@ours.network/fleet 1.1.5 → 1.2.0-nightly.10

package/README.md

@@ -52,11 +52,10 @@ briefing.md per role  ──►  agent session adapter  ──►  native app-se
 ```
 
 Each role gets a state dir (`~/.ours-fleet/agents/<Name>/`) holding its briefing,
-logs, routines, and session markers. On boot the agent reads its briefing: bind
-identity, publish bio/persona, announce to its coordinator, work — while the
+logs, routines, and session markers. Before boot, the supervisor binds the assigned identity and prepares its room.
+The agent then reads its briefing and starts work — while the
 supervisor delivers its mail wakes as `[fleet-monitor]` console lines (see
-[Mail monitor](#mail-monitor)). Set `monitor.mode: native` when the harness
-should own mail wake instead. On crash the supervisor relaunches it and the
+[Mail monitor](#mail-monitor)). Managed ours sessions use supervisor-owned mail wakes. On crash the supervisor relaunches it and the
 harness resumes the same session.
 
 The state dir contract:
@@ -80,7 +79,7 @@ The state dir contract:
 |---|---|---|
 | Node ≥ 22 | runs `ours-fleet` and its maintained adapters | nodejs.org, `apt`, or `brew` |
 | a harness CLI, logged in | the agent itself | e.g. Claude Code (`claude`) or Codex CLI (`codex`) |
-| `ours` CLI + shared daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/cli && ours daemon start` |
+| `ours` CLI + shared daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/cli@2.8.1-nightly.7 @ours.network/daemon@3.8.1-nightly.1 && ours-daemon start` |
 
 Linux only: `ours-fleet init` enables *linger* so roles run without a login session
 and survive reboots. macOS: launchd agents start **at login** (no linger
@@ -231,15 +230,11 @@ from the current runner generation and excludes adapter `session/load` replay;
 those replay events remain in the durable ledger with `agent_replay` provenance
 for diagnosis and recovery rather than appearing as current work.
 
-For every temporary role, the first-boot instructions call ours MCP
-`create_temporary_identity` with the exact assigned name, so the new identity
-is owned and cleaned up by that connector session lifecycle. Temporary roles
-never bind pre-existing identities or fall back to permanent `create_identity`.
-Fleet does not inspect, preserve, or provision an ours identity for temp spawn.
-A collision, missing tool, or creation error stops for operator review; fleet
-never force-adopts or deletes identity state. Permanent roles are
-provisioned by fleet before launch and never delegate normal identity creation
-to the harness.
+The Fleet supervisor creates and binds the assigned identity before the harness
+starts. Temporary identities survive harness reconnects and are released only when
+the logical run ends. Permanent identities remain available after the supervisor
+releases ownership. Agents receive ready tools; no model-owned identity bootstrap
+or onboarding skill is required.
 
 The web console uses structured ACP activity rather than exposing a raw agent terminal.
 
@@ -510,6 +505,23 @@ obsolete, presence-sensitive `OURS_AUTOSTART` variable from ACP harness
 processes. `ours-mcp proxy` is client-only and never starts a daemon; operators and explicit
 installer/setup flows remain responsible for starting it.
 
+Fleet selects explicit `OURS_CONFIG` first, otherwise the managed
+`~/.ours-client/profile.json` when present. With a managed profile, ordinary
+`ours-fleet doctor` and `ours-fleet up` need no environment override. Invalid or
+unreadable managed profiles fail rather than select another daemon. If neither
+selection exists, the existing unmanaged behavior remains.
+
+The private profile names the daemon endpoint, retained instance UUID and host
+credential path; Fleet does not need the daemon state directory. An explicit
+override selects a new invocation without rewriting already installed service
+definitions. To select another profile explicitly:
+
+```sh
+export OURS_CONFIG=/absolute/private/ours/client.json
+ours-fleet doctor
+ours-fleet up
+```
+
 ### Rooms and tasks
 
 Init installs editable `single`, `pair`, and `team` definitions under
@@ -548,7 +560,26 @@ N, Enter, Escape, Ctrl-C, Ctrl-D, or EOF cancels. In a picker, Escape, Ctrl-C, C
 or EOF cancels; Enter records the highlighted choice (or continues a non-empty multi-select),
 N is ignored, and an empty subscription selection remains blocked. Every cancellation
 before the final Yes performs no host setup or config publication. Non-TTY use stops with
-the same zero-mutation guarantee. After the final Yes, host integration runs before locked
+the same zero-mutation guarantee unless `--settings PATH` supplies complete JSON answers.
