@ours.network/fleet 1.1.5 → 1.2.0-nightly.10

package/dist/harness/codex-session.js

@@ -23,6 +23,12 @@ export class CodexAgentSessionAdapter {
     }
     start(options) {
         const { role, prep, launch } = options;
+        const original = this.strategy.nativeConfig(role) ?? {};
+        const managed = options.managedOurs?.native;
+        const config = managed ? { ...original, ...managed,
+            mcp_servers: { ...(original.mcp_servers ?? {}), ...(managed.mcp_servers ?? {}) },
+            plugins: { ...(original.plugins ?? {}), ...(managed.plugins ?? {}) },
+        } : original;
         if (role.session === 'codex-app-server')
             return this.nativeTransport({
                 name: role.name, argv: launch.argv, cwd: options.cwd, env: launch.env,
@@ -31,7 +37,7 @@ export class CodexAgentSessionAdapter {
                 model: role.model, effort: role.effort,
                 approvalPolicy: this.strategy.approvalPolicy(role),
                 sandbox: this.strategy.sandbox(role),
-                config: this.strategy.nativeConfig(role),
+                config,
                 addDirs: this.strategy.addDirs(role),
                 log: options.log,
             });
@@ -40,7 +46,8 @@ export class CodexAgentSessionAdapter {
             argv: launch.argv, cwd: options.cwd, env: launch.env,
             stateDir: options.stateDir, mode: options.mode, permissions: options.permissions,
             modeId: this.strategy.permissionModeId(role),
-            mcpServers: this.strategy.mcpServers(role),
+            mcpServers: options.managedOurs ? [...(this.strategy.mcpServers(role) ?? []).filter(s => s.name !== 'ours'), options.managedOurs.server] : this.strategy.mcpServers(role),
+            inheritEnvironment: options.managedOurs ? false : undefined,
             sessionMeta: this.strategy.sessionMeta(role, prep),
             configSelections: this.strategy.sessionConfigSelections(role),
             permissionMode: options.permissionMode,

package/dist/harness/codex.d.ts

@@ -6,8 +6,9 @@ import type { AcpSessionTransport } from './acp-session-transport.js';
 import type { CodexAppServerSessionTransport } from './codex-session.js';
 /**
  * What an unattended role can actually do under Codex's native settings.
- * `on-request` and `untrusted` stop to ask, and with no console attached that
- * request is refused rather than answered — so the role can only read.
+ * `on-request` and `untrusted` can ask even for startup file reads (for example,
+ * shell reads or files outside the sandbox). Without a controller the request
+ * waits or is denied according to policy. Neither guarantees `read-state`.
  */
 export declare function codexCapabilities(approval: string, sandbox: string): UnattendedCapability[];
 /** Defense in depth for callers which launch a role after validation was bypassed. */

package/dist/harness/codex.js

@@ -25,12 +25,13 @@ const CODEX_PROXY_REAL_PATH_ENV = 'OURS_FLEET_REAL_CODEX_PATH';
 const CODEX_PROXY_MANIFEST_ENV = 'OURS_FLEET_CODEX_ACP_MANIFEST';
 /**
  * What an unattended role can actually do under Codex's native settings.
- * `on-request` and `untrusted` stop to ask, and with no console attached that
- * request is refused rather than answered — so the role can only read.
+ * `on-request` and `untrusted` can ask even for startup file reads (for example,
+ * shell reads or files outside the sandbox). Without a controller the request
+ * waits or is denied according to policy. Neither guarantees `read-state`.
  */
 export function codexCapabilities(approval, sandbox) {
     if (approval !== 'never')
-        return ['read-state'];
+        return [];
     const caps = ['read-state', 'messaging', 'monitor', 'status-commands'];
     if (sandbox !== 'read-only')
         caps.push('write-state', 'workspace-edit');
@@ -167,6 +168,10 @@ function codexAgentLaunch(role, prep) {
             ...(options?.search ? ['--search'] : []),
             'app-server',
         ];
+        // Fleet delivers wakes through the native session itself. The ours-codex
+        // launcher owns a remote TUI and cannot serve this stdio transport.
+        if (launcher === 'auto' && role.monitor?.mode === 'fleet')
+            return { argv: ['codex', ...flags], env: prep.env };
         // Preserve the established `auto` launcher contract without resolving PATH
         // during synchronous launch preparation. The static shell fragment passes
         // every dynamic value as an argv element and `exec`s the selected process.

