@ours.network/fleet 1.2.0-nightly.44 → 1.2.0-nightly.45

package/README.md

@@ -286,10 +286,33 @@ ours-fleet loops reload <Role>
 ours-fleet loops run-now|disable|enable <Role> <Loop>
 ours-fleet rm <Name>
 ours-fleet doctor [--harness H]
+ours-fleet managed-cli setup [--enable <Agent>]... | status [--json]   native harness policy for the task workflow
 ours-fleet version [--json]         build identity, capabilities, installs on PATH
 ours-fleet init
 ```
 
+### Fleet task commands from a harness command sandbox
+
+A Codex or Claude command sandbox refuses the supervisor socket, so a managed
+`ours-fleet` call fails with `connect EPERM` before it parses anything. Fleet
+prepares the native harness policy for the packaged Coordinator task workflow;
+you do not write Codex rules or Claude sandbox settings by hand:
+
+```sh
+ours-fleet managed-cli setup --enable FleetCoordinator   # adds managed_cli: [task-workflow] to that Agent
+ours-fleet managed-cli status                            # static setup, session policy, observed commands
+```
+
+The opt-in is an explicit Agent key and changes no permission. Setup starts no
+session or model, is repeated at every agent start, and `ours-install` runs it
+for you. It prepares `task create|start|finish|block|unblock|review|list|show`,
+`room show|members` and template/plan/help inspection for one pinned
+configuration, and nothing else; `task start`/`task finish` are real authority.
+Qualified end to end on Linux with Codex (native and ACP) and Claude ACP; macOS
+is prepared the same way but not yet qualified. Scope, boundaries, unsupported
+combinations and the evidence are in
+[docs/validation/managed-cli-permissions.md](docs/validation/managed-cli-permissions.md).
+
 ### Which build am I running?
 
 `--version` prints a semver, and a semver does not identify an artifact: version

package/dist/briefing.d.ts

@@ -15,6 +15,8 @@ export interface BriefingOpts {
     identityGuarantee?: 'verified' | 'created' | 'unverified';
     /** Temporary spawn whose newly-created identity should share the session lifecycle. */
     temporaryIdentity?: boolean;
+    /** Fleet-prepared invocation guidance (src/managed-cli.ts); empty when none applies. */
+    managedCli?: string[];
 }
 /** Render a role's briefing.md: narrative (or curated body) + mechanical boot steps. */
 export declare function generateBriefing(role: ResolvedRole, v: BriefingVocab, opts: BriefingOpts): string;

package/dist/briefing.js

@@ -197,9 +197,16 @@ export function generateBriefing(role, v, opts) {
         L.push('For omitted settings, the supervisor inherits your canonical Brain and Role selections,');
         L.push('working directory, neutral permissions, coordinator, and fleet monitor policy. Every');
         L.push('explicit option wins; identity/session-local and secret material never inherit.');
-        L.push('All public CLI surfaces are available; hidden worker entry points remain internal.');
+        L.push('All public CLI surfaces are routed this way; hidden worker entry points remain internal.');
+        if (role.permissions && role.permissions.filesystem !== 'unrestricted' && !opts.managedCli?.length) {
+            L.push('Routing is not reachability: every call first connects to the supervisor socket, and a');
+            L.push('harness command sandbox can refuse that connection (`connect EPERM`), even for `--help`.');
+            L.push('No Fleet command is prepared to run outside your sandbox. If one is refused, report it');
+            L.push('as a blocker; the owner enables a workflow with `ours-fleet managed-cli setup --enable`.');
+        }
         L.push('Lifecycle notice delivery failures stay in service diagnostics and never rerun effects.');
         L.push('This proxy is attribution and convenience, not a security boundary for unisolated roles.');
+        L.push(...(opts.managedCli ?? []));
     }
     if (role.coordinator) {
         L.push(`7. ANNOUNCE yourself: call **${v.sendTool}** to contact "${role.coordinator}" with text:`);

package/dist/build-info.json

@@ -1,10 +1,11 @@
 {
-  "version": "1.2.0-nightly.44",
-  "buildId": "0814e82b7dde",
-  "commit": "94ad261abac133a3c17081c1a531a8a363178470",
+  "version": "1.2.0-nightly.45",
+  "buildId": "9af6d0fa4b7e",
+  "commit": "f59c69b6662ae09b5e72ea2c4c0a958729e1928f",
   "dirty": true,
-  "builtAt": "2026-10-04T08:52:19.101Z",
+  "builtAt": "2026-10-04T12:42:35.826Z",
   "capabilities": [
+    "managed-cli.setup-v1",
     "workspace.enroll.preserve-profile-v1",
