@ours.network/fleet 1.0.5 → 1.1.0-nightly.1

package/dist/monitor.d.ts

@@ -26,15 +26,8 @@ export type FetchLike = (url: string, init?: {
     headers?: Record<string, string>;
     signal?: AbortSignal;
 }) => Promise<FetchResponse>;
-export interface MonitorTmux {
-    has(name: string): Promise<boolean>;
-    capture(name: string, lines?: number): Promise<string>;
-    sendText(name: string, text: string): Promise<void>;
-    sendKey(name: string, key: string): Promise<void>;
-}
 export interface MonitorDeps {
     fetch: FetchLike;
-    tmux: MonitorTmux;
     isAlive(pid: number): boolean;
     sleep(ms: number): Promise<void>;
     now(): number;
@@ -45,7 +38,7 @@ export interface MonitorDeps {
         clear(t: ReturnType<typeof setTimeout>): void;
     };
     /**
-     * Structured prompt delivery used by ACP sessions. Tmux remains the fallback.
+     * Structured prompt delivery used by agent sessions.
      * `succeeded` is the turn's TERMINAL result, not merely that the session took
      * the prompt: a refused or cancelled wake was seen and not acted on, and must
      * not commit the cursor.
@@ -208,14 +201,6 @@ export declare class Monitor {
     /** Gather stragglers arriving within batch_ms so a burst lands as one line. */
     private coalesce;
     private deliver;
-    /**
-     * Watch the pane until the just-triggered turn settles, then fold its outcome
-     * into the API-error streak and republish `.monitor-status`. A completed turn
-     * (or an inconclusive give-up) resets/keeps the streak; an `API Error:` tail
-     * grows it. Once the streak reaches the threshold the status degrades; a later
-     * completed turn flips it back to armed. Detection only — no remediation (#19).
-     */
-    private observeTurnOutcome;
     /** Update the consecutive-API-error streak and derive `.monitor-status` from it. */
     private recordTurn;
     /**
@@ -226,14 +211,6 @@ export declare class Monitor {
      * the composer is cleared by hand. Best-effort: a dead pane just makes the keys
      * no-ops (delivery is still verified downstream).
      */
-    private clearComposer;
-    /**
-     * Block until the console can accept input; classify offline/stopped/ready, or
-     * `modal` when the pane still looks modal after `MODAL_GIVE_UP_MS`. The bound is
-     * what keeps a modal from wedging delivery silently: we still never `Enter` into
-     * the dialog, but the give-up is reported instead of retried forever.
-     */
-    private awaitInjectable;
     private doFetch;
     private advance;
     private persistCursor;

