@ours.network/fleet 1.2.0-nightly.4 → 1.2.0-nightly.41

package/README.md

@@ -79,7 +79,7 @@ The state dir contract:
 |---|---|---|
 | Node ≥ 22 | runs `ours-fleet` and its maintained adapters | nodejs.org, `apt`, or `brew` |
 | a harness CLI, logged in | the agent itself | e.g. Claude Code (`claude`) or Codex CLI (`codex`) |
-| `ours` CLI + shared daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/cli@2.8.1-nightly.7 @ours.network/daemon@3.8.1-nightly.1 && ours-daemon start` |
+| `ours` CLI + shared daemon | identity + agent-to-agent messaging | `ours-install client --config /absolute/private/profile.json --integrations fleet --fleet-settings /absolute/fleet-settings.json` |
 
 Linux only: `ours-fleet init` enables *linger* so roles run without a login session
 and survive reboots. macOS: launchd agents start **at login** (no linger
@@ -139,72 +139,55 @@ the caller's owner channel with the caller and spawned-role details. This is an
 honest-actor convenience and attribution path, not a security boundary; host
 shells and deliberately bypassed absolute binaries retain direct behavior.
 
-## Local web console
+## Local HTTP service
 
-The interactive console is packaged with `@ours.network/fleet` and binds to
-IPv4 loopback by default. Remote or proxy exposure is always explicit:
+Fleet is an HTTP backend. It serves no pages, bundles no frontend and opens no
+browser: every screen belongs to the App, which calls this API with a device
+credential. Any address outside `/api/` answers JSON `404`.
 
 ```sh
-npm run build
-ours-fleet web
+ours-fleet setup-tunnel                # connect this host to your App workspace
+ours-fleet link-device                 # connect another browser or device
 # choose a free port for an isolated test:
-ours-fleet web serve --port 0 --no-open
-# nginx/TLS terminates at the declared browser origin; fleet remains loopback-bound
+ours-fleet web serve --port 0
+# nginx/TLS terminates at the declared origin; fleet remains loopback-bound
 ours-fleet web install --public-origin https://fleet.example.com --password-file /secure/fleet-password
-# Intentional no-password mode, for example when nginx already authenticates:
-ours-fleet web install --public-origin https://fleet.example.com --no-password
 ```
 
-The normal `ours-fleet web` command installs or updates an owner-level native
-service, starts it on stable `127.0.0.1:49271`, and opens/re-pairs the browser.
-Linux uses a systemd user unit and macOS uses a LaunchAgent; both restart after
-process failures and send logs to the native supervisor. Service management is
-explicit through `ours-fleet web install|start|stop|restart|status|uninstall`.
-Use `ours-fleet web serve` for a foreground development process. Linux login
-persistence requires linger; the installer reports when it is missing but
+`ours-fleet web` installs or updates an owner-level native service and starts
+it on stable `127.0.0.1:49271`. Linux uses a systemd user unit and macOS uses a
+LaunchAgent; both restart after process failures and send logs to the native
+supervisor. Service management is explicit through
+`ours-fleet web install|start|stop|restart|status|uninstall`. Use
+`ours-fleet web serve` for a foreground development process. `--no-open` is
+still accepted because installed service units pass it; it has no effect. Linux
+login persistence requires linger; the installer reports when it is missing but
 never enables it or requests root privileges.
 
-The normal command opens a one-time five-minute fragment directly in the local
-browser; it does not print a reusable secret. If the browser needs pairing
-again while the server is running, use `ours-fleet web open`. The fragment is
-exchanged once and removed from history. A paired browser receives a rotating,
-30-day `HttpOnly; SameSite=Strict` device credential and can return after a
-session idle timeout or server restart. Use **Sign out** to revoke the current
-browser, or `ours-fleet web revoke-all` to revoke every trusted browser and
-active web session.
-
-Only a domain-separated SHA-256 device-secret hash and bounded timestamps are
-stored in the owner-private fleet state directory (`0700` directory, `0600`
-atomic file). The re-pair and revoke controls use an owner-private Unix socket;
-local processes running as the same OS user are therefore inside the trust
-boundary.