package/dist/harness/hermes-session.js

@@ -53,6 +53,12 @@ export class HermesAgentSessionAdapter {
         // composition; no second ambient merge may reintroduce provider secrets.
         const env = hermesChildEnvironment(role, preparedHome(prep), launch.env, launch.env);
         delete env.OURS_AUTOSTART;
+        if (options.managedOurs) {
+            for (const key of Object.keys(env))
+                if (key.startsWith('OURS_') && !key.startsWith('OURS_FLEET_'))
+                    delete env[key];
+            Object.assign(env, { FLEET_OURS_MANAGED: '1' });
+        }
         await this.checks.preflight?.(options, env);
         const nativeProvider = await this.checks.expectedProvider(role, prep);
         if (typeof nativeProvider !== 'string' || !nativeProvider.trim())
@@ -68,7 +74,7 @@ export class HermesAgentSessionAdapter {
             permissions: options.permissions, modeId, requireMode: true,
             permissionMode: { fleetMode: options.permissionMode.fleetMode, nativeMode: modeId },
             permissionTimeoutMs: 50_000,
-            mcpServers: hermesMcpServers(role, env),
+            mcpServers: options.managedOurs ? [...hermesMcpServers(role, env).filter(s => s.name !== 'ours'), options.managedOurs.server] : hermesMcpServers(role, env),
             scrubObsoleteOursAutostart: true,
             validateStartupResponse: async (initialized, created) => {
                 await this.checks.validateArtifact(initialized);

package/dist/init-wizard.d.ts

@@ -42,18 +42,23 @@ export interface InitPublishResult {
     manifestExisted: boolean;
     rootExisted: boolean;
 }
+export interface InitExecutionDeps {
+    hostSetup(): Promise<void>;
+    publish(configuration: string, setup: GeneratedSetup): Promise<InitPublishResult>;
+    generate?(answers: InitAnswers): GeneratedSetup;
+    preflight?(configuration: string): InitPathState;
+}
 export declare function validateCatalog(value: BrainCatalog, path?: string): BrainCatalog;
+/** Read and validate the complete public InitAnswers JSON shape without side effects. */
+export declare function readInitSettings(path: string): InitAnswers;
 export declare function askInitQuestions(prompter: InitPrompter, configuration: string): Promise<InitAnswers | undefined>;
 export declare function formatSetupSummary(answers: InitAnswers, configuration: string): string;
 /** Build the exact, deterministic default experience without writing to disk. */
 export declare function generateSetup(answers: InitAnswers): GeneratedSetup;
 /** Run the mutation boundary only after the complete questionnaire is accepted. */
-export declare function executeInitWizard(prompter: InitPrompter, configuration: string, deps: {
-    hostSetup(): Promise<void>;
-    publish(configuration: string, setup: GeneratedSetup): Promise<InitPublishResult>;
-    generate?(answers: InitAnswers): GeneratedSetup;
-    preflight?(configuration: string): InitPathState;
-}): Promise<InitPublishResult | undefined>;
+export declare function executeInitWizard(prompter: InitPrompter, configuration: string, deps: InitExecutionDeps): Promise<InitPublishResult | undefined>;
+/** Execute already-collected answers through the same validation and mutation boundary. */
+export declare function executeInitAnswers(answers: InitAnswers, configuration: string, deps: InitExecutionDeps): Promise<InitPublishResult>;
 export interface InitPathInspectionDeps {
     exists?(path: string): boolean;
     lstat?(path: string): Stats;

