@ours.network/fleet 0.18.0 → 0.19.0-nightly.1

package/dist/harness-plugins.js

@@ -1,309 +0,0 @@
-import { existsSync, readFileSync } from 'node:fs';
-import { join, resolve } from 'node:path';
-import { replaceFileAtomically, withFileLock } from './atomic-file.js';
-import { realExec } from './exec.js';
-import { stateRoot } from './paths.js';
-export const HARNESS_PLUGIN_IDS = ['codex', 'claude-code'];
-const REGISTRY = 'https://registry.npmjs.org';
-const SPECS = {
-    codex: {
-        package: '@ours.network/codex',
-        marketplaceName: 'ours-fleet-codex-lock',
-        marketplaceManifest: '.agents/plugins/marketplace.json',
-        executable: 'codex',
-    },
-    'claude-code': {
-        package: '@ours.network/claude-code',
-        marketplaceName: 'ours-fleet-claude-lock',
-        marketplaceManifest: '.claude-plugin/marketplace.json',
-        executable: 'claude',
-    },
-};
-const EXACT_SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
-const isRecord = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
-export function resolveHarnessPluginConfigs(raw, file = 'fleet.yaml') {
-    const resolved = {
-        codex: { plugin_channel: 'stable' },
-        'claude-code': { plugin_channel: 'stable' },
-    };
-    if (raw === undefined)
-        return resolved;
-    if (!isRecord(raw))
-        throw new Error(`${file}: harnesses must be a map`);
-    const unknown = Object.keys(raw).filter(key => !HARNESS_PLUGIN_IDS.includes(key));
-    if (unknown.length)
-        throw new Error(`${file}: harnesses has unknown harness(es) ${unknown.join(', ')}; allowed: ${HARNESS_PLUGIN_IDS.join(', ')}`);
-    for (const harness of HARNESS_PLUGIN_IDS) {
-        const value = raw[harness];
-        if (value === undefined)
-            continue;
-        if (!isRecord(value))
-            throw new Error(`${file}: harnesses.${harness} must be a map`);
-        const bad = Object.keys(value).filter(key => key !== 'plugin_channel');
-        if (bad.length)
-            throw new Error(`${file}: harnesses.${harness} has unknown key(s) ${bad.join(', ')}; allowed: plugin_channel`);
-        const channel = value.plugin_channel;
-        if (channel !== 'stable' && channel !== 'nightly')
-            throw new Error(`${file}: harnesses.${harness}.plugin_channel must be one of: stable, nightly`);
-        resolved[harness] = { plugin_channel: channel };
-    }
-    return resolved;
-}
-export const harnessPluginRoot = (harness) => join(stateRoot(), 'harness-plugins', harness);
-export const harnessPluginLockPath = (harness) => join(harnessPluginRoot(harness), 'plugin-lock.json');
-export const harnessPluginMarketplaceRoot = (harness) => join(harnessPluginRoot(harness), 'marketplace');
-export const harnessPluginMarketplacePath = (harness) => join(harnessPluginMarketplaceRoot(harness), SPECS[harness].marketplaceManifest);
-function validateLock(value, harness, path) {
-    const spec = SPECS[harness];
-    const fail = (detail) => {
-        throw new Error(`invalid harness plugin lock ${path}: ${detail}; run \`ours-fleet plugins update ${harness}\``);
-    };
-    if (!isRecord(value))
-        return fail('expected a JSON object');
-    if (value.schemaVersion !== 1)
-        fail('unsupported schemaVersion');
-    if (value.harness !== harness)
-        fail(`harness must be '${harness}'`);
-    if (value.channel !== 'stable' && value.channel !== 'nightly')
-        fail('channel must be stable or nightly');
-    const expectedTag = value.channel === 'stable' ? 'latest' : 'nightly';
-    if (value.distTag !== expectedTag)
-        fail(`distTag must be '${expectedTag}' for channel '${value.channel}'`);
-    if (value.package !== spec.package)
-        fail(`package must be '${spec.package}'`);
-    if (typeof value.version !== 'string' || !EXACT_SEMVER.test(value.version))
-        return fail('version must be an exact semver');
-    const version = value.version;
-    if (value.channel === 'stable' && version.includes('-'))
-        fail('stable channel resolved to a prerelease');
-    if (value.channel === 'nightly' && !version.includes('-nightly.'))
