@ours.network/fleet 0.9.0 → 0.9.2

package/dist/config.d.ts

@@ -13,6 +13,13 @@ export interface MonitorConfig {
     wake_sources: string[];
     batch_ms: number;
     inject: InjectMode;
+    /**
+     * Consecutive delivered wakes that must end in an `API Error:`-terminated turn
+     * (with no completed turn in between) before `.monitor-status` degrades to
+     * `turns failing (api error)` — the refusal-wedge detector (issue #19). Must be
+     * a positive integer; resolved default is 3. Optional so old snapshots resolve.
+     */
+    turn_fail_threshold?: number;
 }
 /** Default wake sources when a role does not list its own (design §2). */
 export declare const DEFAULT_WAKE_SOURCES: NotifyEventType[];

package/dist/config.js

@@ -10,9 +10,10 @@ export const NOTIFY_EVENT_TYPES = [
 ];
 /** Default wake sources when a role does not list its own (design §2). */
 export const DEFAULT_WAKE_SOURCES = ['message_received', 'file_received', 'local_contact_request', 'pending_message'];
-const MONITOR_KEYS = ['enabled', 'wake_sources', 'batch_ms', 'inject'];
+const MONITOR_KEYS = ['enabled', 'wake_sources', 'batch_ms', 'inject', 'turn_fail_threshold'];
 const INJECT_MODES = ['notification', 'full'];
 const MONITOR_DEFAULT_BATCH_MS = 2000;
+const MONITOR_DEFAULT_TURN_FAIL_THRESHOLD = 3;
 const isPlainObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
 /** Validate a raw (role-level or merged) `monitor:` block; returns human-readable problems. */
 export function validateMonitorConfig(raw) {
@@ -30,6 +31,10 @@ export function validateMonitorConfig(raw) {
         problems.push('monitor.batch_ms: must be a non-negative number');
     if (m.inject !== undefined && !INJECT_MODES.includes(m.inject))
         problems.push(`monitor.inject: invalid value '${m.inject}'; allowed: ${INJECT_MODES.join(', ')}`);
+    if (m.turn_fail_threshold !== undefined
+        && (typeof m.turn_fail_threshold !== 'number' || !Number.isInteger(m.turn_fail_threshold)
+            || m.turn_fail_threshold < 1))
+        problems.push('monitor.turn_fail_threshold: must be a positive integer');
     if (m.wake_sources !== undefined) {
         if (!Array.isArray(m.wake_sources))
             problems.push('monitor.wake_sources: must be a list');
@@ -168,6 +173,7 @@ export function resolveMonitorConfig(defMonitor, roleMonitor, labels = {}) {
         wake_sources: merged.wake_sources ?? [...DEFAULT_WAKE_SOURCES],
         batch_ms: merged.batch_ms ?? MONITOR_DEFAULT_BATCH_MS,
         inject: merged.inject ?? 'notification',
+        turn_fail_threshold: merged.turn_fail_threshold ?? MONITOR_DEFAULT_TURN_FAIL_THRESHOLD,
     };
 }
 export function findRole(cfg, name) {

