@ours.network/fleet 1.2.0-nightly.3 → 1.2.0-nightly.31

package/dist/doctor.js

@@ -10,7 +10,6 @@ import { agentDir, deriveXdgRuntimeDir } from './paths.js';
 import { resolveIsolation, harnessRuntimeDir } from './isolation/policy.js';
 import { hermesConfiguredProvider } from './harness/hermes-startup.js';
 import { makeBubblewrapBackend } from './isolation/bubblewrap.js';
-import { authResolutionHint, resolveEndpoint, } from './monitor.js';
 import { readClientProfile } from './client-profile.js';
 import { readScheduledLoops, storedLoopHealth } from './loops/state.js';
 import { controlSocketPath } from './session/control.js';
@@ -36,25 +35,21 @@ function resolveMonitorProfiles(roles) {
     const profiles = [];
     for (const role of roles.filter(r => r.monitor?.mode === 'fleet')) {
         const env = { ...process.env, ...(role.env ?? {}) };
-        const client = readClientProfile(env);
-        if (client) {
-            const existing = profiles.find(p => p.client?.endpoint === client.endpoint
-                && p.client.expectedInstanceId === client.expectedInstanceId
-                && p.client.credentialPath === client.credentialPath);
-            if (existing)
-                existing.roles.push(role.name);
-            else
-                profiles.push({ client, roles: [role.name] });
+        let client;
+        try {
+            client = readClientProfile(env);
+        }
+        catch (error) {
+            profiles.push({ roles: [role.name], error: error instanceof Error ? error.message : 'Invalid gateway profile' });
             continue;
         }
-        const endpoint = resolveEndpoint(env);
-        const token = endpoint.headers['x-ours-api-token'];
-        const existing = profiles.find(p => p.endpoint?.origin === endpoint.origin
-            && p.endpoint.headers['x-ours-api-token'] === token);
+        const existing = profiles.find(p => p.client?.endpoint === client.endpoint
+            && p.client.expectedInstanceId === client.expectedInstanceId
+            && p.client.credentialPath === client.credentialPath);
         if (existing)
             existing.roles.push(role.name);
         else
-            profiles.push({ endpoint, roles: [role.name] });
+            profiles.push({ client, roles: [role.name] });
     }
     return profiles;
 }
@@ -155,7 +150,7 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     // ── Rooms/tasks checks ────────────────────────────────────────
     if (loaded.ok && loaded.rooms) {
         const rooms = loaded.rooms;
-        // Cowork socket reachability
+        // Cowork gateway reachability
         const coworkConfig = rooms.cowork?.config;
         try {
             const { createCoworkAdapter } = await import('./rooms-tasks/cowork-adapter.js');
@@ -164,14 +159,14 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
             checks.push({
                 name: 'cowork', ok: reachable,
                 detail: reachable
-                    ? 'management socket reachable'
-                    : `management socket unreachable${coworkConfig ? ` (config: ${coworkConfig})` : ''}`,
+                    ? 'gateway management reachable'
+                    : `gateway management unreachable${coworkConfig ? ` (config: ${coworkConfig})` : ''}`,
             });
         }
         catch (e) {
             checks.push({
                 name: 'cowork', ok: false,
-                detail: `management socket error${coworkConfig ? ` (config: ${coworkConfig})` : ''}: ${e?.message ?? e}`,
+                detail: `gateway management error${coworkConfig ? ` (config: ${coworkConfig})` : ''}: ${e?.message ?? e}`,
             });
         }
         // Owner CID shape
@@ -218,17 +213,6 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                     : `template '${defaultTemplate}' not found`,
             });
         }
-        // Shared-daemon selection coherence
-        if (rooms.cowork?.config) {
-            const { existsSync: exists } = await import('node:fs');
-            const configOk = exists(rooms.cowork.config);
-            checks.push({
-                name: 'rooms: cowork config', ok: configOk,
-                detail: configOk
-                    ? `cowork config at ${rooms.cowork.config}`
-                    : `cowork config not found: ${rooms.cowork.config}`,
-            });
-        }
         // Hard room-management capability check
         try {
             const { createCoworkAdapter } = await import('./rooms-tasks/cowork-adapter.js');
@@ -272,21 +256,36 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
         }
         catch { /* state dir may not exist yet */ }
     }
+    let managedSelection = true;
     try {
+        // Mark explicit selection before validation so a damaged managed profile does
+        // not produce advice to start an unrelated local daemon.
+        managedSelection = true;