-        fail('nightly channel did not resolve to a -nightly.N prerelease');
-    if (value.registry !== REGISTRY)
-        fail(`registry must be '${REGISTRY}'`);
-    if (typeof value.resolvedAt !== 'string' || !Number.isFinite(Date.parse(value.resolvedAt)))
-        fail('resolvedAt must be an ISO timestamp');
-    return value;
-}
-export function readHarnessPluginLock(harness) {
-    const path = harnessPluginLockPath(harness);
-    if (!existsSync(path))
-        return undefined;
-    let parsed;
-    try {
-        parsed = JSON.parse(readFileSync(path, 'utf8'));
-    }
-    catch (error) {
-        throw new Error(`invalid harness plugin lock ${path}: ${error.message}; `
-            + `run \`ours-fleet plugins update ${harness}\``);
-    }
-    return validateLock(parsed, harness, path);
-}
-function marketplaceDocument(lock) {
-    const spec = SPECS[lock.harness];
-    const source = lock.harness === 'codex'
-        ? { source: 'npm', package: lock.package, version: lock.version, registry: lock.registry }
-        : { source: 'npm', package: lock.package, version: lock.version };
-    if (lock.harness === 'codex') {
-        return {
-            name: spec.marketplaceName,
-            interface: { displayName: `ours.network (${lock.channel}, locked ${lock.version})` },
-            plugins: [{
-                    name: 'ours', source,
-                    policy: { installation: 'AVAILABLE', authentication: 'ON_INSTALL' },
-                    category: 'Productivity',
-                }],
-        };
-    }
-    return {
-        $schema: 'https://json.schemastore.org/claude-code-marketplace.json',
-        name: spec.marketplaceName,
-        owner: { name: 'Adapt Framework Solutions Ltd', url: 'https://ours.network' },
-        description: `Generated by ours-fleet; @ours.network/claude-code is locked to ${lock.version}.`,
-        plugins: [{
-                name: 'ours', source,
-                description: 'Secure ours.network messaging for Claude Code.',
-            }],
-    };
-}
-function writeMarketplace(lock) {
-    const path = harnessPluginMarketplacePath(lock.harness);
-    replaceFileAtomically(path, `${JSON.stringify(marketplaceDocument(lock), null, 2)}\n`, 0o644);
-    return path;
-}
-/**
- * Re-materialize the generated marketplace from the persisted exact lock.
- * This is the ONLY ordinary startup/reconciliation path: it performs no exec,
- * no network call, and cannot observe a moving npm dist-tag.
- */
-export function restoreLockedHarnessMarketplace(harness, expectedChannel) {
-    const lock = readHarnessPluginLock(harness);
-    if (!lock) {
-        if (expectedChannel === 'nightly')
-            throw new Error(`harness '${harness}' requests nightly but has no exact lock; `
-                + `run \`ours-fleet plugins install ${harness}\``);
-        return undefined;
-    }
-    if (expectedChannel && lock.channel !== expectedChannel)
-        throw new Error(`harness '${harness}' requests ${expectedChannel} but its exact lock is ${lock.channel} `
-            + `(${lock.version}); run \`ours-fleet plugins update ${harness}\``);
-    if (lock)
-        writeMarketplace(lock);
-    return lock;
-}
-async function checked(exec, command, args, action) {
-    const result = await exec(command, args);
-    if (result.code !== 0)
-        throw new Error(`${action} failed (${command} ${args.join(' ')}): ${result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`}`);
-    return result;
-}
-function parseJson(output, action) {
-    try {
-        return JSON.parse(output);
-    }
-    catch (error) {
-        throw new Error(`${action} returned invalid JSON: ${error.message}`);
-    }
-}
-async function resolveExactVersion(harness, channel, exec, now) {
-    const spec = SPECS[harness];
-    const distTag = channel === 'stable' ? 'latest' : 'nightly';
-    const result = await checked(exec, 'npm', ['view', `${spec.package}@${distTag}`, 'version', '--json'], `resolve ${spec.package} ${distTag}`);
-    const version = parseJson(result.stdout, `npm view ${spec.package}@${distTag}`);
-    if (typeof version !== 'string' || !EXACT_SEMVER.test(version))
-        throw new Error(`npm view ${spec.package}@${distTag} did not return one exact semver`);
-    if (channel === 'stable' && version.includes('-'))
-        throw new Error(`refusing stable ${spec.package}: npm latest resolved to prerelease ${version}`);
-    if (channel === 'nightly' && !version.includes('-nightly.'))
