@ours.network/fleet 1.1.0-nightly.1 → 1.1.0-nightly.2

package/dist/model-env.js

@@ -1,3 +1,4 @@
+import { getAdapter } from './harness/registry.js';
 /**
  * Which environment variable a harness reads to pin the model it RUNS.
  *
@@ -9,12 +10,9 @@
  * ACP role, and a fleet-wide `defaults.env.ANTHROPIC_MODEL` silently outranked
  * an explicitly requested one.
  */
-export const MODEL_ENV_BY_HARNESS = {
-    'claude-code': 'ANTHROPIC_MODEL',
-};
 /** The model-pin variable for a harness, or undefined if it pins no model by env. */
 export function modelEnvVar(harness) {
-    return harness === undefined ? undefined : MODEL_ENV_BY_HARNESS[harness];
+    return harness === undefined ? undefined : getAdapter(harness).agentSession.modelEnvironmentVariable();
 }
 /**
  * Resolve a role's environment and its runtime model TOGETHER, so the two can

package/dist/ops.js

@@ -1,7 +1,7 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, unlinkSync, } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID, createHash } from 'node:crypto';
-import { agentDir, fleetDDir, watchdogsRoot } from './paths.js';
+import { agentDir, watchdogsRoot } from './paths.js';
 import { findRole } from './config.js';
 import { getAdapter } from './harness/registry.js';
 import { generateBriefing } from './briefing.js';
@@ -9,6 +9,7 @@ import { resetRestartLedger } from './runner.js';
 import { archiveTempState, stopTempSupervisor, tempSupervisorLiveness, } from './temp-lifecycle.js';
 import { realExec } from './exec.js';
 import { daemonIdentityProvisioner, reconcilePermanentRoleIdentities, } from './creation.js';
+import { provesGeneratedAgentSource } from './generated-agent-source.js';
 // Launch staggering now lives at the harness-launch point (the runner's start
 // gate, driven by `start_stagger_ms`), so it covers systemd host-boot too — not
 // just the `up`/`restart` command loop below. The old in-loop FLEET_START_STAGGER
@@ -264,9 +265,10 @@ export async function rmRole(cfg, name, deps) {
         return;
     }
     const role = findRole(cfg, name);
+    const generatedSource = provesGeneratedAgentSource(agentDir(name), cfg.files[0], role.sourceFile);
     await deps.backend.uninstall(name);
     rmSync(agentDir(name), { recursive: true, force: true });
-    if (role.sourceFile.startsWith(fleetDDir() + '/')) {
+    if (generatedSource && existsSync(role.sourceFile)) {
         unlinkSync(role.sourceFile);
         deps.log(`removed ${role.sourceFile}`);
     }

package/dist/resolved-plan.d.ts

@@ -1,5 +1,6 @@
 import type { FleetConfig, ResolvedRole } from './config.js';
-export declare const RESOLVED_PLAN_SCHEMA_VERSION = 1;
+export declare const RESOLVED_PLAN_SCHEMA_VERSION = 2;
+export declare const redactSensitive: (value: unknown, key?: string) => unknown;
 /** Stable, secret-safe machine contract consumed by config JSON and spawn dry-run. */
 export declare function resolvedPlan(cfg: FleetConfig): Record<string, unknown>;
-export declare function resolvedRolePlan(role: ResolvedRole): Record<string, unknown>;
+export declare function resolvedRolePlan(role: ResolvedRole, manifestDir?: string): Record<string, unknown>;