+        const selected = readClientProfile(process.env);
+        managedSelection = selected !== undefined;
         const client = await attachDaemon({
-            env: process.env,
+            endpoint: selected.endpoint, expectedInstanceId: selected.expectedInstanceId,
+            credentialPath: selected.credentialPath, env: {}, sessionMode: 'external',
             leaseToken: `ours-fleet-doctor-${process.pid}`,
-            clientPid: process.pid,
         });
-        const info = await client.version();
-        if (info.name !== 'ours' || typeof info.version !== 'string')
-            throw new Error('the selected endpoint did not return a valid ours daemon identity');
-        checks.push({ name: 'ours daemon', ok: true, detail: `running (${info.version})` });
+        let daemonVersion;
+        try {
+            const info = await client.version();
+            if (info.name !== 'ours' || typeof info.version !== 'string')
+                throw new Error('the selected endpoint did not return a valid ours daemon identity');
+            daemonVersion = info.version;
+        }
+        finally {
+            await client.close();
+        }
+        checks.push({ name: 'ours daemon', ok: true, detail: `running (${daemonVersion})` });
     }
     catch (error) {
         checks.push({
             name: 'ours daemon', ok: false,
-            detail: `not reachable through the SDK — start it with: ours-daemon start `
+            detail: (managedSelection
+                ? 'selected client profile failed — check its endpoint, instance and issued credential '
+                : 'not reachable through the SDK — start it with: ours-daemon start ')
                 + `[${error?.message ?? String(error)}]`,
         });
     }
@@ -429,14 +428,18 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     // shared-mode misconfig (401) surfaces here rather than as a silent deaf monitor.
     const monitorProfiles = resolveMonitorProfiles(roles);
     for (const profile of monitorProfiles) {
-        const { endpoint, client: selected } = profile;
+        const selected = profile.client;
         const checkName = monitorProfiles.length === 1
             ? 'monitor: daemon API'
             : `monitor: daemon API (${profile.roles.join(', ')})`;
-        let ok = false, detail;
+        let ok = false, detail = 'gateway profile unavailable';
+        if (profile.error) {
+            checks.push({ name: checkName, ok: false, detail: profile.error });
+            continue;
+        }
         try {
             if (selected) {
-                const daemon = await attachOursClient({
+                const daemon = await attachDaemon({
                     endpoint: selected.endpoint,
                     expectedInstanceId: selected.expectedInstanceId,
                     credentialPath: selected.credentialPath,
@@ -445,7 +448,7 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 });
                 try {
                     const [info, identities] = await Promise.all([
-                        daemon.version(), daemon.identities(),
+                        daemon.version(), daemon.identities?.(),
                     ]);
                     if (info.name !== 'ours' || !Array.isArray(identities))
                         throw new Error('selected daemon metadata is invalid');
@@ -458,27 +461,11 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 checks.push({ name: checkName, ok, detail });
                 continue;
             }
-            const live = await fetchImpl(`${endpoint.origin}/state-dir`, {});
-            if (!live.ok) {
-                detail = `daemon on :${endpoint.port} answered /state-dir with HTTP ${live.status} — not the ours daemon?`;
-            }
-            else {
-                const auth = await fetchImpl(`${endpoint.origin}/identities`, { headers: endpoint.headers });
-                if (auth.status === 401)
-                    detail = `reachable on :${endpoint.port} but the API token was rejected (401) — ` +
-                        authResolutionHint(endpoint);
-                else if (!auth.ok)
-                    detail = `reachable on :${endpoint.port} but /identities returned HTTP ${auth.status}`;
-                else {
-                    ok = true;
-                    detail = `reachable on :${endpoint.port}, authorized — supervisor wake stream available`;
-                }
-            }
         }
         catch (e) {
-            const target = selected?.endpoint ?? `:${endpoint.port}`;
+            const target = selected.endpoint;
             detail = `unreachable on ${target} — monitored roles run degraded until it is up ` +
-                `(start it: ours-daemon start) [${e?.message ?? e}]`;
+                `(check the configured gateway and issued credential) [${e?.message ?? e}]`;
         }
         checks.push({ name: checkName, ok, detail });
     }

