@ours.network/fleet 0.18.0-nightly.6 → 0.18.0

package/dist/owner-channel/channel.js

@@ -1,19 +1,21 @@
-import { createHash } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { mkdir, readFile, readdir, rm } from 'node:fs/promises';
+import { createInterface } from 'node:readline';
 import { join } from 'node:path';
 import { DEFAULT_OWNER_ATTACHMENT_MIME, canonicalCid, } from '../config.js';
 import { replaceFileAtomically } from '../atomic-file.js';
+import { resolveEndpoint } from '../monitor.js';
 import { ACP_CANCEL_DEADLINE_EXCEEDED, SessionControlError, interruptOutcome, } from '../session/types.js';
 import { VERSION } from '../version.js';
 import { dispatchOwnerCommand, fleetCliOps, isOwnerCommandText, } from './commands.js';
-import { OURS_BOUND_ELSEWHERE, OursSdkClient, oursErrorCode, } from './ours-client.js';
+import { OursMcpClient } from './mcp.js';
 import { ownerNotices, } from './notices.js';
 import { DuplicateSendError, OwnerAuthorizationState, OwnerChannelState, OwnerConversationState, } from './state.js';
 import { OwnerTaskState, ownerTaskAuditId, ownerTaskDigest, } from './tasks.js';
-import { AttachmentRecoveryState, admitAttachments, cleanupAttachmentRoot, parseIncomingAttachments, parseRetrievedAttachments, prepareAttachmentDirectory, recoveredAttachment, removeRequestDirectory, safeField, validateAttachmentSelection, validateAttachmentRelaySelection, writeRecoveredAttachment, } from './attachments.js';
+import { AttachmentRecoveryState, admitAttachments, cleanupAttachmentRoot, parseIncomingAttachments, parseRetrievedAttachments, prepareAttachmentDirectory, recoveredAttachment, removeRequestDirectory, safeField, validateAttachmentSelection, validateAttachmentRelaySelection, } from './attachments.js';
 import { acquireOwnerBinderLease, OWNER_BIND_HANDOFF_TIMEOUT_MS, } from './binder.js';
-import { MessageRecoveryState } from './message-recovery.js';
 const OWNER_UPDATE_MIN_INTERVAL_MS = 5_000;
 const OWNER_UPDATE_MAX_COUNT = 20;
 const OWNER_UPDATE_MAX_CHARS = 280;
@@ -26,8 +28,15 @@ const COMMENTARY_MAX_CHARS = 1_600;
 const COMMENTARY_MAX_BYTES = 6_400;
 const COMMENTARY_MAX_UPDATES = 32;
 const COMMENTARY_DEDUPE_LIMIT = 512;
+const OWNER_WATCH_STALL_MS = 120_000;
 const OWNER_WATCH_BACKOFF_MAX_MS = 30_000;
-const OWNER_MESSAGE_BATCH_LIMIT = 200;
+/**
+ * Credentials that are wrong now are wrong on the next attempt too. Retrying a
+ * permanent 401 forever burns the daemon and hides the real fault behind an
+ * endless reconnect log, so the watch stops after this many consecutive auth
+ * rejections and records a terminal reason instead.
+ */
+const OWNER_WATCH_AUTH_FATAL_ATTEMPTS = 5;
 /** A relay attempt that failed only because no owner route exists yet. */
 class RelayUnroutableError extends Error {
 }
@@ -42,7 +51,6 @@ export class OwnerChannel {
     authorizations;
     conversations;
     tasks;
-    messageRecovery;
     attachmentRecovery;
     attachmentConfig;
     attachmentRoot;
@@ -51,7 +59,7 @@ export class OwnerChannel {
      * (a crash must replay them) but must not be queued twice while live.
      */
     inFlight = new Set();
-    /** Wires already NACKed to the managed agent, so a history replay stays quiet. */
+    /** Wires already NACKed to the managed agent, so a deferred replay stays quiet. */
     relayNacks = new Set();
     /**
      * fleet.yaml declares the restart baseline; `/comments on|off` changes only
@@ -62,6 +70,7 @@ export class OwnerChannel {
     commentsBaseline;
     commentsEnabled;
     stopping = false;
+    watchProcess;
     watchTask;
     watchAbort;
     drainTask;
@@ -75,13 +84,12 @@ export class OwnerChannel {
     fleetOps;
     constructor(options) {
         this.options = options;
-        this.client = options.client ?? new OursSdkClient(options.env, line => options.log(`[${options.role}] owner channel ${line}`));
+        this.client = options.client ?? new OursMcpClient(options.command, options.env, line => options.log(`[${options.role}] owner channel ${line}`));
         this.fleetOps = options.fleet ?? fleetCliOps(options.role, options.configPath);
         this.state = new OwnerChannelState(join(options.stateDir, '.owner-channel-state.json'));
         this.authorizations = new OwnerAuthorizationState(join(options.stateDir, '.owner-channel-owners.json'), options.config.owners);
         this.conversations = new OwnerConversationState(join(options.stateDir, '.owner-channel-conversations.json'));
         this.tasks = new OwnerTaskState(join(options.stateDir, '.owner-channel-tasks.json'));
-        this.messageRecovery = new MessageRecoveryState(join(options.stateDir, '.owner-channel-message-recovery.json'));
         this.attachmentRecovery = new AttachmentRecoveryState(join(options.stateDir, '.owner-channel-attachment-recovery.json'));
         this.attachmentRoot = join(options.stateDir, '.owner-channel-inbox');
         // An absent key is a pre-`comments` configuration, which relayed live
@@ -100,8 +108,6 @@ export class OwnerChannel {
             options.log(`[${options.role}] owner conversation state corrupt; proactive messages disabled`);
         if (!this.tasks.integrity().ok)
             options.log(`[${options.role}] owner task state corrupt; proactive reports disabled`);
-        if (!this.messageRecovery.integrity())
-            options.log(`[${options.role}] owner message recovery state corrupt; message intake disabled`);
         if (!this.attachmentRecovery.integrity())
             options.log(`[${options.role}] owner attachment recovery state corrupt; attachments disabled`);
     }
@@ -117,16 +123,12 @@ export class OwnerChannel {
             const bindStartedAt = now();
             for (;;) {
                 try {
-                    await this.client.bindIdentity(this.options.config.identity);
+                    await this.client.callTool('choose_identity', { name: this.options.config.identity });
                     break;
                 }
                 catch (error) {
-                    // The predecessor's lease may still be in flight. Only the daemon's
-                    // own typed verdict may extend the handoff window: matching the
-                    // wording of an error message would let any other failure whose text
-                    // happens to say "bound to another live session" — including one
-                    // relayed from a peer — spin here for the whole timeout.
