@ours.network/fleet 1.2.0-nightly.5 → 1.2.0-nightly.51

package/dist/harness/codex-runtime.d.ts

@@ -4,8 +4,18 @@ export declare const VERIFIED_CODEX_ACP_VERSIONS: Set<string>;
 export declare function executableOnPath(command: string, env: NodeJS.ProcessEnv, cwd?: string): string;
 /** Match the npm Codex wrapper's platform-package/vendor selection. */
 export declare function codexExecutable(entry: string): string;
+/**
+ * The host's own Codex, when ACP sessions should run it instead of the copy bundled with the adapter.
+ * The person signs in to, updates and checks the host Codex, and a newer Codex knows models the bundled
+ * one does not. It is used only when it is at least as new as the bundled copy; an explicit CODEX_PATH
+ * (including an empty one, which selects the bundled copy) always decides instead.
+ */
+export declare function hostCodex(adapterManifest: string | undefined, env: NodeJS.ProcessEnv, cwd?: string, version?: (path: string, env: NodeJS.ProcessEnv) => string | undefined): {
+    path: string;
+    version: string;
+} | undefined;
 export interface CodexRuntime {
-    source: 'CODEX_PATH' | 'bundled';
+    source: 'CODEX_PATH' | 'host' | 'bundled';
     entry: string;
     executable: string;
     version: string;

package/dist/harness/codex-runtime.js

@@ -1,5 +1,6 @@
 import { createRequire } from 'node:module';
-import { accessSync, constants, existsSync, realpathSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { accessSync, constants, existsSync, readFileSync, realpathSync } from 'node:fs';
 import { dirname, join, isAbsolute, resolve, delimiter } from 'node:path';
 import { realExec } from '../exec.js';
 export const VERIFIED_CODEX_ACP_VERSIONS = new Set(['1.1.7', '1.10.0']);
@@ -46,18 +47,44 @@ export function codexExecutable(entry) {
     }
     throw new Error(`Codex platform binary missing under ${vendor}; reinstall Fleet with optional dependencies`);
 }
+const versionOf = (text) => text.match(/\b(\d+\.\d+\.\d+)\b/)?.[1];
+function installedCodexVersion(path, env) {
+    const result = spawnSync(path, ['--version'], { env, encoding: 'utf8', timeout: 5_000, stdio: ['ignore', 'pipe', 'ignore'] });
+    return result.status === 0 ? versionOf(result.stdout ?? '') : undefined;
+}
+/**
+ * The host's own Codex, when ACP sessions should run it instead of the copy bundled with the adapter.
+ * The person signs in to, updates and checks the host Codex, and a newer Codex knows models the bundled
+ * one does not. It is used only when it is at least as new as the bundled copy; an explicit CODEX_PATH
+ * (including an empty one, which selects the bundled copy) always decides instead.
+ */
+export function hostCodex(adapterManifest, env, cwd = process.cwd(), version = installedCodexVersion) {
+    if (env.CODEX_PATH !== undefined || !adapterManifest)
+        return undefined;
+    let path, bundled;
+    try {
+        path = executableOnPath('codex', env, cwd);
+        bundled = JSON.parse(readFileSync(createRequire(adapterManifest).resolve('@openai/codex/package.json'), 'utf8')).version;
+    }
+    catch {
+        return undefined;
+    }
+    const found = version(path, env);
+    return found && typeof bundled === 'string' && codexVersionAtLeast(found, bundled) ? { path, version: found } : undefined;
+}
 export async function probeCodexRuntime(adapter, env, exec = realExec, cwd = process.cwd()) {
-    const configured = env.CODEX_PATH;
+    const host = hostCodex(adapter.manifestPath, env, cwd);
+    const configured = env.CODEX_PATH || host?.path;
     if (!configured && !adapter.manifestPath)
         throw new Error('ACP runtime is unknown for a PATH/custom adapter; set CODEX_PATH to an absolute executable or use the bundled adapter');
     const entry = configured ? executableOnPath(configured, env, cwd)
         : createRequire(adapter.manifestPath).resolve('@openai/codex/bin/codex.js');
     const executable = codexExecutable(entry);
     const result = await exec(!configured ? process.execPath : entry, !configured ? [entry, '--version'] : ['--version'], { env, timeout: 5_000 });
-    const version = result.stdout.match(/\b(\d+\.\d+\.\d+)\b/)?.[1];
+    const version = versionOf(result.stdout);
     if (result.code !== 0 || !version)
         throw new Error(`Cannot read Codex version from ${entry}; check CODEX_PATH and executable permissions`);
-    return { source: configured ? 'CODEX_PATH' : 'bundled', entry, executable, version };
+    return { source: host ? 'host' : configured ? 'CODEX_PATH' : 'bundled', entry, executable, version };
 }
 export function codexVersionAtLeast(version, minimum) {
     const actual = version.split('.').map(Number);