     "cowork.http-management-v1",
     "monitor.interrupt.after_tool"

package/dist/capabilities.d.ts

@@ -16,7 +16,9 @@
 export declare const CAP_MONITOR_INTERRUPT_AFTER_TOOL = "monitor.interrupt.after_tool";
 export declare const CAP_HTTP_COWORK = "cowork.http-management-v1";
 export declare const CAP_WORKSPACE_PRESERVE_PROFILE = "workspace.enroll.preserve-profile-v1";
-export declare const CAPABILITIES: readonly ["workspace.enroll.preserve-profile-v1", "cowork.http-management-v1", "monitor.interrupt.after_tool"];
+/** `ours-fleet managed-cli setup|status` and the `managed_cli` Agent key (#233). */
+export declare const CAP_MANAGED_CLI_SETUP = "managed-cli.setup-v1";
+export declare const CAPABILITIES: readonly ["managed-cli.setup-v1", "workspace.enroll.preserve-profile-v1", "cowork.http-management-v1", "monitor.interrupt.after_tool"];
 export type Capability = (typeof CAPABILITIES)[number];
 /** Does this build declare `token`? */
 export declare const hasCapability: (token: string) => boolean;

package/dist/capabilities.js

@@ -16,7 +16,10 @@
 export const CAP_MONITOR_INTERRUPT_AFTER_TOOL = 'monitor.interrupt.after_tool';
 export const CAP_HTTP_COWORK = 'cowork.http-management-v1';
 export const CAP_WORKSPACE_PRESERVE_PROFILE = 'workspace.enroll.preserve-profile-v1';
+/** `ours-fleet managed-cli setup|status` and the `managed_cli` Agent key (#233). */
+export const CAP_MANAGED_CLI_SETUP = 'managed-cli.setup-v1';
 export const CAPABILITIES = [
+    CAP_MANAGED_CLI_SETUP,
     CAP_WORKSPACE_PRESERVE_PROFILE,
     CAP_HTTP_COWORK,
     CAP_MONITOR_INTERRUPT_AFTER_TOOL,

package/dist/cli.js

@@ -56,6 +56,8 @@ import './harness/claude-code.js'; // registers the claude-code adapter
 import './harness/codex.js'; // registers the codex adapter
 import './harness/hermes.js';
 import { registerLayoutCommands } from './rooms-tasks/layout-cli.js';
+import { MANAGED_CONFIGURATION_FLAG, assertPinnedConfiguration, enableManagedCli, managedCliReport, parseManagedEntry, } from './managed-cli.js';
+import { MANAGED_CLI_WORKFLOW_IDS } from './config.js';
 import { registerTemplateCommands, registerTaskCommands, registerRoomCommands } from './rooms-tasks/cli.js';
 import { RoleCreationService } from './application/role-creation-service.js';
 import { RoleRemovalService } from './application/role-removal-service.js';
@@ -99,6 +101,22 @@ const program = new Command()
     .exitOverride()
     .version(VERSION);
 const cOpt = (cmd) => cmd.option('-c, --configuration <file>', 'manifest (default: ~/fleet.yaml; documents under ~/fleet/)');
+/**
+ * Set only for the pinned managed entry form (see src/managed-cli.ts). Checked
+ * against the PARSED option, so every spelling of a later `-c` is covered.
+ */
+let pinnedConfiguration;
+program.hook('preAction', (_program, action) => {
+    if (pinnedConfiguration === undefined)
+        return;
+    try {
+        assertPinnedConfiguration(pinnedConfiguration, action.opts().configuration);
+    }
+    catch (error) {
+        console.error(`error: ${error.message}`);
+        throw new FleetCliExit(1, 'validation', 'not_started');
+    }
+});
 const collect = (value, previous) => [...previous, value];
 program.command('docs')
     .alias('man')
@@ -1299,6 +1317,78 @@ cOpt(program.command('spawn [name]').description('spawn a new agent (permanent b
         die(e);
     }
 });
+function renderManagedCliReport(report) {
+    const lines = [
+        `Managed CLI setup for ${report.configuration}`,
+        `  node ${report.node}`, `  cli  ${report.cli}`,
+        `  platform ${report.platform.os}${report.platform.declared ? '' : ' (not a declared platform)'}`,
+    ];
+    for (const role of report.roles) {
+        if (role.setup.state === 'not-declared')
+            continue;
+        lines.push('', `${role.role} (${role.harness}/${role.session}) — ${role.workflows.join(', ')}`);
+        lines.push(`  setup (static): ${role.setup.state}${role.setup.action ? ` [${role.setup.action}]` : ''} — ${role.setup.detail}`);
+        if (role.setup.artifact)
+            lines.push(`    ${role.setup.artifact}`);
+        lines.push(`  running session: ${role.session_policy}`);
+        lines.push(`  observed (audit ledger): ${role.observed.summary}`);
+        if (role.commandPrefix)
+            lines.push(`  invoke as: ${role.commandPrefix} <command>`);
+        for (const line of role.scope)
+            lines.push(`  scope: ${line}`);
+        for (const line of role.warnings)
+            lines.push(`  note: ${line}`);
+    }
