@ours.network/fleet 1.1.4 → 1.2.0-nightly.1

package/README.md

@@ -510,6 +510,23 @@ obsolete, presence-sensitive `OURS_AUTOSTART` variable from ACP harness
 processes. `ours-mcp proxy` is client-only and never starts a daemon; operators and explicit
 installer/setup flows remain responsible for starting it.
 
+Fleet selects explicit `OURS_CONFIG` first, otherwise the managed
+`~/.ours-client/profile.json` when present. With a managed profile, ordinary
+`ours-fleet doctor` and `ours-fleet up` need no environment override. Invalid or
+unreadable managed profiles fail rather than select another daemon. If neither
+selection exists, the existing unmanaged behavior remains.
+
+The private profile names the daemon endpoint, retained instance UUID and host
+credential path; Fleet does not need the daemon state directory. An explicit
+override selects a new invocation without rewriting already installed service
+definitions. To select another profile explicitly:
+
+```sh
+export OURS_CONFIG=/absolute/private/ours/client.json
+ours-fleet doctor
+ours-fleet up
+```
+
 ### Rooms and tasks
 
 Init installs editable `single`, `pair`, and `team` definitions under
@@ -548,7 +565,26 @@ N, Enter, Escape, Ctrl-C, Ctrl-D, or EOF cancels. In a picker, Escape, Ctrl-C, C
 or EOF cancels; Enter records the highlighted choice (or continues a non-empty multi-select),
 N is ignored, and an empty subscription selection remains blocked. Every cancellation
 before the final Yes performs no host setup or config publication. Non-TTY use stops with
-the same zero-mutation guarantee. After the final Yes, host integration runs before locked
+the same zero-mutation guarantee unless `--settings PATH` supplies complete JSON answers.
+Prepared settings run without questions and use this strict shape (catalog model capabilities
+must match exactly):
+
+```json
+{
+  "subscriptions": ["codex"],
+  "assignmentStrategy": "one-model",
+  "models": {
+    "development": { "harness": "codex", "session": "acp", "model": "gpt-5.6-sol", "efforts": ["low", "medium", "high", "xhigh", "max", "ultra"] },
+    "review": { "harness": "codex", "session": "acp", "model": "gpt-5.6-sol", "efforts": ["low", "medium", "high", "xhigh", "max", "ultra"] },
+    "coordination": { "harness": "codex", "session": "acp", "model": "gpt-5.6-sol", "efforts": ["low", "medium", "high", "xhigh", "max", "ultra"] }
+  },
+  "reasoning": "balanced"
+}
+```
+
+Run `ours-fleet init --settings settings.json -c /path/custom.yaml`. Unreadable,
+malformed, incomplete, extra, or unsupported values fail before host setup and publication;
+Fleet never falls back to questions. After the final Yes or validated settings, host integration runs before locked
 publication; a hard kill, power loss, or host crash can therefore leave host integration
 or private stage/recovery evidence to inspect.
 Existing targets and their tree must be owner-private regular files/directories on the
@@ -1542,3 +1578,103 @@ that environment, and restart only affected agents after applying the override.
 For temporary agents with a sealed stale override, have the task coordinator
 arrange replacement with the corrected template. Reinstall/upgrade Fleet with
 optional dependencies enabled to repair a missing or stale bundled runtime.
+
+### Hermes ACP
+
+A Hermes Brain uses `harness: hermes`, `session: acp`, and an explicit non-empty
+`model`. See [the example Brain](examples/fleet/brains/hermes.yaml). The model is
+illustrative: select one supported by the native provider provisioned for your
+role. The same Brain can be selected by Coordinator or an ordinary Agent; this
+does not switch an existing Coordinator automatically.
+
+Each role has a private persistent Hermes home at
+`<role-state-dir>/harness/hermes`, separate from its project working directory.
+Stop the role before setup or upgrades. Point Hermes's native setup at that exact
+path using `HERMES_HOME`; provision the provider and credentials there. Do not copy
+or link an operator's active credentials. Fleet creates the home with mode 0700
+and writes its configuration with mode 0600. Fleet owns `model.default` and
+`approvals.mode: manual`; unrelated native configuration, credentials, memory,
+skills and runtime files remain native-owned. Removing the Brain model is an
+error, not a request to restore an old native model.
+
+Every start creates a fresh ACP conversation and receives the full role briefing.
+Memory and skills in the role home survive; the previous conversation is not