package/dist/harness/codex.d.ts

@@ -6,8 +6,9 @@ import type { AcpSessionTransport } from './acp-session-transport.js';
 import type { CodexAppServerSessionTransport } from './codex-session.js';
 /**
  * What an unattended role can actually do under Codex's native settings.
- * `on-request` and `untrusted` stop to ask, and with no console attached that
- * request is refused rather than answered — so the role can only read.
+ * `on-request` and `untrusted` can ask even for startup file reads (for example,
+ * shell reads or files outside the sandbox). Without a controller the request
+ * waits or is denied according to policy. Neither guarantees `read-state`.
  */
 export declare function codexCapabilities(approval: string, sandbox: string): UnattendedCapability[];
 /** Defense in depth for callers which launch a role after validation was bypassed. */

package/dist/harness/codex.js

@@ -6,8 +6,9 @@ import { realExec } from '../exec.js';
 import { registerAdapter } from './registry.js';
 import { harnessRuntimeDir } from '../isolation/policy.js';
 import { resolveBundledAcpAgent, } from './acp-agent.js';
-import { VERIFIED_CODEX_ACP_VERSIONS, probeCodexRuntime, codexVersionAtLeast } from './codex-runtime.js';
+import { VERIFIED_CODEX_ACP_VERSIONS, probeCodexRuntime, codexVersionAtLeast, hostCodex } from './codex-runtime.js';
 import { CodexAgentSessionAdapter } from './codex-session.js';
+import { CODEX_REASONING_EFFORTS, isCodexReasoningEffort } from './codex-reasoning.js';
 const OPTION_KEYS = [
     'launcher', 'sandbox', 'approval', 'permission_mode', 'search', 'profile', 'config', 'add_dirs',
     'monitor',
@@ -25,12 +26,13 @@ const CODEX_PROXY_REAL_PATH_ENV = 'OURS_FLEET_REAL_CODEX_PATH';
 const CODEX_PROXY_MANIFEST_ENV = 'OURS_FLEET_CODEX_ACP_MANIFEST';
 /**
  * What an unattended role can actually do under Codex's native settings.
- * `on-request` and `untrusted` stop to ask, and with no console attached that
- * request is refused rather than answered — so the role can only read.
+ * `on-request` and `untrusted` can ask even for startup file reads (for example,
+ * shell reads or files outside the sandbox). Without a controller the request
+ * waits or is denied according to policy. Neither guarantees `read-state`.
  */
 export function codexCapabilities(approval, sandbox) {
     if (approval !== 'never')
-        return ['read-state'];
+        return [];
     const caps = ['read-state', 'messaging', 'monitor', 'status-commands'];
     if (sandbox !== 'read-only')
         caps.push('write-state', 'workspace-edit');
@@ -140,6 +142,13 @@ function neutralSandboxMode(role) {
 function isNativeConfigKeyAllowed(key) {
     return NATIVE_CONFIG_ALLOWLIST.has(key);
 }