package/dist/init-wizard.js

@@ -49,6 +49,35 @@ function catalog() {
     const path = join(packagedPresetRoot(), 'brain-catalog.json');
     return validateCatalog(JSON.parse(readFileSync(path, 'utf8')), path);
 }
+const hasExactKeys = (value, keys) => Object.keys(value).sort().join('\0') === [...keys].sort().join('\0');
+/** Read and validate the complete public InitAnswers JSON shape without side effects. */
+export function readInitSettings(path) {
+    let value;
+    try {
+        value = JSON.parse(readFileSync(resolve(path), 'utf8'));
+    }
+    catch (error) {
+        throw new Error(`cannot read valid Fleet init settings ${path}: ${error.message}`, { cause: error });
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value)
+        || !hasExactKeys(value, ['subscriptions', 'assignmentStrategy', 'models', 'reasoning']))
+        throw new Error('Fleet init settings must contain exactly subscriptions, assignmentStrategy, models, and reasoning');
+    const candidate = value;
+    const models = candidate.models;
+    if (!models || typeof models !== 'object' || Array.isArray(models)
+        || !hasExactKeys(models, WORK_KINDS))
+        throw new Error('Fleet init settings models must contain exactly development, review, and coordination');
+    for (const work of WORK_KINDS) {
+        const model = models[work];
+        if (!model || typeof model !== 'object' || Array.isArray(model)
+            || !hasExactKeys(model, ['harness', 'session', 'model', 'efforts']))
+            throw new Error(`Fleet init settings ${work} model must contain exactly harness, session, model, and efforts`);
+    }
+    const answers = value;
+    // Generation is the single semantic/catalog validator for wizard and file input.
+    generateSetup(answers);
+    return answers;
+}
 const subscriptionFor = (model) => model.harness === 'codex' ? 'codex' : 'claude';
 export async function askInitQuestions(prompter, configuration) {
     const configPath = resolve(configuration);
@@ -216,6 +245,10 @@ export async function executeInitWizard(prompter, configuration, deps) {
     const answers = await askInitQuestions(prompter, configuration);
     if (!answers)
         return undefined;
+    return executeInitAnswers(answers, configuration, deps);
+}
+/** Execute already-collected answers through the same validation and mutation boundary. */
+export async function executeInitAnswers(answers, configuration, deps) {
     // Resolve every catalog/preset dependency before crossing the first mutation
     // boundary. Production owns this new map; the optional seam forces failures
     // deterministically in tests.

package/dist/monitor.d.ts

@@ -1,3 +1,4 @@
+import { type AttachOursClientOptions } from '@ours.network/sdk/client';
 import type { MonitorConfig, MonitorInterrupt, NotifyEventType } from './config.js';
 import { type FailureEvidence } from './model-recovery.js';
 /** A content-free arrival event as the daemon serves it over the notifications API. */
@@ -26,6 +27,28 @@ export type FetchLike = (url: string, init?: {
     headers?: Record<string, string>;
     signal?: AbortSignal;
 }) => Promise<FetchResponse>;
+export interface MonitorPageClient {
+    readNotificationPage(identity: string, options?: {
+        since?: number | 'tip';
+        signal?: AbortSignal;
+        requestTimeoutMs?: number;
+    }): Promise<{
+        cursor: number;
+        events: Array<Record<string, unknown>>;
+    }>;
+    close(): Promise<void>;
+}
+export interface IdentityProbeClient {
+    identities(): Promise<Array<string | {
+        name?: unknown;
+        temporary?: unknown;
+        stale?: unknown;
+    }>>;
+    close(): Promise<void>;
+}
+export interface IdentityProbeDeps {
+    attachClient?(options: AttachOursClientOptions): IdentityProbeClient | Promise<IdentityProbeClient>;
+}
 export interface MonitorDeps {
     fetch: FetchLike;
     isAlive(pid: number): boolean;
@@ -37,6 +60,8 @@ export interface MonitorDeps {
         set(fn: () => void, ms: number): ReturnType<typeof setTimeout>;
         clear(t: ReturnType<typeof setTimeout>): void;
     };
+    /** Test seam; production attaches through the SDK's verified selection path. */
+    attachClient?(options: AttachOursClientOptions): MonitorPageClient | Promise<MonitorPageClient>;
     /**
      * Structured prompt delivery used by agent sessions.
      * `succeeded` is the turn's TERMINAL result, not merely that the session took
@@ -101,13 +126,13 @@ export type IdentityPresence = {
     detail: string;
 };
 /** Resolve the daemon endpoint + auth header from env → config → defaults. */
-export declare function resolveEndpoint(env: NodeJS.ProcessEnv): DaemonEndpoint;
+export declare function resolveEndpoint(env: NodeJS.ProcessEnv, includeToken?: boolean): DaemonEndpoint;
 /**
  * Ask the daemon's authoritative identity index. The notifications endpoint is
  * intentionally unsuitable for lifecycle: it serves an empty 200 page for a
  * valid but missing identity, which made a closed temp identity look healthy.
  */
-export declare function probeIdentityPresence(name: string, fetch: FetchLike, env: NodeJS.ProcessEnv): Promise<IdentityPresence>;
+export declare function probeIdentityPresence(name: string, fetch: FetchLike, env: NodeJS.ProcessEnv, deps?: IdentityProbeDeps): Promise<IdentityPresence>;
 /** Actionable, secret-free description of every token source for this profile. */
 export declare function authResolutionHint(ep: DaemonEndpoint): string;
 /** Keep only the events whose type the role asked to wake on. */
@@ -171,7 +196,11 @@ export declare class Monitor {
     private readonly identity;
     private readonly cfg;
     private readonly deps;
-    private readonly ep;
+    private readonly ep?;
+    private readonly profile?;
+    private readonly profileKey;
+    private readonly monitorLeaseToken;
+    private profileClientPromise?;
     private readonly statusPath;
     private readonly cursorPath;
     private readonly statePath;
@@ -212,6 +241,8 @@ export declare class Monitor {
      * no-ops (delivery is still verified downstream).
      */
     private doFetch;
+    private profileClient;
+    private disposeProfileClient;
     private advance;
     private persistCursor;
     private readPersistedCursor;