+Prepared settings run without questions and use this strict shape (catalog model capabilities
+must match exactly):
+
+```json
+{
+  "subscriptions": ["codex"],
+  "assignmentStrategy": "one-model",
+  "models": {
+    "development": { "harness": "codex", "session": "acp", "model": "gpt-5.6-sol", "efforts": ["low", "medium", "high", "xhigh", "max", "ultra"] },
+    "review": { "harness": "codex", "session": "acp", "model": "gpt-5.6-sol", "efforts": ["low", "medium", "high", "xhigh", "max", "ultra"] },
+    "coordination": { "harness": "codex", "session": "acp", "model": "gpt-5.6-sol", "efforts": ["low", "medium", "high", "xhigh", "max", "ultra"] }
+  },
+  "reasoning": "balanced"
+}
+```
+
+Run `ours-fleet init --settings settings.json -c /path/custom.yaml`. Unreadable,
+malformed, incomplete, extra, or unsupported values fail before host setup and publication;
+Fleet never falls back to questions. After the final Yes or validated settings, host integration runs before locked
 publication; a hard kill, power loss, or host crash can therefore leave host integration
 or private stage/recovery evidence to inspect.
 Existing targets and their tree must be owner-private regular files/directories on the
@@ -613,10 +644,10 @@ originating task. Existing active rooms are not retroactively migrated, and room
 with Owner attachment disabled receive no Owner grant.
 
 Fleet launches each template member with a dedicated one-time Cowork invite.
-The generated temporary-agent briefing contains the exact identity name, invite,
-Cowork role, and task. The agent creates that identity itself with ours MCP
-`create_temporary_identity`, accepts the invite with `add_contact`, and starts
-work immediately. A room is ready only after the Cowork room (and its task, when
+The supervisor accepts the startup invite and verifies the provisioned identity CID
+in the authenticated room seat before starting the model. The generated briefing
+contains the assigned identity, room, role and task, without invite material.
+A room is ready only after the Cowork room (and its task, when
 task-bound) is durably active, every configured member seat is authenticated and active with its matching
 live Fleet launch, and the configured Owner seat is active when owner attachment is
 enabled. There is no briefing hash, startup ACK, or separate role-briefing readiness
@@ -639,8 +670,8 @@ Set `room.anonymous: true` on a room template, or pass `--anonymous` to
 `task create`, `task start`, `task work`, or `room create`, to create an
 anonymous Cowork room. `--no-anonymous` explicitly overrides an anonymous
 template. Fleet records the resolved value before room creation so retries keep
-the same choice. Temporary members of an anonymous room are instructed to call
-`create_temporary_identity` with `expose_local=false`. Their generated briefings
+the same choice. The supervisor creates anonymous room members with local contact-book exposure
+disabled. Their generated briefings
 do not disclose or compare an Owner participant CID. A participant-originated
 instruction has Owner authority only when the authenticated Cowork room envelope
 attributes that participant seat the exact `Owner` role. Literal text, display
@@ -1610,3 +1641,114 @@ any interpreter symlink path. Declare these installation-specific paths in
 `isolation.fs.read`; do not expose an entire operator home. The tested policy
 allowed a project write and refused a write to an outside read-only directory.
 The `broker` network mode retains host networking; it is not network isolation.
+
+## Container-daemon recovery checks
+
+After building Fleet with the selected SDK and CLI artifacts installed, run
+`npm run test:v1-recovery` in an isolated Docker container with external networking
+disabled. The existing test covers retry and terminal failure cases using a
+temporary daemon and no authenticated AI harness. By default both daemon and
+token-update commands use `node_modules/@ours.network/daemon/dist/cli.js`;
+`FLEET_DAEMON_CLI` and `FLEET_TOKEN_CLI` can select explicitly prepared CLI entries.
+These package checks do not replace native Fleet/harness or platform acceptance.
+
+### Build with selected SDK and CLI archives
+
+Run in the build container with Node 22+, npm and tar available:
+
+```sh
+node scripts/build-selected.mjs --sdk /artifacts/ours.network-sdk-3.7.2.tgz --cli /artifacts/ours.network-cli-2.7.2.tgz --out-dir /artifacts/consumer
+```
+
+The recipe validates package names, installs and builds in disposable staging,
+then writes one complete portable npm archive. Stdout is a JSON object with its
+actual `filename`; build/npm logs go to stderr. Normal source manifests, locks
+and installed dependencies are preserved. The installer must install the same
+selected SDK and CLI archives alongside this package; its final dependency
+versions come from those archives. Existing bundling choices are unchanged.