+restored. Changing the Brain model takes effect on the next start. Temporary
+homes last for the temporary role's lifetime; persistent homes remain until an
+authorized role operation removes them.
+
+Use Fleet-owned monitoring (`monitor.mode: fleet`). Fleet supplies the reserved
+`ours` connector through ACP, plus optional explicit
+`harness_options.mcp_servers`. An identical explicit
+`ours: { command: ours-mcp, args: [proxy] }` is merged once; a conflicting one is
+rejected. Disable all home-configured MCP servers and MCP-providing plugins in
+this role home. Startup does not silently remove them. An ACP connection means
+MCP availability is **unverified until actual use**; a configured connector name
+or a model's claim does not prove that a tool works. Fleet adds no probe prompt.
+
+| Fleet approval | Hermes edit mode |
+| --- | --- |
+| `ask` | `default` |
+| `auto` | `accept_edits` |
+| `allow` | `dont_ask` |
+
+These modes cover dangerous terminal command prompts and `write_file`/`patch`.
+They do not provide universal approval for browser, memory, skills, delegation
+or MCP side effects. Native protected-action floors remain. Fleet's permission
+wait is 50 seconds, below the tested native dangerous-command timeout of 60
+seconds. Workspace confinement is approximate without verified enforcing Fleet
+isolation; unrestricted filesystem mode is also available. Read-only mode,
+legacy approval `deny`, Fleet provider overrides, effort, model chains, native
+monitoring and `after_tool` are unsupported.
+
+This dedicated home and environment filtering are not a complete isolation
+boundary: native Hermes can also read installation/system configuration and
+provider credential fallbacks outside it. Fleet uses its existing process
+lifecycle without adding a separate process-death barrier. Use the appropriate
+OS/service isolation for stronger separation.
+
+The tested artifact is Hermes 0.21.1 at source commit
+`d15ed4445207dda418b984e8bda0f68f48b8c6f3`, Python ACP 0.9.0, protocol 1.
+Unknown builds require compatibility testing before managed launch. Configure a
+literal native `model.provider` in the stopped home so Fleet can compare the
+reported provider against an independent value; `auto` selection is unsupported.
+
+For an enforcing Linux workspace sandbox, use the existing bubblewrap backend
+with `on_unavailable: strict`. Its allowlist must include read-only access to the
+Hermes source/virtualenv and the Python runtime used by its launcher, including
+any interpreter symlink path. Declare these installation-specific paths in
+`isolation.fs.read`; do not expose an entire operator home. The tested policy
+allowed a project write and refused a write to an outside read-only directory.
+The `broker` network mode retains host networking; it is not network isolation.
+
+## Container-daemon recovery checks
+
+After building Fleet with the selected SDK and CLI artifacts installed, run
+`npm run test:v1-recovery` in an isolated Docker container with external networking
+disabled. The existing test covers retry and terminal failure cases using a
+temporary daemon and no authenticated AI harness. By default both daemon and
+token-update commands use `node_modules/@ours.network/cli/dist/cli.js`;
+`FLEET_DAEMON_CLI` and `FLEET_TOKEN_CLI` can select explicitly prepared CLI entries.
+These package checks do not replace native Fleet/harness or platform acceptance.
+
+### Build with selected SDK and CLI archives
+
+Run in the build container with Node 22+, npm and tar available:
+
+```sh
+node scripts/build-selected.mjs --sdk /artifacts/ours.network-sdk-3.7.2.tgz --cli /artifacts/ours.network-cli-2.7.2.tgz --out-dir /artifacts/consumer
+```
+
+The recipe validates package names, installs and builds in disposable staging,
+then writes one complete portable npm archive. Stdout is a JSON object with its
+actual `filename`; build/npm logs go to stderr. Normal source manifests, locks
+and installed dependencies are preserved. The installer must install the same
+selected SDK and CLI archives alongside this package; its final dependency
+versions come from those archives. Existing bundling choices are unchanged.
+
+Focused build/install verification (two real builds, including changed bytes
+under identical input names and versions, plus a missing-vendor negative check):
+
+```sh
+node scripts/check-build-selected.mjs --sdk /artifacts/ours.network-sdk-3.7.2.tgz --cli /artifacts/ours.network-cli-2.7.2.tgz
+```

