@ours.network/fleet 0.5.2 → 0.7.0

package/README.md

@@ -26,15 +26,15 @@ reality match the file.
 
 **Harness-agnostic by design.** The core never assumes a specific agent CLI; each
 harness is a small adapter (how to launch, how to resume, how to wire config).
-**Claude Code** is wired in, and the adapter interface is public — each
-additional harness (Codex CLI, Gemini CLI, OpenCode, …) is a small adapter. A
-single fleet can mix harnesses per role:
+**Claude Code** and **Codex CLI** are wired in, and the adapter interface is
+public — each additional harness (Gemini CLI, OpenCode, …) is a small adapter.
+A single fleet can mix harnesses per role:
 
 ```yaml
 roles:
   Reviewer:                 # runs in Claude Code
     harness: claude-code
-  Prototyper:               # (future) runs elsewhere
+  Prototyper:                # runs in Codex CLI
     harness: codex
 ```
 
@@ -70,7 +70,7 @@ The state dir contract:
 |---|---|---|
 | Node ≥ 20 | runs `ours-fleet` itself | nodejs.org, `apt`, or `brew` |
 | tmux | every role's console | `apt install tmux` / `brew install tmux` |
-| a harness CLI, logged in | the agent itself | e.g. Claude Code (`claude`) |
+| a harness CLI, logged in | the agent itself | e.g. Claude Code (`claude`) or Codex CLI (`codex`) |
 | `ours-mcp` daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/mcp && ours-mcp start` |
 
 Linux only: `ours-fleet init` enables *linger* so roles run without a login session
@@ -107,6 +107,11 @@ From the shell:
 ours-fleet spawn Worker --mission "own the worker repo" \
   --bio-file bio.md --persona-file persona.md --coordinator FleetCoordinator
 ours-fleet spawn --temp Scout --mission "one-off research"   # gone on exit/reboot
+
+# Codex role: ours-codex is preferred automatically; plain codex is the fallback
+ours-fleet spawn Coder --harness codex --model gpt-5.4 \
+  --permission-mode on-request --sandbox workspace-write \
+  --profile fleet --search --monitor --coordinator FleetCoordinator
 ```
 
 Permanent spawns are written to `~/fleet.d/<Name>.yaml` — your hand-written
@@ -117,6 +122,17 @@ From inside Claude Code: install the `ours-fleet` plugin (ships in this repo und
 temp-vs-permanent, co-drafts the bio and persona with you, spawns, and arms
 oversight.
 
+From inside Codex, install the native fleet plugin:
+
+```sh
+npm i -g @ours.network/fleet-codex
+ours-fleet-codex-install
+```
+
+Start a new Codex session and say **"spawn an ours agent …"**. The bundled skill
+walks through lifetime, model, sandbox, approval policy, profile, launcher, and
+mail-monitor consent, then verifies the real tmux session and offers oversight.
+
 ## Oversight ("keep an eye")
 
 Spawned agents are subagents; their spawner (or any assigned overseer) checks on
@@ -147,7 +163,7 @@ ours-fleet up|down|restart|force-restart [-c FILE] [Name...]
 ours-fleet config [-c FILE]         validate + print merged plan
 ours-fleet ls | attach | peek | logs [-f] | status <Name>
 ours-fleet send <Name> "text" | --key <K>
-ours-fleet spawn [--temp] <Name> [--mission --model --bio-file --persona-file ...]
+ours-fleet spawn [--temp] <Name> [--harness --mission --model --permission-mode ...]
 ours-fleet rm <Name>
 ours-fleet doctor [--harness H]
 ours-fleet init
@@ -179,6 +195,18 @@ roles:
       # mem_palace: false                      # claude-code: disable memory plugin
       # permission_mode: dontAsk               # claude-code: launch permission mode —
       #   one of default | acceptEdits | plan | dontAsk | bypassPermissions
+      # sandbox: workspace-write                # codex: --sandbox —
+      #   one of read-only | workspace-write | danger-full-access
+      # approval: never                         # codex: --ask-for-approval —
+      #   one of untrusted | on-request | never
+      # permission_mode: never                  # codex alias for approval
+      # launcher: auto                          # codex: auto | ours-codex | codex
+      # profile: fleet                          # codex: $CODEX_HOME/fleet.config.toml
+      # search: true                            # codex: enable --search (live web search)
+      # add_dirs: [/data/shared]                # codex: repeat --add-dir
+      # monitor: true                           # explicit persistent consent to arm mail wake
+      # config:                                 # codex: repeat --config key=<TOML value>
+      #   model_reasoning_effort: high
     isolation:                          # OS-level sandbox (additive; omit = today's behavior)
       backend: auto                     # auto | bubblewrap | podman | none   (default auto)
       on_unavailable: warn              # warn (un-isolated + marker) | strict (refuse)   (default warn)
@@ -190,7 +218,65 @@ roles:
 
 Merge order: `fleet.yaml` ← `fleet.d/*.yaml`; a duplicate role name is a hard
 error naming both files. Identities and roles are decoupled — removing a role
-never deletes an identity.