+Use `ours-fleet web revoke-all` to revoke every linked device and active
+session. Only a domain-separated SHA-256 device-secret hash and bounded
+timestamps are stored in the owner-private fleet state directory (`0700`
+directory, `0600` atomic file). The link and revoke controls use an
+owner-private Unix socket; local processes running as the same OS user are
+therefore inside the trust boundary.
 
 On first setup, the CLI requires an explicit access choice: `--password-file`
 or `--pairing` for protected access, or `--no-password` for intentional
 unprotected access. `--password-file` stores only a salted scrypt verifier in
-the owner-private web state; the source file remains operator-managed. New
-browsers sign in and then receive the same rotating HttpOnly trusted-device
-credential. `--no-password` is deliberately named and prints a warning: anyone
-who can reach that origin can control the fleet.
+the owner-private web state; the source file remains operator-managed.
+`--no-password` is deliberately named and prints a warning: anyone who can
+reach that origin can control the fleet.
 
 For nginx on a VPS, keep the default loopback bind and set the exact external
 `--public-origin` (scheme, hostname, optional port). nginx should proxy HTTP and
 WebSocket upgrades to `127.0.0.1:49271` and provide TLS; rewriting the upstream
-Host is not required because the declared browser Origin remains authoritative. To listen beyond
+Host is not required because the declared Origin remains authoritative. To listen beyond
 loopback, add an explicit `--bind`; fleet refuses a non-loopback bind without a
 public origin. Host and Origin validation use that declaration rather than
 trusting forwarded headers. `localhost` and `127.0.0.1` both work in normal
-local mode; an unconfigured hostname gets a self-describing HTML page instead
-of raw internal Host-header JSON.
-
-The console is installable as a standalone PWA. Its service worker caches only
-the data-free offline page and successful content-hashed JavaScript/CSS assets.
-HTML stays network-first and no API, authentication, bootstrap, device,
-WebSocket, terminal, event, audit, log, session, query-bearing, or error response
-is cached. When the local daemon is unavailable, the PWA shows an explicit
-offline shell and no stale fleet state.
+local mode; an unconfigured hostname is refused with a JSON error.
 
-The console provides evidence-separated inventory and status, ACP activity and
+The API provides evidence-separated inventory and status, ACP activity and
 permission controls, redacted logs, typed text send, confirmed lifecycle
 actions, and transactional permanent/temporary creation. Identity is fixed to
 the role name. Creation uses the authenticated
@@ -376,9 +359,9 @@ preserve at most one recent late occurrence. The trusted authoring file and
 private sealed role snapshot retain exact prompt text; resolved launch, task,
 room, provenance, and audit presentation surfaces show only bytes and SHA-256.
 
-Every packaged `Developer`, `Critic`, and `LocalCoordinator` Agent Template uses
+Every packaged `Developer`, `Engineer`, `Critic`, and `LocalCoordinator` Agent Template uses
 `monitor.mode: fleet` with `monitor.interrupt: after_tool`. Consequently every
-member of the standard `single`, `pair`, and `team` Room Templates resolves to
+member of the standard `single`, `pair`, `team`, and `engineering` Room Templates resolves to
 that policy. A custom Agent Template or explicit per-member override remains
 authoritative and is merged key by key without rewriting unrelated values.
 
@@ -524,7 +507,7 @@ ours-fleet up
 
 ### Rooms and tasks
 
-Init installs editable `single`, `pair`, and `team` definitions under
+Init installs editable `single`, `pair`, `team`, and `engineering` definitions under
 `~/fleet/room_templates/`, plus every exact-cased Agent, Role, and Brain they
 reference. Inspect them with `ours-fleet template list` and
 `ours-fleet template show team`. After configuring the authenticated owner below:
@@ -533,8 +516,25 @@ reference. Inspect them with `ours-fleet template list` and
 ours-fleet task create --title "Solo task" --template single
 ours-fleet task create --title "Reviewed change" --template pair
 ours-fleet task create --title "Phased delivery" --template team
+ours-fleet task create --title "Gated feature build" --template engineering
 ```
 
+`engineering` pairs a gate-pipeline `Engineer` with the standard `Critic`. The
+Engineer works every non-trivial task through ordered gates — scope and a numbered
+Definition of Done before code, an over-engineering check, spec before
+implementation, test-first, review, a sized security pass, docs, and evidence-backed
+DoD verification — invoking an installed gate-pipeline skill when one is present and
+walking the same gates by hand otherwise. The seat is labelled `Engineer`, so a
+gated seat is never mistaken for a plain `Developer`. To make it the default for
+development tasks, set `tasks: { default_room_template: engineering }` in
+`fleet.yaml`.