package/dist/monitor.js

@@ -1,6 +1,9 @@
 import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { attachOursClient } from '@ours.network/sdk/client';
+import { clientProfileKey, readClientProfile, } from './client-profile.js';
 // Code constants rather than user configuration.
 const DEFAULT_PORT = 3050;
 // The daemon normally holds for 25s, but that value is operator-configurable
@@ -92,12 +95,12 @@ export function resolveApiToken(env, file = readDaemonConfig(env)) {
     return undefined;
 }
 /** Resolve the daemon endpoint + auth header from env → config → defaults. */
-export function resolveEndpoint(env) {
+export function resolveEndpoint(env, includeToken = true) {
     const file = readDaemonConfig(env);
     const port = envInt(env, 'OURS_PORT') ?? file.port ?? DEFAULT_PORT;
     const configPath = daemonConfigPath(env);
     const stateDir = env.OURS_STATE_DIR ?? file.stateDir ?? join(homedir(), '.ours');
-    const token = resolveApiToken(env, file);
+    const token = includeToken ? resolveApiToken(env, file) : undefined;
     const origin = `http://127.0.0.1:${port}`;
     return {
         origin,
@@ -113,7 +116,29 @@ export function resolveEndpoint(env) {
  * intentionally unsuitable for lifecycle: it serves an empty 200 page for a
  * valid but missing identity, which made a closed temp identity look healthy.
  */
-export async function probeIdentityPresence(name, fetch, env) {
+export async function probeIdentityPresence(name, fetch, env, deps = {}) {
+    const profile = readClientProfile(env);
+    if (profile) {
+        let client;
+        try {
+            client = await (deps.attachClient?.({
+                endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
+                credentialPath: profile.credentialPath,
+                sessionMode: 'external', leaseToken: randomUUID(), env: {},
+            }) ?? attachOursClient({
+                endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
+                credentialPath: profile.credentialPath,
+                sessionMode: 'external', leaseToken: randomUUID(), env: {},
+            }));
+            return classifyIdentityPresence(name, await client.identities());
+        }
+        catch {
+            return { state: 'unknown', detail: 'selected identity index is unavailable' };
+        }
+        finally {
+            await client?.close().catch(() => undefined);
+        }
+    }
     const ep = resolveEndpoint(env);
     let response;
     try {
@@ -131,25 +156,36 @@ export async function probeIdentityPresence(name, fetch, env) {
         };
     try {
         const body = await response.json();
-        if (!Array.isArray(body.identities))
-            return { state: 'unknown', detail: 'identity index response is malformed' };
-        // A healthy daemon normally has at least its Human identity. During daemon
-        // restart, however, the authenticated endpoint can briefly serve a valid
-        // but empty index while state is still loading. Empty is therefore not
-        // enough authority to retire a live temporary role.
-        if (body.identities.length === 0)
-            return { state: 'unknown', detail: 'identity index is temporarily empty' };
-        const found = body.identities.find(identity => (typeof identity === 'string' ? identity : identity?.name) === name);
-        if (!found)
-            return { state: 'absent' };
-        return typeof found === 'string'
-            ? { state: 'present', temporary: false, stale: false }
-            : { state: 'present', temporary: found.temporary === true, stale: found.stale === true };
+        return classifyIdentityPresence(name, body.identities);
     }
     catch (error) {
         return { state: 'unknown', detail: `identity index response is unreadable (${msg(error)})` };
     }
 }
+function classifyIdentityPresence(name, identities) {
+    if (!Array.isArray(identities))
+        return { state: 'unknown', detail: 'identity index response is malformed' };
+    // A healthy daemon normally has at least its Human identity. During daemon
+    // restart, however, the authenticated endpoint can briefly serve a valid
+    // but empty index while state is still loading. Empty is therefore not
