@ours.network/fleet 1.0.3 → 1.0.5

package/README.md

@@ -400,7 +400,6 @@ roles:
         max_file_bytes: 10485760         # 10 MiB
         max_request_bytes: 20971520      # 20 MiB total, and >= max_file_bytes
         retention_ms: 86400000           # stale crash cleanup; 1 minute..30 days
-        allowed_mime: [application/pdf, text/plain, image/png, audio/ogg]
     model: claude-fable-5               # launch on a specific model (pass-through id; default: launcher default)
     mission: one line
     persona: |                          # operating contract (published as persona)
@@ -967,20 +966,25 @@ message plaintext in fleet state.
 Inbound owner attachments use the same authenticated-CID and exact-wire routing
 boundary. Fleet first calls the metadata-only `listIncomingFiles`, groups a
 file-only wake or a same-sender reply-linked text caption, and checks the enabled,
-count, declared MIME, per-file size, and total-size policy before retrieving any
-bytes. It then calls selective `getFiles` only for the admitted wire IDs. An
+count, per-file size, and total-size policy before retrieving any bytes. MIME values,
+extensions, file categories, and declared-versus-detected mismatches are metadata,
+never rejection criteria. It then calls selective `getFiles` only for the admitted wire IDs. An
 unauthorized sender is ignored without retrieval or reply. A rejected authorized
 request receives a bounded reason correlated to its file wire.
 
 Retrieved files must be regular, non-symlink paths whose byte count and SHA-256
-match typed SDK metadata. Fleet additionally checks content signatures against the
-declared MIME, sanitizes traversal/control characters from names, and copies each
+match typed SDK metadata. Fleet detects recognizable content only to report metadata,
+sanitizes traversal/control characters from names, and copies each
 file into a random request-scoped directory at mode 0700 with files at mode 0600.
 The `[fleet-owner]` turn receives only bounded metadata, the private local paths,
 and an explicit daemon transcription result for voice messages. Successful
 transcripts are included; `failed` and `unavailable` states are stated plainly so
 the agent must use the audio path rather than inventing text.
 
+The legacy `attachments.allowed_mime` key is accepted and ignored so existing
+configurations continue to load. It is omitted from resolved configuration and
+cannot affect attachment admission.
+
 Request files are removed after final delivery and stale directories are removed
 after `retention_ms`. A bounded mode-0600 recovery journal stores only owner CID
 and wire routing metadata—never filenames, paths, captions, transcripts, or file
@@ -1002,11 +1006,11 @@ Managed-agent file egress is a separate trust direction. It retains the same
 metadata provenance checks, count/per-file/request byte caps, regular-file and
 no-symlink reads, actual byte-count/SHA-256 verification, filename sanitization,
 private staging, fixed owner routing, and bounded body-free recovery metadata.
-It deliberately does not consult `attachments.enabled` or `allowed_mime`; MIME is
+It deliberately does not consult `attachments.enabled`; MIME is
 still detected during byte validation, but a declared-versus-detected mismatch is
-not an egress deny gate. Markdown, HTML, octet-stream, unknown extensions, and normal
-binaries are therefore routable only from the exact configured `agent` CID.
-Owner-to-agent admission above remains byte-for-byte strict. Each outbound file
+not a deny gate in either direction. Markdown, HTML, octet-stream, unknown extensions,
+and normal binaries are therefore routable only across their authenticated direction.
+Each outbound file
 gets a durable pre-send marker: a failed/ambiguous send becomes `uncertain` and is
 not blindly retried, while files not yet attempted remain recoverable after restart.
 Logs contain counts and byte totals, never filenames or raw bytes.

package/dist/application/errors.d.ts

@@ -1,4 +1,4 @@
-export type FleetErrorCode = 'role_not_found' | 'capability_unavailable' | 'invalid_request' | 'offline' | 'control_unavailable' | 'timeout' | 'rejected' | 'backend_failure' | 'conflict' | 'stale_state' | 'prerequisite_unavailable' | 'idempotency_conflict' | 'rollback_incomplete' | 'launched_unconfirmed' | 'unauthorized' | 'forbidden' | 'rate_limited' | 'incompatible_version' | 'internal';
+export type FleetErrorCode = 'role_not_found' | 'resource_not_found' | 'capability_unavailable' | 'invalid_request' | 'offline' | 'control_unavailable' | 'timeout' | 'rejected' | 'backend_failure' | 'conflict' | 'stale_state' | 'prerequisite_unavailable' | 'idempotency_conflict' | 'rollback_incomplete' | 'launched_unconfirmed' | 'unauthorized' | 'forbidden' | 'rate_limited' | 'incompatible_version' | 'internal';
 export interface FleetErrorShape {
     code: FleetErrorCode;
     message: string;

