@ours.network/fleet 1.2.0-nightly.3 → 1.2.0-nightly.4

package/README.md

@@ -52,11 +52,10 @@ briefing.md per role  ──►  agent session adapter  ──►  native app-se
 ```
 
 Each role gets a state dir (`~/.ours-fleet/agents/<Name>/`) holding its briefing,
-logs, routines, and session markers. On boot the agent reads its briefing: bind
-identity, publish bio/persona, announce to its coordinator, work — while the
+logs, routines, and session markers. Before boot, the supervisor binds the assigned identity and prepares its room.
+The agent then reads its briefing and starts work — while the
 supervisor delivers its mail wakes as `[fleet-monitor]` console lines (see
-[Mail monitor](#mail-monitor)). Set `monitor.mode: native` when the harness
-should own mail wake instead. On crash the supervisor relaunches it and the
+[Mail monitor](#mail-monitor)). Managed ours sessions use supervisor-owned mail wakes. On crash the supervisor relaunches it and the
 harness resumes the same session.
 
 The state dir contract:
@@ -231,15 +230,11 @@ from the current runner generation and excludes adapter `session/load` replay;
 those replay events remain in the durable ledger with `agent_replay` provenance
 for diagnosis and recovery rather than appearing as current work.
 
-For every temporary role, the first-boot instructions call ours MCP
-`create_temporary_identity` with the exact assigned name, so the new identity
-is owned and cleaned up by that connector session lifecycle. Temporary roles
-never bind pre-existing identities or fall back to permanent `create_identity`.
-Fleet does not inspect, preserve, or provision an ours identity for temp spawn.
-A collision, missing tool, or creation error stops for operator review; fleet
-never force-adopts or deletes identity state. Permanent roles are
-provisioned by fleet before launch and never delegate normal identity creation
-to the harness.
+The Fleet supervisor creates and binds the assigned identity before the harness
+starts. Temporary identities survive harness reconnects and are released only when
+the logical run ends. Permanent identities remain available after the supervisor
+releases ownership. Agents receive ready tools; no model-owned identity bootstrap
+or onboarding skill is required.
 
 The web console uses structured ACP activity rather than exposing a raw agent terminal.
 
@@ -649,10 +644,10 @@ originating task. Existing active rooms are not retroactively migrated, and room
 with Owner attachment disabled receive no Owner grant.
 
 Fleet launches each template member with a dedicated one-time Cowork invite.
-The generated temporary-agent briefing contains the exact identity name, invite,
-Cowork role, and task. The agent creates that identity itself with ours MCP
-`create_temporary_identity`, accepts the invite with `add_contact`, and starts
-work immediately. A room is ready only after the Cowork room (and its task, when
+The supervisor accepts the startup invite and verifies the provisioned identity CID
+in the authenticated room seat before starting the model. The generated briefing
+contains the assigned identity, room, role and task, without invite material.
+A room is ready only after the Cowork room (and its task, when
 task-bound) is durably active, every configured member seat is authenticated and active with its matching
 live Fleet launch, and the configured Owner seat is active when owner attachment is
 enabled. There is no briefing hash, startup ACK, or separate role-briefing readiness
@@ -675,8 +670,8 @@ Set `room.anonymous: true` on a room template, or pass `--anonymous` to
 `task create`, `task start`, `task work`, or `room create`, to create an
 anonymous Cowork room. `--no-anonymous` explicitly overrides an anonymous
 template. Fleet records the resolved value before room creation so retries keep
-the same choice. Temporary members of an anonymous room are instructed to call
-`create_temporary_identity` with `expose_local=false`. Their generated briefings
+the same choice. The supervisor creates anonymous room members with local contact-book exposure
+disabled. Their generated briefings
 do not disclose or compare an Owner participant CID. A participant-originated
 instruction has Owner authority only when the authenticated Cowork room envelope
 attributes that participant seat the exact `Owner` role. Literal text, display
@@ -1697,3 +1692,5 @@ origin directly. UUID/capability checks still precede credential-bearing calls.