+
+Focused build/install verification (two real builds, including changed bytes
+under identical input names and versions, plus a missing-vendor negative check):
+
+```sh
+node scripts/check-build-selected.mjs --sdk /artifacts/ours.network-sdk-3.7.2.tgz --cli /artifacts/ours.network-cli-2.7.2.tgz
+```
+
+### Remote clients over HTTPS
+
+A client may select an `https://` origin backed by a TLS reverse proxy. Keep the
+daemon listener private and configure the proxy separately with a certificate
+trusted by the client and matching the hostname. Node uses its normal trust
+store; a private CA may be supplied through `NODE_EXTRA_CA_CERTS` before starting
+the client. Certificate verification must remain enabled.
+
+The existing issued client credential works over either transport; changing the
+URL scheme does not require a new credential. Keep the server's master on the
+server. Forward `x-ours-api-token` and the `x-ours-*` session headers unchanged,
+and support streamed request/response bodies and long polling. Client requests
+refuse redirects, including HTTPS-to-HTTP redirects: configure the final HTTPS
+origin directly. UUID/capability checks still precede credential-bearing calls.
+
+This adds client HTTPS support, not an HTTPS daemon listener, certificate
+provisioning or automatic reverse-proxy configuration. Existing local HTTP and
+SSH-tunnel profiles continue to work.
+
+See [supervisor-owned ours and migration](docs/supervisor-ours.md) for the runtime contract and review build instructions.
+
+### One-server gateway profile
+
+A private client profile may include `serverUrl`, for example
+`https://ours.example/base`, together with `endpoint` set to
+`https://ours.example/base/daemon`, the existing `expectedInstanceId`, and the
+absolute private `credentialPath`. Fleet preserves that daemon prefix for doctor
+and monitoring and derives `/cowork/management/rpc` from `serverUrl` for room
+management. Requests use the issued server credential, reject redirects, have
+bounded bodies/deadlines, and never replay mutations. This capability is declared
+as `cowork.http-management-v1` in the built artifact.
+
+Explicit Cowork socket, config or state-directory overrides continue to select
+local Unix management. Profiles without `serverUrl` retain legacy behavior. The
+HTTP API grants operator room authority; use the installer's supported private
+or authenticated external gateway entry, and keep its backend ports private.
+
+### Agent ours tools through the supervisor
+
+Operators can invoke the running agent's ordinary ours MCP tools without sending
+an LLM prompt or binding another session to its identity:
+
+```sh
+ours-fleet ours tools Critic1
+ours-fleet ours call Critic1 current_identity
+ours-fleet ours call Critic1 list_contacts
+ours-fleet ours call Critic1 generate_invite --args-file /private/invite-options.json
+ours-fleet ours call Critic1 add_contact --args-file /private/contact.json
+```
+
+`tools` returns the managed MCP tool names and argument schemas, plus the selected
+agent's identity name, CID, and supervisor generation. `call` returns the same
+identity metadata and the MCP result. The private JSON file contains the tool's
+arguments (for example `{"invite":"…"}` for `add_contact`); omitted arguments mean
+`{}`. Protect files containing invites and protect command output containing a
+new invite. Tool errors set a nonzero CLI exit status.
+
+The authenticated REST equivalents are `GET /api/v1/roles/:id/ours/tools` and
+`POST /api/v1/roles/:id/ours/call`, with the normal Fleet session and CSRF token.
+The POST body is `{"tool":"list_contacts","arguments":{}}`. MCP tool errors
+remain in `result.isError`; transport failures use the normal Fleet error envelope.
+Request arguments and results are excluded from the Fleet audit log.
+
+Both interfaces use the supervisor's existing fixed-identity MCP server and tool
+policy. Identity creation, removal, switching, and binding are not exposed. The
+supervisor must be running. Older descriptors are supported only when a unique
+existing runtime journal, instance record, and identity pin prove the selected
+agent and generation, and the same MCP connection confirms its identity and
+lifetime before the operation. This reads existing state without rewriting the
+descriptor or restarting the agent. Missing, ambiguous, stale, or mismatched
+proofs fail closed. Unknown identity descriptions also fail closed. Closing an operator call
+retains the supervisor's identity. An interrupted mutation can have an unknown
+outcome: inspect state before retrying, because there is no automatic retry or
+exactly-once guarantee. Contact acceptance alone does not prove peer verification
+or message delivery. File tools resolve paths in the invoking CLI process or
+Fleet web server's filesystem context, with that process's access permissions.