package/dist/application/role-command-service.d.ts

@@ -1,7 +1,32 @@
-import { type OpsDeps } from '../ops.js';
+import { loadConfig } from '../config.js';
+import { restartRoles, type OpsDeps } from '../ops.js';
 import { FleetError } from './errors.js';
 import { RoleRepository } from './role-repository.js';
 import type { RoleStatus } from './types.js';
+export interface RestartBatchPlan {
+    readonly roleIds: readonly string[];
+    readonly mode: 'keep' | 'fresh';
+    readonly config: ReturnType<typeof loadConfig>;
+    readonly configPath?: string;
+}
+/** Shared restart kernel. Receipt policy and surface rendering stay with callers. */
+export declare class RoleLifecycleService {
+    private readonly options;
+    constructor(options: RoleCommandOptions);
+    prepareRestart(input: {
+        roleIds: string[];
+        mode: 'keep' | 'fresh';
+        config?: ReturnType<typeof loadConfig>;
+    }): Promise<RestartBatchPlan>;
+    executeRestart(plan: RestartBatchPlan): Promise<void>;
+    status(roleId: string): Promise<RoleStatus>;
+}
+/** Adapter-facing batch entry point used by CLI and detached Messenger workers. */
+export declare function executeRestartBatch(lifecycle: Pick<RoleLifecycleService, 'prepareRestart' | 'executeRestart'>, input: {
+    roleIds: string[];
+    mode: 'keep' | 'fresh';
+    config?: ReturnType<typeof loadConfig>;
+}): Promise<RestartBatchPlan>;
 export type LifecycleAction = 'start' | 'stop' | 'restart_resume' | 'restart_fresh';
 export interface CommandReceipt {
     actionId: string;
@@ -19,11 +44,14 @@ export interface RoleCommandOptions {
     configPath?: string;
     status(roleId: string): Promise<RoleStatus>;
     onProgress?: (receipt: CommandReceipt) => void;
+    restart?: typeof restartRoles;
+    lifecycle?: RoleLifecycleService;
 }
 export declare class RoleCommandService {
     private readonly options;
     private readonly receipts;
     private readonly locks;
+    readonly lifecycle: RoleLifecycleService;
     constructor(options: RoleCommandOptions);
     execute(input: {
         roleId: string;

package/dist/application/role-command-service.js

@@ -2,12 +2,46 @@ import { randomUUID } from 'node:crypto';
 import { loadConfig } from '../config.js';
 import { up, restartRoles } from '../ops.js';
 import { FleetError, normalizeError } from './errors.js';
+/** Shared restart kernel. Receipt policy and surface rendering stay with callers. */
+export class RoleLifecycleService {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async prepareRestart(input) {
+        const config = input.config ?? loadConfig(this.options.configPath);
+        const selected = input.roleIds.length ? input.roleIds : config.roles.map(role => role.name);
+        for (const roleId of selected) {
+            const role = await this.options.repository.get(roleId);
+            if (!role)
+                throw new FleetError('role_not_found', `no such role '${roleId}'`);
+            if (role.lifetime !== 'permanent')
+                throw new FleetError('capability_unavailable', 'lifecycle is unavailable for temporary/orphan roles');
+        }
+        return Object.freeze({
+            roleIds: Object.freeze([...input.roleIds]), mode: input.mode, config,
+            ...(this.options.configPath ? { configPath: this.options.configPath } : {}),
+        });
+    }
+    async executeRestart(plan) {
+        await (this.options.restart ?? restartRoles)(plan.config, [...plan.roleIds], this.options.ops, plan.mode, plan.configPath);
+    }
+    status(roleId) { return this.options.status(roleId); }
+}
+/** Adapter-facing batch entry point used by CLI and detached Messenger workers. */
+export async function executeRestartBatch(lifecycle, input) {
+    const plan = await lifecycle.prepareRestart(input);
+    await lifecycle.executeRestart(plan);
+    return plan;
+}
 export class RoleCommandService {
     options;
     receipts = new Map();
     locks = new Map();
+    lifecycle;
     constructor(options) {
         this.options = options;
+        this.lifecycle = options.lifecycle ?? new RoleLifecycleService(options);
     }
     async execute(input) {
         const actionId = input.actionId ?? randomUUID();
@@ -42,8 +76,13 @@ export class RoleCommandService {
                 await up(config, [receipt.roleId], this.options.ops, this.options.configPath);
             else if (receipt.action === 'stop')
                 await this.options.ops.backend.stop(receipt.roleId);
-            else
-                await restartRoles(config, [receipt.roleId], this.options.ops, receipt.action === 'restart_fresh' ? 'fresh' : 'keep', this.options.configPath);
+            else {
+                const plan = await this.lifecycle.prepareRestart({
+                    roleIds: [receipt.roleId],
+                    mode: receipt.action === 'restart_fresh' ? 'fresh' : 'keep', config,
+                });
+                await this.lifecycle.executeRestart(plan);
+            }
             try {
                 const status = await this.options.status(receipt.roleId);
                 receipt.postcondition = { overall: status.overall, observedAt: status.observedAt };