package/dist/erased-resources.d.ts

@@ -0,0 +1,9 @@
+export declare const erasedArg: (value: string) => string;
+export declare function redactErasedContent<T>(value: T): T;
+/** Every cooperative writer filters stale in-memory snapshots under the same lock as erasure. */
+export declare function writePrivacyFilteredLedger(path: string, value: unknown): void;
+/** Content-free resource IDs persist to prevent active writers resurrecting erased labels. */
+export declare function eraseResourcePresentations(resources: ReadonlyArray<{
+    kind: 'task' | 'room' | 'agent';
+    id: string;
+}>): void;

package/dist/erased-resources.js

@@ -0,0 +1,87 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically, withSynchronousFileLock } from './atomic-file.js';
+import { stateRoot } from './paths.js';
+const registryPath = () => join(stateRoot(), 'erased-resources.json');
+const lockPath = () => join(stateRoot(), 'locks', 'audit-erasure');
+const ledgerNames = ['.fleet-command-audit.json', '.owner-channel-command-audit.json', '.owner-channel-lifecycle-outbox.json'];
+export const erasedArg = (value) => `[erased:${createHash('sha256').update(value).digest('hex')}]`;
+function registry() {
+    if (!existsSync(registryPath()))
+        return new Set();
+    const value = JSON.parse(readFileSync(registryPath(), 'utf8'));
+    if (!Array.isArray(value) || value.some(v => typeof v !== 'string'))
+        throw new Error('Invalid erasure registry');
+    return new Set(value);
+}
+/** Preserve delivery/deduplication metadata while removing owned presentation content. */
+function redact(value, erased) {
+    if (Array.isArray(value))
+        return value.map(item => redact(item, erased));
+    if (!value || typeof value !== 'object')
+        return value;
+    const next = { ...value };
+    const kind = value.kind === 'lifecycle_failure' ? value.resource?.toLowerCase() : value.kind === 'agent_started' ? 'agent' : value.kind;
+    if (typeof value.id === 'string' && erased.has(`${kind}:${value.id}`)) {
+        for (const key of ['title', 'reason', 'roomName', 'label', 'template', 'configuration', 'model', 'permissions'])
+            delete next[key];
+        if (kind === 'task')
+            next.agents = [];
+        if (kind === 'room') {
+            delete next.name;
+            next.participants = [];
+        }
+        if (kind === 'agent') {
+            next.name = 'erased';
+            next.brain = '[erased]';
+            next.role = '[erased]';
+            next.inherited = [];
+        }
+    }
+    if (typeof value.roomId === 'string' && erased.has(`room:${value.roomId}`)) {
+        delete next.roomName;
+        if (kind === 'task')
+            next.agents = [];
+    }
+    const resources = value.outcome?.resourceIds;
+    const ownsAttempt = resources && Object.entries(resources).some(([key, id]) => erased.has(`${key}:${id}`));
+    const ownsPresentation = value.outcome?.presentations?.some((p) => erased.has(`${p.kind === 'agent_started' ? 'agent' : p.kind}:${p.id}`));
+    if ((ownsAttempt || ownsPresentation) && Array.isArray(value.argv) && !value.erased) {
+        next.argv = value.argv.map(erasedArg);
+        next.erased = true;
+    }
+    for (const key of Object.keys(next))
+        if (typeof next[key] === 'object')
+            next[key] = redact(next[key], erased);
+    return next;
+}
+export function redactErasedContent(value) { return redact(value, registry()); }
+/** Every cooperative writer filters stale in-memory snapshots under the same lock as erasure. */
+export function writePrivacyFilteredLedger(path, value) {
+    withSynchronousFileLock(lockPath(), () => replaceFileAtomically(path, JSON.stringify(redact(value, registry())) + '\n'));
+}
+/** Content-free resource IDs persist to prevent active writers resurrecting erased labels. */
+export function eraseResourcePresentations(resources) {
+    withSynchronousFileLock(lockPath(), () => {
+        const erased = registry();
+        for (const resource of resources)
+            erased.add(`${resource.kind}:${resource.id}`);
+        replaceFileAtomically(registryPath(), JSON.stringify([...erased]));
+        for (const root of [join(stateRoot(), 'agents'), join(stateRoot(), 'tmp'), join(stateRoot(), 'recovery', 'temporary')]) {
+            if (!existsSync(root))
+                continue;
+            for (const entry of readdirSync(root, { withFileTypes: true })) {
+                if (!entry.isDirectory() || entry.isSymbolicLink())
+                    continue;
+                for (const name of ledgerNames) {
+                    const path = join(root, entry.name, name);
+                    if (!existsSync(path) || !lstatSync(path).isFile() || lstatSync(path).isSymbolicLink())
+                        continue;
+                    const old = JSON.parse(readFileSync(path, 'utf8'));
+                    replaceFileAtomically(path, JSON.stringify(redact(old, erased)) + '\n');
+                }
+            }
+        }
+    });
+}