+    // enough authority to retire a live temporary role.
+    if (identities.length === 0)
+        return { state: 'unknown', detail: 'identity index is temporarily empty' };
+    const found = identities.find(identity => (typeof identity === 'string'
+        ? identity
+        : identity && typeof identity === 'object'
+            ? identity.name
+            : undefined) === name);
+    if (!found)
+        return { state: 'absent' };
+    return typeof found === 'string'
+        ? { state: 'present', temporary: false, stale: false }
+        : {
+            state: 'present',
+            temporary: found.temporary === true,
+            stale: found.stale === true,
+        };
+}
 /** Actionable, secret-free description of every token source for this profile. */
 export function authResolutionHint(ep) {
     const tokenPath = join(ep.stateDir, 'daemon-token');
@@ -379,6 +415,10 @@ export class Monitor {
     cfg;
     deps;
     ep;
+    profile;
+    profileKey;
+    monitorLeaseToken = `ours-fleet-monitor-${process.pid}-${randomUUID()}`;
+    profileClientPromise;
     statusPath;
     cursorPath;
     statePath;
@@ -400,7 +440,9 @@ export class Monitor {
         this.identity = o.identity ?? o.name;
         this.cfg = o.cfg;
         this.deps = o.deps;
-        this.ep = resolveEndpoint(o.deps.env);
+        this.profile = readClientProfile(o.deps.env);
+        this.ep = this.profile ? undefined : resolveEndpoint(o.deps.env);
+        this.profileKey = this.profile ? clientProfileKey(this.profile) : this.ep.origin;
         this.statusPath = join(o.agentDir, '.monitor-status');
         this.cursorPath = join(o.agentDir, '.notify-cursor');
         this.statePath = join(o.agentDir, '.monitor-state.json');
@@ -428,8 +470,14 @@ export class Monitor {
         }
         catch (e) {
             if (e instanceof AuthError) {
-                this.fatal = true;
-                this.degrade('auth', e.message, 'failed');
+                if (this.profile) {
+                    this.cursor = null;
+                    this.degrade('auth', e.message);
+                }
+                else {
+                    this.fatal = true;
+                    this.degrade('auth', e.message, 'failed');
+                }
             }
             else {
                 this.cursor = null;
@@ -439,70 +487,81 @@ export class Monitor {
     }
     /** Long-poll → filter → coalesce → inject, until the pane pid dies or stop(). */
     async run(pid) {
-        if (this.fatal)
+        if (this.fatal) {
+            await this.disposeProfileClient();
             return;
+        }
         this.bootDeadline = this.deps.now() + BOOT_GRACE_MS;
         let backoff = 0;
         const pending = [];
-        while (!this.stopped) {
-            if (!this.deps.isAlive(pid)) {
-                this.degrade('offline', 'session offline');
-                return;
-            }
-            let body;
-            try {
-                body = await this.doFetch(String(this.cursor ?? 0), LONGPOLL_STALL_MS, 'stall');
-                backoff = 0;
-                // A poll that worked proves the stream is healthy — and only that.
-                this.recover('connectivity');
-            }
-            catch (e) {
-                if (this.stopped)
-                    return;
-                if (e instanceof AuthError) {
-                    this.fatal = true;
-                    this.degrade('auth', e.message, 'failed');
+        try {
+            while (!this.stopped) {
+                if (!this.deps.isAlive(pid)) {
+                    this.degrade('offline', 'session offline');
                     return;
                 }
-                backoff = Math.min(backoff + BACKOFF_STEP_MS, BACKOFF_MAX_MS);
-                this.degrade('connectivity', `stream hiccup (${msg(e)})`);
-                await this.deps.sleep(backoff);
-                continue;
-            }
-            this.advance(body.cursor, false);
-            const batch = filterEvents(body.events ?? [], this.cfg.wake_sources);
-            appendUniqueEvents(pending, batch);
-            if (pending.length === 0) {
-                this.persistCursor();