+
+Task workspace ownership, retention, safe deletion and legacy migration are documented in [Task workspaces](docs/task-workspaces.md).

package/dist/agent-ours/bridge.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+/** Runs inside exactly the harness OS sandbox. Only this process opens agent paths. */
+export declare function runBridge(descriptorPath: string): Promise<void>;

package/dist/agent-ours/bridge.js

@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto';
+import { connect } from 'node:net';
+import { access, mkdir, open, readFile } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { basename, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { MAX_CHUNK_BYTES, MAX_FRAME_BYTES, Wire } from './wire.js';
+/** Runs inside exactly the harness OS sandbox. Only this process opens agent paths. */
+export async function runBridge(descriptorPath) {
+    const descriptor = JSON.parse(await readFile(descriptorPath, 'utf8'));
+    if (typeof descriptor.socket !== 'string' ||
+        typeof descriptor.capability !== 'string' ||
+        !Number.isInteger(descriptor.generation))
+        throw Error('INVALID_BRIDGE_DESCRIPTOR');
+    if (process.env.FLEET_OURS_BRIDGE_EXPECTED) {
+        const expected = JSON.parse(process.env.FLEET_OURS_BRIDGE_EXPECTED);
+        const digest = createHash('sha256').update(JSON.stringify([descriptor.socket, descriptor.capability, descriptor.generation])).digest('hex');
+        if (expected.transportDigest !== digest)
+            throw Error('SUPERVISOR_TRANSPORT_CHANGED');
+        if (['role', 'identity', 'cid', 'generation'].some(key => descriptor[key] !== expected[key]))
+            throw Error('SUPERVISOR_SELECTION_CHANGED');
+    }
+    const wire = new Wire(connect(descriptor.socket));
+    const handles = new Map();
+    const cleanup = async () => {
+        for (const row of handles.values())
+            await row.file.close().catch(() => { });
+        handles.clear();
+    };
+    let admitted = false;
+    let stdin = Buffer.alloc(0);
+    let chain = Promise.resolve();
+    const fail = () => {
+        wire.close();
+        process.stdin.pause();
+        void cleanup();
+    };
+    wire.onClose = fail;
+    wire.onFrame = (raw) => {
+        if (raw?.kind === 'ready') {
+            if (admitted)
+                throw Error('DUPLICATE_READY');
+            admitted = true;
+            process.stdin.resume();
+            return;
+        }
+        if (!admitted)
+            throw Error('BRIDGE_NOT_READY');
+        if (raw?.kind === 'mcp') {
+            const line = JSON.stringify(raw.value) + '\n';
+            if (!process.stdout.write(line)) {
+                wire.socket.pause();
+                process.stdout.once('drain', () => wire.socket.resume());
+            }
+            return;
+        }
+        if (raw?.kind !== 'fs' || typeof raw.id !== 'string' || typeof raw.call !== 'string')
+            throw Error('INVALID_BRIDGE_FRAME');
+        chain = chain
+            .then(async () => {
+            try {
+                const { op, args, call } = raw;
+                let value;
+                if (op === 'probe') {
+                    try {
+                        await access(args.path, constants.R_OK);
+                        value = true;
+                    }
+                    catch {
+                        value = false;
+                    }
+                }
+                else if (op === 'read-open' || op === 'write-open') {
+                    if (handles.size >= 32 ||
+                        typeof args.handle !== 'string' ||
+                        handles.has(args.handle) ||
+                        typeof args.path !== 'string')
+                        throw Error('FILE_LIMIT');
+                    const path = resolve(args.path);
+                    if (op === 'write-open')
+                        await mkdir(dirname(path), { recursive: true });
+                    const file = await open(path, op === 'write-open' ? 'w' : 'r');
+                    handles.set(args.handle, { file, call, write: op === 'write-open' });
+                    value =
+                        op === 'write-open'
+                            ? path
+                            : { filename: basename(path), size: (await file.stat()).size };
+                }
+                else {
+                    const row = handles.get(args.handle);
+                    if (!row) {
+                        if (op === 'close') {
+                            value = null;