package/dist/doctor.js

@@ -6,6 +6,7 @@ import { getAdapter } from './harness/registry.js';
 import { agentDir, home, deriveXdgRuntimeDir } from './paths.js';
 import { resolveIsolation } from './isolation/policy.js';
 import { makeBubblewrapBackend } from './isolation/bubblewrap.js';
+import { authResolutionHint, resolveEndpoint, } from './monitor.js';
 /** Which cgroup-v2 controllers are delegated to this user manager (advisory). */
 function cgroupDelegationDetail() {
     try {
@@ -19,6 +20,21 @@ function cgroupDelegationDetail() {
         return 'unknown (not cgroup-v2 or no delegation info)';
     }
 }
+/** Resolve and deduplicate the effective daemon profiles used by monitored roles. */
+function resolveMonitorProfiles(roles) {
+    const profiles = [];
+    for (const role of roles.filter(r => r.monitor?.enabled)) {
+        const endpoint = resolveEndpoint({ ...process.env, ...(role.env ?? {}) });
+        const token = endpoint.headers['x-ours-api-token'];
+        const existing = profiles.find(p => p.endpoint.origin === endpoint.origin
+            && p.endpoint.headers['x-ours-api-token'] === token);
+        if (existing)
+            existing.roles.push(role.name);
+        else
+            profiles.push({ endpoint, roles: [role.name] });
+    }
+    return profiles;
+}
 /** Host-level + per-harness prerequisite report with actionable messages. */
 export async function doctor(opts = {}, exec = realExec, platform = process.platform, fetchImpl = (u, i) => globalThis.fetch(u, i)) {
     const checks = [];
@@ -110,34 +126,36 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     // Monitor daemon-API reachability (design §5): only when a role is supervised.
     // /state-dir is unauthenticated (liveness); /identities exercises the token so a
     // shared-mode misconfig (401) surfaces here rather than as a silent deaf monitor.
-    if (roles.some(r => r.monitor?.enabled)) {
-        const port = Number(process.env.OURS_PORT) || 3050;
-        const token = process.env.OURS_API_TOKEN;
-        const headers = token ? { 'x-ours-api-token': token } : {};
+    const monitorProfiles = resolveMonitorProfiles(roles);
+    for (const profile of monitorProfiles) {
+        const { endpoint } = profile;
+        const checkName = monitorProfiles.length === 1
+            ? 'monitor: daemon API'
+            : `monitor: daemon API (${profile.roles.join(', ')})`;
         let ok = false, detail;
         try {
-            const live = await fetchImpl(`http://127.0.0.1:${port}/state-dir`, {});
+            const live = await fetchImpl(`${endpoint.origin}/state-dir`, {});
             if (!live.ok) {
-                detail = `daemon on :${port} answered /state-dir with HTTP ${live.status} — not the ours daemon?`;
+                detail = `daemon on :${endpoint.port} answered /state-dir with HTTP ${live.status} — not the ours daemon?`;
             }
             else {
-                const auth = await fetchImpl(`http://127.0.0.1:${port}/identities`, { headers });
+                const auth = await fetchImpl(`${endpoint.origin}/identities`, { headers: endpoint.headers });
                 if (auth.status === 401)
-                    detail = `reachable on :${port} but the API token was rejected (401) — set OURS_API_TOKEN to the ` +
-                        `daemon's token (shared mode) or run the fleet as the daemon owner`;
+                    detail = `reachable on :${endpoint.port} but the API token was rejected (401) — ` +
+                        authResolutionHint(endpoint);
                 else if (!auth.ok)
-                    detail = `reachable on :${port} but /identities returned HTTP ${auth.status}`;
+                    detail = `reachable on :${endpoint.port} but /identities returned HTTP ${auth.status}`;
                 else {
                     ok = true;
-                    detail = `reachable on :${port}, authorized — supervisor wake stream available`;
+                    detail = `reachable on :${endpoint.port}, authorized — supervisor wake stream available`;
                 }
             }
         }
         catch (e) {
-            detail = `unreachable on :${port} — monitored roles run degraded until it is up ` +
+            detail = `unreachable on :${endpoint.port} — monitored roles run degraded until it is up ` +
                 `(start it: ours-mcp start) [${e?.message ?? e}]`;
         }
-        checks.push({ name: 'monitor: daemon API', ok, detail });
+        checks.push({ name: checkName, ok, detail });
     }
     const harnesses = opts.harness
         ? [opts.harness]