-                    const liveConflict = oursErrorCode(error) === OURS_BOUND_ELSEWHERE;
+                    const message = error?.message ?? String(error);
+                    const liveConflict = /currently bound to another live session/i.test(message);
                     if (!this.binder.inherited || !liveConflict
                         || now() - bindStartedAt >= OWNER_BIND_HANDOFF_TIMEOUT_MS)
                         throw error;
@@ -148,10 +150,9 @@ export class OwnerChannel {
             void cleanupAttachmentRoot(this.attachmentRoot, Date.now(), this.attachmentConfig.retention_ms).catch(error => this.logError('attachment crash cleanup failed', error));
         }
         this.ready = true;
+        this.watchTask = this.options.watch ? this.legacyWatchLoop() : this.watchLoop();
         // Do not make role startup wait for an old owner request to finish a turn.
-        // watchLoop itself drains before every establishment, including this first
-        // one, so there is no drain-to-tip race.
-        this.watchTask = this.watchLoop();
+        void this.drain().catch(error => this.logError('initial drain failed', error));
     }
     drain() {
         this.drainRequested = true;
@@ -168,8 +169,13 @@ export class OwnerChannel {
     async close() {
         this.stopping = true;
         this.ready = false;
+        const watch = this.watchProcess;
+        this.watchProcess = undefined;
+        if (watch && watch.exitCode === null)
+            watch.kill('SIGTERM');
         this.watchAbort?.abort();
-        await this.watchTask?.catch(error => this.logError('watch shutdown failed', error));
+        if (!this.options.watch)
+            await this.watchTask?.catch(error => this.logError('watch shutdown failed', error));
         this.watchTask = undefined;
         await this.managementTail;
         try {
@@ -195,10 +201,13 @@ export class OwnerChannel {
                 ? ' with interruption'
                 : event.monitor.interrupt === 'after_tool' ? ' with after-tool steering' : '';
             const monitor = `${event.monitor.mode} monitor${monitorPolicy}`;
+            const permission = event.permissionMode
+                ? `; permission ${event.permissionMode.fleetMode}, native ${event.permissionMode.nativeMode}`
+                : '';
             const inherited = event.inherited.length
                 ? ` Supervisor inherited omitted defaults: ${event.inherited.join(', ')}.` : '';
             await this.sendProactiveMessage(`🧑‍💻 ${event.caller} spawned ${event.lifetime} agent ${event.role} `
-                + `(${event.harness}/${event.session}${model}; ${monitor}).${inherited}`, `fleet-spawn\0${event.creationActionId}`, 0);
+                + `(${event.harness}/${event.session}${model}; ${monitor}${permission}).${inherited}`, `fleet-spawn\0${event.creationActionId}`, 0);
         });
         this.managementTail = run.then(() => undefined, () => undefined);
         return run;
@@ -211,14 +220,11 @@ export class OwnerChannel {
                 return { action: request.action, contacts: await this.contacts() };
             case 'contact_invite': {
                 this.assertLabel(request.name);
-                // The invite is the blob field, not a sentence containing it. The MCP
-                // surface answered with "One-time invite for X created (invite_id …).
-                // Share this blob out-of-band …:\n<blob>" and the whole sentence was
-                // handed out as the invite, so any rewording changed the payload.
-                const { blob } = await this.client.generateInvite(request.name);
-                if (typeof blob !== 'string' || !blob)
-                    throw new Error('the ours daemon returned no invite blob');
-                return { action: request.action, invite: blob };
+                const raw = await this.client.callTool('generate_invite', request.name ? { name: request.name } : {});
+                const invite = typeof raw === 'string' ? raw : String(raw?.invite ?? '');
+                if (!invite)
+                    throw new Error('ours-mcp returned no invite');
+                return { action: request.action, invite };
             }
             case 'contact_add': {
                 if (typeof request.invite !== 'string' || !request.invite)
@@ -226,19 +232,18 @@ export class OwnerChannel {
                 if (Buffer.byteLength(request.invite) > 48 * 1024)
                     throw new Error('invite exceeds 49152 bytes');
                 this.assertLabel(request.name);
-                let added;
+                let raw;
                 try {
-                    added = await this.client.addContact({
+                    raw = await this.client.callTool('add_contact', {
                         invite: request.invite, ...(request.name ? { name: request.name } : {}),
                     });
                 }
                 catch {
                     // Daemon errors are not allowed to reflect invite material through
                     // the control response, CLI stderr, or supervisor logs.
-                    throw new Error('the ours daemon could not accept the contact invite');
+                    throw new Error('ours-mcp could not accept the contact invite');
                 }
-                const contact = this.contact(added.cid, added.display, 'pending');
-                return { action: request.action, status: 'pending', ...(contact ? { contact } : {}) };
+                return { action: request.action, status: 'pending', contact: this.contact(raw) };
             }
             case 'owner_list':
                 return {
@@ -312,36 +317,33 @@ export class OwnerChannel {
                 throw new Error('unknown owner-channel management action');
         }
     }
-    /**
-     * The daemon reports established contacts and pending introductions as two
-     * separate collections, so the status is structural rather than a word parsed
-     * out of a rendered line. Nothing here can be spoofed by a contact's own
-     * display name.
