireId);
             return true;
         }
-        // Interrupting the live turn does not remove prompts which were already
-        // accepted into the ACP queue. Never claim this request is running while
-        // the session itself says earlier work remains ahead of it.
-        const accepted = queued.queuedBehind > 0
-            ? ownerNotices.receivedQueued(queued.queuedBehind)
-            : this.options.config.interrupt
-                ? ownerNotices.receivedInterrupting()
-                : ownerNotices.receivedStarted();
+        const accepted = this.acceptanceNotice(queued);
         this.inFlight.add(wireId);
         const receipt = this.send(sender.id, accepted, wireId).then(() => undefined).catch(error => {
             this.logError(`request ${requestId.slice(0, 12)} acceptance notice failed`, error);
@@ -1036,9 +1036,7 @@ export class OwnerChannel {
     async handleManagedAgentAttachmentGroup(group, handledWireIds, agent) {
         const captionWire = group.caption ? this.wireId(group.caption) : undefined;
         const nackWire = captionWire ?? group.files[0].wireId;
-        // A caption whose own wire id is synthetic (msg_id only) must not be echoed
-        // back as a reply reference; a file wire always is a real one.
-        const nackReplyTo = (group.caption ? group.caption.wire_id : nackWire) ? nackWire : undefined;
+        const nackMessage = group.caption ?? { wire_id: nackWire };
         let requestDir;
         let recovery;
         try {
@@ -1074,12 +1072,15 @@ export class OwnerChannel {
             const unread = group.files.filter(file => file.status === 'unread');
             const processed = group.files.filter(file => file.status !== 'unread');
             const retrieved = unread.length
-                ? parseRetrievedAttachments(await this.client.getFiles(unread.map(file => file.wireId)), unread)
+                ? parseRetrievedAttachments(await this.client.callTool('get_files', {
+                    wire_ids: unread.map(file => file.wireId),
+                }), unread)
                 : [];
             for (const file of processed) {
                 if (!group.recovery)
                     throw new Error('unexpected processed attachment without recovery route');
-                const recoveryPath = await writeRecoveredAttachment(requestDir, file.wireId, await this.client.fetchFile(file.wireId));
+                const recoveryPath = join(requestDir, `.recovered-${file.wireId}-${randomUUID()}`);
+                await this.client.callTool('save_file', { wire_id: file.wireId, dest_path: recoveryPath });
                 retrieved.push(await recoveredAttachment(file, recoveryPath));
             }
             const order = new Map(group.files.map((file, index) => [file.wireId, index]));
@@ -1091,9 +1092,9 @@ export class OwnerChannel {
                 if (caption)
                     await this.send(contact, caption, replyTo);
                 for (const file of admitted) {
-                    await this.client.sendFile({
+                    await this.client.callTool('send_file', {
                         contact, path: file.path, filename: file.filename,
-                        ...(replyTo ? { replyToWireId: replyTo } : {}),
+                        ...(replyTo ? { reply_to_wire_id: replyTo } : {}),
                     });
                 }
             }
@@ -1130,11 +1131,11 @@ export class OwnerChannel {
             if (error instanceof RelayUnroutableError) {
                 this.options.log(`[${this.options.role}] managed-agent attachment has no owner route; `
                     + `transaction stays queued: ${this.errorText(error)}`);
-                await this.nackManagedAgent(agent, nackReplyTo, nackWire, ownerNotices.relayQueued());
+                await this.nackManagedAgent(agent, nackMessage, nackWire, ownerNotices.relayQueued());
                 return false;
             }
             this.logError('managed-agent caption/file relay refused', error);
-            await this.nackManagedAgent(agent, nackReplyTo, nackWire, ownerNotices.relayRefused(this.errorText(error)));
+            await this.nackManagedAgent(agent, nackMessage, nackWire, ownerNotices.relayRefused(this.errorText(error)));
             // Rejection/admission failure and uncertain transport are terminal and
             // visible. Consuming every correlated wire prevents a later partial replay.
             for (const wire of handledWireIds)
@@ -1173,14 +1174,14 @@ export class OwnerChannel {
      * to the authenticated agent, while its deferred replays stay quiet. NACK
      * delivery is best-effort — it must never make the failure worse.