+never deletes an identity. `defaults.harness_options` is shallow-merged with each
+role's `harness_options`, so a fleet can set common Codex permission/profile defaults
+and override individual keys per role.
+
+## Codex roles
+
+Install Codex, the native ours plugin, and the fleet skills once on the fleet host:
+
+```sh
+npm i -g @ours.network/fleet-codex
+ours-fleet-codex-install
+ours-fleet doctor --harness codex
+```
+
+A role with `harness: codex` resolves its launcher at every supervised start:
+
+1. `harness_options.launcher: auto` (the default) uses `ours-codex` when it is on
+   `PATH`, giving the role session-scoped background mail wake.
+2. If `ours-codex` is absent, it launches ordinary `codex`; the native ours plugin's
+   blocking `foreground_monitor` is used as the supported fallback.
+3. `launcher: ours-codex` makes the enhanced launcher mandatory and fails clearly if
+   it is missing; `launcher: codex` explicitly selects standard mode.
+
+Monitoring remains consent-first. By default the generated briefing asks in the role's
+console before calling `arm_monitor`. Set `harness_options.monitor: true` (or pass
+`ours-fleet spawn --monitor`) to record explicit persistent consent for that role, including
+supervised restarts. In the standard-Codex fallback, the agent separately surfaces the
+`ours-codex` recommendation before asking to enter `foreground_monitor`. It never backgrounds
+`ours-mcp watch`, because a detached watch cannot wake a Codex turn. The foreground
+wait is re-entered after each handled message; `ours-codex` instead wakes the idle
+session through its App Server integration.
+
+The main Codex controls needed by fleet roles are available declaratively and when spawning:
+
+```yaml
+defaults:
+  harness: codex
+  model: gpt-5.4
+  harness_options:
+    launcher: auto
+    profile: fleet                 # $CODEX_HOME/fleet.config.toml
+    sandbox: workspace-write
+    approval: on-request
+    monitor: true                  # explicit consent for unattended mail wake
+    search: true
+    add_dirs: [/data/shared]
+    config:
+      model_reasoning_effort: high
+
+roles:
+  Reviewer:
+    harness_options:
+      sandbox: read-only           # overrides just this default key
+```
+
+Equivalent one-off/permanent spawn controls include `--model`, `--permission-mode`,
+`--sandbox`, `--profile`, `--launcher`, `--search`, `--monitor`, repeatable
+`--codex-config key=value`, and repeatable `--add-dir`. Use `env.OURS_PORT`/`env.OURS_CONFIG` for a
+role-specific ours daemon, or configure the host default in `~/.ours/config.json`.
 
 ## Agent isolation
 
@@ -212,6 +298,8 @@ all invisible, ours messaging still works, no hard resource caps.
   unshares the network; `broker` keeps host networking so the loopback ours daemon
   stays reachable — full broker egress-hardening is a follow-up.
 - **`fs.read` / `fs.write`** — extra read-only / read-write binds on top of the durable set.
+  The durable harness credentials are selected automatically: `~/.claude*` for Claude Code,
+  or `~/.codex` plus read-only `~/.agents` for Codex.
 - **`resources`** — `mem` (→ `MemoryMax` + `MemorySwapMax=0`, a hard OOM bound),
   `cpu` cores (→ `CPUQuota`), `pids` (→ `TasksMax`). CPU degrades to a warning if the
   cpu cgroup controller isn't delegated (mem/pids still enforced).
@@ -233,7 +321,17 @@ npm run build
 
 Adding a harness = implementing `HarnessAdapter`
 (`src/harness/types.ts`) and registering it — see `src/harness/claude-code.ts`
-for the reference implementation.
+and `src/harness/codex.ts` for reference implementations.
+
+**Codex CLI resume note.** Codex assigns its own session id (there's no `--session-id`
+equivalent to pin at creation), so resume uses `codex resume --last`, which
+picks the most recently active session **in the role's `cwd`**. This works
+cleanly as long as each role has its own `cwd` (the common case); two roles
+sharing an identical `cwd` could have their resumes cross — give them distinct
+working directories if that matters. MCP and monitor wiring is provided by
+[`@ours.network/codex`](https://github.com/adapt-toolkit/ours-mcp/tree/main/packages/codex);
+the native spawn/oversight skills are provided by `@ours.network/fleet-codex`.
+`ours-fleet doctor --harness codex` verifies the CLI, ours plugin, and enhanced launcher/fallback.