+
+The `engineering` starter expresses a prompt-level workflow mandate; Fleet does not enforce
+the gates at runtime or install pipeline skills. The Engineer label identifies that mandate,
+not a completed review. When migrating an existing install, a newly added Engineer uses
+the existing Developer template's brain selection and keeps the packaged restrictive permissions.
+Existing customized Engineer files are preserved.
+
 The default `team` gives only its LocalCoordinator Agent Template a 15-minute
 continuity loop. Each idle-only pass uses authenticated assigned-room evidence,
 posts at most one missing interval update or status request, and reports `STALLED`
@@ -588,8 +588,9 @@ non-owner-controlled parent fail closed before host setup and are rechecked unde
 per-setup init lock before publication.
 
 The generated task experiences are fixed consequences, not extra questions: `single`
-uses `Developer`; `pair` uses `Developer` with an independent `Critic`; and `team` uses
-task-local `LocalCoordinator`, `Developer`, and `Critic`. The persistent
+uses `Developer`; `pair` uses `Developer` with an independent `Critic`; `team` uses
+task-local `LocalCoordinator`, `Developer`, and `Critic`; and `engineering` uses the
+gate-pipeline `Engineer` with an independent `Critic`. The persistent
 `FleetCoordinator` uses the separate packaged `Coordinator` contract and coordination
 model.
 
@@ -666,6 +667,29 @@ continuation is serialized per Task and remains alive until convergence or an
 Owner-action blocker. Re-running `task start <id>` safely resumes the same durable
 provisioning operation after the blocker is corrected or a process restarts.
 
+Live health is distinct from durable lifecycle. `task show TASK --json` adds a
+`readiness` observation for active tasks (`ready`, `degraded`, or `unknown`); human
+and authenticated Owner task-show output display the same observation. Task start/work
+continue to reject unavailable health with `task_not_ready`. A same-role untracked
+seat or a changed recorded launch cannot satisfy an original slot. Each control,
+liveness, and production Cowork probe is bounded; members are checked sequentially,
+so total latency grows with room size. These are point-in-time observations, not
+proof that a timed-out session is dead or permission to respawn it.
+
+Before deliberate recovery, Fleet Coordinator must inspect existing room seats and
+the exact old launch's termination record and worklog under `recovery/temporary`.
+Keep original slot records and archives intact; record verified old/new identity
+and launch provenance privately. Never restore archived identity state or reuse
+consumed invites. A same-role seat is only a possible replacement, not proven ownership.
+
+A replacement's empty inbox does not establish that no work is pending. Paginate
+scoped room/operator history to the end, retain the cursor privately, authenticate
+historical Owner instructions from identity metadata, and compare replies, worklogs,
+and already-completed actions before resuming. Ask the Owner when authority or
+completion is uncertain. Transfer only necessary non-secret context; never replay
+instructions blindly. Observation does not adopt seats, launch replacements, change
+lifecycle, or modify retained recovery evidence.
+
 Set `room.anonymous: true` on a room template, or pass `--anonymous` to
 `task create`, `task start`, `task work`, or `room create`, to create an
 anonymous Cowork room. `--no-anonymous` explicitly overrides an anonymous
@@ -1348,8 +1372,9 @@ The command override is exact: Fleet does not append `--profile`, `--search`, or
 
 One-off/permanent spawn selects a Brain that owns model, reasoning, native permission,
 sandbox, profile, launcher, search, monitor consent, native config, and additional roots.
-Use `env.OURS_PORT`/`env.OURS_CONFIG` for a
-role-specific ours daemon, or configure the host default in `~/.ours/config.json`.
+All roles use the shared gateway profile `~/.ours-client/profile.json`.