package/dist/resolved-plan.js

@@ -1,8 +1,10 @@
 import { analyzeRolePermissions } from './permissions.js';
-export const RESOLVED_PLAN_SCHEMA_VERSION = 1;
+import { dirname, relative } from 'node:path';
+import { isSensitiveConfigKey } from './sensitive-config.js';
+export const RESOLVED_PLAN_SCHEMA_VERSION = 2;
 const sortedObject = (value) => Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)));
-const redactSensitive = (value, key = '') => {
-    if (/(?:secret|token|password|authorization|api[_-]?key)/i.test(key))
+export const redactSensitive = (value, key = '') => {
+    if (isSensitiveConfigKey(key))
         return '<redacted>';
     if (Array.isArray(value))
         return value.map(item => redactSensitive(item));
@@ -14,12 +16,17 @@ const redactSensitive = (value, key = '') => {
 };
 /** Stable, secret-safe machine contract consumed by config JSON and spawn dry-run. */
 export function resolvedPlan(cfg) {
+    const manifestDir = dirname(cfg.files[0] ?? '.');
     return {
         schemaVersion: RESOLVED_PLAN_SCHEMA_VERSION,
+        configMode: cfg.configMode ?? 'split-v2',
         sourceFiles: [...cfg.files],
+        sourceDocuments: (cfg.sourceDocuments ?? []).map(document => ({
+            ...document, path: relative(manifestDir, document.path) || document.path,
+        })),
         startStaggerMs: cfg.startStaggerMs,
         diagnostics: cfg.diagnostics.map(diagnostic => ({ ...diagnostic })),
-        roles: cfg.roles.map(resolvedRolePlan),
+        roles: cfg.roles.map(role => resolvedRolePlan(role, manifestDir)),
         loops: cfg.loops.map(loop => sortedObject({
             name: loop.name, selectors: [...loop.selectors], roles: [...loop.roleNames],
             intervalMs: loop.intervalMs, initialDelayMs: loop.initialDelayMs, jitterMs: loop.jitterMs,
@@ -36,16 +43,25 @@ export function resolvedPlan(cfg) {
         })),
     };
 }
-export function resolvedRolePlan(role) {
+export function resolvedRolePlan(role, manifestDir = dirname(role.sourceFile)) {
     const analysis = analyzeRolePermissions(role);
     return {
         name: role.name,
         sourceFile: role.sourceFile,
+        references: Object.values(role.provenance ?? {}).flatMap(item => item.viaReference ? [item.viaReference] : [])
+            .filter((item, index, all) => all.findIndex(other => JSON.stringify(other) === JSON.stringify(item)) === index)
+            .sort((a, b) => a.kind.localeCompare(b.kind) || a.id.localeCompare(b.id)
+            || a.sourcePointer.localeCompare(b.sourcePointer)),
+        provenance: sortedObject(Object.fromEntries(Object.entries(role.provenance ?? {}).map(([field, item]) => [
+            field, { ...item, sourceFile: item.sourceKind === 'built-in'
+                    ? item.sourceFile : relative(manifestDir, item.sourceFile) || item.sourceFile },
+        ]))),
         identity: role.identity,
         harness: role.harness,
         session: role.session,
         sessionOptions: role.session_options ?? null,
         model: role.model ?? null,
+        effort: role.effort ?? null,
         modelChain: role.model_chain ?? null,
         cwd: role.cwd ?? null,
         coordinator: role.coordinator ?? null,

package/dist/sensitive-config.d.ts

@@ -0,0 +1,2 @@
+/** Shared recursive configuration redaction boundary for operator-facing models. */
+export declare function isSensitiveConfigKey(key: string): boolean;

package/dist/sensitive-config.js

@@ -0,0 +1,4 @@
+/** Shared recursive configuration redaction boundary for operator-facing models. */
+export function isSensitiveConfigKey(key) {
+    return /(?:secret|token|password|credential|private[_-]?key|auth|invite|api[_-]?key)/i.test(key);
+}

package/dist/spawn.d.ts

@@ -85,17 +85,17 @@ export declare const effectiveIdentity: (o: SpawnOpts) => string;
 export interface SpawnDryRun {
     schemaVersion: 1;
     warning: string;
-    roleDocument: {
-        roles: Record<string, RoleConfig>;
-    };
+    roleDocument: Record<string, unknown>;
     resolvedRole: ResolvedRole;
 }
+/** Bare Agent document written by v2 spawn: inline Role × inline Brain + operations. */
+export declare function buildAgentDocument(raw: RoleConfig): Record<string, unknown>;
 /**
  * Validate and resolve a spawn without reserving names, contacting the daemon,
  * or writing state. Collision checks are necessarily a point-in-time snapshot.
  */
 export declare function spawnDryRun(o: SpawnOpts): SpawnDryRun;
-/** Permanent spawn: persist to ~/fleet.d/<Name>.yaml, then bring it up. */
+/** Permanent spawn: persist one bare Agent document under the selected v2 root. */
 export declare function spawnPermanent(o: SpawnOpts, deps: OpsDeps, creation?: CreationDeps): Promise<string>;
 export type { SupervisorLauncher } from './temp-lifecycle.js';
 /** Temp spawn: live state under ~/.ours-fleet/tmp, independent transient supervision. */