+    if (!report.roles.some(role => role.setup.state !== 'not-declared'))
+        lines.push('', 'No agent declares managed_cli. Nothing was generated and no permission changed.', 'Enable it for one agent with: ours-fleet managed-cli setup --enable <Agent>');
+    for (const item of report.removed)
+        lines.push('', `${item.action}: ${item.path} — ${item.detail ?? ''}`);
+    lines.push('', ...report.disclosure.map(line => `* ${line}`));
+    return lines.join('\n');
+}
+const managedCliCommand = program.command('managed-cli')
+    .description('prepare and inspect native harness policy for Fleet commands run from a command sandbox');
+for (const [name, write, description] of [
+    ['setup', true, 'generate the policy for agents declaring managed_cli; starts no session and no model'],
+    ['status', false, 'compare generated policy and observed supervisor access without changing anything'],
+]) {
+    const command = cOpt(managedCliCommand.command(name).description(description)).option('--json', 'JSON output');
+    if (write)
+        command.option('--enable <agent>', 'first add managed_cli: [task-workflow] to this Agent file (repeatable); its permissions are not changed', (value, all) => [...all, value], [])
+            .option('--workflow <id>', `workflow --enable adds (${MANAGED_CLI_WORKFLOW_IDS.join(', ')})`, 'task-workflow');
+    command.action((opts) => {
+        try {
+            const enabled = [];
+            if (opts.enable?.length) {
+                if (!MANAGED_CLI_WORKFLOW_IDS.includes(opts.workflow ?? ''))
+                    throw new Error(`unknown workflow '${opts.workflow}'; supported: ${MANAGED_CLI_WORKFLOW_IDS.join(', ')}`);
+                // Validate every name before the first file is touched.
+                const cfg = loadConfig(opts.configuration);
+                for (const agent of opts.enable)
+                    findRole(cfg, agent);
+                for (const agent of opts.enable)
+                    enabled.push({ agent, ...enableManagedCli(opts.configuration, agent, opts.workflow) });
+            }
+            const report = managedCliReport(loadConfig(opts.configuration), opts.configuration, { write });
+            if (opts.json) {
+                console.log(JSON.stringify({ ...report, enabled }, null, 2));
+            }
+            else {
+                for (const item of enabled)
+                    console.log(`${item.changed ? 'Enabled' : 'Already enabled'} ${opts.workflow} for ${item.agent} in ${item.file}`);
+                console.log(renderManagedCliReport(report));
+            }
+            const failing = report.roles.filter(role => ['unsupported', 'conflict', 'stale', 'missing'].includes(role.setup.state));
+            if (failing.length)
+                throw new FleetCliExit(1);
+        }
+        catch (error) {
+            if (error instanceof FleetCliExit)
+                throw error;
+            die(error);
+        }
+    });
+}
 cOpt(program.command('doctor').description('prerequisite report'))
     .option('--harness <id>', 'check one harness explicitly')
     .option('--yaml-mode <mode>', 'non-plain YAML policy: compat|strict', 'compat')
@@ -1797,7 +1887,15 @@ async function parseFleetCli() {
 async function runFleetCli() {
     const stateDir = process.env[FLEET_PROXY_STATE_DIR_ENV];
     const caller = process.env[FLEET_PROXY_CALLER_ENV];
+    const entry = parseManagedEntry(process.argv.slice(2));
     if (!stateDir || !caller) {
+        // The pinned form exists for managed sessions; outside one there is no
+        // supervisor to audit the call, so it is refused rather than run unaudited.
+        if (entry.kind !== 'none') {
+            console.error(`error: ${entry.kind === 'error' ? entry.message
+                : `${MANAGED_CONFIGURATION_FLAG} is only valid inside a Fleet-managed agent session, where the supervisor audits the call`}`);
+            throw new FleetCliExit(1, 'validation', 'not_started');
+        }
         await parseFleetCli();
         return;
     }
@@ -1832,6 +1930,15 @@ async function runFleetCli() {
         const originalExit = process.exit;
         process.exit = ((code) => { throw new FleetCliExit(code ?? 0); });
         try {
+            if (entry.kind === 'error') {
+                console.error(`error: ${entry.message}`);
+                throw new FleetCliExit(1, 'validation', 'not_started');
+            }
+            if (entry.kind === 'pinned') {
+                // The supervisor audited the argv as typed; Commander parses the ordinary form.