+`OURS_CONFIG` selects an alternate whole profile. Legacy port/token/state-dir
+overrides are rejected. See the [gateway setup guide](https://github.com/adapt-toolkit/ours-network/blob/prerelease/packages/installer/GATEWAY_SETUP.md).
 
 ## Agent isolation
 
@@ -1694,3 +1719,90 @@ provisioning or automatic reverse-proxy configuration. Existing local HTTP and
 SSH-tunnel profiles continue to work.
 
 See [supervisor-owned ours and migration](docs/supervisor-ours.md) for the runtime contract and review build instructions.
+
+### One-server gateway profile
+
+A private client profile may include `serverUrl`, for example
+`https://ours.example/base`, together with `endpoint` set to
+`https://ours.example/base/daemon`, the existing `expectedInstanceId`, and the
+absolute private `credentialPath`. Fleet preserves that daemon prefix for doctor
+and monitoring and derives `/cowork/management/rpc` from `serverUrl` for room
+management. Requests use the issued server credential, reject redirects, have
+bounded bodies/deadlines, and never replay mutations. This capability is declared
+as `cowork.http-management-v1` in the built artifact.
+
+Explicit Cowork socket, config or state-directory overrides continue to select
+local Unix management. Profiles without `serverUrl` retain legacy behavior. The
+HTTP API grants operator room authority; use the installer's supported private
+or authenticated external gateway entry, and keep its backend ports private.
+
+### Agent ours tools through the supervisor
+
+Operators can invoke the running agent's ordinary ours MCP tools without sending
+an LLM prompt or binding another session to its identity:
+
+```sh
+ours-fleet ours tools Critic1
+ours-fleet ours call Critic1 current_identity
+ours-fleet ours call Critic1 list_contacts
+ours-fleet ours call Critic1 generate_invite --args-file /private/invite-options.json
+ours-fleet ours call Critic1 add_contact --args-file /private/contact.json
+```
+
+`tools` returns the managed MCP tool names and argument schemas, plus the selected
+agent's identity name, CID, and supervisor generation. `call` returns the same
+identity metadata and the MCP result. The private JSON file contains the tool's
+arguments (for example `{"invite":"…"}` for `add_contact`); omitted arguments mean
+`{}`. Protect files containing invites and protect command output containing a
+new invite. Tool errors set a nonzero CLI exit status.
+
+The authenticated REST equivalents are `GET /api/v1/roles/:id/ours/tools` and
+`POST /api/v1/roles/:id/ours/call`, with the normal Fleet session and CSRF token.
+The POST body is `{"tool":"list_contacts","arguments":{}}`. MCP tool errors
+remain in `result.isError`; transport failures use the normal Fleet error envelope.
+Request arguments and results are excluded from the Fleet audit log.
+
+Both interfaces use the supervisor's existing fixed-identity MCP server and tool
+policy. Identity creation, removal, switching, and binding are not exposed. The
+supervisor must be running. Older descriptors are supported only when a unique
+existing runtime journal, instance record, and identity pin prove the selected
+agent and generation, and the same MCP connection confirms its identity and
+lifetime before the operation. This reads existing state without rewriting the
+descriptor or restarting the agent. Missing, ambiguous, stale, or mismatched
+proofs fail closed. Unknown identity descriptions also fail closed. Closing an operator call
+retains the supervisor's identity. An interrupted mutation can have an unknown
+outcome: inspect state before retrying, because there is no automatic retry or
+exactly-once guarantee. Contact acceptance alone does not prove peer verification
+or message delivery. File tools resolve paths in the invoking CLI process or
+Fleet web server's filesystem context, with that process's access permissions.
+
+Task workspace ownership, retention, safe deletion and legacy migration are documented in [Task workspaces](docs/task-workspaces.md).
+
+### Active task readiness after interruption
+
+Task and room list states, and `taskProvisioningOutcome`, describe durable lifecycle
+and provisioning progress; they are not live health checks. Retrying `task start`
+or `task work` on an active task checks the current Cowork room identity and seats,
+member launch ownership, supervisor liveness, and authenticated session status
+before reporting success. Waiting for provisioning completion also checks live
+readiness. This is a point-in-time observation, not proof of an agent-authored reply.