package/dist/monitor.js

@@ -1,7 +1,6 @@
 import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { classifyFailureText } from './model-recovery.js';
 // Code constants rather than user configuration.
 const DEFAULT_PORT = 3050;
 // The daemon normally holds for 25s, but that value is operator-configurable
@@ -522,7 +521,11 @@ export class Monitor {
     }
     async deliver(pid, batch) {
         const line = formatNotificationLine(batch);
-        if (this.deps.delivery) {
+        if (!this.deps.delivery) {
+            this.degrade('delivery', 'structured agent-session delivery is unavailable');
+            return false;
+        }
+        {
             const result = await this.deps.delivery.submit(line, { interrupt: this.cfg.interrupt });
             if (!result.succeeded) {
                 // Name the reason: "refused" and "cancelled" are the agent's answer,
@@ -540,101 +543,6 @@ export class Monitor {
                 this.recordTurn('completed');
             return true;
         }
-        // Tmux exposes no authenticated tool lifecycle. `after_tool` therefore
-        // degrades to the existing non-cancelling injection path; never guess a
-        // boundary from pane text and never send C-c for this mode.
-        if (this.cfg.interrupt === true)
-            await this.deps.tmux.sendKey(this.name, 'C-c');
-        if (this.cfg.interrupt === 'after_tool')
-            this.degrade('safe-boundary', 'after_tool unsupported by tmux; using non-cancelling delivery');
-        const state = await this.awaitInjectable(pid);
-        if (state !== 'ready') {
-            if (state === 'offline')
-                this.degrade('offline', 'offline during delivery');
-            else if (state === 'modal')
-                this.degrade('modal', `modal wedge — pane held a dialog for ` +
-                    `${MODAL_GIVE_UP_MS / 1000}s, wake not injected`);
-            return false;
-        }
-        await this.clearComposer(); // start from an empty composer
-        await this.deps.tmux.sendText(this.name, line); // send-keys -l + Enter
-        let delivered = false;
-        // Verify submission for THIS line even if stop() arrives mid-flight: the text
-        // is already in the composer and we want it submitted (at-least-once). A truly
-        // dead pane makes safeCapture return '' ⇒ not-in-composer ⇒ breaks, no wasted Enter.
-        for (let i = 0; i < MAX_ENTER_RETRIES;) {
-            await this.deps.sleep(POST_VERIFY_MS);
-            const capture = await safeCapture(this.deps.tmux, this.name);
-            if (!capture.ok) {
-                this.degrade('delivery', 'capture failed during injection verification');
-                return false;
-            }
-            // A dialog can appear after the initial send. Never let a verification
-            // retry confirm it. Wait under the same bounded modal policy as initial
-            // injection, then re-capture immediately before considering Enter.
-            if (looksModal(capture.pane)) {
-                const state = await this.awaitInjectable(pid);
-                if (state === 'ready')
-                    continue;
-                if (state === 'offline')
-                    this.degrade('offline', 'offline during injection verification');
-                else if (state === 'modal')
-                    this.degrade('modal', `modal wedge during injection verification — ` +
-                        `no Enter sent for ${MODAL_GIVE_UP_MS / 1000}s`);
-                return false;
-            }
-            if (!stillInComposer(capture.pane, line)) {
-                delivered = true;
-                break;
-            }
-            await this.deps.tmux.sendKey(this.name, 'Enter');
-            i++;
-        }
-        if (!delivered) {
-            this.degrade('delivery', 'injection unverified');
-            return false;
-        }
-        this.recover('delivery', 'modal');
-        // The wake landed and a turn started; observe how that turn terminates so a
-        // refusal-wedge (every turn dies with `API Error:` while delivery stays green)
-        // becomes visible in `.monitor-status` instead of masquerading as armed (#19).
-        const recoveryTriggered = await this.observeTurnOutcome(pid);
-        return !recoveryTriggered;
-    }
-    /**
-     * Watch the pane until the just-triggered turn settles, then fold its outcome
-     * into the API-error streak and republish `.monitor-status`. A completed turn
-     * (or an inconclusive give-up) resets/keeps the streak; an `API Error:` tail
-     * grows it. Once the streak reaches the threshold the status degrades; a later
-     * completed turn flips it back to armed. Detection only — no remediation (#19).
-     */
-    async observeTurnOutcome(pid) {
-        for (let i = 0; i < TURN_OBSERVE_POLLS; i++) {
-            if (this.stopped)
-                return false; // shutting down — leave status
-            if (!this.deps.isAlive(pid) || !(await this.deps.tmux.has(this.name)))
-                return false; // loop marks offline
-            const capture = await safeCapture(this.deps.tmux, this.name);
-            if (!capture.ok) {
-                this.degrade('delivery', 'capture failed during turn observation');
-                return false;
-            }
-            if (looksApiError(capture.pane)) {
-                const evidence = classifyFailureText(capture.pane);
-                const recoveryTriggered = evidence
-                    ? this.deps.onFailureEvidence?.(evidence) === true
-                    : false;
-                this.recordTurn('api-error');
-                return recoveryTriggered;
-            }
-            if (!looksRunning(capture.pane)) {
-                this.recordTurn('completed');
-                return false;
-            }
-            await this.deps.sleep(TURN_OBSERVE_INTERVAL_MS);
-        }
-        this.recordTurn('inconclusive'); // still running at give-up: hold the streak, don't re-arm
-        return false;
     }
     /** Update the consecutive-API-error streak and derive `.monitor-status` from it. */
     recordTurn(outcome) {
@@ -658,41 +566,6 @@ export class Monitor {
      * the composer is cleared by hand. Best-effort: a dead pane just makes the keys
      * no-ops (delivery is still verified downstream).
      */
-    async clearComposer() {
-        for (const key of COMPOSER_CLEAR_KEYS)
-            await this.deps.tmux.sendKey(this.name, key);
-    }
-    /**
-     * Block until the console can accept input; classify offline/stopped/ready, or
-     * `modal` when the pane still looks modal after `MODAL_GIVE_UP_MS`. The bound is
-     * what keeps a modal from wedging delivery silently: we still never `Enter` into
-     * the dialog, but the give-up is reported instead of retried forever.
-     */
-    async awaitInjectable(pid) {
-        let modalWaits = 0;
-        for (;;) {
-            if (this.stopped)
-                return 'stopped';
-            if (!this.deps.isAlive(pid) || !(await this.deps.tmux.has(this.name)))
-                return 'offline';
-            const now = this.deps.now();
-            if (now < this.bootDeadline) {
-                await this.deps.sleep(this.bootDeadline - now);
-                continue;
-            }
-            const capture = await safeCapture(this.deps.tmux, this.name);
-            if (!capture.ok) {
-                this.degrade('delivery', 'capture failed while checking session readiness');
-                await this.deps.sleep(MODAL_RETRY_MS);
-                continue;
-            }
-            if (!looksModal(capture.pane))
-                return 'ready';
-            if (modalWaits++ >= MAX_MODAL_WAITS)
-                return 'modal';
-            await this.deps.sleep(MODAL_RETRY_MS);
-        }
-    }
     async doFetch(since, timeoutMs, timeoutKind) {
         const ctrl = new AbortController();
         this.currentAbort = ctrl;
@@ -820,12 +693,4 @@ export class Monitor {
 export function createMonitor(o) {
     return new Monitor(o);
 }
-async function safeCapture(tmux, name) {
-    try {
-        return { ok: true, pane: await tmux.capture(name) };
-    }
-    catch {
-        return { ok: false, pane: '' };
-    }
-}
 const msg = (e) => e?.message ?? String(e);