 This adds client HTTPS support, not an HTTPS daemon listener, certificate
 provisioning or automatic reverse-proxy configuration. Existing local HTTP and
 SSH-tunnel profiles continue to work.
+
+See [supervisor-owned ours and migration](docs/supervisor-ours.md) for the runtime contract and review build instructions.

package/dist/agent-ours/bridge.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+/** Runs inside exactly the harness OS sandbox. Only this process opens agent paths. */
+export declare function runBridge(descriptorPath: string): Promise<void>;

package/dist/agent-ours/bridge.js

@@ -0,0 +1,169 @@
+#!/usr/bin/env node
+import { connect } from 'node:net';
+import { access, mkdir, open, readFile } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { basename, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { MAX_CHUNK_BYTES, MAX_FRAME_BYTES, Wire } from './wire.js';
+/** Runs inside exactly the harness OS sandbox. Only this process opens agent paths. */
+export async function runBridge(descriptorPath) {
+    const descriptor = JSON.parse(await readFile(descriptorPath, 'utf8'));
+    if (typeof descriptor.socket !== 'string' ||
+        typeof descriptor.capability !== 'string' ||
+        !Number.isInteger(descriptor.generation))
+        throw Error('INVALID_BRIDGE_DESCRIPTOR');
+    const wire = new Wire(connect(descriptor.socket));
+    const handles = new Map();
+    const cleanup = async () => {
+        for (const row of handles.values())
+            await row.file.close().catch(() => { });
+        handles.clear();
+    };
+    let admitted = false;
+    let stdin = Buffer.alloc(0);
+    let chain = Promise.resolve();
+    const fail = () => {
+        wire.close();
+        process.stdin.pause();
+        void cleanup();
+    };
+    wire.onClose = fail;
+    wire.onFrame = (raw) => {
+        if (raw?.kind === 'ready') {
+            if (admitted)
+                throw Error('DUPLICATE_READY');
+            admitted = true;
+            process.stdin.resume();
+            return;
+        }
+        if (!admitted)
+            throw Error('BRIDGE_NOT_READY');
+        if (raw?.kind === 'mcp') {
+            const line = JSON.stringify(raw.value) + '\n';
+            if (!process.stdout.write(line)) {
+                wire.socket.pause();
+                process.stdout.once('drain', () => wire.socket.resume());
+            }
+            return;
+        }
+        if (raw?.kind !== 'fs' || typeof raw.id !== 'string' || typeof raw.call !== 'string')
+            throw Error('INVALID_BRIDGE_FRAME');
+        chain = chain
+            .then(async () => {
+            try {
+                const { op, args, call } = raw;
+                let value;
+                if (op === 'probe') {
+                    try {
+                        await access(args.path, constants.R_OK);
+                        value = true;
+                    }
+                    catch {
+                        value = false;
+                    }
+                }
+                else if (op === 'read-open' || op === 'write-open') {
+                    if (handles.size >= 32 ||
+                        typeof args.handle !== 'string' ||
+                        handles.has(args.handle) ||
+                        typeof args.path !== 'string')
+                        throw Error('FILE_LIMIT');
+                    const path = resolve(args.path);
+                    if (op === 'write-open')
+                        await mkdir(dirname(path), { recursive: true });
+                    const file = await open(path, op === 'write-open' ? 'w' : 'r');
+                    handles.set(args.handle, { file, call, write: op === 'write-open' });
+                    value =
+                        op === 'write-open'
+                            ? path
+                            : { filename: basename(path), size: (await file.stat()).size };
+                }
+                else {
+                    const row = handles.get(args.handle);
+                    if (!row) {
+                        if (op === 'close') {
+                            value = null;
+                        }