+/** Brain wins; a validated native effort also needs delivery through ACP's selection API. */
+function reasoningEffort(role) {
+    if (typeof role.effort === 'string')
+        return role.effort;
+    const value = role.harness_options?.config?.model_reasoning_effort;
+    return isCodexReasoningEffort(value) ? value : undefined;
+}
 /** Defense in depth for callers which launch a role after validation was bypassed. */
 export function nativeCodexConfig(role) {
     const options = role.harness_options;
@@ -265,7 +274,9 @@ function codexAcpEnvironment(role, dirs) {
         [CODEX_PROXY_APPROVAL_ENV]: approvalPolicy(role) ?? 'on-request',
         [CODEX_PROXY_SANDBOX_ENV]: acpRuntimeSandbox(role),
         [CODEX_PROXY_MANIFEST_ENV]: resolution.manifestPath,
-        [CODEX_PROXY_REAL_PATH_ENV]: role.env?.CODEX_PATH ?? process.env.CODEX_PATH ?? '',
+        // Same choice as probeCodexRuntime: an explicit CODEX_PATH, else a host Codex at least as new as the bundled one.
+        [CODEX_PROXY_REAL_PATH_ENV]: role.env?.CODEX_PATH ?? process.env.CODEX_PATH
+            ?? hostCodex(resolution.manifestPath, { ...process.env, ...role.env }, dirs.runCwd)?.path ?? '',
     };
 }
 function encodeTomlValue(value) {
@@ -315,10 +326,8 @@ export function makeCodexAdapter(exec = realExec, transport, nativeTransport) {
         id: 'codex',
         agentSession: new CodexAgentSessionAdapter({
             resolveBrain(brain) {
-                const levels = ['low', 'medium', 'high', 'xhigh', 'max', 'ultra'];
-                if (brain.effort != null
-                    && (typeof brain.effort !== 'string' || !levels.includes(brain.effort)))
-                    throw new Error(`Codex Brain effort must be one of: ${levels.join(', ')}`);
+                if (brain.effort != null && !isCodexReasoningEffort(brain.effort))
+                    throw new Error(`Codex Brain effort must be one of: ${CODEX_REASONING_EFFORTS.join(', ')}`);
                 const harnessOptions = { ...(brain.harnessOptions ?? {}) };
                 if (brain.effort)
                     harnessOptions.config = {
@@ -340,8 +349,8 @@ export function makeCodexAdapter(exec = realExec, transport, nativeTransport) {
             sessionConfigSelections: role => [
                 ...(typeof role.model === 'string'
                     ? [{ configId: 'model', value: role.model }] : []),
-                ...(typeof role.effort === 'string'
-                    ? [{ configId: 'reasoning_effort', value: role.effort }] : []),
+                ...(reasoningEffort(role)
+                    ? [{ configId: 'reasoning_effort', value: reasoningEffort(role) }] : []),
             ],
             permissionModeId: role => acpAgentMode(role),
             mcpServers: () => undefined,