-        throw new Error(`refusing nightly ${spec.package}: npm nightly resolved to ${version}`);
-    return {
-        schemaVersion: 1,
-        harness,
-        channel,
-        distTag,
-        package: spec.package,
-        version,
-        registry: REGISTRY,
-        resolvedAt: now().toISOString(),
-    };
-}
-function marketplaceEntries(harness, output) {
-    const parsed = parseJson(output, `${SPECS[harness].executable} plugin marketplace list`);
-    if (harness === 'codex') {
-        if (!isRecord(parsed) || !Array.isArray(parsed.marketplaces))
-            throw new Error('codex plugin marketplace list returned an unexpected shape');
-        return parsed.marketplaces.filter(isRecord);
-    }
-    if (!Array.isArray(parsed))
-        throw new Error('claude plugin marketplace list returned an unexpected shape');
-    return parsed.filter(isRecord);
-}
-async function ensureMarketplaceRegistered(harness, exec) {
-    const spec = SPECS[harness];
-    const root = harnessPluginMarketplaceRoot(harness);
-    const result = await checked(exec, spec.executable, ['plugin', 'marketplace', 'list', '--json'], `list ${harness} marketplaces`);
-    const existing = marketplaceEntries(harness, result.stdout)
-        .find(entry => entry.name === spec.marketplaceName);
-    if (existing) {
-        if (harness === 'codex') {
-            const declared = isRecord(existing.marketplaceSource)
-                ? existing.marketplaceSource.source : existing.root;
-            if (typeof declared !== 'string' || resolve(declared) !== resolve(root))
-                throw new Error(`marketplace '${spec.marketplaceName}' already exists but does not point to ${root}; `
-                    + 'refusing to replace an unrelated marketplace');
-        }
-        else {
-            // Claude copies marketplace contents into its cache, but retains the
-            // source kind in list output. Refresh that copy after each lock update.
-            if (existing.source !== 'directory')
-                throw new Error(`marketplace '${spec.marketplaceName}' already exists but is not a local directory; `
-                    + 'refusing to replace an unrelated marketplace');
-            await checked(exec, 'claude', ['plugin', 'marketplace', 'update', spec.marketplaceName], `refresh ${harness} locked marketplace`);
-        }
-        return;
-    }
-    const args = harness === 'codex'
-        ? ['plugin', 'marketplace', 'add', root, '--json']
-        : ['plugin', 'marketplace', 'add', root, '--scope', 'user'];
-    await checked(exec, spec.executable, args, `register ${harness} locked marketplace`);
-}
-async function removeLegacyPluginSelections(harness, exec) {
-    const spec = SPECS[harness];
-    const result = await checked(exec, spec.executable, ['plugin', 'list', '--json'], `list ${harness} plugins`);
-    const parsed = parseJson(result.stdout, `${spec.executable} plugin list`);
-    if (harness === 'codex' && (!isRecord(parsed) || !Array.isArray(parsed.installed)))
-        throw new Error('codex plugin list returned an unexpected shape');
-    if (harness === 'claude-code' && !Array.isArray(parsed))
-        throw new Error('claude plugin list returned an unexpected shape');
-    const entries = (harness === 'codex'
-        ? parsed.installed
-        : parsed).filter(isRecord);
-    const ids = new Set(entries
-        .map(entry => harness === 'codex' ? entry.pluginId : entry.id)
-        .filter((id) => typeof id === 'string'));
-    const legacy = harness === 'codex'
-        ? ['ours@ours-codex-marketplace', 'ours-fleet@ours-codex-marketplace']
-        : ['ours@ours', 'ours@ours.network'];
-    for (const selector of legacy.filter(id => ids.has(id))) {
-        const args = harness === 'codex'
-            ? ['plugin', 'remove', selector, '--json']
-            : ['plugin', 'uninstall', selector, '--scope', 'user', '--keep-data'];
-        await checked(exec, spec.executable, args, `remove legacy moving selection ${selector}`);
-    }
-}
-async function installFromLock(lock, exec) {
-    const spec = SPECS[lock.harness];
-    // The Codex package also owns the ours-codex launcher. Pin that executable to
-    // the same exact artifact as the local marketplace; never invoke its broad
-    // installer, which may select daemon/SDK packages outside this feature.