+                        }
+                        else
+                            throw Error('UNKNOWN_FILE_HANDLE');
+                    }
+                    else {
+                        if (row.call !== call)
+                            throw Error('FOREIGN_FILE_CALL');
+                        if (op === 'close') {
+                            handles.delete(args.handle);
+                            await row.file.close();
+                            value = null;
+                        }
+                        else if (op === 'read' && !row.write) {
+                            const buffer = Buffer.alloc(MAX_CHUNK_BYTES);
+                            const { bytesRead } = await row.file.read(buffer);
+                            value = bytesRead ? buffer.subarray(0, bytesRead).toString('base64') : null;
+                        }
+                        else if (op === 'write' && row.write) {
+                            if (typeof args.data !== 'string' ||
+                                args.data.length > Math.ceil(MAX_CHUNK_BYTES / 3) * 4)
+                                throw Error('FILE_CHUNK_LIMIT');
+                            const buffer = Buffer.from(args.data, 'base64');
+                            let offset = 0;
+                            while (offset < buffer.length) {
+                                const r = await row.file.write(buffer, offset, buffer.length - offset);
+                                if (!r.bytesWritten)
+                                    throw Error('SHORT_WRITE');
+                                offset += r.bytesWritten;
+                            }
+                            value = null;
+                        }
+                        else
+                            throw Error('INVALID_FILE_OPERATION');
+                    }
+                }
+                await wire.send({ kind: 'fs-result', id: raw.id, value });
+            }
+            catch {
+                await wire.send({ kind: 'fs-result', id: raw.id, error: 'FILE_OPERATION_FAILED' });
+            }
+        })
+            .catch(fail);
+    };
+    process.stdin.pause();
+    process.stdin.on('data', (chunk) => {
+        stdin = Buffer.concat([stdin, chunk]);
+        for (;;) {
+            const end = stdin.indexOf(10);
+            if (end < 0) {
+                if (stdin.length > MAX_FRAME_BYTES)
+                    fail();
+                return;
+            }
+            if (end > MAX_FRAME_BYTES) {
+                fail();
+                return;
+            }
+            const line = stdin.subarray(0, end);
+            stdin = stdin.subarray(end + 1);
+            try {
+                const value = JSON.parse(line.toString('utf8'));
+                process.stdin.pause();
+                void wire.send({ kind: 'mcp', value }).then(() => process.stdin.resume(), fail);
+            }
+            catch {
+                fail();
+                return;
+            }
+        }
+    });
+    process.stdin.on('end', fail);
+    process.stdout.on('error', fail);
+    await wire.send({
+        kind: 'hello',
+        capability: descriptor.capability,
+        generation: descriptor.generation,
+    });
+}
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+    runBridge(process.env.FLEET_OURS_BRIDGE_DESCRIPTOR ?? '').catch(() => {
+        process.stderr.write('Fleet ours bridge unavailable\n');
+        process.exitCode = 1;
+    });
+}

package/dist/agent-ours/controller.d.ts

@@ -0,0 +1,14 @@
+import { RuntimeJournal } from './state.js';
+/** Reuse Fleet's process-lifetime binder to serialize startup and cleanup. */
+export declare class RuntimeController {
+    private readonly lease;
+    readonly privateDir: string;
+    readonly journal: RuntimeJournal;
+    private active;
+    private constructor();
+    static acquire(root: string, daemon: string, name: string, instance: string): Promise<RuntimeController>;
+    assertFence: () => void;
+    successor(): string;
+    resumeGeneration(): number;
+    unlock(): void;
+}

package/dist/agent-ours/controller.js

@@ -0,0 +1,60 @@
+import { randomUUID } from 'node:crypto';
+import { mkdirSync, renameSync } from 'node:fs';
+import { join } from 'node:path';
+import { acquireOwnerBinderLease } from '../owner-channel/binder.js';
+import { binderKey, RuntimeJournal } from './state.js';
+/** Reuse Fleet's process-lifetime binder to serialize startup and cleanup. */
+export class RuntimeController {