+
+A `task_not_ready` result distinguishes confirmed degradation from unknown health
+(for example, an unavailable control socket). Ask Fleet Coordinator to inspect room
+and member status and choose supported recovery. These checks do not restart agents,
+recreate identities, redeem invites, or rewrite lifecycle state. Temporary room agents
+remain transient across host reboot; retained launch records do not restore them.
+
+See [predefined Brain models and runtime requirements](presets/README.md) for the verified model/effort matrix and regeneration instructions.
+
+### YAML room layouts
+
+Room layouts describe room composition with shared or fresh participant sessions and independent room closure.
+See [Room layouts](docs/room-layouts.md) for YAML examples and CLI commands.
+
+
+### Dedicated notification service
+
+Configure the web backend with `OURS_NOTIFICATIONS_ORIGIN` and a Fleet-scoped `OURS_NOTIFICATIONS_PRODUCER_TOKEN`. It reads each local supervisor ledger incrementally with persistent checkpoints under web state, correlating owner browser/channel prompts with terminal completion. Monitor/startup turns do not notify. First installation skips existing history; no agent restart or conversation controller is needed. Persist web state across deployment/restarts. Reads are bounded to 256 KiB per role per tick, and oversized model/media records are skipped across chunks. Expose `/notifications` through the generic authenticated prefix gateway with a server-side user token and `stripBrowserContext: true`; producer tokens stay server-side. All browser sessions of this single-owner console map to one stable notification account. See [ours-notifications](https://github.com/adapt-toolkit/ours-notifications) for configuration/API/release details.
+
+Existing-host enrollment: `ours-fleet workspace-enroll --file <private-file> --preserve-profile` requires Messenger to advertise preservation support before any enrollment POST. It omits Name/Surname and leaves existing/absent profile untouched. Existing Fleet models and agents are retained; the installer must skip init when its configuration exists. Signed root proof, tunnel setup and device QR issuance remain the normal enrollment flow. Older Messenger fails closed and requires its preservation-capable release.

package/dist/account-origin.d.ts

@@ -0,0 +1,2 @@
+export declare const accountOrigins: readonly ["https://app.ours.network", "https://app.ours-tunnel.com"];
+export declare function validateAccountOrigin(value: unknown): string;

package/dist/account-origin.js

@@ -0,0 +1,6 @@
+export const accountOrigins = ['https://app.ours.network', 'https://app.ours-tunnel.com'];
+export function validateAccountOrigin(value) {
+    if (typeof value !== 'string' || !accountOrigins.some(origin => origin === value))
+        throw Error('Unsupported account origin');
+    return value;
+}

package/dist/agent-ours/bridge.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { createHash } from 'node:crypto';
 import { connect } from 'node:net';
 import { access, mkdir, open, readFile } from 'node:fs/promises';
 import { constants } from 'node:fs';
@@ -12,6 +13,14 @@ export async function runBridge(descriptorPath) {
         typeof descriptor.capability !== 'string' ||
         !Number.isInteger(descriptor.generation))
         throw Error('INVALID_BRIDGE_DESCRIPTOR');
+    if (process.env.FLEET_OURS_BRIDGE_EXPECTED) {
+        const expected = JSON.parse(process.env.FLEET_OURS_BRIDGE_EXPECTED);
+        const digest = createHash('sha256').update(JSON.stringify([descriptor.socket, descriptor.capability, descriptor.generation])).digest('hex');
+        if (expected.transportDigest !== digest)
+            throw Error('SUPERVISOR_TRANSPORT_CHANGED');
+        if (['role', 'identity', 'cid', 'generation'].some(key => descriptor[key] !== expected[key]))
+            throw Error('SUPERVISOR_SELECTION_CHANGED');
+    }
     const wire = new Wire(connect(descriptor.socket));
     const handles = new Map();
     const cleanup = async () => {

package/dist/agent-ours/correspondence.d.ts

@@ -0,0 +1,10 @@
+/** Read-only operations exposed by the identity-owning supervisor. */
+export interface AgentHistoryQuery {
+    peer_cid: string;
+    limit?: number;
+    before_seq?: number;
+}
+export interface SupervisorCorrespondence {
+    contacts(): Promise<unknown>;
+    history(request: AgentHistoryQuery): Promise<unknown>;
+}

package/dist/agent-ours/correspondence.js

@@ -0,0 +1 @@
+export {};

package/dist/agent-ours/harness.js

@@ -20,12 +20,19 @@ export function prepareManagedHarness(role, stateDir, cwd, descriptor, env) {
         args: [bridge],
         env: [{ name: 'FLEET_OURS_BRIDGE_DESCRIPTOR', value: descriptor }],
     };
+    // Portable allow covers bound identity messaging, not all tools on the server.