-    if (lock.harness === 'codex') {
-        await checked(exec, 'npm', ['install', '--global', `${lock.package}@${lock.version}`], `install ${lock.package}@${lock.version}`);
-    }
-    await ensureMarketplaceRegistered(lock.harness, exec);
-    const selector = `ours@${spec.marketplaceName}`;
-    const args = lock.harness === 'codex'
-        ? ['plugin', 'add', selector, '--json']
-        : ['plugin', 'install', selector, '--scope', 'user'];
-    await checked(exec, spec.executable, args, `install ${selector}`);
-    // The same plugin under an older Git marketplace is a distinct harness
-    // selection and can remain enabled beside the lock. Remove only the known
-    // ours selectors, after the exact local selection is installed successfully.
-    await removeLegacyPluginSelections(lock.harness, exec);
-}
-/**
- * Explicit install/update transaction.
- *
- * install reuses an existing same-channel lock (deterministic repair/reinstall);
- * update always resolves the requested channel once and advances the lock.
- */
-export async function installHarnessPlugin(harness, channel, options = {}) {
-    const exec = options.exec ?? realExec;
-    const root = harnessPluginRoot(harness);
-    return withFileLock(`${root}.lock`, async () => {
-        const existing = readHarnessPluginLock(harness);
-        const mustResolve = options.update === true || !existing || existing.channel !== channel;
-        const lock = mustResolve
-            ? await resolveExactVersion(harness, channel, exec, options.now ?? (() => new Date()))
-            : existing;
-        if (mustResolve)
-            replaceFileAtomically(harnessPluginLockPath(harness), `${JSON.stringify(lock, null, 2)}\n`);
-        // Publish the lock first. If installation is interrupted, every retry uses
-        // this same exact version; no half-finished transaction can observe a newer
-        // dist-tag on its own.
-        const marketplacePath = writeMarketplace(lock);
-        await installFromLock(lock, exec);
-        return {
-            lock,
-            lockPath: harnessPluginLockPath(harness),
-            marketplacePath,
-            resolved: mustResolve,
-        };
-    });
-}
-export function selectedHarnessPluginIds(values) {
-    if (!values.length)
-        return [...HARNESS_PLUGIN_IDS];
-    const unknown = values.filter(value => !HARNESS_PLUGIN_IDS.includes(value));
-    if (unknown.length)
-        throw new Error(`unknown harness(es) ${unknown.join(', ')}; allowed: ${HARNESS_PLUGIN_IDS.join(', ')}`);
-    return [...new Set(values)];
-}

package/dist/model-env.d.ts

@@ -1,71 +0,0 @@
-import type { ResolvedRole } from './config.js';
-/**
- * Which environment variable a harness reads to pin the model it RUNS.
- *
- * This is not a convenience: for `claude-code` it is the only channel that
- * reaches the ACP backend at all. `buildLaunch` (tmux) passes `--model`, but
- * `buildAcpLaunch` launches the ACP adapter with no model argument, and that
- * adapter resolves its model in this order — ANTHROPIC_MODEL, then
- * `settings.model`, then a resumed session's live model, then its first
- * catalogue entry. A role's declared model was therefore invisible to every
- * ACP role, and a fleet-wide `defaults.env.ANTHROPIC_MODEL` silently outranked
- * an explicitly requested one.
- */
-export declare const MODEL_ENV_BY_HARNESS: Readonly<Record<string, string>>;
-/** The model-pin variable for a harness, or undefined if it pins no model by env. */
-export declare function modelEnvVar(harness: string | undefined): string | undefined;
-export interface RoleModelEnvInput {
-    harness: string;
-    /** Already resolved by `resolveRoleModel` — may come from the fleet default. */
-    model: string | undefined;
-    /** True when the role (or `--model`) named a model, including `model: null`. */
-    modelWasExplicit: boolean;
-    defaultsEnv?: Record<string, string>;
-    roleEnv?: Record<string, string>;
-    authProxyBaseUrl?: string;
-}
-export interface RoleModelEnv {
-    env: Record<string, string>;
-    /**
-     * The model the harness will actually run. Equal to `env[pin]` for a harness
-     * that pins by env, so anything reporting this value reports the runtime.