package/dist/owner-channel/channel.d.ts

@@ -1,5 +1,5 @@
 import { type OwnerChannelConfig } from '../config.js';
-import { type SessionHandle } from '../session/types.js';
+import { type AgentSession } from '../session/types.js';
 import { type OwnerFleetOps } from './commands.js';
 import type { ManagedFleetSpawnResult } from '../fleet-proxy.js';
 import { type OursOps } from './ours-client.js';
@@ -12,7 +12,7 @@ export interface OwnerChannelOptions {
     /** Harness id of the role (e.g. 'claude-code', 'codex'); gates which slash commands may be forwarded. */
     harness: string;
     config: OwnerChannelConfig;
-    session: SessionHandle;
+    session: AgentSession;
     stateDir: string;
     env?: Record<string, string>;
     log(line: string): void;

package/dist/runner.d.ts

@@ -1,15 +1,12 @@
 import { type ResolvedRole } from './config.js';
-import type { Launch } from './harness/types.js';
-import { Tmux } from './tmux.js';
 import { type MonitorHandle, type MonitorOpts, type FetchLike } from './monitor.js';
 import { type Exec } from './exec.js';
-import { type AcpSessionOptions } from './session/acp.js';
 import { RoleControlServer } from './session/control.js';
-import type { ExitRecord, SessionHandle, TurnResult } from './session/types.js';
+import type { AgentSession, ExitRecord, TurnResult } from './session/types.js';
+import type { AgentSessionAdapter, AgentSessionStartOptions } from './harness/agent-session.js';
 import { type OwnerChannelHandle, type OwnerChannelOptions } from './owner-channel/channel.js';
 import { type OwnerBinderLease } from './owner-channel/binder.js';
 export interface RunnerDeps {
-    tmux: Tmux;
     exec: Exec;
     cpuDelegated(): boolean;
     isAlive(pid: number): boolean;
@@ -23,9 +20,10 @@ export interface RunnerDeps {
     /** Construct trusted owner ingress (injectable for lifecycle tests). */
     createOwnerChannel(opts: OwnerChannelOptions): OwnerChannelHandle;
     /** Start the ACP transport (injectable for deterministic runner lifecycle tests). */
-    startAcpSession(opts: AcpSessionOptions): Promise<SessionHandle>;
+    /** Neutral construction seam for deterministic runner lifecycle tests. */
+    startAgentSession(adapter: AgentSessionAdapter, options: AgentSessionStartOptions): Promise<AgentSession>;
     /** Construct the authenticated role control route (injectable where sockets are unavailable). */
-    createControlServer(stateDir: string, session: SessionHandle, log: (line: string) => void): Pick<RoleControlServer, 'start' | 'close' | 'setFleetSpawner' | 'setOwnerChannel' | 'setConfigReloader' | 'setLoopManager'>;
+    createControlServer(stateDir: string, session: AgentSession, log: (line: string) => void): Pick<RoleControlServer, 'start' | 'close' | 'setFleetSpawner' | 'setOwnerChannel' | 'setConfigReloader' | 'setLoopManager'>;
     /** Acquire the cross-process owner-channel binder lease before replacing the control socket. */
     acquireOwnerBinder(stateDir: string, role: string, identity: string): Promise<OwnerBinderLease>;
     /** Ask the still-authenticated predecessor to emit the fixed recovery notice. */
@@ -51,14 +49,6 @@ export declare function harnessChildEnv(role: ResolvedRole, launchEnv: Record<st
  * responsible for.
  */
 export declare function recordMonitorOwner(dir: string, owner: 'fleet' | 'native'): boolean;
-/**
- * Compose the tmux pane shell command: env prefix + argv + exit-status capture.
- * `paneArgv` defaults to `launch.argv`; when isolation is active the caller passes
- * the sandbox-wrapped argv (e.g. `bwrap … -- claude …`). The `env` prefix and the
- * `echo $? > exitfile` capture stay host-side, outside the sandbox, so the runner
- * still sees the real exit code.
- */
-export declare function buildPaneCommand(launch: Launch, roleEnv: Record<string, string> | undefined, exitStatusPath: string, paneArgv?: string[]): string;
 /**
  * Read the pane's `.exit-status`. Three shapes are accepted: the structured
  * record written above, a bare number left by a pre-upgrade pane (so an