package/dist/application/role-creation-service.d.ts

@@ -1,8 +1,10 @@
 import { type CommonPermissions, type MonitorConfig, type MonitorInterrupt, type NotifyEventType } from '../config.js';
 import { type IdentityProvisioner } from '../creation.js';
-import { type SupervisorLauncher } from '../spawn.js';
+import { spawnDryRun, type SpawnOpts, type SupervisorLauncher } from '../spawn.js';
 import type { OpsDeps } from '../ops.js';
+import type { ResolvedRole } from '../config.js';
 import { FleetError } from './errors.js';
+import { type ManagedFleetSpawnResult } from '../fleet-proxy.js';
 import { type HarnessModelCatalog, type HarnessModelOption } from './model-catalog.js';
 export interface CreateRoleSessionRequest {
     name: string;
@@ -122,7 +124,20 @@ export interface RoleCreationServiceOptions {
     probeReady?: (name: string, session: 'acp' | 'tmux') => Promise<'ready' | 'attention' | 'unknown'>;
     onProgress?: (action: CreationAction) => void;
     modelCatalogs?: Partial<Record<'codex' | 'claude-code', () => HarnessModelCatalog>>;
+    /** Direct/managed callers must not create or restore the web action journal. */
+    journal?: boolean;
 }
+export type CreationPlan = {
+    origin: 'direct';
+    options: SpawnOpts;
+    preview: ReturnType<typeof spawnDryRun>;
+} | {
+    origin: 'managed';
+    options: SpawnOpts;
+    preview: ReturnType<typeof spawnDryRun>;
+    caller: string;
+    inherited: string[];
+};
 export declare class RoleCreationService {
     private readonly options;
     private readonly actions;
@@ -131,6 +146,22 @@ export declare class RoleCreationService {
     private readonly journalDir;
     private readonly identityProvisioner;
     constructor(options: RoleCreationServiceOptions);
+    previewSpawn(input: {
+        origin: 'direct';
+        options: SpawnOpts;
+    } | {
+        origin: 'managed';
+        caller: ResolvedRole;
+        options: SpawnOpts;
+    }): CreationPlan;
+    createDirect(options: SpawnOpts): Promise<{
+        plan: Extract<CreationPlan, {
+            origin: 'direct';
+        }>;
+        statePath: string;
+    }>;
+    createManaged(caller: ResolvedRole, requested: SpawnOpts): Promise<ManagedFleetSpawnResult>;
+    private launchSync;
     capabilities(): Promise<CreationCapabilities>;
     preview(input: CreateRoleSessionRequest): Promise<CreationPreview>;
     create(input: CreateRoleSessionRequest, previewHash: string, idempotencyKey: string, browserSession: string): Promise<CreationAction>;