-     */
-    model: string | undefined;
-}
-/**
- * Resolve a role's environment and its runtime model TOGETHER, so the two can
- * never disagree.
- *
- * Precedence, highest first:
- *   1. an explicit `model:` / `--model` on the role
- *   2. the role's own `env:` pin
- *   3. the fleet `defaults.model`
- *   4. the fleet `defaults.env` pin
- *
- * Inheriting the fleet default remains correct when the role names no model
- * (2, 3, 4); an explicitly named one wins (1). Where both are explicit and they
- * disagree, there is no defensible winner, so this refuses rather than picking
- * one silently — the silence is what let a day of "Fable" work run on Opus.
- *
- * `model: null` explicitly asks for no fleet-chosen model, so it also clears an
- * inherited pin instead of leaving one in place to act as a hidden default.
- */
-export declare function resolveRoleModelEnv(input: RoleModelEnvInput, describe?: (message: string) => Error): RoleModelEnv;
-/**
- * The model a role will actually run, read back from the environment it was
- * resolved with. Use this wherever a model is reported to a human.
- */
-export declare function effectiveRoleModel(role: ResolvedRole): string | undefined;
-/**
- * Move a role's env pin onto a new model. Anything that changes the model a
- * role runs after resolution — model-chain recovery is the live example — must
- * go through this, or it changes only the label.
- */
-export declare function repinModelEnv(role: ResolvedRole, model: string | undefined): Record<string, string> | undefined;
-/**
- * Last line of defence, at the exact point a child's environment is composed:
- * refuse to launch a role whose child would run a model other than the one the
- * role declares and the banner reports. A spawn that cannot keep those two in
- * agreement must fail loudly, not start and be believed.
- */
-export declare function assertModelPinReachesChild(role: ResolvedRole, childEnv: Record<string, string | undefined>): void;

package/dist/model-env.js

@@ -1,106 +0,0 @@
-/**
- * Which environment variable a harness reads to pin the model it RUNS.
- *
- * This is not a convenience: for `claude-code` it is the only channel that
- * reaches the ACP backend at all. `buildLaunch` (tmux) passes `--model`, but
- * `buildAcpLaunch` launches the ACP adapter with no model argument, and that
- * adapter resolves its model in this order — ANTHROPIC_MODEL, then
- * `settings.model`, then a resumed session's live model, then its first
- * catalogue entry. A role's declared model was therefore invisible to every
- * ACP role, and a fleet-wide `defaults.env.ANTHROPIC_MODEL` silently outranked
- * an explicitly requested one.
- */
-export const MODEL_ENV_BY_HARNESS = {
-    'claude-code': 'ANTHROPIC_MODEL',
-};
-/** The model-pin variable for a harness, or undefined if it pins no model by env. */
-export function modelEnvVar(harness) {
-    return harness === undefined ? undefined : MODEL_ENV_BY_HARNESS[harness];
-}
-/**
- * Resolve a role's environment and its runtime model TOGETHER, so the two can
- * never disagree.
- *
- * Precedence, highest first:
- *   1. an explicit `model:` / `--model` on the role
- *   2. the role's own `env:` pin
- *   3. the fleet `defaults.model`
- *   4. the fleet `defaults.env` pin
- *
- * Inheriting the fleet default remains correct when the role names no model
- * (2, 3, 4); an explicitly named one wins (1). Where both are explicit and they
- * disagree, there is no defensible winner, so this refuses rather than picking
- * one silently — the silence is what let a day of "Fable" work run on Opus.
- *
- * `model: null` explicitly asks for no fleet-chosen model, so it also clears an
- * inherited pin instead of leaving one in place to act as a hidden default.
- */
-export function resolveRoleModelEnv(input, describe = message => new Error(message)) {
-    const env = {
-        ...(input.defaultsEnv ?? {}),
-        ...(input.roleEnv ?? {}),
-        ...(input.authProxyBaseUrl ? { ANTHROPIC_BASE_URL: input.authProxyBaseUrl } : {}),
-    };
-    const pin = modelEnvVar(input.harness);
-    if (!pin)
-        return { env, model: input.model };
-    const rolePin = input.roleEnv?.[pin];
-    if (input.modelWasExplicit) {
-        if (rolePin !== undefined && rolePin !== input.model)
-            throw describe(`model '${input.model ?? '(none)'}' contradicts env.${pin} '${rolePin}'; `
-                + `remove one — ${pin} is what the harness actually runs`);
-        if (input.model === undefined)
-            delete env[pin];
-        else
-            env[pin] = input.model;
-        return { env, model: input.model };
-    }
-    // Not explicit: a role-level pin is the most specific thing said about this
-    // role, so it decides — and the reported model follows it.
