@ours.network/fleet 1.2.0-nightly.44 → 1.2.0-nightly.46

package/README.md

@@ -286,10 +286,33 @@ ours-fleet loops reload <Role>
 ours-fleet loops run-now|disable|enable <Role> <Loop>
 ours-fleet rm <Name>
 ours-fleet doctor [--harness H]
+ours-fleet managed-cli setup [--enable <Agent>]... | status [--json]   native harness policy for the task workflow
 ours-fleet version [--json]         build identity, capabilities, installs on PATH
 ours-fleet init
 ```
 
+### Fleet task commands from a harness command sandbox
+
+A Codex or Claude command sandbox refuses the supervisor socket, so a managed
+`ours-fleet` call fails with `connect EPERM` before it parses anything. Fleet
+prepares the native harness policy for the packaged Coordinator task workflow;
+you do not write Codex rules or Claude sandbox settings by hand:
+
+```sh
+ours-fleet managed-cli setup --enable FleetCoordinator   # adds managed_cli: [task-workflow] to that Agent
+ours-fleet managed-cli status                            # static setup, session policy, observed commands
+```
+
+The opt-in is an explicit Agent key and changes no permission. Setup starts no
+session or model, is repeated at every agent start, and `ours-install` runs it
+for you. It prepares `task create|start|finish|block|unblock|review|list|show`,
+`room show|members` and template/plan/help inspection for one pinned
+configuration, and nothing else; `task start`/`task finish` are real authority.
+Qualified end to end on Linux with Codex (native and ACP) and Claude ACP; macOS
+is prepared the same way but not yet qualified. Scope, boundaries, unsupported
+combinations and the evidence are in
+[docs/validation/managed-cli-permissions.md](docs/validation/managed-cli-permissions.md).
+
 ### Which build am I running?
 
 `--version` prints a semver, and a semver does not identify an artifact: version
@@ -1833,6 +1856,58 @@ pipe with a 32KiB limit and refuses a terminal. Legacy v1 payloads, which contai
 long-lived scoped credentials, are accepted only through file/stdin, never as
 command arguments. Use only one payload transport.
 
+When this host already has a registration, Fleet inspects the one-use grant without
+consuming it. The same workspace reruns without a deletion prompt or retirement.
+An account-origin change for that workspace requires `--migrate-app-origin`; a
+changed server identity is refused. An older App without inspection support falls
+back to asking before redemption. An unavailable inspection service preserves the
+grant and setup. Fleet verifies the redeemed destination against the inspection.
+
+For another workspace, setup describes the existing workspace, tunnel hostname and
+account origin and asks `[y/N]`. No answer or `no` preserves the setup and grant; a
+noninteractive caller must pass `--replace-registration`, otherwise it exits with
+an error. A legacy binding without a server identity must rerun its own workspace
+first. The original Human root signs retirement. Fleet waits for the account's
+durable cleanup receipt before stopping the old service and revoking its linked
+devices. If a migrated database has no old registration, the signed command confirms
+absence; the service has no old provider resources to delete. Installation identities,
+profile, agents, history, stable host ID and local pairing are preserved.
+
+Replacement recovery is saved in an owned private `workspace/replacement.json`
+after root, host, service and server-contact preconditions pass. The App must
+explicitly support deadline-enforced retirement; an older App without that
+capability preserves the existing setup. `setup-tunnel --resume` retries its nonce
+and saved operation deadline (24 hours less a five-minute clock margin).
+If the enrollment challenge expires, obtain a fresh App command for the same target
+and pass `--replace-registration`; completed retirement is retained. The old server
+identity is pinned: only its own invitation can reconnect it.
+
+`setup-tunnel --abandon-replacement` removes the private recovery payload only when
+a fresh private receipt confirms no deletion and the operation was never dispatched
+or was terminally rejected. A lost transport response remains uncertain. Expired
+operations require a fresh receipt proving the old binding still exists after the
+deadline plus five minutes and an explicit server guarantee that the deadline is enforced;
+older recovery records without that guarantee must be resumed. Abandoning preserves
+the existing binding, connector and installation data. A terminally rejected operation
+requires abandonment and a new App command, rather than reusing its nonce.