+    const tools = role.harness === 'codex' && role.permissions?.approval === 'allow'
+        ? Object.fromEntries([
+            'current_identity', 'get_messages', 'list_history', 'list_contacts', 'send_message',
+        ].map(name => [name, { approval_mode: 'approve' }]))
+        : undefined;
     const native = {
         mcp_servers: {
             ours: {
                 command: process.execPath,
                 args: [bridge],
                 env: { FLEET_OURS_BRIDGE_DESCRIPTOR: descriptor },
+                ...(tools ? { tools } : {}),
             },
         },
         plugins: { 'ours@ours-codex-marketplace': { enabled: false } },
@@ -35,6 +42,7 @@ export function prepareManagedHarness(role, stateDir, cwd, descriptor, env) {
         const config = child.CODEX_CONFIG ? JSON.parse(child.CODEX_CONFIG) : {};
         child.CODEX_CONFIG = JSON.stringify({
             ...config,
+            mcp_servers: { ...config.mcp_servers, ...native.mcp_servers },
             plugins: { ...config.plugins, ...native.plugins },
         });
         // codex-acp otherwise prefers a same-name connector from the user's config.

package/dist/agent-ours/runtime.d.ts

@@ -1,3 +1,4 @@
+import type { AgentHistoryQuery } from './correspondence.js';
 import type { OursClient } from '@ours.network/sdk/client';
 import { RuntimeJournal, type RuntimeState } from './state.js';
 export interface AssignedIdentity {
@@ -47,6 +48,11 @@ export declare class AgentOursRuntime {
     prepare(room?: RoomAdmission, timeoutMs?: number): Promise<void>;
     /** Admission covers SDK calls, response rendering and agent filesystem callbacks. */
     admit(): Promise<() => void>;
+    /** Trusted supervisor-only admission for a later room; keeps the live harness
+     * and original startup assignment. Not exposed as an agent lifecycle tool. */
+    joinAdditionalRoom(invite: string, expectedRoomCid: string): Promise<void>;
+    readContacts(): Promise<unknown>;
+    readHistory(request: AgentHistoryQuery): Promise<unknown>;
     startHarness<T>(start: () => Promise<T>): Promise<T>;
     suspend(): Promise<void>;
     terminal(): Promise<void>;

package/dist/agent-ours/runtime.js

@@ -201,6 +201,42 @@ export class AgentOursRuntime {
             throw error;
         }
     }
+    /** Trusted supervisor-only admission for a later room; keeps the live harness
+     * and original startup assignment. Not exposed as an agent lifecycle tool. */
+    async joinAdditionalRoom(invite, expectedRoomCid) {
+        const release = await this.admit();
+        try {
+            const contact = await this.deps.client.addContact({ invite });
+            if (contact.cid !== expectedRoomCid)
+                throw Error('ADDITIONAL_ROOM_CID_MISMATCH');
+            await this.verify();
+        }
+        finally {
+            release();
+        }
+    }
+    async readContacts() {
+        const release = await this.admit();
+        try {
+            const data = await this.deps.client.listContacts();
+            await this.verify();
+            return { identity: { name: this.state.name, cid: this.state.cid, generation: this.state.generation }, ...data };
+        }
+        finally {
+            release();
+        }
+    }
+    async readHistory(request) {
+        const release = await this.admit();
+        try {
+            const data = await this.deps.client.listHistory(request);
+            await this.verify();
+            return { identity: { name: this.state.name, cid: this.state.cid, generation: this.state.generation }, ...data };
+        }
+        finally {
+            release();
+        }
+    }
     async startHarness(start) {
         if (!this.accepting || this.state.phase !== 'READY')
             throw Error('RUNTIME_NOT_READY');

package/dist/agent-ours/service.js

@@ -1,3 +1,4 @@
+import { socketPath as privateSocketPath } from '../socket-path.js';
 import { randomBytes, randomUUID } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -11,19 +12,31 @@ import { atomicPrivateWrite, binderKey } from './state.js';
 import { AgentOursRuntime } from './runtime.js';