-    if (rolePin !== undefined)
-        return { env, model: rolePin };
-    if (input.model !== undefined)
-        env[pin] = input.model;
-    return { env, model: input.model ?? env[pin] };
-}
-/**
- * The model a role will actually run, read back from the environment it was
- * resolved with. Use this wherever a model is reported to a human.
- */
-export function effectiveRoleModel(role) {
-    const pin = modelEnvVar(role.harness);
-    return (pin ? role.env?.[pin] : undefined) ?? role.model;
-}
-/**
- * Move a role's env pin onto a new model. Anything that changes the model a
- * role runs after resolution — model-chain recovery is the live example — must
- * go through this, or it changes only the label.
- */
-export function repinModelEnv(role, model) {
-    const pin = modelEnvVar(role.harness);
-    if (!pin)
-        return role.env;
-    const env = { ...(role.env ?? {}) };
-    if (model === undefined)
-        delete env[pin];
-    else
-        env[pin] = model;
-    return Object.keys(env).length ? env : undefined;
-}
-/**
- * Last line of defence, at the exact point a child's environment is composed:
- * refuse to launch a role whose child would run a model other than the one the
- * role declares and the banner reports. A spawn that cannot keep those two in
- * agreement must fail loudly, not start and be believed.
- */
-export function assertModelPinReachesChild(role, childEnv) {
-    const pin = modelEnvVar(role.harness);
-    if (!pin || role.model === undefined)
-        return;
-    const actual = childEnv[pin];
-    if (actual === role.model)
-        return;
-    throw new Error(`[${role.name}] refusing to launch: role model is '${role.model}' but the child's `
-        + `${pin} is ${actual === undefined ? 'unset' : `'${actual}'`} — the session would run a `
-        + 'different model than the one reported');
-}

package/dist/owner-channel/mcp.d.ts

@@ -1,24 +0,0 @@
-export declare class OursMcpError extends Error {
-}
-export interface OursToolClient {
-    start(): Promise<void>;
-    callTool(name: string, args?: Record<string, unknown>): Promise<unknown>;
-    close(): Promise<void>;
-}
-/** Minimal MCP stdio client. One instance owns exactly one ours identity binding. */
-export declare class OursMcpClient implements OursToolClient {
-    private readonly command;
-    private readonly env;
-    private readonly log;
-    private child?;
-    private nextId;
-    private tail;
-    constructor(command?: string, env?: Record<string, string>, log?: (line: string) => void);
-    start(): Promise<void>;
-    callTool(name: string, args?: Record<string, unknown>): Promise<unknown>;
-    close(): Promise<void>;
-    private request;
-    private requestNow;
-    private notify;
-    private write;
-}

package/dist/owner-channel/mcp.js

@@ -1,145 +0,0 @@
-import { spawn } from 'node:child_process';
-import { randomUUID } from 'node:crypto';
-import { createInterface } from 'node:readline';
-export class OursMcpError extends Error {
-}
-/** Minimal MCP stdio client. One instance owns exactly one ours identity binding. */
-export class OursMcpClient {
-    command;
-    env;
-    log;
-    child;
-    nextId = 0;
-    tail = Promise.resolve();
-    constructor(command = 'ours-mcp', env = {}, log = () => undefined) {
-        this.command = command;
-        this.env = env;
-        this.log = log;
-    }
-    async start() {
-        if (this.child && this.child.exitCode === null)
-            return;
-        // ours-mcp normally records the long-lived client PID so an identity lease
-        // survives connector churn. An owner-channel connector has the opposite
-        // lifecycle: each supervised attempt owns a fresh connector and must make
-        // its lease reclaimable when that connector exits, even though the fleet
-        // supervisor itself remains alive. POSIX exec preserves the shell PID as
-        // the proxy PID, giving the daemon an exact process-lifetime fence without
-        // interpolating the command path into shell text.