+After that deadline, a fresh command for the same target can also resume with a
+new operation nonce after checking the enforced expiry. This confirms signed
+absence if an old successful receipt was lost and later pruned.
+
+If the App accepted the successor proof before Fleet wrote its local binding,
+a fresh command for that target retains the original private connector from the
+recovery record. If that successor cannot be recovered, remove it in the App,
+then use `setup-tunnel --discard-retired-replacement` and a fresh App command.
+Discard is allowed only after retirement and local cleanup, while the old local
+binding remains. It removes only the recovery record. This host has no working
+registration until the new setup completes; the old service was stopped and its
+linked devices revoked.
+
+Renewal commands contain no existing live connector credential. Fleet keeps the
+current private connector byte for byte, and accepts renewal only for its recorded
+workspace, server, origin and tunnel hostname. Restore a missing or unsafe connector,
+or remove and re-create that workspace in the App before setting it up again.
+
 After service and signed tunnel-target confirmation, setup prints both a QR and
 ordinary private single-use connection code. The App checks readiness automatically
 and immediately opens the code field. If setup or code output fails after binding,

package/dist/application/role-removal-service.js

@@ -1,3 +1,4 @@
+import { retireNotificationTarget } from '../notifications/target-cleanup.js';
 import { cpSync, existsSync, mkdirSync, readdirSync, renameSync } from 'node:fs';
 import { basename, dirname, join } from 'node:path';
 import { loadConfig, ROLE_NAME_RE } from '../config.js';
@@ -87,6 +88,7 @@ export class RoleRemovalService {
             await this.options.ops.backend.uninstall(preview.role);
             if (existsSync(sourceState))
                 renameSync(sourceState, join(recoveryPath, 'orphan-state'));
+            await retireNotificationTarget(`/fleet/chats?chat=${encodeURIComponent(preview.role)}`).catch(() => { });
             this.options.ops.log(`removed orphaned backend/state '${preview.role}'`);
         }
         return { ...preview, removed: true, recoveryPath };

package/dist/briefing.d.ts

@@ -15,6 +15,8 @@ export interface BriefingOpts {
     identityGuarantee?: 'verified' | 'created' | 'unverified';
     /** Temporary spawn whose newly-created identity should share the session lifecycle. */
     temporaryIdentity?: boolean;
+    /** Fleet-prepared invocation guidance (src/managed-cli.ts); empty when none applies. */
+    managedCli?: string[];
 }
 /** Render a role's briefing.md: narrative (or curated body) + mechanical boot steps. */
 export declare function generateBriefing(role: ResolvedRole, v: BriefingVocab, opts: BriefingOpts): string;

package/dist/briefing.js

@@ -197,9 +197,16 @@ export function generateBriefing(role, v, opts) {
         L.push('For omitted settings, the supervisor inherits your canonical Brain and Role selections,');
         L.push('working directory, neutral permissions, coordinator, and fleet monitor policy. Every');
         L.push('explicit option wins; identity/session-local and secret material never inherit.');
-        L.push('All public CLI surfaces are available; hidden worker entry points remain internal.');
+        L.push('All public CLI surfaces are routed this way; hidden worker entry points remain internal.');
+        if (role.permissions && role.permissions.filesystem !== 'unrestricted' && !opts.managedCli?.length) {
+            L.push('Routing is not reachability: every call first connects to the supervisor socket, and a');
+            L.push('harness command sandbox can refuse that connection (`connect EPERM`), even for `--help`.');
+            L.push('No Fleet command is prepared to run outside your sandbox. If one is refused, report it');
+            L.push('as a blocker; the owner enables a workflow with `ours-fleet managed-cli setup --enable`.');
+        }
         L.push('Lifecycle notice delivery failures stay in service diagnostics and never rerun effects.');
         L.push('This proxy is attribution and convenience, not a security boundary for unisolated roles.');
+        L.push(...(opts.managedCli ?? []));
     }
     if (role.coordinator) {
         L.push(`7. ANNOUNCE yourself: call **${v.sendTool}** to contact "${role.coordinator}" with text:`);