package/dist/harness/claude-code.js

@@ -38,6 +38,15 @@ export function pretrust(dir) {
     e.projectOnboardingSeenCount = Math.max(e.projectOnboardingSeenCount ?? 0, 1);
     writeFileSync(p, JSON.stringify(d, null, 2));
 }
+/**
+ * Shared Monitor-arming mandate (issue #16). Single-sourced so the briefing and
+ * the restart prompt can never diverge on how the agent must arm its monitor —
+ * it must be the Monitor TOOL, not a background Bash task (which never wakes the
+ * agent on output → an armed-looking but deaf monitor).
+ */
+const armMonitor = (id) => 'arm a **persistent Monitor** (the Monitor TOOL — NOT a background Bash command; a ' +
+    `background Bash task never wakes you on output) running \`ours-mcp watch "${id}"\` ` +
+    'so inbound ours mail wakes you';
 export function makeClaudeCodeAdapter(exec = realExec) {
     return {
         id: 'claude-code',
@@ -108,7 +117,10 @@ export function makeClaudeCodeAdapter(exec = realExec) {
             sendTool: 'send_message',
             getMessagesTool: 'get_messages',
             watchCommand: id => `ours-mcp watch "${id}"`,
-            monitorInstruction: id => `Arm a **persistent Monitor** running the shell command \`ours-mcp watch "${id}"\` so inbound ours mail wakes you.`,
+            monitorInstruction: id => {
+                const m = armMonitor(id);
+                return `${m.charAt(0).toUpperCase()}${m.slice(1)}.`;
+            },
             supervisedWakeNote: () => 'Your mail wake-ups are delivered by the fleet supervisor directly into this console as ' +
                 '`[fleet-monitor]` lines — do NOT arm an in-session Monitor. When such a line appears, run ' +
                 '**get_messages** to drain the mail.',
@@ -116,8 +128,12 @@ export function makeClaudeCodeAdapter(exec = realExec) {
             restartPrompt: (id, worklog, role) => `Session restarted. Re-bind your ours identity now (choose_identity name "${id}" force=true), ` +
                 (role?.monitor?.enabled
                     ? 'then continue from '
-                    : `re-arm your monitor (ours-mcp watch "${id}"), then continue from `) +
-                `${worklog}. Do not re-run whatever crashed you.`,
+                    : `then ${armMonitor(id)}, then continue from `) +
+                `${worklog}. Do not re-run whatever crashed you.` +
+                (role?.monitor?.enabled
+                    ? ' Your mail wakes arrive as `[fleet-monitor]` console lines from the supervisor — ' +
+                        'do NOT arm an in-session Monitor.'
+                    : ''),
         },
         exitPolicy: { cleanExitIsFresh: true, fastFailSecs: 20 },
     };

package/dist/monitor.d.ts

@@ -39,11 +39,37 @@ export interface MonitorDeps {
         clear(t: ReturnType<typeof setTimeout>): void;
     };
 }
-/** Resolve the daemon endpoint + auth header from the environment (design §6c). */
-export declare function resolveEndpoint(env: NodeJS.ProcessEnv): {
+/** Best-effort daemon config (issue #17): the fields the MCP client reads. */
+interface DaemonConfig {
+    apiToken?: string;
+    port?: number;
+    stateDir?: string;
+}
+/**
+ * Read the daemon config the way the MCP client does — best-effort. Any missing,
+ * malformed, or unreadable config yields `{}` so token resolution falls through
+ * (issue #17). Only the well-typed fields we consume are surfaced.
+ */
+export declare function readDaemonConfig(env: NodeJS.ProcessEnv): DaemonConfig;
+/**
+ * Resolve the daemon API token exactly like the MCP client (issue #17), a 3-step
+ * chain: `OURS_API_TOKEN` (trimmed) → config `apiToken` (trimmed) → the 0600 owner
+ * token at `<stateDir>/daemon-token`. Never generates a token; a failed read of
+ * any source (missing/unreadable) silently falls through to the next.
+ */
+export declare function resolveApiToken(env: NodeJS.ProcessEnv, file?: DaemonConfig): string | undefined;
+export interface DaemonEndpoint {
+    origin: string;
+    port: number;
+    configPath: string;
+    stateDir: string;
     url(name: string): string;
     headers: Record<string, string>;
-};
+}
+/** Resolve the daemon endpoint + auth header from env → config → defaults. */
+export declare function resolveEndpoint(env: NodeJS.ProcessEnv): DaemonEndpoint;
+/** Actionable, secret-free description of every token source for this profile. */
+export declare function authResolutionHint(ep: DaemonEndpoint): string;
 /** Keep only the events whose type the role asked to wake on. */
 export declare function filterEvents(events: NotifyEvent[], wakeSources: string[]): NotifyEvent[];
 /**
@@ -59,6 +85,21 @@ export declare function formatNotificationLine(events: NotifyEvent[]): string;
  * open question (a): refine empirically). A running turn is NOT modal.
  */
 export declare function looksModal(pane: string): boolean;
+/**
+ * Heuristic: did the turn shown in this pane TERMINATE in an API-level error?
+ * Claude Code renders a failed turn's tail as an `API Error:` line (a Usage-Policy
+ * refusal, a 4xx, etc.). We scan a generous tail window so the marker survives a
+ * trailing idle composer redrawn beneath it (design §3.2, refine empirically).
+ * The N-consecutive threshold in the Monitor debounces the odd false match.
+ */
+export declare function looksApiError(pane: string): boolean;
+/**
+ * Heuristic: is a turn still RUNNING in this pane? Claude Code shows a live
+ * "esc to interrupt" footer (often with an elapsed-seconds meter) while a turn
+ * streams. Absence of any running marker — and no API error — means the turn has
+ * settled (completed). Kept a positive check so a quiet idle pane reads as done.
+ */
+export declare function looksRunning(pane: string): boolean;
 export interface MonitorOpts {
     name: string;
     agentDir: string;
@@ -83,6 +124,8 @@ export declare class Monitor {
     private stopped;
     private bootDeadline;
     private currentAbort;
+    private apiErrorStreak;
+    private readonly turnFailThreshold;
     constructor(o: MonitorOpts);
     /** Prime at the stream tip (or resume a persisted cursor if the daemon is down). */
     prime(): Promise<void>;
@@ -92,6 +135,16 @@ export declare class Monitor {
     /** Gather stragglers arriving within batch_ms so a burst lands as one line. */
     private coalesce;
     private deliver;
+    /**
+     * Watch the pane until the just-triggered turn settles, then fold its outcome
+     * into the API-error streak and republish `.monitor-status`. A completed turn
+     * (or an inconclusive give-up) resets/keeps the streak; an `API Error:` tail
+     * grows it. Once the streak reaches the threshold the status degrades; a later
+     * completed turn flips it back to armed. Detection only — no remediation (#19).
+     */
+    private observeTurnOutcome;
+    /** Update the consecutive-API-error streak and derive `.monitor-status` from it. */
+    private recordTurn;
     /** Block until the console can accept input; classify offline/stopped/ready. */
     private awaitInjectable;
     private doFetch;
@@ -101,3 +154,4 @@ export declare class Monitor {
     private setStatus;
 }
 export declare function createMonitor(o: MonitorOpts): Monitor;
+export {};