 
 ## Learn more
 

package/dist/briefing.js

@@ -34,14 +34,16 @@ export function generateBriefing(role, v, opts) {
         : '   with a 1–2 sentence summary of your Charter above. Skip if it already matches.');
     L.push(`5. SET your **persona** (local operating contract, never shared in invites) via`);
     L.push(`   **${v.setPersonaTool}** with the **Charter** section above, verbatim. Skip if it matches.`);
-    L.push(`6. ${v.monitorInstruction(id)}`);
+    L.push(`6. ${v.monitorInstruction(id, role)}`);
     if (role.coordinator) {
         L.push(`7. ANNOUNCE yourself: call **${v.sendTool}** to contact "${role.coordinator}" with text:`);
-        L.push(`   "${role.name} online — identity '${id}' bound, monitor armed, ready."`);
-        L.push(`8. Await messages. When the monitor wakes you, call **${v.getMessagesTool}**, act, reply.`);
+        L.push(`   "${role.name} online — identity '${id}' bound, ready."`);
+        L.push(`8. Await messages. When the monitor wakes you (or the owner requests a manual check),`);
+        L.push(`   call **${v.getMessagesTool}**, act, and reply.`);
     }
     else {
-        L.push(`7. Await messages. When the monitor wakes you, call **${v.getMessagesTool}**, act on them,`);
+        L.push(`7. Await messages. When the monitor wakes you (or the owner requests a manual check),`);
+        L.push(`   call **${v.getMessagesTool}**, act on them,`);
         L.push(`   and reply with ${v.sendTool}. No coordinator is configured — the owner drives you`);
         L.push(`   via \`tmux attach -t ${role.name}\` or by messaging "${id}".`);
     }
@@ -67,8 +69,8 @@ export function generateBriefing(role, v, opts) {
     L.push('on messages, timers, or prompts — and follow it for recurring or scheduled work. It may');
     L.push('change between wakes without a restart; treat the file, not your memory of it, as current.');
     L.push('', '## On restart (you run under a supervised launcher)');
-    L.push(`On restart, WITHOUT asking: re-bind (**${v.bindTool}** name "${id}" force=true),`);
-    L.push(`re-arm the \`${v.watchCommand(id)}\` monitor, then continue from your WORKLOG.`);
+    L.push(`On restart, WITHOUT asking: re-bind (**${v.bindTool}** name "${id}" force=true), then`);
+    L.push(`${v.monitorInstruction(id, role)} Then continue from your WORKLOG.`);
     L.push('Do not blindly re-run whatever may have crashed you.');
     L.push('', '## House rules');
     L.push('- Never broad `rm -rf` on home/critical paths; quote globs; use explicit paths.');

package/dist/cli.d.ts

@@ -1,2 +1,3 @@
 #!/usr/bin/env node
 import './harness/claude-code.js';
+import './harness/codex.js';

package/dist/cli.js

@@ -13,6 +13,7 @@ import { runOnce, runTemp } from './runner.js';
 import { spawnPermanent, spawnTemp } from './spawn.js';
 import { doctor } from './doctor.js';
 import './harness/claude-code.js'; // registers the claude-code adapter
+import './harness/codex.js'; // registers the codex adapter
 // sudo/su shells lack XDG_RUNTIME_DIR, breaking every systemctl/journalctl
 // --user child (supervisor commands, logs, doctor). Derive it before dispatch. (#9)
 deriveXdgRuntimeDir();
@@ -39,6 +40,26 @@ const program = new Command()
     .description('Fleet of persistent, identity-bound AI agents — harness-agnostic, tmux + systemd/launchd.')
     .version(VERSION);
 const cOpt = (cmd) => cmd.option('-c, --configuration <file>', 'config file (default: ~/fleet.yaml + ~/fleet.d/)');
+const collect = (value, previous) => [...previous, value];
+function parseCodexConfig(values) {
+    if (!values?.length)
+        return undefined;
+    const out = {};
+    for (const raw of values) {
+        const i = raw.indexOf('=');
+        if (i < 1)
+            throw new Error(`invalid --codex-config '${raw}'; expected key=value`);
+        const key = raw.slice(0, i);
+        const value = raw.slice(i + 1);
+        if (value === 'true' || value === 'false')
+            out[key] = value === 'true';
+        else if (value.trim() !== '' && Number.isFinite(Number(value)))
+            out[key] = Number(value);
+        else
+            out[key] = value;
+    }
+    return out;
+}
 cOpt(program.command('config').description('validate + print the merged plan (no side effects)'))
     .action(opts => {
     try {
@@ -53,6 +74,8 @@ cOpt(program.command('config').description('validate + print the merged plan (no
                 console.log(`    cwd:         ${r.cwd}`);
             if (r.model)
                 console.log(`    model:       ${r.model}`);
+            if (r.harness_options && Object.keys(r.harness_options).length)
+                console.log(`    options:     ${JSON.stringify(r.harness_options)}`);
             if (r.coordinator)
                 console.log(`    coordinator: ${r.coordinator}`);
             if (r.mission)
@@ -164,16 +187,27 @@ cOpt(program.command('spawn <name>').description('spawn a new agent (permanent b