-        const child = spawn('/bin/sh', [
-            '-c', 'OURS_CLIENT_PID=$$; export OURS_CLIENT_PID; exec "$1" "$2"',
-            'ours-fleet-owner-proxy', this.command, 'proxy',
-        ], {
-            env: {
-                ...process.env,
-                ...this.env,
-                // Bindings are keyed by this value. Sharing it would silently rebind a
-                // role's normal mailbox or another owner channel.
-                CLAUDE_CODE_SESSION_ID: `ours-fleet-owner-${process.pid}-${randomUUID()}`,
-            },
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
-        await new Promise((resolve, reject) => {
-            child.once('spawn', resolve);
-            child.once('error', reject);
-        });
-        this.child = child;
-        child.once('exit', (code, signal) => {
-            this.log(`ours-mcp proxy launcher exited (${code ?? signal ?? 'unknown'})`);
-        });
-        child.stdin.on('error', error => this.log(`ours-mcp stdin: ${error.message}`));
-        createInterface({ input: child.stderr }).on('line', line => this.log(`ours-mcp: ${line}`));
-        try {
-            await this.request('initialize', {
-                protocolVersion: '2025-03-26', capabilities: {},
-                clientInfo: { name: 'ours-fleet-owner-channel', version: '1' },
-            });
-            await this.notify('notifications/initialized', {});
-        }
-        catch (error) {
-            await this.close();
-            throw error;
-        }
-    }
-    async callTool(name, args = {}) {
-        const result = await this.request('tools/call', { name, arguments: args });
-        const text = (result.content ?? [])
-            .filter(item => item.type === 'text').map(item => item.text ?? '').join('\n').trim();
-        if (result.isError)
-            throw new OursMcpError(text || `ours tool ${name} failed`);
-        if (result.structuredContent !== undefined)
-            return result.structuredContent;
-        if (!text)
-            return {};
-        try {
-            return JSON.parse(text);
-        }
-        catch {
-            return text;
-        }
-    }
-    async close() {
-        const child = this.child;
-        this.child = undefined;
-        if (!child || child.exitCode !== null)
-            return;
-        // EOF asks the proxy to close normally. Once this exact process exits, the
-        // daemon can reclaim its lease even while the supervisor stays alive.
-        child.stdin.end();
-        const exited = await new Promise(resolve => {
-            const timer = setTimeout(() => resolve(false), 1_000);
-            child.once('exit', () => { clearTimeout(timer); resolve(true); });
-        });
-        if (exited || child.exitCode !== null)
-            return;
-        child.kill('SIGTERM');
-        await new Promise(resolve => {
-            const timer = setTimeout(() => { child.kill('SIGKILL'); resolve(); }, 5_000);
-            child.once('exit', () => { clearTimeout(timer); resolve(); });
-        });
-    }
-    request(method, params) {
-        const run = this.tail.then(() => this.requestNow(method, params));
-        this.tail = run.then(() => undefined, () => undefined);
-        return run;
-    }
-    async requestNow(method, params) {
-        const child = this.child;
-        if (!child || child.exitCode !== null)
-            throw new OursMcpError('ours-mcp proxy is not running');
-        const id = ++this.nextId;
-        await this.write(child, { jsonrpc: '2.0', id, method, params });
-        const lines = createInterface({ input: child.stdout, crlfDelay: Infinity });
-        try {
-            for await (const line of lines) {
-                let response;
-                try {
-                    response = JSON.parse(line);
-                }
-                catch {
-                    continue;
-                }
-                if (response.id !== id)
-                    continue;
-                if (response.error !== undefined)
-                    throw new OursMcpError(JSON.stringify(response.error));
-                return response.result ?? {};
-            }
-            throw new OursMcpError('ours-mcp proxy closed its output');
-        }
-        finally {
-            lines.close();
-        }
-    }
-    async notify(method, params) {
-        const child = this.child;
-        if (!child || child.exitCode !== null)
-            throw new OursMcpError('ours-mcp proxy is not running');
-        await this.write(child, { jsonrpc: '2.0', method, params });
-    }
-    write(child, value) {
-        return new Promise((resolve, reject) => {
-            child.stdin.write(JSON.stringify(value) + '\n', error => error ? reject(error) : resolve());
-        });
-    }
-}