@ours.network/fleet 1.0.5 → 1.1.0-nightly.2

package/dist/init-guidance.d.ts

@@ -0,0 +1 @@
+export declare const INIT_COMPLETION_GUIDANCE = "\nNext:\n  cp \"$(npm root -g)/@ours.network/fleet/examples/fleet.yaml\" ~/fleet.yaml\n  cp -R \"$(npm root -g)/@ours.network/fleet/examples/fleet\" ~/fleet\n  edit ~/fleet.yaml and ~/fleet/{agents,roles,brains}/*.yaml, then: ours-fleet up";

package/dist/init-guidance.js

@@ -0,0 +1,5 @@
+export const INIT_COMPLETION_GUIDANCE = `
+Next:
+  cp "$(npm root -g)/@ours.network/fleet/examples/fleet.yaml" ~/fleet.yaml
+  cp -R "$(npm root -g)/@ours.network/fleet/examples/fleet" ~/fleet
+  edit ~/fleet.yaml and ~/fleet/{agents,roles,brains}/*.yaml, then: ours-fleet up`;

package/dist/isolation/resources.d.ts

@@ -4,13 +4,9 @@ export interface ResourceArgs {
     warnings: string[];
 }
 /**
- * Build the `systemd-run --user --scope -p … --` prefix that caps the pane's
- * cgroup-v2 scope. Composed OUTSIDE the sandbox wrap: a tmux pane is
- * a child of a tmux SERVER rather than of the role's own runner process, so the
- * only reliable per-agent limit is a transient scope at the pane itself. (Since
- * #32 that server is per role rather than fleet-wide, which is what keeps one
- * role's `stop` off every other role's pane — the limit still belongs on the
- * pane.)
+ * Build the `systemd-run --user --scope -p … --` prefix that caps the agent
+ * process's cgroup-v2 scope. It composes outside the sandbox wrapper so both
+ * the adapter and its sandboxed child remain inside the transient scope.
  *
  * mem/pids are always enforced (their controllers are delegated to `--user` by
  * default). cpu degrades to a warning when the cpu controller is not delegated.

package/dist/isolation/resources.js

@@ -1,12 +1,8 @@
 import { readFileSync } from 'node:fs';
 /**
- * Build the `systemd-run --user --scope -p … --` prefix that caps the pane's
- * cgroup-v2 scope. Composed OUTSIDE the sandbox wrap: a tmux pane is
- * a child of a tmux SERVER rather than of the role's own runner process, so the
- * only reliable per-agent limit is a transient scope at the pane itself. (Since
- * #32 that server is per role rather than fleet-wide, which is what keeps one
- * role's `stop` off every other role's pane — the limit still belongs on the
- * pane.)
+ * Build the `systemd-run --user --scope -p … --` prefix that caps the agent
+ * process's cgroup-v2 scope. It composes outside the sandbox wrapper so both
+ * the adapter and its sandboxed child remain inside the transient scope.
  *
  * mem/pids are always enforced (their controllers are delegated to `--user` by
  * default). cpu degrades to a warning when the cpu controller is not delegated.

package/dist/model-env.d.ts

@@ -3,15 +3,13 @@ import type { ResolvedRole } from './config.js';
  * Which environment variable a harness reads to pin the model it RUNS.
  *
  * This is not a convenience: for `claude-code` it is the only channel that
- * reaches the ACP backend at all. `buildLaunch` (tmux) passes `--model`, but
- * `buildAcpLaunch` launches the ACP adapter with no model argument, and that
- * adapter resolves its model in this order — ANTHROPIC_MODEL, then
+ * reaches the Claude Code ACP adapter. The adapter resolves its model in this
+ * order — ANTHROPIC_MODEL, then
  * `settings.model`, then a resumed session's live model, then its first
  * catalogue entry. A role's declared model was therefore invisible to every
  * ACP role, and a fleet-wide `defaults.env.ANTHROPIC_MODEL` silently outranked
  * an explicitly requested one.
  */
-export declare const MODEL_ENV_BY_HARNESS: Readonly<Record<string, string>>;
 /** The model-pin variable for a harness, or undefined if it pins no model by env. */
 export declare function modelEnvVar(harness: string | undefined): string | undefined;
 export interface RoleModelEnvInput {