package/dist/build-info.json

@@ -1,10 +1,11 @@
 {
-  "version": "1.2.0-nightly.44",
-  "buildId": "0814e82b7dde",
-  "commit": "94ad261abac133a3c17081c1a531a8a363178470",
+  "version": "1.2.0-nightly.46",
+  "buildId": "a75b12e57308",
+  "commit": "f608ced10209f4b9ecf9dc9b573d8cab46136a68",
   "dirty": true,
-  "builtAt": "2026-10-04T08:52:19.101Z",
+  "builtAt": "2026-10-04T23:11:11.430Z",
   "capabilities": [
+    "managed-cli.setup-v1",
     "workspace.enroll.preserve-profile-v1",
     "cowork.http-management-v1",
     "monitor.interrupt.after_tool"

package/dist/capabilities.d.ts

@@ -16,7 +16,9 @@
 export declare const CAP_MONITOR_INTERRUPT_AFTER_TOOL = "monitor.interrupt.after_tool";
 export declare const CAP_HTTP_COWORK = "cowork.http-management-v1";
 export declare const CAP_WORKSPACE_PRESERVE_PROFILE = "workspace.enroll.preserve-profile-v1";
-export declare const CAPABILITIES: readonly ["workspace.enroll.preserve-profile-v1", "cowork.http-management-v1", "monitor.interrupt.after_tool"];
+/** `ours-fleet managed-cli setup|status` and the `managed_cli` Agent key (#233). */
+export declare const CAP_MANAGED_CLI_SETUP = "managed-cli.setup-v1";
+export declare const CAPABILITIES: readonly ["managed-cli.setup-v1", "workspace.enroll.preserve-profile-v1", "cowork.http-management-v1", "monitor.interrupt.after_tool"];
 export type Capability = (typeof CAPABILITIES)[number];
 /** Does this build declare `token`? */
 export declare const hasCapability: (token: string) => boolean;

package/dist/capabilities.js

@@ -16,7 +16,10 @@
 export const CAP_MONITOR_INTERRUPT_AFTER_TOOL = 'monitor.interrupt.after_tool';
 export const CAP_HTTP_COWORK = 'cowork.http-management-v1';
 export const CAP_WORKSPACE_PRESERVE_PROFILE = 'workspace.enroll.preserve-profile-v1';
+/** `ours-fleet managed-cli setup|status` and the `managed_cli` Agent key (#233). */
+export const CAP_MANAGED_CLI_SETUP = 'managed-cli.setup-v1';
 export const CAPABILITIES = [
+    CAP_MANAGED_CLI_SETUP,
     CAP_WORKSPACE_PRESERVE_PROFILE,
     CAP_HTTP_COWORK,
     CAP_MONITOR_INTERRUPT_AFTER_TOOL,

package/dist/cli.js

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
+import { beginWorkspaceReplacement, abandonWorkspaceReplacement, discardRetiredWorkspaceReplacement, clearWorkspaceReplacement, confirmWorkspaceReplacement, finishWorkspaceReplacement, readWorkspaceBinding, readWorkspaceReplacement, requiresWorkspaceReplacement, refreshWorkspaceReplacement } from './workspace-replacement.js';
 import { completeTunnelSetup } from './tunnel-setup-completion.js';
-import { readTunnelSetupFile, readTunnelSetupStdin, readTunnelSetupArgument, redeemTunnelSetup } from './tunnel-setup-input.js';
+import { readTunnelSetupFile, readTunnelSetupStdin, readTunnelSetupArgument, redeemTunnelSetup, inspectTunnelSetup, verifyTunnelSetupTarget } from './tunnel-setup-input.js';
 import { ensureMinimalSetup } from './minimal-setup.js';
-import { confirmWorkspaceTarget } from './workspace-enrollment.js';
+import { confirmWorkspaceTarget, checkWorkspaceConnector } from './workspace-enrollment.js';
 import { clearPendingTunnelSetup, readPendingTunnelSetup, requiredPortAfterExpiry, savePendingTunnelSetup, setupTunnelPreflight } from './setup-tunnel-preflight.js';
 import { availableWebPort } from './web/available-port.js';
 import QRCode from 'qrcode';
@@ -56,6 +57,8 @@ import './harness/claude-code.js'; // registers the claude-code adapter
 import './harness/codex.js'; // registers the codex adapter
 import './harness/hermes.js';
 import { registerLayoutCommands } from './rooms-tasks/layout-cli.js';
+import { MANAGED_CONFIGURATION_FLAG, assertPinnedConfiguration, enableManagedCli, managedCliReport, parseManagedEntry, } from './managed-cli.js';
+import { MANAGED_CLI_WORKFLOW_IDS } from './config.js';
 import { registerTemplateCommands, registerTaskCommands, registerRoomCommands } from './rooms-tasks/cli.js';
 import { RoleCreationService } from './application/role-creation-service.js';
 import { RoleRemovalService } from './application/role-removal-service.js';
@@ -99,6 +102,22 @@ const program = new Command()
     .exitOverride()
     .version(VERSION);
 const cOpt = (cmd) => cmd.option('-c, --configuration <file>', 'manifest (default: ~/fleet.yaml; documents under ~/fleet/)');
+/**
+ * Set only for the pinned managed entry form (see src/managed-cli.ts). Checked
+ * against the PARSED option, so every spelling of a later `-c` is covered.