-                continue;
-            }
-            this.pendingState = {
-                count: pending.length,
-                eventTypes: uniq(pending.map(event => event.event ?? 'unknown')),
-                attempts: (this.pendingState?.attempts ?? 0) + 1,
-            };
-            this.persistState();
-            await this.coalesce(pending);
-            // Do not durably commit this cursor until the session explicitly accepts
-            // the wake. If delivery fails or the runner crashes, the daemon replays
-            // from the last committed cursor and the wake is attempted again.
-            let accepted = false;
-            try {
-                accepted = await this.deliver(pid, pending);
-            }
-            catch (e) {
-                this.degrade('delivery', `delivery failed (${msg(e)})`);
-            }
-            if (accepted) {
-                pending.length = 0;
-                this.pendingState = null;
-                this.persistCursor();
+                let body;
+                try {
+                    body = await this.doFetch(String(this.cursor ?? 0), LONGPOLL_STALL_MS, 'stall');
+                    backoff = 0;
+                    // A poll that worked proves the stream is healthy — and only that.
+                    this.recover('connectivity', 'auth');
+                }
+                catch (e) {
+                    if (this.stopped)
+                        return;
+                    if (e instanceof AuthError && !this.profile) {
+                        this.fatal = true;
+                        this.degrade('auth', e.message, 'failed');
+                        return;
+                    }
+                    backoff = Math.min(backoff + BACKOFF_STEP_MS, BACKOFF_MAX_MS);
+                    if (e instanceof AuthError)
+                        this.degrade('auth', e.message);
+                    else
+                        this.degrade('connectivity', `stream hiccup (${msg(e)})`);
+                    await this.deps.sleep(backoff);
+                    continue;
+                }
+                this.advance(body.cursor, false);
+                const batch = filterEvents(body.events ?? [], this.cfg.wake_sources);
+                appendUniqueEvents(pending, batch);
+                if (pending.length === 0) {
+                    this.persistCursor();
+                    continue;
+                }
+                this.pendingState = {
+                    count: pending.length,
+                    eventTypes: uniq(pending.map(event => event.event ?? 'unknown')),
+                    attempts: (this.pendingState?.attempts ?? 0) + 1,
+                };
+                this.persistState();
+                await this.coalesce(pending);
+                // Do not durably commit this cursor until the session explicitly accepts
+                // the wake. If delivery fails or the runner crashes, the daemon replays
+                // from the last committed cursor and the wake is attempted again.
+                let accepted = false;
+                try {
+                    accepted = await this.deliver(pid, pending);
+                }
+                catch (e) {
+                    this.degrade('delivery', `delivery failed (${msg(e)})`);
+                }
+                if (accepted) {
+                    pending.length = 0;
+                    this.pendingState = null;
+                    this.persistCursor();
+                }
             }
         }
+        finally {
+            await this.disposeProfileClient();
+        }
     }
     stop() {
         this.stopped = true;
         this.currentAbort?.abort();
+        void this.disposeProfileClient();
     }
     // ── internals ──────────────────────────────────────────────────────────────
     /** Gather stragglers arriving within batch_ms so a burst lands as one line. */
@@ -573,11 +632,24 @@ export class Monitor {
         const timer = this.deps.timers.set(() => { timedOut = true; ctrl.abort(); }, timeoutMs);
         let resp;
         try {
+            if (this.profile) {
+                const client = await this.profileClient();
+                const page = await client.readNotificationPage(this.identity, {