-     */
     async contacts() {
-        const view = await this.client.listContacts();
-        const rows = [
-            ...(Array.isArray(view?.contacts) ? view.contacts : [])
-                .map(row => this.contact(row?.container_id, row?.name, 'established', view)),
-            ...(Array.isArray(view?.pending) ? view.pending : [])
-                .map(row => this.contact(row?.container_id, row?.name, 'pending', view)),
-        ];
-        return rows.filter((row) => Boolean(row))
+        const raw = await this.client.callTool('list_contacts');
+        const values = Array.isArray(raw) ? raw : raw?.contacts;
+        if (!Array.isArray(values))
+            return [];
+        return values.map(value => this.contact(value)).filter((v) => Boolean(v))
             .sort((a, b) => a.cid.localeCompare(b.cid));
     }
-    contact(cidValue, nameValue, status, view) {
-        const cid = String(cidValue ?? '');
+    contact(raw) {
+        if (!raw || typeof raw !== 'object')
+            return undefined;
+        const value = raw;
+        const cid = String(value.cid ?? value.id ?? value.container_id ?? value.containerId ?? '');
         if (!/^[A-Fa-f0-9]{64}$/.test(cid))
             return undefined;
-        const root = view?.roots?.[cid];
-        const rootCid = String(root?.root_cid ?? '');
+        const humanRaw = value.human ?? value.root;
+        const human = humanRaw && typeof humanRaw === 'object' ? humanRaw : undefined;
         return {
             cid,
-            name: this.safeMetadata(nameValue ?? cid),
-            status,
-            ...(root ? { human: {
-                    ...(/^[A-Fa-f0-9]{64}$/.test(rootCid) ? { cid: rootCid } : {}),
-                    ...(root.root_name ? { name: this.safeMetadata(root.root_name) } : {}),
+            name: this.safeMetadata(value.name ?? value.display_name ?? cid),
+            status: this.safeMetadata(value.status ?? 'established'),
+            ...(typeof value.kind === 'string' ? { kind: this.safeMetadata(value.kind) } : {}),
+            ...(human ? { human: {
+                    ...(typeof (human.cid ?? human.id) === 'string'
+                        && /^[A-Fa-f0-9]{64}$/.test(String(human.cid ?? human.id))
+                        ? { cid: String(human.cid ?? human.id) } : {}),
+                    ...(human.name ? { name: this.safeMetadata(human.name) } : {}),
                 } } : {}),
         };
     }
@@ -523,145 +525,60 @@ export class OwnerChannel {
         return message;
     }
     async drainAll() {
-        // A finite cap protects the supervisor if a broken daemon never advances
-        // its oldest-first unread batch. A watch hint will resume draining later.
+        // A finite cap protects the supervisor if a broken daemon repeats unread
+        // messages forever. A watch notification will resume draining later.
         for (let pass = 0; pass < 100 && !this.stopping; pass++) {
-            const [claimed, fileResult] = await Promise.all([
-                this.claimMessages(),
-                this.client.listIncomingFiles()
+            const [raw, fileResult] = await Promise.all([
+                this.client.callTool('get_messages'),
+                this.client.callTool('list_incoming_files')
                     .catch(error => {
                     this.logError('attachment metadata inspection unavailable', error);
                     return undefined;
                 }),
             ]);
+            const messages = Array.isArray(raw?.messages)
+                ? raw.messages.filter(message => message && typeof message === 'object')
+                : [];
+            let files = [];
+            try {
+                files = parseIncomingAttachments(fileResult);
+            }
+            catch (error) {
+                this.logError('attachment metadata inspection unavailable', error);
+            }
             const pending = this.attachmentRecovery.integrity() ? this.attachmentRecovery.list() : [];
-            let files = await this.attachmentMetadata(fileResult, pending);
             const pendingWires = new Set(pending.flatMap(item => item.fileWireIds));
             files = files.filter(file => (file.status === 'unread' || pendingWires.has(file.wireId))
                 && !this.state.has(file.wireId));
-            if (!claimed.messages.length && !files.length && claimed.remaining === 0)
+            if (!messages.length && !files.length)
                 return;
+            // get_messages marks the batch processed. Requeue allowed, unhandled
+            // inputs before executing them so a mid-turn process crash can replay.
+            const deferred = messages.filter(message => {
+                const wireId = this.wireId(message);
+                return wireId && !this.state.has(wireId)
+                    && this.acceptedSender(this.sender(message).id)
+                    && Number.isInteger(message.msg_id);
+            }).map(message => message.msg_id);
+            if (deferred.length)
+                await this.client.callTool('defer_messages', { msg_ids: deferred });
             let advanced = false;
             const consumedMessages = new Set();
-            const groups = this.attachmentGroups(files, claimed.messages, pending, consumedMessages);
+            const groups = this.attachmentGroups(files, messages, pending, consumedMessages);
             for (const group of groups)
                 advanced = await this.handleAttachmentGroup(group) || advanced;
-            for (const message of claimed.messages) {
+            for (const message of messages) {
                 if (!consumedMessages.has(message))
                     advanced = await this.handle(message) || advanced;
             }
-            this.messageRecovery.pruneHandled(wireId => this.state.has(wireId));
-            // Journaled in-flight messages remain history-recoverable until their
-            // correlated response is delivered. Do not spin on those copies once the
-            // unread SQLite queue itself is empty; completion triggers another drain.
-            if (!advanced && claimed.remaining === 0)
+            // Deferred in-flight messages are intentionally visible again until
+            // their correlated response is delivered. Do not spin on those replay
+            // copies; a new watch event or completion-triggered drain will resume.
+            if (!advanced)
                 return;
         }
         this.options.log(`[${this.options.role}] owner channel drain capped at 100 batches`);
     }
-    /**
-     * Claim the exact oldest unread SQLite batch before marking it read.
-     * The journal contains only wire IDs and sequence numbers; bodies remain in
-     * the daemon's persistent history and are recovered with getHistoryItem.
-     */
-    async claimMessages() {
-        if (!this.messageRecovery.integrity())
-            throw new Error('message recovery state is corrupt; refusing owner message intake');
-        this.messageRecovery.pruneHandled(wireId => this.state.has(wireId));
-        const recovered = [];
-        for (const claim of this.messageRecovery.list()) {
-            const item = await this.client.getHistoryItem(claim.wireId);
-            if (!item)
-                throw new Error(`journaled owner message ${claim.wireId} is missing from persistent history`);
-            recovered.push(this.historyMessage(item, claim));
-        }
-        const listed = await this.client.listIncomingMessages();
-        if (!Array.isArray(listed))
-            throw new Error('the ours daemon returned invalid unread message metadata');
-        const preflight = listed.slice(0, OWNER_MESSAGE_BATCH_LIMIT);
-        const now = Date.now();
-        const claims = preflight.map(item => this.messageClaim(item, now));
-        const claimKeys = new Set(claims.map(item => `${item.seq}\0${item.wireId}`));
-        if (claimKeys.size !== claims.length)
-            throw new Error('the ours daemon returned duplicate unread message metadata');
-        this.messageRecovery.claim(claims);
-        let fresh = [];
-        let remaining = 0;
-        // SDK batchLimit rejects zero. An empty preflight is a read-only drain.