      */
-    async nackManagedAgent(contact, replyTo, wireId, notice) {
+    async nackManagedAgent(contact, message, wireId, notice) {
         if (this.relayNacks.has(wireId))
             return;
         this.relayNacks.add(wireId);
         if (this.relayNacks.size > RELAY_NACK_MEMORY)
             this.relayNacks.delete(this.relayNacks.values().next().value);
         try {
-            await this.send(contact, notice, replyTo);
+            await this.send(contact, notice, message.wire_id ? wireId : undefined);
         }
         catch (error) {
             this.logError('managed-agent relay NACK delivery failed', error);
@@ -1241,6 +1242,32 @@ export class OwnerChannel {
     authorizationIntegrity() {
         return this.options.config.agent ? { ok: true } : this.authorizations.integrity();
     }
+    /**
+     * Report what the session actually did with the prompt, not what the config
+     * asked for. `interrupt: true` used to be reported as "your request
+     * interrupted the previous task" unconditionally; the session now answers
+     * whether anything was cancelled, whether the request is queued behind
+     * earlier prompts, or whether it is held until the current task reaches a
+     * safe stopping point. Backends that report no delivery state keep the old
+     * queuedBehind-based wording.
+     */
+    acceptanceNotice(queued) {
+        switch (queued.delivery) {
+            case 'interrupted': return ownerNotices.receivedInterrupting();
+            case 'deferred': return ownerNotices.receivedDeferred();
+            case 'queued': return ownerNotices.receivedQueued(Math.max(1, queued.queuedBehind));
+            case 'started': return ownerNotices.receivedStarted();
+            default:
+                // Interrupting the live turn does not remove prompts which were already
+                // accepted into the ACP queue. Never claim this request is running while
+                // the session itself says earlier work remains ahead of it.
+                return queued.queuedBehind > 0
+                    ? ownerNotices.receivedQueued(queued.queuedBehind)
+                    : this.options.config.interrupt
+                        ? ownerNotices.receivedInterrupting()
+                        : ownerNotices.receivedStarted();
+        }
+    }
     async complete(active, outbox, queued, activityCursor) {
         const progressMs = this.options.config.progress_interval_ms;
         let lastSeq = activityCursor;
@@ -1441,7 +1468,7 @@ export class OwnerChannel {
             throw new Error('commentary appears to contain secret, reasoning, or raw tool content');
         return message;
     }
-    ownerAttachmentPrompt(sender, wireId, requestId, outbox, files, caption) {
+    ownerAttachmentPrompt(sender, wireId, requestId, files, caption) {
         const lines = [
             '[fleet-owner]',
             `Authenticated owner ${safeField(sender.name, 160)} (${sender.id}) sent owner-channel attachment request ${wireId}.`,
@@ -1465,10 +1492,13 @@ export class OwnerChannel {
                     lines.push(`- voice transcript status: ${transcription?.status ?? 'unavailable'}`, `- voice transcript fallback: audio path above; category ${transcription?.errorCategory ?? 'not_provided'}`);
             }
         }
-        lines.push('Answer in your final assistant response; fleet routes it only to the authenticated sender and correlates it to the originating file wire.', `To attach response files, write regular files only to: ${outbox}`);
+        lines.push('Answer in your final assistant response; fleet routes it only to the authenticated sender and correlates it to the originating file wire.', 
+        // send_file is the only delivery route an agent is given: a tool call either
+        // delivers or reports an error, where a file written to disk does neither.
+        'To send the owner a file — now or later in this turn — call ours `send_file`:', `contact: ${this.options.config.identity}`, 'and the path of the finished file. Fleet routes it to the authenticated owner.', 'A file written anywhere else is not delivered and nothing will report that it was not.', 'Use descriptive unique filenames. Send nothing the owner did not request or should not receive.');
         return lines.join('\n');
     }
-    ownerPrompt(sender, text, wireId, outbox) {
+    ownerPrompt(sender, text, wireId) {
         return [
             '[fleet-owner]',
             `Authenticated owner ${sender.name} (${sender.id}) sent owner-channel message ${wireId}.`,
@@ -1482,10 +1512,13 @@ export class OwnerChannel {
             ] : [
                 'Managed-agent outbound relay is not configured; do not send intermediate or proactive owner-channel messages.',
             ]),
-            'To attach files to your response, copy each finished file directly into this fleet outbox:',
-            outbox,
-            'Fleet sends every regular file in that directory to the authenticated owner, correlated to this request.',
-            'Use descriptive unique filenames. Put nothing there that the owner did not request or should not receive.',
+            // send_file is the only delivery route an agent is given: a tool call either
+            // delivers or reports an error, where a file written to disk does neither.