package/dist/runner.js

@@ -5,16 +5,13 @@ import { parse } from 'yaml';
 import { agentDir, stateRoot } from './paths.js';
 import { loadConfig, findRole, isolationContextFor, resolveMonitorConfig, resolvePermissions, } from './config.js';
 import { getAdapter } from './harness/registry.js';
-import { Tmux } from './tmux.js';
 import { createMonitor, probeIdentityPresence, } from './monitor.js';
-import { realExec, shq } from './exec.js';
+import { realExec } from './exec.js';
 import { resolveIsolation } from './isolation/policy.js';
 import { selectIsolationBackend } from './isolation/registry.js';
 import { resourceArgs, cpuControllerDelegated } from './isolation/resources.js';
 import { resolveLaunchRuntime } from './isolation/runtime.js';
-import { AcpSession } from './session/acp.js';
 import { controlRequest, RoleControlServer } from './session/control.js';
-import { TmuxSession } from './session/tmux.js';
 import { ACP_CANCEL_DEADLINE_EXCEEDED, classifyShellStatus } from './session/types.js';
 import { effectiveModelForRole, modelRecoveryHeld, reconcileModelRecovery, recordModelFailure, classifyFailureText, } from './model-recovery.js';
 import { rotateWorklog } from './worklog.js';
@@ -28,7 +25,6 @@ import { effectivePermissionMode } from './permissions.js';
 import { assertModelPinReachesChild, effectiveRoleModel, repinModelEnv } from './model-env.js';
 import { archiveTempState, markTempSupervisorActive, requestedTempStopReason, } from './temp-lifecycle.js';
 const defaultDeps = () => ({
-    tmux: new Tmux(),
     exec: realExec,
     cpuDelegated: () => cpuControllerDelegated(),
     isAlive: pid => { try {
@@ -44,7 +40,7 @@ const defaultDeps = () => ({
     fetch: (url, init) => globalThis.fetch(url, init),
     createMonitor: opts => createMonitor(opts),
     createOwnerChannel: opts => new OwnerChannel(opts),
-    startAcpSession: opts => AcpSession.start(opts),
+    startAgentSession: (adapter, options) => adapter.start(options),
     createControlServer: (stateDir, session, log) => new RoleControlServer(stateDir, session, log),
     acquireOwnerBinder: (stateDir, role, identity) => acquireOwnerBinderLease(stateDir, role, identity),
     reportOwnerStartupFailure: async (stateDir) => {
@@ -133,38 +129,10 @@ export function recordMonitorOwner(dir, owner) {
     catch { /* ownership diagnostics must never take the role down */ }
     return owner === 'fleet' && previous === 'native';
 }
-/**
- * Compose the tmux pane shell command: env prefix + argv + exit-status capture.
- * `paneArgv` defaults to `launch.argv`; when isolation is active the caller passes
- * the sandbox-wrapped argv (e.g. `bwrap … -- claude …`). The `env` prefix and the
- * `echo $? > exitfile` capture stay host-side, outside the sandbox, so the runner
- * still sees the real exit code.
- */
-export function buildPaneCommand(launch, roleEnv, exitStatusPath, paneArgv = launch.argv) {
-    const env = {
-        PATH: process.env.PATH ?? '', COLORTERM: 'truecolor', ...launch.env, ...(roleEnv ?? {}),
-    };
-    delete env[OBSOLETE_OURS_AUTOSTART_ENV];
-    // Interactive panes should advertise colour even when the supervisor itself
-    // was launched with NO_COLOR. A role may still deliberately opt back in to
-    // NO_COLOR (or replace COLORTERM) through its explicit env block.
-    const unsetNoColor = Object.prototype.hasOwnProperty.call(roleEnv ?? {}, 'NO_COLOR')
-        ? '' : '-u NO_COLOR ';
-    const envPfx = 'env -u OURS_AUTOSTART ' + unsetNoColor
-        + Object.entries(env).map(([k, v]) => `${k}=${shq(v)}`).join(' ');
-    const cmd = paneArgv.map(shq).join(' ');
-    // Write a structured record, not a bare number: the wait status alone cannot
-    // say whether the file is missing because the program never exited or because
-    // nothing ever wrote it. `printf` is POSIX; no shell branching is needed
-    // because classification happens in one place, in TypeScript.
-    const record = `'{"version":1,"backend":"tmux","status":'"$__ofs"'}'`;
-    return `${envPfx} ${cmd}; __ofs=$?; printf %s ${record} > ${shq(exitStatusPath)}`;
-}
 /** Adapt runner deps and the role's daemon-profile overrides for the monitor. */
 function monitorDeps(deps, roleEnv) {
     return {
         fetch: deps.fetch,
-        tmux: deps.tmux,
         isAlive: deps.isAlive,
         sleep: deps.sleep,
         now: deps.now,
@@ -484,16 +452,9 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     writeFileSync(bootedFile, `${new Date(deps.now()).toISOString()} ${mode}\n`);
     const runCwd = role.cwd && existsSync(role.cwd) ? role.cwd : dir;
     const prep = await adapter.prepareSession(role, { stateDir: dir, runCwd });
-    const sessionBackend = role.session ?? 'tmux';
-    let launch = sessionBackend === 'acp'
-        ? (() => {
-            if (!adapter.buildAcpLaunch)
-                throw new Error(`harness '${role.harness}' does not support the ACP session backend`);