package/dist/briefing.js

@@ -124,6 +124,7 @@ function generateRoomMemberBriefing(role, v, opts, prefix) {
 export function generateBriefing(role, v, opts) {
     const L = [];
     const id = role.identity;
+    const bindForce = role.harness === 'hermes' ? 'false' : 'true';
     const hostUser = userInfo().username;
     L.push(`# ${role.name} — Role Briefing`, '');
     const lifetime = opts.temporaryIdentity ? 'temporary' : 'persistent';
@@ -154,13 +155,13 @@ export function generateBriefing(role, v, opts) {
         const guarantee = opts.identityGuarantee ?? 'unverified';
         if (guarantee === 'unverified') {
             L.push(`2. BIND your ours identity: call the **${v.bindTool}** tool with`);
-            L.push(`   name "${id}" force=true (search the deferred tool registry first if needed).`);
+            L.push(`   name "${id}" force=${bindForce} (search the deferred tool registry first if needed).`);
             L.push(`   - This permanent identity was NOT verified before launch. If it does not exist, STOP`);
             L.push('     and report the infrastructure error; identity creation belongs to the fleet lifecycle.');
         }
         else {
             L.push(`2. BIND your ours identity: call the **${v.bindTool}** tool with`);
-            L.push(`   name "${id}" force=true (search the deferred tool registry first if needed).`);
+            L.push(`   name "${id}" force=${bindForce} (search the deferred tool registry first if needed).`);
             L.push(`   - It was ${guarantee === 'created' ? 'created' : 'verified to exist'} when your role`);
             L.push('     was started, so binding should succeed. If it unexpectedly reports no such identity,');
             L.push('     STOP and report the infrastructure race; do not create or replace it yourself.');
@@ -305,7 +306,7 @@ export function generateBriefing(role, v, opts) {
         L.push('to permanent creation, or delete identity state. After successful creation,');
     }
     else {
-        L.push(`On restart, WITHOUT asking: re-bind (**${v.bindTool}** name "${id}" force=true), then`);
+        L.push(`On restart, WITHOUT asking: re-bind (**${v.bindTool}** name "${id}" force=${bindForce}), then`);
     }
     L.push(`${wakeNote} Then continue from your WORKLOG.`);
     L.push('Do not blindly re-run whatever may have crashed you.');

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.1.4",
-  "buildId": "a288595a172d",
-  "commit": "72d6d26ea49eaf1941885e721eab76e177f974af",
-  "dirty": false,
-  "builtAt": "2026-09-11T09:05:53.118Z",
+  "version": "1.2.0-nightly.1",
+  "buildId": "1e4449b7d64e",
+  "commit": "79fb01a75d39a721491c789b857f892c7c9d000f",
+  "dirty": true,
+  "builtAt": "2026-09-18T12:07:17.159Z",
   "capabilities": [
     "monitor.interrupt.after_tool"
   ]

package/dist/cli.d.ts

@@ -1,3 +1,4 @@
 #!/usr/bin/env node
 import './harness/claude-code.js';
 import './harness/codex.js';
+import './harness/hermes.js';