     .option('--cwd <dir>', 'working directory')
     .option('--coordinator <name>', 'announce target')
     .option('--model <id>', 'model id to launch on (e.g. claude-fable-5); default: launcher default')
+    .option('--permission-mode <mode>', 'harness permission mode (Codex: untrusted|on-request|never; Claude: native values)')
+    .option('--sandbox <mode>', 'Codex sandbox: read-only|workspace-write|danger-full-access')
+    .option('--profile <name>', 'Codex profile file name ($CODEX_HOME/<name>.config.toml)')
+    .option('--launcher <mode>', 'Codex launcher: auto|ours-codex|codex (default: auto)')
+    .option('--search', 'enable Codex live web search')
+    .option('--codex-config <key=value>', 'Codex config override (repeatable)', collect, [])
+    .option('--add-dir <dir>', 'additional Codex writable directory (repeatable)', collect, [])
+    .option('--monitor', 'explicitly consent to arm this Codex role\'s ours mail monitor')
     .option('--bio-file <file>', 'public bio (file)')
     .option('--persona-file <file>', 'persona / operating contract (file)')
     .action(async (name, opts) => {
-    const o = {
-        name, temp: opts.temp, harness: opts.harness, mission: opts.mission,
-        identity: opts.identity, cwd: opts.cwd, coordinator: opts.coordinator,
-        model: opts.model,
-        bioFile: opts.bioFile, personaFile: opts.personaFile, configPath: opts.configuration,
-    };
     try {
+        const o = {
+            name, temp: opts.temp, harness: opts.harness, mission: opts.mission,
+            identity: opts.identity, cwd: opts.cwd, coordinator: opts.coordinator,
+            model: opts.model,
+            permissionMode: opts.permissionMode, sandbox: opts.sandbox, profile: opts.profile,
+            launcher: opts.launcher, search: opts.search,
+            codexConfig: parseCodexConfig(opts.codexConfig), addDirs: opts.addDir, monitor: opts.monitor,
+            bioFile: opts.bioFile, personaFile: opts.personaFile, configPath: opts.configuration,
+        };
         if (o.temp) {
             const dir = await spawnTemp(o, binPath);
             console.log(`spawned temp agent '${name}' (state: ${dir}; gone on exit/reboot)`);

package/dist/config.js

@@ -62,6 +62,17 @@ export function loadConfig(configPath) {
             if (bad.length)
                 throw new ConfigError(`${file}: role '${name}' has unknown key(s) ${bad.join(', ')}; allowed: ${ROLE_KEYS.join(', ')}`);
             const isolation = r.isolation ?? defaults.isolation;
+            const defaultHarnessOptions = defaults.harness_options;
+            if (defaultHarnessOptions !== undefined
+                && (typeof defaultHarnessOptions !== 'object' || defaultHarnessOptions === null
+                    || Array.isArray(defaultHarnessOptions)))
+                throw new ConfigError(`${base}: defaults.harness_options must be a map`);
+            const harnessOptions = defaultHarnessOptions === undefined && r.harness_options === undefined
+                ? undefined
+                : {
+                    ...(defaultHarnessOptions ?? {}),
+                    ...(r.harness_options ?? {}),
+                };
             if (isolation !== undefined) {
                 const problems = validateIsolationConfig(isolation);
                 if (problems.length)
@@ -75,6 +86,7 @@ export function loadConfig(configPath) {
                 identity: r.identity ?? name,
                 model: r.model ?? defaults.model,
                 max_tokens: r.max_tokens ?? defaults.max_tokens,
+                harness_options: harnessOptions,
                 isolation,
             });
         }

package/dist/doctor.js

@@ -80,7 +80,12 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
         checks.push({ name: 'isolation: cgroup delegation', ok: true, detail: cgroupDelegationDetail() });
     for (const r of roles.filter(r => r.isolation)) {
         const stateDir = agentDir(r.name);
-        const policy = resolveIsolation(r.isolation, { stateDir, runCwd: r.cwd ?? stateDir, home: home() });
+        const policy = resolveIsolation(r.isolation, {
+            stateDir, runCwd: r.cwd ?? stateDir, home: home(), harness: r.harness,
+            additionalWriteDirs: r.harness === 'codex'
+                ? (r.harness_options?.add_dirs ?? [])
+                : [],
+        });
         const caps = [
             policy.resources.mem && `mem=${policy.resources.mem}`,
             policy.resources.cpu && `cpu=${policy.resources.cpu}`,

package/dist/harness/claude-code.js

@@ -96,7 +96,7 @@ export function makeClaudeCodeAdapter(exec = realExec) {
             const argv = mode === 'fresh'
                 ? [...base, '--session-id', s.sessionId, `Read and follow ${join(stateDir, 'briefing.md')} now.`]
                 : [...base, '--resume', s.sessionId,