package/dist/init-wizard.d.ts

@@ -53,6 +53,8 @@ export declare function validateCatalog(value: BrainCatalog, path?: string): Bra
 export declare function readInitSettings(path: string): InitAnswers;
 export declare function askInitQuestions(prompter: InitPrompter, configuration: string): Promise<InitAnswers | undefined>;
 export declare function formatSetupSummary(answers: InitAnswers, configuration: string): string;
+/** The packaged Brain preset for a catalog model at one effort; the same naming the presets are generated with. */
+export declare function brainPresetId(model: Pick<CatalogModel, 'harness' | 'model'>, effort: string): string;
 /** Build the exact, deterministic default experience without writing to disk. */
 export declare function generateSetup(answers: InitAnswers): GeneratedSetup;
 /** Run the mutation boundary only after the complete questionnaire is accepted. */

package/dist/init-wizard.js

@@ -7,13 +7,19 @@ import { packagedPresetRoot } from './preset-bootstrap.js';
 import { listTemplates } from './rooms-tasks/templates.js';
 const WORK_KINDS = ['development', 'review', 'coordination'];
 const ROLE_WORK = {
-    Developer: 'development', Critic: 'review',
+    Developer: 'development', Engineer: 'development', Critic: 'review',
     LocalCoordinator: 'coordination', Coordinator: 'coordination', FleetCoordinator: 'coordination',
 };
 const REASONING_EFFORT = {
     quick: 'low', balanced: 'medium', thorough: 'high',
 };
 const MODEL_LABELS = {
+    'gpt-6.1-sol': 'GPT-6.1 Sol',
+    'gpt-6-sol': 'GPT-6 Sol',
+    'gpt-6-luna': 'GPT-6 Luna',
+    'claude-fable-5-1': 'Claude Fable 5.1',
+    'claude-opus-5-5': 'Claude Opus 5.5',
+    'claude-haiku-4-5-20251001': 'Claude Haiku 4.5',
     'gpt-6-astra': 'GPT-6 Astra',
     'gpt-5.6-sol': 'GPT-5.6 Sol',
     'gpt-5.6-terra': 'GPT-5.6 Terra',
@@ -33,10 +39,10 @@ export function validateCatalog(value, path = 'supported model catalog') {
     for (const model of value.models) {
         if (!['codex', 'claude-code'].includes(model.harness) || model.session !== 'acp'
             || typeof model.model !== 'string' || !MODEL_LABELS[model.model]
-            || !Array.isArray(model.efforts) || model.efforts.length === 0
+            || !Array.isArray(model.efforts)
             || new Set(model.efforts).size !== model.efforts.length
             || model.efforts.some(effort => !['low', 'medium', 'high', 'xhigh', 'max', 'ultra'].includes(effort))
-            || !['low', 'medium', 'high'].every(effort => model.efforts.includes(effort)))
+            || (model.efforts.length > 0 && !['low', 'medium', 'high'].every(effort => model.efforts.includes(effort))))
             throw new Error(`unsupported model state in ${path}`);
         const tuple = `${model.harness}\0${model.session}\0${model.model}`;
         if (tuples.has(tuple))
@@ -90,7 +96,9 @@ export async function askInitQuestions(prompter, configuration) {
         return undefined;
     if (subscriptions.length === 0)
         throw new Error('Select at least one subscription.');
-    const available = catalog().models.filter(model => subscriptions.includes(subscriptionFor(model)));
+    // The wizard assigns low/medium/high; no-effort models remain available as named presets.
+    const available = catalog().models.filter(model => subscriptions.includes(subscriptionFor(model))
+        && model.efforts.length > 0);
     if (!available.length)
         throw new Error('None of the selected subscriptions has a supported model.');
     prompter.note([
@@ -163,7 +171,9 @@ export function formatSetupSummary(answers, configuration) {
         '  One-agent work: one Developer',
         '  Reviewed pair: Developer + independent Critic',
         '  Team: LocalCoordinator + Developer + Critic',
+        '  Gated engineering: Engineer (gate pipeline) + independent Critic',
         '  FleetCoordinator: coordination model',
+        '  Brains: the packaged presets; each prepared agent references the preset of its chosen model',
         '',
         'After the final Yes, Fleet performs host service setup before publishing the complete configuration.',
         'A hard termination after that Yes can leave host integration or private stage/recovery evidence to inspect.',
@@ -172,6 +182,11 @@ export function formatSetupSummary(answers, configuration) {
 function preset(relative) {
     return readFileSync(join(packagedPresetRoot(), 'fleet', relative), 'utf8');
 }
+/** The packaged Brain preset for a catalog model at one effort; the same naming the presets are generated with. */
+export function brainPresetId(model, effort) {
+    return `${model.harness === 'claude-code' ? 'claude' : 'codex'}-${model.model
+        .replace(/^claude-/, '').replace(/\./g, '-').toLowerCase()}-${effort}`;
+}
 /** Build the exact, deterministic default experience without writing to disk. */
 export function generateSetup(answers) {