+            'To send the owner a file — now or later in this turn — call ours `send_file`:',
+            `contact: ${this.options.config.identity}`,
+            'and the path of the finished file. Fleet routes it to the authenticated owner.',
+            'A file written anywhere else is not delivered and nothing will report that it was not.',
+            'Use descriptive unique filenames. Send nothing the owner did not request or should not receive.',
             '',
             text || '(empty message)',
         ].join('\n');
@@ -1498,8 +1531,8 @@ export class OwnerChannel {
         return createHash('sha256').update(wireId).digest('hex');
     }
     send(contact, text, replyTo) {
-        return this.client.sendMessage({
-            contact, text, ...(replyTo ? { replyToWireId: replyTo } : {}),
+        return this.client.callTool('send_message', {
+            contact, text, ...(replyTo ? { reply_to_wire_id: replyTo } : {}),
         });
     }
     async sendAttachments(contact, outbox, replyTo) {
@@ -1507,11 +1540,11 @@ export class OwnerChannel {
             .filter(entry => entry.isFile())
             .sort((a, b) => a.name.localeCompare(b.name));
         for (const entry of entries) {
-            await this.client.sendFile({
+            await this.client.callTool('send_file', {
                 contact,
                 path: join(outbox, entry.name),
                 filename: entry.name,
-                replyToWireId: replyTo,
+                reply_to_wire_id: replyTo,
             });
         }
         await rm(outbox, { recursive: true, force: true });
@@ -1534,11 +1567,11 @@ export class OwnerChannel {
         return Number.isInteger(message.msg_id) ? `msg:${message.msg_id}` : '';
     }
     sender(message) {
-        // Authenticated routing data, straight from the daemon's typed envelope.
-        // The id still goes through the CID checks in acceptedSender/isEffectiveOwner.
-        const source = message.from;
-        const id = String(source?.id ?? '');
-        return { id, name: String(source?.name ?? id) };
+        const source = message.from ?? message.sender;
+        if (typeof source === 'string')
+            return { id: source, name: source };
+        const id = String(source?.id ?? message.sender_id ?? '');
+        return { id, name: String(source?.name ?? message.sender_name ?? id) };
     }
     latestEventSeq(events) {
         return events.reduce((latest, event) => Math.max(latest, event.seq), 0);
@@ -1567,65 +1600,90 @@ export class OwnerChannel {
         return undefined;
     }
     async watchLoop() {
+        const endpoint = resolveEndpoint({ ...process.env, ...(this.options.env ?? {}) });
+        const fetch = this.options.watchFetch
+            ?? ((url, init) => globalThis.fetch(url, init));
         const sleep = this.options.binderDeps?.sleep
             ?? (ms => new Promise(resolve => setTimeout(resolve, ms)));
         const restored = this.readWatchState();
         let state = restored.state;
-        if (restored.recovered)
-            state = this.writeWatchState(state, 'OWNER_WATCH_STATE_RECOVERED');
+        // An unreadable cursor is the ONLY reason to restart at the tip. Say so on
+        // the next successful connect, and drain first: everything the lost cursor
+        // would have pointed at is still in the inbox, which is the authority.
+        let recovering = restored.recovered;
+        let cursor = state?.cursor ?? 'tip';
         let delayMs = 1_000;
-        let attempts = 0;
+        let authFailures = 0;
+        if (recovering)
+            await this.drain().catch(error => this.logError('cursor recovery drain failed', error));
         while (!this.stopping) {
             const ctrl = new AbortController();
             this.watchAbort = ctrl;
+            let stalled = false;
+            let authRejected = false;
+            const timer = setTimeout(() => { stalled = true; ctrl.abort(); }, this.options.watchStallMs ?? OWNER_WATCH_STALL_MS);
+            timer.unref?.();
             try {
-                // This drain is unconditional at EVERY establishment. Starting the SDK
-                // stream at 0 then replays notification hints instead of tip-priming,
-                // so mail arriving after the drain but before the first request cannot
-                // fall into a gap. The inbox is authoritative and its durable wire-ID
-                // dedupe makes replayed hints harmless.