-        if (claims.length) {
-            const payload = await this.client.getMessages(claims.length);
-            if (!payload || !Array.isArray(payload.messages)
-                || !Number.isSafeInteger(payload.remaining) || payload.remaining < 0)
-                throw new Error('the ours daemon returned an invalid claimed message batch');
-            fresh = payload.messages.map(message => this.historyMessage(message));
-            remaining = payload.remaining;
-            const expected = claimKeys;
-            const actual = new Set(fresh.map(item => `${item.seq}\0${item.wire_id}`));
-            if (fresh.length !== claims.length || actual.size !== fresh.length
-                || actual.size !== expected.size
-                || [...expected].some(item => !actual.has(item)))
-                throw new Error('the ours daemon claimed a different message batch than fleet journaled');
-        }
-        const merged = new Map();
-        for (const message of [...recovered, ...fresh]) {
-            const wireId = this.wireId(message);
-            const previous = merged.get(wireId);
-            if (previous && previous.seq !== message.seq)
-                throw new Error('persistent message history changed sequence during recovery');
-            merged.set(wireId, message);
-        }
-        return {
-            messages: [...merged.values()].sort((a, b) => a.seq - b.seq),
-            remaining,
-        };
-    }
-    messageClaim(message, claimedAt) {
-        const value = message;
-        const wireId = String(value.wire_id ?? '').trim();
-        const seq = Number(value.seq);
-        if (!wireId || !Number.isSafeInteger(seq) || seq < 1
-            || value.status !== 'unread' || value.inbox_state !== 'unread')
-            throw new Error('the ours daemon returned malformed unread message metadata');
-        return { wireId, seq, claimedAt };
-    }
-    historyMessage(message, claim) {
-        const value = message;
-        const wireId = String(value.wire_id ?? '').trim();
-        const seq = Number(value.seq);
-        const direction = String(value.direction ?? '');
-        if (!wireId || !Number.isSafeInteger(seq) || seq < 1 || direction !== 'in'
-            || (claim && (claim.wireId !== wireId || claim.seq !== seq)))
-            throw new Error('persistent owner message metadata mismatched its recovery claim');
-        return message;
-    }
-    async attachmentMetadata(unread, pending) {
-        const raw = Array.isArray(unread) ? [...unread] : [];
-        const present = new Set(raw.map(file => String(file.wire_id ?? '')));
-        for (const recovery of pending) {
-            for (const wireId of recovery.fileWireIds) {
-                if (present.has(wireId))
-                    continue;
-                const item = await this.client.getFileInfo(wireId);
-                if (!item)
-                    throw new Error(`journaled owner file ${wireId} is missing from persistent history`);
-                if (item.wire_id !== wireId || item.direction !== 'in'
-                    || item.inbox_state !== 'read' || item.status !== 'read')
-                    throw new Error(`journaled owner file ${wireId} mismatched persistent history`);
-                raw.push(item);
-                present.add(wireId);
-            }
-        }
-        const files = parseIncomingAttachments(raw);
-        const byWire = new Map(files.map(file => [file.wireId, file]));
-        for (const recovery of pending) {
-            for (const wireId of recovery.fileWireIds) {
-                const file = byWire.get(wireId);
-                if (!file || file.senderId !== recovery.contact)
-                    throw new Error(`journaled owner file ${wireId} failed recovery provenance validation`);
-            }
-        }
-        return files;
-    }
     attachmentGroups(files, messages, pending, consumed) {
         const groups = [];
         const used = new Set();
@@ -686,9 +603,9 @@ export class OwnerChannel {
                 ? undefined : messageByWire.get(recovery.originWireId);
             if (caption && this.sender(caption).id !== recovery.contact)
                 continue;
-            // A managed-agent caption is claimed before its inbox row becomes read.
-            // If recovery sees a read file before that body is recovered from history,
-            // keep the file reserved by the journal until both halves are present.
+            // A managed-agent caption is deferred before retrieval. If recovery sees
+            // the processed file before that body is replayed, keep the file reserved
+            // by the journal until both halves are present again.
             if (!caption && !recovery.fileWireIds.includes(recovery.originWireId))
                 continue;
             if (caption)
@@ -773,14 +690,17 @@ export class OwnerChannel {
                 this.attachmentRecovery.add(recovery);
             requestDir = await prepareAttachmentDirectory(this.attachmentRoot, requestId);
             const unread = group.files.filter(file => file.status === 'unread');
-            const historyRecovered = group.files.filter(file => file.status !== 'unread');
+            const processed = group.files.filter(file => file.status !== 'unread');
             const retrieved = unread.length
-                ? parseRetrievedAttachments(await this.client.getFiles(unread.map(file => file.wireId)), unread)
+                ? parseRetrievedAttachments(await this.client.callTool('get_files', {
+                    wire_ids: unread.map(file => file.wireId),
+                }), unread)
                 : [];
-            for (const file of historyRecovered) {
+            for (const file of processed) {
                 if (!group.recovery)
-                    throw new Error('unexpected read attachment without recovery route');
-                const recoveryPath = await writeRecoveredAttachment(requestDir, file.wireId, await this.client.fetchFile(file.wireId));
+                    throw new Error('unexpected processed attachment without recovery route');
+                const recoveryPath = join(requestDir, `.recovered-${file.wireId}-${randomUUID()}`);
+                await this.client.callTool('save_file', { wire_id: file.wireId, dest_path: recoveryPath });
                 retrieved.push(await recoveredAttachment(file, recoveryPath));
             }
             const order = new Map(group.files.map((file, index) => [file.wireId, index]));
@@ -789,17 +709,13 @@ export class OwnerChannel {
             outbox = this.outboxDir(originWireId);
             await mkdir(outbox, { recursive: true, mode: 0o700 });
             const activityCursor = this.latestEventSeq(this.options.session.eventsSince(0));
-            const queued = await this.options.session.queuePrompt(this.ownerAttachmentPrompt(sender, originWireId, requestId, outbox, admitted, group.caption), {
+            const queued = await this.options.session.queuePrompt(this.ownerAttachmentPrompt(sender, originWireId, requestId, admitted, group.caption), {
                 interrupt: this.options.config.interrupt,
                 ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
                 origin: { kind: 'owner', requestId,
                     ...(group.caption ? { displayText: String(group.caption.text ?? '') } : {}) },
             });
-            const accepted = this.options.config.interrupt
-                ? ownerNotices.receivedInterrupting()
-                : queued.queuedBehind > 0
-                    ? ownerNotices.receivedQueued(queued.queuedBehind)
-                    : ownerNotices.receivedStarted();
+            const accepted = this.acceptanceNotice(queued);
             handledWireIds.forEach(wire => this.inFlight.add(wire));
             const receipt = this.send(sender.id, accepted, originWireId).then(() => undefined).catch(error => {
                 this.logError(`attachment request ${requestId.slice(0, 12)} acceptance notice failed`, error);
@@ -872,17 +788,17 @@ export class OwnerChannel {
                     this.options.log(`[${this.options.role}] managed-agent relay replay of a delivered wire consumed`);
                 }
                 else if (error instanceof RelayUnroutableError) {
-                    // No owner route exists yet. Leave the wire journaled and unconsumed
-                    // so persistent history replays it after the first owner contact, and
-                    // tell the authenticated agent once so the wait is never silent.