-            return adapter.buildAcpLaunch(role, prep);
-        })()
-        : adapter.buildLaunch(role, mode, { sessionId }, prep);
-    // Isolation is additive: only roles that declare `isolation:` are wrapped. The
-    // env prefix + exit capture in buildPaneCommand stay host-side.
+    const sessionBackend = role.session ?? 'acp';
+    let launch = adapter.agentSession.prepareLaunch(role, prep);
+    // Isolation is additive: only roles that declare `isolation:` are wrapped.
     let wrappedArgv = launch.argv;
     if (role.isolation) {
         // Start with the same durable context that config validation and doctor judged,
@@ -530,7 +491,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     // user unit concurrently on boot; `ours-fleet up`/restart-all bulk-start) does not
     // hit the harness/API rate limit at once. Time-based via a shared launch gate, so
     // a lone start or a solo crash-restart waits zero. Applied right before the harness
-    // launch (tmux.newSession); the cheap monitor prime still runs immediately after.
+    // agent-session start; the cheap monitor prime still runs immediately after.
     if (staggerMs > 0) {
         const slot = await reserveLaunchSlot(stateRoot(), staggerMs, deps);
         const wait = slot - deps.now();
@@ -575,7 +536,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         await monitor.prime({ resetCursor: resetMonitorCursor });
     rmSync(exitFile, { force: true });
     let pid;
-    let acpSession;
+    let agentSession;
     let control;
     let unsubscribeRecovery;
     let monitorLoop;
@@ -590,7 +551,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     let loopGeneration = JSON.stringify((role.loops ?? []).map(loop => [
         loop.name, loop.definitionHash, loop.promptHash,
     ]));
-    if (sessionBackend === 'acp') {
+    {
         const perms = role.permissions ?? resolvePermissions(undefined, undefined);
         // Say once, at startup, that this role will decide permission requests by
         // itself. Without it the only trace of an auto-denied tool call is a turn
@@ -598,34 +559,16 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         if (perms.unattended === 'deny')
             deps.log(`[${name}] permission policy: unattended=deny — with no console attached, ` +
                 `permission requests are automatically denied once each (reject_once) and the turn continues`);
-        acpSession = await deps.startAcpSession({
-            name,
-            argv: wrappedArgv,
-            cwd: runCwd,
-            env: harnessChildEnv(role, launch.env, dir),
-            stateDir: dir,
-            mode,
-            permissions: perms,
-            modeId: adapter.acpPermissionModeId?.(role),
-            // The role's declared MCP servers, and the bundled agent's `_meta`
-            // vocabulary for the options it takes no flag for. Both come from the
-            // ADAPTER and from `prep`: the ACP launch cannot carry `prep.argv`, so this
-            // is the route by which harness_options that used to be silently dropped
-            // for an ACP role actually reach the session.
-            mcpServers: adapter.acpMcpServers?.(role),
-            sessionMeta: adapter.acpSessionMeta?.(role, prep),
-            permissionMode: effectivePermissionMode(role),
-            // Provenance travels with the exact ACP launch. Keeping it out of a
-            // role-only adapter hook prevents a PATH fallback or resolver skew from
-            // claiming metadata trust for an argv it did not authenticate.
-            permissionMetadataSource: launch.permissionMetadataSource,
-            scrubObsoleteOursAutostart: true,
-            log: deps.log,
+        agentSession = await deps.startAgentSession(adapter.agentSession, {
+            role, prep,
+            launch: { ...launch, argv: wrappedArgv, env: harnessChildEnv(role, launch.env, dir) },
+            cwd: runCwd, stateDir: dir, mode, permissions: perms,
+            permissionMode: effectivePermissionMode(role), log: deps.log,
         });
-        pid = acpSession.pid;
-        arbiter = new RoleTurnArbiter(acpSession);
+        pid = agentSession.pid;
+        arbiter = new RoleTurnArbiter(agentSession);
         sessionHandle = arbiter;
-        unsubscribeRecovery = acpSession.subscribe(event => {
+        unsubscribeRecovery = agentSession.subscribe(event => {
             if (event.kind !== 'error' || !event.text)
                 return;
             const evidence = classifyFailureText(event.text, 'acp', new Date(deps.now()).toISOString());
@@ -647,7 +590,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                             + `${notifyError?.message ?? String(notifyError)}`);
                     }
                 }
-                await acpSession.close();
+                await agentSession.close();
                 unsubscribeRecovery?.();
                 throw new Error(`[${name}] owner channel failed to start: `