package/dist/cli.js

@@ -9,7 +9,7 @@ import { Command } from 'commander';
 import { VERSION } from './version.js';
 import { INIT_COMPLETION_GUIDANCE } from './init-guidance.js';
 import { migrateLegacyStarterPresets, migratePackagedRoleDefaults } from './preset-migration.js';
-import { executeInitWizard, isInteractiveTerminal, publishSetup, TerminalPrompter, } from './init-wizard.js';
+import { executeInitAnswers, executeInitWizard, isInteractiveTerminal, publishSetup, readInitSettings, TerminalPrompter, } from './init-wizard.js';
 import { analyzeInstalls, buildInfo, buildLabel, discoverInstalls, runningLabel, } from './provenance.js';
 import { agentDir, agentsRoot, tmpRoot, logsRoot, deriveXdgRuntimeDir, defaultConfigPath } from './paths.js';
 import { findRole, loadConfig, ROLE_NAME_RE } from './config.js';
@@ -43,6 +43,7 @@ import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, } from './fleet-prox
 import { beginFleetAuditCollection, consumeFleetAuditCollection, FleetCliExit, setFleetAuditLifecycleCheckpoint, } from './fleet-command-audit.js';
 import './harness/claude-code.js'; // registers the claude-code adapter
 import './harness/codex.js'; // registers the codex adapter
+import './harness/hermes.js';
 import { registerTemplateCommands, registerTaskCommands, registerRoomCommands } from './rooms-tasks/cli.js';
 import { RoleCreationService } from './application/role-creation-service.js';
 import { RoleRemovalService } from './application/role-removal-service.js';
@@ -1268,13 +1269,14 @@ cOpt(program.command('doctor').description('prerequisite report'))
     if (!rep.ok)
         throw new FleetCliExit(1);
 });
-cOpt(program.command('init').description('interactively add missing Fleet defaults while preserving existing configuration'))
+cOpt(program.command('init').description('add missing Fleet defaults while preserving existing configuration')
+    .option('--settings <file>', 'validated InitAnswers JSON; runs without interactive questions'))
     .action(async (opts) => {
     const configuration = opts.configuration ?? defaultConfigPath();
-    if (!isInteractiveTerminal(process.stdin, process.stdout))
+    if (!opts.settings && !isInteractiveTerminal(process.stdin, process.stdout))
         die('ours-fleet init requires an interactive terminal; no host setup ran and no configuration changed');
     try {
-        const result = await executeInitWizard(new TerminalPrompter(process.stdin, process.stdout), configuration, {
+        const initDeps = {
             async hostSetup() {
                 for (const d of [agentsRoot(), tmpRoot(), logsRoot()])
                     mkdirSync(d, { recursive: true });
@@ -1282,10 +1284,13 @@ cOpt(program.command('init').description('interactively add missing Fleet defaul
                     console.log(message);
             },
             publish: publishSetup,
-        });
+        };
+        const result = opts.settings
+            ? await executeInitAnswers(readInitSettings(opts.settings), configuration, initDeps)
+            : await executeInitWizard(new TerminalPrompter(process.stdin, process.stdout), configuration, initDeps);
         if (!result) {
             console.log('Fleet setup cancelled. No host setup ran and no configuration changed.');
-            return;
+            throw new FleetCliExit(1);
         }
         const prior = result.manifestExisted && result.rootExisted ? 'manifest and split configuration'
             : result.manifestExisted ? 'manifest only'
@@ -1296,6 +1301,8 @@ cOpt(program.command('init').description('interactively add missing Fleet defaul
         console.log(INIT_COMPLETION_GUIDANCE);
     }
     catch (error) {
+        if (error instanceof FleetCliExit)
+            throw error;
         die(error);
     }
 });