package/dist/monitor.js

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
 import { join } from 'node:path';
 // Code constants (not config — YAGNI, design §2).
 const DEFAULT_PORT = 3050;
@@ -12,17 +13,88 @@ const BACKOFF_STEP_MS = 1_000;
 const BACKOFF_MAX_MS = 5_000;
 const PREFIX = '[fleet-monitor]';
 const MAX_LINE = 260;
+// Turn-outcome observation (issue #19): after a delivered wake, watch the pane
+// until the triggered turn settles, then classify it. Code constants (not config):
+const TURN_OBSERVE_POLLS = 20; // give up after ~POLLS × INTERVAL of a still-running turn
+const TURN_OBSERVE_INTERVAL_MS = 1_500;
+const DEFAULT_TURN_FAIL_THRESHOLD = 3; // fallback when the resolved config omits it
 class AuthError extends Error {
 }
-/** Resolve the daemon endpoint + auth header from the environment (design §6c). */
+/** Path to the daemon config the MCP client uses: OURS_CONFIG ?? real ~/.ours/config.json. */
+const daemonConfigPath = (env) => env.OURS_CONFIG ?? join(homedir(), '.ours', 'config.json');
+/** Match ours-mcp's env integer semantics: parseInt, invalid → absent. */
+function envInt(env, name) {
+    const raw = env[name];
+    if (raw === undefined)
+        return undefined;
+    const n = parseInt(raw, 10);
+    return Number.isNaN(n) ? undefined : n;
+}
+/**
+ * Read the daemon config the way the MCP client does — best-effort. Any missing,
+ * malformed, or unreadable config yields `{}` so token resolution falls through
+ * (issue #17). Only the well-typed fields we consume are surfaced.
+ */
+export function readDaemonConfig(env) {
+    try {
+        const p = JSON.parse(readFileSync(daemonConfigPath(env), 'utf8'));
+        const o = {};
+        if (typeof p.apiToken === 'string' && p.apiToken.trim())
+            o.apiToken = p.apiToken.trim();
+        if (typeof p.port === 'number' && Number.isFinite(p.port))
+            o.port = p.port;
+        if (typeof p.stateDir === 'string')
+            o.stateDir = p.stateDir;
+        return o;
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Resolve the daemon API token exactly like the MCP client (issue #17), a 3-step
+ * chain: `OURS_API_TOKEN` (trimmed) → config `apiToken` (trimmed) → the 0600 owner
+ * token at `<stateDir>/daemon-token`. Never generates a token; a failed read of
+ * any source (missing/unreadable) silently falls through to the next.
+ */
+export function resolveApiToken(env, file = readDaemonConfig(env)) {
+    const e = env.OURS_API_TOKEN?.trim();
+    if (e)
+        return e;
+    if (file.apiToken)
+        return file.apiToken;
+    const sd = env.OURS_STATE_DIR ?? file.stateDir ?? join(homedir(), '.ours');
+    try {
+        const t = readFileSync(join(sd, 'daemon-token'), 'utf8').trim();
+        if (t)
+            return t;
+    }
+    catch { /* missing/unreadable (e.g. cross-user 0600) → fall through */ }
+    return undefined;
+}
+/** Resolve the daemon endpoint + auth header from env → config → defaults. */
 export function resolveEndpoint(env) {
-    const port = Number(env.OURS_PORT) || DEFAULT_PORT;
-    const token = env.OURS_API_TOKEN;
+    const file = readDaemonConfig(env);
+    const port = envInt(env, 'OURS_PORT') ?? file.port ?? DEFAULT_PORT;
+    const configPath = daemonConfigPath(env);
+    const stateDir = env.OURS_STATE_DIR ?? file.stateDir ?? join(homedir(), '.ours');
+    const token = resolveApiToken(env, file);
+    const origin = `http://127.0.0.1:${port}`;
     return {
-        url: (name) => `http://127.0.0.1:${port}/identities/${encodeURIComponent(name)}/notifications`,
+        origin,
+        port,
+        configPath,
+        stateDir,
+        url: (name) => `${origin}/identities/${encodeURIComponent(name)}/notifications`,
         headers: token ? { 'x-ours-api-token': token } : {},
     };
 }
+/** Actionable, secret-free description of every token source for this profile. */
+export function authResolutionHint(ep) {
+    const tokenPath = join(ep.stateDir, 'daemon-token');
+    return `set OURS_API_TOKEN, set apiToken in ${JSON.stringify(ep.configPath)}, or ensure ` +
+        `${JSON.stringify(tokenPath)} is readable by the fleet supervisor`;
+}
 /** Keep only the events whose type the role asked to wake on. */
 export function filterEvents(events, wakeSources) {
     const set = new Set(wakeSources);
@@ -84,6 +156,31 @@ export function looksModal(pane) {
     const hasNumbered = /(^|\n)\s*[❯>]?\s*\d+[.)]\s+\S/.test(pane);
     return hasPointer && hasNumbered;
 }
+/**
+ * Heuristic: did the turn shown in this pane TERMINATE in an API-level error?
+ * Claude Code renders a failed turn's tail as an `API Error:` line (a Usage-Policy
+ * refusal, a 4xx, etc.). We scan a generous tail window so the marker survives a
+ * trailing idle composer redrawn beneath it (design §3.2, refine empirically).
+ * The N-consecutive threshold in the Monitor debounces the odd false match.