+                    since: since === 'tip' ? 'tip' : Number.parseInt(since, 10),
+                    signal: ctrl.signal,
+                    requestTimeoutMs: timeoutMs,
+                });
+                return { cursor: page.cursor, events: page.events };
+            }
             resp = await this.deps.fetch(`${this.ep.url(this.identity)}?since=${since}`, { headers: this.ep.headers, signal: ctrl.signal });
         }
         catch (error) {
             if (timedOut && timeoutKind === 'stall')
                 throw new Error(`notification stream stalled for ${Math.round(timeoutMs / 1000)}s`);
+            if (this.profile && /(?:HTTP\s*401|unauthori[sz]ed|API token)/i.test(msg(error)))
+                throw new AuthError(`daemon rejected the API token (401) — verify the credential file `
+                    + `${JSON.stringify(this.profile.credentialPath)} selected by `
+                    + `${JSON.stringify(this.profile.configPath)}`);
             throw error;
         }
         finally {
@@ -590,6 +662,34 @@ export class Monitor {
             throw new Error(`daemon returned HTTP ${resp.status}`);
         return resp.json();
     }
+    profileClient() {
+        if (!this.profile)
+            throw new Error('explicit client profile is not selected');
+        if (!this.profileClientPromise) {
+            const { endpoint, expectedInstanceId, credentialPath } = this.profile;
+            const options = {
+                endpoint, expectedInstanceId, credentialPath,
+                sessionMode: 'external', leaseToken: this.monitorLeaseToken, env: {},
+            };
+            this.profileClientPromise = Promise.resolve(this.deps.attachClient?.(options) ?? attachOursClient(options)).catch(error => {
+                this.profileClientPromise = undefined;
+                throw error;
+            });
+        }
+        return this.profileClientPromise;
+    }
+    async disposeProfileClient() {
+        const pending = this.profileClientPromise;
+        this.profileClientPromise = undefined;
+        if (!pending)
+            return;
+        try {
+            await (await pending).close();
+        }
+        catch {
+            this.deps.log(`[${this.name}] monitor: failed to close daemon client`);
+        }
+    }
     advance(cursor, persist = true) {
         if (typeof cursor === 'number' && cursor !== this.cursor) {
             this.cursor = cursor;
@@ -616,7 +716,7 @@ export class Monitor {
             if (existsSync(this.statePath)) {
                 const state = JSON.parse(readFileSync(this.statePath, 'utf8'));
                 if ((state.identity !== undefined && state.identity !== this.identity)
-                    || (state.profileKey !== undefined && state.profileKey !== this.ep.origin))
+                    || (state.profileKey !== undefined && state.profileKey !== this.profileKey))
                     return null;
                 if (typeof state.deliveredCursor === 'number') {
                     this.deliveredCursor = state.deliveredCursor;
@@ -641,7 +741,7 @@ export class Monitor {
             writeFileSync(tmp, JSON.stringify({
                 version: 1,
                 identity: this.identity,
-                profileKey: this.ep.origin,
+                profileKey: this.profileKey,
                 observedCursor: this.cursor,
                 deliveredCursor: this.deliveredCursor,
                 pending: this.pendingState,

package/dist/owner-channel/channel.d.ts

@@ -14,6 +14,8 @@ export interface OwnerChannelOptions {
     harness: string;
     config: OwnerChannelConfig;
     session: AgentSession;
+    /** Ordinary owner input must not cancel the initial briefing turn. */
+    startupPending?: () => boolean;
     stateDir: string;
     env?: Record<string, string>;
     log(line: string): void;
@@ -269,6 +271,7 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private attachmentGroups;
     private handleAttachmentGroup;
     private handle;
+    private ownerPromptPolicy;
     /**
      * Deterministic command path: the message never becomes an agent prompt.
      * Authorization already happened — the managed-agent relay branch and the