-                    this.vocabulary.restartPrompt(role.identity, join(stateDir, 'WORKLOG.md'))];
+                    this.vocabulary.restartPrompt(role.identity, join(stateDir, 'WORKLOG.md'), role)];
             return { argv, env: prep.env };
         },
         vocabulary: {

package/dist/harness/codex.d.ts

@@ -0,0 +1,4 @@
+import { type Exec } from '../exec.js';
+import type { HarnessAdapter } from './types.js';
+export declare function makeCodexAdapter(exec?: Exec): HarnessAdapter;
+export declare const codexAdapter: HarnessAdapter;

package/dist/harness/codex.js

@@ -0,0 +1,223 @@
+import { join } from 'node:path';
+import { agentDir } from '../paths.js';
+import { realExec } from '../exec.js';
+import { registerAdapter } from './registry.js';
+const OPTION_KEYS = [
+    'launcher', 'sandbox', 'approval', 'permission_mode', 'search', 'profile', 'config', 'add_dirs',
+    'monitor',
+];
+const LAUNCHERS = ['auto', 'ours-codex', 'codex'];
+/** Codex CLI's accepted `--sandbox` values. */
+const SANDBOX_MODES = ['read-only', 'workspace-write', 'danger-full-access'];
+/** Codex CLI's accepted `--ask-for-approval` values. */
+const APPROVAL_POLICIES = ['untrusted', 'on-request', 'never'];
+/** Resolve & validate the per-role sandbox mode, throwing on an unknown value. */
+function sandboxMode(role) {
+    const s = role.harness_options?.sandbox;
+    if (s == null)
+        return undefined;
+    if (!SANDBOX_MODES.includes(s))
+        throw new Error(`invalid harness_options.sandbox "${s}"; allowed: ${SANDBOX_MODES.join(', ')}`);
+    return s;
+}
+/** Resolve & validate the per-role approval policy, throwing on an unknown value. */
+function approvalPolicy(role) {
+    const o = role.harness_options;
+    const a = o?.approval ?? o?.permission_mode;
+    if (a == null)
+        return undefined;
+    if (!APPROVAL_POLICIES.includes(a))
+        throw new Error(`invalid harness_options.approval "${a}"; allowed: ${APPROVAL_POLICIES.join(', ')}`);
+    return a;
+}
+function launcherMode(role) {
+    return role.harness_options?.launcher ?? 'auto';
+}
+function encodeTomlValue(value) {
+    if (typeof value === 'string')
+        return JSON.stringify(value);
+    if (typeof value === 'boolean')
+        return String(value);
+    if (typeof value === 'number' && Number.isFinite(value))
+        return String(value);
+    if (Array.isArray(value) && value.every(v => ['string', 'boolean', 'number'].includes(typeof v)))
+        return `[${value.map(encodeTomlValue).join(', ')}]`;
+    throw new Error('must be a string, finite number, boolean, or array of those values');
+}
+/** Flags shared by fresh launch and resume: model, sandbox, approval, search. */
+function commonFlags(role) {
+    const o = (role.harness_options ?? {});
+    const search = o.search === true;
+    const sm = sandboxMode(role);
+    const ap = approvalPolicy(role);
+    return [
+        ...(role.model ? ['--model', role.model] : []),
+        ...(o.profile ? ['--profile', o.profile] : []),
+        ...(sm ? ['--sandbox', sm] : []),
+        ...(ap ? ['--ask-for-approval', ap] : []),
+        ...(search ? ['--search'] : []),
+        ...(o.add_dirs ?? []).flatMap(dir => ['--add-dir', dir]),
+        ...Object.entries(o.config ?? {}).flatMap(([key, value]) => ['--config', `${key}=${encodeTomlValue(value)}`]),
+    ];
+}
+async function commandAvailable(command, exec) {
+    const r = await exec('sh', ['-c', `command -v ${command} >/dev/null 2>&1`]);
+    return r.code === 0;
+}
+function hasInstalledOursPlugin(output) {
+    try {
+        const value = JSON.parse(output);
+        return (value.installed ?? []).some(plugin => (plugin.name === 'ours' || (typeof plugin.pluginId === 'string' && plugin.pluginId.startsWith('ours@')))
+            && plugin.installed === true
+            && plugin.enabled === true);
+    }
+    catch {
+        return false;
+    }
+}
+export function makeCodexAdapter(exec = realExec) {
+    return {
+        id: 'codex',
+        supportsResume: true,
+        async checkPrereqs() {
+            const [r, hasOursCodex, plugins] = await Promise.all([
+                exec('codex', ['--version']),
+                commandAvailable('ours-codex', exec),
+                exec('codex', ['plugin', 'list', '--json']),
+            ]);
+            const ok = r.code === 0;
+            const hasOursPlugin = plugins.code === 0 && hasInstalledOursPlugin(plugins.stdout);
+            return {
+                ok: ok && hasOursPlugin,
+                checks: [
+                    {
+                        name: 'codex',
+                        ok,
+                        detail: ok ? r.stdout.trim() : 'codex CLI not found on PATH — install the Codex CLI and log in',
+                    },
+                    {
+                        name: 'ours-codex',
+                        // Optional by design: plain Codex is the supported fallback.