package/dist/model-env.js

@@ -1,21 +1,18 @@
+import { getAdapter } from './harness/registry.js';
 /**
  * Which environment variable a harness reads to pin the model it RUNS.
  *
  * This is not a convenience: for `claude-code` it is the only channel that
- * reaches the ACP backend at all. `buildLaunch` (tmux) passes `--model`, but
- * `buildAcpLaunch` launches the ACP adapter with no model argument, and that
- * adapter resolves its model in this order — ANTHROPIC_MODEL, then
+ * reaches the Claude Code ACP adapter. The adapter resolves its model in this
+ * order — ANTHROPIC_MODEL, then
  * `settings.model`, then a resumed session's live model, then its first
  * catalogue entry. A role's declared model was therefore invisible to every
  * ACP role, and a fleet-wide `defaults.env.ANTHROPIC_MODEL` silently outranked
  * an explicitly requested one.
  */
-export const MODEL_ENV_BY_HARNESS = {
-    'claude-code': 'ANTHROPIC_MODEL',
-};
 /** The model-pin variable for a harness, or undefined if it pins no model by env. */
 export function modelEnvVar(harness) {
-    return harness === undefined ? undefined : MODEL_ENV_BY_HARNESS[harness];
+    return harness === undefined ? undefined : getAdapter(harness).agentSession.modelEnvironmentVariable();
 }
 /**
  * Resolve a role's environment and its runtime model TOGETHER, so the two can

package/dist/monitor.d.ts

@@ -26,15 +26,8 @@ export type FetchLike = (url: string, init?: {
     headers?: Record<string, string>;
     signal?: AbortSignal;
 }) => Promise<FetchResponse>;
-export interface MonitorTmux {
-    has(name: string): Promise<boolean>;
-    capture(name: string, lines?: number): Promise<string>;
-    sendText(name: string, text: string): Promise<void>;
-    sendKey(name: string, key: string): Promise<void>;
-}
 export interface MonitorDeps {
     fetch: FetchLike;
-    tmux: MonitorTmux;
     isAlive(pid: number): boolean;
     sleep(ms: number): Promise<void>;
     now(): number;
@@ -45,7 +38,7 @@ export interface MonitorDeps {
         clear(t: ReturnType<typeof setTimeout>): void;
     };
     /**
-     * Structured prompt delivery used by ACP sessions. Tmux remains the fallback.
+     * Structured prompt delivery used by agent sessions.
      * `succeeded` is the turn's TERMINAL result, not merely that the session took
      * the prompt: a refused or cancelled wake was seen and not acted on, and must
      * not commit the cursor.
@@ -208,14 +201,6 @@ export declare class Monitor {
     /** Gather stragglers arriving within batch_ms so a burst lands as one line. */
     private coalesce;
     private deliver;
-    /**
-     * Watch the pane until the just-triggered turn settles, then fold its outcome
-     * into the API-error streak and republish `.monitor-status`. A completed turn
-     * (or an inconclusive give-up) resets/keeps the streak; an `API Error:` tail
-     * grows it. Once the streak reaches the threshold the status degrades; a later
-     * completed turn flips it back to armed. Detection only — no remediation (#19).
-     */
-    private observeTurnOutcome;
     /** Update the consecutive-API-error streak and derive `.monitor-status` from it. */
     private recordTurn;
     /**
@@ -226,14 +211,6 @@ export declare class Monitor {
      * the composer is cleared by hand. Best-effort: a dead pane just makes the keys
      * no-ops (delivery is still verified downstream).
      */
-    private clearComposer;
-    /**
-     * Block until the console can accept input; classify offline/stopped/ready, or
-     * `modal` when the pane still looks modal after `MODAL_GIVE_UP_MS`. The bound is
-     * what keeps a modal from wedging delivery silently: we still never `Enter` into
-     * the dialog, but the give-up is reported instead of retried forever.
-     */
-    private awaitInjectable;
     private doFetch;
     private advance;
     private persistCursor;