                     + `${error?.message ?? String(error)}`);
@@ -659,7 +602,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         }
         catch (error) {
             ownerBinder?.release();
-            await acpSession.close();
+            await agentSession.close();
             unsubscribeRecovery?.();
             throw error;
         }
@@ -740,7 +683,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         const started = await starting;
         // A temporary role's first turn can be the active turn when an ours wake
         // needs immediate attention. A typed console/monitor cancellation ends
-        // only that turn: the already-live ACP session and any queued wake remain
+        // only that turn: the already-live agent session and any queued wake remain
         // valid. Keep every unproven cancellation, refusal, shutdown, and genuine
         // failure terminal so a role that never accepted its briefing is not
         // silently reported as healthy.
@@ -749,7 +692,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             monitor?.stop();
             await control.close();
             ownerBinder?.release();
-            await acpSession.close();
+            await agentSession.close();
             unsubscribeRecovery?.();
             if (modelRecovery) {
                 if (monitorLoop)
@@ -795,7 +738,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
                 await ownerChannel.close().catch(() => undefined);
                 await control.close();
                 ownerBinder?.release();
-                await acpSession.close();
+                await agentSession.close();
                 unsubscribeRecovery?.();
                 throw new Error(`[${name}] owner channel failed to start: `
                     + `${error?.message ?? String(error)}`);
@@ -854,20 +797,6 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             }
         }
     }
-    else {
-        await deps.tmux.kill(name);
-        await deps.tmux.newSession(name, runCwd, buildPaneCommand(launch, role.env, exitFile, wrappedArgv));
-        let panePid = null;
-        for (let i = 0; i < 40 && panePid === null; i++) {
-            panePid = await deps.tmux.panePid(name);
-            if (panePid === null)
-                await deps.sleep(250);
-        }
-        if (panePid === null)
-            throw new Error(`[${name}] could not resolve tmux pane pid`);
-        pid = panePid;
-        sessionHandle = new TmuxSession(name, pid, deps.tmux, deps.isAlive);
-    }
     deps.log(`[${name}] up; pid=${pid} cwd=${runCwd} harness=${role.harness} session=${sessionBackend} mode=${mode}`);
     // The monitor loop lives exactly as long as the session: it starts once the
     // pane pid is known and is stopped when that pid dies (task dies with runner).
@@ -899,7 +828,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             else if (presence.state === 'absent' && identityObserved) {
                 identityAbsentSince ??= now;
                 // Require a continuous, time-bounded run of authoritative absence.
-                // The first positive observation is the readiness gate: cold tmux
+                // The first positive observation is the readiness gate: cold harness
                 // starts may spend minutes loading the harness and briefing before the
                 // agent creates/binds its identity, and absence before then is not a
                 // close event. After readiness, debounce a real disappearance.
@@ -948,19 +877,14 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         await monitorLoop;
     }
     unsubscribeRecovery?.();
-    if (acpSession && !sessionClosed)
-        await acpSession.close();
+    if (agentSession && !sessionClosed)
+        await agentSession.close();
     const elapsed = (deps.now() - start) / 1000;
     // Establish what actually happened before deciding anything. Absence of a
     // record is `unknown` — except when the console itself is gone, which is a
     // different event with a different consequence.
-    const exitRecord = acpSession
-        ? acpSession.exitResult()
-            ?? { version: 1, class: 'unknown', detail: 'the ACP agent stopped without reporting an exit' }
-        : readExitRecord(exitFile)
-            ?? (await deps.tmux.has(name)
-                ? { version: 1, class: 'unknown', detail: 'the pane process ended without writing an exit record' }
-                : { version: 1, class: 'session-destroyed', detail: `the tmux session '${name}' no longer exists` });
+    const exitRecord = agentSession.exitResult()
+        ?? { version: 1, class: 'unknown', detail: 'the agent session stopped without reporting an exit' };
     writeFileSync(exitFile, JSON.stringify({
         ...exitRecord, at: new Date(deps.now()).toISOString(), elapsedSecs: Number(elapsed.toFixed(1)),
     }) + '\n');