package/dist/client-profile.d.ts

@@ -0,0 +1,17 @@
+export interface ExplicitClientProfile {
+    readonly endpoint: string;
+    readonly expectedInstanceId: string;
+    readonly credentialPath: string;
+    readonly configPath: string;
+}
+export declare class ClientProfileError extends Error {
+    constructor(message: string);
+}
+export declare function clientConfigPath(env: NodeJS.ProcessEnv): string;
+/**
+ * Read Fleet's selected host-client profile without opening its credential.
+ * A legacy daemon config remains legacy only when none of the profile fields is
+ * present. Explicit and managed selections fail closed on invalid input.
+ */
+export declare function readClientProfile(env: NodeJS.ProcessEnv): ExplicitClientProfile | undefined;
+export declare function clientProfileKey(profile: ExplicitClientProfile): string;

package/dist/client-profile.js

@@ -0,0 +1,115 @@
+import { lstatSync, readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join } from 'node:path';
+const PROFILE_FIELDS = ['endpoint', 'expectedInstanceId', 'credentialPath'];
+const LOWERCASE_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const LEGACY_CONFIG_FIELDS = ['apiToken', 'stateDir', 'port'];
+const LEGACY_ENV_FIELDS = ['OURS_API_TOKEN', 'OURS_STATE_DIR', 'OURS_PORT', 'OURS_DAEMON_ID'];
+export class ClientProfileError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ClientProfileError';
+    }
+}
+export function clientConfigPath(env) {
+    if (env.OURS_CONFIG !== undefined)
+        return env.OURS_CONFIG;
+    const managedPath = join(env.HOME || homedir(), '.ours-client', 'profile.json');
+    try {
+        lstatSync(managedPath);
+        return managedPath;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw invalid(managedPath, 'could not be read');
+        return join(homedir(), '.ours', 'config.json');
+    }
+}
+function invalid(path, detail) {
+    return new ClientProfileError(`ours client profile ${JSON.stringify(path)} ${detail}`);
+}
+/**
+ * Read Fleet's selected host-client profile without opening its credential.
+ * A legacy daemon config remains legacy only when none of the profile fields is
+ * present. Explicit and managed selections fail closed on invalid input.
+ */
+export function readClientProfile(env) {
+    const configPath = clientConfigPath(env);
+    const managed = configPath === join(env.HOME || homedir(), '.ours-client', 'profile.json');
+    const named = env.OURS_CONFIG !== undefined || managed;
+    let text;
+    try {
+        text = readFileSync(configPath, 'utf8');
+    }
+    catch {
+        if (named)
+            throw invalid(configPath, 'could not be read');
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        if (named)
+            throw invalid(configPath, 'is not valid JSON');
+        return undefined;
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        if (named)
+            throw invalid(configPath, 'must contain a JSON object');
+        return undefined;
+    }
+    const row = parsed;
+    if (!PROFILE_FIELDS.some(field => Object.prototype.hasOwnProperty.call(row, field))) {
+        if (managed)
+            throw invalid(configPath, 'must contain a complete client profile');
+        return undefined;
+    }
+    let metadata;
+    try {
+        metadata = statSync(configPath);
+    }
+    catch {
+        throw invalid(configPath, 'could not be inspected');
+    }
+    if (!metadata.isFile())
+        throw invalid(configPath, 'must be a regular file');
+    const getuid = process.getuid;
+    if (getuid && metadata.uid !== getuid())
+        throw invalid(configPath, 'must be owned by this user');
+    if ((metadata.mode & 0o077) !== 0)
+        throw invalid(configPath, 'must not be accessible by group or other users');
+    for (const field of PROFILE_FIELDS)
+        if (typeof row[field] !== 'string' || !row[field].trim())
+            throw invalid(configPath, `has an invalid or missing ${field}`);
+    for (const field of LEGACY_CONFIG_FIELDS)
+        if (Object.prototype.hasOwnProperty.call(row, field))
+            throw invalid(configPath, `cannot combine ${field} with explicit profile selection`);
+    for (const field of LEGACY_ENV_FIELDS)
+        if (env[field]?.trim())
+            throw invalid(configPath, `cannot combine ${field} with explicit profile selection`);
+    const endpoint = row.endpoint.trim();
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        throw invalid(configPath, 'has an invalid endpoint');
+    }
+    if (url.protocol !== 'http:' || url.username || url.password || url.pathname !== '/'
+        || url.search || url.hash)
+        throw invalid(configPath, 'endpoint must be a local HTTP origin');
+    const expectedInstanceId = row.expectedInstanceId.trim();
+    if (!LOWERCASE_UUID.test(expectedInstanceId))
+        throw invalid(configPath, 'expectedInstanceId must be a lowercase UUID');
+    const credentialPath = row.credentialPath.trim();
+    if (!isAbsolute(credentialPath))
+        throw invalid(configPath, 'credentialPath must be absolute');
+    return Object.freeze({
+        endpoint: url.origin, expectedInstanceId, credentialPath, configPath,
+    });
+}
+export function clientProfileKey(profile) {
+    return `${profile.endpoint}#${profile.expectedInstanceId}`;
+}