+ */
+let pinnedConfiguration;
+program.hook('preAction', (_program, action) => {
+    if (pinnedConfiguration === undefined)
+        return;
+    try {
+        assertPinnedConfiguration(pinnedConfiguration, action.opts().configuration);
+    }
+    catch (error) {
+        console.error(`error: ${error.message}`);
+        throw new FleetCliExit(1, 'validation', 'not_started');
+    }
+});
 const collect = (value, previous) => [...previous, value];
 program.command('docs')
     .alias('man')
@@ -1299,6 +1318,78 @@ cOpt(program.command('spawn [name]').description('spawn a new agent (permanent b
         die(e);
     }
 });
+function renderManagedCliReport(report) {
+    const lines = [
+        `Managed CLI setup for ${report.configuration}`,
+        `  node ${report.node}`, `  cli  ${report.cli}`,
+        `  platform ${report.platform.os}${report.platform.declared ? '' : ' (not a declared platform)'}`,
+    ];
+    for (const role of report.roles) {
+        if (role.setup.state === 'not-declared')
+            continue;
+        lines.push('', `${role.role} (${role.harness}/${role.session}) — ${role.workflows.join(', ')}`);
+        lines.push(`  setup (static): ${role.setup.state}${role.setup.action ? ` [${role.setup.action}]` : ''} — ${role.setup.detail}`);
+        if (role.setup.artifact)
+            lines.push(`    ${role.setup.artifact}`);
+        lines.push(`  running session: ${role.session_policy}`);
+        lines.push(`  observed (audit ledger): ${role.observed.summary}`);
+        if (role.commandPrefix)
+            lines.push(`  invoke as: ${role.commandPrefix} <command>`);
+        for (const line of role.scope)
+            lines.push(`  scope: ${line}`);
+        for (const line of role.warnings)
+            lines.push(`  note: ${line}`);
+    }
+    if (!report.roles.some(role => role.setup.state !== 'not-declared'))
+        lines.push('', 'No agent declares managed_cli. Nothing was generated and no permission changed.', 'Enable it for one agent with: ours-fleet managed-cli setup --enable <Agent>');
+    for (const item of report.removed)
+        lines.push('', `${item.action}: ${item.path} — ${item.detail ?? ''}`);
+    lines.push('', ...report.disclosure.map(line => `* ${line}`));
+    return lines.join('\n');
+}
+const managedCliCommand = program.command('managed-cli')
+    .description('prepare and inspect native harness policy for Fleet commands run from a command sandbox');
+for (const [name, write, description] of [
+    ['setup', true, 'generate the policy for agents declaring managed_cli; starts no session and no model'],
+    ['status', false, 'compare generated policy and observed supervisor access without changing anything'],
+]) {
+    const command = cOpt(managedCliCommand.command(name).description(description)).option('--json', 'JSON output');
+    if (write)
+        command.option('--enable <agent>', 'first add managed_cli: [task-workflow] to this Agent file (repeatable); its permissions are not changed', (value, all) => [...all, value], [])
+            .option('--workflow <id>', `workflow --enable adds (${MANAGED_CLI_WORKFLOW_IDS.join(', ')})`, 'task-workflow');
+    command.action((opts) => {
+        try {
+            const enabled = [];
+            if (opts.enable?.length) {
+                if (!MANAGED_CLI_WORKFLOW_IDS.includes(opts.workflow ?? ''))
+                    throw new Error(`unknown workflow '${opts.workflow}'; supported: ${MANAGED_CLI_WORKFLOW_IDS.join(', ')}`);
+                // Validate every name before the first file is touched.