+                    // No owner route exists yet. Leave the wire deferred and unconsumed
+                    // so the daemon replays it after the first owner contact, and tell
+                    // the authenticated agent once so the wait is never silent.
                     this.options.log(`[${this.options.role}] owner channel managed-agent relay has no owner `
                         + `route yet; message stays queued: ${this.errorText(error)}`);
-                    await this.nackManagedAgent(sender.id, message.wire_id ? wireId : undefined, wireId, ownerNotices.relayQueued());
+                    await this.nackManagedAgent(sender.id, message, wireId, ownerNotices.relayQueued());
                     return false;
                 }
                 else {
                     this.logError('managed-agent message relay refused', error);
-                    await this.nackManagedAgent(sender.id, message.wire_id ? wireId : undefined, wireId, ownerNotices.relayRefused(this.errorText(error)));
+                    await this.nackManagedAgent(sender.id, message, wireId, ownerNotices.relayRefused(this.errorText(error)));
                 }
             }
             this.state.remember(wireId);
@@ -918,7 +834,7 @@ export class OwnerChannel {
         let queued;
         const activityCursor = this.latestEventSeq(this.options.session.eventsSince(0));
         try {
-            queued = await this.options.session.queuePrompt(this.ownerPrompt(sender, text, wireId, outbox), {
+            queued = await this.options.session.queuePrompt(this.ownerPrompt(sender, text, wireId), {
                 interrupt: this.options.config.interrupt,
                 ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
                 origin: { kind: 'owner', requestId, displayText: text },
@@ -928,9 +844,9 @@ export class OwnerChannel {
             await rm(outbox, { recursive: true, force: true });
             if (error instanceof SessionControlError
                 && error.reasonCode === ACP_CANCEL_DEADLINE_EXCEEDED) {
-                // drainAll journaled this authenticated message before delivery. The
+                // drainAll deferred this authenticated message before delivery. The
                 // adapter generation is terminating, so leave the wire unhandled and
-                // body-free: the resumed owner channel recovers it exactly once.
+                // body-free: the resumed owner channel will replay it exactly once.
                 this.options.log(`[${this.options.role}] owner request ${requestId.slice(0, 12)} `
                     + `held for adapter resume reason=${ACP_CANCEL_DEADLINE_EXCEEDED}`);
                 return false;
@@ -940,14 +856,7 @@ export class OwnerChannel {
             this.state.remember(wireId);
             return true;
         }
-        // Interrupting the live turn does not remove prompts which were already
-        // accepted into the ACP queue. Never claim this request is running while
-        // the session itself says earlier work remains ahead of it.
-        const accepted = queued.queuedBehind > 0
-            ? ownerNotices.receivedQueued(queued.queuedBehind)
-            : this.options.config.interrupt
-                ? ownerNotices.receivedInterrupting()
-                : ownerNotices.receivedStarted();
+        const accepted = this.acceptanceNotice(queued);
         this.inFlight.add(wireId);
         const receipt = this.send(sender.id, accepted, wireId).then(() => undefined).catch(error => {
             this.logError(`request ${requestId.slice(0, 12)} acceptance notice failed`, error);
@@ -1127,9 +1036,7 @@ export class OwnerChannel {
     async handleManagedAgentAttachmentGroup(group, handledWireIds, agent) {
         const captionWire = group.caption ? this.wireId(group.caption) : undefined;
         const nackWire = captionWire ?? group.files[0].wireId;
-        // A caption whose own wire id is synthetic (msg_id only) must not be echoed
-        // back as a reply reference; a file wire always is a real one.
-        const nackReplyTo = (group.caption ? group.caption.wire_id : nackWire) ? nackWire : undefined;
+        const nackMessage = group.caption ?? { wire_id: nackWire };
         let requestDir;
         let recovery;
         try {
@@ -1163,14 +1070,17 @@ export class OwnerChannel {
                 this.attachmentRecovery.add(recovery);
             requestDir = await prepareAttachmentDirectory(this.attachmentRoot, transactionId);
             const unread = group.files.filter(file => file.status === 'unread');
-            const historyRecovered = group.files.filter(file => file.status !== 'unread');
+            const processed = group.files.filter(file => file.status !== 'unread');
             const retrieved = unread.length
-                ? parseRetrievedAttachments(await this.client.getFiles(unread.map(file => file.wireId)), unread)
+                ? parseRetrievedAttachments(await this.client.callTool('get_files', {
+                    wire_ids: unread.map(file => file.wireId),
+                }), unread)
                 : [];
-            for (const file of historyRecovered) {
+            for (const file of processed) {
                 if (!group.recovery)
-                    throw new Error('unexpected read attachment without recovery route');
-                const recoveryPath = await writeRecoveredAttachment(requestDir, file.wireId, await this.client.fetchFile(file.wireId));
+                    throw new Error('unexpected processed attachment without recovery route');
+                const recoveryPath = join(requestDir, `.recovered-${file.wireId}-${randomUUID()}`);
+                await this.client.callTool('save_file', { wire_id: file.wireId, dest_path: recoveryPath });
                 retrieved.push(await recoveredAttachment(file, recoveryPath));
             }
             const order = new Map(group.files.map((file, index) => [file.wireId, index]));
@@ -1182,9 +1092,9 @@ export class OwnerChannel {
                 if (caption)
                     await this.send(contact, caption, replyTo);
                 for (const file of admitted) {
-                    await this.client.sendFile({
+                    await this.client.callTool('send_file', {
                         contact, path: file.path, filename: file.filename,
-                        ...(replyTo ? { replyToWireId: replyTo } : {}),
+                        ...(replyTo ? { reply_to_wire_id: replyTo } : {}),
                     });
                 }
             }
@@ -1221,11 +1131,11 @@ export class OwnerChannel {
             if (error instanceof RelayUnroutableError) {
                 this.options.log(`[${this.options.role}] managed-agent attachment has no owner route; `
                     + `transaction stays queued: ${this.errorText(error)}`);
-                await this.nackManagedAgent(agent, nackReplyTo, nackWire, ownerNotices.relayQueued());
+                await this.nackManagedAgent(agent, nackMessage, nackWire, ownerNotices.relayQueued());
                 return false;
             }
             this.logError('managed-agent caption/file relay refused', error);
-            await this.nackManagedAgent(agent, nackReplyTo, nackWire, ownerNotices.relayRefused(this.errorText(error)));
+            await this.nackManagedAgent(agent, nackMessage, nackWire, ownerNotices.relayRefused(this.errorText(error)));
             // Rejection/admission failure and uncertain transport are terminal and
             // visible. Consuming every correlated wire prevents a later partial replay.