+                        ok: true,
+                        detail: hasOursCodex
+                            ? 'available — fleet roles use native background mail wake'
+                            : 'not found — fleet roles fall back to codex with foreground monitoring; install @ours.network/codex for background wake',
+                    },
+                    {
+                        name: 'ours plugin',
+                        ok: hasOursPlugin,
+                        detail: hasOursPlugin
+                            ? 'installed and enabled — ours tools and monitor tools are available'
+                            : 'not installed — run: npm i -g @ours.network/codex && ours-codex-install',
+                    },
+                ],
+            };
+        },
+        validateOptions(opts) {
+            if (opts == null)
+                return [];
+            if (typeof opts !== 'object' || Array.isArray(opts))
+                return [{ path: 'harness_options', message: 'must be a map' }];
+            const errs = Object.keys(opts)
+                .filter(k => !OPTION_KEYS.includes(k))
+                .map(k => ({ path: `harness_options.${k}`, message: `unknown option; allowed: ${OPTION_KEYS.join(', ')}` }));
+            const o = opts;
+            if (o.launcher != null && !LAUNCHERS.includes(o.launcher))
+                errs.push({ path: 'harness_options.launcher', message: `must be one of: ${LAUNCHERS.join(', ')}` });
+            if (o.sandbox != null && !SANDBOX_MODES.includes(o.sandbox))
+                errs.push({ path: 'harness_options.sandbox', message: `must be one of: ${SANDBOX_MODES.join(', ')}` });
+            if (o.approval != null && !APPROVAL_POLICIES.includes(o.approval))
+                errs.push({ path: 'harness_options.approval', message: `must be one of: ${APPROVAL_POLICIES.join(', ')}` });
+            if (o.permission_mode != null && !APPROVAL_POLICIES.includes(o.permission_mode))
+                errs.push({ path: 'harness_options.permission_mode', message: `must be one of: ${APPROVAL_POLICIES.join(', ')}` });
+            if (o.approval != null && o.permission_mode != null && o.approval !== o.permission_mode)
+                errs.push({ path: 'harness_options.permission_mode', message: 'conflicts with harness_options.approval' });
+            if (o.search != null && typeof o.search !== 'boolean')
+                errs.push({ path: 'harness_options.search', message: 'must be a boolean' });
+            if (o.monitor != null && typeof o.monitor !== 'boolean')
+                errs.push({ path: 'harness_options.monitor', message: 'must be a boolean' });
+            if (o.profile != null && (typeof o.profile !== 'string' || !o.profile.trim()))
+                errs.push({ path: 'harness_options.profile', message: 'must be a non-empty profile name' });
+            if (o.add_dirs != null && (!Array.isArray(o.add_dirs) || o.add_dirs.some(v => typeof v !== 'string' || !v)))
+                errs.push({ path: 'harness_options.add_dirs', message: 'must be an array of non-empty paths' });
+            if (o.config != null) {
+                if (typeof o.config !== 'object' || Array.isArray(o.config))
+                    errs.push({ path: 'harness_options.config', message: 'must be a map of Codex config keys to TOML scalar/array values' });
+                else
+                    for (const [key, value] of Object.entries(o.config)) {
+                        try {
+                            encodeTomlValue(value);
+                        }
+                        catch (e) {
+                            errs.push({ path: `harness_options.config.${key}`, message: e.message });
+                        }
+                    }
+            }
+            return errs;
+        },
+        async prepareSession(role, _dirs) {
+            const requested = launcherMode(role);
+            const hasOursCodex = await commandAvailable('ours-codex', exec);
+            if (requested === 'ours-codex' && !hasOursCodex)
+                throw new Error('harness_options.launcher is ours-codex, but ours-codex is not on PATH; install @ours.network/codex or use launcher: auto');
+            const command = requested === 'codex' ? 'codex' : hasOursCodex ? 'ours-codex' : 'codex';
+            return { argv: [], env: {}, command };
+        },
+        buildLaunch(role, mode, _s, prep) {
+            const stateDir = roleStateDir(role);
+            const flags = commonFlags(role);
+            const command = prep.command ?? 'codex';
+            const argv = mode === 'fresh'
+                ? [command, ...flags, ...prep.argv, `Read and follow ${join(stateDir, 'briefing.md')} now.`]
+                : [command, 'resume', '--last', ...flags, ...prep.argv,
+                    this.vocabulary.restartPrompt(role.identity, join(stateDir, 'WORKLOG.md'), role)];
+            return { argv, env: prep.env };
+        },
+        vocabulary: {
+            bindTool: 'choose_identity',
+            createTool: 'create_identity',
+            setBioTool: 'set_bio',
+            setPersonaTool: 'set_persona',
+            currentIdentityTool: 'current_identity',
+            sendTool: 'send_message',
+            getMessagesTool: 'get_messages',
+            watchCommand: id => `ours-mcp watch "${id}"`,
+            monitorInstruction: (id, configuredRole) => {
+                const consented = configuredRole?.harness_options?.monitor === true;
+                const consent = consented
+                    ? `The fleet owner explicitly consented in configuration with \`harness_options.monitor: true\`. ` +
+                        `Call **arm_monitor** for identity "${id}" after binding. `
+                    : `Ask the fleet owner in this console whether to arm mail monitoring for "${id}". ` +
+                        `Do not call **arm_monitor** until they explicitly say yes; if they decline, leave it ` +
+                        `disarmed and check mail only when asked. `;
+                return consent +
+                    `Under \`ours-codex\` this arms session-scoped background wake. If the tool reports that ` +
+                    `only standard Codex is available, surface its \`ours-codex\` recommendation and ask ` +
+                    `separately before calling **foreground_monitor**; that blocking wait is the supported ` +
+                    `fallback. After each arrival, call **get_messages**, handle the mail, and re-enter ` +
+                    `**foreground_monitor** while the approved monitoring session remains armed.`;
+            },
+            launchNote: name => `You were launched as the fleet role \`${name}\` under a Codex session. Confirm you are running.`,
+            restartPrompt: (id, worklog, configuredRole) => {
+                const consented = configuredRole?.harness_options?.monitor === true;
+                return `Session restarted. Re-bind your ours identity now (choose_identity name "${id}" force=true), ` +
+                    (consented
+                        ? `then call arm_monitor for "${id}"; monitor consent is persisted in fleet configuration. `
+                        : `then ask the fleet owner before arming monitoring for "${id}". `) +
+                    `If this is the native-codex fallback, follow the tool's foreground_monitor consent flow and ` +
+                    `re-enter it after handling each message. Continue from ${worklog}. Do not re-run whatever crashed you.`;
+            },
+        },
+        exitPolicy: { cleanExitIsFresh: true, fastFailSecs: 20 },
+    };
+}
+// The adapter needs the state dir for briefing/worklog paths in launch prompts.