package/dist/creation.js

@@ -4,6 +4,7 @@ import { randomUUID } from 'node:crypto';
 import { attachOursClient, } from '@ours.network/sdk/client';
 import { replaceFileAtomically, withFileLock } from './atomic-file.js';
 import { stateRoot } from './paths.js';
+import { readClientProfile } from './client-profile.js';
 import { buildInfo, UNKNOWN_BUILD } from './provenance.js';
 /**
  * One creation transaction: role name and ours identity reserved together,
@@ -221,12 +222,17 @@ export async function ensureIdentity(name, profile, provisioner, log = () => { }
     };
 }
 export function daemonIdentityProvisioner(env = process.env, attachClient = attachOursClient, options = {}) {
+    const connect = (leaseToken) => {
+        const profile = readClientProfile(env);
+        return attachClient(profile ? {
+            endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
+            credentialPath: profile.credentialPath, sessionMode: 'external', leaseToken, env: {},
+        } : { env, leaseToken, clientPid: process.pid });
+    };
     const provisioner = {
         async exists(name) {
             try {
-                const client = await attachClient({
-                    env, leaseToken: `ours-fleet-identity-preflight-${process.pid}`, clientPid: process.pid,
-                });
+                const client = await connect(`ours-fleet-identity-preflight-${process.pid}`);
                 const identities = await client.identities();
                 if (!Array.isArray(identities))
                     return 'unknown';
@@ -248,10 +254,7 @@ export function daemonIdentityProvisioner(env = process.env, attachClient = atta
     if (options.createPermanent === false)
         return provisioner;
     provisioner.create = async (name, profile) => {
-        const client = await attachClient({
-            env, leaseToken: `ours-fleet-identity-create-${process.pid}-${randomUUID()}`,
-            clientPid: process.pid,
-        });
+        const client = await connect(`ours-fleet-identity-create-${process.pid}-${randomUUID()}`);
         if (!client.listIdentities || !client.createIdentity || !client.releaseLease)
             throw new Error('the selected ours SDK client cannot create permanent identities');
         try {

package/dist/daemon-recovery.d.ts

@@ -1,3 +1,4 @@
+import { type AttachOursClientOptions, type OursClient } from '@ours.network/sdk/client';
 import { type FetchLike } from './monitor.js';
 export declare const DAEMON_RECOVERY_MAX_ATTEMPTS = 6;
 export declare const DAEMON_RECOVERY_INITIAL_BACKOFF_MS = 1000;
@@ -31,6 +32,7 @@ export type DaemonGenerationObservation = {
 interface GenerationProbeDeps {
     readText?(path: string): string;
     canonicalize?(path: string): string;
+    attachClient?(options: AttachOursClientOptions): Pick<OursClient, 'version' | 'identities' | 'close'> | Promise<Pick<OursClient, 'version' | 'identities' | 'close'>>;
 }
 /**
  * Corroborate the loopback daemon's unauthenticated `/info`, its credentialed