+                const cfg = loadConfig(opts.configuration);
+                for (const agent of opts.enable)
+                    findRole(cfg, agent);
+                for (const agent of opts.enable)
+                    enabled.push({ agent, ...enableManagedCli(opts.configuration, agent, opts.workflow) });
+            }
+            const report = managedCliReport(loadConfig(opts.configuration), opts.configuration, { write });
+            if (opts.json) {
+                console.log(JSON.stringify({ ...report, enabled }, null, 2));
+            }
+            else {
+                for (const item of enabled)
+                    console.log(`${item.changed ? 'Enabled' : 'Already enabled'} ${opts.workflow} for ${item.agent} in ${item.file}`);
+                console.log(renderManagedCliReport(report));
+            }
+            const failing = report.roles.filter(role => ['unsupported', 'conflict', 'stale', 'missing'].includes(role.setup.state));
+            if (failing.length)
+                throw new FleetCliExit(1);
+        }
+        catch (error) {
+            if (error instanceof FleetCliExit)
+                throw error;
+            die(error);
+        }
+    });
+}
 cOpt(program.command('doctor').description('prerequisite report'))
     .option('--harness <id>', 'check one harness explicitly')
     .option('--yaml-mode <mode>', 'non-plain YAML policy: compat|strict', 'compat')
@@ -1519,9 +1610,23 @@ webCommand.command('uninstall').description('stop and uninstall the owner web se
 });
 async function workspaceEnrollmentCommand(opts, setupTunnel = false, argument) {
     try {
+        if (opts.discardRetiredReplacement) {
+            if (!setupTunnel || argument !== undefined || opts.file || opts.stdin || opts.check || opts.resume || opts.migrateAppOrigin || opts.replaceRegistration || opts.configuration || opts.abandonReplacement)
+                throw Error('--discard-retired-replacement takes no payload or other setup options');
+            discardRetiredWorkspaceReplacement();
+            process.stdout.write('Retired replacement recovery discarded. This host has no working registration: the old service was stopped and linked devices revoked. After removing the failed successor in the App, use a fresh command to complete a new registration. Installation data and the old local binding are preserved.\n');
+            return;
+        }
+        if (opts.abandonReplacement) {
+            if (!setupTunnel || argument !== undefined || opts.file || opts.stdin || opts.check || opts.resume || opts.migrateAppOrigin || opts.replaceRegistration || opts.configuration)
+                throw Error('--abandon-replacement takes no payload or other setup options');
+            await abandonWorkspaceReplacement();
+            process.stdout.write('Unsent or rejected replacement abandoned; existing local setup preserved. Obtain a fresh App command for another setup.\n');
+            return;
+        }
         if (setupTunnel && opts.check && opts.resume)
             throw Error('Use either --check or --resume');
-        if (setupTunnel && (opts.check || opts.resume) && (argument !== undefined || opts.file || opts.stdin || opts.migrateAppOrigin))
+        if (setupTunnel && (opts.check || opts.resume) && (argument !== undefined || opts.file || opts.stdin || opts.migrateAppOrigin || opts.replaceRegistration))
             throw Error('--check and --resume take no payload or migration flag');
         if (setupTunnel && opts.check) {
             await setupTunnelPreflight();
@@ -1531,10 +1636,22 @@ async function workspaceEnrollmentCommand(opts, setupTunnel = false, argument) {
         }
         let pending;
         if (setupTunnel && opts.resume) {
-            pending = readPendingTunnelSetup();
-            if (opts.configuration && resolvePath(opts.configuration) !== pending.configuration)
-                throw Error(`This setup started with configuration ${pending.configuration}; resume it without --configuration`);
-            await setupTunnelPreflight();
+            const replacement = readWorkspaceReplacement();
+            if (replacement) {
+                if (opts.configuration && resolvePath(opts.configuration) !== replacement.configuration)
+                    throw Error('Resume replacement with its original configuration');
+                await setupTunnelPreflight();
+                const result = await finishWorkspaceReplacement(replacement);
+                pending = { appOrigin: replacement.payload.appOrigin, origin: result.origin, hostWorkspaceId: result.hostWorkspaceId, rootCid: result.rootCid, challenge: replacement.payload.challenge, configuration: replacement.configuration };