+// Roles' state dirs are canonical: agentDir(name) — temp roles carry their dir in cwd handling
+// by the runner, which passes dirs to prepareSession; buildLaunch derives from the same rule.
+function roleStateDir(role) {
+    // Temp roles are marked by the runner via a private field to keep the interface small.
+    const temp = role.__temp === true;
+    return agentDir(role.name, temp);
+}
+export const codexAdapter = makeCodexAdapter();
+registerAdapter(codexAdapter);

package/dist/harness/types.d.ts

@@ -15,10 +15,12 @@ export interface RoleDirs {
 export interface SessionState {
     sessionId: string;
 }
-/** Extra argv/env contributed by prepareSession (overlays, trust, limits). */
+/** Extra command/argv/env contributed by prepareSession (overlays, trust, limits). */
 export interface SessionPrep {
     argv: string[];
     env: Record<string, string>;
+    /** Optional launcher selected after runtime prerequisite probing. */
+    command?: string;
 }
 export interface Launch {
     argv: string[];
@@ -34,9 +36,9 @@ export interface BriefingVocab {
     sendTool: string;
     getMessagesTool: string;
     watchCommand(identity: string): string;
-    monitorInstruction(identity: string): string;
+    monitorInstruction(identity: string, role?: ResolvedRole): string;
     launchNote(name: string): string;
-    restartPrompt(identity: string, worklogPath: string): string;
+    restartPrompt(identity: string, worklogPath: string, role?: ResolvedRole): string;
 }
 export interface ExitPolicy {
     cleanExitIsFresh: boolean;

package/dist/index.d.ts

@@ -3,6 +3,7 @@ export type { FleetConfig, ResolvedRole, RoleConfig, OverseeEntry } from './conf
 export type { HarnessAdapter, BriefingVocab, ExitPolicy, PrereqReport, PrereqCheck, SessionPrep, SessionState, Launch, RoleDirs, ValidationError, } from './harness/types.js';
 export { registerAdapter, getAdapter, knownAdapters } from './harness/registry.js';
 export { claudeCodeAdapter, makeClaudeCodeAdapter } from './harness/claude-code.js';
+export { codexAdapter, makeCodexAdapter } from './harness/codex.js';
 export { generateBriefing } from './briefing.js';
 export { pickBackend } from './supervisor/index.js';
 export type { SupervisorBackend } from './supervisor/types.js';

package/dist/index.js

@@ -1,6 +1,7 @@
 export { loadConfig, findRole, ConfigError } from './config.js';
 export { registerAdapter, getAdapter, knownAdapters } from './harness/registry.js';
 export { claudeCodeAdapter, makeClaudeCodeAdapter } from './harness/claude-code.js';
+export { codexAdapter, makeCodexAdapter } from './harness/codex.js';
 export { generateBriefing } from './briefing.js';
 export { pickBackend } from './supervisor/index.js';
 export { up, down, restartRoles, rmRole, applyRole } from './ops.js';

package/dist/isolation/policy.js

@@ -75,11 +75,20 @@ export function resolveIsolation(cfg, ctx) {
         mounts.push({ src: p, dst: p, mode: 'rw' }); };
     const addRo = (p) => { if (!mounts.some(m => m.src === p))
         mounts.push({ src: p, dst: p, mode: 'ro' }); };
-    // Durable set (always present, rw): state dir, cwd, Claude config.
+    // Durable set: state dir + cwd, then only the active harness's config/auth roots.
     addRw(stateDir);
     addRw(runCwd);
-    addRw(join(home, '.claude'));
-    addRw(join(home, '.claude.json'));
+    if (ctx.harness === 'codex') {
+        addRw(join(home, '.codex'));
+        addRo(join(home, '.agents'));
+    }
+    else {
+        // Preserve the historical default for callers that predate harness-aware contexts.