+                pinnedConfiguration = entry.configuration;
+                process.argv = [process.argv[0], process.argv[1], ...entry.argv];
+            }
             await parseFleetCli();
         }
         catch (error) {

package/dist/config.d.ts

@@ -36,6 +36,12 @@ export type FilesystemMode = 'read-only' | 'workspace' | 'unrestricted';
 export type UnattendedMode = 'deny' | 'wait';
 /** Monitor wake policy: preserve legacy booleans and add one explicit safe boundary. */
 export type MonitorInterrupt = boolean | 'after_tool';
+/**
+ * Workflows Fleet prepares native harness execution policy for. Declared per
+ * Agent; never inferred from a role's name or persona, and never inherited.
+ */
+export declare const MANAGED_CLI_WORKFLOW_IDS: readonly ["task-workflow"];
+export type ManagedCliWorkflowId = (typeof MANAGED_CLI_WORKFLOW_IDS)[number];
 export interface CommonPermissions {
     approval: ApprovalMode;
     filesystem: FilesystemMode;
@@ -146,6 +152,8 @@ export interface RoleConfig {
     owner_channel?: OwnerChannelConfigInput;
     worklog?: WorklogPolicyInput;
     auth_proxy?: Partial<AuthProxyConfig>;
+    /** Fleet-prepared CLI workflows this role may run outside its command sandbox. */
+    managed_cli?: ManagedCliWorkflowId[];
 }
 export type AgentSelection<T extends Record<string, unknown> = Record<string, unknown>> = {
     ref: string;
@@ -167,6 +175,8 @@ export interface AgentDefinition {
     owner_channel?: OwnerChannelConfigInput;
     worklog?: WorklogPolicyInput;
     auth_proxy?: Partial<AuthProxyConfig>;
+    /** Fleet-prepared CLI workflows this Agent may run outside its command sandbox. */
+    managed_cli?: ManagedCliWorkflowId[];
     /** Scheduled turns scoped only to temporary launches; persistent Agents reject this field. */
     loops?: AgentLoopsConfig;
 }

package/dist/config.js

@@ -24,6 +24,11 @@ export const NOTIFY_EVENT_TYPES = [
     'message_received', 'file_received', 'sibling_contact_added', 'local_contact_request',
     'pending_message', 'contact_restored', 'inbound_error', 'state_import_failed',
 ];
+/**
+ * Workflows Fleet prepares native harness execution policy for. Declared per
+ * Agent; never inferred from a role's name or persona, and never inherited.
+ */
+export const MANAGED_CLI_WORKFLOW_IDS = ['task-workflow'];
 /** Default wake sources when a role does not list its own. */
 export const DEFAULT_WAKE_SOURCES = ['message_received', 'file_received', 'local_contact_request', 'pending_message'];
 const MONITOR_KEYS = [
@@ -139,7 +144,7 @@ export const ROLE_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 const ROLE_KEYS = [
     'harness', 'session', 'session_options', 'permissions', 'identity', 'cwd', 'coordinator', 'mission', 'persona', 'bio',
     'briefing_file', 'model', 'effort', 'model_chain', 'max_tokens', 'autocompact_pct', 'env', 'oversee', 'harness_options',
-    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy',
+    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'managed_cli',
 ];
 export const ROLE_PRESET_KEYS = ['mission', 'persona', 'bio', 'briefing_file'];
 export const BRAIN_PRESET_KEYS = [
@@ -148,7 +153,7 @@ export const BRAIN_PRESET_KEYS = [
 ];
 export const AGENT_KEYS = [
     'role', 'brain', 'permissions', 'identity', 'cwd', 'coordinator', 'env', 'oversee',
-    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'loops',
+    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'loops', 'managed_cli',
 ];
 const AGENT_INSTANCE_KEYS = ['template', 'overrides'];
 const TEMPLATE_FORBIDDEN_KEYS = ['identity'];
@@ -236,6 +241,12 @@ function validateAgentScalars(value, file, id) {
         if (current !== undefined && (typeof current !== 'string' || !current.trim()))
             schemaError(file, `/agents/${id}/${key}`, 'must be a non-blank string');
     }
+    if (value.managed_cli !== undefined) {
+        const ids = value.managed_cli;
+        if (!Array.isArray(ids) || ids.some(entry => !MANAGED_CLI_WORKFLOW_IDS.includes(entry))
+            || new Set(ids).size !== ids.length)
+            schemaError(file, `/agents/${id}/managed_cli`, `must be a list of distinct workflow IDs; supported: ${MANAGED_CLI_WORKFLOW_IDS.join(', ')}`);
+    }
     if (value.coordinator !== undefined
         && (typeof value.coordinator !== 'string' || !ROLE_NAME_RE.test(value.coordinator)))
         schemaError(file, `/agents/${id}/coordinator`, 'must be a valid Agent ID');