package/dist/spawn.js

@@ -2,14 +2,15 @@ import { spawn as spawnChild } from 'node:child_process';
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { parse, stringify } from 'yaml';
-import { agentDir, fleetDDir } from './paths.js';
+import { agentDir, defaultConfigPath } from './paths.js';
 import { validateIsolationConfig } from './isolation/policy.js';
-import { loadConfig, resolveAuthProxy, resolveModelChain, resolveMonitorConfig, resolveOwnerChannelConfig, resolvePermissions, resolveRoleModel, resolveWorklogPolicy, validateMonitorConfig, } from './config.js';
+import { loadConfig, resolveAuthProxy, resolveModelChain, resolveMonitorConfig, resolveOwnerChannelConfig, resolvePermissions, resolveRoleModel, resolveWorklogPolicy, splitRootFor, validateMonitorConfig, } from './config.js';
 import { resolveRoleModelEnv } from './model-env.js';
 import { applyRole, up } from './ops.js';
 import { START_STAGGER_FILE } from './runner.js';
 import { buildProvenance, daemonIdentityProvisioner, ensureIdentity, provenanceOf, withCreationTransaction, writeProvenance, writeRoleFile, } from './creation.js';
 import { VERSION } from './version.js';
+import { recordGeneratedAgentSource } from './generated-agent-source.js';
 import './harness/claude-code.js';
 import './harness/codex.js';
 import { getAdapter } from './harness/registry.js';
@@ -34,8 +35,9 @@ export function profileValues(o) {
 /** Pure option-to-role mapping shared by CLI and application services. */
 export function buildRoleConfig(o, defaultHarness) {
     const r = {};
-    if (o.harness)
-        r.harness = o.harness;
+    const harness = o.harness ?? defaultHarness;
+    if (harness)
+        r.harness = harness;
     if (o.session)
         r.session = o.session;
     if (o.identity)
@@ -52,7 +54,8 @@ export function buildRoleConfig(o, defaultHarness) {
         r.model = null;
     else if (o.model?.trim())
         r.model = o.model.trim();
-    const harness = o.harness ?? defaultHarness;
+    if (o.reasoningEffort?.trim())
+        r.effort = o.reasoningEffort.trim();
     const harnessOptions = {};
     if (o.permissionMode)
         harnessOptions[harness === 'claude-code' ? 'permission_mode' : 'approval'] = o.permissionMode;
@@ -65,12 +68,8 @@ export function buildRoleConfig(o, defaultHarness) {
     if (o.search === true)
         harnessOptions.search = true;
     const codexConfig = { ...(o.codexConfig ?? {}) };
-    if (o.reasoningEffort && harness === 'codex')
-        codexConfig.model_reasoning_effort = o.reasoningEffort;
     if (Object.keys(codexConfig).length)
         harnessOptions.config = codexConfig;
-    if (o.reasoningEffort && harness === 'claude-code')
-        harnessOptions.effort = o.reasoningEffort;
     if (o.addDirs?.length)
         harnessOptions.add_dirs = o.addDirs;
     if (o.monitor === true)
@@ -174,6 +173,23 @@ function assertNameFree(o) {
 }
 /** The ours identity a spawn will bind: explicit, else the role name. */
 export const effectiveIdentity = (o) => o.identity ?? o.name;
+/** Bare Agent document written by v2 spawn: inline Role × inline Brain + operations. */
+export function buildAgentDocument(raw) {
+    const role = Object.fromEntries(['mission', 'persona', 'bio', 'briefing_file']
+        .filter(key => raw[key] !== undefined)
+        .map(key => [key, raw[key]]));
+    const brain = Object.fromEntries([
+        'harness', 'session', 'session_options', 'model', 'model_chain', 'max_tokens',
+        'autocompact_pct', 'harness_options', 'effort',
+    ].filter(key => raw[key] !== undefined)
+        .map(key => [key, raw[key]]));
+    const operational = Object.fromEntries([
+        'permissions', 'identity', 'cwd', 'coordinator', 'env', 'oversee', 'isolation',
+        'monitor', 'owner_channel', 'worklog', 'auth_proxy',
+    ].filter(key => raw[key] !== undefined)
+        .map(key => [key, raw[key]]));
+    return { role: { inline: role }, brain: { inline: brain }, ...operational };
+}
 /**
  * Validate and resolve a spawn without reserving names, contacting the daemon,
  * or writing state. Collision checks are necessarily a point-in-time snapshot.
@@ -186,7 +202,7 @@ export function spawnDryRun(o) {
         readMissionFile(o.missionFile);
     assertNameFree(o);
     const cfg = loadConfig(o.configPath);
-    const raw = buildRoleConfig(o, cfg.defaults.harness);
+    const raw = buildRoleConfig(o, cfg.defaults.harness ?? 'claude-code');
     const harnessOptions = {
         ...(cfg.defaults.harness_options ?? {}),
         ...(raw.harness_options ?? {}),
@@ -204,23 +220,30 @@ export function spawnDryRun(o) {
         roleEnv: raw.env,
         ...(authProxy ? { authProxyBaseUrl: authProxy.base_url } : {}),
     });
-    const model = modelEnv.model;
+    const adapter = getAdapter(harness);
+    const brain = adapter.agentSession.resolveBrain({
+        model: modelEnv.model,
+        effort: raw.effort,
+        harnessOptions: Object.keys(harnessOptions).length ? harnessOptions : undefined,
+    });
+    const model = brain.model ?? undefined;
     const session = raw.session ?? cfg.defaults.session ?? 'acp';
     const resolvedRole = {
         ...raw,
         name: o.name,
-        sourceFile: o.temp ? '(temp dry-run)' : join(fleetDDir(), `${o.name}.yaml`),