     const effort = REASONING_EFFORT[answers.reasoning];
@@ -192,6 +207,7 @@ export function generateSetup(answers) {
         '  permissions: { approval: ask, filesystem: workspace, unattended: deny }',
         '',
     ].join('\n'));
+    const assigned = {};
     for (const work of WORK_KINDS) {
         const proposed = answers.models[work];
         if (!proposed || !answers.subscriptions.includes(subscriptionFor(proposed)))
@@ -205,14 +221,14 @@ export function generateSetup(answers) {
             throw new Error(`${work} contains tampered model capabilities`);
         if (!model.efforts.includes(effort))
             throw new Error(`${MODEL_LABELS[model.model]} does not support ${answers.reasoning} reasoning`);
-        files.set(`brains/${work}.yaml`, [
-            `harness: ${model.harness}`,
-            `session: ${model.session}`,
-            `model: ${model.model}`,
-            `effort: ${effort}`,
-            '',
-        ].join('\n'));
+        // The chosen model is assigned by reference to its packaged Brain preset; setup defines no Brain of its own.
+        const id = brainPresetId(model, effort);
+        if (!existsSync(join(packagedPresetRoot(), 'fleet', 'brains', `${id}.yaml`)))
+            throw new Error(`no packaged Brain preset for ${MODEL_LABELS[model.model]} at ${effort} reasoning`);
+        assigned[work] = id;
     }
+    for (const name of readdirSync(join(packagedPresetRoot(), 'fleet', 'brains')).filter(name => name.endsWith('.yaml')).sort())
+        files.set(`brains/${name}`, preset(`brains/${name}`));
     if (answers.assignmentStrategy === 'one-model') {
         const tuples = new Set(WORK_KINDS.map(work => {
             const model = answers.models[work];
@@ -221,23 +237,26 @@ export function generateSetup(answers) {
         if (tuples.size !== 1)
             throw new Error('one-model assignment requires the same exact model for development, review, and coordination');
     }
-    for (const role of ['Coordinator', 'LocalCoordinator', 'Developer', 'Critic']) {
+    for (const role of ['Coordinator', 'LocalCoordinator', 'Developer', 'Engineer', 'Critic']) {
         files.set(`roles/${role}.yaml`, preset(`roles/${role}.yaml`));
         if (role === 'Coordinator')
             continue;
         files.set(`agent_templates/${role}.yaml`, [
             `role: { ref: ${role} }`,
-            `brain: { ref: ${ROLE_WORK[role]} }`,
+            `brain: { ref: ${assigned[ROLE_WORK[role]]} }`,
             'coordinator: FleetCoordinator',
-            'permissions: { approval: ask, filesystem: workspace, unattended: deny }',
+            // Temporary default while the product is being tested: prepared agents work without asking.
+            'permissions: { approval: allow, filesystem: unrestricted, unattended: deny }',
             'monitor: { mode: fleet, interrupt: after_tool }',
             '',
         ].join('\n'));
     }
     files.set('agents/FleetCoordinator.yaml', preset('agents/FleetCoordinator.yaml')
-        .replace('brain: { ref: claude-default }', 'brain: { ref: coordination }'));
-    for (const name of ['single', 'pair', 'team'])
+        .replace('brain: { ref: claude-default }', `brain: { ref: ${assigned.coordination} }`));
+    for (const name of ['single', 'pair', 'team', 'engineering']) {
         files.set(`room_templates/${name}.yaml`, preset(`room_templates/${name}.yaml`));
+        files.set(`room_layouts/${name}.yaml`, preset(`room_layouts/${name}.yaml`));
+    }
     return { files, answers };
 }
 /** Run the mutation boundary only after the complete questionnaire is accepted. */
@@ -385,7 +404,7 @@ function writeStaged(stageManifest, setup) {
         replaceFileAtomically(target, contents, 0o600);
         fsyncPath(target);
     }
-    for (const kind of ['agents', 'agent_templates', 'roles', 'brains', 'room_templates'])
+    for (const kind of ['agents', 'agent_templates', 'roles', 'brains', 'room_templates', 'room_layouts'])
         fsyncPath(join(stageRoot, kind));
     fsyncPath(stageRoot);
     fsyncPath(dirname(stageManifest));
@@ -394,8 +413,8 @@ function validateStaged(stageManifest) {
     const config = loadConfig(stageManifest, { yamlMode: 'strict' });
     const templates = listTemplates(config.roomTemplates ?? {});
     const names = new Set(templates.map(template => template.name));
-    if (!['pair', 'single', 'team'].every(name => names.has(name)))
-        throw new Error('generated setup did not resolve the default single, pair, and team experiences');
+    if (!['pair', 'single', 'team', 'engineering'].every(name => names.has(name)))
+        throw new Error('generated setup did not resolve the default single, pair, team, and engineering experiences');
     for (const template of templates)
         for (const member of template.members)
             if (!config.agentTemplates?.[member.agent_template])