package/dist/fleet-command-audit.d.ts

@@ -113,6 +113,7 @@ export interface FleetCommandClassification {
     decision: FleetCommandDecision;
 }
 export interface FleetAuditAttempt {
+    erased?: boolean;
     version: 1;
     correlationId: string;
     requestId: string;

package/dist/fleet-command-audit.js

@@ -1,7 +1,7 @@
+import { erasedArg, redactErasedContent, writePrivacyFilteredLedger } from './erased-resources.js';
 import { existsSync, readFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { Buffer } from 'node:buffer';
-import { replaceFileAtomically } from './atomic-file.js';
 import { isSensitiveConfigKey } from './sensitive-config.js';
 import { mandatoryConfigurationFits } from './lifecycle-summary.js';
 import { MARKDOWN_MAX_BYTES, MARKDOWN_MAX_CODE_POINTS, markdownCode, markdownProse, } from './rooms-tasks/markdown.js';
@@ -91,7 +91,7 @@ export function recordFleetAuditPresentation(value) {
                 : value.kind === 'lifecycle_failure'
                     ? { label: fleetPresentationLabel(value.label) }
                     : {};
-        const presentation = structuredClone({ ...value, ...labels, eventId: basis });
+        const presentation = redactErasedContent(structuredClone({ ...value, ...labels, eventId: basis }));
         const digest = lifecycleEventDigestBasis(presentation);
         if (!collection.presentations.some(existing => lifecycleEventDigestBasis(existing) === digest))
             collection.presentations.push(presentation);
@@ -117,6 +117,7 @@ export function consumeFleetAuditCollection() {
 const SAFE_READ = new Set(['docs', 'version', 'config', 'ls', 'peek', 'logs', 'status', 'doctor']);
 const AGENT_SURFACES = {
     spawn: new Set(['<none>']),
+    ours: new Set(['tools', 'call']),
     template: new Set(['list', 'show', 'validate']),
     task: new Set(['create', 'list', 'lists', 'list-create', 'list-rename', 'list-delete', 'move',
         'show', 'start', 'block', 'unblock', 'review', 'done', 'cancel', 'delete', 'work', 'finish']),
@@ -132,7 +133,7 @@ export const fleetProxyTopLevelInventory = Object.freeze({
         'up', 'down', 'restart', 'force-restart', 'attach', 'send', 'loops', 'owner-channel',
         'watchdog-run', 'watchdog-report', 'rm', 'init', 'web',
     ], denied: [...DENIED],
-    hidden: ['_run', '_run-temp', '_run-watchdog', '_run-watchdogs'], aliases: ['man'],
+    hidden: ['_run', '_run-temp', '_run-temp-worker', '_run-watchdog', '_run-watchdogs'], aliases: ['man'],
 });
 const globalValueOptions = new Set(['-c', '--configuration']);
 /** Classify before Commander parsing. Unknown and internal paths fail closed. */
@@ -189,7 +190,7 @@ const sensitiveValueFlags = new Set([
     '--identity', '--invite', '--token', '--api-token', '--password', '--password-file',
     '--env', '--brief', '--brief-file', '--bio-file', '--persona-file', '--isolation-file', '--loops-file',