+        sourceFile: o.temp ? '(temp dry-run)' : join(splitRootFor(o.configPath ?? defaultConfigPath()), 'agents', `${o.name}.yaml`),
         harness,
         session,
         session_options: raw.session_options,
         permissions: resolvePermissions(cfg.defaults.permissions, raw.permissions),
         permissionsDeclared: raw.permissions !== undefined || cfg.defaults.permissions !== undefined,
         identity: effectiveIdentity(o),
+        effort: raw.effort,
         model,
         model_chain: resolveModelChain(model, raw.model_chain ?? (inheritsModelDefaults
             ? cfg.defaults.model_chain
             : undefined)),
-        harness_options: Object.keys(harnessOptions).length ? harnessOptions : undefined,
+        harness_options: brain.harnessOptions,
         isolation: raw.isolation ?? cfg.defaults.isolation,
         monitor: resolveMonitorConfig(cfg.defaults.monitor, raw.monitor),
         owner_channel: resolveOwnerChannelConfig(cfg.defaults.owner_channel, raw.owner_channel, session),
@@ -228,7 +251,6 @@ export function spawnDryRun(o) {
         auth_proxy: authProxy,
     };
     resolvedRole.env = modelEnv.env;
-    const adapter = getAdapter(resolvedRole.harness);
     if (resolvedRole.auth_proxy && resolvedRole.harness !== 'claude-code')
         throw new Error('auth_proxy is supported only by claude-code');
     const optionProblems = adapter.validateOptions(resolvedRole.harness_options, resolvedRole);
@@ -237,7 +259,7 @@ export function spawnDryRun(o) {
     return {
         schemaVersion: 1,
         warning: 'collision checks are a snapshot; a real spawn reserves names atomically',
-        roleDocument: { roles: { [o.name]: raw } },
+        roleDocument: buildAgentDocument(raw),
         resolvedRole,
     };
 }
@@ -278,7 +300,7 @@ function provenanceSettings(o, defaults) {
         monitor: tagged('monitorConfig', provenanceOf(o.monitorConfig, defaults.monitor, { mode: 'fleet' })),
     };
 }
-/** Permanent spawn: persist to ~/fleet.d/<Name>.yaml, then bring it up. */
+/** Permanent spawn: persist one bare Agent document under the selected v2 root. */
 export async function spawnPermanent(o, deps, creation = {}) {
     validateSpawnOpts(o);
     if (o.isolationFile)
@@ -307,12 +329,11 @@ export async function spawnPermanent(o, deps, creation = {}) {
                     await creation.identityProvisioner?.remove?.(effectiveIdentity(o));
                 },
             });
-        mkdirSync(fleetDDir(), { recursive: true });
+        const agentRoot = join(splitRootFor(o.configPath ?? defaultConfigPath()), 'agents');
+        mkdirSync(agentRoot, { recursive: true });
         creation.onStage?.('writing_role');
-        const file = join(fleetDDir(), `${o.name}.yaml`);
-        writeRoleFile(tx, file, stringify({
-            roles: { [o.name]: buildRoleConfig(o, cfg.defaults.harness) },
-        }));
+        const file = join(agentRoot, `${o.name}.yaml`);
+        writeRoleFile(tx, file, stringify(buildAgentDocument(buildRoleConfig(o, cfg.defaults.harness ?? 'claude-code'))));
         // `up` materialises the state dir and registers the service. Journal the
         // dir before it exists so a failure leaves the name genuinely reusable
         // rather than blocked by a half-built directory.
@@ -343,6 +364,7 @@ export async function spawnPermanent(o, deps, creation = {}) {
         });
         mkdirSync(agentDir(o.name), { recursive: true });
         writeProvenance(agentDir(o.name), provenance);
+        recordGeneratedAgentSource(agentDir(o.name), o.configPath ?? defaultConfigPath(), file);
         creation.onStage?.('registering_supervisor');
         await up(loadConfig(o.configPath), [o.name], {
             ...deps,
@@ -418,7 +440,13 @@ async function spawnTempInner(o, binPath, launch, tx, onStage) {
         roleEnv: fromOpts.env,
         ...(tempAuthProxy ? { authProxyBaseUrl: tempAuthProxy.base_url } : {}),
     });
-    const model = modelEnv.model;
+    const adapter = getAdapter(harness);
+    const brain = adapter.agentSession.resolveBrain({
+        model: modelEnv.model,
+        effort: fromOpts.effort,
+        harnessOptions: Object.keys(mergedHarnessOptions).length ? mergedHarnessOptions : undefined,
+    });
+    const model = brain.model ?? undefined;
     const session = o.session ?? cfg.defaults.session ?? 'acp';
     const role = {
         ...fromOpts, // includes `isolation` when --isolation-file was given
@@ -426,11 +454,12 @@ async function spawnTempInner(o, binPath, launch, tx, onStage) {
         harness,
         session,
         identity: o.identity ?? o.name,
+        effort: fromOpts.effort,
         model,
         model_chain: resolveModelChain(model, fromOpts.model_chain ?? (inheritsModelDefaults
             ? cfg.defaults.model_chain
             : undefined)),
-        harness_options: Object.keys(mergedHarnessOptions).length ? mergedHarnessOptions : undefined,
+        harness_options: brain.harnessOptions,
         permissions: resolvePermissions(cfg.defaults.permissions, fromOpts.permissions),
         permissionsDeclared: fromOpts.permissions !== undefined || cfg.defaults.permissions !== undefined,
         // Temp agents inherit the fleet-wide monitor defaults via the snapshot.