             for (const wire of handledWireIds)
@@ -1261,17 +1171,17 @@ export class OwnerChannel {
     }
     /**
      * One bounded NACK per wire: an unroutable or refused relay must be visible
-     * to the authenticated agent, while its history replays stay quiet. NACK
+     * to the authenticated agent, while its deferred replays stay quiet. NACK
      * delivery is best-effort — it must never make the failure worse.
      */
-    async nackManagedAgent(contact, replyTo, wireId, notice) {
+    async nackManagedAgent(contact, message, wireId, notice) {
         if (this.relayNacks.has(wireId))
             return;
         this.relayNacks.add(wireId);
         if (this.relayNacks.size > RELAY_NACK_MEMORY)
             this.relayNacks.delete(this.relayNacks.values().next().value);
         try {
-            await this.send(contact, notice, replyTo);
+            await this.send(contact, notice, message.wire_id ? wireId : undefined);
         }
         catch (error) {
             this.logError('managed-agent relay NACK delivery failed', error);
@@ -1332,6 +1242,32 @@ export class OwnerChannel {
     authorizationIntegrity() {
         return this.options.config.agent ? { ok: true } : this.authorizations.integrity();
     }
+    /**
+     * Report what the session actually did with the prompt, not what the config
+     * asked for. `interrupt: true` used to be reported as "your request
+     * interrupted the previous task" unconditionally; the session now answers
+     * whether anything was cancelled, whether the request is queued behind
+     * earlier prompts, or whether it is held until the current task reaches a
+     * safe stopping point. Backends that report no delivery state keep the old
+     * queuedBehind-based wording.
+     */
+    acceptanceNotice(queued) {
+        switch (queued.delivery) {
+            case 'interrupted': return ownerNotices.receivedInterrupting();
+            case 'deferred': return ownerNotices.receivedDeferred();
+            case 'queued': return ownerNotices.receivedQueued(Math.max(1, queued.queuedBehind));
+            case 'started': return ownerNotices.receivedStarted();
+            default:
+                // Interrupting the live turn does not remove prompts which were already
+                // accepted into the ACP queue. Never claim this request is running while
+                // the session itself says earlier work remains ahead of it.
+                return queued.queuedBehind > 0
+                    ? ownerNotices.receivedQueued(queued.queuedBehind)
+                    : this.options.config.interrupt
+                        ? ownerNotices.receivedInterrupting()
+                        : ownerNotices.receivedStarted();
+        }
+    }
     async complete(active, outbox, queued, activityCursor) {
         const progressMs = this.options.config.progress_interval_ms;
         let lastSeq = activityCursor;
@@ -1532,7 +1468,7 @@ export class OwnerChannel {
             throw new Error('commentary appears to contain secret, reasoning, or raw tool content');
         return message;
     }
-    ownerAttachmentPrompt(sender, wireId, requestId, outbox, files, caption) {
+    ownerAttachmentPrompt(sender, wireId, requestId, files, caption) {
         const lines = [
             '[fleet-owner]',
             `Authenticated owner ${safeField(sender.name, 160)} (${sender.id}) sent owner-channel attachment request ${wireId}.`,
@@ -1556,10 +1492,13 @@ export class OwnerChannel {
                     lines.push(`- voice transcript status: ${transcription?.status ?? 'unavailable'}`, `- voice transcript fallback: audio path above; category ${transcription?.errorCategory ?? 'not_provided'}`);
             }
         }
-        lines.push('Answer in your final assistant response; fleet routes it only to the authenticated sender and correlates it to the originating file wire.', `To attach response files, write regular files only to: ${outbox}`);
+        lines.push('Answer in your final assistant response; fleet routes it only to the authenticated sender and correlates it to the originating file wire.', 
+        // send_file is the only delivery route an agent is given: a tool call either
+        // delivers or reports an error, where a file written to disk does neither.
+        'To send the owner a file — now or later in this turn — call ours `send_file`:', `contact: ${this.options.config.identity}`, 'and the path of the finished file. Fleet routes it to the authenticated owner.', 'A file written anywhere else is not delivered and nothing will report that it was not.', 'Use descriptive unique filenames. Send nothing the owner did not request or should not receive.');
         return lines.join('\n');
     }
-    ownerPrompt(sender, text, wireId, outbox) {
+    ownerPrompt(sender, text, wireId) {
         return [
             '[fleet-owner]',
             `Authenticated owner ${sender.name} (${sender.id}) sent owner-channel message ${wireId}.`,
@@ -1573,10 +1512,13 @@ export class OwnerChannel {
             ] : [
                 'Managed-agent outbound relay is not configured; do not send intermediate or proactive owner-channel messages.',
             ]),
-            'To attach files to your response, copy each finished file directly into this fleet outbox:',
-            outbox,
-            'Fleet sends every regular file in that directory to the authenticated owner, correlated to this request.',
-            'Use descriptive unique filenames. Put nothing there that the owner did not request or should not receive.',
+            // send_file is the only delivery route an agent is given: a tool call either
+            // delivers or reports an error, where a file written to disk does neither.