+ */
+export function looksApiError(pane) {
+    const tail = pane.split('\n').slice(-15).join('\n');
+    return /\bAPI Error\b/i.test(tail);
+}
+/**
+ * Heuristic: is a turn still RUNNING in this pane? Claude Code shows a live
+ * "esc to interrupt" footer (often with an elapsed-seconds meter) while a turn
+ * streams. Absence of any running marker — and no API error — means the turn has
+ * settled (completed). Kept a positive check so a quiet idle pane reads as done.
+ */
+export function looksRunning(pane) {
+    const tail = pane.split('\n').slice(-6).join('\n');
+    if (/esc to interrupt/i.test(tail))
+        return true; // Claude Code's running footer
+    if (/\(\s*\d+s\b/.test(tail))
+        return true; // "(12s · … tokens)" elapsed meter
+    return false;
+}
 /** Is the injected line still sitting unsubmitted in the composer (bottom of pane)? */
 function stillInComposer(pane, line) {
     const frag = line.slice(0, 48);
@@ -102,6 +199,10 @@ export class Monitor {
     stopped = false;
     bootDeadline = 0;
     currentAbort = null;
+    // Refusal-wedge detector (issue #19): consecutive delivered wakes whose turn
+    // ended in an API error with no completed turn in between.
+    apiErrorStreak = 0;
+    turnFailThreshold;
     constructor(o) {
         this.name = o.name;
         this.cfg = o.cfg;
@@ -109,6 +210,8 @@ export class Monitor {
         this.ep = resolveEndpoint(o.deps.env);
         this.statusPath = join(o.agentDir, '.monitor-status');
         this.cursorPath = join(o.agentDir, '.notify-cursor');
+        const n = o.cfg.turn_fail_threshold;
+        this.turnFailThreshold = typeof n === 'number' && n >= 1 ? n : DEFAULT_TURN_FAIL_THRESHOLD;
     }
     /** Prime at the stream tip (or resume a persisted cursor if the daemon is down). */
     async prime() {
@@ -207,7 +310,51 @@ export class Monitor {
             }
             await this.deps.tmux.sendKey(this.name, 'Enter');
         }
-        this.setStatus(delivered ? 'armed' : 'degraded: injection unverified');
+        if (!delivered) {
+            this.setStatus('degraded: injection unverified');
+            return;
+        }
+        // The wake landed and a turn started; observe how that turn terminates so a
+        // refusal-wedge (every turn dies with `API Error:` while delivery stays green)
+        // becomes visible in `.monitor-status` instead of masquerading as armed (#19).
+        await this.observeTurnOutcome(pid);
+    }
+    /**
+     * Watch the pane until the just-triggered turn settles, then fold its outcome
+     * into the API-error streak and republish `.monitor-status`. A completed turn
+     * (or an inconclusive give-up) resets/keeps the streak; an `API Error:` tail
+     * grows it. Once the streak reaches the threshold the status degrades; a later
+     * completed turn flips it back to armed. Detection only — no remediation (#19).
+     */
+    async observeTurnOutcome(pid) {
+        for (let i = 0; i < TURN_OBSERVE_POLLS; i++) {
+            if (this.stopped)
+                return; // shutting down — leave status
+            if (!this.deps.isAlive(pid) || !(await this.deps.tmux.has(this.name)))
+                return; // loop marks offline
+            const pane = await safeCapture(this.deps.tmux, this.name);
+            if (looksApiError(pane)) {
+                this.recordTurn('api-error');
+                return;
+            }
+            if (!looksRunning(pane)) {
+                this.recordTurn('completed');
+                return;
+            }
+            await this.deps.sleep(TURN_OBSERVE_INTERVAL_MS);
+        }
+        this.recordTurn('inconclusive'); // still running at give-up: hold the streak, don't re-arm
+    }
+    /** Update the consecutive-API-error streak and derive `.monitor-status` from it. */
+    recordTurn(outcome) {
+        if (outcome === 'api-error')
+            this.apiErrorStreak++;
+        else if (outcome === 'completed')
+            this.apiErrorStreak = 0;
+        // 'inconclusive' leaves the streak (and therefore the status) unchanged.
+        this.setStatus(this.apiErrorStreak >= this.turnFailThreshold
+            ? 'degraded: turns failing (api error)'
+            : 'armed');
     }
     /** Block until the console can accept input; classify offline/stopped/ready. */
     async awaitInjectable(pid) {
@@ -242,7 +389,7 @@ export class Monitor {
             this.currentAbort = null;
         }
         if (resp.status === 401)
-            throw new AuthError('daemon rejected the API token (401) — set OURS_API_TOKEN or run as the daemon owner');
+            throw new AuthError(`daemon rejected the API token (401) — ${authResolutionHint(this.ep)}`);
         if (!resp.ok)
             throw new Error(`daemon returned HTTP ${resp.status}`);
         return resp.json();