 import { startMcpEndpoint } from './mcp-endpoint.js';
 export const privateRuntimeRoot = () => join(stateRoot(), 'private-ours');
+function roomSecretPath(role) {
+    const startup = role.roomMemberStartup;
+    return join(privateRuntimeRoot(), 'room-inputs', binderKey(startup.room_identity_cid, JSON.stringify([role.name, startup.invite_id])) + '.json');
+}
+function matchesRoomSecret(secret, role) {
+    const startup = role.roomMemberStartup;
+    return secret.room_id === startup.room_id && secret.room_identity_cid === startup.room_identity_cid
+        && secret.invite_id === startup.invite_id && secret.identity_name === role.identity
+        && secret.role === startup.role;
+}
 /** Only trusted launch orchestration may write this descriptor, never the child. */
 export function storeRoomSecret(role) {
     const startup = role.roomMemberStartup;
     if (!startup?.invite)
         return;
+    if (startup.identity_name !== role.identity)
+        throw Error('ROOM_SECRET_MISMATCH');
     const root = join(privateRuntimeRoot(), 'room-inputs');
     mkdirSync(root, { recursive: true, mode: 0o700 });
-    const path = join(root, binderKey(startup.room_identity_cid, role.name) + '.json');
+    // Failed attempts retain private evidence. A new invite must never overwrite
+    // or consume a previous attempt's descriptor.
+    const path = roomSecretPath(role);
     if (existsSync(path)) {
         const old = JSON.parse(readFileSync(path, 'utf8'));
-        if (old.room_id !== startup.room_id ||
-            old.invite_id !== startup.invite_id ||
-            old.identity_name !== startup.identity_name)
+        if (!matchesRoomSecret(old, role) || old.invite !== startup.invite)
             throw Error('ROOM_SECRET_COLLISION');
         return;
     }
@@ -144,7 +157,9 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
         let room;
         if (role.roomMemberStartup) {
             const startup = role.roomMemberStartup;
-            const path = join(root, 'room-inputs', binderKey(startup.room_identity_cid, role.name) + '.json');
+            const legacyPath = join(root, 'room-inputs', binderKey(startup.room_identity_cid, role.name) + '.json');
+            const currentPath = roomSecretPath(role);
+            const path = existsSync(currentPath) ? currentPath : legacyPath;
             const cowork = createCoworkAdapter();
             room = {
                 id: startup.room_id,
@@ -153,9 +168,7 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
                 action: startup.invite_id,
                 redeem: async (attached) => {
                     const secret = JSON.parse(readFileSync(path, 'utf8'));
-                    if (secret.room_id !== startup.room_id ||
-                        secret.invite_id !== startup.invite_id ||
-                        secret.identity_name !== role.identity)
+                    if (!matchesRoomSecret(secret, role))
                         throw Error('ROOM_SECRET_MISMATCH');
                     return attached.addContact({ invite: secret.invite });
                 },
@@ -195,7 +208,7 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
         await identities.add(role.identity);
         const bridgeDir = join(stateDir, '.ours-bridge');
         mkdirSync(bridgeDir, { recursive: true, mode: 0o700 });
-        const capability = randomBytes(32).toString('hex'), socket = join(bridgeDir, `g${generation}.sock`);
+        const capability = randomBytes(32).toString('hex'), socket = privateSocketPath(join(bridgeDir, `g${generation}.sock`));
         const endpoint = await startMcpEndpoint({
             socket,
             capability,
@@ -207,7 +220,7 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
         });
         partialEndpoint = endpoint;
         const descriptor = join(bridgeDir, 'descriptor.json');
-        atomicPrivateWrite(descriptor, { socket, capability, generation });
+        atomicPrivateWrite(descriptor, { socket, capability, generation, role: role.name, identity: role.identity, cid: runtime.snapshot.cid });
         return {
             runtime,
             descriptor,
@@ -255,8 +268,10 @@ export async function preparePermanentAssignment(role) {