+            'To send the owner a file — now or later in this turn — call ours `send_file`:',
+            `contact: ${this.options.config.identity}`,
+            'and the path of the finished file. Fleet routes it to the authenticated owner.',
+            'A file written anywhere else is not delivered and nothing will report that it was not.',
+            'Use descriptive unique filenames. Send nothing the owner did not request or should not receive.',
             '',
             text || '(empty message)',
         ].join('\n');
@@ -1589,8 +1531,8 @@ export class OwnerChannel {
         return createHash('sha256').update(wireId).digest('hex');
     }
     send(contact, text, replyTo) {
-        return this.client.sendMessage({
-            contact, text, ...(replyTo ? { replyToWireId: replyTo } : {}),
+        return this.client.callTool('send_message', {
+            contact, text, ...(replyTo ? { reply_to_wire_id: replyTo } : {}),
         });
     }
     async sendAttachments(contact, outbox, replyTo) {
@@ -1598,11 +1540,11 @@ export class OwnerChannel {
             .filter(entry => entry.isFile())
             .sort((a, b) => a.name.localeCompare(b.name));
         for (const entry of entries) {
-            await this.client.sendFile({
+            await this.client.callTool('send_file', {
                 contact,
                 path: join(outbox, entry.name),
                 filename: entry.name,
-                replyToWireId: replyTo,
+                reply_to_wire_id: replyTo,
             });
         }
         await rm(outbox, { recursive: true, force: true });
@@ -1625,11 +1567,11 @@ export class OwnerChannel {
         return Number.isInteger(message.msg_id) ? `msg:${message.msg_id}` : '';
     }
     sender(message) {
-        // Authenticated routing data, straight from the daemon's typed envelope.
-        // The id still goes through the CID checks in acceptedSender/isEffectiveOwner.
-        const source = message.from;
-        const id = String(source?.id ?? '');
-        return { id, name: String(source?.name ?? id) };
+        const source = message.from ?? message.sender;
+        if (typeof source === 'string')
+            return { id: source, name: source };
+        const id = String(source?.id ?? message.sender_id ?? '');
+        return { id, name: String(source?.name ?? message.sender_name ?? id) };
     }
     latestEventSeq(events) {
         return events.reduce((latest, event) => Math.max(latest, event.seq), 0);
@@ -1658,65 +1600,90 @@ export class OwnerChannel {
         return undefined;
     }
     async watchLoop() {
+        const endpoint = resolveEndpoint({ ...process.env, ...(this.options.env ?? {}) });
+        const fetch = this.options.watchFetch
+            ?? ((url, init) => globalThis.fetch(url, init));
         const sleep = this.options.binderDeps?.sleep
             ?? (ms => new Promise(resolve => setTimeout(resolve, ms)));
         const restored = this.readWatchState();
         let state = restored.state;
-        if (restored.recovered)
-            state = this.writeWatchState(state, 'OWNER_WATCH_STATE_RECOVERED');
+        // An unreadable cursor is the ONLY reason to restart at the tip. Say so on
+        // the next successful connect, and drain first: everything the lost cursor
+        // would have pointed at is still in the inbox, which is the authority.
+        let recovering = restored.recovered;
+        let cursor = state?.cursor ?? 'tip';
         let delayMs = 1_000;
-        let attempts = 0;
+        let authFailures = 0;
+        if (recovering)
+            await this.drain().catch(error => this.logError('cursor recovery drain failed', error));
         while (!this.stopping) {
             const ctrl = new AbortController();
             this.watchAbort = ctrl;
+            let stalled = false;
+            let authRejected = false;
+            const timer = setTimeout(() => { stalled = true; ctrl.abort(); }, this.options.watchStallMs ?? OWNER_WATCH_STALL_MS);
+            timer.unref?.();
             try {
-                // This drain is unconditional at EVERY establishment. Starting the SDK
-                // stream at 0 then replays notification hints instead of tip-priming,
-                // so mail arriving after the drain but before the first request cannot
-                // fall into a gap. Persistent history plus fleet's body-free claim
-                // journal is authoritative; durable wire-ID dedupe makes hints harmless.
-                await this.drain();
-                if (this.stopping)
-                    return;
-                state = this.writeWatchState(state, 'OWNER_WATCH_CONNECTING', { reconnected: attempts > 0 });
-                attempts++;
-                for await (const _event of this.client.watchNotifications(this.options.config.identity, { since: 0, signal: ctrl.signal })) {
-                    if (this.stopping)
+                const response = await fetch(`${endpoint.url(this.options.config.identity)}?since=${cursor}`, { headers: endpoint.headers, signal: ctrl.signal });
+                if (response.status === 401) {
+                    authRejected = true;
+                    authFailures++;
+                    const at = cursor === 'tip' ? state?.cursor ?? 0 : cursor;
+                    if (authFailures >= OWNER_WATCH_AUTH_FATAL_ATTEMPTS) {
+                        state = this.writeWatchState(state, at, 'OWNER_WATCH_AUTH_FATAL', true);
+                        this.options.log(`[${this.options.role}] owner watch stopped `
+                            + `reason=OWNER_WATCH_AUTH_FATAL after ${authFailures} consecutive HTTP 401 responses; `
+                            + 'owner notifications require re-authorization and will not be retried');
                         return;
-                    state = this.writeWatchState(state, 'OWNER_WATCH_CONNECTED', { resetFailures: true });
-                    delayMs = 1_000;
-                    // Notification events contain no bodies and are only wake hints.
-                    // Draining is idempotent at the turn boundary because wire IDs are
-                    // recorded before a managed request is dispatched.
-                    await this.drain();
+                    }
+                    state = this.writeWatchState(state, at, 'OWNER_WATCH_AUTH_FAILED', true);
+                    throw new Error('OWNER_WATCH_AUTH_FAILED: daemon rejected notification credentials');
                 }
-                if (!this.stopping)
-                    throw new Error('ours SDK notification stream ended');
+                if (!response.ok)
+                    throw new Error(`daemon returned HTTP ${response.status}`);
+                const body = await response.json();
+                const next = typeof body.cursor === 'number' ? body.cursor : cursor === 'tip' ? 0 : cursor;
+                const reconnect = (state?.consecutiveFailures ?? 0) > 0;
+                state = this.writeWatchState(state, next, recovering ? 'OWNER_WATCH_CURSOR_RECOVERED' : 'OWNER_WATCH_CONNECTED', false, reconnect);
+                recovering = false;
+                authFailures = 0;
+                cursor = next;
+                delayMs = 1_000;
+                // Notification events are content-free hints. The inbox remains the
+                // authority and its wire-level durable dedupe prevents duplicate turns.
+                if ((body.events?.length ?? 0) > 0)
+                    await this.drain();
             }
             catch (error) {
                 if (this.stopping)
                     return;
-                // SDK 2 deliberately hides transport status behind its typed stream.
-                // Do not parse error prose to rediscover it: every failure follows the
-                // same capped retry path forever, and the pre-establishment drain makes
-                // that retry correctness-preserving.