package/dist/monitor.js

@@ -1,7 +1,6 @@
 import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { classifyFailureText } from './model-recovery.js';
 // Code constants rather than user configuration.
 const DEFAULT_PORT = 3050;
 // The daemon normally holds for 25s, but that value is operator-configurable
@@ -522,7 +521,11 @@ export class Monitor {
     }
     async deliver(pid, batch) {
         const line = formatNotificationLine(batch);
-        if (this.deps.delivery) {
+        if (!this.deps.delivery) {
+            this.degrade('delivery', 'structured agent-session delivery is unavailable');
+            return false;
+        }
+        {
             const result = await this.deps.delivery.submit(line, { interrupt: this.cfg.interrupt });
             if (!result.succeeded) {
                 // Name the reason: "refused" and "cancelled" are the agent's answer,
@@ -540,101 +543,6 @@ export class Monitor {
                 this.recordTurn('completed');
             return true;
         }
-        // Tmux exposes no authenticated tool lifecycle. `after_tool` therefore
-        // degrades to the existing non-cancelling injection path; never guess a
-        // boundary from pane text and never send C-c for this mode.
-        if (this.cfg.interrupt === true)
-            await this.deps.tmux.sendKey(this.name, 'C-c');
-        if (this.cfg.interrupt === 'after_tool')
-            this.degrade('safe-boundary', 'after_tool unsupported by tmux; using non-cancelling delivery');
-        const state = await this.awaitInjectable(pid);
-        if (state !== 'ready') {
-            if (state === 'offline')
-                this.degrade('offline', 'offline during delivery');
-            else if (state === 'modal')
-                this.degrade('modal', `modal wedge — pane held a dialog for ` +
-                    `${MODAL_GIVE_UP_MS / 1000}s, wake not injected`);
-            return false;
-        }
-        await this.clearComposer(); // start from an empty composer
-        await this.deps.tmux.sendText(this.name, line); // send-keys -l + Enter
-        let delivered = false;
-        // Verify submission for THIS line even if stop() arrives mid-flight: the text
-        // is already in the composer and we want it submitted (at-least-once). A truly
-        // dead pane makes safeCapture return '' ⇒ not-in-composer ⇒ breaks, no wasted Enter.
-        for (let i = 0; i < MAX_ENTER_RETRIES;) {
-            await this.deps.sleep(POST_VERIFY_MS);
-            const capture = await safeCapture(this.deps.tmux, this.name);
-            if (!capture.ok) {
-                this.degrade('delivery', 'capture failed during injection verification');
-                return false;
-            }
-            // A dialog can appear after the initial send. Never let a verification
-            // retry confirm it. Wait under the same bounded modal policy as initial
-            // injection, then re-capture immediately before considering Enter.
-            if (looksModal(capture.pane)) {
-                const state = await this.awaitInjectable(pid);
-                if (state === 'ready')
-                    continue;
-                if (state === 'offline')
-                    this.degrade('offline', 'offline during injection verification');
-                else if (state === 'modal')
-                    this.degrade('modal', `modal wedge during injection verification — ` +
-                        `no Enter sent for ${MODAL_GIVE_UP_MS / 1000}s`);
-                return false;
-            }
-            if (!stillInComposer(capture.pane, line)) {
-                delivered = true;
-                break;
-            }
-            await this.deps.tmux.sendKey(this.name, 'Enter');
-            i++;
-        }
-        if (!delivered) {
-            this.degrade('delivery', 'injection unverified');
-            return false;
-        }
-        this.recover('delivery', 'modal');
-        // The wake landed and a turn started; observe how that turn terminates so a
-        // refusal-wedge (every turn dies with `API Error:` while delivery stays green)
-        // becomes visible in `.monitor-status` instead of masquerading as armed (#19).
-        const recoveryTriggered = await this.observeTurnOutcome(pid);
-        return !recoveryTriggered;
-    }
-    /**
-     * Watch the pane until the just-triggered turn settles, then fold its outcome
-     * into the API-error streak and republish `.monitor-status`. A completed turn
-     * (or an inconclusive give-up) resets/keeps the streak; an `API Error:` tail
-     * grows it. Once the streak reaches the threshold the status degrades; a later
-     * completed turn flips it back to armed. Detection only — no remediation (#19).
-     */
-    async observeTurnOutcome(pid) {
-        for (let i = 0; i < TURN_OBSERVE_POLLS; i++) {
-            if (this.stopped)
-                return false; // shutting down — leave status
-            if (!this.deps.isAlive(pid) || !(await this.deps.tmux.has(this.name)))
-                return false; // loop marks offline
-            const capture = await safeCapture(this.deps.tmux, this.name);
-            if (!capture.ok) {
-                this.degrade('delivery', 'capture failed during turn observation');
-                return false;
-            }
-            if (looksApiError(capture.pane)) {
-                const evidence = classifyFailureText(capture.pane);
-                const recoveryTriggered = evidence
-                    ? this.deps.onFailureEvidence?.(evidence) === true
-                    : false;
-                this.recordTurn('api-error');
-                return recoveryTriggered;
-            }
-            if (!looksRunning(capture.pane)) {
-                this.recordTurn('completed');
-                return false;
-            }
-            await this.deps.sleep(TURN_OBSERVE_INTERVAL_MS);
-        }
-        this.recordTurn('inconclusive'); // still running at give-up: hold the streak, don't re-arm
-        return false;
     }
     /** Update the consecutive-API-error streak and derive `.monitor-status` from it. */
     recordTurn(outcome) {
@@ -658,41 +566,6 @@ export class Monitor {
      * the composer is cleared by hand. Best-effort: a dead pane just makes the keys
      * no-ops (delivery is still verified downstream).
      */
-    async clearComposer() {
-        for (const key of COMPOSER_CLEAR_KEYS)
-            await this.deps.tmux.sendKey(this.name, key);
-    }
-    /**
-     * Block until the console can accept input; classify offline/stopped/ready, or
-     * `modal` when the pane still looks modal after `MODAL_GIVE_UP_MS`. The bound is
-     * what keeps a modal from wedging delivery silently: we still never `Enter` into
-     * the dialog, but the give-up is reported instead of retried forever.
-     */
-    async awaitInjectable(pid) {
-        let modalWaits = 0;
-        for (;;) {
-            if (this.stopped)
-                return 'stopped';
-            if (!this.deps.isAlive(pid) || !(await this.deps.tmux.has(this.name)))
-                return 'offline';
-            const now = this.deps.now();
-            if (now < this.bootDeadline) {
-                await this.deps.sleep(this.bootDeadline - now);
-                continue;
-            }
-            const capture = await safeCapture(this.deps.tmux, this.name);
-            if (!capture.ok) {
-                this.degrade('delivery', 'capture failed while checking session readiness');
-                await this.deps.sleep(MODAL_RETRY_MS);
-                continue;
-            }
-            if (!looksModal(capture.pane))
-                return 'ready';
-            if (modalWaits++ >= MAX_MODAL_WAITS)
-                return 'modal';
-            await this.deps.sleep(MODAL_RETRY_MS);
-        }
-    }
     async doFetch(since, timeoutMs, timeoutKind) {
         const ctrl = new AbortController();
         this.currentAbort = ctrl;
@@ -820,12 +693,4 @@ export class Monitor {
 export function createMonitor(o) {
     return new Monitor(o);
 }
-async function safeCapture(tmux, name) {
-    try {
-        return { ok: true, pane: await tmux.capture(name) };
-    }
-    catch {
-        return { ok: false, pane: '' };
-    }
-}
 const msg = (e) => e?.message ?? String(e);