         endpoint: profile.endpoint,
         expectedInstanceId: profile.expectedInstanceId,
         credentialPath: profile.credentialPath,
-        sessionMode: 'local',
-        requiredCapabilities: ['local-pid-v1', 'root-first-identities-v1'],
+        sessionMode: 'external',
+        leaseToken: randomUUID(),
+        requiredCapabilities: ['external-sessions-v1', 'root-first-identities-v1'],
+        env: {},
     });
     try {
         const rows = await client.listIdentities(), row = rows.find((r) => r.name === role.identity);
@@ -283,7 +298,12 @@ export async function preparePermanentAssignment(role) {
         return 'verified';
     }
     finally {
-        await client.close();
+        try {
+            await client.releaseLease();
+        }
+        finally {
+            await client.close();
+        }
     }
 }
 export function readRoomReadiness(roomCid, name) {

package/dist/application/codex-models.d.ts

@@ -0,0 +1,15 @@
+import { type OfferedModels } from '../subscriptions/cli.js';
+export interface CodexModelDiscoveryDeps {
+    /** The Codex executable ACP sessions will run, and its version. */
+    runtime(): Promise<{
+        executable: string;
+        version: string;
+    }>;
+    ask(executable: string, env: NodeJS.ProcessEnv): Promise<OfferedModels>;
+    now(): number;
+}
+/**
+ * The models offered to the active Codex account by the runtime that sessions will actually use.
+ * An answer is reused only for the same executable, version, profile and sign-in.
+ */
+export declare function createCodexModelDiscovery(overrides?: Partial<CodexModelDiscoveryDeps>): () => Promise<OfferedModels>;

package/dist/application/codex-models.js

@@ -0,0 +1,56 @@
+import { statSync } from 'node:fs';
+import { join } from 'node:path';
+import { resolveBundledAcpAgent } from '../harness/acp-agent.js';
+import { probeCodexRuntime } from '../harness/codex-runtime.js';
+import { codexOfferedModels, profileEnv } from '../subscriptions/cli.js';
+import { profileHome, readSubscriptionState } from '../subscriptions/store.js';
+const KNOWN_FOR_MS = 5 * 60_000;
+const UNKNOWN_FOR_MS = 10_000;
+/** When the profile's sign-in last changed; a new sign-in must not reuse another account's answer. */
+function signInStamp(home) {
+    try {
+        return statSync(join(home, 'auth.json')).mtimeMs;
+    }
+    catch {
+        return 0;
+    }
+}
+/**
+ * The models offered to the active Codex account by the runtime that sessions will actually use.
+ * An answer is reused only for the same executable, version, profile and sign-in.
+ */
+export function createCodexModelDiscovery(overrides = {}) {
+    const deps = {
+        runtime: () => probeCodexRuntime(resolveBundledAcpAgent('@agentclientprotocol/codex-acp', 'codex-acp', 'codex-acp'), process.env),
+        ask: codexOfferedModels,
+        now: Date.now,
+        ...overrides,
+    };
+    let cached;
+    let pending;
+    return async () => {
+        let key, executable, env;
+        try {
+            const profileId = readSubscriptionState().providers.codex.activeProfileId;
+            const profile = profileHome('codex', profileId);
+            const runtime = await deps.runtime();
+            executable = runtime.executable;
+            env = profileEnv('CODEX_HOME', profileId, profile);
+            key = [runtime.executable, runtime.version, profileId, signInStamp(profile)].join('\n');
+        }
+        catch (error) {
+            return { state: 'unknown', reason: error instanceof Error ? error.message : String(error) };
+        }
+        if (cached && cached.key === key && cached.until > deps.now())
+            return cached.value;
+        if (pending?.key === key)
+            return pending.answer;
+        const answer = deps.ask(executable, env).then(value => {
+            cached = { key, until: deps.now() + (value.state === 'known' ? KNOWN_FOR_MS : UNKNOWN_FOR_MS), value };
+            return value;
+        }).finally(() => { if (pending?.key === key)
+            pending = undefined; });
+        pending = { key, answer };
+        return answer;
+    };
+}