+                savePendingTunnelSetup(pending);
+                clearWorkspaceReplacement();
+            }
+            else {
+                pending = readPendingTunnelSetup();
+                if (opts.configuration && resolvePath(opts.configuration) !== pending.configuration)
+                    throw Error(`This setup started with configuration ${pending.configuration}; resume it without --configuration`);
+                await setupTunnelPreflight();
+            }
         }
         else {
             if (argument === undefined && !opts.file && !opts.stdin)
@@ -1544,18 +1661,49 @@ async function workspaceEnrollmentCommand(opts, setupTunnel = false, argument) {
             if (opts.stdin && process.stdin.isTTY)
                 throw Error('--stdin requires a pipe; use an owned private --file instead');
             const input = setupTunnel ? (argument !== undefined ? readTunnelSetupArgument(argument) : opts.stdin ? await readTunnelSetupStdin() : readTunnelSetupFile(opts.file)) : undefined;
+            const previous = setupTunnel ? readWorkspaceBinding() : undefined;
+            const replacement = setupTunnel ? readWorkspaceReplacement() : undefined;
+            if (replacement && !opts.replaceRegistration)
+                throw Error('An unfinished replacement exists. Run setup-tunnel --resume, use a fresh command for the same target with --replace-registration, or --abandon-replacement when retirement was never sent or definitively rejected. If retirement and cleanup completed but the successor cannot be recovered, remove the successor in the App and use --discard-retired-replacement');
+            if (replacement && resolvePath(opts.configuration ?? defaultConfigPath()) !== replacement.configuration)
+                throw Error('Replacement requires its original configuration');
+            const target = previous && !replacement ? await inspectTunnelSetup(input) : undefined;
+            const different = previous && !replacement && (!target || requiresWorkspaceReplacement(previous, target, opts.migrateAppOrigin));
+            if (different && !(await confirmWorkspaceReplacement(previous, opts.replaceRegistration))) {
+                if (!process.stdin.isTTY)
+                    throw Error('Replacement confirmation required; existing setup and grant preserved');
+                return;
+            }
             if (setupTunnel) {
                 await setupTunnelPreflight();
                 await checkWorkspaceConfiguration(opts.configuration ?? defaultConfigPath());
             }
-            const payload = setupTunnel ? await redeemTunnelSetup(input) : readWorkspacePayload(opts.file);
+            let payload = setupTunnel ? await redeemTunnelSetup(input) : readWorkspacePayload(opts.file);
+            verifyTunnelSetupTarget(target, payload);
+            const replace = previous && !replacement && requiresWorkspaceReplacement(previous, { workspaceId: payload.challenge.workspaceId, serverCid: payload.serverCid, appOrigin: payload.appOrigin }, opts.migrateAppOrigin);
+            if (replacement) {
+                refreshWorkspaceReplacement(replacement, payload, opts.configuration ?? defaultConfigPath());
+                payload = replacement.payload;
+            }
+            checkWorkspaceConnector(payload);
             if (setupTunnel)
                 await ensureMinimalSetup(opts.configuration ?? defaultConfigPath());
-            const result = await enrollWorkspace(payload, opts.configuration, { migrateAppOrigin: opts.migrateAppOrigin, preserveProfile: setupTunnel || opts.preserveProfile });
+            let result;
+            if (replacement) {
+                result = await finishWorkspaceReplacement(replacement);
+            }
+            else if (replace) {
+                const record = await beginWorkspaceReplacement(previous, payload, opts.configuration ?? defaultConfigPath());
+                result = await finishWorkspaceReplacement(record);
+            }
+            else
+                result = await enrollWorkspace(payload, opts.configuration, { migrateAppOrigin: opts.migrateAppOrigin, preserveProfile: setupTunnel || opts.preserveProfile });
             pending = { appOrigin: payload.appOrigin, origin: result.origin, hostWorkspaceId: result.hostWorkspaceId, rootCid: result.rootCid, challenge: payload.challenge, configuration: resolvePath(opts.configuration ?? defaultConfigPath()) };
-            // The proof is one-time: keep what the remaining steps need so they can be finished without a new command.