-                await this.drain();
-                if (this.stopping)
-                    return;
-                state = this.writeWatchState(state, 'OWNER_WATCH_CONNECTING', { reconnected: attempts > 0 });
-                attempts++;
-                for await (const _event of this.client.watchNotifications(this.options.config.identity, { since: 0, signal: ctrl.signal })) {
-                    if (this.stopping)
+                const response = await fetch(`${endpoint.url(this.options.config.identity)}?since=${cursor}`, { headers: endpoint.headers, signal: ctrl.signal });
+                if (response.status === 401) {
+                    authRejected = true;
+                    authFailures++;
+                    const at = cursor === 'tip' ? state?.cursor ?? 0 : cursor;
+                    if (authFailures >= OWNER_WATCH_AUTH_FATAL_ATTEMPTS) {
+                        state = this.writeWatchState(state, at, 'OWNER_WATCH_AUTH_FATAL', true);
+                        this.options.log(`[${this.options.role}] owner watch stopped `
+                            + `reason=OWNER_WATCH_AUTH_FATAL after ${authFailures} consecutive HTTP 401 responses; `
+                            + 'owner notifications require re-authorization and will not be retried');
                         return;
-                    state = this.writeWatchState(state, 'OWNER_WATCH_CONNECTED', { resetFailures: true });
-                    delayMs = 1_000;
-                    // Notification events contain no bodies and are only wake hints.
-                    // Draining is idempotent at the turn boundary because wire IDs are
-                    // recorded before a managed request is dispatched.
-                    await this.drain();
+                    }
+                    state = this.writeWatchState(state, at, 'OWNER_WATCH_AUTH_FAILED', true);
+                    throw new Error('OWNER_WATCH_AUTH_FAILED: daemon rejected notification credentials');
                 }
-                if (!this.stopping)
-                    throw new Error('ours SDK notification stream ended');
+                if (!response.ok)
+                    throw new Error(`daemon returned HTTP ${response.status}`);
+                const body = await response.json();
+                const next = typeof body.cursor === 'number' ? body.cursor : cursor === 'tip' ? 0 : cursor;
+                const reconnect = (state?.consecutiveFailures ?? 0) > 0;
+                state = this.writeWatchState(state, next, recovering ? 'OWNER_WATCH_CURSOR_RECOVERED' : 'OWNER_WATCH_CONNECTED', false, reconnect);
+                recovering = false;
+                authFailures = 0;
+                cursor = next;
+                delayMs = 1_000;
+                // Notification events are content-free hints. The inbox remains the
+                // authority and its wire-level durable dedupe prevents duplicate turns.
+                if ((body.events?.length ?? 0) > 0)
+                    await this.drain();
             }
             catch (error) {
                 if (this.stopping)
                     return;
-                // SDK 2 deliberately hides transport status behind its typed stream.
-                // Do not parse error prose to rediscover it: every failure follows the
-                // same capped retry path forever, and the pre-establishment drain makes
-                // that retry correctness-preserving.
-                state = this.writeWatchState(state, 'OWNER_WATCH_STREAM_ERROR', { failed: true });
+                const reason = stalled
+                    ? 'OWNER_WATCH_STALLED' : 'OWNER_WATCH_STREAM_ERROR';
+                const current = cursor === 'tip' ? state?.cursor ?? 0 : cursor;
+                cursor = current;
+                // Only THIS iteration's auth rejection is already written. A stale
+                // AUTH_FAILED from an earlier attempt must never suppress the cursor,
+                // the failure counter, or a later STALLED transition.
+                if (!authRejected)
+                    state = this.writeWatchState(state, current, reason, true);
                 this.options.log(`[${this.options.role}] owner watch reconnect `
-                    + `reason=OWNER_WATCH_STREAM_ERROR delay_ms=${delayMs} `
-                    + `failures=${state.consecutiveFailures}: ${this.errorText(error)}`);
+                    + `reason=${authRejected ? 'OWNER_WATCH_AUTH_FAILED' : reason} `
+                    + `delay_ms=${delayMs} cursor=${current}`);
                 await sleep(delayMs);
                 delayMs = Math.min(delayMs * 2, OWNER_WATCH_BACKOFF_MAX_MS);
             }
             finally {
+                clearTimeout(timer);
                 if (this.watchAbort === ctrl)
                     this.watchAbort = undefined;
             }
         }
     }
     /**
-     * `recovered` distinguishes a first-ever start from unreadable persisted
-     * diagnostics. Notification correctness does not depend on this state: every
-     * establishment drains and then replays SDK hints from offset zero.
+     * `recovered` distinguishes a first-ever start (no state, nothing lost) from a
+     * cursor we HAD and can no longer read. Only the latter is a recovery, and the
+     * caller needs to know because the reason it reports is the only evidence a
+     * durable cursor was ever lost.