     '--configuration', '-c', '--public-invite', '--public-invite-file', '--invite-file',
-    '--summary-file', '--text', '--message', '--summary', '--reason', '--goal', '--cwd',
+    '--args-file', '--summary-file', '--text', '--message', '--summary', '--reason', '--goal', '--cwd',
     '--identity-cid', '--owner-cid', '--contact-cid', '--codex-config', '--add-dir',
 ]);
 function redactUrl(value) {
@@ -304,11 +305,12 @@ export class FleetCommandAuditStore {
         if (recovered)
             this.persist();
     }
-    list() { return this.attempts.map(item => structuredClone(item)); }
+    list() { return redactErasedContent(this.attempts).map(item => structuredClone(item)); }
     begin(requestId, caller, argv) {
+        this.attempts = redactErasedContent(this.attempts);
         const existing = this.attempts.find(item => item.caller === caller && item.requestId === requestId);
         if (existing) {
-            if (JSON.stringify(existing.argv) !== JSON.stringify(redactFleetArgv(argv)))
+            if (JSON.stringify(existing.argv) !== JSON.stringify(existing.erased ? redactFleetArgv(argv).map(erasedArg) : redactFleetArgv(argv)))
                 throw new Error('fleet command request ID was reused with different argv');
             return structuredClone(existing);
         }
@@ -328,6 +330,8 @@ export class FleetCommandAuditStore {
         return structuredClone(attempt);
     }
     finish(correlationId, caller, outcome) {
+        this.attempts = redactErasedContent(this.attempts);
+        outcome = redactErasedContent({ outcome }).outcome;
         const attempt = this.owned(correlationId, caller);
         if (!attempt.outcome)
             attempt.outcome = { ...outcome, completedAt: this.deps.now().toISOString(), delivery: 'sending' };
@@ -359,7 +363,8 @@ export class FleetCommandAuditStore {
         return attempt;
     }
     persist() {
-        replaceFileAtomically(this.path, `${JSON.stringify({ version: 1, attempts: this.attempts })}\n`, 0o600);
+        this.attempts = redactErasedContent(this.attempts);
+        writePrivacyFilteredLedger(this.path, { version: 1, attempts: this.attempts });
     }
 }
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;

package/dist/harness/agent-session.d.ts

@@ -1,3 +1,4 @@
+import type { ManagedHarnessOurs } from '../agent-ours/harness.js';
 import type { CommonPermissions, FleetPermissionMode, ResolvedRole } from '../config.js';
 import type { AgentSession } from '../session/types.js';
 import type { Launch, SessionPrep } from './types.js';
@@ -22,6 +23,7 @@ export interface AgentSessionConfigSelection {
     value: string;
 }
 export interface AgentSessionStartOptions {
+    managedOurs?: ManagedHarnessOurs;
     role: ResolvedRole;
     prep: SessionPrep;
     launch: PreparedAgentSessionLaunch;