+                        else
+                            throw Error('UNKNOWN_FILE_HANDLE');
+                    }
+                    else {
+                        if (row.call !== call)
+                            throw Error('FOREIGN_FILE_CALL');
+                        if (op === 'close') {
+                            handles.delete(args.handle);
+                            await row.file.close();
+                            value = null;
+                        }
+                        else if (op === 'read' && !row.write) {
+                            const buffer = Buffer.alloc(MAX_CHUNK_BYTES);
+                            const { bytesRead } = await row.file.read(buffer);
+                            value = bytesRead ? buffer.subarray(0, bytesRead).toString('base64') : null;
+                        }
+                        else if (op === 'write' && row.write) {
+                            if (typeof args.data !== 'string' ||
+                                args.data.length > Math.ceil(MAX_CHUNK_BYTES / 3) * 4)
+                                throw Error('FILE_CHUNK_LIMIT');
+                            const buffer = Buffer.from(args.data, 'base64');
+                            let offset = 0;
+                            while (offset < buffer.length) {
+                                const r = await row.file.write(buffer, offset, buffer.length - offset);
+                                if (!r.bytesWritten)
+                                    throw Error('SHORT_WRITE');
+                                offset += r.bytesWritten;
+                            }
+                            value = null;
+                        }
+                        else
+                            throw Error('INVALID_FILE_OPERATION');
+                    }
+                }
+                await wire.send({ kind: 'fs-result', id: raw.id, value });
+            }
+            catch {
+                await wire.send({ kind: 'fs-result', id: raw.id, error: 'FILE_OPERATION_FAILED' });
+            }
+        })
+            .catch(fail);
+    };
+    process.stdin.pause();
+    process.stdin.on('data', (chunk) => {
+        stdin = Buffer.concat([stdin, chunk]);
+        for (;;) {
+            const end = stdin.indexOf(10);
+            if (end < 0) {
+                if (stdin.length > MAX_FRAME_BYTES)
+                    fail();
+                return;
+            }
+            if (end > MAX_FRAME_BYTES) {
+                fail();
+                return;
+            }
+            const line = stdin.subarray(0, end);
+            stdin = stdin.subarray(end + 1);
+            try {
+                const value = JSON.parse(line.toString('utf8'));
+                process.stdin.pause();
+                void wire.send({ kind: 'mcp', value }).then(() => process.stdin.resume(), fail);
+            }
+            catch {
+                fail();
+                return;
+            }
+        }
+    });
+    process.stdin.on('end', fail);
+    process.stdout.on('error', fail);
+    await wire.send({
+        kind: 'hello',
+        capability: descriptor.capability,
+        generation: descriptor.generation,
+    });
+}
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+    runBridge(process.env.FLEET_OURS_BRIDGE_DESCRIPTOR ?? '').catch(() => {
+        process.stderr.write('Fleet ours bridge unavailable\n');
+        process.exitCode = 1;
+    });
+}

package/dist/agent-ours/controller.d.ts

@@ -0,0 +1,14 @@
+import { RuntimeJournal } from './state.js';
+/** Reuse Fleet's process-lifetime binder to serialize startup and cleanup. */
+export declare class RuntimeController {
+    private readonly lease;
+    readonly privateDir: string;
+    readonly journal: RuntimeJournal;
+    private active;
+    private constructor();
+    static acquire(root: string, daemon: string, name: string, instance: string): Promise<RuntimeController>;
+    assertFence: () => void;
+    successor(): string;
+    resumeGeneration(): number;
+    unlock(): void;
+}

package/dist/agent-ours/controller.js

@@ -0,0 +1,60 @@
+import { randomUUID } from 'node:crypto';
+import { mkdirSync, renameSync } from 'node:fs';