      */
     readWatchState() {
         const path = join(this.options.stateDir, '.owner-channel-watch.json');
@@ -1633,43 +1691,76 @@ export class OwnerChannel {
             return { recovered: false };
         try {
             const value = JSON.parse(readFileSync(path, 'utf8'));
-            if ((value.version !== 1 && value.version !== 2)
+            if (value.version !== 1 || !Number.isSafeInteger(value.cursor) || value.cursor < 0
                 || !Number.isSafeInteger(value.reconnects) || value.reconnects < 0
                 || !Number.isSafeInteger(value.consecutiveFailures) || value.consecutiveFailures < 0)
                 throw new Error('invalid owner watch state');
-            const reasons = new Set([
-                'OWNER_WATCH_CONNECTING', 'OWNER_WATCH_CONNECTED',
-                'OWNER_WATCH_STREAM_ERROR', 'OWNER_WATCH_STATE_RECOVERED',
-            ]);
-            return { state: {
-                    version: 2,
-                    reconnects: value.reconnects,
-                    consecutiveFailures: value.consecutiveFailures,
-                    reason: reasons.has(value.reason)
-                        ? value.reason : 'OWNER_WATCH_CONNECTING',
-                    updatedAt: typeof value.updatedAt === 'string'
-                        ? value.updatedAt : new Date(this.options.binderDeps?.now?.() ?? Date.now()).toISOString(),
-                }, recovered: false };
+            return { state: value, recovered: false };
         }
         catch {
             this.options.log(`[${this.options.role}] owner watch `
-                + 'reason=OWNER_WATCH_STATE_RECOVERED invalid persisted counters; restarting safely');
+                + 'reason=OWNER_WATCH_CURSOR_RECOVERED invalid cursor state; draining inbox and starting at tip');
             return { recovered: true };
         }
     }
-    writeWatchState(previous, reason, options = {}) {
+    writeWatchState(previous, cursor, reason, failed, reconnected = false) {
         const state = {
-            version: 2,
-            reconnects: (previous?.reconnects ?? 0) + (options.reconnected ? 1 : 0),
-            consecutiveFailures: options.failed
-                ? (previous?.consecutiveFailures ?? 0) + 1
-                : options.resetFailures ? 0 : previous?.consecutiveFailures ?? 0,
+            version: 1,
+            cursor,
+            reconnects: (previous?.reconnects ?? 0) + (reconnected ? 1 : 0),
+            consecutiveFailures: failed ? (previous?.consecutiveFailures ?? 0) + 1 : 0,
             reason,
             updatedAt: new Date(this.options.binderDeps?.now?.() ?? Date.now()).toISOString(),
         };
         replaceFileAtomically(join(this.options.stateDir, '.owner-channel-watch.json'), `${JSON.stringify(state)}\n`, 0o600);
         return state;
     }
+    /** Compatibility path for injected child-process tests; production is direct. */
+    async legacyWatchLoop() {
+        let delayMs = 1_000;
+        while (!this.stopping) {
+            try {
+                const child = this.options.watch?.(this.options.config.identity) ?? spawn(this.options.command ?? 'ours-mcp', ['watch', this.options.config.identity], {
+                    env: { ...process.env, ...(this.options.env ?? {}) }, stdio: ['pipe', 'pipe', 'pipe'],
+                });
+                this.watchProcess = child;
+                await new Promise((resolve, reject) => {
+                    if (child.pid) {
+                        resolve();
+                        return;
+                    }
+                    child.once('spawn', resolve);
+                    child.once('error', reject);
+                });
+                createInterface({ input: child.stderr }).on('line', line => this.options.log(`[${this.options.role}] owner watch: ${line}`));
+                delayMs = 1_000;
+                // Drain at every (re)attachment, not only after a future notification:
+                // a failed send/turn leaves the input deferred and may not emit another
+                // watch line by itself.
+                await this.drain();
+                for await (const _line of createInterface({ input: child.stdout })) {
+                    if (this.stopping)
+                        break;
+                    await this.drain();
+                }
+                if (!this.stopping)
+                    throw new Error('watch exited');
+            }
+            catch (error) {
+                if (!this.stopping) {
+                    this.logError('watch failed; retrying', error);
+                    await new Promise(resolve => setTimeout(resolve, delayMs));
+                    delayMs = Math.min(delayMs * 2, 30_000);
+                }
+            }
+            finally {
+                const child = this.watchProcess;
+                this.watchProcess = undefined;
+                if (child && child.exitCode === null)
+                    child.kill('SIGTERM');
+            }
+        }
+    }
     errorText(error) {
         return error?.message ?? String(error);
     }