-                state = this.writeWatchState(state, 'OWNER_WATCH_STREAM_ERROR', { failed: true });
+                const reason = stalled
+                    ? 'OWNER_WATCH_STALLED' : 'OWNER_WATCH_STREAM_ERROR';
+                const current = cursor === 'tip' ? state?.cursor ?? 0 : cursor;
+                cursor = current;
+                // Only THIS iteration's auth rejection is already written. A stale
+                // AUTH_FAILED from an earlier attempt must never suppress the cursor,
+                // the failure counter, or a later STALLED transition.
+                if (!authRejected)
+                    state = this.writeWatchState(state, current, reason, true);
                 this.options.log(`[${this.options.role}] owner watch reconnect `
-                    + `reason=OWNER_WATCH_STREAM_ERROR delay_ms=${delayMs} `
-                    + `failures=${state.consecutiveFailures}: ${this.errorText(error)}`);
+                    + `reason=${authRejected ? 'OWNER_WATCH_AUTH_FAILED' : reason} `
+                    + `delay_ms=${delayMs} cursor=${current}`);
                 await sleep(delayMs);
                 delayMs = Math.min(delayMs * 2, OWNER_WATCH_BACKOFF_MAX_MS);
             }
             finally {
+                clearTimeout(timer);
                 if (this.watchAbort === ctrl)
                     this.watchAbort = undefined;
             }
         }
     }
     /**
-     * `recovered` distinguishes a first-ever start from unreadable persisted
-     * diagnostics. Notification correctness does not depend on this state: every
-     * establishment drains and then replays SDK hints from offset zero.
+     * `recovered` distinguishes a first-ever start (no state, nothing lost) from a
+     * cursor we HAD and can no longer read. Only the latter is a recovery, and the
+     * caller needs to know because the reason it reports is the only evidence a
+     * durable cursor was ever lost.
      */
     readWatchState() {
         const path = join(this.options.stateDir, '.owner-channel-watch.json');
@@ -1724,43 +1691,76 @@ export class OwnerChannel {
             return { recovered: false };
         try {
             const value = JSON.parse(readFileSync(path, 'utf8'));
-            if ((value.version !== 1 && value.version !== 2)
+            if (value.version !== 1 || !Number.isSafeInteger(value.cursor) || value.cursor < 0
                 || !Number.isSafeInteger(value.reconnects) || value.reconnects < 0
                 || !Number.isSafeInteger(value.consecutiveFailures) || value.consecutiveFailures < 0)
                 throw new Error('invalid owner watch state');
-            const reasons = new Set([
-                'OWNER_WATCH_CONNECTING', 'OWNER_WATCH_CONNECTED',
-                'OWNER_WATCH_STREAM_ERROR', 'OWNER_WATCH_STATE_RECOVERED',
-            ]);
-            return { state: {
-                    version: 2,
-                    reconnects: value.reconnects,
-                    consecutiveFailures: value.consecutiveFailures,
-                    reason: reasons.has(value.reason)
-                        ? value.reason : 'OWNER_WATCH_CONNECTING',
-                    updatedAt: typeof value.updatedAt === 'string'
-                        ? value.updatedAt : new Date(this.options.binderDeps?.now?.() ?? Date.now()).toISOString(),
-                }, recovered: false };
+            return { state: value, recovered: false };
         }
         catch {
             this.options.log(`[${this.options.role}] owner watch `
-                + 'reason=OWNER_WATCH_STATE_RECOVERED invalid persisted counters; restarting safely');
+                + 'reason=OWNER_WATCH_CURSOR_RECOVERED invalid cursor state; draining inbox and starting at tip');
             return { recovered: true };
         }
     }
-    writeWatchState(previous, reason, options = {}) {
+    writeWatchState(previous, cursor, reason, failed, reconnected = false) {
         const state = {
-            version: 2,
-            reconnects: (previous?.reconnects ?? 0) + (options.reconnected ? 1 : 0),
-            consecutiveFailures: options.failed
-                ? (previous?.consecutiveFailures ?? 0) + 1
-                : options.resetFailures ? 0 : previous?.consecutiveFailures ?? 0,
+            version: 1,
+            cursor,
+            reconnects: (previous?.reconnects ?? 0) + (reconnected ? 1 : 0),
+            consecutiveFailures: failed ? (previous?.consecutiveFailures ?? 0) + 1 : 0,
             reason,
             updatedAt: new Date(this.options.binderDeps?.now?.() ?? Date.now()).toISOString(),
         };
         replaceFileAtomically(join(this.options.stateDir, '.owner-channel-watch.json'), `${JSON.stringify(state)}\n`, 0o600);
         return state;
     }
+    /** Compatibility path for injected child-process tests; production is direct. */
+    async legacyWatchLoop() {
+        let delayMs = 1_000;
+        while (!this.stopping) {
+            try {
+                const child = this.options.watch?.(this.options.config.identity) ?? spawn(this.options.command ?? 'ours-mcp', ['watch', this.options.config.identity], {
+                    env: { ...process.env, ...(this.options.env ?? {}) }, stdio: ['pipe', 'pipe', 'pipe'],
+                });
+                this.watchProcess = child;
+                await new Promise((resolve, reject) => {
+                    if (child.pid) {
+                        resolve();
+                        return;
+                    }
+                    child.once('spawn', resolve);
+                    child.once('error', reject);
+                });
+                createInterface({ input: child.stderr }).on('line', line => this.options.log(`[${this.options.role}] owner watch: ${line}`));
+                delayMs = 1_000;
+                // Drain at every (re)attachment, not only after a future notification:
+                // a failed send/turn leaves the input deferred and may not emit another
+                // watch line by itself.
+                await this.drain();
+                for await (const _line of createInterface({ input: child.stdout })) {
+                    if (this.stopping)
+                        break;
+                    await this.drain();
+                }
+                if (!this.stopping)
+                    throw new Error('watch exited');
+            }
+            catch (error) {
+                if (!this.stopping) {
+                    this.logError('watch failed; retrying', error);
+                    await new Promise(resolve => setTimeout(resolve, delayMs));
+                    delayMs = Math.min(delayMs * 2, 30_000);
+                }
+            }
+            finally {
+                const child = this.watchProcess;
+                this.watchProcess = undefined;
+                if (child && child.exitCode === null)
+                    child.kill('SIGTERM');
+            }
+        }
+    }
     errorText(error) {
         return error?.message ?? String(error);
     }