package/dist/isolation/policy.js

@@ -168,6 +168,8 @@ export function resolveIsolation(cfg, ctx) {
     }
     for (const dir of ctx.additionalWriteDirs ?? [])
         addRw(dir);
+    if (ctx.subscriptionHome)
+        addRw(ctx.subscriptionHome);
     // The selected harness/session command may live outside the system allowlist
     // (for example Node and a bundled ACP adapter under ~/.local). The runner
     // resolves its exact executable/package closure; keep every such bind RO.

package/dist/isolation/types.d.ts

@@ -63,6 +63,11 @@ export interface WrapContext {
      * them for itself or for its peers.
      */
     harnessSharedPaths?: string[];
+    /**
+     * The pinned subscription profile home (CLAUDE_CONFIG_DIR / CODEX_HOME), mounted
+     * read-write so the CLI can refresh that profile's login. Absent for the default.
+     */
+    subscriptionHome?: string;
     /** Exact launcher/interpreter/module closure required by the selected command. */
     runtimeReadPaths?: string[];
     brokerEndpoint?: string;

package/dist/managed-cli.d.ts

@@ -0,0 +1,253 @@
+import { type FleetConfig, type ManagedCliWorkflowId, type ResolvedRole } from './config.js';
+import type { SessionPrep } from './harness/types.js';
+/** Capability-gated by the installer; see src/capabilities.ts. */
+export declare const MANAGED_CONFIGURATION_FLAG = "--managed-configuration";
+/** What the last launch of a role actually prepared. Lives in the role's state dir. */
+export declare const MANAGED_CLI_RECORD = ".managed-cli.json";
+/** Quoted path tokens were refused by Codex 0.159.0 (#231) and granted by 0.160.0. */
+export declare const CODEX_QUOTED_PATH_MINIMUM = "0.160.0";
+export interface ManagedCliForm {
+    /** Argv tokens after the pin, matched exactly. */
+    tokens: readonly string[];
+    /** `lifecycle` forms create, change or retire tasks, rooms and agents. */
+    effect: 'help' | 'read' | 'lifecycle';
+    /** Whether the command itself takes -c/--configuration, where the pin is injected. */
+    configuration: boolean;
+}
+export interface ManagedCliWorkflow {
+    description: string;
+    forms: readonly ManagedCliForm[];
+    /** Named so nobody reads their absence as an oversight. */
+    excluded: readonly string[];
+}
+export declare const MANAGED_CLI_WORKFLOWS: Readonly<Record<ManagedCliWorkflowId, ManagedCliWorkflow>>;
+export type ManagedEntry = {
+    kind: 'none';
+} | {
+    kind: 'error';
+    message: string;
+} | {
+    kind: 'pinned';
+    configuration: string;
+    form: ManagedCliForm;
+    argv: string[];
+};
+/**
+ * Recognise the pinned entry form in `argv` (process.argv.slice(2)) and return
+ * the ordinary argv Commander should parse.
+ *
+ * The pin must be the first argument: that is the only position a native prefix
+ * rule can fix. For a command that takes `--configuration`, the pinned file is
+ * injected directly after the command tokens; a later, different value is
+ * refused by `assertPinnedConfiguration` on the PARSED option, so `-c`,
+ * `-cFILE`, `--configuration=FILE` and repeats need no token heuristics here.
+ */
+export declare function parseManagedEntry(argv: readonly string[]): ManagedEntry;
+/** Refuse a parsed `--configuration` that is not the pinned file. Throws a plain Error. */
+export declare function assertPinnedConfiguration(pinned: string, parsed: unknown): void;
+export interface ManagedCliPaths {
+    node: string;
+    cli: string;
+    configuration: string;
+}
+/** The exact tokens a rule fixes: this process's node, this installation's CLI, this configuration. */
+export declare function managedCliPaths(configPath?: string, overrides?: Partial<ManagedCliPaths>): ManagedCliPaths;
+/** The canonical shell spelling of one path token, or undefined when none is qualified. */
+export declare function shellSpelling(token: string): string | undefined;
+export declare const needsQuoting: (paths: ManagedCliPaths) => boolean;
+/** The argv prefix every prepared invocation starts with. */
+export declare function managedCliPrefix(paths: ManagedCliPaths): string[];
+/** The same prefix as the agent must type it. Undefined when a path cannot be spelled. */
+export declare function managedCliCommandPrefix(paths: ManagedCliPaths): string | undefined;
+/** Codex execution rules: one `prefix_rule` per form. JSON strings are valid Starlark strings. */