+    lease;
+    privateDir;
+    journal;
+    active = true;
+    constructor(lease, privateDir) {
+        this.lease = lease;
+        this.privateDir = privateDir;
+        this.journal = new RuntimeJournal(privateDir);
+    }
+    static async acquire(root, daemon, name, instance) {
+        const dir = join(root, binderKey(daemon, name));
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const lease = await acquireOwnerBinderLease(dir, 'agent-ours', name);
+        const controller = new RuntimeController(lease, dir);
+        if (controller.journal.read()?.instance && controller.journal.read().instance !== instance) {
+            lease.release();
+            throw Error('RUNTIME_INSTANCE_MISMATCH');
+        }
+        return controller;
+    }
+    assertFence = () => {
+        if (!this.active)
+            throw Error('STALE_RUNTIME_CONTROLLER');
+    };
+    successor() {
+        this.assertFence();
+        const state = this.journal.read();
+        if (state?.phase !== 'RELEASED')
+            throw Error('PREDECESSOR_NOT_RELEASED');
+        const archive = join(this.privateDir, `retired-${state.instance}`);
+        mkdirSync(archive, { mode: 0o700 });
+        for (const file of ['state.json', 'owner.json', 'instance.json'])
+            renameSync(join(this.privateDir, file), join(archive, file));
+        return randomUUID();
+    }
+    resumeGeneration() {
+        this.assertFence();
+        const s = this.journal.read();
+        if (!s)
+            return 1;
+        if (['TERMINAL_INTENT', 'CLEANUP_PENDING', 'RELEASED', 'FAILED'].includes(s.phase))
+            throw Error('RUNTIME_RETIRED_OR_FAILED');
+        if (!s.cid)
+            throw Error('UNCERTAIN_PROVISIONING');
+        this.journal.commit({ ...s, generation: s.generation + 1, phase: 'RECOVERING' }, s.revision);
+        return s.generation + 1;
+    }
+    unlock() {
+        this.assertFence();
+        this.lease.release();
+        this.active = false;
+    }
+}

package/dist/agent-ours/file-rpc.d.ts

@@ -0,0 +1,23 @@
+import type { FileExecutionContext } from '@ours.network/mcp/server';
+import type { ToolRequestExtra } from '@ours.network/mcp/dist/types/mcp/tool.js';
+import { type Wire } from './wire.js';
+/** Call-scoped callbacks carry no daemon credentials or upload receipts. */
+export declare class FileCallbacks implements FileExecutionContext {
+    private readonly wire;
+    private pending;
+    constructor(wire: Wire);
+    receive(frame: any): void;
+    close(): void;
+    private rpc;
+    canRead(path: string, extra: ToolRequestExtra): Promise<boolean>;
+    read(path: string, extra: ToolRequestExtra): Promise<{
+        filename: any;
+        size: any;
+        body: ReadableStream<Uint8Array<ArrayBufferLike>>;
+        close: () => Promise<void>;
+    }>;
+    write(path: string, body: ReadableStream<Uint8Array>, extra: ToolRequestExtra): Promise<{
+        path: string;
+        size: number;
+    }>;
+}

package/dist/agent-ours/file-rpc.js

@@ -0,0 +1,123 @@
+import { randomUUID } from 'node:crypto';
+import { MAX_CHUNK_BYTES } from './wire.js';
+/** Call-scoped callbacks carry no daemon credentials or upload receipts. */
+export class FileCallbacks {
+    wire;
+    pending = new Map();
+    constructor(wire) {
+        this.wire = wire;
+    }
+    receive(frame) {
+        if (frame?.kind !== 'fs-result' || typeof frame.id !== 'string')
+            throw Error('INVALID_FILE_RESPONSE');
+        const p = this.pending.get(frame.id);
+        if (!p)
+            throw Error('UNSOLICITED_FILE_RESPONSE');
+        this.pending.delete(frame.id);
+        clearTimeout(p.timer);
+        if (frame.error)
+            p.reject(Error('AGENT_FILE_OPERATION_FAILED'));
+        else
+            p.resolve(frame.value);
+    }
+    close() {
+        for (const p of this.pending.values()) {
+            clearTimeout(p.timer);
+            p.reject(Error('FILE_BRIDGE_DISCONNECTED'));
+        }
+        this.pending.clear();
+    }
+    async rpc(call, op, args, signal) {
+        signal.throwIfAborted();
+        if (this.pending.size >= 64)
+            throw Error('FILE_CALLBACK_LIMIT');
+        const id = randomUUID();
+        return new Promise((resolve, reject) => {
+            const finish = (f) => (value) => {
+                signal.removeEventListener('abort', abort);
+                f(value);
+            };
+            const fail = (reason) => {
+                const p = this.pending.get(id);
+                if (!p)