+import { join } from 'node:path';
+import { acquireOwnerBinderLease } from '../owner-channel/binder.js';
+import { binderKey, RuntimeJournal } from './state.js';
+/** Reuse Fleet's process-lifetime binder to serialize startup and cleanup. */
+export class RuntimeController {
+    lease;
+    privateDir;
+    journal;
+    active = true;
+    constructor(lease, privateDir) {
+        this.lease = lease;
+        this.privateDir = privateDir;
+        this.journal = new RuntimeJournal(privateDir);
+    }
+    static async acquire(root, daemon, name, instance) {
+        const dir = join(root, binderKey(daemon, name));
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const lease = await acquireOwnerBinderLease(dir, 'agent-ours', name);
+        const controller = new RuntimeController(lease, dir);
+        if (controller.journal.read()?.instance && controller.journal.read().instance !== instance) {
+            lease.release();
+            throw Error('RUNTIME_INSTANCE_MISMATCH');
+        }
+        return controller;
+    }
+    assertFence = () => {
+        if (!this.active)
+            throw Error('STALE_RUNTIME_CONTROLLER');
+    };
+    successor() {
+        this.assertFence();
+        const state = this.journal.read();
+        if (state?.phase !== 'RELEASED')
+            throw Error('PREDECESSOR_NOT_RELEASED');
+        const archive = join(this.privateDir, `retired-${state.instance}`);
+        mkdirSync(archive, { mode: 0o700 });
+        for (const file of ['state.json', 'owner.json', 'instance.json'])
+            renameSync(join(this.privateDir, file), join(archive, file));
+        return randomUUID();
+    }
+    resumeGeneration() {
+        this.assertFence();
+        const s = this.journal.read();
+        if (!s)
+            return 1;
+        if (['TERMINAL_INTENT', 'CLEANUP_PENDING', 'RELEASED', 'FAILED'].includes(s.phase))
+            throw Error('RUNTIME_RETIRED_OR_FAILED');
+        if (!s.cid)
+            throw Error('UNCERTAIN_PROVISIONING');
+        this.journal.commit({ ...s, generation: s.generation + 1, phase: 'RECOVERING' }, s.revision);
+        return s.generation + 1;
+    }
+    unlock() {
+        this.assertFence();
+        this.lease.release();
+        this.active = false;
+    }
+}

package/dist/agent-ours/file-rpc.d.ts

@@ -0,0 +1,23 @@
+import type { FileExecutionContext } from '@ours.network/mcp/server';
+import type { ToolRequestExtra } from '@ours.network/mcp/dist/types/mcp/tool.js';
+import { type Wire } from './wire.js';
+/** Call-scoped callbacks carry no daemon credentials or upload receipts. */
+export declare class FileCallbacks implements FileExecutionContext {
+    private readonly wire;
+    private pending;
+    constructor(wire: Wire);
+    receive(frame: any): void;
+    close(): void;
+    private rpc;
+    canRead(path: string, extra: ToolRequestExtra): Promise<boolean>;
+    read(path: string, extra: ToolRequestExtra): Promise<{
+        filename: any;
+        size: any;
+        body: ReadableStream<Uint8Array<ArrayBufferLike>>;
+        close: () => Promise<void>;
+    }>;
+    write(path: string, body: ReadableStream<Uint8Array>, extra: ToolRequestExtra): Promise<{
+        path: string;
+        size: number;
+    }>;
+}

package/dist/agent-ours/file-rpc.js

@@ -0,0 +1,123 @@
+import { randomUUID } from 'node:crypto';
+import { MAX_CHUNK_BYTES } from './wire.js';
+/** Call-scoped callbacks carry no daemon credentials or upload receipts. */
+export class FileCallbacks {
+    wire;
+    pending = new Map();
+    constructor(wire) {
+        this.wire = wire;
+    }
+    receive(frame) {
+        if (frame?.kind !== 'fs-result' || typeof frame.id !== 'string')
+            throw Error('INVALID_FILE_RESPONSE');
+        const p = this.pending.get(frame.id);
+        if (!p)
+            throw Error('UNSOLICITED_FILE_RESPONSE');
+        this.pending.delete(frame.id);
+        clearTimeout(p.timer);
+        if (frame.error)
+            p.reject(Error('AGENT_FILE_OPERATION_FAILED'));
+        else
+            p.resolve(frame.value);
+    }
+    close() {
+        for (const p of this.pending.values()) {
+            clearTimeout(p.timer);