package/dist/ops.js

@@ -1,7 +1,7 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, unlinkSync, } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID, createHash } from 'node:crypto';
-import { agentDir, fleetDDir, watchdogsRoot } from './paths.js';
+import { agentDir, watchdogsRoot } from './paths.js';
 import { findRole } from './config.js';
 import { getAdapter } from './harness/registry.js';
 import { generateBriefing } from './briefing.js';
@@ -9,6 +9,7 @@ import { resetRestartLedger } from './runner.js';
 import { archiveTempState, stopTempSupervisor, tempSupervisorLiveness, } from './temp-lifecycle.js';
 import { realExec } from './exec.js';
 import { daemonIdentityProvisioner, reconcilePermanentRoleIdentities, } from './creation.js';
+import { provesGeneratedAgentSource } from './generated-agent-source.js';
 // Launch staggering now lives at the harness-launch point (the runner's start
 // gate, driven by `start_stagger_ms`), so it covers systemd host-boot too — not
 // just the `up`/`restart` command loop below. The old in-loop FLEET_START_STAGGER
@@ -264,9 +265,10 @@ export async function rmRole(cfg, name, deps) {
         return;
     }
     const role = findRole(cfg, name);
+    const generatedSource = provesGeneratedAgentSource(agentDir(name), cfg.files[0], role.sourceFile);
     await deps.backend.uninstall(name);
     rmSync(agentDir(name), { recursive: true, force: true });
-    if (role.sourceFile.startsWith(fleetDDir() + '/')) {
+    if (generatedSource && existsSync(role.sourceFile)) {
         unlinkSync(role.sourceFile);
         deps.log(`removed ${role.sourceFile}`);
     }