package/dist/daemon-recovery.js

@@ -1,7 +1,9 @@
 import { readFileSync, realpathSync } from 'node:fs';
 import { join, resolve } from 'node:path';
-import { createHash } from 'node:crypto';
-import { resolveEndpoint } from './monitor.js';
+import { createHash, randomUUID } from 'node:crypto';
+import { attachOursClient, } from '@ours.network/sdk/client';
+import { readDaemonConfig, resolveEndpoint } from './monitor.js';
+import { readClientProfile } from './client-profile.js';
 import { replaceFileAtomically } from './atomic-file.js';
 export const DAEMON_RECOVERY_MAX_ATTEMPTS = 6;
 export const DAEMON_RECOVERY_INITIAL_BACKOFF_MS = 1_000;
@@ -50,6 +52,9 @@ function canonical(path, deps) {
  * stale `ready` file can outlive the process that wrote it.
  */
 export async function probeDaemonGeneration(fetch, env, deps = {}) {
+    const profile = readClientProfile(env);
+    if (profile || env.OURS_DAEMON_ID)
+        return probeSelectedDaemon(env, deps, profile);
     const endpoint = resolveEndpoint(env);
     let response;
     try {
@@ -141,6 +146,52 @@ export async function probeDaemonGeneration(fetch, env, deps = {}) {
         },
     };
 }
+/** Container selection uses public SDK reads; daemon paths/PIDs remain opaque metadata. */
+async function probeSelectedDaemon(env, deps, profile) {
+    // Defer credential-file access to SDK selection, which checks the configured
+    // daemon identity/capability before it reads or sends the credential.
+    const endpoint = profile ? undefined : resolveEndpoint(env, false);
+    const token = profile ? undefined : env.OURS_API_TOKEN?.trim() || readDaemonConfig(env).apiToken;
+    let client;
+    try {
+        const options = profile ? {
+            endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
+            credentialPath: profile.credentialPath,
+            sessionMode: 'external', leaseToken: randomUUID(), env: {},
+        } : {
+            endpoint: endpoint.origin, expectedInstanceId: env.OURS_DAEMON_ID,
+            sessionMode: 'external', leaseToken: randomUUID(),
+            ...(token ? { token } : { credentialPath: join(endpoint.stateDir, 'daemon-token') }),
+        };
+        client = await (deps.attachClient?.(options) ?? attachOursClient(options));
+        const info = await client.version({ startup: true });
+        if (info.name !== 'ours' || !positiveInteger(info.pid)
+            || typeof info.stateDir !== 'string' || !info.stateDir)
+            return { state: 'unavailable', reason: 'DAEMON_INFO_INVALID' };
+        const progress = startupProgress(info.startup);
+        if (!progress)
+            return { state: 'unavailable', reason: 'DAEMON_PROGRESS_INVALID' };
+        if (progress.phase !== 'ready')
+            return { state: 'unavailable', reason: 'DAEMON_PROGRESS_NOT_READY' };
+        if (progress.pid !== info.pid)
+            return { state: 'unavailable', reason: 'DAEMON_GENERATION_MISMATCH' };
+        const identities = await client.identities();
+        if (!Array.isArray(identities))
+            return { state: 'unavailable', reason: 'DAEMON_IDENTITIES_INVALID' };
+        if (!identities.length)
+            return { state: 'unavailable', reason: 'DAEMON_IDENTITIES_NOT_READY' };
+        return { state: 'ready', generation: {
+                bootId: progress.bootId, pid: progress.pid, startedAt: progress.startedAt, stateDir: info.stateDir,
+            } };
+    }
+    catch {
+        // Failed selection, auth or transport is unavailable, never owner death.
+        return { state: 'unavailable', reason: 'DAEMON_SELECTED_PROBE_UNAVAILABLE' };
+    }
+    finally {
+        await client?.close();
+    }
+}
 export class DaemonGenerationObserver {
     current;
     unavailable = false;