-            if (setupTunnel)
+            // Keep both the replacement capability and the proof until the next recovery record is durable.
+            if (setupTunnel) {
                 savePendingTunnelSetup(pending);
+                clearWorkspaceReplacement();
+            }
         }
         try {
             await finishWorkspaceService(pending, opts.resume ? pending.configuration : opts.configuration, setupTunnel);
@@ -1649,7 +1797,10 @@ cOpt(program.command('setup-tunnel').argument('[payload]', 'minimal one-use v2 A
     .option('--file <path>', 'owned private App grant or legacy payload file (chmod 600)')
     .option('--stdin', 'read the private App grant or legacy payload from a pipe')
     .option('--check', 'only verify host prerequisites; changes nothing and needs no payload')
-    .option('--resume', 'finish a setup that stopped after this host was bound; needs no new payload')
+    .option('--resume', 'finish an interrupted replacement or setup; needs no new payload')
+    .option('--discard-retired-replacement', 'forget a failed successor after retirement and local cleanup; remove it in the App first')
+    .option('--abandon-replacement', 'discard an unsent or definitively rejected replacement after checking its private receipt')
+    .option('--replace-registration', 'confirm retirement of the existing account registration when the new one differs')
     .option('--migrate-app-origin', 'explicitly migrate the same workspace to its new account origin after verified signed proof')
     .action(async (payload, opts) => workspaceEnrollmentCommand(opts, true, payload));
 program.command('link-device').description('create a single-use workspace device connection code (expires in five minutes)')
@@ -1797,7 +1948,15 @@ async function parseFleetCli() {
 async function runFleetCli() {
     const stateDir = process.env[FLEET_PROXY_STATE_DIR_ENV];
     const caller = process.env[FLEET_PROXY_CALLER_ENV];
+    const entry = parseManagedEntry(process.argv.slice(2));
     if (!stateDir || !caller) {
+        // The pinned form exists for managed sessions; outside one there is no
+        // supervisor to audit the call, so it is refused rather than run unaudited.
+        if (entry.kind !== 'none') {
+            console.error(`error: ${entry.kind === 'error' ? entry.message
+                : `${MANAGED_CONFIGURATION_FLAG} is only valid inside a Fleet-managed agent session, where the supervisor audits the call`}`);
+            throw new FleetCliExit(1, 'validation', 'not_started');
+        }
         await parseFleetCli();
         return;
     }
@@ -1832,6 +1991,15 @@ async function runFleetCli() {
         const originalExit = process.exit;
         process.exit = ((code) => { throw new FleetCliExit(code ?? 0); });
         try {
+            if (entry.kind === 'error') {
+                console.error(`error: ${entry.message}`);
+                throw new FleetCliExit(1, 'validation', 'not_started');
+            }
+            if (entry.kind === 'pinned') {
+                // The supervisor audited the argv as typed; Commander parses the ordinary form.
+                pinnedConfiguration = entry.configuration;
+                process.argv = [process.argv[0], process.argv[1], ...entry.argv];
+            }
             await parseFleetCli();
         }
         catch (error) {

package/dist/config.d.ts

@@ -36,6 +36,12 @@ export type FilesystemMode = 'read-only' | 'workspace' | 'unrestricted';
 export type UnattendedMode = 'deny' | 'wait';
 /** Monitor wake policy: preserve legacy booleans and add one explicit safe boundary. */
 export type MonitorInterrupt = boolean | 'after_tool';
+/**
+ * Workflows Fleet prepares native harness execution policy for. Declared per
+ * Agent; never inferred from a role's name or persona, and never inherited.