package/dist/application/role-creation-service.js

@@ -5,8 +5,11 @@ import { loadConfig, NOTIFY_EVENT_TYPES, resolveMonitorConfig, resolveRoleModel,
 import { daemonIdentityProvisioner, } from '../creation.js';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { stateRoot } from '../paths.js';
-import { buildRoleConfig, spawnPermanent, spawnTemp, validateSpawnOpts, } from '../spawn.js';
+import { buildRoleConfig, spawnDryRun, spawnPermanent, spawnTemp, validateSpawnOpts, } from '../spawn.js';
 import { FleetError, normalizeError } from './errors.js';
+import { inheritCallerSpawnDefaults } from '../fleet-proxy.js';
+import { effectivePermissionMode } from '../permissions.js';
+import { effectiveRoleModel } from '../model-env.js';
 import { claudeModelCatalog, codexModelCatalog, } from './model-catalog.js';
 const canonical = (value) => {
     if (Array.isArray(value))
@@ -33,9 +36,46 @@ export class RoleCreationService {
     constructor(options) {
         this.options = options;
         this.journalDir = options.journalDir ?? `${stateRoot()}/web/creation-actions`;
-        mkdirSync(this.journalDir, { recursive: true, mode: 0o700 });
+        if (options.journal !== false)
+            mkdirSync(this.journalDir, { recursive: true, mode: 0o700 });
         this.identityProvisioner = options.identityProvisioner ?? daemonIdentityProvisioner();
-        this.restore();
+        if (options.journal !== false)
+            this.restore();
+    }
+    previewSpawn(input) {
+        if (input.origin === 'direct') {
+            const options = { ...input.options, surface: 'cli' };
+            return { origin: 'direct', options, preview: spawnDryRun(options) };
+        }
+        const inherited = inheritCallerSpawnDefaults(input.caller, input.options, this.options.configPath);
+        const options = { ...inherited.options, surface: 'agent',
+            callerRole: input.caller.name };
+        return { origin: 'managed', options, caller: input.caller.name,
+            inherited: inherited.inherited, preview: spawnDryRun(options) };
+    }
+    async createDirect(options) {
+        const plan = this.previewSpawn({ origin: 'direct', options });
+        return { plan, statePath: await this.launchSync(plan.options) };
+    }
+    async createManaged(caller, requested) {
+        const plan = this.previewSpawn({ origin: 'managed', caller, options: requested });
+        const creationActionId = randomUUID();
+        plan.options.creationActionId = creationActionId;
+        const statePath = await this.launchSync(plan.options);
+        return {
+            caller: plan.caller, role: plan.options.name,
+            lifetime: plan.options.temp ? 'temporary' : 'permanent', statePath,
+            harness: plan.preview.resolvedRole.harness, session: plan.preview.resolvedRole.session,
+            ...(effectiveRoleModel(plan.preview.resolvedRole) ? { model: effectiveRoleModel(plan.preview.resolvedRole) } : {}),
+            monitor: { mode: plan.preview.resolvedRole.monitor.mode, interrupt: plan.preview.resolvedRole.monitor.interrupt },
+            permissionMode: effectivePermissionMode(plan.preview.resolvedRole), inherited: plan.inherited,
+            creationActionId,
+        };
+    }
+    launchSync(options, creation) {
+        return options.temp
+            ? spawnTemp(options, this.options.binPath, this.options.tempLauncher, creation)
+            : spawnPermanent(options, this.options.ops, creation);
     }
     async capabilities() {
         const reasons = [];
@@ -216,12 +256,7 @@ export class RoleCreationService {
                     : { exists: name => this.identityProvisioner.exists(name) },
                 onStage: (stage, evidence) => this.coreStage(action, stage, evidence),
             };
-            if (preview.effective.lifetime === 'permanent') {
-                await spawnPermanent(this.spawnOptions(preview.request, action.actionId), this.options.ops, creation);
-            }
-            else {
-                await spawnTemp(this.spawnOptions(preview.request, action.actionId), this.options.binPath, this.options.tempLauncher, creation);
-            }
+            await this.launchSync(this.spawnOptions(preview.request, action.actionId), creation);
             this.stage(action, 'launched', 'launch accepted; readiness not yet confirmed');
             this.stage(action, 'identity_bootstrap_pending', preview.effective.lifetime === 'permanent'
                 ? 'fleet established the permanent identity; the harness must bind it from the generated briefing'
@@ -262,6 +297,16 @@ export class RoleCreationService {
         return 'unknown';
     }
     validate(input) {
+        const allowed = new Set([
+            'name', 'harness', 'model', 'reasoningEffort', 'session', 'cwd', 'lifetime', 'mission',
+            'coordinator', 'permissions', 'bio', 'persona', 'monitor', 'openAfterCreate',
+            'highRiskAcknowledged', 'reuseExistingIdentityAcknowledged',
+            'unverifiedIdentityAcknowledged',
+        ]);
+        const unsupported = Object.keys(input)
+            .filter(key => !allowed.has(key));
+        if (unsupported.length)
+            throw new FleetError('invalid_request', `unsupported web creation field: ${unsupported[0]}`);
         if (!ROLE_NAME_RE.test(input.name))
             throw new FleetError('invalid_request', 'invalid role name');
         if (!['codex', 'claude-code'].includes(input.harness))
@@ -316,7 +361,8 @@ export class RoleCreationService {
     }
     spawnOptions(request, creationActionId) {
         return {
-            name: request.name, identity: request.name, harness: request.harness,
+            name: request.name, temp: request.lifetime === 'temporary',
+            identity: request.name, harness: request.harness,
             model: request.model, session: request.session, cwd: request.cwd,
             reasoningEffort: request.reasoningEffort,
             mission: request.mission, coordinator: request.coordinator,