package/dist/owner-channel/channel.d.ts

@@ -1,5 +1,5 @@
 import { type OwnerChannelConfig } from '../config.js';
-import { type SessionHandle } from '../session/types.js';
+import { type AgentSession } from '../session/types.js';
 import { type OwnerFleetOps } from './commands.js';
 import type { ManagedFleetSpawnResult } from '../fleet-proxy.js';
 import { type OursOps } from './ours-client.js';
@@ -12,7 +12,7 @@ export interface OwnerChannelOptions {
     /** Harness id of the role (e.g. 'claude-code', 'codex'); gates which slash commands may be forwarded. */
     harness: string;
     config: OwnerChannelConfig;
-    session: SessionHandle;
+    session: AgentSession;
     stateDir: string;
     env?: Record<string, string>;
     log(line: string): void;

package/dist/resolved-plan.d.ts

@@ -1,5 +1,6 @@
 import type { FleetConfig, ResolvedRole } from './config.js';
-export declare const RESOLVED_PLAN_SCHEMA_VERSION = 1;
+export declare const RESOLVED_PLAN_SCHEMA_VERSION = 2;
+export declare const redactSensitive: (value: unknown, key?: string) => unknown;
 /** Stable, secret-safe machine contract consumed by config JSON and spawn dry-run. */
 export declare function resolvedPlan(cfg: FleetConfig): Record<string, unknown>;
-export declare function resolvedRolePlan(role: ResolvedRole): Record<string, unknown>;
+export declare function resolvedRolePlan(role: ResolvedRole, manifestDir?: string): Record<string, unknown>;

package/dist/resolved-plan.js

@@ -1,8 +1,10 @@
 import { analyzeRolePermissions } from './permissions.js';
-export const RESOLVED_PLAN_SCHEMA_VERSION = 1;
+import { dirname, relative } from 'node:path';
+import { isSensitiveConfigKey } from './sensitive-config.js';
+export const RESOLVED_PLAN_SCHEMA_VERSION = 2;
 const sortedObject = (value) => Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)));
-const redactSensitive = (value, key = '') => {
-    if (/(?:secret|token|password|authorization|api[_-]?key)/i.test(key))
+export const redactSensitive = (value, key = '') => {
+    if (isSensitiveConfigKey(key))
         return '<redacted>';
     if (Array.isArray(value))
         return value.map(item => redactSensitive(item));
@@ -14,12 +16,17 @@ const redactSensitive = (value, key = '') => {
 };
 /** Stable, secret-safe machine contract consumed by config JSON and spawn dry-run. */
 export function resolvedPlan(cfg) {
+    const manifestDir = dirname(cfg.files[0] ?? '.');
     return {
         schemaVersion: RESOLVED_PLAN_SCHEMA_VERSION,
+        configMode: cfg.configMode ?? 'split-v2',
         sourceFiles: [...cfg.files],
+        sourceDocuments: (cfg.sourceDocuments ?? []).map(document => ({
+            ...document, path: relative(manifestDir, document.path) || document.path,
+        })),
         startStaggerMs: cfg.startStaggerMs,
         diagnostics: cfg.diagnostics.map(diagnostic => ({ ...diagnostic })),
-        roles: cfg.roles.map(resolvedRolePlan),
+        roles: cfg.roles.map(role => resolvedRolePlan(role, manifestDir)),
         loops: cfg.loops.map(loop => sortedObject({
             name: loop.name, selectors: [...loop.selectors], roles: [...loop.roleNames],
             intervalMs: loop.intervalMs, initialDelayMs: loop.initialDelayMs, jitterMs: loop.jitterMs,
@@ -36,16 +43,25 @@ export function resolvedPlan(cfg) {
         })),
     };
 }
-export function resolvedRolePlan(role) {
+export function resolvedRolePlan(role, manifestDir = dirname(role.sourceFile)) {
     const analysis = analyzeRolePermissions(role);
     return {
         name: role.name,
         sourceFile: role.sourceFile,
+        references: Object.values(role.provenance ?? {}).flatMap(item => item.viaReference ? [item.viaReference] : [])
+            .filter((item, index, all) => all.findIndex(other => JSON.stringify(other) === JSON.stringify(item)) === index)
+            .sort((a, b) => a.kind.localeCompare(b.kind) || a.id.localeCompare(b.id)
+            || a.sourcePointer.localeCompare(b.sourcePointer)),
+        provenance: sortedObject(Object.fromEntries(Object.entries(role.provenance ?? {}).map(([field, item]) => [
+            field, { ...item, sourceFile: item.sourceKind === 'built-in'
+                    ? item.sourceFile : relative(manifestDir, item.sourceFile) || item.sourceFile },
+        ]))),
         identity: role.identity,
         harness: role.harness,
         session: role.session,
         sessionOptions: role.session_options ?? null,
         model: role.model ?? null,
+        effort: role.effort ?? null,
         modelChain: role.model_chain ?? null,
         cwd: role.cwd ?? null,
         coordinator: role.coordinator ?? null,