package/dist/runner.js

@@ -41,8 +41,8 @@ export function buildPaneCommand(launch, roleEnv, exitStatusPath, paneArgv = lau
     const cmd = paneArgv.map(shq).join(' ');
     return `${envPfx} ${cmd}; echo $? > ${shq(exitStatusPath)}`;
 }
-/** Adapt the runner's injected deps into the monitor's dependency surface. */
-function monitorDeps(deps) {
+/** Adapt runner deps and the role's daemon-profile overrides for the monitor. */
+function monitorDeps(deps, roleEnv) {
     return {
         fetch: deps.fetch,
         tmux: deps.tmux,
@@ -50,7 +50,9 @@ function monitorDeps(deps) {
         sleep: deps.sleep,
         now: deps.now,
         log: deps.log,
-        env: process.env,
+        // The agent pane receives role.env too. The supervisor monitor must select
+        // the same ours daemon profile, with per-role values winning over service env.
+        env: { ...process.env, ...(roleEnv ?? {}) },
         timers: { set: (fn, ms) => setTimeout(fn, ms), clear: t => clearTimeout(t) },
     };
 }
@@ -232,7 +234,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     // as disabled (monitor may be undefined on an old role.yaml).
     const monitor = role.monitor?.enabled ? deps.createMonitor({
         name, agentDir: dir, cfg: role.monitor,
-        deps: monitorDeps(deps),
+        deps: monitorDeps(deps, role.env),
     }) : null;
     if (monitor)
         await monitor.prime();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux consoles, systemd/launchd supervision, ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",