+            p.reject(Error('FILE_BRIDGE_DISCONNECTED'));
+        }
+        this.pending.clear();
+    }
+    async rpc(call, op, args, signal) {
+        signal.throwIfAborted();
+        if (this.pending.size >= 64)
+            throw Error('FILE_CALLBACK_LIMIT');
+        const id = randomUUID();
+        return new Promise((resolve, reject) => {
+            const finish = (f) => (value) => {
+                signal.removeEventListener('abort', abort);
+                f(value);
+            };
+            const fail = (reason) => {
+                const p = this.pending.get(id);
+                if (!p)
+                    return;
+                this.pending.delete(id);
+                clearTimeout(p.timer);
+                finish(reject)(reason);
+            };
+            const abort = () => fail(Error('FILE_CALLBACK_ABORTED'));
+            const timer = setTimeout(() => fail(Error('FILE_CALLBACK_TIMEOUT')), 30_000);
+            timer.unref();
+            this.pending.set(id, { resolve: finish(resolve), reject: finish(reject), timer });
+            signal.addEventListener('abort', abort, { once: true });
+            void this.wire
+                .send({ kind: 'fs', id, call, op, args })
+                .catch(() => fail(Error('FILE_BRIDGE_DISCONNECTED')));
+        });
+    }
+    async canRead(path, extra) {
+        return (await this.rpc(String(extra.requestId), 'probe', { path }, extra.signal)) === true;
+    }
+    async read(path, extra) {
+        const call = String(extra.requestId), handle = randomUUID();
+        const meta = await this.rpc(call, 'read-open', { path, handle }, extra.signal);
+        if (!meta ||
+            typeof meta.filename !== 'string' ||
+            !Number.isSafeInteger(meta.size) ||
+            meta.size < 0)
+            throw Error('INVALID_FILE_METADATA');
+        const close = async () => {
+            await this.rpc(call, 'close', { handle }, new AbortController().signal).catch(() => { });
+        };
+        const body = new ReadableStream({
+            pull: async (controller) => {
+                try {
+                    const chunk = await this.rpc(call, 'read', { handle }, extra.signal);
+                    if (chunk === null) {
+                        controller.close();
+                        return;
+                    }
+                    if (typeof chunk !== 'string' || chunk.length > Math.ceil(MAX_CHUNK_BYTES / 3) * 4)
+                        throw Error('INVALID_FILE_CHUNK');
+                    const bytes = Buffer.from(chunk, 'base64');
+                    if (bytes.length > MAX_CHUNK_BYTES)
+                        throw Error('FILE_CHUNK_TOO_LARGE');
+                    controller.enqueue(bytes);
+                }
+                catch (error) {
+                    controller.error(error);
+                    await close();
+                }
+            },
+            cancel: close,
+        });
+        return { filename: meta.filename, size: meta.size, body, close };
+    }
+    async write(path, body, extra) {
+        const call = String(extra.requestId), handle = randomUUID();
+        const reader = body.getReader();
+        try {
+            const resolved = await this.rpc(call, 'write-open', { path, handle }, extra.signal);
+            if (typeof resolved !== 'string')
+                throw Error('INVALID_FILE_PATH');
+            let size = 0;
+            for (;;) {
+                extra.signal.throwIfAborted();
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                for (let offset = 0; offset < chunk.value.length; offset += MAX_CHUNK_BYTES) {
+                    const bytes = chunk.value.subarray(offset, offset + MAX_CHUNK_BYTES);
+                    size += bytes.length;
+                    await this.rpc(call, 'write', { handle, data: Buffer.from(bytes).toString('base64') }, extra.signal);
+                }
+            }
+            await this.rpc(call, 'close', { handle }, extra.signal);
+            return { path: resolved, size };
+        }
+        finally {
+            await reader.cancel().catch(() => { });
+            await this.rpc(call, 'close', { handle }, new AbortController().signal).catch(() => { });