package/dist/session/acp.d.ts

@@ -3,7 +3,7 @@ import type { CommonPermissions } from '../config.js';
 import type { AcpMcpServer } from '../harness/types.js';
 import { ConversationEventStore } from './conversation-store.js';
 import type { ConversationSnapshot, PromptOrigin, PromptReceipt, SubmitPromptCommand } from './conversation-types.js';
-import type { ConversationHandlePage, ExitRecord, InterruptOutcome, QueuedPrompt, SessionEvent, RuntimeSelectorMetadata, SessionHandle, SessionSnapshot, SubmitPromptOptions, TurnCancellationSource, TurnOutcome, TurnResult } from './types.js';
+import type { ConversationHandlePage, ExitRecord, InterruptOutcome, QueuedPrompt, SessionEvent, AgentSession, RuntimeSelectorMetadata, SessionSnapshot, SubmitPromptOptions, TurnCancellationSource, TurnOutcome, TurnResult } from './types.js';
 /** Bound safe-boundary waiting without turning a hung tool into cancellation. */
 export declare const AFTER_TOOL_BOUNDARY_TIMEOUT_MS = 120000;
 /**
@@ -81,7 +81,7 @@ export declare function classifyStopReason(stopReason: string | undefined): Turn
  * Persistent ACP v1 client. It is the sole owner of the agent's stdio; all
  * human/automation attachment happens through the fleet role-control protocol.
  */
-export declare class AcpSession implements SessionHandle {
+export declare class AcpSession implements AgentSession {
     private readonly options;
     readonly backend: "acp";
     readonly pid: number;