package/dist/harness/claude-code-session.js

@@ -1,3 +1,4 @@
+import { managedClaudeMeta } from '../agent-ours/harness.js';
 import { AcpSession } from '../session/acp.js';
 import { acpAdapterState, } from './acp-session-transport.js';
 /** Explicit Claude Code implementation of Fleet's shared agent-session factory. */
@@ -25,8 +26,9 @@ export class ClaudeCodeAgentSessionAdapter {
             argv: launch.argv, cwd: options.cwd, env: launch.env,
             stateDir: options.stateDir, mode: options.mode, permissions: options.permissions,
             modeId: this.strategy.permissionModeId(role),
-            mcpServers: this.strategy.mcpServers(role),
-            sessionMeta: this.strategy.sessionMeta(role, prep),
+            mcpServers: options.managedOurs ? [...(this.strategy.mcpServers(role) ?? []).filter(s => s.name !== 'ours'), options.managedOurs.server] : this.strategy.mcpServers(role),
+            inheritEnvironment: options.managedOurs ? false : undefined,
+            sessionMeta: options.managedOurs ? managedClaudeMeta(this.strategy.sessionMeta(role, prep)) : this.strategy.sessionMeta(role, prep),
             configSelections: this.strategy.sessionConfigSelections(role),
             permissionMode: options.permissionMode,
             permissionMetadataSource: acpAdapterState(launch.adapterState).permissionMetadataSource,

package/dist/harness/codex-app-server-proxy.d.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+type JsonObject = Record<string, unknown>;
 interface TerminalRecoveryOptions {
     sendToCodex(line: string): void;
     emitToClient(line: string): void;
@@ -39,6 +40,8 @@ export declare class CodexTerminalRecovery {
     private finishTurn;
 }
 /** Transform one app-server NDJSON request; malformed input passes through. */
-export declare function rewriteCodexAppServerRequest(line: string, approval: string, expectedSandbox: string, disableInheritedMcp?: boolean): string;
+export declare function rewriteCodexAppServerRequest(line: string, approval: string, expectedSandbox: string, disableInheritedMcp?: boolean, managedOursTools?: JsonObject): string;
+/** ACP only carries transport fields; read policy from Fleet's complete config. */
+export declare function managedCodexToolPolicy(env: NodeJS.ProcessEnv): JsonObject | undefined;
 export declare function runCodexAppServerProxy(): void;
 export {};