+                    return;
+                this.pending.delete(id);
+                clearTimeout(p.timer);
+                finish(reject)(reason);
+            };
+            const abort = () => fail(Error('FILE_CALLBACK_ABORTED'));
+            const timer = setTimeout(() => fail(Error('FILE_CALLBACK_TIMEOUT')), 30_000);
+            timer.unref();
+            this.pending.set(id, { resolve: finish(resolve), reject: finish(reject), timer });
+            signal.addEventListener('abort', abort, { once: true });
+            void this.wire
+                .send({ kind: 'fs', id, call, op, args })
+                .catch(() => fail(Error('FILE_BRIDGE_DISCONNECTED')));
+        });
+    }
+    async canRead(path, extra) {
+        return (await this.rpc(String(extra.requestId), 'probe', { path }, extra.signal)) === true;
+    }
+    async read(path, extra) {
+        const call = String(extra.requestId), handle = randomUUID();
+        const meta = await this.rpc(call, 'read-open', { path, handle }, extra.signal);
+        if (!meta ||
+            typeof meta.filename !== 'string' ||
+            !Number.isSafeInteger(meta.size) ||
+            meta.size < 0)
+            throw Error('INVALID_FILE_METADATA');
+        const close = async () => {
+            await this.rpc(call, 'close', { handle }, new AbortController().signal).catch(() => { });
+        };
+        const body = new ReadableStream({
+            pull: async (controller) => {
+                try {
+                    const chunk = await this.rpc(call, 'read', { handle }, extra.signal);
+                    if (chunk === null) {
+                        controller.close();
+                        return;
+                    }
+                    if (typeof chunk !== 'string' || chunk.length > Math.ceil(MAX_CHUNK_BYTES / 3) * 4)
+                        throw Error('INVALID_FILE_CHUNK');
+                    const bytes = Buffer.from(chunk, 'base64');
+                    if (bytes.length > MAX_CHUNK_BYTES)
+                        throw Error('FILE_CHUNK_TOO_LARGE');
+                    controller.enqueue(bytes);
+                }
+                catch (error) {
+                    controller.error(error);
+                    await close();
+                }
+            },
+            cancel: close,
+        });
+        return { filename: meta.filename, size: meta.size, body, close };
+    }
+    async write(path, body, extra) {
+        const call = String(extra.requestId), handle = randomUUID();
+        const reader = body.getReader();
+        try {
+            const resolved = await this.rpc(call, 'write-open', { path, handle }, extra.signal);
+            if (typeof resolved !== 'string')
+                throw Error('INVALID_FILE_PATH');
+            let size = 0;
+            for (;;) {
+                extra.signal.throwIfAborted();
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                for (let offset = 0; offset < chunk.value.length; offset += MAX_CHUNK_BYTES) {
+                    const bytes = chunk.value.subarray(offset, offset + MAX_CHUNK_BYTES);
+                    size += bytes.length;
+                    await this.rpc(call, 'write', { handle, data: Buffer.from(bytes).toString('base64') }, extra.signal);
+                }
+            }
+            await this.rpc(call, 'close', { handle }, extra.signal);
+            return { path: resolved, size };
+        }
+        finally {
+            await reader.cancel().catch(() => { });
+            await this.rpc(call, 'close', { handle }, new AbortController().signal).catch(() => { });
+        }
+    }
+}

package/dist/agent-ours/harness.d.ts

@@ -0,0 +1,14 @@
+import type { AcpMcpServer } from '../harness/types.js';
+import type { ResolvedRole } from '../config.js';
+export interface ManagedHarnessOurs {
+    server: AcpMcpServer;
+    native: Record<string, unknown>;
+}
+/** Do not pass the supervisor's ours connection credentials to harness children. */
+export declare function managedChildEnvironment(input: NodeJS.ProcessEnv): Record<string, string>;
+/** Replace ours only; retain the user's ordinary harness configuration and plugins. */
+export declare function prepareManagedHarness(role: ResolvedRole, stateDir: string, cwd: string, descriptor: string, env: Record<string, string>): {
+    ours: ManagedHarnessOurs;
+    env: Record<string, string>;
+};
+export declare function managedClaudeMeta(base: Record<string, unknown> | undefined): Record<string, unknown>;