+export declare function renderCodexRules(paths: ManagedCliPaths, workflows: readonly ManagedCliWorkflowId[]): string;
+export interface ClaudeManagedCliSettings {
+    permissions: {
+        allow: string[];
+    };
+    sandbox: {
+        excludedCommands: string[];
+    };
+}
+/**
+ * Claude needs BOTH halves: `permissions.allow` authorizes the Bash call and
+ * `sandbox.excludedCommands` places it outside the OS sandbox when one is
+ * enabled. Each form is listed bare and with ` *` because the wildcard form
+ * alone is not relied on to match an invocation without arguments.
+ */
+export declare function claudeManagedCliSettings(paths: ManagedCliPaths, workflows: readonly ManagedCliWorkflowId[]): ClaudeManagedCliSettings | undefined;
+/**
+ * Merge the fragment into Fleet's own per-role settings overlay. Entries from a
+ * previous launch are dropped first, so a moved node, CLI or configuration
+ * leaves nothing stale behind. `sandbox.enabled` is never written: whether
+ * Claude's OS sandbox is on stays the operator's setting.
+ */
+export declare function mergeClaudeOverlay(base: Record<string, unknown>, fragment: ClaudeManagedCliSettings | undefined): Record<string, unknown>;
+export type ManagedCliMechanism = 'codex-workspace-rules' | 'claude-session-settings';
+export interface ManagedCliAnalysis {
+    role: string;
+    harness: string;
+    session: string;
+    workflows: ManagedCliWorkflowId[];
+    state: 'not-declared' | 'not-required' | 'unsupported' | 'supported';
+    mechanism?: ManagedCliMechanism;
+    /** Why the state is not-required or unsupported. Actionable, one per line. */
+    reasons: string[];
+    /** What the prepared policy actually grants, for disclosure. */
+    scope: string[];
+    workspace: string;
+    paths: ManagedCliPaths;
+    /** The prefix the agent types; absent unless supported. */
+    commandPrefix?: string;
+}
+export interface ManagedCliDeps {
+    platform?: NodeJS.Platform;
+    paths?: Partial<ManagedCliPaths>;
+    /** Codex version for the quoted-path qualification; read from the role's Codex when omitted. */
+    codexVersion?: string;
+}
+export declare function roleWorkspace(role: ResolvedRole, temp?: boolean): string;
+/** Decide, without touching the filesystem, what Fleet prepares for one role. */
+export declare function analyzeManagedCli(role: ResolvedRole, configPath: string | undefined, options?: ManagedCliDeps & {
+    temp?: boolean;
+    workspace?: string;
+}): ManagedCliAnalysis;
+export declare function codexRulesPath(workspace: string, configuration: string): string;
+export type RulesAction = 'created' | 'updated' | 'unchanged' | 'removed' | 'conflict';
+export interface RulesResult {
+    path: string;
+    action: RulesAction;
+    detail?: string;
+}
+/** Write this workspace's rules file and record `holder` as needing it. */
+export declare function acquireCodexRules(workspace: string, paths: ManagedCliPaths, workflows: readonly ManagedCliWorkflowId[], holder: string): RulesResult;
+/**
+ * Drop `holder` from every rules file except `keep`. A file left without a
+ * holder is removed when Fleet still owns it; a file other agents hold is left
+ * exactly as it is. This is what a launch does when the role stopped declaring
+ * the workflow, lost support, or moved to another workspace or configuration.
+ */
+export declare function releaseCodexRules(holder: string, keep?: string): RulesResult[];
+/**
+ * Bring every registered rules file of `configuration` in line with `expected`
+ * (path → persistent holders). Temporary holders stay while their state dir
+ * exists. A file nobody holds is removed if — and only if — Fleet still owns
+ * it; a file whose configuration no longer exists is obsolete and goes too.
+ */
+export declare function reconcileCodexRules(configuration: string, expected: ReadonlyMap<string, readonly string[]>, write: boolean): RulesResult[];
+/** Static comparison of the rules file with what this installation would generate. */
+export declare function inspectCodexRules(workspace: string, paths: ManagedCliPaths, workflows: readonly ManagedCliWorkflowId[]): {
+    path: string;
+    state: 'prepared' | 'missing' | 'stale' | 'conflict';
+    detail: string;
+};
+/** Whether Codex treats the workspace as trusted, which is what loads project rules. */
+export declare function codexWorkspaceTrust(workspace: string, env?: NodeJS.ProcessEnv): {
+    state: 'trusted' | 'untrusted' | 'unknown';