+        addRw(join(home, '.claude'));
+        addRw(join(home, '.claude.json'));
+    }
+    for (const dir of ctx.additionalWriteDirs ?? [])
+        addRw(dir);
     // Declared fs extras.
     for (const p of cfg.fs?.write ?? [])
         addRw(p);

package/dist/isolation/types.d.ts

@@ -46,6 +46,10 @@ export interface WrapContext {
     stateDir: string;
     runCwd: string;
     home: string;
+    /** Harness selects the minimum credential/config mounts needed by that CLI. */
+    harness?: string;
+    /** Harness-declared writable roots (for example Codex --add-dir). */
+    additionalWriteDirs?: string[];
     brokerEndpoint?: string;
 }
 /**

package/dist/runner.js

@@ -72,7 +72,12 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     // env prefix + exit capture in buildPaneCommand stay host-side (see §5.3).
     let paneArgv = launch.argv;
     if (role.isolation) {
-        const ctx = { stateDir: dir, runCwd, home: home() };
+        const addDirs = role.harness === 'codex'
+            ? (role.harness_options?.add_dirs ?? [])
+            : [];
+        const ctx = {
+            stateDir: dir, runCwd, home: home(), harness: role.harness, additionalWriteDirs: addDirs,
+        };
         const policy = resolveIsolation(role.isolation, ctx);
         const sel = await selectIsolationBackend(policy, deps.exec); // throws on strict + unavailable
         const degradedMarker = join(dir, '.isolation-degraded');

package/dist/spawn.d.ts

@@ -8,6 +8,14 @@ export interface SpawnOpts {
     cwd?: string;
     coordinator?: string;
     model?: string;
+    permissionMode?: string;
+    sandbox?: string;
+    profile?: string;
+    launcher?: string;
+    search?: boolean;
+    codexConfig?: Record<string, string | number | boolean>;
+    addDirs?: string[];
+    monitor?: boolean;
     bioFile?: string;
     personaFile?: string;
     overseeInterval?: string;

package/dist/spawn.js

@@ -5,7 +5,7 @@ import { stringify } from 'yaml';
 import { agentDir, fleetDDir } from './paths.js';
 import { loadConfig } from './config.js';
 import { applyRole, up } from './ops.js';
-function roleFromOpts(o) {
+function roleFromOpts(o, defaultHarness) {
     const r = {};
     if (o.harness)
         r.harness = o.harness;
@@ -19,6 +19,26 @@ function roleFromOpts(o) {
         r.mission = o.mission;
     if (o.model?.trim())
         r.model = o.model.trim();
+    const harness = o.harness ?? defaultHarness;
+    const harnessOptions = {};
+    if (o.permissionMode)
+        harnessOptions[harness === 'claude-code' ? 'permission_mode' : 'approval'] = o.permissionMode;
+    if (o.sandbox)
+        harnessOptions.sandbox = o.sandbox;
+    if (o.profile)
+        harnessOptions.profile = o.profile;
+    if (o.launcher)
+        harnessOptions.launcher = o.launcher;
+    if (o.search === true)
+        harnessOptions.search = true;
+    if (o.codexConfig && Object.keys(o.codexConfig).length)
+        harnessOptions.config = o.codexConfig;
+    if (o.addDirs?.length)
+        harnessOptions.add_dirs = o.addDirs;
+    if (o.monitor === true)
+        harnessOptions.monitor = true;
+    if (Object.keys(harnessOptions).length)
+        r.harness_options = harnessOptions;
     if (o.bioFile)
         r.bio = readFileSync(o.bioFile, 'utf8').trim();
     if (o.personaFile)
@@ -35,9 +55,12 @@ function assertNameFree(o) {
 /** Permanent spawn: persist to ~/fleet.d/<Name>.yaml, then bring it up. */
 export async function spawnPermanent(o, deps) {
     assertNameFree(o);
+    const cfg = loadConfig(o.configPath);
     mkdirSync(fleetDDir(), { recursive: true });
     const file = join(fleetDDir(), `${o.name}.yaml`);
-    writeFileSync(file, stringify({ roles: { [o.name]: roleFromOpts(o) } }));
+    writeFileSync(file, stringify({
+        roles: { [o.name]: roleFromOpts(o, cfg.defaults.harness) },
+    }));
     await up(loadConfig(o.configPath), [o.name], deps);
     return file;
 }
@@ -54,12 +77,19 @@ const detachedSupervisor = (binPath, args, dir) => {
 export async function spawnTemp(o, binPath, launch = detachedSupervisor) {
     assertNameFree(o);
     const cfg = loadConfig(o.configPath);
+    const defaultHarness = cfg.defaults.harness;
+    const fromOpts = roleFromOpts(o, defaultHarness);
+    const mergedHarnessOptions = {
+        ...(cfg.defaults.harness_options ?? {}),
+        ...(fromOpts.harness_options ?? {}),
+    };
     const role = {
-        ...roleFromOpts(o),
+        ...fromOpts,
         name: o.name,
-        harness: o.harness ?? cfg.defaults.harness ?? 'claude-code',
+        harness: o.harness ?? defaultHarness ?? 'claude-code',
         identity: o.identity ?? o.name,
         model: o.model?.trim() || cfg.defaults.model,
+        harness_options: Object.keys(mergedHarnessOptions).length ? mergedHarnessOptions : undefined,
         sourceFile: '(temp)',
     };
     const dir = applyRole(role, { temp: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.5.2",
+  "version": "0.7.0",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux consoles, systemd/launchd supervision, ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",