package/dist/web/fleet-config-service.d.ts

@@ -1,10 +1,13 @@
 import type { PrereqReport } from '../harness/types.js';
 export declare const REDACTED_ENV_VALUE = "__OURS_FLEET_SECRET_REDACTED__";
-export type EditableFleetModel = Record<string, unknown>;
+export interface EditableFleetModel {
+    manifest: Record<string, unknown>;
+    agents: Record<string, Record<string, unknown>>;
+}
 export interface ConfigReadResult {
     path: string;
-    exists: boolean;
-    firstRun: boolean;
+    exists: true;
+    firstRun: false;
     revision: string;
     model: EditableFleetModel;
     redactions: string[];
@@ -33,15 +36,15 @@ export interface ConfigWriteResult extends ConfigPreviewResult {
 export interface FleetConfigServiceOptions {
     configPath?: string;
     preflight?(configPath: string): Promise<PrereqReport>;
+    /** Fault-injection seam; called under lock immediately before each mutation. */
+    beforeMutation?(relativePath: string, index: number): void;
 }
 export declare class FleetConfigService {
     readonly path: string;
     private readonly preflight;
+    private readonly beforeMutation?;
     constructor(options?: FleetConfigServiceOptions);
     read(): ConfigReadResult;
-    preview(baseRevision: string, model: unknown): Promise<ConfigPreviewResult>;
-    write(baseRevision: string, model: unknown): Promise<ConfigWriteResult>;
-    private readSource;
-    private assertRevision;
-    private validateCandidate;
+    preview(baseRevision: string, input: unknown): Promise<ConfigPreviewResult>;
+    write(baseRevision: string, input: unknown): Promise<ConfigWriteResult>;
 }