package/dist/harness/codex-app-server-proxy.js

@@ -300,9 +300,9 @@ function sandboxMode(policy) {
  * Fleet keeps the preset's sandbox policy, but restores the independently
  * configured approval policy on the request Codex actually executes.
  */
-function rewriteMessage(value, approval, expectedSandbox, disableInheritedMcp) {
+function rewriteMessage(value, approval, expectedSandbox, disableInheritedMcp, managedOursTools) {
     if (Array.isArray(value))
-        return value.map(candidate => rewriteMessage(candidate, approval, expectedSandbox, disableInheritedMcp));
+        return value.map(candidate => rewriteMessage(candidate, approval, expectedSandbox, disableInheritedMcp, managedOursTools));
     if (!isObject(value) || !isObject(value.params))
         return value;
     if (value.method === 'turn/start') {
@@ -318,17 +318,52 @@ function rewriteMessage(value, approval, expectedSandbox, disableInheritedMcp) {
             params: { ...value.params, config: { ...config, mcp_servers: {} } },
         };
     }
+    if (managedOursTools
+        && (value.method === 'thread/start' || value.method === 'thread/resume')) {
+        const config = isObject(value.params.config) ? value.params.config : {};
+        const servers = isObject(config.mcp_servers) ? config.mcp_servers : {};
+        const ours = servers.ours;
+        // Policy cannot create or re-enable a connector that ACP did not inject.
+        if (!isObject(ours) || ours.enabled === false)
+            return value;
+        const tools = isObject(ours.tools) ? { ...ours.tools } : {};
+        for (const [name, policy] of Object.entries(managedOursTools)) {
+            if (isObject(policy))
+                tools[name] = {
+                    ...(isObject(tools[name]) ? tools[name] : {}), ...policy,
+                };
+        }
+        return { ...value, params: { ...value.params, config: { ...config,
+                    mcp_servers: { ...servers, ours: { ...ours, tools } },
+                } } };
+    }
     return value;
 }
 /** Transform one app-server NDJSON request; malformed input passes through. */
-export function rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp = false) {
+export function rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp = false, managedOursTools) {
     try {
-        return JSON.stringify(rewriteMessage(JSON.parse(line), approval, expectedSandbox, disableInheritedMcp));
+        return JSON.stringify(rewriteMessage(JSON.parse(line), approval, expectedSandbox, disableInheritedMcp, managedOursTools));
     }
     catch {
         return line;
     }
 }
+/** ACP only carries transport fields; read policy from Fleet's complete config. */
+export function managedCodexToolPolicy(env) {
+    if (env.FLEET_OURS_MANAGED !== '1')
+        return undefined;
+    try {
+        const config = JSON.parse(env.CODEX_CONFIG ?? '{}');
+        const servers = isObject(config) ? config.mcp_servers : undefined;
+        const ours = isObject(servers) ? servers.ours : undefined;
+        return isObject(ours) && ours.enabled !== false && isObject(ours.tools)
+            ? ours.tools : undefined;
+    }
+    catch {
+        // Invalid config never grants tool approval. ACP owns config diagnostics.
+        return undefined;
+    }
+}
 function requiredChoice(name, allowed) {
     const value = process.env[name];
     if (value && allowed.has(value))
@@ -355,6 +390,7 @@ export function runCodexAppServerProxy() {
     const approval = requiredChoice(APPROVAL_ENV, APPROVAL_POLICIES);
     const expectedSandbox = requiredChoice(SANDBOX_ENV, SANDBOX_MODES);
     const disableInheritedMcp = process.env[DISABLE_INHERITED_MCP_ENV] === '1';
+    const managedOursTools = managedCodexToolPolicy(process.env);
     const launch = realCodexLaunch();
     const env = { ...process.env };
     delete env.CODEX_PATH;
@@ -450,7 +486,7 @@ export function runCodexAppServerProxy() {
     input.on('line', line => {
         if (finished)
             return;
-        const rewritten = rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp);
+        const rewritten = rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp, managedOursTools);
         recovery.observeClientLine(rewritten);
         writeToChild(rewritten);
     });

package/dist/harness/codex-session.js

@@ -23,6 +23,12 @@ export class CodexAgentSessionAdapter {
     }
     start(options) {
         const { role, prep, launch } = options;
+        const original = this.strategy.nativeConfig(role) ?? {};
+        const managed = options.managedOurs?.native;
+        const config = managed ? { ...original, ...managed,
+            mcp_servers: { ...(original.mcp_servers ?? {}), ...(managed.mcp_servers ?? {}) },
+            plugins: { ...(original.plugins ?? {}), ...(managed.plugins ?? {}) },
+        } : original;
         if (role.session === 'codex-app-server')
             return this.nativeTransport({
                 name: role.name, argv: launch.argv, cwd: options.cwd, env: launch.env,
@@ -31,7 +37,7 @@ export class CodexAgentSessionAdapter {
                 model: role.model, effort: role.effort,
                 approvalPolicy: this.strategy.approvalPolicy(role),
                 sandbox: this.strategy.sandbox(role),
-                config: this.strategy.nativeConfig(role),
+                config,
                 addDirs: this.strategy.addDirs(role),
                 log: options.log,
             });
@@ -40,7 +46,8 @@ export class CodexAgentSessionAdapter {
             argv: launch.argv, cwd: options.cwd, env: launch.env,
             stateDir: options.stateDir, mode: options.mode, permissions: options.permissions,
             modeId: this.strategy.permissionModeId(role),
-            mcpServers: this.strategy.mcpServers(role),
+            mcpServers: options.managedOurs ? [...(this.strategy.mcpServers(role) ?? []).filter(s => s.name !== 'ours'), options.managedOurs.server] : this.strategy.mcpServers(role),
+            inheritEnvironment: options.managedOurs ? false : undefined,
             sessionMeta: this.strategy.sessionMeta(role, prep),
             configSelections: this.strategy.sessionConfigSelections(role),
             permissionMode: options.permissionMode,