package/dist/runner.d.ts

@@ -1,15 +1,12 @@
 import { type ResolvedRole } from './config.js';
-import type { Launch } from './harness/types.js';
-import { Tmux } from './tmux.js';
 import { type MonitorHandle, type MonitorOpts, type FetchLike } from './monitor.js';
 import { type Exec } from './exec.js';
-import { type AcpSessionOptions } from './session/acp.js';
 import { RoleControlServer } from './session/control.js';
-import type { ExitRecord, SessionHandle, TurnResult } from './session/types.js';
+import type { AgentSession, ExitRecord, TurnResult } from './session/types.js';
+import type { AgentSessionAdapter, AgentSessionStartOptions } from './harness/agent-session.js';
 import { type OwnerChannelHandle, type OwnerChannelOptions } from './owner-channel/channel.js';
 import { type OwnerBinderLease } from './owner-channel/binder.js';
 export interface RunnerDeps {
-    tmux: Tmux;
     exec: Exec;
     cpuDelegated(): boolean;
     isAlive(pid: number): boolean;
@@ -23,9 +20,10 @@ export interface RunnerDeps {
     /** Construct trusted owner ingress (injectable for lifecycle tests). */
     createOwnerChannel(opts: OwnerChannelOptions): OwnerChannelHandle;
     /** Start the ACP transport (injectable for deterministic runner lifecycle tests). */
-    startAcpSession(opts: AcpSessionOptions): Promise<SessionHandle>;
+    /** Neutral construction seam for deterministic runner lifecycle tests. */
+    startAgentSession(adapter: AgentSessionAdapter, options: AgentSessionStartOptions): Promise<AgentSession>;
     /** Construct the authenticated role control route (injectable where sockets are unavailable). */
-    createControlServer(stateDir: string, session: SessionHandle, log: (line: string) => void): Pick<RoleControlServer, 'start' | 'close' | 'setFleetSpawner' | 'setOwnerChannel' | 'setConfigReloader' | 'setLoopManager'>;
+    createControlServer(stateDir: string, session: AgentSession, log: (line: string) => void): Pick<RoleControlServer, 'start' | 'close' | 'setFleetSpawner' | 'setOwnerChannel' | 'setConfigReloader' | 'setLoopManager'>;
     /** Acquire the cross-process owner-channel binder lease before replacing the control socket. */
     acquireOwnerBinder(stateDir: string, role: string, identity: string): Promise<OwnerBinderLease>;
     /** Ask the still-authenticated predecessor to emit the fixed recovery notice. */
@@ -51,14 +49,6 @@ export declare function harnessChildEnv(role: ResolvedRole, launchEnv: Record<st
  * responsible for.
  */
 export declare function recordMonitorOwner(dir: string, owner: 'fleet' | 'native'): boolean;
-/**
- * Compose the tmux pane shell command: env prefix + argv + exit-status capture.
- * `paneArgv` defaults to `launch.argv`; when isolation is active the caller passes
- * the sandbox-wrapped argv (e.g. `bwrap … -- claude …`). The `env` prefix and the
- * `echo $? > exitfile` capture stay host-side, outside the sandbox, so the runner
- * still sees the real exit code.
- */
-export declare function buildPaneCommand(launch: Launch, roleEnv: Record<string, string> | undefined, exitStatusPath: string, paneArgv?: string[]): string;
 /**
  * Read the pane's `.exit-status`. Three shapes are accepted: the structured
  * record written above, a bare number left by a pre-upgrade pane (so an