+    source: string;
+};
+export interface ClaudeSettingsInspection {
+    /** `unknown` when no readable source states it; Claude's default is then off. */
+    sandbox: 'enabled' | 'disabled' | 'unknown';
+    sources: string[];
+    /** Bash deny rules, which take precedence over Fleet's allow entries. */
+    bashDeny: string[];
+    unreadable: string[];
+}
+export declare function inspectClaudeSettings(workspace: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): ClaudeSettingsInspection;
+export interface ManagedCliRecord {
+    version: 1;
+    state: ManagedCliAnalysis['state'] | 'conflict';
+    mechanism?: ManagedCliMechanism;
+    workflows: ManagedCliWorkflowId[];
+    paths: ManagedCliPaths;
+    workspace: string;
+    /** Hash of everything that decides the generated policy; equal digests mean the same policy. */
+    digest: string;
+    /** When a policy with this digest was first loaded into a launch. */
+    preparedAt: string;
+    artifact?: string;
+    reasons: string[];
+}
+export declare function managedCliDigest(analysis: ManagedCliAnalysis): string;
+export declare function readManagedCliRecord(stateDir: string): ManagedCliRecord | undefined;
+/**
+ * Prepare the native policy for one launch and return the session prep to use.
+ * Never throws: a role whose policy cannot be prepared still launches, exactly
+ * as sandboxed as it was, and the reason is logged and recorded.
+ */
+export declare function prepareManagedCliLaunch(role: ResolvedRole, options: {
+    stateDir: string;
+    runCwd: string;
+    configPath?: string;
+    temp?: boolean;
+    prep: SessionPrep;
+    log(line: string): void;
+    deps?: ManagedCliDeps;
+    now?(): Date;
+}): SessionPrep;
+export interface ManagedCliObservation {
+    /** Per form, the best completed pinned invocation recorded after the current policy was loaded. */
+    current: {
+        form: string;
+        effect: ManagedCliForm['effect'];
+        at: string;
+        class: string;
+    }[];
+    /** Pinned invocations that predate the current policy: history, not verification. */
+    historical: number;
+    /** Rows pinned to a configuration other than the one this policy was prepared for. */
+    foreign: number;
+    summary: string;
+}
+/** Read the role's audit ledger without mutating or recovering it. */
+export declare function observeManagedCli(stateDir: string, record: ManagedCliRecord | undefined): ManagedCliObservation;
+export interface ManagedCliRoleReport {
+    role: string;
+    harness: string;
+    session: string;
+    workflows: ManagedCliWorkflowId[];
+    /** Generated configuration compared with this installation. Static. */
+    setup: {
+        state: 'not-declared' | 'not-required' | 'unsupported' | 'prepared' | 'missing' | 'stale' | 'conflict' | 'generated-at-launch';
+        mechanism?: ManagedCliMechanism;
+        artifact?: string;
+        action?: RulesAction;
+        detail: string;
+    };
+    /** Whether the session that is (or was last) running loaded the current policy. */
+    session_policy: 'not-applicable' | 'never-launched' | 'current' | 'restart-required';
+    /** From the audit ledger. Never inferred from `setup`. */
+    observed: ManagedCliObservation;
+    commandPrefix?: string;
+    scope: string[];
+    warnings: string[];
+}
+export interface ManagedCliReport {
+    version: 1;
+    configuration: string;
+    node: string;
+    cli: string;
+    platform: {
+        os: NodeJS.Platform;
+        declared: boolean;
+    };
+    wrote: boolean;
+    roles: ManagedCliRoleReport[];
+    removed: RulesResult[];
+    disclosure: string[];
+}
+export declare function managedCliReport(cfg: Pick<FleetConfig, 'roles'>, configPath: string | undefined, options: ManagedCliDeps & {
+    write: boolean;
+    env?: NodeJS.ProcessEnv;
+}): ManagedCliReport;
+/**
+ * Add a workflow to an existing Agent file, and nothing else. Comments, key
+ * order and every other setting — permissions included — are preserved.
+ */
+export declare function enableManagedCli(configPath: string | undefined, agent: string, workflow: ManagedCliWorkflowId): {
+    file: string;
+    changed: boolean;
+};
+/** The briefing section for a role, or nothing when it declares no workflow. */
+export declare function managedCliBriefing(role: ResolvedRole, configPath: string | undefined, temp?: boolean): string[];