package/dist/application/role-removal-service.d.ts

@@ -19,7 +19,26 @@ export declare class RoleRemovalService {
         ops: OpsDeps;
         currentControlRole?: string;
     });
+    removeDirect(input: {
+        actor: {
+            kind: 'local_control';
+            surface: 'cli';
+        };
+        role: string;
+    }): Promise<void>;
+    previewWeb(requested: string): RoleRemovalPreview;
+    removeWeb(input: {
+        role: string;
+        confirmation?: string;
+        confirmed?: boolean;
+        coordinatorAcknowledged?: boolean;
+    }): Promise<RoleRemovalPreview & {
+        removed: true;
+        recoveryPath: string;
+    }>;
+    /** @deprecated Internal compatibility aliases; surface adapters use explicit policies above. */
     preview(requested: string): RoleRemovalPreview;
+    /** @deprecated Internal compatibility aliases; surface adapters use explicit policies above. */
     remove(input: {
         role: string;
         confirmation?: string;

package/dist/application/role-removal-service.js

@@ -9,7 +9,11 @@ export class RoleRemovalService {
     constructor(options) {
         this.options = options;
     }
-    preview(requested) {
+    async removeDirect(input) {
+        const cfg = loadConfig(this.options.configPath);
+        await rmRole(cfg, input.role, this.options.ops);
+    }
+    previewWeb(requested) {
         if (!ROLE_NAME_RE.test(requested))
             throw new FleetError('invalid_request', 'invalid role name');
         const cfg = loadConfig(this.options.configPath);
@@ -54,8 +58,8 @@ export class RoleRemovalService {
             recovery: { available: true, detail: 'State and spawned configuration are copied to the local removal archive before deletion.' },
         };
     }
-    async remove(input) {
-        const preview = this.preview(input.role);
+    async removeWeb(input) {
+        const preview = this.previewWeb(input.role);
         if (preview.selfProtected)
             throw new FleetError('forbidden', 'the current control role cannot remove itself from its own web session');
         if (preview.coordinatorProtection && !input.coordinatorAcknowledged)
@@ -84,4 +88,10 @@ export class RoleRemovalService {
         }
         return { ...preview, removed: true, recoveryPath };
     }
+    /** @deprecated Internal compatibility aliases; surface adapters use explicit policies above. */
+    preview(requested) { return this.previewWeb(requested); }
+    /** @deprecated Internal compatibility aliases; surface adapters use explicit policies above. */
+    remove(input) {
+        return this.removeWeb(input);
+    }
 }

package/dist/application/session-mutations.d.ts

@@ -0,0 +1,7 @@
+import type { InterruptOutcome, QueuedPrompt, SessionHandle, SubmitPromptOptions, TurnCancellationSource } from '../session/types.js';
+/** Thin in-process session mutation kernel. Callers retain every policy decision. */
+export declare const queueSessionPrompt: (session: SessionHandle, text: string, options?: SubmitPromptOptions) => Promise<QueuedPrompt>;
+export declare const interruptSession: (session: SessionHandle, source: TurnCancellationSource) => Promise<InterruptOutcome>;
+export declare const respondSessionPermission: (session: SessionHandle, permissionId: string, optionId: string) => boolean;
+export type GenerationPermissionResult = 'accepted' | 'stale' | 'unavailable';
+export declare const respondSessionPermissionV2: (session: SessionHandle, permissionId: string, optionId: string, sessionGeneration: string) => GenerationPermissionResult;

package/dist/application/session-mutations.js

@@ -0,0 +1,8 @@
+import { interruptOutcome } from '../session/types.js';
+/** Thin in-process session mutation kernel. Callers retain every policy decision. */
+export const queueSessionPrompt = (session, text, options) => session.queuePrompt(text, options);
+export const interruptSession = async (session, source) => interruptOutcome(await session.interrupt(source));
+export const respondSessionPermission = (session, permissionId, optionId) => session.respondPermission(permissionId, optionId);
+export const respondSessionPermissionV2 = (session, permissionId, optionId, sessionGeneration) => session.respondPermissionV2
+    ? session.respondPermissionV2(permissionId, optionId, sessionGeneration)
+    : 'unavailable';