package/dist/harness/codex.d.ts

@@ -6,8 +6,9 @@ import type { AcpSessionTransport } from './acp-session-transport.js';
 import type { CodexAppServerSessionTransport } from './codex-session.js';
 /**
  * What an unattended role can actually do under Codex's native settings.
- * `on-request` and `untrusted` stop to ask, and with no console attached that
- * request is refused rather than answered — so the role can only read.
+ * `on-request` and `untrusted` can ask even for startup file reads (for example,
+ * shell reads or files outside the sandbox). Without a controller the request
+ * waits or is denied according to policy. Neither guarantees `read-state`.
  */
 export declare function codexCapabilities(approval: string, sandbox: string): UnattendedCapability[];
 /** Defense in depth for callers which launch a role after validation was bypassed. */

package/dist/harness/codex.js

@@ -25,12 +25,13 @@ const CODEX_PROXY_REAL_PATH_ENV = 'OURS_FLEET_REAL_CODEX_PATH';
 const CODEX_PROXY_MANIFEST_ENV = 'OURS_FLEET_CODEX_ACP_MANIFEST';
 /**
  * What an unattended role can actually do under Codex's native settings.
- * `on-request` and `untrusted` stop to ask, and with no console attached that
- * request is refused rather than answered — so the role can only read.
+ * `on-request` and `untrusted` can ask even for startup file reads (for example,
+ * shell reads or files outside the sandbox). Without a controller the request
+ * waits or is denied according to policy. Neither guarantees `read-state`.
  */
 export function codexCapabilities(approval, sandbox) {
     if (approval !== 'never')
-        return ['read-state'];
+        return [];
     const caps = ['read-state', 'messaging', 'monitor', 'status-commands'];
     if (sandbox !== 'read-only')
         caps.push('write-state', 'workspace-edit');

package/dist/harness/hermes-session.js

@@ -53,6 +53,12 @@ export class HermesAgentSessionAdapter {
         // composition; no second ambient merge may reintroduce provider secrets.
         const env = hermesChildEnvironment(role, preparedHome(prep), launch.env, launch.env);
         delete env.OURS_AUTOSTART;
+        if (options.managedOurs) {
+            for (const key of Object.keys(env))
+                if (key.startsWith('OURS_') && !key.startsWith('OURS_FLEET_'))
+                    delete env[key];
+            Object.assign(env, { FLEET_OURS_MANAGED: '1' });
+        }
         await this.checks.preflight?.(options, env);
         const nativeProvider = await this.checks.expectedProvider(role, prep);
         if (typeof nativeProvider !== 'string' || !nativeProvider.trim())
@@ -68,7 +74,7 @@ export class HermesAgentSessionAdapter {
             permissions: options.permissions, modeId, requireMode: true,
             permissionMode: { fleetMode: options.permissionMode.fleetMode, nativeMode: modeId },
             permissionTimeoutMs: 50_000,
-            mcpServers: hermesMcpServers(role, env),
+            mcpServers: options.managedOurs ? [...hermesMcpServers(role, env).filter(s => s.name !== 'ours'), options.managedOurs.server] : hermesMcpServers(role, env),
             scrubObsoleteOursAutostart: true,
             validateStartupResponse: async (initialized, created) => {
                 await this.checks.validateArtifact(initialized);