+        }
+    }
+}

package/dist/agent-ours/harness.d.ts

@@ -0,0 +1,14 @@
+import type { AcpMcpServer } from '../harness/types.js';
+import type { ResolvedRole } from '../config.js';
+export interface ManagedHarnessOurs {
+    server: AcpMcpServer;
+    native: Record<string, unknown>;
+}
+/** Do not pass the supervisor's ours connection credentials to harness children. */
+export declare function managedChildEnvironment(input: NodeJS.ProcessEnv): Record<string, string>;
+/** Replace ours only; retain the user's ordinary harness configuration and plugins. */
+export declare function prepareManagedHarness(role: ResolvedRole, stateDir: string, cwd: string, descriptor: string, env: Record<string, string>): {
+    ours: ManagedHarnessOurs;
+    env: Record<string, string>;
+};
+export declare function managedClaudeMeta(base: Record<string, unknown> | undefined): Record<string, unknown>;

package/dist/agent-ours/harness.js

@@ -0,0 +1,64 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+/** Do not pass the supervisor's ours connection credentials to harness children. */
+export function managedChildEnvironment(input) {
+    const out = {};
+    for (const [key, value] of Object.entries(input)) {
+        if (value === undefined || (/^OURS_/i.test(key) && !key.startsWith('OURS_FLEET_')))
+            continue;
+        out[key] = value;
+    }
+    out.FLEET_OURS_MANAGED = '1';
+    return out;
+}
+/** Replace ours only; retain the user's ordinary harness configuration and plugins. */
+export function prepareManagedHarness(role, stateDir, cwd, descriptor, env) {
+    const bridge = fileURLToPath(new URL('./bridge.js', import.meta.url));
+    const server = {
+        name: 'ours',
+        command: process.execPath,
+        args: [bridge],
+        env: [{ name: 'FLEET_OURS_BRIDGE_DESCRIPTOR', value: descriptor }],
+    };
+    const native = {
+        mcp_servers: {
+            ours: {
+                command: process.execPath,
+                args: [bridge],
+                env: { FLEET_OURS_BRIDGE_DESCRIPTOR: descriptor },
+            },
+        },
+        plugins: { 'ours@ours-codex-marketplace': { enabled: false } },
+    };
+    const child = managedChildEnvironment({ ...process.env, ...env });
+    if (role.harness === 'codex') {
+        const config = child.CODEX_CONFIG ? JSON.parse(child.CODEX_CONFIG) : {};
+        child.CODEX_CONFIG = JSON.stringify({
+            ...config,
+            plugins: { ...config.plugins, ...native.plugins },
+        });
+        // codex-acp otherwise prefers a same-name connector from the user's config.
+        child.DISABLE_MCP_CONFIG_FILTERING = 'true';
+    }
+    return { ours: { server, native }, env: child };
+}
+export function managedClaudeMeta(base) {
+    const meta = base ?? {}, claude = (meta.claudeCode ?? {});
+    const options = (claude.options ?? {});
+    const settings = typeof options.settings === 'string'
+        ? JSON.parse(readFileSync(options.settings, 'utf8'))
+        : (options.settings ?? {});
+    return {
+        ...meta,
+        claudeCode: {
+            ...claude,
+            options: {
+                ...options,
+                settings: {
+                    ...settings,
+                    enabledPlugins: { ...settings.enabledPlugins, 'ours@ours.network': false },
+                },
+            },
+        },
+    };
+}

package/dist/agent-ours/mcp-endpoint.d.ts

@@ -0,0 +1,15 @@
+import type { ApplicationIdentityStore } from '@ours.network/mcp/application-identities';
+import type { OursClient } from '@ours.network/sdk/client';
+import type { AgentOursRuntime } from './runtime.js';
+export interface EndpointOptions {
+    socket: string;
+    capability: string;
+    generation: number;
+    runtime: AgentOursRuntime;
+    client: OursClient;
+    identities: ApplicationIdentityStore;
+    remoteDaemonFiles: boolean;
+}
+export declare function startMcpEndpoint(options: EndpointOptions): Promise<{
+    close(): Promise<void>;
+}>;

package/dist/agent-ours/mcp-endpoint.js

@@ -0,0 +1,111 @@
+import { createServer } from 'node:net';
+import { chmod, unlink } from 'node:fs/promises';