+ */
+export declare const MANAGED_CLI_WORKFLOW_IDS: readonly ["task-workflow"];
+export type ManagedCliWorkflowId = (typeof MANAGED_CLI_WORKFLOW_IDS)[number];
 export interface CommonPermissions {
     approval: ApprovalMode;
     filesystem: FilesystemMode;
@@ -146,6 +152,8 @@ export interface RoleConfig {
     owner_channel?: OwnerChannelConfigInput;
     worklog?: WorklogPolicyInput;
     auth_proxy?: Partial<AuthProxyConfig>;
+    /** Fleet-prepared CLI workflows this role may run outside its command sandbox. */
+    managed_cli?: ManagedCliWorkflowId[];
 }
 export type AgentSelection<T extends Record<string, unknown> = Record<string, unknown>> = {
     ref: string;
@@ -167,6 +175,8 @@ export interface AgentDefinition {
     owner_channel?: OwnerChannelConfigInput;
     worklog?: WorklogPolicyInput;
     auth_proxy?: Partial<AuthProxyConfig>;
+    /** Fleet-prepared CLI workflows this Agent may run outside its command sandbox. */
+    managed_cli?: ManagedCliWorkflowId[];
     /** Scheduled turns scoped only to temporary launches; persistent Agents reject this field. */
     loops?: AgentLoopsConfig;
 }

package/dist/config.js

@@ -24,6 +24,11 @@ export const NOTIFY_EVENT_TYPES = [
     'message_received', 'file_received', 'sibling_contact_added', 'local_contact_request',
     'pending_message', 'contact_restored', 'inbound_error', 'state_import_failed',
 ];
+/**
+ * Workflows Fleet prepares native harness execution policy for. Declared per
+ * Agent; never inferred from a role's name or persona, and never inherited.
+ */
+export const MANAGED_CLI_WORKFLOW_IDS = ['task-workflow'];
 /** Default wake sources when a role does not list its own. */
 export const DEFAULT_WAKE_SOURCES = ['message_received', 'file_received', 'local_contact_request', 'pending_message'];
 const MONITOR_KEYS = [
@@ -139,7 +144,7 @@ export const ROLE_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 const ROLE_KEYS = [
     'harness', 'session', 'session_options', 'permissions', 'identity', 'cwd', 'coordinator', 'mission', 'persona', 'bio',
     'briefing_file', 'model', 'effort', 'model_chain', 'max_tokens', 'autocompact_pct', 'env', 'oversee', 'harness_options',
-    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy',
+    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'managed_cli',
 ];
 export const ROLE_PRESET_KEYS = ['mission', 'persona', 'bio', 'briefing_file'];
 export const BRAIN_PRESET_KEYS = [
@@ -148,7 +153,7 @@ export const BRAIN_PRESET_KEYS = [
 ];
 export const AGENT_KEYS = [
     'role', 'brain', 'permissions', 'identity', 'cwd', 'coordinator', 'env', 'oversee',
-    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'loops',
+    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'loops', 'managed_cli',
 ];
 const AGENT_INSTANCE_KEYS = ['template', 'overrides'];
 const TEMPLATE_FORBIDDEN_KEYS = ['identity'];
@@ -236,6 +241,12 @@ function validateAgentScalars(value, file, id) {
         if (current !== undefined && (typeof current !== 'string' || !current.trim()))
             schemaError(file, `/agents/${id}/${key}`, 'must be a non-blank string');
     }
+    if (value.managed_cli !== undefined) {
+        const ids = value.managed_cli;
+        if (!Array.isArray(ids) || ids.some(entry => !MANAGED_CLI_WORKFLOW_IDS.includes(entry))
+            || new Set(ids).size !== ids.length)
+            schemaError(file, `/agents/${id}/managed_cli`, `must be a list of distinct workflow IDs; supported: ${MANAGED_CLI_WORKFLOW_IDS.join(', ')}`);
+    }
     if (value.coordinator !== undefined
         && (typeof value.coordinator !== 'string' || !ROLE_NAME_RE.test(value.coordinator)))
         schemaError(file, `/agents/${id}/coordinator`, 'must be a valid Agent ID');