package/dist/session/acp.js

@@ -281,8 +281,7 @@ export class AcpSession {
                 clearTimeout(this.cancelForceKill);
             this.cancelForceKill = undefined;
             this.releaseSteeringOccupancy('adapter exited');
-            // Record the child's real exit code/signal. The tmux path can only see a
-            // shell's `$?`; here the truth is available, so keep it.
+            // Record the child's real exit code/signal while the truth is available.
             const classified = classifyChildExit(code, signal);
             this.exit = this.cancelRecoveryReason
                 ? { ...classified, detail: `${this.cancelRecoveryReason}; ${classified.detail}` }
@@ -1476,7 +1475,7 @@ export class AcpSession {
             ...(normalized.adapterMeta ? { adapterMeta: normalized.adapterMeta } : {}),
         });
     }
-    // ── conversation ledger access (SessionHandle) ─────────────────────────────
+    // ── conversation ledger access (AgentSession) ─────────────────────────────
     conversationPage(request = {}) {
         const floor = Number(this.conversationStartCursor ?? 0);
         const requested = Number(request.after ?? 0);

package/dist/session/activity.d.ts

@@ -18,9 +18,8 @@ export interface ObservedActivity {
     lastUpdateAt?: string;
 }
 /**
- * Classify agent-side activity. `unobservable` is NOT `quiet`: a backend that
- * cannot see the agent (tmux) has no evidence, and no evidence must never be
- * reported as "doing nothing".
+ * Classify agent-side activity. `unobservable` is NOT `quiet`: absent evidence
+ * must never be reported as "doing nothing".
  */
 export declare function classifyActivity(activity: SessionActivity | undefined, now?: number): ObservedActivity;
 /**

package/dist/session/activity.js

@@ -11,9 +11,8 @@
  */
 export const ACTIVITY_WINDOW_MS = 60_000;
 /**
- * Classify agent-side activity. `unobservable` is NOT `quiet`: a backend that
- * cannot see the agent (tmux) has no evidence, and no evidence must never be
- * reported as "doing nothing".
+ * Classify agent-side activity. `unobservable` is NOT `quiet`: absent evidence
+ * must never be reported as "doing nothing".
  */
 export function classifyActivity(activity, now = Date.now()) {
     if (!activity)

package/dist/session/arbiter.d.ts

@@ -1,4 +1,4 @@
-import type { ConversationHandlePage, ExitRecord, InterruptOutcome, PromptOrigin, QueuedPrompt, SessionEvent, SessionHandle, SessionSnapshot, SubmitPromptOptions, TurnCancellationSource, TurnResult } from './types.js';
+import type { ConversationHandlePage, ExitRecord, InterruptOutcome, PromptOrigin, QueuedPrompt, SessionEvent, AgentSession, SessionSnapshot, SubmitPromptOptions, TurnCancellationSource, TurnResult } from './types.js';
 import type { ConversationEventV1, ConversationSnapshot, PromptReceipt, SubmitPromptCommand } from './conversation-types.js';
 export type ScheduledAttempt = {
     state: 'started';
@@ -15,9 +15,9 @@ export type ScheduledAttempt = {
  * producers retain ACP queue semantics while making their unsettled claim
  * visible before another producer can inspect idle state.
  */
-export declare class RoleTurnArbiter implements SessionHandle {
+export declare class RoleTurnArbiter implements AgentSession {
     private readonly session;
-    readonly backend: import("../config.js").SessionBackendId;
+    readonly backend: "acp";
     readonly pid: number;
     private tail;
     private unsettled;
@@ -26,7 +26,7 @@ export declare class RoleTurnArbiter implements SessionHandle {
     private generation;
     /** Resolves the instant the CURRENT generation is retired. */
     private retirement;
-    constructor(session: SessionHandle);
+    constructor(session: AgentSession);
     /**
      * Waiters race the tail against their own generation's retirement, so a
      * single operation that never settles cannot own the boundary forever. A