+import { timingSafeEqual } from 'node:crypto';
+import { createManagedOursMcpServer } from '@ours.network/mcp/server';
+import { JSONRPCMessageSchema } from '@modelcontextprotocol/sdk/types.js';
+import { FileCallbacks } from './file-rpc.js';
+import { Wire } from './wire.js';
+export async function startMcpEndpoint(options) {
+    const sockets = new Set();
+    const server = createServer((socket) => {
+        if (sockets.size >= 4) {
+            socket.destroy();
+            return;
+        }
+        const wire = new Wire(socket);
+        sockets.add(wire);
+        const files = new FileCallbacks(wire);
+        let authenticated = false;
+        let inFlight = 0;
+        const ids = new Set();
+        const deadline = setTimeout(() => wire.close(), 5000);
+        deadline.unref();
+        const transport = {
+            start: async () => { },
+            send: async (message) => {
+                if ('id' in message &&
+                    message.id !== undefined &&
+                    ('result' in message || 'error' in message))
+                    ids.delete(message.id);
+                await wire.send({ kind: 'mcp', value: message });
+            },
+            close: async () => wire.close(),
+        };
+        const mcp = createManagedOursMcpServer(options.client, 'managed-v1', options.identities, {
+            remoteDaemonFiles: options.remoteDaemonFiles,
+            fileContext: files,
+            admit: async () => {
+                if (!authenticated || inFlight >= 32)
+                    throw Error('MCP_ADMISSION_LIMIT');
+                inFlight++;
+                try {
+                    const release = await options.runtime.admit();
+                    return () => {
+                        inFlight--;
+                        release();
+                    };
+                }
+                catch (error) {
+                    inFlight--;
+                    throw error;
+                }
+            },
+        });
+        wire.onClose = () => {
+            clearTimeout(deadline);
+            sockets.delete(wire);
+            files.close();
+            transport.onclose?.();
+        };
+        wire.onFrame = (frame) => {
+            if (!authenticated) {
+                const actual = typeof frame?.capability === 'string' ? Buffer.from(frame.capability) : Buffer.alloc(0);
+                const expected = Buffer.from(options.capability);
+                if (frame?.kind !== 'hello' ||
+                    frame.generation !== options.generation ||
+                    actual.length !== expected.length ||
+                    !timingSafeEqual(actual, expected))
+                    throw Error('UNAUTHORIZED_BRIDGE');
+                authenticated = true;
+                clearTimeout(deadline);
+                void mcp
+                    .connect(transport)
+                    .then(() => wire.send({ kind: 'ready' }))
+                    .catch(() => wire.close());
+                return;
+            }
+            if (frame?.kind === 'fs-result') {
+                files.receive(frame);
+                return;
+            }
+            if (frame?.kind !== 'mcp')
+                throw Error('UNKNOWN_BRIDGE_OPERATION');
+            const message = JSONRPCMessageSchema.parse(frame.value);
+            if ('method' in message && 'id' in message) {
+                if (ids.has(message.id) || ids.size >= 64)
+                    throw Error('MCP_REQUEST_LIMIT');
+                ids.add(message.id);
+            }
+            transport.onmessage?.(message);
+        };
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(options.socket, () => {
+            server.removeListener('error', reject);
+            resolve();
+        });
+    });
+    await chmod(options.socket, 0o600);
+    return {
+        close: async () => {
+            for (const socket of sockets)
+                socket.close();
+            await new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));
+            await unlink(options.socket).catch((error) => {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            });
+        },
+    };
+}